hip2-server/build/hip2-server.js

/*!
 * hip2-server@1.0.0
 * Copyright (c) 2022, Matthew Zipkin (MIT)
 * https://github.com/pinheadmz/hip2-server#readme
 */

var __node_modules__ = [
[/* 0 */ 'hip2-server', '/src/derive.js', function(exports, module, __filename, __dirname, __meta) {
'use strict';

const HDPublicKey = __node_require__(1 /* 'hsd/lib/hd/public' */);
const Address = __node_require__(55 /* 'hsd/lib/primitives/address' */);
const fs = require('fs');
const path = require('path');
const http = require('http');

const MAX_INDEX = 0x7fffffff;

if (process.argv.length < 3)
  throw new Error('Usage: node build/hip2-server.js <PORT>');
const port = process.argv[2];

const xpubFile = path.join(__dirname, '..', 'conf', 'xpub');
let xpub;
try {
  xpub = fs.readFileSync(xpubFile, 'ascii');
} catch (e) {
  throw new Error('xpub file missing');
}
xpub = xpub.split('\n')[0];

if (xpub === 'xpub6DBMpym6PM3qe7Ug7BwG6zo7dinMMjpk8nmb73czsjkzPTzfQ1d5ZvqDea4uNmMVv1Y9DT6v17GuDL1x2km9FQuKqWMdnrDfRiDNrG1nTMr')
  throw new Error('Example xpub must not be used! Repalce with your own account xpub.');

const acct = HDPublicKey.fromBase58(xpub);

// For some reason when bpkg'ed with -browser modules, we need to call
// this once as a throwaway before actually using it.
// The first function call FAILS because entropy can not be found to
// "pregenerate a random blinding value" as part of the ECDSA precomputation.
// For whatever reason, the function call succeeds from here on.
// This is either a bug in bcrypto or bpkg, exposing an inconguity
// with the -browser module.
// See https://github.com/handshake-org/hsd/issues/700
acct.derive(0);

const recv = acct.derive(0);

function addr() {
  const indexFile = path.join(__dirname, '..', 'log', 'hip2-index');
  let index = 0;
  try {
    index = parseInt(fs.readFileSync(indexFile, 'utf-8'));
  } catch (e) {
    ;
  }

  fs.writeFileSync(indexFile, String(index + 1), 'utf-8');

  // Wow, used all our non-hardened addresses!
  // Don't roll over the saved index (that way the user knows this has happened)
  // but start over the address space and reuse addresses starting again at 0.
  if (index >= MAX_INDEX)
    index -= MAX_INDEX;

  const pk = recv.derive(index);
  const addr = Address.fromPubkey(pk.publicKey).toString();
  return addr;
}

const requestListener = function (req, res) {
  res.writeHead(200);
  res.end(addr());
};

const server = http.createServer(requestListener);
server.listen({port});
}],
[/* 1 */ 'hsd', '/lib/hd/public.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * public.js - hd public keys for hsd
 * Copyright (c) 2017-2018, Christopher Jeffrey (MIT License).
 * https://github.com/handshake-org/hsd
 */

'use strict';

const assert = __node_require__(2 /* 'bsert' */);
const bio = __node_require__(3 /* 'bufio' */);
const base58 = __node_require__(12 /* 'bcrypto/lib/encoding/base58' */);
const sha512 = __node_require__(15 /* 'bcrypto/lib/sha512' */);
const hash160 = __node_require__(18 /* 'bcrypto/lib/hash160' */);
const hash256 = __node_require__(22 /* 'bcrypto/lib/hash256' */);
const cleanse = __node_require__(24 /* 'bcrypto/lib/cleanse' */);
const secp256k1 = __node_require__(28 /* 'bcrypto/lib/secp256k1' */);
const Network = __node_require__(44 /* '../protocol/network' */);
const consensus = __node_require__(51 /* '../protocol/consensus' */);
const common = __node_require__(52 /* './common' */);

/**
 * HDPublicKey
 * @alias module:hd.PublicKey
 * @property {Number} depth
 * @property {Number} parentFingerPrint
 * @property {Number} childIndex
 * @property {Buffer} chainCode
 * @property {Buffer} publicKey
 */

class HDPublicKey extends bio.Struct {
  /**
   * Create an HD public key.
   * @constructor
   * @param {Object|Base58String} options
   * @param {Base58String?} options.xkey - Serialized base58 key.
   * @param {Number?} options.depth
   * @param {Number?} options.parentFingerPrint
   * @param {Number?} options.childIndex
   * @param {Buffer?} options.chainCode
   * @param {Buffer?} options.publicKey
   */

  constructor(options) {
    super();

    this.depth = 0;
    this.parentFingerPrint = 0;
    this.childIndex = 0;
    this.chainCode = consensus.ZERO_HASH;
    this.publicKey = common.ZERO_KEY;

    this.fingerPrint = -1;

    if (options)
      this.fromOptions(options);
  }

  /**
   * Inject properties from options object.
   * @private
   * @param {Object} options
   */

  fromOptions(options) {
    assert(options, 'No options for HDPublicKey');
    assert((options.depth & 0xff) === options.depth);
    assert((options.parentFingerPrint >>> 0) === options.parentFingerPrint);
    assert((options.childIndex >>> 0) === options.childIndex);
    assert(Buffer.isBuffer(options.chainCode));
    assert(Buffer.isBuffer(options.publicKey));

    this.depth = options.depth;
    this.parentFingerPrint = options.parentFingerPrint;
    this.childIndex = options.childIndex;
    this.chainCode = options.chainCode;
    this.publicKey = options.publicKey;

    return this;
  }

  /**
   * Get HD public key (self).
   * @returns {HDPublicKey}
   */

  toPublic() {
    return this;
  }

  /**
   * Get cached base58 xprivkey (always null here).
   * @returns {null}
   */

  xprivkey(network) {
    return null;
  }

  /**
   * Get cached base58 xpubkey.
   * @returns {Base58String}
   */

  xpubkey(network) {
    return this.toBase58(network);
  }

  /**
   * Destroy the key (zeroes chain code and pubkey).
   */

  destroy() {
    this.depth = 0;
    this.childIndex = 0;
    this.parentFingerPrint = 0;

    cleanse(this.chainCode);
    cleanse(this.publicKey);

    this.fingerPrint = -1;
  }

  /**
   * Derive a child key.
   * @param {Number} index - Derivation index.
   * @param {Boolean?} hardened - Whether the derivation
   * should be hardened (throws if true).
   * @returns {HDPrivateKey}
   * @throws on `hardened`
   */

  derive(index, hardened) {
    assert(typeof index === 'number');

    if ((index >>> 0) !== index)
      throw new Error('Index out of range.');

    if ((index & common.HARDENED) || hardened)
      throw new Error('Cannot derive hardened.');

    if (this.depth >= 0xff)
      throw new Error('Depth too high.');

    const id = this.getID(index);
    const cache = common.cache.get(id);

    if (cache)
      return cache;

    const bw = bio.pool(37);

    bw.writeBytes(this.publicKey);
    bw.writeU32BE(index);

    const data = bw.render();

    const hash = sha512.mac(data, this.chainCode);
    const left = hash.slice(0, 32);
    const right = hash.slice(32, 64);

    let key;
    try {
      key = secp256k1.publicKeyTweakAdd(this.publicKey, left, true);
    } catch (e) {
      return this.derive(index + 1);
    }

    if (this.fingerPrint === -1) {
      const fp = hash160.digest(this.publicKey);
      this.fingerPrint = fp.readUInt32BE(0, true);
    }

    const child = new this.constructor();
    child.depth = this.depth + 1;
    child.parentFingerPrint = this.fingerPrint;
    child.childIndex = index;
    child.chainCode = right;
    child.publicKey = key;

    common.cache.set(id, child);

    return child;
  }

  /**
   * Unique HD key ID.
   * @private
   * @param {Number} index
   * @returns {String}
   */

  getID(index) {
    return 'b' + this.publicKey.toString('hex') + index;
  }

  /**
   * Derive a BIP44 account key (does not derive, only ensures account key).
   * @method
   * @param {Number} purpose
   * @param {Number} type
   * @param {Number} account
   * @returns {HDPublicKey}
   * @throws Error if key is not already an account key.
   */

  deriveAccount(purpose, type, account) {
    assert((purpose >>> 0) === purpose);
    assert((type >>> 0) === type);
    assert((account >>> 0) === account);
    assert(this.isAccount(account), 'Cannot derive account index.');
    return this;
  }

  /**
   * Test whether the key is a master key.
   * @method
   * @returns {Boolean}
   */

  isMaster() {
    return common.isMaster(this);
  }

  /**
   * Test whether the key is (most likely) a BIP44 account key.
   * @method
   * @param {Number?} account
   * @returns {Boolean}
   */

  isAccount(account) {
    return common.isAccount(this, account);
  }

  /**
   * Test whether a string is a valid path.
   * @param {String} path
   * @param {Boolean?} hardened
   * @returns {Boolean}
   */

  static isValidPath(path) {
    try {
      common.parsePath(path, false);
      return true;
    } catch (e) {
      return false;
    }
  }

  /**
   * Derive a key from a derivation path.
   * @param {String} path
   * @returns {HDPublicKey}
   * @throws Error if `path` is not a valid path.
   * @throws Error if hardened.
   */

  derivePath(path) {
    const indexes = common.parsePath(path, false);

    let key = this;

    for (const index of indexes)
      key = key.derive(index);

    return key;
  }

  /**
   * Compare a key against an object.
   * @param {Object} obj
   * @returns {Boolean}
   */

  equals(obj) {
    assert(HDPublicKey.isHDPublicKey(obj));

    return this.depth === obj.depth
      && this.parentFingerPrint === obj.parentFingerPrint
      && this.childIndex === obj.childIndex
      && this.chainCode.equals(obj.chainCode)
      && this.publicKey.equals(obj.publicKey);
  }

  /**
   * Compare a key against an object.
   * @param {Object} obj
   * @returns {Boolean}
   */

  compare(key) {
    assert(HDPublicKey.isHDPublicKey(key));

    let cmp = this.depth - key.depth;

    if (cmp !== 0)
      return cmp;

    cmp = this.parentFingerPrint - key.parentFingerPrint;

    if (cmp !== 0)
      return cmp;

    cmp = this.childIndex - key.childIndex;

    if (cmp !== 0)
      return cmp;

    cmp = this.chainCode.compare(key.chainCode);

    if (cmp !== 0)
      return cmp;

    cmp = this.publicKey.compare(key.publicKey);

    if (cmp !== 0)
      return cmp;

    return 0;
  }

  /**
   * Convert key to a more json-friendly object.
   * @returns {Object}
   */

  getJSON(network) {
    return {
      xpubkey: this.xpubkey(network)
    };
  }

  /**
   * Inject properties from json object.
   * @private
   * @param {Object} json
   * @param {Network?} network
   */

  fromJSON(json, network) {
    assert(json.xpubkey, 'Could not handle HD key JSON.');
    this.fromBase58(json.xpubkey, network);
    return this;
  }

  /**
   * Test whether an object is in the form of a base58 xpubkey.
   * @param {String} data
   * @param {(Network|NetworkType)?} network
   * @returns {Boolean}
   */

  static isBase58(data, network) {
    if (typeof data !== 'string')
      return false;

    if (data.length < 4)
      return false;

    const prefix = data.substring(0, 4);

    try {
      Network.fromPublic58(prefix, network);
      return true;
    } catch (e) {
      return false;
    }
  }

  /**
   * Test whether a buffer has a valid network prefix.
   * @param {Buffer} data
   * @param {(Network|NetworkType)?} network
   * @returns {NetworkType}
   */

  static isRaw(data, network) {
    if (!Buffer.isBuffer(data))
      return false;

    if (data.length < 4)
      return false;

    const version = data.readUInt32BE(0, true);

    try {
      Network.fromPublic(version, network);
      return true;
    } catch (e) {
      return false;
    }
  }

  /**
   * Inject properties from a base58 key.
   * @private
   * @param {Base58String} xkey
   * @param {Network?} network
   */

  fromBase58(xkey, network) {
    assert(typeof xkey === 'string');
    return this.decode(base58.decode(xkey), network);
  }

  /**
   * Inject properties from serialized data.
   * @private
   * @param {BufferReader} br
   * @param {(Network|NetworkType)?} network
   */

  read(br, network) {
    const version = br.readU32BE();

    Network.fromPublic(version, network);

    this.depth = br.readU8();
    this.parentFingerPrint = br.readU32BE();
    this.childIndex = br.readU32BE();
    this.chainCode = br.readBytes(32);
    this.publicKey = br.readBytes(33);

    br.verifyChecksum(hash256.digest);

    return this;
  }

  /**
   * Serialize key data to base58 extended key.
   * @param {(Network|NetworkType)?} network
   * @returns {Base58String}
   */

  toBase58(network) {
    return base58.encode(this.encode(network));
  }

  /**
   * Write the key to a buffer writer.
   * @param {BufferWriter} bw
   * @param {(Network|NetworkType)?} network
   */

  write(bw, network) {
    network = Network.get(network);

    bw.writeU32BE(network.keyPrefix.xpubkey);
    bw.writeU8(this.depth);
    bw.writeU32BE(this.parentFingerPrint);
    bw.writeU32BE(this.childIndex);
    bw.writeBytes(this.chainCode);
    bw.writeBytes(this.publicKey);
    bw.writeChecksum(hash256.digest);

    return bw;
  }

  /**
   * Calculate serialization size.
   * @returns {Number}
   */

  getSize() {
    return 82;
  }

  /**
   * Instantiate an HD public key from a base58 string.
   * @param {Base58String} xkey
   * @param {Network?} network
   * @returns {HDPublicKey}
   */

  static fromBase58(xkey, network) {
    return new this().fromBase58(xkey, network);
  }

  /**
   * Test whether an object is a HDPublicKey.
   * @param {Object} obj
   * @returns {Boolean}
   */

  static isHDPublicKey(obj) {
    return obj instanceof HDPublicKey;
  }
}

/*
 * Expose
 */

module.exports = HDPublicKey;
}],
[/* 2 */ 'bsert', '/lib/assert.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * assert.js - assertions for javascript
 * Copyright (c) 2018, Christopher Jeffrey (MIT License).
 * https://github.com/chjj/bsert
 */

'use strict';

/**
 * AssertionError
 */

class AssertionError extends Error {
  constructor(options) {
    if (typeof options === 'string')
      options = { message: options };

    if (options === null || typeof options !== 'object')
      options = {};

    let message = null;
    let operator = 'fail';
    let generatedMessage = Boolean(options.generatedMessage);

    if (options.message != null)
      message = toString(options.message);

    if (typeof options.operator === 'string')
      operator = options.operator;

    if (message == null) {
      if (operator === 'fail') {
        message = 'Assertion failed.';
      } else {
        const a = stringify(options.actual);
        const b = stringify(options.expected);

        message = `${a} ${operator} ${b}`;
      }

      generatedMessage = true;
    }

    super(message);

    let start = this.constructor;

    if (typeof options.stackStartFunction === 'function')
      start = options.stackStartFunction;
    else if (typeof options.stackStartFn === 'function')
      start = options.stackStartFn;

    this.type = 'AssertionError';
    this.name = 'AssertionError [ERR_ASSERTION]';
    this.code = 'ERR_ASSERTION';
    this.generatedMessage = generatedMessage;
    this.actual = options.actual;
    this.expected = options.expected;
    this.operator = operator;

    if (Error.captureStackTrace)
      Error.captureStackTrace(this, start);
  }
}

/*
 * Assert
 */

function assert(value, message) {
  if (!value) {
    let generatedMessage = false;

    if (arguments.length === 0) {
      message = 'No value argument passed to `assert()`.';
      generatedMessage = true;
    } else if (message == null) {
      message = 'Assertion failed.';
      generatedMessage = true;
    } else if (isError(message)) {
      throw message;
    }

    throw new AssertionError({
      message,
      actual: value,
      expected: true,
      operator: '==',
      generatedMessage,
      stackStartFn: assert
    });
  }
}

function equal(actual, expected, message) {
  if (!Object.is(actual, expected)) {
    if (isError(message))
      throw message;

    throw new AssertionError({
      message,
      actual,
      expected,
      operator: 'strictEqual',
      stackStartFn: equal
    });
  }
}

function notEqual(actual, expected, message) {
  if (Object.is(actual, expected)) {
    if (isError(message))
      throw message;

    throw new AssertionError({
      message,
      actual,
      expected,
      operator: 'notStrictEqual',
      stackStartFn: notEqual
    });
  }
}

function fail(message) {
  let generatedMessage = false;

  if (isError(message))
    throw message;

  if (message == null) {
    message = 'Assertion failed.';
    generatedMessage = true;
  }

  throw new AssertionError({
    message,
    actual: false,
    expected: true,
    operator: 'fail',
    generatedMessage,
    stackStartFn: fail
  });
}

function throws(func, expected, message) {
  if (typeof expected === 'string') {
    message = expected;
    expected = undefined;
  }

  let thrown = false;
  let err = null;

  enforce(typeof func === 'function', 'func', 'function');

  try {
    func();
  } catch (e) {
    thrown = true;
    err = e;
  }

  if (!thrown) {
    let generatedMessage = false;

    if (message == null) {
      message = 'Missing expected exception.';
      generatedMessage = true;
    }

    throw new AssertionError({
      message,
      actual: undefined,
      expected,
      operator: 'throws',
      generatedMessage,
      stackStartFn: throws
    });
  }

  if (!testError(err, expected, message, throws))
    throw err;
}

function doesNotThrow(func, expected, message) {
  if (typeof expected === 'string') {
    message = expected;
    expected = undefined;
  }

  let thrown = false;
  let err = null;

  enforce(typeof func === 'function', 'func', 'function');

  try {
    func();
  } catch (e) {
    thrown = true;
    err = e;
  }

  if (!thrown)
    return;

  if (testError(err, expected, message, doesNotThrow)) {
    let generatedMessage = false;

    if (message == null) {
      message = 'Got unwanted exception.';
      generatedMessage = true;
    }

    throw new AssertionError({
      message,
      actual: err,
      expected,
      operator: 'doesNotThrow',
      generatedMessage,
      stackStartFn: doesNotThrow
    });
  }

  throw err;
}

async function rejects(func, expected, message) {
  if (typeof expected === 'string') {
    message = expected;
    expected = undefined;
  }

  let thrown = false;
  let err = null;

  if (typeof func !== 'function')
    enforce(isPromise(func), 'func', 'promise');

  try {
    if (isPromise(func))
      await func;
    else
      await func();
  } catch (e) {
    thrown = true;
    err = e;
  }

  if (!thrown) {
    let generatedMessage = false;

    if (message == null) {
      message = 'Missing expected rejection.';
      generatedMessage = true;
    }

    throw new AssertionError({
      message,
      actual: undefined,
      expected,
      operator: 'rejects',
      generatedMessage,
      stackStartFn: rejects
    });
  }

  if (!testError(err, expected, message, rejects))
    throw err;
}

async function doesNotReject(func, expected, message) {
  if (typeof expected === 'string') {
    message = expected;
    expected = undefined;
  }

  let thrown = false;
  let err = null;

  if (typeof func !== 'function')
    enforce(isPromise(func), 'func', 'promise');

  try {
    if (isPromise(func))
      await func;
    else
      await func();
  } catch (e) {
    thrown = true;
    err = e;
  }

  if (!thrown)
    return;

  if (testError(err, expected, message, doesNotReject)) {
    let generatedMessage = false;

    if (message == null) {
      message = 'Got unwanted rejection.';
      generatedMessage = true;
    }

    throw new AssertionError({
      message,
      actual: undefined,
      expected,
      operator: 'doesNotReject',
      generatedMessage,
      stackStartFn: doesNotReject
    });
  }

  throw err;
}

function ifError(err) {
  if (err != null) {
    let message = 'ifError got unwanted exception: ';

    if (typeof err === 'object' && typeof err.message === 'string') {
      if (err.message.length === 0 && err.constructor)
        message += err.constructor.name;
      else
        message += err.message;
    } else {
      message += stringify(err);
    }

    throw new AssertionError({
      message,
      actual: err,
      expected: null,
      operator: 'ifError',
      generatedMessage: true,
      stackStartFn: ifError
    });
  }
}

function deepEqual(actual, expected, message) {
  if (!isDeepEqual(actual, expected, false)) {
    if (isError(message))
      throw message;

    throw new AssertionError({
      message,
      actual,
      expected,
      operator: 'deepStrictEqual',
      stackStartFn: deepEqual
    });
  }
}

function notDeepEqual(actual, expected, message) {
  if (isDeepEqual(actual, expected, true)) {
    if (isError(message))
      throw message;

    throw new AssertionError({
      message,
      actual,
      expected,
      operator: 'notDeepStrictEqual',
      stackStartFn: notDeepEqual
    });
  }
}

function bufferEqual(actual, expected, enc, message) {
  if (!isEncoding(enc)) {
    message = enc;
    enc = null;
  }

  if (enc == null)
    enc = 'hex';

  expected = bufferize(actual, expected, enc);

  enforce(isBuffer(actual), 'actual', 'buffer');
  enforce(isBuffer(expected), 'expected', 'buffer');

  if (actual !== expected && !actual.equals(expected)) {
    if (isError(message))
      throw message;

    throw new AssertionError({
      message,
      actual: actual.toString(enc),
      expected: expected.toString(enc),
      operator: 'bufferEqual',
      stackStartFn: bufferEqual
    });
  }
}

function notBufferEqual(actual, expected, enc, message) {
  if (!isEncoding(enc)) {
    message = enc;
    enc = null;
  }

  if (enc == null)
    enc = 'hex';

  expected = bufferize(actual, expected, enc);

  enforce(isBuffer(actual), 'actual', 'buffer');
  enforce(isBuffer(expected), 'expected', 'buffer');

  if (actual === expected || actual.equals(expected)) {
    if (isError(message))
      throw message;

    throw new AssertionError({
      message,
      actual: actual.toString(enc),
      expected: expected.toString(enc),
      operator: 'notBufferEqual',
      stackStartFn: notBufferEqual
    });
  }
}

function enforce(value, name, type) {
  if (!value) {
    let msg;

    if (name == null) {
      msg = 'Invalid type for parameter.';
    } else {
      if (type == null)
        msg = `Invalid type for "${name}".`;
      else
        msg = `"${name}" must be a(n) ${type}.`;
    }

    const err = new TypeError(msg);

    if (Error.captureStackTrace)
      Error.captureStackTrace(err, enforce);

    throw err;
  }
}

function range(value, name) {
  if (!value) {
    const msg = name != null
      ? `"${name}" is out of range.`
      : 'Parameter is out of range.';

    const err = new RangeError(msg);

    if (Error.captureStackTrace)
      Error.captureStackTrace(err, range);

    throw err;
  }
}

/*
 * Stringification
 */

function stringify(value) {
  switch (typeof value) {
    case 'undefined':
      return 'undefined';
    case 'object':
      if (value === null)
        return 'null';
      return `[${objectName(value)}]`;
    case 'boolean':
      return `${value}`;
    case 'number':
      return `${value}`;
    case 'string':
      if (value.length > 80)
        value = `${value.substring(0, 77)}...`;
      return JSON.stringify(value);
    case 'symbol':
      return tryString(value);
    case 'function':
      return `[${funcName(value)}]`;
    case 'bigint':
      return `${value}n`;
    default:
      return `[${typeof value}]`;
  }
}

function toString(value) {
  if (typeof value === 'string')
    return value;

  if (isError(value))
    return tryString(value);

  return stringify(value);
}

function tryString(value) {
  try {
    return String(value);
  } catch (e) {
    return 'Object';
  }
}

/*
 * Error Testing
 */

function testError(err, expected, message, func) {
  if (expected == null)
    return true;

  if (isRegExp(expected))
    return expected.test(err);

  if (typeof expected !== 'function') {
    if (func === doesNotThrow || func === doesNotReject)
      throw new TypeError('"expected" must not be an object.');

    if (typeof expected !== 'object')
      throw new TypeError('"expected" must be an object.');

    let generatedMessage = false;

    if (message == null) {
      const name = func === rejects ? 'rejection' : 'exception';
      message = `Missing expected ${name}.`;
      generatedMessage = true;
    }

    if (err == null || typeof err !== 'object') {
      throw new AssertionError({
        actual: err,
        expected,
        message,
        operator: func.name,
        generatedMessage,
        stackStartFn: func
      });
    }

    const keys = Object.keys(expected);

    if (isError(expected))
      keys.push('name', 'message');

    if (keys.length === 0)
      throw new TypeError('"expected" may not be an empty object.');

    for (const key of keys) {
      const expect = expected[key];
      const value = err[key];

      if (typeof value === 'string'
          && isRegExp(expect)
          && expect.test(value)) {
        continue;
      }

      if ((key in err) && isDeepEqual(value, expect, false))
        continue;

      throw new AssertionError({
        actual: err,
        expected: expected,
        message,
        operator: func.name,
        generatedMessage,
        stackStartFn: func
      });
    }

    return true;
  }

  if (expected.prototype !== undefined && (err instanceof expected))
    return true;

  if (Error.isPrototypeOf(expected))
    return false;

  return expected.call({}, err) === true;
}

/*
 * Comparisons
 */

function isDeepEqual(x, y, fail) {
  try {
    return compare(x, y, null);
  } catch (e) {
    return fail;
  }
}

function compare(a, b, cache) {
  // Primitives.
  if (Object.is(a, b))
    return true;

  if (!isObject(a) || !isObject(b))
    return false;

  // Semi-primitives.
  if (objectString(a) !== objectString(b))
    return false;

  if (Object.getPrototypeOf(a) !== Object.getPrototypeOf(b))
    return false;

  if (isBuffer(a) && isBuffer(b))
    return a.equals(b);

  if (isDate(a))
    return Object.is(a.getTime(), b.getTime());

  if (isRegExp(a)) {
    return a.source === b.source
        && a.global === b.global
        && a.multiline === b.multiline
        && a.lastIndex === b.lastIndex
        && a.ignoreCase === b.ignoreCase;
  }

  if (isError(a)) {
    if (a.message !== b.message)
      return false;
  }

  if (isArrayBuffer(a)) {
    a = new Uint8Array(a);
    b = new Uint8Array(b);
  }

  if (isView(a) && !isBuffer(a)) {
    if (isBuffer(b))
      return false;

    const x = new Uint8Array(a.buffer);
    const y = new Uint8Array(b.buffer);

    if (x.length !== y.length)
      return false;

    for (let i = 0; i < x.length; i++) {
      if (x[i] !== y[i])
        return false;
    }

    return true;
  }

  if (isSet(a)) {
    if (a.size !== b.size)
      return false;

    const keys = new Set([...a, ...b]);

    return keys.size === a.size;
  }

  // Recursive.
  if (!cache) {
    cache = {
      a: new Map(),
      b: new Map(),
      p: 0
    };
  } else {
    const aa = cache.a.get(a);

    if (aa != null) {
      const bb = cache.b.get(b);
      if (bb != null)
        return aa === bb;
    }

    cache.p += 1;
  }

  cache.a.set(a, cache.p);
  cache.b.set(b, cache.p);

  const ret = recurse(a, b, cache);

  cache.a.delete(a);
  cache.b.delete(b);

  return ret;
}

function recurse(a, b, cache) {
  if (isMap(a)) {
    if (a.size !== b.size)
      return false;

    const keys = new Set([...a.keys(), ...b.keys()]);

    if (keys.size !== a.size)
      return false;

    for (const key of keys) {
      if (!compare(a.get(key), b.get(key), cache))
        return false;
    }

    return true;
  }

  if (isArray(a)) {
    if (a.length !== b.length)
      return false;

    for (let i = 0; i < a.length; i++) {
      if (!compare(a[i], b[i], cache))
        return false;
    }

    return true;
  }

  const ak = ownKeys(a);
  const bk = ownKeys(b);

  if (ak.length !== bk.length)
    return false;

  const keys = new Set([...ak, ...bk]);

  if (keys.size !== ak.length)
    return false;

  for (const key of keys) {
    if (!compare(a[key], b[key], cache))
      return false;
  }

  return true;
}

function ownKeys(obj) {
  const keys = Object.keys(obj);

  if (!Object.getOwnPropertySymbols)
    return keys;

  if (!Object.getOwnPropertyDescriptor)
    return keys;

  const symbols = Object.getOwnPropertySymbols(obj);

  for (const symbol of symbols) {
    const desc = Object.getOwnPropertyDescriptor(obj, symbol);

    if (desc && desc.enumerable)
      keys.push(symbol);
  }

  return keys;
}

/*
 * Helpers
 */

function objectString(obj) {
  if (obj === undefined)
    return '[object Undefined]';

  if (obj === null)
    return '[object Null]';

  try {
    return Object.prototype.toString.call(obj);
  } catch (e) {
    return '[object Object]';
  }
}

function objectType(obj) {
  return objectString(obj).slice(8, -1);
}

function objectName(obj) {
  const type = objectType(obj);

  if (obj == null)
    return type;

  if (type !== 'Object' && type !== 'Error')
    return type;

  let ctor, name;

  try {
    ctor = obj.constructor;
  } catch (e) {
    ;
  }

  if (ctor == null)
    return type;

  try {
    name = ctor.name;
  } catch (e) {
    return type;
  }

  if (typeof name !== 'string' || name.length === 0)
    return type;

  return name;
}

function funcName(func) {
  let name;

  try {
    name = func.name;
  } catch (e) {
    ;
  }

  if (typeof name !== 'string' || name.length === 0)
    return 'Function';

  return `Function: ${name}`;
}

function isArray(obj) {
  return Array.isArray(obj);
}

function isArrayBuffer(obj) {
  return obj instanceof ArrayBuffer;
}

function isBuffer(obj) {
  return isObject(obj)
      && typeof obj.writeUInt32LE === 'function'
      && typeof obj.equals === 'function';
}

function isDate(obj) {
  return obj instanceof Date;
}

function isError(obj) {
  return obj instanceof Error;
}

function isMap(obj) {
  return obj instanceof Map;
}

function isObject(obj) {
  return obj && typeof obj === 'object';
}

function isPromise(obj) {
  return obj instanceof Promise;
}

function isRegExp(obj) {
  return obj instanceof RegExp;
}

function isSet(obj) {
  return obj instanceof Set;
}

function isView(obj) {
  return ArrayBuffer.isView(obj);
}

function isEncoding(enc) {
  if (typeof enc !== 'string')
    return false;

  switch (enc) {
    case 'ascii':
    case 'binary':
    case 'base64':
    case 'hex':
    case 'latin1':
    case 'ucs2':
    case 'utf8':
    case 'utf16le':
      return true;
  }

  return false;
}

function bufferize(actual, expected, enc) {
  if (typeof expected === 'string') {
    if (!isBuffer(actual))
      return null;

    const {constructor} = actual;

    if (!constructor || typeof constructor.from !== 'function')
      return null;

    if (!isEncoding(enc))
      return null;

    if (enc === 'hex' && (expected.length & 1))
      return null;

    const raw = constructor.from(expected, enc);

    if (enc === 'hex' && raw.length !== (expected.length >>> 1))
      return null;

    return raw;
  }

  return expected;
}

/*
 * API
 */

assert.AssertionError = AssertionError;
assert.assert = assert;
assert.strict = assert;
assert.ok = assert;
assert.equal = equal;
assert.notEqual = notEqual;
assert.strictEqual = equal;
assert.notStrictEqual = notEqual;
assert.fail = fail;
assert.throws = throws;
assert.doesNotThrow = doesNotThrow;
assert.rejects = rejects;
assert.doesNotReject = doesNotReject;
assert.ifError = ifError;
assert.deepEqual = deepEqual;
assert.notDeepEqual = notDeepEqual;
assert.deepStrictEqual = deepEqual;
assert.notDeepStrictEqual = notDeepEqual;
assert.bufferEqual = bufferEqual;
assert.notBufferEqual = notBufferEqual;
assert.enforce = enforce;
assert.range = range;

/*
 * Expose
 */

module.exports = assert;
}],
[/* 3 */ 'bufio', '/lib/bufio.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * bufio.js - buffer utilities for javascript
 * Copyright (c) 2014-2017, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcoin
 */

'use strict';

const custom = __node_require__(4 /* './custom' */);
const encoding = __node_require__(5 /* './encoding' */);
const enforce = __node_require__(6 /* './enforce' */);
const EncodingError = __node_require__(7 /* './error' */);
const BufferReader = __node_require__(8 /* './reader' */);
const BufferWriter = __node_require__(9 /* './writer' */);
const StaticWriter = __node_require__(10 /* './staticwriter' */);
const Struct = __node_require__(11 /* './struct' */);

exports.custom = custom;
exports.encoding = encoding;
exports.EncodingError = EncodingError;
exports.BufferReader = BufferReader;
exports.BufferWriter = BufferWriter;
exports.StaticWriter = StaticWriter;
exports.Struct = Struct;

exports.read = function read(data, zeroCopy) {
  return new BufferReader(data, zeroCopy);
};

exports.write = function write(size) {
  return size != null
    ? new StaticWriter(size)
    : new BufferWriter();
};

exports.pool = function pool(size) {
  return StaticWriter.pool(size);
};

function _read(func, size) {
  return function(data, off) {
    enforce(Buffer.isBuffer(data), 'data', 'buffer');
    enforce((off >>> 0) === off, 'off', 'integer');

    if (off + size > data.length)
      throw new EncodingError(off, 'Out of bounds read');

    return func(data, off);
  };
}

function _readn(func) {
  return function(data, off, len) {
    enforce(Buffer.isBuffer(data), 'data', 'buffer');
    enforce((off >>> 0) === off, 'off', 'integer');
    enforce((len >>> 0) === len, 'len', 'integer');

    if (off + len > data.length)
      throw new EncodingError(off, 'Out of bounds read');

    return func(data, off, len);
  };
}

function _readvar(func) {
  return function(data, off) {
    enforce(Buffer.isBuffer(data), 'data', 'buffer');
    enforce((off >>> 0) === off, 'off', 'integer');
    return func(data, off);
  };
}

function _write(func, size) {
  return function(data, num, off) {
    enforce(Buffer.isBuffer(data), 'data', 'buffer');
    enforce((off >>> 0) === off, 'off', 'integer');

    if (off + size > data.length)
      throw new EncodingError(off, 'Out of bounds write');

    return func(data, num, off);
  };
}

function _writen(func) {
  return function(data, num, off, len) {
    enforce(Buffer.isBuffer(data), 'data', 'buffer');
    enforce((off >>> 0) === off, 'off', 'integer');
    enforce((len >>> 0) === len, 'len', 'integer');

    if (off + len > data.length)
      throw new EncodingError(off, 'Out of bounds write');

    return func(data, num, off, len);
  };
}

function _writecb(func, size) {
  return function(data, num, off) {
    enforce(Buffer.isBuffer(data), 'data', 'buffer');
    enforce((off >>> 0) === off, 'off', 'integer');

    if (off + size(num) > data.length)
      throw new EncodingError(off, 'Out of bounds write');

    return func(data, num, off);
  };
}

exports.readU = _readn(encoding.readU);
exports.readU64 = _read(encoding.readU64, 8);
exports.readU56 = _read(encoding.readU56, 7);
exports.readU48 = _read(encoding.readU48, 6);
exports.readU40 = _read(encoding.readU40, 5);
exports.readU32 = _read(encoding.readU32, 4);
exports.readU24 = _read(encoding.readU24, 3);
exports.readU16 = _read(encoding.readU16, 2);
exports.readU8 = _read(encoding.readU8, 1);

exports.readUBE = _readn(encoding.readUBE);
exports.readU64BE = _read(encoding.readU64BE, 8);
exports.readU56BE = _read(encoding.readU56BE, 7);
exports.readU48BE = _read(encoding.readU48BE, 6);
exports.readU40BE = _read(encoding.readU40BE, 5);
exports.readU32BE = _read(encoding.readU32BE, 4);
exports.readU24BE = _read(encoding.readU24BE, 3);
exports.readU16BE = _read(encoding.readU16BE, 2);

exports.readI = _readn(encoding.readI);
exports.readI64 = _read(encoding.readI64, 8);
exports.readI56 = _read(encoding.readI56, 7);
exports.readI48 = _read(encoding.readI48, 6);
exports.readI40 = _read(encoding.readI40, 5);
exports.readI32 = _read(encoding.readI32, 4);
exports.readI24 = _read(encoding.readI24, 3);
exports.readI16 = _read(encoding.readI16, 2);
exports.readI8 = _read(encoding.readI8, 1);

exports.readIBE = _readn(encoding.readIBE);
exports.readI64BE = _read(encoding.readI64BE, 8);
exports.readI56BE = _read(encoding.readI56BE, 7);
exports.readI48BE = _read(encoding.readI48BE, 6);
exports.readI40BE = _read(encoding.readI40BE, 5);
exports.readI32BE = _read(encoding.readI32BE, 4);
exports.readI24BE = _read(encoding.readI24BE, 3);
exports.readI16BE = _read(encoding.readI16BE, 2);

exports.readFloat = _read(encoding.readFloat, 4);
exports.readFloatBE = _read(encoding.readFloatBE, 4);
exports.readDouble = _read(encoding.readDouble, 8);
exports.readDoubleBE = _read(encoding.readDoubleBE, 8);

exports.writeU = _writen(encoding.writeU);
exports.writeU64 = _write(encoding.writeU64, 8);
exports.writeU56 = _write(encoding.writeU56, 7);
exports.writeU48 = _write(encoding.writeU48, 6);
exports.writeU40 = _write(encoding.writeU40, 5);
exports.writeU32 = _write(encoding.writeU32, 4);
exports.writeU24 = _write(encoding.writeU24, 3);
exports.writeU16 = _write(encoding.writeU16, 2);
exports.writeU8 = _write(encoding.writeU8, 1);

exports.writeUBE = _writen(encoding.writeUBE);
exports.writeU64BE = _write(encoding.writeU64BE, 8);
exports.writeU56BE = _write(encoding.writeU56BE, 7);
exports.writeU48BE = _write(encoding.writeU48BE, 6);
exports.writeU40BE = _write(encoding.writeU40BE, 5);
exports.writeU32BE = _write(encoding.writeU32BE, 4);
exports.writeU24BE = _write(encoding.writeU24BE, 3);
exports.writeU16BE = _write(encoding.writeU16BE, 2);

exports.writeI = _writen(encoding.writeI);
exports.writeI64 = _write(encoding.writeI64, 8);
exports.writeI56 = _write(encoding.writeI56, 7);
exports.writeI48 = _write(encoding.writeI48, 6);
exports.writeI40 = _write(encoding.writeI40, 5);
exports.writeI32 = _write(encoding.writeI32, 4);
exports.writeI24 = _write(encoding.writeI24, 3);
exports.writeI16 = _write(encoding.writeI16, 2);
exports.writeI8 = _write(encoding.writeI8, 1);

exports.writeIBE = _writen(encoding.writeIBE);
exports.writeI64BE = _write(encoding.writeI64BE, 8);
exports.writeI56BE = _write(encoding.writeI56BE, 7);
exports.writeI48BE = _write(encoding.writeI48BE, 6);
exports.writeI40BE = _write(encoding.writeI40BE, 5);
exports.writeI32BE = _write(encoding.writeI32BE, 4);
exports.writeI24BE = _write(encoding.writeI24BE, 3);
exports.writeI16BE = _write(encoding.writeI16BE, 2);

exports.writeFloat = _write(encoding.writeFloat, 4);
exports.writeFloatBE = _write(encoding.writeFloatBE, 4);
exports.writeDouble = _write(encoding.writeDouble, 8);
exports.writeDoubleBE = _write(encoding.writeDoubleBE, 8);

exports.readVarint = _readvar(encoding.readVarint);
exports.writeVarint = _writecb(encoding.writeVarint, encoding.sizeVarint);
exports.sizeVarint = encoding.sizeVarint;
exports.readVarint2 = _readvar(encoding.readVarint2);
exports.writeVarint2 = _writecb(encoding.writeVarint2, encoding.sizeVarint2);
exports.sizeVarint2 = encoding.sizeVarint2;

exports.sliceBytes = encoding.sliceBytes;
exports.readBytes = encoding.readBytes;
exports.writeBytes = encoding.writeBytes;
exports.readString = encoding.readString;
exports.writeString = encoding.writeString;

exports.realloc = encoding.realloc;
exports.copy = encoding.copy;
exports.concat = encoding.concat;

exports.sizeVarBytes = encoding.sizeVarBytes;
exports.sizeVarlen = encoding.sizeVarlen;
exports.sizeVarString = encoding.sizeVarString;
}],
[/* 4 */ 'bufio', '/lib/custom-browser.js', function(exports, module, __filename, __dirname, __meta) {
'use strict';

exports.custom = 'inspect';
}],
[/* 5 */ 'bufio', '/lib/encoding.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * encoding.js - encoding utils for bcoin
 * Copyright (c) 2014-2015, Fedor Indutny (MIT License)
 * Copyright (c) 2014-2017, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcoin
 */

/* eslint no-implicit-coercion: "off" */

'use strict';

const enforce = __node_require__(6 /* './enforce' */);
const EncodingError = __node_require__(7 /* './error' */);

/*
 * Constants
 */

const HI = 1 / 0x100000000;
const {MAX_SAFE_INTEGER} = Number;
const F32_ARRAY = new Float32Array(1);
const F328_ARRAY = new Uint8Array(F32_ARRAY.buffer);
const F64_ARRAY = new Float64Array(1);
const F648_ARRAY = new Uint8Array(F64_ARRAY.buffer);

F32_ARRAY[0] = -1;

const BIG_ENDIAN = F328_ARRAY[3] === 0;

/*
 * Read Unsigned LE
 */

function readU(data, off, len) {
  switch (len) {
    case 8:
      return readU64(data, off);
    case 7:
      return readU56(data, off);
    case 6:
      return readU48(data, off);
    case 5:
      return readU40(data, off);
    case 4:
      return readU32(data, off);
    case 3:
      return readU24(data, off);
    case 2:
      return readU16(data, off);
    case 1:
      return readU8(data, off);
    default:
      throw new EncodingError(off, 'Invalid read length');
  }
}

function readU64(data, off) {
  const hi = readU32(data, off + 4);
  const lo = readU32(data, off);

  check((hi & 0xffe00000) === 0, off, 'Number exceeds 2^53-1');

  return hi * 0x100000000 + lo;
}

function readU56(data, off) {
  const hi = readU24(data, off + 4);
  const lo = readU32(data, off);

  check((hi & 0xffe00000) === 0, off, 'Number exceeds 2^53-1');

  return hi * 0x100000000 + lo;
}

function readU48(data, off) {
  return (data[off++]
        + data[off++] * 0x100
        + data[off++] * 0x10000
        + data[off++] * 0x1000000
        + data[off++] * 0x100000000
        + data[off] * 0x10000000000);
}

function readU40(data, off) {
  return (data[off++]
        + data[off++] * 0x100
        + data[off++] * 0x10000
        + data[off++] * 0x1000000
        + data[off] * 0x100000000);
}

function readU32(data, off) {
  return (data[off++]
        + data[off++] * 0x100
        + data[off++] * 0x10000
        + data[off] * 0x1000000);
}

function readU24(data, off) {
  return (data[off++]
        + data[off++] * 0x100
        + data[off] * 0x10000);
}

function readU16(data, off) {
  return data[off++] + data[off] * 0x100;
}

function readU8(data, off) {
  return data[off];
}

/*
 * Read Unsigned BE
 */

function readUBE(data, off, len) {
  switch (len) {
    case 8:
      return readU64BE(data, off);
    case 7:
      return readU56BE(data, off);
    case 6:
      return readU48BE(data, off);
    case 5:
      return readU40BE(data, off);
    case 4:
      return readU32BE(data, off);
    case 3:
      return readU24BE(data, off);
    case 2:
      return readU16BE(data, off);
    case 1:
      return readU8(data, off);
    default:
      throw new EncodingError(off, 'Invalid read length');
  }
}

function readU64BE(data, off) {
  const hi = readU32BE(data, off);
  const lo = readU32BE(data, off + 4);

  check((hi & 0xffe00000) === 0, off, 'Number exceeds 2^53-1');

  return hi * 0x100000000 + lo;
}

function readU56BE(data, off) {
  const hi = readU24BE(data, off);
  const lo = readU32BE(data, off + 3);

  check((hi & 0xffe00000) === 0, off, 'Number exceeds 2^53-1');

  return hi * 0x100000000 + lo;
}

function readU48BE(data, off) {
  return (data[off++] * 0x10000000000
        + data[off++] * 0x100000000
        + data[off++] * 0x1000000
        + data[off++] * 0x10000
        + data[off++] * 0x100
        + data[off]);
}

function readU40BE(data, off) {
  return (data[off++] * 0x100000000
        + data[off++] * 0x1000000
        + data[off++] * 0x10000
        + data[off++] * 0x100
        + data[off]);
}

function readU32BE(data, off) {
  return (data[off++] * 0x1000000
        + data[off++] * 0x10000
        + data[off++] * 0x100
        + data[off]);
}

function readU24BE(data, off) {
  return (data[off++] * 0x10000
        + data[off++] * 0x100
        + data[off]);
}

function readU16BE(data, off) {
  return data[off++] * 0x100 + data[off];
}

/*
 * Read Signed LE
 */

function readI(data, off, len) {
  switch (len) {
    case 8:
      return readI64(data, off);
    case 7:
      return readI56(data, off);
    case 6:
      return readI48(data, off);
    case 5:
      return readI40(data, off);
    case 4:
      return readI32(data, off);
    case 3:
      return readI24(data, off);
    case 2:
      return readI16(data, off);
    case 1:
      return readI8(data, off);
    default:
      throw new EncodingError(off, 'Invalid read length');
  }
}

function readI64(data, off) {
  const hi = readI32(data, off + 4);
  const lo = readU32(data, off);

  check(isSafe(hi, lo), 'Number exceeds 2^53-1');

  return hi * 0x100000000 + lo;
}

function readI56(data, off) {
  const hi = readI24(data, off + 4);
  const lo = readU32(data, off);

  check(isSafe(hi, lo), 'Number exceeds 2^53-1');

  return hi * 0x100000000 + lo;
}

function readI48(data, off) {
  const val = data[off + 4] + data[off + 5] * 0x100;

  return (data[off++]
        + data[off++] * 0x100
        + data[off++] * 0x10000
        + data[off] * 0x1000000
        + (val | (val & 0x8000) * 0x1fffe) * 0x100000000);
}

function readI40(data, off) {
  return (data[off++]
        + data[off++] * 0x100
        + data[off++] * 0x10000
        + data[off++] * 0x1000000
        + (data[off] | (data[off] & 0x80) * 0x1fffffe) * 0x100000000);
}

function readI32(data, off) {
  return (data[off++]
        + data[off++] * 0x100
        + data[off++] * 0x10000
        + (data[off] << 24));
}

function readI24(data, off) {
  const val = (data[off++]
             + data[off++] * 0x100
             + data[off] * 0x10000);

  return val | (val & 0x800000) * 0x1fe;
}

function readI16(data, off) {
  const val = data[off++] + data[off] * 0x100;
  return val | (val & 0x8000) * 0x1fffe;
}

function readI8(data, off) {
  const val = data[off];
  return val | (val & 0x80) * 0x1fffffe;
}

/*
 * Read Signed BE
 */

function readIBE(data, off, len) {
  switch (len) {
    case 8:
      return readI64BE(data, off);
    case 7:
      return readI56BE(data, off);
    case 6:
      return readI48BE(data, off);
    case 5:
      return readI40BE(data, off);
    case 4:
      return readI32BE(data, off);
    case 3:
      return readI24BE(data, off);
    case 2:
      return readI16BE(data, off);
    case 1:
      return readI8(data, off);
    default:
      throw new EncodingError(off, 'Invalid read length');
  }
}

function readI64BE(data, off) {
  const hi = readI32BE(data, off);
  const lo = readU32BE(data, off + 4);

  check(isSafe(hi, lo), 'Number exceeds 2^53-1');

  return hi * 0x100000000 + lo;
}

function readI56BE(data, off) {
  const hi = readI24BE(data, off);
  const lo = readU32BE(data, off + 3);

  check(isSafe(hi, lo), 'Number exceeds 2^53-1');

  return hi * 0x100000000 + lo;
}

function readI48BE(data, off) {
  const val = data[off++] * 0x100 + data[off++];

  return ((val | (val & 0x8000) * 0x1fffe) * 0x100000000
        + data[off++] * 0x1000000
        + data[off++] * 0x10000
        + data[off++] * 0x100
        + data[off]);
}

function readI40BE(data, off) {
  const val = data[off++];

  return ((val | (val & 0x80) * 0x1fffffe) * 0x100000000
        + data[off++] * 0x1000000
        + data[off++] * 0x10000
        + data[off++] * 0x100
        + data[off]);
}

function readI32BE(data, off) {
  return ((data[off++] << 24)
        + data[off++] * 0x10000
        + data[off++] * 0x100
        + data[off]);
}

function readI24BE(data, off) {
  const val = (data[off++] * 0x10000
             + data[off++] * 0x100
             + data[off]);

  return val | (val & 0x800000) * 0x1fe;
}

function readI16BE(data, off) {
  const val = data[off++] * 0x100 + data[off];
  return val | (val & 0x8000) * 0x1fffe;
}

/*
 * Read Float
 */

function _readFloatBackwards(data, off) {
  F328_ARRAY[3] = data[off++];
  F328_ARRAY[2] = data[off++];
  F328_ARRAY[1] = data[off++];
  F328_ARRAY[0] = data[off];
  return F32_ARRAY[0];
}

function _readFloatForwards(data, off) {
  F328_ARRAY[0] = data[off++];
  F328_ARRAY[1] = data[off++];
  F328_ARRAY[2] = data[off++];
  F328_ARRAY[3] = data[off];
  return F32_ARRAY[0];
}

function _readDoubleBackwards(data, off) {
  F648_ARRAY[7] = data[off++];
  F648_ARRAY[6] = data[off++];
  F648_ARRAY[5] = data[off++];
  F648_ARRAY[4] = data[off++];
  F648_ARRAY[3] = data[off++];
  F648_ARRAY[2] = data[off++];
  F648_ARRAY[1] = data[off++];
  F648_ARRAY[0] = data[off];
  return F64_ARRAY[0];
}

function _readDoubleForwards(data, off) {
  F648_ARRAY[0] = data[off++];
  F648_ARRAY[1] = data[off++];
  F648_ARRAY[2] = data[off++];
  F648_ARRAY[3] = data[off++];
  F648_ARRAY[4] = data[off++];
  F648_ARRAY[5] = data[off++];
  F648_ARRAY[6] = data[off++];
  F648_ARRAY[7] = data[off];
  return F64_ARRAY[0];
}

const readFloat = BIG_ENDIAN ? _readFloatBackwards : _readFloatForwards;
const readFloatBE = BIG_ENDIAN ? _readFloatForwards : _readFloatBackwards;
const readDouble = BIG_ENDIAN ? _readDoubleBackwards : _readDoubleForwards;
const readDoubleBE = BIG_ENDIAN ? _readDoubleForwards : _readDoubleBackwards;

/*
 * Write Unsigned LE
 */

function writeU(dst, num, off, len) {
  switch (len) {
    case 8:
      return writeU64(dst, num, off);
    case 7:
      return writeU56(dst, num, off);
    case 6:
      return writeU48(dst, num, off);
    case 5:
      return writeU40(dst, num, off);
    case 4:
      return writeU32(dst, num, off);
    case 3:
      return writeU24(dst, num, off);
    case 2:
      return writeU16(dst, num, off);
    case 1:
      return writeU8(dst, num, off);
    default:
      throw new EncodingError(off, 'Invalid write length');
  }
}

function writeU64(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');
  return write64(dst, num, off, false);
}

function writeU56(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');
  return write56(dst, num, off, false);
}

function writeU48(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  const hi = (num * HI) | 0;

  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  dst[off++] = hi;
  dst[off++] = hi >>> 8;

  return off;
}

function writeU40(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  const hi = (num * HI) | 0;

  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  dst[off++] = hi;

  return off;
}

function writeU32(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;

  return off;
}

function writeU24(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;

  return off;
}

function writeU16(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  dst[off++] = num;
  dst[off++] = num >>> 8;

  return off;
}

function writeU8(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  dst[off] = num;

  return off + 1;
}

/*
 * Write Unsigned BE
 */

function writeUBE(dst, num, off, len) {
  switch (len) {
    case 8:
      return writeU64BE(dst, num, off);
    case 7:
      return writeU56BE(dst, num, off);
    case 6:
      return writeU48BE(dst, num, off);
    case 5:
      return writeU40BE(dst, num, off);
    case 4:
      return writeU32BE(dst, num, off);
    case 3:
      return writeU24BE(dst, num, off);
    case 2:
      return writeU16BE(dst, num, off);
    case 1:
      return writeU8(dst, num, off);
    default:
      throw new EncodingError(off, 'Invalid write length');
  }
}

function writeU64BE(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');
  return write64(dst, num, off, true);
}

function writeU56BE(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');
  return write56(dst, num, off, true);
}

function writeU48BE(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  const hi = (num * HI) | 0;

  dst[off++] = hi >>> 8;
  dst[off++] = hi;
  dst[off + 3] = num;
  num >>>= 8;
  dst[off + 2] = num;
  num >>>= 8;
  dst[off + 1] = num;
  num >>>= 8;
  dst[off] = num;

  return off + 4;
}

function writeU40BE(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  const hi = (num * HI) | 0;

  dst[off++] = hi;
  dst[off + 3] = num;
  num >>>= 8;
  dst[off + 2] = num;
  num >>>= 8;
  dst[off + 1] = num;
  num >>>= 8;
  dst[off] = num;

  return off + 4;
}

function writeU32BE(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  dst[off + 3] = num;
  num >>>= 8;
  dst[off + 2] = num;
  num >>>= 8;
  dst[off + 1] = num;
  num >>>= 8;
  dst[off] = num;

  return off + 4;
}

function writeU24BE(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  dst[off + 2] = num;
  num >>>= 8;
  dst[off + 1] = num;
  num >>>= 8;
  dst[off] = num;

  return off + 3;
}

function writeU16BE(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  dst[off++] = num >>> 8;
  dst[off++] = num;

  return off;
}

/*
 * Write Signed LE
 */

function writeI(dst, num, off, len) {
  switch (len) {
    case 8:
      return writeU64(dst, num, off);
    case 7:
      return writeU56(dst, num, off);
    case 6:
      return writeU48(dst, num, off);
    case 5:
      return writeU40(dst, num, off);
    case 4:
      return writeU24(dst, num, off);
    case 3:
      return writeU32(dst, num, off);
    case 2:
      return writeU16(dst, num, off);
    case 1:
      return writeU8(dst, num, off);
    default:
      throw new EncodingError(off, 'Invalid write length');
  }
}

function writeI64(dst, num, off) {
  return writeU64(dst, num, off);
}

function writeI56(dst, num, off) {
  return writeU56(dst, num, off);
}

function writeI48(dst, num, off) {
  return writeU48(dst, num, off);
}

function writeI40(dst, num, off) {
  return writeU40(dst, num, off);
}

function writeI32(dst, num, off) {
  return writeU32(dst, num, off);
}

function writeI24(dst, num, off) {
  return writeU24(dst, num, off);
}

function writeI16(dst, num, off) {
  return writeU16(dst, num, off);
}

function writeI8(dst, num, off) {
  return writeU8(dst, num, off);
}

/*
 * Write Signed BE
 */

function writeIBE(dst, num, off, len) {
  switch (len) {
    case 8:
      return writeU64BE(dst, num, off);
    case 7:
      return writeU56BE(dst, num, off);
    case 6:
      return writeU48BE(dst, num, off);
    case 5:
      return writeU40BE(dst, num, off);
    case 4:
      return writeU32BE(dst, num, off);
    case 3:
      return writeU24BE(dst, num, off);
    case 2:
      return writeU16BE(dst, num, off);
    case 1:
      return writeU8(dst, num, off);
    default:
      throw new EncodingError(off, 'Invalid write length');
  }
}

function writeI64BE(dst, num, off) {
  return writeU64BE(dst, num, off);
}

function writeI56BE(dst, num, off) {
  return writeU56BE(dst, num, off);
}

function writeI48BE(dst, num, off) {
  return writeU48BE(dst, num, off);
}

function writeI40BE(dst, num, off) {
  return writeU40BE(dst, num, off);
}

function writeI32BE(dst, num, off) {
  return writeU32BE(dst, num, off);
}

function writeI24BE(dst, num, off) {
  return writeU24BE(dst, num, off);
}

function writeI16BE(dst, num, off) {
  return writeU16BE(dst, num, off);
}

function _writeDoubleForwards(dst, num, off) {
  enforce(isNumber(num), 'num', 'number');

  F64_ARRAY[0] = num;

  dst[off++] = F648_ARRAY[0];
  dst[off++] = F648_ARRAY[1];
  dst[off++] = F648_ARRAY[2];
  dst[off++] = F648_ARRAY[3];
  dst[off++] = F648_ARRAY[4];
  dst[off++] = F648_ARRAY[5];
  dst[off++] = F648_ARRAY[6];
  dst[off++] = F648_ARRAY[7];

  return off;
}

function _writeDoubleBackwards(dst, num, off) {
  enforce(isNumber(num), 'num', 'number');

  F64_ARRAY[0] = num;

  dst[off++] = F648_ARRAY[7];
  dst[off++] = F648_ARRAY[6];
  dst[off++] = F648_ARRAY[5];
  dst[off++] = F648_ARRAY[4];
  dst[off++] = F648_ARRAY[3];
  dst[off++] = F648_ARRAY[2];
  dst[off++] = F648_ARRAY[1];
  dst[off++] = F648_ARRAY[0];

  return off;
}

function _writeFloatForwards(dst, num, off) {
  enforce(isNumber(num), 'num', 'number');

  F32_ARRAY[0] = num;

  dst[off++] = F328_ARRAY[0];
  dst[off++] = F328_ARRAY[1];
  dst[off++] = F328_ARRAY[2];
  dst[off++] = F328_ARRAY[3];

  return off;
}

function _writeFloatBackwards(dst, num, off) {
  enforce(isNumber(num), 'num', 'number');

  F32_ARRAY[0] = num;

  dst[off++] = F328_ARRAY[3];
  dst[off++] = F328_ARRAY[2];
  dst[off++] = F328_ARRAY[1];
  dst[off++] = F328_ARRAY[0];

  return off;
}

const writeFloat = BIG_ENDIAN ? _writeFloatBackwards : _writeFloatForwards;
const writeFloatBE = BIG_ENDIAN ? _writeFloatForwards : _writeFloatBackwards;
const writeDouble = BIG_ENDIAN ? _writeDoubleBackwards : _writeDoubleForwards;
const writeDoubleBE = BIG_ENDIAN ? _writeDoubleForwards : _writeDoubleBackwards;

/*
 * Varints
 */

function readVarint(data, off) {
  let value, size;

  checkRead(off < data.length, off);

  switch (data[off]) {
    case 0xff:
      size = 9;
      checkRead(off + size <= data.length, off);
      value = readU64(data, off + 1);
      check(value > 0xffffffff, off, 'Non-canonical varint');
      break;
    case 0xfe:
      size = 5;
      checkRead(off + size <= data.length, off);
      value = readU32(data, off + 1);
      check(value > 0xffff, off, 'Non-canonical varint');
      break;
    case 0xfd:
      size = 3;
      checkRead(off + size <= data.length, off);
      value = readU16(data, off + 1);
      check(value >= 0xfd, off, 'Non-canonical varint');
      break;
    default:
      size = 1;
      value = data[off];
      break;
  }

  return new Varint(size, value);
}

function writeVarint(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  if (num < 0xfd) {
    dst[off++] = num;
    return off;
  }

  if (num <= 0xffff) {
    dst[off++] = 0xfd;
    return writeU16(dst, num, off);
  }

  if (num <= 0xffffffff) {
    dst[off++] = 0xfe;
    return writeU32(dst, num, off);
  }

  dst[off++] = 0xff;

  return writeU64(dst, num, off);
}

function sizeVarint(num) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  if (num < 0xfd)
    return 1;

  if (num <= 0xffff)
    return 3;

  if (num <= 0xffffffff)
    return 5;

  return 9;
}

function readVarint2(data, off) {
  let num = 0;
  let size = 0;

  for (;;) {
    checkRead(off < data.length, off);

    const ch = data[off++];

    size += 1;

    // Number.MAX_SAFE_INTEGER >>> 7
    check(num <= 0x3fffffffffff - (ch & 0x7f), off, 'Number exceeds 2^53-1');

    // num = (num << 7) | (ch & 0x7f);
    num = (num * 0x80) + (ch & 0x7f);

    if ((ch & 0x80) === 0)
      break;

    check(num !== MAX_SAFE_INTEGER, off, 'Number exceeds 2^53-1');
    num += 1;
  }

  return new Varint(size, num);
}

function writeVarint2(dst, num, off) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  const tmp = [];

  let len = 0;

  for (;;) {
    tmp[len] = (num & 0x7f) | (len ? 0x80 : 0x00);

    if (num <= 0x7f)
      break;

    // num = (num >>> 7) - 1;
    num = ((num - (num % 0x80)) / 0x80) - 1;
    len += 1;
  }

  checkRead(off + len + 1 <= dst.length, off);

  do {
    dst[off++] = tmp[len];
  } while (len--);

  return off;
}

function sizeVarint2(num) {
  enforce(Number.isSafeInteger(num), 'num', 'integer');

  let size = 0;

  for (;;) {
    size += 1;

    if (num <= 0x7f)
      break;

    // num = (num >>> 7) - 1;
    num = ((num - (num % 0x80)) / 0x80) - 1;
  }

  return size;
}

/*
 * Bytes
 */

function sliceBytes(data, off, size) {
  enforce(Buffer.isBuffer(data), 'data', 'buffer');
  enforce((off >>> 0) === off, 'off', 'integer');
  enforce((size >>> 0) === size, 'size', 'integer');

  if (off + size > data.length)
    throw new EncodingError(off, 'Out of bounds read');

  return data.slice(off, off + size);
}

function readBytes(data, off, size) {
  enforce(Buffer.isBuffer(data), 'data', 'buffer');
  enforce((off >>> 0) === off, 'off', 'integer');
  enforce((size >>> 0) === size, 'size', 'integer');

  if (off + size > data.length)
    throw new EncodingError(off, 'Out of bounds read');

  const buf = Buffer.allocUnsafeSlow(size);

  data.copy(buf, 0, off, off + size);

  return buf;
}

function writeBytes(data, value, off) {
  enforce(Buffer.isBuffer(data), 'data', 'buffer');
  enforce(Buffer.isBuffer(value), 'value', 'buffer');
  enforce((off >>> 0) === off, 'off', 'integer');

  if (off + value.length > data.length)
    throw new EncodingError(off, 'Out of bounds write');

  return value.copy(data, off, 0, value.length);
}

function readString(data, off, size, enc) {
  if (enc == null)
    enc = 'binary';

  enforce(Buffer.isBuffer(data), 'data', 'buffer');
  enforce((off >>> 0) === off, 'off', 'integer');
  enforce((size >>> 0) === size, 'size', 'integer');
  enforce(typeof enc === 'string', 'enc', 'string');

  if (off + size > data.length)
    throw new EncodingError(off, 'Out of bounds read');

  return data.toString(enc, off, off + size);
}

function writeString(data, str, off, enc) {
  if (enc == null)
    enc = 'binary';

  enforce(Buffer.isBuffer(data), 'data', 'buffer');
  enforce(typeof str === 'string', 'str', 'string');
  enforce((off >>> 0) === off, 'off', 'integer');
  enforce(typeof enc === 'string', 'enc', 'string');

  if (str.length === 0)
    return 0;

  const size = Buffer.byteLength(str, enc);

  if (off + size > data.length)
    throw new EncodingError(off, 'Out of bounds write');

  return data.write(str, off, enc);
}

function realloc(data, size) {
  enforce(Buffer.isBuffer(data), 'data', 'buffer');

  const buf = Buffer.allocUnsafeSlow(size);

  data.copy(buf, 0);

  return buf;
}

function copy(data) {
  enforce(Buffer.isBuffer(data), 'data', 'buffer');
  return realloc(data, data.length);
}

function concat(a, b) {
  enforce(Buffer.isBuffer(a), 'a', 'buffer');
  enforce(Buffer.isBuffer(b), 'b', 'buffer');

  const size = a.length + b.length;
  const buf = Buffer.allocUnsafeSlow(size);

  a.copy(buf, 0);
  b.copy(buf, a.length);

  return buf;
}

/*
 * Size Helpers
 */

function sizeVarBytes(data) {
  enforce(Buffer.isBuffer(data), 'data', 'buffer');
  return sizeVarint(data.length) + data.length;
}

function sizeVarlen(len) {
  return sizeVarint(len) + len;
}

function sizeVarString(str, enc) {
  if (enc == null)
    enc = 'binary';

  enforce(typeof str === 'string', 'str', 'string');
  enforce(typeof enc === 'string', 'enc', 'string');

  if (str.length === 0)
    return 1;

  const len = Buffer.byteLength(str, enc);

  return sizeVarint(len) + len;
}

/*
 * Helpers
 */

function isSafe(hi, lo) {
  if (hi < 0) {
    hi = ~hi;
    if (lo === 0)
      hi += 1;
  }

  return (hi & 0xffe00000) === 0;
}

function write64(dst, num, off, be) {
  let neg = false;

  if (num < 0) {
    num = -num;
    neg = true;
  }

  let hi = (num * HI) | 0;
  let lo = num | 0;

  if (neg) {
    if (lo === 0) {
      hi = (~hi + 1) | 0;
    } else {
      hi = ~hi;
      lo = ~lo + 1;
    }
  }

  if (be) {
    off = writeI32BE(dst, hi, off);
    off = writeI32BE(dst, lo, off);
  } else {
    off = writeI32(dst, lo, off);
    off = writeI32(dst, hi, off);
  }

  return off;
}

function write56(dst, num, off, be) {
  let neg = false;

  if (num < 0) {
    num = -num;
    neg = true;
  }

  let hi = (num * HI) | 0;
  let lo = num | 0;

  if (neg) {
    if (lo === 0) {
      hi = (~hi + 1) | 0;
    } else {
      hi = ~hi;
      lo = ~lo + 1;
    }
  }

  if (be) {
    off = writeI24BE(dst, hi, off);
    off = writeI32BE(dst, lo, off);
  } else {
    off = writeI32(dst, lo, off);
    off = writeI24(dst, hi, off);
  }

  return off;
}

class Varint {
  constructor(size, value) {
    this.size = size;
    this.value = value;
  }
}

function isNumber(num) {
  return typeof num === 'number' && isFinite(num);
}

function checkRead(value, offset) {
  if (!value)
    throw new EncodingError(offset, 'Out of bounds read', checkRead);
}

function check(value, offset, reason) {
  if (!value)
    throw new EncodingError(offset, reason, check);
}

/*
 * Expose
 */

exports.readU = readU;
exports.readU64 = readU64;
exports.readU56 = readU56;
exports.readU48 = readU48;
exports.readU40 = readU40;
exports.readU32 = readU32;
exports.readU24 = readU24;
exports.readU16 = readU16;
exports.readU8 = readU8;

exports.readUBE = readUBE;
exports.readU64BE = readU64BE;
exports.readU56BE = readU56BE;
exports.readU48BE = readU48BE;
exports.readU40BE = readU40BE;
exports.readU32BE = readU32BE;
exports.readU24BE = readU24BE;
exports.readU16BE = readU16BE;

exports.readI = readI;
exports.readI64 = readI64;
exports.readI56 = readI56;
exports.readI48 = readI48;
exports.readI40 = readI40;
exports.readI32 = readI32;
exports.readI24 = readI24;
exports.readI16 = readI16;
exports.readI8 = readI8;

exports.readIBE = readIBE;
exports.readI64BE = readI64BE;
exports.readI56BE = readI56BE;
exports.readI48BE = readI48BE;
exports.readI40BE = readI40BE;
exports.readI32BE = readI32BE;
exports.readI24BE = readI24BE;
exports.readI16BE = readI16BE;

exports.readFloat = readFloat;
exports.readFloatBE = readFloatBE;
exports.readDouble = readDouble;
exports.readDoubleBE = readDoubleBE;

exports.writeU = writeU;
exports.writeU64 = writeU64;
exports.writeU56 = writeU56;
exports.writeU48 = writeU48;
exports.writeU40 = writeU40;
exports.writeU32 = writeU32;
exports.writeU24 = writeU24;
exports.writeU16 = writeU16;
exports.writeU8 = writeU8;

exports.writeUBE = writeUBE;
exports.writeU64BE = writeU64BE;
exports.writeU56BE = writeU56BE;
exports.writeU48BE = writeU48BE;
exports.writeU40BE = writeU40BE;
exports.writeU32BE = writeU32BE;
exports.writeU24BE = writeU24BE;
exports.writeU16BE = writeU16BE;

exports.writeI = writeI;
exports.writeI64 = writeI64;
exports.writeI56 = writeI56;
exports.writeI48 = writeI48;
exports.writeI40 = writeI40;
exports.writeI32 = writeI32;
exports.writeI24 = writeI24;
exports.writeI16 = writeI16;
exports.writeI8 = writeI8;

exports.writeIBE = writeIBE;
exports.writeI64BE = writeI64BE;
exports.writeI56BE = writeI56BE;
exports.writeI48BE = writeI48BE;
exports.writeI40BE = writeI40BE;
exports.writeI32BE = writeI32BE;
exports.writeI24BE = writeI24BE;
exports.writeI16BE = writeI16BE;

exports.writeFloat = writeFloat;
exports.writeFloatBE = writeFloatBE;
exports.writeDouble = writeDouble;
exports.writeDoubleBE = writeDoubleBE;

exports.readVarint = readVarint;
exports.writeVarint = writeVarint;
exports.sizeVarint = sizeVarint;
exports.readVarint2 = readVarint2;
exports.writeVarint2 = writeVarint2;
exports.sizeVarint2 = sizeVarint2;

exports.sliceBytes = sliceBytes;
exports.readBytes = readBytes;
exports.writeBytes = writeBytes;
exports.readString = readString;
exports.writeString = writeString;

exports.realloc = realloc;
exports.copy = copy;
exports.concat = concat;

exports.sizeVarBytes = sizeVarBytes;
exports.sizeVarlen = sizeVarlen;
exports.sizeVarString = sizeVarString;
}],
[/* 6 */ 'bufio', '/lib/enforce.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * enforce.js - type enforcement for bcoin
 * Copyright (c) 2014-2017, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcoin
 */

'use strict';

/*
 * Enforce
 */

function enforce(value, name, type) {
  if (!value) {
    const err = new TypeError(`'${name}' must be a(n) ${type}.`);

    if (Error.captureStackTrace)
      Error.captureStackTrace(err, enforce);

    throw err;
  }
}

/*
 * Expose
 */

module.exports = enforce;
}],
[/* 7 */ 'bufio', '/lib/error.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * error.js - encoding error for bcoin
 * Copyright (c) 2014-2015, Fedor Indutny (MIT License)
 * Copyright (c) 2014-2017, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcoin
 */

'use strict';

/**
 * Encoding Error
 * @extends {Error}
 */

class EncodingError extends Error {
  /**
   * Create an encoding error.
   * @constructor
   * @param {Number} offset
   * @param {String} reason
   */

  constructor(offset, reason, start) {
    super();

    this.type = 'EncodingError';
    this.name = 'EncodingError';
    this.code = 'ERR_ENCODING';
    this.message = `${reason} (offset=${offset}).`;

    if (Error.captureStackTrace)
      Error.captureStackTrace(this, start || EncodingError);
  }
}

/*
 * Expose
 */

module.exports = EncodingError;
}],
[/* 8 */ 'bufio', '/lib/reader.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * reader.js - buffer reader for bcoin
 * Copyright (c) 2014-2015, Fedor Indutny (MIT License)
 * Copyright (c) 2014-2017, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcoin
 */

'use strict';

const enforce = __node_require__(6 /* './enforce' */);
const encoding = __node_require__(5 /* './encoding' */);
const EncodingError = __node_require__(7 /* './error' */);

/*
 * Constants
 */

const EMPTY = Buffer.alloc(0);

/**
 * Buffer Reader
 */

class BufferReader {
  /**
   * Create a buffer reader.
   * @constructor
   * @param {Buffer} data
   * @param {Boolean?} zeroCopy - Do not reallocate buffers when
   * slicing. Note that this can lead to memory leaks if not used
   * carefully.
   */

  constructor(data, zeroCopy = false) {
    enforce(Buffer.isBuffer(data), 'data', 'buffer');
    enforce(typeof zeroCopy === 'boolean', 'zeroCopy', 'boolean');

    this.data = data;
    this.offset = 0;
    this.zeroCopy = zeroCopy;
    this.stack = [];
  }

  /**
   * Assertion.
   * @param {Number} size
   */

  check(size) {
    if (this.offset + size > this.data.length)
      throw new EncodingError(this.offset, 'Out of bounds read', this.check);
  }

  /**
   * Get total size of passed-in Buffer.
   * @returns {Buffer}
   */

  getSize() {
    return this.data.length;
  }

  /**
   * Calculate number of bytes left to read.
   * @returns {Number}
   */

  left() {
    this.check(0);
    return this.data.length - this.offset;
  }

  /**
   * Seek to a position to read from by offset.
   * @param {Number} off - Offset (positive or negative).
   */

  seek(off) {
    enforce(Number.isSafeInteger(off), 'off', 'integer');

    if (this.offset + off < 0)
      throw new EncodingError(this.offset, 'Out of bounds read');

    this.check(off);
    this.offset += off;

    return this;
  }

  /**
   * Mark the current starting position.
   */

  start() {
    this.stack.push(this.offset);
    return this.offset;
  }

  /**
   * Stop reading. Pop the start position off the stack
   * and calculate the size of the data read.
   * @returns {Number} Size.
   * @throws on empty stack.
   */

  end() {
    if (this.stack.length === 0)
      throw new Error('Cannot end without a stack item.');

    const start = this.stack.pop();

    return this.offset - start;
  }

  /**
   * Stop reading. Pop the start position off the stack
   * and return the data read.
   * @param {Bolean?} zeroCopy - Do a fast buffer
   * slice instead of allocating a new buffer (warning:
   * may cause memory leaks if not used with care).
   * @returns {Buffer} Data read.
   * @throws on empty stack.
   */

  endData(zeroCopy = false) {
    enforce(typeof zeroCopy === 'boolean', 'zeroCopy', 'boolean');

    if (this.stack.length === 0)
      throw new Error('Cannot end without a stack item.');

    const start = this.stack.pop();
    const end = this.offset;
    const size = end - start;
    const data = this.data;

    if (size === data.length)
      return data;

    if (this.zeroCopy || zeroCopy)
      return data.slice(start, end);

    const ret = Buffer.allocUnsafeSlow(size);

    data.copy(ret, 0, start, end);

    return ret;
  }

  /**
   * Destroy the reader. Remove references to the data.
   */

  destroy() {
    this.data = EMPTY;
    this.offset = 0;
    this.stack.length = 0;
    return this;
  }

  /**
   * Read uint8.
   * @returns {Number}
   */

  readU8() {
    this.check(1);

    const ret = this.data[this.offset];

    this.offset += 1;

    return ret;
  }

  /**
   * Read uint16le.
   * @returns {Number}
   */

  readU16() {
    this.check(2);

    const ret = encoding.readU16(this.data, this.offset);

    this.offset += 2;

    return ret;
  }

  /**
   * Read uint16be.
   * @returns {Number}
   */

  readU16BE() {
    this.check(2);

    const ret = encoding.readU16BE(this.data, this.offset);

    this.offset += 2;

    return ret;
  }

  /**
   * Read uint24le.
   * @returns {Number}
   */

  readU24() {
    this.check(3);

    const ret = encoding.readU24(this.data, this.offset);

    this.offset += 3;

    return ret;
  }

  /**
   * Read uint24be.
   * @returns {Number}
   */

  readU24BE() {
    this.check(3);

    const ret = encoding.readU24BE(this.data, this.offset);

    this.offset += 3;

    return ret;
  }

  /**
   * Read uint32le.
   * @returns {Number}
   */

  readU32() {
    this.check(4);

    const ret = encoding.readU32(this.data, this.offset);

    this.offset += 4;

    return ret;
  }

  /**
   * Read uint32be.
   * @returns {Number}
   */

  readU32BE() {
    this.check(4);

    const ret = encoding.readU32BE(this.data, this.offset);

    this.offset += 4;

    return ret;
  }

  /**
   * Read uint40le.
   * @returns {Number}
   */

  readU40() {
    this.check(5);

    const ret = encoding.readU40(this.data, this.offset);

    this.offset += 5;

    return ret;
  }

  /**
   * Read uint40be.
   * @returns {Number}
   */

  readU40BE() {
    this.check(5);

    const ret = encoding.readU40BE(this.data, this.offset);

    this.offset += 5;

    return ret;
  }

  /**
   * Read uint48le.
   * @returns {Number}
   */

  readU48() {
    this.check(6);

    const ret = encoding.readU48(this.data, this.offset);

    this.offset += 6;

    return ret;
  }

  /**
   * Read uint48be.
   * @returns {Number}
   */

  readU48BE() {
    this.check(6);

    const ret = encoding.readU48BE(this.data, this.offset);

    this.offset += 6;

    return ret;
  }

  /**
   * Read uint56le.
   * @returns {Number}
   */

  readU56() {
    this.check(7);

    const ret = encoding.readU56(this.data, this.offset);

    this.offset += 7;

    return ret;
  }

  /**
   * Read uint56be.
   * @returns {Number}
   */

  readU56BE() {
    this.check(7);

    const ret = encoding.readU56BE(this.data, this.offset);

    this.offset += 7;

    return ret;
  }

  /**
   * Read uint64le as a js number.
   * @returns {Number}
   * @throws on num > MAX_SAFE_INTEGER
   */

  readU64() {
    this.check(8);

    const ret = encoding.readU64(this.data, this.offset);

    this.offset += 8;

    return ret;
  }

  /**
   * Read uint64be as a js number.
   * @returns {Number}
   * @throws on num > MAX_SAFE_INTEGER
   */

  readU64BE() {
    this.check(8);

    const ret = encoding.readU64BE(this.data, this.offset);

    this.offset += 8;

    return ret;
  }

  /**
   * Read int8.
   * @returns {Number}
   */

  readI8() {
    this.check(1);

    const ret = encoding.readI8(this.data, this.offset);

    this.offset += 1;

    return ret;
  }

  /**
   * Read int16le.
   * @returns {Number}
   */

  readI16() {
    this.check(2);

    const ret = encoding.readI16(this.data, this.offset);

    this.offset += 2;

    return ret;
  }

  /**
   * Read int16be.
   * @returns {Number}
   */

  readI16BE() {
    this.check(2);

    const ret = encoding.readI16BE(this.data, this.offset);

    this.offset += 2;

    return ret;
  }

  /**
   * Read int24le.
   * @returns {Number}
   */

  readI24() {
    this.check(3);

    const ret = encoding.readI24(this.data, this.offset);

    this.offset += 3;

    return ret;
  }

  /**
   * Read int24be.
   * @returns {Number}
   */

  readI24BE() {
    this.check(3);

    const ret = encoding.readI24BE(this.data, this.offset);

    this.offset += 3;

    return ret;
  }

  /**
   * Read int32le.
   * @returns {Number}
   */

  readI32() {
    this.check(4);

    const ret = encoding.readI32(this.data, this.offset);

    this.offset += 4;

    return ret;
  }

  /**
   * Read int32be.
   * @returns {Number}
   */

  readI32BE() {
    this.check(4);

    const ret = encoding.readI32BE(this.data, this.offset);

    this.offset += 4;

    return ret;
  }

  /**
   * Read int40le.
   * @returns {Number}
   */

  readI40() {
    this.check(5);

    const ret = encoding.readI40(this.data, this.offset);

    this.offset += 5;

    return ret;
  }

  /**
   * Read int40be.
   * @returns {Number}
   */

  readI40BE() {
    this.check(5);

    const ret = encoding.readI40BE(this.data, this.offset);

    this.offset += 5;

    return ret;
  }

  /**
   * Read int48le.
   * @returns {Number}
   */

  readI48() {
    this.check(6);

    const ret = encoding.readI48(this.data, this.offset);

    this.offset += 6;

    return ret;
  }

  /**
   * Read int48be.
   * @returns {Number}
   */

  readI48BE() {
    this.check(6);

    const ret = encoding.readI48BE(this.data, this.offset);

    this.offset += 6;

    return ret;
  }

  /**
   * Read int56le.
   * @returns {Number}
   */

  readI56() {
    this.check(7);

    const ret = encoding.readI56(this.data, this.offset);

    this.offset += 7;

    return ret;
  }

  /**
   * Read int56be.
   * @returns {Number}
   */

  readI56BE() {
    this.check(7);

    const ret = encoding.readI56BE(this.data, this.offset);

    this.offset += 7;

    return ret;
  }

  /**
   * Read int64le as a js number.
   * @returns {Number}
   * @throws on num > MAX_SAFE_INTEGER
   */

  readI64() {
    this.check(8);

    const ret = encoding.readI64(this.data, this.offset);

    this.offset += 8;

    return ret;
  }

  /**
   * Read int64be as a js number.
   * @returns {Number}
   * @throws on num > MAX_SAFE_INTEGER
   */

  readI64BE() {
    this.check(8);

    const ret = encoding.readI64BE(this.data, this.offset);

    this.offset += 8;

    return ret;
  }

  /**
   * Read float le.
   * @returns {Number}
   */

  readFloat() {
    this.check(4);

    const ret = encoding.readFloat(this.data, this.offset);

    this.offset += 4;

    return ret;
  }

  /**
   * Read float be.
   * @returns {Number}
   */

  readFloatBE() {
    this.check(4);

    const ret = encoding.readFloatBE(this.data, this.offset);

    this.offset += 4;

    return ret;
  }

  /**
   * Read double float le.
   * @returns {Number}
   */

  readDouble() {
    this.check(8);

    const ret = encoding.readDouble(this.data, this.offset);

    this.offset += 8;

    return ret;
  }

  /**
   * Read double float be.
   * @returns {Number}
   */

  readDoubleBE() {
    this.check(8);

    const ret = encoding.readDoubleBE(this.data, this.offset);

    this.offset += 8;

    return ret;
  }

  /**
   * Read a varint.
   * @returns {Number}
   */

  readVarint() {
    const {size, value} = encoding.readVarint(this.data, this.offset);

    this.offset += size;

    return value;
  }

  /**
   * Read a varint (type 2).
   * @returns {Number}
   */

  readVarint2() {
    const {size, value} = encoding.readVarint2(this.data, this.offset);

    this.offset += size;

    return value;
  }

  /**
   * Read N bytes (will do a fast slice if zero copy).
   * @param {Number} size
   * @param {Bolean?} zeroCopy - Do a fast buffer
   * slice instead of allocating a new buffer (warning:
   * may cause memory leaks if not used with care).
   * @returns {Buffer}
   */

  readBytes(size, zeroCopy = false) {
    enforce((size >>> 0) === size, 'size', 'integer');
    enforce(typeof zeroCopy === 'boolean', 'zeroCopy', 'boolean');

    this.check(size);

    let ret;

    if (this.zeroCopy || zeroCopy) {
      ret = this.data.slice(this.offset, this.offset + size);
    } else {
      ret = Buffer.allocUnsafeSlow(size);
      this.data.copy(ret, 0, this.offset, this.offset + size);
    }

    this.offset += size;

    return ret;
  }

  /**
   * Read a varint number of bytes (will do a fast slice if zero copy).
   * @param {Bolean?} zeroCopy - Do a fast buffer
   * slice instead of allocating a new buffer (warning:
   * may cause memory leaks if not used with care).
   * @returns {Buffer}
   */

  readVarBytes(zeroCopy = false) {
    return this.readBytes(this.readVarint(), zeroCopy);
  }

  /**
   * Slice N bytes and create a child reader.
   * @param {Number} size
   * @returns {BufferReader}
   */

  readChild(size) {
    enforce((size >>> 0) === size, 'size', 'integer');

    this.check(size);

    const data = this.data.slice(0, this.offset + size);
    const br = new this.constructor(data);

    br.offset = this.offset;

    this.offset += size;

    return br;
  }

  /**
   * Read a string.
   * @param {Number} size
   * @param {String} enc - Any buffer-supported encoding.
   * @returns {String}
   */

  readString(size, enc) {
    if (enc == null)
      enc = 'binary';

    enforce((size >>> 0) === size, 'size', 'integer');
    enforce(typeof enc === 'string', 'enc', 'string');

    this.check(size);

    const ret = this.data.toString(enc, this.offset, this.offset + size);

    this.offset += size;

    return ret;
  }

  /**
   * Read a 32-byte hash.
   * @param {String} enc - `"hex"` or `null`.
   * @returns {Hash|Buffer}
   */

  readHash(enc) {
    if (enc)
      return this.readString(32, enc);
    return this.readBytes(32);
  }

  /**
   * Read string of a varint length.
   * @param {String} enc - Any buffer-supported encoding.
   * @param {Number?} limit - Size limit.
   * @returns {String}
   */

  readVarString(enc, limit = 0) {
    if (enc == null)
      enc = 'binary';

    enforce(typeof enc === 'string', 'enc', 'string');
    enforce((limit >>> 0) === limit, 'limit', 'integer');

    const size = this.readVarint();

    if (limit !== 0 && size > limit)
      throw new EncodingError(this.offset, 'String exceeds limit');

    return this.readString(size, enc);
  }

  /**
   * Read a null-terminated string.
   * @param {String} enc - Any buffer-supported encoding.
   * @returns {String}
   */

  readNullString(enc) {
    if (enc == null)
      enc = 'binary';

    enforce(typeof enc === 'string', 'enc', 'string');

    let i = this.offset;

    for (; i < this.data.length; i++) {
      if (this.data[i] === 0)
        break;
    }

    if (i === this.data.length)
      throw new EncodingError(this.offset, 'No NUL terminator');

    const ret = this.readString(i - this.offset, enc);

    this.offset = i + 1;

    return ret;
  }

  /**
   * Create a checksum from the last start position.
   * @param {Function} hash
   * @returns {Number} Checksum.
   */

  createChecksum(hash) {
    if (!hash || typeof hash.digest !== 'function')
      enforce(typeof hash === 'function', 'hash', 'function');

    let start = 0;

    if (this.stack.length > 0)
      start = this.stack[this.stack.length - 1];

    const data = this.data.slice(start, this.offset);
    const raw = hash.digest ? hash.digest(data) : hash(data);

    return encoding.readU32(raw, 0);
  }

  /**
   * Verify a 4-byte checksum against a calculated checksum.
   * @param {Function} hash
   * @returns {Number} checksum
   * @throws on bad checksum
   */

  verifyChecksum(hash) {
    const checksum = this.createChecksum(hash);
    const expect = this.readU32();

    if (checksum !== expect)
      throw new EncodingError(this.offset, 'Checksum mismatch');

    return checksum;
  }
}

/*
 * Expose
 */

module.exports = BufferReader;
}],
[/* 9 */ 'bufio', '/lib/writer.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * writer.js - buffer writer for bcoin
 * Copyright (c) 2014-2015, Fedor Indutny (MIT License)
 * Copyright (c) 2014-2017, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcoin
 */

'use strict';

const enforce = __node_require__(6 /* './enforce' */);
const encoding = __node_require__(5 /* './encoding' */);
const EncodingError = __node_require__(7 /* './error' */);

/*
 * Constants
 */

const SEEK = 0;
const U8 = 1;
const U16 = 2;
const U16BE = 3;
const U24 = 4;
const U24BE = 5;
const U32 = 6;
const U32BE = 7;
const U40 = 8;
const U40BE = 9;
const U48 = 10;
const U48BE = 11;
const U56 = 12;
const U56BE = 13;
const U64 = 14;
const U64BE = 15;
const I8 = 16;
const I16 = 17;
const I16BE = 18;
const I24 = 19;
const I24BE = 20;
const I32 = 21;
const I32BE = 22;
const I40 = 23;
const I40BE = 24;
const I48 = 25;
const I48BE = 26;
const I56 = 27;
const I56BE = 28;
const I64 = 29;
const I64BE = 30;
const FL = 31;
const FLBE = 32;
const DBL = 33;
const DBLBE = 34;
const VARINT = 35;
const VARINT2 = 36;
const BYTES = 37;
const STR = 38;
const CHECKSUM = 39;
const FILL = 40;

/**
 * Buffer Writer
 */

class BufferWriter {
  /**
   * Create a buffer writer.
   * @constructor
   */

  constructor() {
    this.ops = [];
    this.offset = 0;
  }

  /**
   * Allocate and render the final buffer.
   * @returns {Buffer} Rendered buffer.
   */

  render() {
    const data = Buffer.allocUnsafeSlow(this.offset);

    let off = 0;

    for (const op of this.ops) {
      switch (op.type) {
        case SEEK:
          off += op.value;
          break;
        case U8:
          off = encoding.writeU8(data, op.value, off);
          break;
        case U16:
          off = encoding.writeU16(data, op.value, off);
          break;
        case U16BE:
          off = encoding.writeU16BE(data, op.value, off);
          break;
        case U24:
          off = encoding.writeU24(data, op.value, off);
          break;
        case U24BE:
          off = encoding.writeU24BE(data, op.value, off);
          break;
        case U32:
          off = encoding.writeU32(data, op.value, off);
          break;
        case U32BE:
          off = encoding.writeU32BE(data, op.value, off);
          break;
        case U40:
          off = encoding.writeU40(data, op.value, off);
          break;
        case U40BE:
          off = encoding.writeU40BE(data, op.value, off);
          break;
        case U48:
          off = encoding.writeU48(data, op.value, off);
          break;
        case U48BE:
          off = encoding.writeU48BE(data, op.value, off);
          break;
        case U56:
          off = encoding.writeU56(data, op.value, off);
          break;
        case U56BE:
          off = encoding.writeU56BE(data, op.value, off);
          break;
        case U64:
          off = encoding.writeU64(data, op.value, off);
          break;
        case U64BE:
          off = encoding.writeU64BE(data, op.value, off);
          break;
        case I8:
          off = encoding.writeI8(data, op.value, off);
          break;
        case I16:
          off = encoding.writeI16(data, op.value, off);
          break;
        case I16BE:
          off = encoding.writeI16BE(data, op.value, off);
          break;
        case I24:
          off = encoding.writeI24(data, op.value, off);
          break;
        case I24BE:
          off = encoding.writeI24BE(data, op.value, off);
          break;
        case I32:
          off = encoding.writeI32(data, op.value, off);
          break;
        case I32BE:
          off = encoding.writeI32BE(data, op.value, off);
          break;
        case I40:
          off = encoding.writeI40(data, op.value, off);
          break;
        case I40BE:
          off = encoding.writeI40BE(data, op.value, off);
          break;
        case I48:
          off = encoding.writeI48(data, op.value, off);
          break;
        case I48BE:
          off = encoding.writeI48BE(data, op.value, off);
          break;
        case I56:
          off = encoding.writeI56(data, op.value, off);
          break;
        case I56BE:
          off = encoding.writeI56BE(data, op.value, off);
          break;
        case I64:
          off = encoding.writeI64(data, op.value, off);
          break;
        case I64BE:
          off = encoding.writeI64BE(data, op.value, off);
          break;
        case FL:
          off = encoding.writeFloat(data, op.value, off);
          break;
        case FLBE:
          off = encoding.writeFloatBE(data, op.value, off);
          break;
        case DBL:
          off = encoding.writeDouble(data, op.value, off);
          break;
        case DBLBE:
          off = encoding.writeDoubleBE(data, op.value, off);
          break;
        case VARINT:
          off = encoding.writeVarint(data, op.value, off);
          break;
        case VARINT2:
          off = encoding.writeVarint2(data, op.value, off);
          break;
        case BYTES:
          off += op.data.copy(data, off);
          break;
        case STR:
          off += data.write(op.value, off, op.enc);
          break;
        case CHECKSUM:
          off += op.func(data.slice(0, off)).copy(data, off, 0, 4);
          break;
        case FILL:
          data.fill(op.value, off, off + op.size);
          off += op.size;
          break;
        default:
          throw new Error('Invalid type.');
      }
    }

    if (off !== data.length)
      throw new EncodingError(off, 'Out of bounds write');

    this.destroy();

    return data;
  }

  /**
   * Get size of data written so far.
   * @returns {Number}
   */

  getSize() {
    return this.offset;
  }

  /**
   * Seek to relative offset.
   * @param {Number} offset
   */

  seek(off) {
    enforce(Number.isSafeInteger(off), 'off', 'integer');

    if (this.offset + off < 0)
      throw new EncodingError(this.offset, 'Out of bounds write');

    this.offset += off;
    this.ops.push(new NumberOp(SEEK, off));

    return this;
  }

  /**
   * Destroy the buffer writer. Remove references to `ops`.
   */

  destroy() {
    this.ops.length = 0;
    this.offset = 0;
    return this;
  }

  /**
   * Write uint8.
   * @param {Number} value
   */

  writeU8(value) {
    this.offset += 1;
    this.ops.push(new NumberOp(U8, value));
    return this;
  }

  /**
   * Write uint16le.
   * @param {Number} value
   */

  writeU16(value) {
    this.offset += 2;
    this.ops.push(new NumberOp(U16, value));
    return this;
  }

  /**
   * Write uint16be.
   * @param {Number} value
   */

  writeU16BE(value) {
    this.offset += 2;
    this.ops.push(new NumberOp(U16BE, value));
    return this;
  }

  /**
   * Write uint24le.
   * @param {Number} value
   */

  writeU24(value) {
    this.offset += 3;
    this.ops.push(new NumberOp(U24, value));
    return this;
  }

  /**
   * Write uint24be.
   * @param {Number} value
   */

  writeU24BE(value) {
    this.offset += 3;
    this.ops.push(new NumberOp(U24BE, value));
    return this;
  }

  /**
   * Write uint32le.
   * @param {Number} value
   */

  writeU32(value) {
    this.offset += 4;
    this.ops.push(new NumberOp(U32, value));
    return this;
  }

  /**
   * Write uint32be.
   * @param {Number} value
   */

  writeU32BE(value) {
    this.offset += 4;
    this.ops.push(new NumberOp(U32BE, value));
    return this;
  }

  /**
   * Write uint40le.
   * @param {Number} value
   */

  writeU40(value) {
    this.offset += 5;
    this.ops.push(new NumberOp(U40, value));
    return this;
  }

  /**
   * Write uint40be.
   * @param {Number} value
   */

  writeU40BE(value) {
    this.offset += 5;
    this.ops.push(new NumberOp(U40BE, value));
    return this;
  }

  /**
   * Write uint48le.
   * @param {Number} value
   */

  writeU48(value) {
    this.offset += 6;
    this.ops.push(new NumberOp(U48, value));
    return this;
  }

  /**
   * Write uint48be.
   * @param {Number} value
   */

  writeU48BE(value) {
    this.offset += 6;
    this.ops.push(new NumberOp(U48BE, value));
    return this;
  }

  /**
   * Write uint56le.
   * @param {Number} value
   */

  writeU56(value) {
    this.offset += 7;
    this.ops.push(new NumberOp(U56, value));
    return this;
  }

  /**
   * Write uint56be.
   * @param {Number} value
   */

  writeU56BE(value) {
    this.offset += 7;
    this.ops.push(new NumberOp(U56BE, value));
    return this;
  }

  /**
   * Write uint64le.
   * @param {Number} value
   */

  writeU64(value) {
    this.offset += 8;
    this.ops.push(new NumberOp(U64, value));
    return this;
  }

  /**
   * Write uint64be.
   * @param {Number} value
   */

  writeU64BE(value) {
    this.offset += 8;
    this.ops.push(new NumberOp(U64BE, value));
    return this;
  }

  /**
   * Write int8.
   * @param {Number} value
   */

  writeI8(value) {
    this.offset += 1;
    this.ops.push(new NumberOp(I8, value));
    return this;
  }

  /**
   * Write int16le.
   * @param {Number} value
   */

  writeI16(value) {
    this.offset += 2;
    this.ops.push(new NumberOp(I16, value));
    return this;
  }

  /**
   * Write int16be.
   * @param {Number} value
   */

  writeI16BE(value) {
    this.offset += 2;
    this.ops.push(new NumberOp(I16BE, value));
    return this;
  }

  /**
   * Write int24le.
   * @param {Number} value
   */

  writeI24(value) {
    this.offset += 3;
    this.ops.push(new NumberOp(I24, value));
    return this;
  }

  /**
   * Write int24be.
   * @param {Number} value
   */

  writeI24BE(value) {
    this.offset += 3;
    this.ops.push(new NumberOp(I24BE, value));
    return this;
  }

  /**
   * Write int32le.
   * @param {Number} value
   */

  writeI32(value) {
    this.offset += 4;
    this.ops.push(new NumberOp(I32, value));
    return this;
  }

  /**
   * Write int32be.
   * @param {Number} value
   */

  writeI32BE(value) {
    this.offset += 4;
    this.ops.push(new NumberOp(I32BE, value));
    return this;
  }

  /**
   * Write int40le.
   * @param {Number} value
   */

  writeI40(value) {
    this.offset += 5;
    this.ops.push(new NumberOp(I40, value));
    return this;
  }

  /**
   * Write int40be.
   * @param {Number} value
   */

  writeI40BE(value) {
    this.offset += 5;
    this.ops.push(new NumberOp(I40BE, value));
    return this;
  }

  /**
   * Write int48le.
   * @param {Number} value
   */

  writeI48(value) {
    this.offset += 6;
    this.ops.push(new NumberOp(I48, value));
    return this;
  }

  /**
   * Write int48be.
   * @param {Number} value
   */

  writeI48BE(value) {
    this.offset += 6;
    this.ops.push(new NumberOp(I48BE, value));
    return this;
  }

  /**
   * Write int56le.
   * @param {Number} value
   */

  writeI56(value) {
    this.offset += 7;
    this.ops.push(new NumberOp(I56, value));
    return this;
  }

  /**
   * Write int56be.
   * @param {Number} value
   */

  writeI56BE(value) {
    this.offset += 7;
    this.ops.push(new NumberOp(I56BE, value));
    return this;
  }

  /**
   * Write int64le.
   * @param {Number} value
   */

  writeI64(value) {
    this.offset += 8;
    this.ops.push(new NumberOp(I64, value));
    return this;
  }

  /**
   * Write int64be.
   * @param {Number} value
   */

  writeI64BE(value) {
    this.offset += 8;
    this.ops.push(new NumberOp(I64BE, value));
    return this;
  }

  /**
   * Write float le.
   * @param {Number} value
   */

  writeFloat(value) {
    this.offset += 4;
    this.ops.push(new NumberOp(FL, value));
    return this;
  }

  /**
   * Write float be.
   * @param {Number} value
   */

  writeFloatBE(value) {
    this.offset += 4;
    this.ops.push(new NumberOp(FLBE, value));
    return this;
  }

  /**
   * Write double le.
   * @param {Number} value
   */

  writeDouble(value) {
    this.offset += 8;
    this.ops.push(new NumberOp(DBL, value));
    return this;
  }

  /**
   * Write double be.
   * @param {Number} value
   */

  writeDoubleBE(value) {
    this.offset += 8;
    this.ops.push(new NumberOp(DBLBE, value));
    return this;
  }

  /**
   * Write a varint.
   * @param {Number} value
   */

  writeVarint(value) {
    this.offset += encoding.sizeVarint(value);
    this.ops.push(new NumberOp(VARINT, value));
    return this;
  }

  /**
   * Write a varint (type 2).
   * @param {Number} value
   */

  writeVarint2(value) {
    this.offset += encoding.sizeVarint2(value);
    this.ops.push(new NumberOp(VARINT2, value));
    return this;
  }

  /**
   * Write bytes.
   * @param {Buffer} value
   */

  writeBytes(value) {
    enforce(Buffer.isBuffer(value), 'value', 'buffer');

    if (value.length === 0)
      return this;

    this.offset += value.length;
    this.ops.push(new BufferOp(BYTES, value));

    return this;
  }

  /**
   * Write bytes with a varint length before them.
   * @param {Buffer} value
   */

  writeVarBytes(value) {
    enforce(Buffer.isBuffer(value), 'value', 'buffer');

    this.offset += encoding.sizeVarint(value.length);
    this.ops.push(new NumberOp(VARINT, value.length));

    if (value.length === 0)
      return this;

    this.offset += value.length;
    this.ops.push(new BufferOp(BYTES, value));

    return this;
  }

  /**
   * Copy bytes.
   * @param {Buffer} value
   * @param {Number} start
   * @param {Number} end
   */

  copy(value, start, end) {
    enforce(Buffer.isBuffer(value), 'value', 'buffer');
    enforce((start >>> 0) === start, 'start', 'integer');
    enforce((end >>> 0) === end, 'end', 'integer');
    enforce(end >= start, 'start', 'integer');

    const buf = value.slice(start, end);

    this.writeBytes(buf);

    return this;
  }

  /**
   * Write string to buffer.
   * @param {String} value
   * @param {String?} enc - Any buffer-supported encoding.
   */

  writeString(value, enc) {
    if (enc == null)
      enc = 'binary';

    enforce(typeof value === 'string', 'value', 'string');
    enforce(typeof enc === 'string', 'enc', 'string');

    if (value.length === 0)
      return this;

    this.offset += Buffer.byteLength(value, enc);
    this.ops.push(new StringOp(STR, value, enc));

    return this;
  }

  /**
   * Write a 32 byte hash.
   * @param {Hash} value
   */

  writeHash(value) {
    if (typeof value !== 'string') {
      enforce(Buffer.isBuffer(value), 'value', 'buffer');
      enforce(value.length === 32, 'value', '32-byte hash');
      this.writeBytes(value);
      return this;
    }

    enforce(value.length === 64, 'value', '32-byte hash');

    this.writeString(value, 'hex');

    return this;
  }

  /**
   * Write a string with a varint length before it.
   * @param {String}
   * @param {String?} enc - Any buffer-supported encoding.
   */

  writeVarString(value, enc) {
    if (enc == null)
      enc = 'binary';

    enforce(typeof value === 'string', 'value', 'string');
    enforce(typeof enc === 'string', 'enc', 'string');

    if (value.length === 0) {
      this.ops.push(new NumberOp(VARINT, 0));
      return this;
    }

    const size = Buffer.byteLength(value, enc);

    this.offset += encoding.sizeVarint(size);
    this.offset += size;

    this.ops.push(new NumberOp(VARINT, size));
    this.ops.push(new StringOp(STR, value, enc));

    return this;
  }

  /**
   * Write a null-terminated string.
   * @param {String|Buffer}
   * @param {String?} enc - Any buffer-supported encoding.
   */

  writeNullString(value, enc) {
    this.writeString(value, enc);
    this.writeU8(0);
    return this;
  }

  /**
   * Calculate and write a checksum for the data written so far.
   * @param {Function} hash
   */

  writeChecksum(hash) {
    if (hash && typeof hash.digest === 'function')
      hash = hash.digest.bind(hash);

    enforce(typeof hash === 'function', 'hash', 'function');

    this.offset += 4;
    this.ops.push(new FunctionOp(CHECKSUM, hash));

    return this;
  }

  /**
   * Fill N bytes with value.
   * @param {Number} value
   * @param {Number} size
   */

  fill(value, size) {
    enforce((value & 0xff) === value, 'value', 'byte');
    enforce((size >>> 0) === size, 'size', 'integer');

    if (size === 0)
      return this;

    this.offset += size;
    this.ops.push(new FillOp(FILL, value, size));

    return this;
  }
}

/*
 * Helpers
 */

class WriteOp {
  constructor(type) {
    this.type = type;
  }
}

class NumberOp extends WriteOp {
  constructor(type, value) {
    super(type);
    this.value = value;
  }
}

class BufferOp extends WriteOp {
  constructor(type, data) {
    super(type);
    this.data = data;
  }
}

class StringOp extends WriteOp {
  constructor(type, value, enc) {
    super(type);
    this.value = value;
    this.enc = enc;
  }
}

class FunctionOp extends WriteOp {
  constructor(type, func) {
    super(type);
    this.func = func;
  }
}

class FillOp extends WriteOp {
  constructor(type, value, size) {
    super(type);
    this.value = value;
    this.size = size;
  }
}

/*
 * Expose
 */

module.exports = BufferWriter;
}],
[/* 10 */ 'bufio', '/lib/staticwriter.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * staticwriter.js - buffer writer for bcoin
 * Copyright (c) 2014-2017, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcoin
 */

'use strict';

const enforce = __node_require__(6 /* './enforce' */);
const encoding = __node_require__(5 /* './encoding' */);
const EncodingError = __node_require__(7 /* './error' */);

/*
 * Constants
 */

const EMPTY = Buffer.alloc(0);
const POOL_SIZE = 100 << 10;

let POOL = null;

/**
 * Statically Allocated Writer
 */

class StaticWriter {
  /**
   * Statically allocated buffer writer.
   * @constructor
   * @param {Number|Buffer} options
   */

  constructor(options) {
    this.data = EMPTY;
    this.offset = 0;

    if (options != null)
      this.init(options);
  }

  /**
   * Assertion.
   * @param {Number} size
   */

  check(size) {
    if (this.offset + size > this.data.length)
      throw new EncodingError(this.offset, 'Out of bounds write', this.check);
  }

  /**
   * Initialize options.
   * @param {Object} options
   */

  init(options) {
    if (Buffer.isBuffer(options)) {
      this.data = options;
      this.offset = 0;
      return this;
    }

    enforce((options >>> 0) === options, 'size', 'integer');

    this.data = Buffer.allocUnsafeSlow(options);
    this.offset = 0;

    return this;
  }

  /**
   * Allocate writer from preallocated 100kb pool.
   * @param {Number} size
   * @returns {StaticWriter}
   */

  static pool(size) {
    enforce((size >>> 0) === size, 'size', 'integer');

    if (size <= POOL_SIZE) {
      if (!POOL)
        POOL = Buffer.allocUnsafeSlow(POOL_SIZE);

      const bw = new StaticWriter();

      bw.data = POOL.slice(0, size);

      return bw;
    }

    return new StaticWriter(size);
  }

  /**
   * Allocate and render the final buffer.
   * @returns {Buffer} Rendered buffer.
   */

  render() {
    const {data, offset} = this;

    if (offset !== data.length)
      throw new EncodingError(offset, 'Out of bounds write');

    this.destroy();

    return data;
  }

  /**
   * Slice the final buffer at written offset.
   * @returns {Buffer} Rendered buffer.
   */

  slice() {
    const {data, offset} = this;

    if (offset > data.length)
      throw new EncodingError(offset, 'Out of bounds write');

    this.destroy();

    return data.slice(0, offset);
  }

  /**
   * Get size of data written so far.
   * @returns {Number}
   */

  getSize() {
    return this.offset;
  }

  /**
   * Seek to relative offset.
   * @param {Number} off
   */

  seek(off) {
    enforce(Number.isSafeInteger(off), 'off', 'integer');

    if (this.offset + off < 0)
      throw new EncodingError(this.offset, 'Out of bounds write');

    this.check(off);
    this.offset += off;

    return this;
  }

  /**
   * Destroy the buffer writer.
   */

  destroy() {
    this.data = EMPTY;
    this.offset = 0;
    return this;
  }

  /**
   * Write uint8.
   * @param {Number} value
   */

  writeU8(value) {
    this.check(1);
    this.offset = encoding.writeU8(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint16le.
   * @param {Number} value
   */

  writeU16(value) {
    this.check(2);
    this.offset = encoding.writeU16(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint16be.
   * @param {Number} value
   */

  writeU16BE(value) {
    this.check(2);
    this.offset = encoding.writeU16BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint24le.
   * @param {Number} value
   */

  writeU24(value) {
    this.check(3);
    this.offset = encoding.writeU24(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint24be.
   * @param {Number} value
   */

  writeU24BE(value) {
    this.check(3);
    this.offset = encoding.writeU24BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint32le.
   * @param {Number} value
   */

  writeU32(value) {
    this.check(4);
    this.offset = encoding.writeU32(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint32be.
   * @param {Number} value
   */

  writeU32BE(value) {
    this.check(4);
    this.offset = encoding.writeU32BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint40le.
   * @param {Number} value
   */

  writeU40(value) {
    this.check(5);
    this.offset = encoding.writeU40(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint40be.
   * @param {Number} value
   */

  writeU40BE(value) {
    this.check(5);
    this.offset = encoding.writeU40BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint48le.
   * @param {Number} value
   */

  writeU48(value) {
    this.check(6);
    this.offset = encoding.writeU48(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint48be.
   * @param {Number} value
   */

  writeU48BE(value) {
    this.check(6);
    this.offset = encoding.writeU48BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint56le.
   * @param {Number} value
   */

  writeU56(value) {
    this.check(7);
    this.offset = encoding.writeU56(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint56be.
   * @param {Number} value
   */

  writeU56BE(value) {
    this.check(7);
    this.offset = encoding.writeU56BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint64le.
   * @param {Number} value
   */

  writeU64(value) {
    this.check(8);
    this.offset = encoding.writeU64(this.data, value, this.offset);
    return this;
  }

  /**
   * Write uint64be.
   * @param {Number} value
   */

  writeU64BE(value) {
    this.check(8);
    this.offset = encoding.writeU64BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int8.
   * @param {Number} value
   */

  writeI8(value) {
    this.check(1);
    this.offset = encoding.writeI8(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int16le.
   * @param {Number} value
   */

  writeI16(value) {
    this.check(2);
    this.offset = encoding.writeI16(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int16be.
   * @param {Number} value
   */

  writeI16BE(value) {
    this.check(2);
    this.offset = encoding.writeI16BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int24le.
   * @param {Number} value
   */

  writeI24(value) {
    this.check(3);
    this.offset = encoding.writeI24(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int24be.
   * @param {Number} value
   */

  writeI24BE(value) {
    this.check(3);
    this.offset = encoding.writeI24BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int32le.
   * @param {Number} value
   */

  writeI32(value) {
    this.check(4);
    this.offset = encoding.writeI32(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int32be.
   * @param {Number} value
   */

  writeI32BE(value) {
    this.check(4);
    this.offset = encoding.writeI32BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int40le.
   * @param {Number} value
   */

  writeI40(value) {
    this.check(5);
    this.offset = encoding.writeI40(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int40be.
   * @param {Number} value
   */

  writeI40BE(value) {
    this.check(5);
    this.offset = encoding.writeI40BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int48le.
   * @param {Number} value
   */

  writeI48(value) {
    this.check(6);
    this.offset = encoding.writeI48(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int48be.
   * @param {Number} value
   */

  writeI48BE(value) {
    this.check(6);
    this.offset = encoding.writeI48BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int56le.
   * @param {Number} value
   */

  writeI56(value) {
    this.check(7);
    this.offset = encoding.writeI56(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int56be.
   * @param {Number} value
   */

  writeI56BE(value) {
    this.check(7);
    this.offset = encoding.writeI56BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int64le.
   * @param {Number} value
   */

  writeI64(value) {
    this.check(8);
    this.offset = encoding.writeI64(this.data, value, this.offset);
    return this;
  }

  /**
   * Write int64be.
   * @param {Number} value
   */

  writeI64BE(value) {
    this.check(8);
    this.offset = encoding.writeI64BE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write float le.
   * @param {Number} value
   */

  writeFloat(value) {
    this.check(4);
    this.offset = encoding.writeFloat(this.data, value, this.offset);
    return this;
  }

  /**
   * Write float be.
   * @param {Number} value
   */

  writeFloatBE(value) {
    this.check(4);
    this.offset = encoding.writeFloatBE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write double le.
   * @param {Number} value
   */

  writeDouble(value) {
    this.check(8);
    this.offset = encoding.writeDouble(this.data, value, this.offset);
    return this;
  }

  /**
   * Write double be.
   * @param {Number} value
   */

  writeDoubleBE(value) {
    this.check(8);
    this.offset = encoding.writeDoubleBE(this.data, value, this.offset);
    return this;
  }

  /**
   * Write a varint.
   * @param {Number} value
   */

  writeVarint(value) {
    this.offset = encoding.writeVarint(this.data, value, this.offset);
    return this;
  }

  /**
   * Write a varint (type 2).
   * @param {Number} value
   */

  writeVarint2(value) {
    this.offset = encoding.writeVarint2(this.data, value, this.offset);
    return this;
  }

  /**
   * Write bytes.
   * @param {Buffer} value
   */

  writeBytes(value) {
    enforce(Buffer.isBuffer(value), 'value', 'buffer');

    this.check(value.length);
    this.offset += value.copy(this.data, this.offset);

    return this;
  }

  /**
   * Write bytes with a varint length before them.
   * @param {Buffer} value
   */

  writeVarBytes(value) {
    enforce(Buffer.isBuffer(value), 'value', 'buffer');

    this.writeVarint(value.length);
    this.writeBytes(value);

    return this;
  }

  /**
   * Copy bytes.
   * @param {Buffer} value
   * @param {Number} start
   * @param {Number} end
   */

  copy(value, start, end) {
    enforce(Buffer.isBuffer(value), 'value', 'buffer');
    enforce((start >>> 0) === start, 'start', 'integer');
    enforce((end >>> 0) === end, 'end', 'integer');
    enforce(end >= start, 'start', 'integer');

    this.check(end - start);
    this.offset += value.copy(this.data, this.offset, start, end);

    return this;
  }

  /**
   * Write string to buffer.
   * @param {String} value
   * @param {String?} enc - Any buffer-supported encoding.
   */

  writeString(value, enc) {
    if (enc == null)
      enc = 'binary';

    enforce(typeof value === 'string', 'value', 'string');
    enforce(typeof enc === 'string', 'enc', 'string');

    if (value.length === 0)
      return this;

    const size = Buffer.byteLength(value, enc);

    this.check(size);

    this.offset += this.data.write(value, this.offset, enc);

    return this;
  }

  /**
   * Write a 32 byte hash.
   * @param {Hash} value
   */

  writeHash(value) {
    if (typeof value !== 'string') {
      enforce(Buffer.isBuffer(value), 'value', 'buffer');
      enforce(value.length === 32, 'value', '32-byte hash');
      this.writeBytes(value);
      return this;
    }

    enforce(value.length === 64, 'value', '32-byte hash');

    this.check(32);
    this.offset += this.data.write(value, this.offset, 'hex');

    return this;
  }

  /**
   * Write a string with a varint length before it.
   * @param {String}
   * @param {String?} enc - Any buffer-supported encoding.
   */

  writeVarString(value, enc) {
    if (enc == null)
      enc = 'binary';

    enforce(typeof value === 'string', 'value', 'string');
    enforce(typeof enc === 'string', 'enc', 'string');

    if (value.length === 0) {
      this.writeVarint(0);
      return this;
    }

    const size = Buffer.byteLength(value, enc);

    this.writeVarint(size);
    this.check(size);
    this.offset += this.data.write(value, this.offset, enc);

    return this;
  }

  /**
   * Write a null-terminated string.
   * @param {String|Buffer}
   * @param {String?} enc - Any buffer-supported encoding.
   */

  writeNullString(value, enc) {
    this.writeString(value, enc);
    this.writeU8(0);
    return this;
  }

  /**
   * Calculate and write a checksum for the data written so far.
   * @param {Function} hash
   */

  writeChecksum(hash) {
    if (!hash || typeof hash.digest !== 'function')
      enforce(typeof hash === 'function', 'hash', 'function');

    this.check(4);

    const data = this.data.slice(0, this.offset);
    const raw = hash.digest ? hash.digest(data) : hash(data);

    raw.copy(this.data, this.offset, 0, 4);

    this.offset += 4;

    return this;
  }

  /**
   * Fill N bytes with value.
   * @param {Number} value
   * @param {Number} size
   */

  fill(value, size) {
    enforce((value & 0xff) === value, 'value', 'byte');
    enforce((size >>> 0) === size, 'size', 'integer');

    this.check(size);

    this.data.fill(value, this.offset, this.offset + size);
    this.offset += size;

    return this;
  }
}

/*
 * Expose
 */

module.exports = StaticWriter;
}],
[/* 11 */ 'bufio', '/lib/struct.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * struct.js - struct object for bcoin
 * Copyright (c) 2018, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcoin
 */

'use strict';

const enforce = __node_require__(6 /* './enforce' */);
const BufferReader = __node_require__(8 /* './reader' */);
const BufferWriter = __node_require__(9 /* './writer' */);
const StaticWriter = __node_require__(10 /* './staticwriter' */);
const {custom} = __node_require__(4 /* './custom' */);

/**
 * Struct
 */

class Struct {
  constructor() {}

  inject(obj) {
    enforce(obj instanceof this.constructor, 'obj', 'struct');
    return this.decode(obj.encode());
  }

  clone() {
    const copy = new this.constructor();
    return copy.inject(this);
  }

  /*
   * Bindable
   */

  getSize(extra) {
    return -1;
  }

  write(bw, extra) {
    return bw;
  }

  read(br, extra) {
    return this;
  }

  toString() {
    return Object.prototype.toString.call(this);
  }

  fromString(str, extra) {
    return this;
  }

  getJSON() {
    return this;
  }

  fromJSON(json, extra) {
    return this;
  }

  fromOptions(options, extra) {
    return this;
  }

  from(options, extra) {
    return this.fromOptions(options, extra);
  }

  format() {
    return this.getJSON();
  }

  /*
   * API
   */

  encode(extra) {
    const size = this.getSize(extra);
    const bw = size === -1
      ? new BufferWriter()
      : new StaticWriter(size);

    this.write(bw, extra);

    return bw.render();
  }

  decode(data, extra) {
    const br = new BufferReader(data);

    this.read(br, extra);

    return this;
  }

  toHex(extra) {
    return this.encode(extra).toString('hex');
  }

  fromHex(str, extra) {
    enforce(typeof str === 'string', 'str', 'string');

    const size = str.length >>> 1;
    const data = Buffer.from(str, 'hex');

    if (data.length !== size)
      throw new Error('Invalid hex string.');

    return this.decode(data, extra);
  }

  toBase64(extra) {
    return this.encode(extra).toString('base64');
  }

  fromBase64(str, extra) {
    enforce(typeof str === 'string', 'str', 'string');

    const data = Buffer.from(str, 'base64');

    if (str.length > size64(data.length))
      throw new Error('Invalid base64 string.');

    return this.decode(data, extra);
  }

  toJSON() {
    return this.getJSON();
  }

  [custom]() {
    return this.format();
  }

  /*
   * Static API
   */

  static read(br, extra) {
    return new this().read(br, extra);
  }

  static decode(data, extra) {
    return new this().decode(data, extra);
  }

  static fromHex(str, extra) {
    return new this().fromHex(str, extra);
  }

  static fromBase64(str, extra) {
    return new this().fromBase64(str, extra);
  }

  static fromString(str, extra) {
    return new this().fromString(str, extra);
  }

  static fromJSON(json, extra) {
    return new this().fromJSON(json, extra);
  }

  static fromOptions(options, extra) {
    return new this().fromOptions(options, extra);
  }

  static from(options, extra) {
    return new this().from(options, extra);
  }

  /*
   * Aliases
   */

  toWriter(bw, extra) {
    return this.write(bw, extra);
  }

  fromReader(br, extra) {
    return this.read(br, extra);
  }

  toRaw(extra) {
    return this.encode(extra);
  }

  fromRaw(data, extra) {
    return this.decode(data, extra);
  }

  /*
   * Static Aliases
   */

  static fromReader(br, extra) {
    return this.read(br, extra);
  }

  static fromRaw(data, extra) {
    return this.decode(data, extra);
  }
}

/*
 * Helpers
 */

function size64(size) {
  const expect = ((4 * size / 3) + 3) & ~3;
  return expect >>> 0;
}

/*
 * Expose
 */

module.exports = Struct;
}],
[/* 12 */ 'bcrypto', '/lib/encoding/base58-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * base58.js - base58 for bcrypto
 * Copyright (c) 2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(13 /* '../js/base58' */);
}],
[/* 13 */ 'bcrypto', '/lib/js/base58.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * base58.js - base58 for bcrypto
 * Copyright (c) 2014-2015, Fedor Indutny (MIT License)
 * Copyright (c) 2014-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on bitcoin/bitcoin:
 *   Copyright (c) 2009-2019, The Bitcoin Core Developers (MIT License).
 *   Copyright (c) 2009-2019, The Bitcoin Developers (MIT License).
 *   https://github.com/bitcoin/bitcoin
 *
 * Resources:
 *   https://github.com/bitcoin/bitcoin/blob/master/src/base58.cpp
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);

/*
 * Constants
 */

const CHARSET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';

const TABLE = [
  -1, -1, -1, -1, -1, -1, -1, -1,
  -1, -1, -1, -1, -1, -1, -1, -1,
  -1, -1, -1, -1, -1, -1, -1, -1,
  -1, -1, -1, -1, -1, -1, -1, -1,
  -1, -1, -1, -1, -1, -1, -1, -1,
  -1, -1, -1, -1, -1, -1, -1, -1,
  -1,  0,  1,  2,  3,  4,  5,  6,
   7,  8, -1, -1, -1, -1, -1, -1,
  -1,  9, 10, 11, 12, 13, 14, 15,
  16, -1, 17, 18, 19, 20, 21, -1,
  22, 23, 24, 25, 26, 27, 28, 29,
  30, 31, 32, -1, -1, -1, -1, -1,
  -1, 33, 34, 35, 36, 37, 38, 39,
  40, 41, 42, 43, -1, 44, 45, 46,
  47, 48, 49, 50, 51, 52, 53, 54,
  55, 56, 57, -1, -1, -1, -1, -1
];

const pool = Buffer.alloc(128);

/**
 * Encode a base58 string.
 * @param {Buffer} data
 * @returns {String}
 */

function encode(data) {
  assert(Buffer.isBuffer(data));

  let zeroes = 0;
  let i = 0;

  for (; i < data.length; i++) {
    if (data[i] !== 0)
      break;

    zeroes += 1;
  }

  const size = (((data.length - zeroes) * 138 / 100) | 0) + 1;
  const b58 = size <= 128 ? pool.fill(0) : Buffer.alloc(size);

  let length = 0;

  for (; i < data.length; i++) {
    let carry = data[i];
    let j = 0;

    for (let k = size - 1; k >= 0; k--, j++) {
      if (carry === 0 && j >= length)
        break;

      carry += b58[k] * 256;
      b58[k] = carry % 58;
      carry = (carry / 58) | 0;
    }

    assert(carry === 0);

    length = j;
  }

  i = size - length;

  while (i < size && b58[i] === 0)
    i += 1;

  let str = '';

  for (let j = 0; j < zeroes; j++)
    str += '1';

  while (i < size)
    str += CHARSET[b58[i++]];

  return str;
}

/**
 * Decode a base58 string.
 * @param {String} str
 * @returns {Buffer}
 * @throws on non-base58 character.
 */

function decode(str) {
  assert(typeof str === 'string');

  let zeroes = 0;
  let i = 0;

  for (; i < str.length; i++) {
    if (str[i] !== '1')
      break;

    zeroes += 1;
  }

  const size = ((str.length * 733) / 1000 | 0) + 1;
  const b256 = size <= 128 ? pool.fill(0) : Buffer.alloc(size);

  let length = 0;

  for (; i < str.length; i++) {
    const ch = str.charCodeAt(i);

    if (ch & 0xff80)
      throw new Error('Invalid base58 string.');

    const val = TABLE[ch];

    if (val === -1)
      throw new Error('Invalid base58 string.');

    let carry = val;
    let j = 0;

    for (let k = size - 1; k >= 0; k--, j++) {
      if (carry === 0 && j >= length)
        break;

      carry += b256[k] * 58;
      b256[k] = carry;
      carry >>>= 8;
    }

    assert(carry === 0);

    length = j;
  }

  // See: https://github.com/bitcoin/bitcoin/commit/2bcf1fc4
  i = size - length;

  const out = Buffer.alloc(zeroes + (size - i));

  let j;

  for (j = 0; j < zeroes; j++)
    out[j] = 0;

  while (i < size)
    out[j++] = b256[i++];

  return out;
}

/**
 * Test whether the string is a base58 string.
 * @param {String} str
 * @returns {Buffer}
 */

function test(str) {
  assert(typeof str === 'string');

  for (let i = 0; i < str.length; i++) {
    const ch = str.charCodeAt(i);

    if (ch & 0xff80)
      return false;

    if (TABLE[ch] === -1)
      return false;
  }

  return true;
}

/*
 * Expose
 */

exports.native = 0;
exports.encode = encode;
exports.decode = decode;
exports.test = test;
}],
[/* 14 */ 'bcrypto', '/lib/internal/assert.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * assert.js - assert for bcrypto
 * Copyright (c) 2020, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

/*
 * Assert
 */

function assert(val, msg) {
  if (!val) {
    const err = new Error(msg || 'Assertion failed');

    if (Error.captureStackTrace)
      Error.captureStackTrace(err, assert);

    throw err;
  }
}

/*
 * Expose
 */

module.exports = assert;
}],
[/* 15 */ 'bcrypto', '/lib/sha512-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * sha512.js - sha512 for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(16 /* './js/sha512' */);
}],
[/* 16 */ 'bcrypto', '/lib/js/sha512.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * sha512.js - SHA512 implementation for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on indutny/hash.js:
 *   Copyright (c) 2014, Fedor Indutny (MIT License).
 *   https://github.com/indutny/hash.js
 *
 * Resources:
 *   https://en.wikipedia.org/wiki/SHA-2
 *   https://tools.ietf.org/html/rfc4634
 *   https://github.com/indutny/hash.js/blob/master/lib/hash/sha/512.js
 */

/* eslint camelcase: "off" */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);
const HMAC = __node_require__(17 /* '../internal/hmac' */);

/*
 * Constants
 */

const FINALIZED = -1;
const DESC = Buffer.alloc(16, 0x00);
const PADDING = Buffer.alloc(128, 0x00);

PADDING[0] = 0x80;

const K = new Uint32Array([
  0x428a2f98, 0xd728ae22, 0x71374491, 0x23ef65cd,
  0xb5c0fbcf, 0xec4d3b2f, 0xe9b5dba5, 0x8189dbbc,
  0x3956c25b, 0xf348b538, 0x59f111f1, 0xb605d019,
  0x923f82a4, 0xaf194f9b, 0xab1c5ed5, 0xda6d8118,
  0xd807aa98, 0xa3030242, 0x12835b01, 0x45706fbe,
  0x243185be, 0x4ee4b28c, 0x550c7dc3, 0xd5ffb4e2,
  0x72be5d74, 0xf27b896f, 0x80deb1fe, 0x3b1696b1,
  0x9bdc06a7, 0x25c71235, 0xc19bf174, 0xcf692694,
  0xe49b69c1, 0x9ef14ad2, 0xefbe4786, 0x384f25e3,
  0x0fc19dc6, 0x8b8cd5b5, 0x240ca1cc, 0x77ac9c65,
  0x2de92c6f, 0x592b0275, 0x4a7484aa, 0x6ea6e483,
  0x5cb0a9dc, 0xbd41fbd4, 0x76f988da, 0x831153b5,
  0x983e5152, 0xee66dfab, 0xa831c66d, 0x2db43210,
  0xb00327c8, 0x98fb213f, 0xbf597fc7, 0xbeef0ee4,
  0xc6e00bf3, 0x3da88fc2, 0xd5a79147, 0x930aa725,
  0x06ca6351, 0xe003826f, 0x14292967, 0x0a0e6e70,
  0x27b70a85, 0x46d22ffc, 0x2e1b2138, 0x5c26c926,
  0x4d2c6dfc, 0x5ac42aed, 0x53380d13, 0x9d95b3df,
  0x650a7354, 0x8baf63de, 0x766a0abb, 0x3c77b2a8,
  0x81c2c92e, 0x47edaee6, 0x92722c85, 0x1482353b,
  0xa2bfe8a1, 0x4cf10364, 0xa81a664b, 0xbc423001,
  0xc24b8b70, 0xd0f89791, 0xc76c51a3, 0x0654be30,
  0xd192e819, 0xd6ef5218, 0xd6990624, 0x5565a910,
  0xf40e3585, 0x5771202a, 0x106aa070, 0x32bbd1b8,
  0x19a4c116, 0xb8d2d0c8, 0x1e376c08, 0x5141ab53,
  0x2748774c, 0xdf8eeb99, 0x34b0bcb5, 0xe19b48a8,
  0x391c0cb3, 0xc5c95a63, 0x4ed8aa4a, 0xe3418acb,
  0x5b9cca4f, 0x7763e373, 0x682e6ff3, 0xd6b2b8a3,
  0x748f82ee, 0x5defb2fc, 0x78a5636f, 0x43172f60,
  0x84c87814, 0xa1f0ab72, 0x8cc70208, 0x1a6439ec,
  0x90befffa, 0x23631e28, 0xa4506ceb, 0xde82bde9,
  0xbef9a3f7, 0xb2c67915, 0xc67178f2, 0xe372532b,
  0xca273ece, 0xea26619c, 0xd186b8c7, 0x21c0c207,
  0xeada7dd6, 0xcde0eb1e, 0xf57d4f7f, 0xee6ed178,
  0x06f067aa, 0x72176fba, 0x0a637dc5, 0xa2c898a6,
  0x113f9804, 0xbef90dae, 0x1b710b35, 0x131c471b,
  0x28db77f5, 0x23047d84, 0x32caab7b, 0x40c72493,
  0x3c9ebe0a, 0x15c9bebc, 0x431d67c4, 0x9c100d4c,
  0x4cc5d4be, 0xcb3e42b6, 0x597f299c, 0xfc657e2a,
  0x5fcb6fab, 0x3ad6faec, 0x6c44198c, 0x4a475817
]);

/**
 * SHA512
 */

class SHA512 {
  constructor() {
    this.state = new Uint32Array(16);
    this.msg = new Uint32Array(160);
    this.block = Buffer.alloc(128);
    this.size = FINALIZED;
  }

  init() {
    this.state[0] = 0x6a09e667;
    this.state[1] = 0xf3bcc908;
    this.state[2] = 0xbb67ae85;
    this.state[3] = 0x84caa73b;
    this.state[4] = 0x3c6ef372;
    this.state[5] = 0xfe94f82b;
    this.state[6] = 0xa54ff53a;
    this.state[7] = 0x5f1d36f1;
    this.state[8] = 0x510e527f;
    this.state[9] = 0xade682d1;
    this.state[10] = 0x9b05688c;
    this.state[11] = 0x2b3e6c1f;
    this.state[12] = 0x1f83d9ab;
    this.state[13] = 0xfb41bd6b;
    this.state[14] = 0x5be0cd19;
    this.state[15] = 0x137e2179;
    this.size = 0;
    return this;
  }

  update(data) {
    assert(Buffer.isBuffer(data));
    this._update(data, data.length);
    return this;
  }

  final() {
    return this._final(Buffer.alloc(64));
  }

  _update(data, len) {
    assert(this.size !== FINALIZED, 'Context is not initialized.');

    let pos = this.size & 127;
    let off = 0;

    this.size += len;

    if (pos > 0) {
      let want = 128 - pos;

      if (want > len)
        want = len;

      data.copy(this.block, pos, off, off + want);

      pos += want;
      len -= want;
      off += want;

      if (pos < 128)
        return;

      this._transform(this.block, 0);
    }

    while (len >= 128) {
      this._transform(data, off);
      off += 128;
      len -= 128;
    }

    if (len > 0)
      data.copy(this.block, 0, off, off + len);
  }

  /**
   * Finalize SHA512 context.
   * @private
   * @param {Buffer} out
   * @returns {Buffer}
   */

  _final(out) {
    assert(this.size !== FINALIZED, 'Context is not initialized.');

    const pos = this.size & 127;
    const len = this.size * 8;

    writeU32(DESC, (len * (1 / 0x100000000)) >>> 0, 8);
    writeU32(DESC, len >>> 0, 12);

    this._update(PADDING, 1 + ((239 - pos) & 127));
    this._update(DESC, 16);

    for (let i = 0; i < 16; i++) {
      writeU32(out, this.state[i], i * 4);
      this.state[i] = 0;
    }

    for (let i = 0; i < 160; i++)
      this.msg[i] = 0;

    for (let i = 0; i < 128; i++)
      this.block[i] = 0;

    this.size = FINALIZED;

    return out;
  }

  _prepare(chunk, pos) {
    const W = this.msg;

    let i = 0;

    for (; i < 32; i++)
      W[i] = readU32(chunk, pos + i * 4);

    for (; i < 160; i += 2) {
      const c0_hi = g1_512_hi(W[i - 4], W[i - 3]);
      const c0_lo = g1_512_lo(W[i - 4], W[i - 3]);
      const c1_hi = W[i - 14];
      const c1_lo = W[i - 13];
      const c2_hi = g0_512_hi(W[i - 30], W[i - 29]);
      const c2_lo = g0_512_lo(W[i - 30], W[i - 29]);
      const c3_hi = W[i - 32];
      const c3_lo = W[i - 31];

      W[i + 0] = sum64_4_hi(c0_hi, c0_lo,
                            c1_hi, c1_lo,
                            c2_hi, c2_lo,
                            c3_hi, c3_lo);

      W[i + 1] = sum64_4_lo(c0_hi, c0_lo,
                            c1_hi, c1_lo,
                            c2_hi, c2_lo,
                            c3_hi, c3_lo);
    }
  }

  _transform(chunk, pos) {
    const W = this.msg;

    this._prepare(chunk, pos);

    let ah = this.state[0];
    let al = this.state[1];
    let bh = this.state[2];
    let bl = this.state[3];
    let ch = this.state[4];
    let cl = this.state[5];
    let dh = this.state[6];
    let dl = this.state[7];
    let eh = this.state[8];
    let el = this.state[9];
    let fh = this.state[10];
    let fl = this.state[11];
    let gh = this.state[12];
    let gl = this.state[13];
    let hh = this.state[14];
    let hl = this.state[15];

    for (let i = 0; i < W.length; i += 2) {
      let c0_hi = hh;
      let c0_lo = hl;
      let c1_hi = s1_512_hi(eh, el);
      let c1_lo = s1_512_lo(eh, el);

      const c2_hi = ch64_hi(eh, el, fh, fl, gh, gl);
      const c2_lo = ch64_lo(eh, el, fh, fl, gh, gl);
      const c3_hi = K[i + 0];
      const c3_lo = K[i + 1];
      const c4_hi = W[i + 0];
      const c4_lo = W[i + 1];

      const T1_hi = sum64_5_hi(c0_hi, c0_lo,
                               c1_hi, c1_lo,
                               c2_hi, c2_lo,
                               c3_hi, c3_lo,
                               c4_hi, c4_lo);

      const T1_lo = sum64_5_lo(c0_hi, c0_lo,
                               c1_hi, c1_lo,
                               c2_hi, c2_lo,
                               c3_hi, c3_lo,
                               c4_hi, c4_lo);

      c0_hi = s0_512_hi(ah, al);
      c0_lo = s0_512_lo(ah, al);
      c1_hi = maj64_hi(ah, al, bh, bl, ch, cl);
      c1_lo = maj64_lo(ah, al, bh, bl, ch, cl);

      const T2_hi = sum64_hi(c0_hi, c0_lo, c1_hi, c1_lo);
      const T2_lo = sum64_lo(c0_hi, c0_lo, c1_hi, c1_lo);

      hh = gh;
      hl = gl;

      gh = fh;
      gl = fl;

      fh = eh;
      fl = el;

      eh = sum64_hi(dh, dl, T1_hi, T1_lo);
      el = sum64_lo(dl, dl, T1_hi, T1_lo);

      dh = ch;
      dl = cl;

      ch = bh;
      cl = bl;

      bh = ah;
      bl = al;

      ah = sum64_hi(T1_hi, T1_lo, T2_hi, T2_lo);
      al = sum64_lo(T1_hi, T1_lo, T2_hi, T2_lo);
    }

    sum64(this.state, 0, ah, al);
    sum64(this.state, 2, bh, bl);
    sum64(this.state, 4, ch, cl);
    sum64(this.state, 6, dh, dl);
    sum64(this.state, 8, eh, el);
    sum64(this.state, 10, fh, fl);
    sum64(this.state, 12, gh, gl);
    sum64(this.state, 14, hh, hl);
  }

  static hash() {
    return new SHA512();
  }

  static hmac() {
    return new HMAC(SHA512, 128);
  }

  static digest(data) {
    return SHA512.ctx.init().update(data).final();
  }

  static root(left, right) {
    assert(Buffer.isBuffer(left) && left.length === 64);
    assert(Buffer.isBuffer(right) && right.length === 64);
    return SHA512.ctx.init().update(left).update(right).final();
  }

  static multi(x, y, z) {
    const {ctx} = SHA512;

    ctx.init();
    ctx.update(x);
    ctx.update(y);

    if (z)
      ctx.update(z);

    return ctx.final();
  }

  static mac(data, key) {
    return SHA512.hmac().init(key).update(data).final();
  }
}

/*
 * Static
 */

SHA512.native = 0;
SHA512.id = 'SHA512';
SHA512.size = 64;
SHA512.bits = 512;
SHA512.blockSize = 128;
SHA512.zero = Buffer.alloc(64, 0x00);
SHA512.ctx = new SHA512();

/*
 * Helpers
 */

function sum64(buf, pos, ah, al) {
  const bh = buf[pos + 0];
  const bl = buf[pos + 1];

  const lo = (al + bl) >>> 0;
  const hi = (lo < al) + ah + bh;

  buf[pos + 0] = hi >>> 0;
  buf[pos + 1] = lo;
}

function sum64_hi(ah, al, bh, bl) {
  const lo = (al + bl) >>> 0;
  const hi = (lo < al) + ah + bh;
  return hi >>> 0;
}

function sum64_lo(ah, al, bh, bl) {
  const lo = al + bl;
  return lo >>> 0;
}

function sum64_4_hi(ah, al, bh, bl, ch, cl, dh, dl) {
  let carry = 0;
  let lo = al;

  lo = (lo + bl) >>> 0;
  carry += (lo < al);

  lo = (lo + cl) >>> 0;
  carry += (lo < cl);

  lo = (lo + dl) >>> 0;
  carry += (lo < dl);

  const hi = ah + bh + ch + dh + carry;

  return hi >>> 0;
}

function sum64_4_lo(ah, al, bh, bl, ch, cl, dh, dl) {
  const lo = al + bl + cl + dl;
  return lo >>> 0;
}

function sum64_5_hi(ah, al, bh, bl, ch, cl, dh, dl, eh, el) {
  let carry = 0;
  let lo = al;

  lo = (lo + bl) >>> 0;
  carry += (lo < al);

  lo = (lo + cl) >>> 0;
  carry += (lo < cl);

  lo = (lo + dl) >>> 0;
  carry += (lo < dl);

  lo = (lo + el) >>> 0;
  carry += (lo < el);

  const hi = ah + bh + ch + dh + eh + carry;

  return hi >>> 0;
}

function sum64_5_lo(ah, al, bh, bl, ch, cl, dh, dl, eh, el) {
  const lo = al + bl + cl + dl + el;
  return lo >>> 0;
}

function rotr64_hi(ah, al, num) {
  const r = (al << (32 - num)) | (ah >>> num);
  return r >>> 0;
}

function rotr64_lo(ah, al, num) {
  const r = (ah << (32 - num)) | (al >>> num);
  return r >>> 0;
}

function shr64_hi(ah, al, num) {
  return ah >>> num;
}

function shr64_lo(ah, al, num) {
  const r = (ah << (32 - num)) | (al >>> num);
  return r >>> 0;
}

function ch64_hi(xh, xl, yh, yl, zh, zl) {
  const r = (xh & yh) ^ ((~xh) & zh);
  return r >>> 0;
}

function ch64_lo(xh, xl, yh, yl, zh, zl) {
  const r = (xl & yl) ^ ((~xl) & zl);
  return r >>> 0;
}

function maj64_hi(xh, xl, yh, yl, zh, zl) {
  const r = (xh & yh) ^ (xh & zh) ^ (yh & zh);
  return r >>> 0;
}

function maj64_lo(xh, xl, yh, yl, zh, zl) {
  const r = (xl & yl) ^ (xl & zl) ^ (yl & zl);
  return r >>> 0;
}

function s0_512_hi(xh, xl) {
  const c0_hi = rotr64_hi(xh, xl, 28);
  const c1_hi = rotr64_hi(xl, xh, 2); // 34
  const c2_hi = rotr64_hi(xl, xh, 7); // 39
  const r = c0_hi ^ c1_hi ^ c2_hi;
  return r >>> 0;
}

function s0_512_lo(xh, xl) {
  const c0_lo = rotr64_lo(xh, xl, 28);
  const c1_lo = rotr64_lo(xl, xh, 2); // 34
  const c2_lo = rotr64_lo(xl, xh, 7); // 39
  const r = c0_lo ^ c1_lo ^ c2_lo;
  return r >>> 0;
}

function s1_512_hi(xh, xl) {
  const c0_hi = rotr64_hi(xh, xl, 14);
  const c1_hi = rotr64_hi(xh, xl, 18);
  const c2_hi = rotr64_hi(xl, xh, 9); // 41
  const r = c0_hi ^ c1_hi ^ c2_hi;
  return r >>> 0;
}

function s1_512_lo(xh, xl) {
  const c0_lo = rotr64_lo(xh, xl, 14);
  const c1_lo = rotr64_lo(xh, xl, 18);
  const c2_lo = rotr64_lo(xl, xh, 9); // 41
  const r = c0_lo ^ c1_lo ^ c2_lo;
  return r >>> 0;
}

function g0_512_hi(xh, xl) {
  const c0_hi = rotr64_hi(xh, xl, 1);
  const c1_hi = rotr64_hi(xh, xl, 8);
  const c2_hi = shr64_hi(xh, xl, 7);
  const r = c0_hi ^ c1_hi ^ c2_hi;
  return r >>> 0;
}

function g0_512_lo(xh, xl) {
  const c0_lo = rotr64_lo(xh, xl, 1);
  const c1_lo = rotr64_lo(xh, xl, 8);
  const c2_lo = shr64_lo(xh, xl, 7);
  const r = c0_lo ^ c1_lo ^ c2_lo;
  return r >>> 0;
}

function g1_512_hi(xh, xl) {
  const c0_hi = rotr64_hi(xh, xl, 19);
  const c1_hi = rotr64_hi(xl, xh, 29); // 61
  const c2_hi = shr64_hi(xh, xl, 6);
  const r = c0_hi ^ c1_hi ^ c2_hi;
  return r >>> 0;
}

function g1_512_lo(xh, xl) {
  const c0_lo = rotr64_lo(xh, xl, 19);
  const c1_lo = rotr64_lo(xl, xh, 29); // 61
  const c2_lo = shr64_lo(xh, xl, 6);
  const r = c0_lo ^ c1_lo ^ c2_lo;
  return r >>> 0;
}

function readU32(data, off) {
  return (data[off++] * 0x1000000
        + data[off++] * 0x10000
        + data[off++] * 0x100
        + data[off]);
}

function writeU32(data, num, off) {
  data[off++] = num >>> 24;
  data[off++] = num >>> 16;
  data[off++] = num >>> 8;
  data[off++] = num;
  return off;
}

/*
 * Expose
 */

module.exports = SHA512;
}],
[/* 17 */ 'bcrypto', '/lib/internal/hmac.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * hmac.js - hmac for bcrypto
 * Copyright (c) 2016-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on indutny/hash.js:
 *   Copyright (c) 2014, Fedor Indutny (MIT License).
 *   https://github.com/indutny/hash.js
 *
 * Resources:
 *   https://en.wikipedia.org/wiki/HMAC
 *   https://tools.ietf.org/html/rfc2104
 *   https://github.com/indutny/hash.js/blob/master/lib/hash/hmac.js
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);

/**
 * HMAC
 */

class HMAC {
  /**
   * Create an HMAC.
   * @param {Function} Hash
   * @param {Number} size
   * @param {Array} [x=[]]
   * @param {Array} [y=[]]
   */

  constructor(Hash, size, x = [], y = []) {
    assert(typeof Hash === 'function');
    assert((size >>> 0) === size);
    assert(Array.isArray(x));
    assert(Array.isArray(y));

    this.hash = Hash;
    this.size = size;
    this.x = x;
    this.y = y;

    this.inner = new Hash();
    this.outer = new Hash();
  }

  /**
   * Initialize HMAC context.
   * @param {Buffer} data
   */

  init(key) {
    assert(Buffer.isBuffer(key));

    // Shorten key
    if (key.length > this.size) {
      const Hash = this.hash;
      const h = new Hash();

      h.init(...this.x);
      h.update(key);

      key = h.final(...this.y);

      assert(key.length <= this.size);
    }

    // Pad key
    const pad = Buffer.alloc(this.size);

    for (let i = 0; i < key.length; i++)
      pad[i] = key[i] ^ 0x36;

    for (let i = key.length; i < pad.length; i++)
      pad[i] = 0x36;

    this.inner.init(...this.x);
    this.inner.update(pad);

    for (let i = 0; i < key.length; i++)
      pad[i] = key[i] ^ 0x5c;

    for (let i = key.length; i < pad.length; i++)
      pad[i] = 0x5c;

    this.outer.init(...this.x);
    this.outer.update(pad);

    return this;
  }

  /**
   * Update HMAC context.
   * @param {Buffer} data
   */

  update(data) {
    this.inner.update(data);
    return this;
  }

  /**
   * Finalize HMAC context.
   * @returns {Buffer}
   */

  final() {
    this.outer.update(this.inner.final(...this.y));
    return this.outer.final(...this.y);
  }
}

/*
 * Expose
 */

module.exports = HMAC;
}],
[/* 18 */ 'bcrypto', '/lib/hash160-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * hash160.js - hash160 for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(19 /* './js/hash160' */);
}],
[/* 19 */ 'bcrypto', '/lib/js/hash160.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * hash160.js - Hash160 implementation for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Resources:
 *   https://github.com/bitcoin/bitcoin/blob/master/src/hash.h
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);
const SHA256 = __node_require__(20 /* './sha256' */);
const RIPEMD160 = __node_require__(21 /* './ripemd160' */);
const HMAC = __node_require__(17 /* '../internal/hmac' */);

/*
 * Constants
 */

const rmd = new RIPEMD160();

/**
 * Hash160
 */

class Hash160 {
  constructor() {
    this.ctx = new SHA256();
  }

  init() {
    this.ctx.init();
    return this;
  }

  update(data) {
    this.ctx.update(data);
    return this;
  }

  final() {
    const out = Buffer.alloc(32);

    this.ctx._final(out);

    rmd.init();
    rmd.update(out);
    rmd._final(out);

    return out.slice(0, 20);
  }

  static hash() {
    return new Hash160();
  }

  static hmac() {
    return new HMAC(Hash160, 64);
  }

  static digest(data) {
    return Hash160.ctx.init().update(data).final();
  }

  static root(left, right) {
    assert(Buffer.isBuffer(left) && left.length === 20);
    assert(Buffer.isBuffer(right) && right.length === 20);
    return Hash160.ctx.init().update(left).update(right).final();
  }

  static multi(x, y, z) {
    const {ctx} = Hash160;

    ctx.init();
    ctx.update(x);
    ctx.update(y);

    if (z)
      ctx.update(z);

    return ctx.final();
  }

  static mac(data, key) {
    return Hash160.hmac().init(key).update(data).final();
  }
}

/*
 * Static
 */

Hash160.native = 0;
Hash160.id = 'HASH160';
Hash160.size = 20;
Hash160.bits = 160;
Hash160.blockSize = 64;
Hash160.zero = Buffer.alloc(20, 0x00);
Hash160.ctx = new Hash160();

/*
 * Expose
 */

module.exports = Hash160;
}],
[/* 20 */ 'bcrypto', '/lib/js/sha256.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * sha256.js - SHA256 implementation for bcrypto
 * Copyright (c) 2016-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on indutny/hash.js:
 *   Copyright (c) 2014, Fedor Indutny (MIT License).
 *   https://github.com/indutny/hash.js
 *
 * Resources:
 *   https://en.wikipedia.org/wiki/SHA-2
 *   https://tools.ietf.org/html/rfc4634
 *   https://github.com/indutny/hash.js/blob/master/lib/hash/sha/256.js
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);
const HMAC = __node_require__(17 /* '../internal/hmac' */);

/*
 * Constants
 */

const FINALIZED = -1;
const DESC = Buffer.alloc(8, 0x00);
const PADDING = Buffer.alloc(64, 0x00);

PADDING[0] = 0x80;

const K = new Uint32Array([
  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5,
  0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3,
  0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc,
  0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
  0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13,
  0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3,
  0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5,
  0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208,
  0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
]);

/**
 * SHA256
 */

class SHA256 {
  constructor() {
    this.state = new Uint32Array(8);
    this.msg = new Uint32Array(64);
    this.block = Buffer.alloc(64);
    this.size = FINALIZED;
  }

  init() {
    this.state[0] = 0x6a09e667;
    this.state[1] = 0xbb67ae85;
    this.state[2] = 0x3c6ef372;
    this.state[3] = 0xa54ff53a;
    this.state[4] = 0x510e527f;
    this.state[5] = 0x9b05688c;
    this.state[6] = 0x1f83d9ab;
    this.state[7] = 0x5be0cd19;
    this.size = 0;
    return this;
  }

  update(data) {
    assert(Buffer.isBuffer(data));
    this._update(data, data.length);
    return this;
  }

  final() {
    return this._final(Buffer.alloc(32));
  }

  _update(data, len) {
    assert(this.size !== FINALIZED, 'Context is not initialized.');

    let pos = this.size & 63;
    let off = 0;

    this.size += len;

    if (pos > 0) {
      let want = 64 - pos;

      if (want > len)
        want = len;

      data.copy(this.block, pos, off, off + want);

      pos += want;
      len -= want;
      off += want;

      if (pos < 64)
        return;

      this._transform(this.block, 0);
    }

    while (len >= 64) {
      this._transform(data, off);
      off += 64;
      len -= 64;
    }

    if (len > 0)
      data.copy(this.block, 0, off, off + len);
  }

  _final(out) {
    assert(this.size !== FINALIZED, 'Context is not initialized.');

    const pos = this.size & 63;
    const len = this.size * 8;

    writeU32(DESC, (len * (1 / 0x100000000)) >>> 0, 0);
    writeU32(DESC, len >>> 0, 4);

    this._update(PADDING, 1 + ((119 - pos) & 63));
    this._update(DESC, 8);

    for (let i = 0; i < 8; i++) {
      writeU32(out, this.state[i], i * 4);
      this.state[i] = 0;
    }

    for (let i = 0; i < 64; i++)
      this.msg[i] = 0;

    for (let i = 0; i < 64; i++)
      this.block[i] = 0;

    this.size = FINALIZED;

    return out;
  }

  _transform(chunk, pos) {
    const W = this.msg;

    let a = this.state[0];
    let b = this.state[1];
    let c = this.state[2];
    let d = this.state[3];
    let e = this.state[4];
    let f = this.state[5];
    let g = this.state[6];
    let h = this.state[7];
    let i = 0;

    for (; i < 16; i++)
      W[i] = readU32(chunk, pos + i * 4);

    for (; i < 64; i++)
      W[i] = sigma1(W[i - 2]) + W[i - 7] + sigma0(W[i - 15]) + W[i - 16];

    for (i = 0; i < 64; i++) {
      const t1 = h + Sigma1(e) + Ch(e, f, g) + K[i] + W[i];
      const t2 = Sigma0(a) + Maj(a, b, c);

      h = g;
      g = f;
      f = e;

      e = (d + t1) >>> 0;

      d = c;
      c = b;
      b = a;

      a = (t1 + t2) >>> 0;
    }

    this.state[0] += a;
    this.state[1] += b;
    this.state[2] += c;
    this.state[3] += d;
    this.state[4] += e;
    this.state[5] += f;
    this.state[6] += g;
    this.state[7] += h;
  }

  static hash() {
    return new SHA256();
  }

  static hmac() {
    return new HMAC(SHA256, 64);
  }

  static digest(data) {
    return SHA256.ctx.init().update(data).final();
  }

  static root(left, right) {
    assert(Buffer.isBuffer(left) && left.length === 32);
    assert(Buffer.isBuffer(right) && right.length === 32);
    return SHA256.ctx.init().update(left).update(right).final();
  }

  static multi(x, y, z) {
    const {ctx} = SHA256;

    ctx.init();
    ctx.update(x);
    ctx.update(y);

    if (z)
      ctx.update(z);

    return ctx.final();
  }

  static mac(data, key) {
    return SHA256.hmac().init(key).update(data).final();
  }
}

/*
 * Static
 */

SHA256.native = 0;
SHA256.id = 'SHA256';
SHA256.size = 32;
SHA256.bits = 256;
SHA256.blockSize = 64;
SHA256.zero = Buffer.alloc(32, 0x00);
SHA256.ctx = new SHA256();

/*
 * Helpers
 */

function Sigma0(x) {
  return (x >>> 2 | x << 30) ^ (x >>> 13 | x << 19) ^ (x >>> 22 | x << 10);
}

function Sigma1(x) {
  return (x >>> 6 | x << 26) ^ (x >>> 11 | x << 21) ^ (x >>> 25 | x << 7);
}

function sigma0(x) {
  return (x >>> 7 | x << 25) ^ (x >>> 18 | x << 14) ^ (x >>> 3);
}

function sigma1(x) {
  return (x >>> 17 | x << 15) ^ (x >>> 19 | x << 13) ^ (x >>> 10);
}

function Ch(x, y, z) {
  return z ^ (x & (y ^ z));
}

function Maj(x, y, z) {
  return (x & y) | (z & (x | y));
}

function readU32(data, off) {
  return (data[off++] * 0x1000000
        + data[off++] * 0x10000
        + data[off++] * 0x100
        + data[off]);
}

function writeU32(data, num, off) {
  data[off++] = num >>> 24;
  data[off++] = num >>> 16;
  data[off++] = num >>> 8;
  data[off++] = num;
  return off;
}

/*
 * Expose
 */

module.exports = SHA256;
}],
[/* 21 */ 'bcrypto', '/lib/js/ripemd160.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * ripemd160.js - RIPEMD160 implementation for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on indutny/hash.js:
 *   Copyright (c) 2014, Fedor Indutny (MIT License).
 *   https://github.com/indutny/hash.js
 *
 * Resources:
 *   https://en.wikipedia.org/wiki/RIPEMD-160
 *   https://homes.esat.kuleuven.be/~bosselae/ripemd160/pdf/AB-9601/AB-9601.pdf
 *   https://github.com/indutny/hash.js/blob/master/lib/hash/ripemd.js
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);
const HMAC = __node_require__(17 /* '../internal/hmac' */);

/*
 * Constants
 */

const FINALIZED = -1;
const DESC = Buffer.alloc(8, 0x00);
const PADDING = Buffer.alloc(64, 0x00);

PADDING[0] = 0x80;

const r = new Uint8Array([
  0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15,
  7, 4, 13, 1, 10, 6, 15, 3, 12, 0, 9, 5, 2, 14, 11, 8,
  3, 10, 14, 4, 9, 15, 8, 1, 2, 7, 0, 6, 13, 11, 5, 12,
  1, 9, 11, 10, 0, 8, 12, 4, 13, 3, 7, 15, 14, 5, 6, 2,
  4, 0, 5, 9, 7, 12, 2, 10, 14, 1, 3, 8, 11, 6, 15, 13
]);

const rh = new Uint8Array([
  5, 14, 7, 0, 9, 2, 11, 4, 13, 6, 15, 8, 1, 10, 3, 12,
  6, 11, 3, 7, 0, 13, 5, 10, 14, 15, 8, 12, 4, 9, 1, 2,
  15, 5, 1, 3, 7, 14, 6, 9, 11, 8, 12, 2, 10, 0, 4, 13,
  8, 6, 4, 1, 3, 11, 15, 0, 5, 12, 2, 13, 9, 7, 10, 14,
  12, 15, 10, 4, 1, 5, 8, 7, 6, 2, 13, 14, 0, 3, 9, 11
]);

const s = new Uint8Array([
  11, 14, 15, 12, 5, 8, 7, 9, 11, 13, 14, 15, 6, 7, 9, 8,
  7, 6, 8, 13, 11, 9, 7, 15, 7, 12, 15, 9, 11, 7, 13, 12,
  11, 13, 6, 7, 14, 9, 13, 15, 14, 8, 13, 6, 5, 12, 7, 5,
  11, 12, 14, 15, 14, 15, 9, 8, 9, 14, 5, 6, 8, 6, 5, 12,
  9, 15, 5, 11, 6, 8, 13, 12, 5, 12, 13, 14, 11, 8, 5, 6
]);

const sh = new Uint8Array([
  8, 9, 9, 11, 13, 15, 15, 5, 7, 7, 8, 11, 14, 14, 12, 6,
  9, 13, 15, 7, 12, 8, 9, 11, 7, 7, 12, 7, 6, 15, 13, 11,
  9, 7, 15, 11, 8, 6, 6, 14, 12, 13, 5, 14, 13, 13, 7, 5,
  15, 5, 8, 11, 14, 14, 6, 14, 6, 9, 12, 9, 12, 5, 15, 8,
  8, 5, 12, 9, 12, 5, 14, 6, 8, 13, 6, 5, 15, 13, 11, 11
]);

/**
 * RIPEMD160
 */

class RIPEMD160 {
  constructor() {
    this.state = new Uint32Array(5);
    this.msg = new Uint32Array(16);
    this.block = Buffer.alloc(64);
    this.size = FINALIZED;
  }

  init() {
    this.state[0] = 0x67452301;
    this.state[1] = 0xefcdab89;
    this.state[2] = 0x98badcfe;
    this.state[3] = 0x10325476;
    this.state[4] = 0xc3d2e1f0;
    this.size = 0;
    return this;
  }

  update(data) {
    assert(Buffer.isBuffer(data));
    this._update(data, data.length);
    return this;
  }

  final() {
    return this._final(Buffer.alloc(20));
  }

  _update(data, len) {
    assert(this.size !== FINALIZED, 'Context is not initialized.');

    let pos = this.size & 63;
    let off = 0;

    this.size += len;

    if (pos > 0) {
      let want = 64 - pos;

      if (want > len)
        want = len;

      data.copy(this.block, pos, off, off + want);

      pos += want;
      len -= want;
      off += want;

      if (pos < 64)
        return;

      this._transform(this.block, 0);
    }

    while (len >= 64) {
      this._transform(data, off);
      off += 64;
      len -= 64;
    }

    if (len > 0)
      data.copy(this.block, 0, off, off + len);
  }

  _final(out) {
    assert(this.size !== FINALIZED, 'Context is not initialized.');

    const pos = this.size & 63;
    const len = this.size * 8;

    writeU32(DESC, len >>> 0, 0);
    writeU32(DESC, (len * (1 / 0x100000000)) >>> 0, 4);

    this._update(PADDING, 1 + ((119 - pos) & 63));
    this._update(DESC, 8);

    for (let i = 0; i < 5; i++) {
      writeU32(out, this.state[i], i * 4);
      this.state[i] = 0;
    }

    for (let i = 0; i < 16; i++)
      this.msg[i] = 0;

    for (let i = 0; i < 64; i++)
      this.block[i] = 0;

    this.size = FINALIZED;

    return out;
  }

  _transform(chunk, pos) {
    const W = this.msg;

    let A = this.state[0];
    let B = this.state[1];
    let C = this.state[2];
    let D = this.state[3];
    let E = this.state[4];
    let Ah = A;
    let Bh = B;
    let Ch = C;
    let Dh = D;
    let Eh = E;

    for (let i = 0; i < 16; i++)
      W[i] = readU32(chunk, pos + i * 4);

    for (let j = 0; j < 80; j++) {
      let a = A + f(j, B, C, D) + W[r[j]] + K(j);
      let b = rotl32(a, s[j]);
      let T = b + E;

      A = E;
      E = D;
      D = rotl32(C, 10);
      C = B;
      B = T;

      a = Ah + f(79 - j, Bh, Ch, Dh) + W[rh[j]] + Kh(j);
      b = rotl32(a, sh[j]);
      T = b + Eh;
      Ah = Eh;
      Eh = Dh;
      Dh = rotl32(Ch, 10);
      Ch = Bh;
      Bh = T;
    }

    const T = this.state[1] + C + Dh;

    this.state[1] = this.state[2] + D + Eh;
    this.state[2] = this.state[3] + E + Ah;
    this.state[3] = this.state[4] + A + Bh;
    this.state[4] = this.state[0] + B + Ch;
    this.state[0] = T;
  }

  static hash() {
    return new RIPEMD160();
  }

  static hmac() {
    return new HMAC(RIPEMD160, 64);
  }

  static digest(data) {
    return RIPEMD160.ctx.init().update(data).final();
  }

  static root(left, right) {
    assert(Buffer.isBuffer(left) && left.length === 20);
    assert(Buffer.isBuffer(right) && right.length === 20);
    return RIPEMD160.ctx.init().update(left).update(right).final();
  }

  static multi(x, y, z) {
    const {ctx} = RIPEMD160;

    ctx.init();
    ctx.update(x);
    ctx.update(y);

    if (z)
      ctx.update(z);

    return ctx.final();
  }

  static mac(data, key) {
    return RIPEMD160.hmac().init(key).update(data).final();
  }
}

/*
 * Static
 */

RIPEMD160.native = 0;
RIPEMD160.id = 'RIPEMD160';
RIPEMD160.size = 20;
RIPEMD160.bits = 160;
RIPEMD160.blockSize = 64;
RIPEMD160.zero = Buffer.alloc(20, 0x00);
RIPEMD160.ctx = new RIPEMD160();

/*
 * Helpers
 */

function rotl32(w, b) {
  return (w << b) | (w >>> (32 - b));
}

function f(j, x, y, z) {
  if (j <= 15)
    return x ^ y ^ z;

  if (j <= 31)
    return (x & y) | ((~x) & z);

  if (j <= 47)
    return (x | (~y)) ^ z;

  if (j <= 63)
    return (x & z) | (y & (~z));

  return x ^ (y | (~z));
}

function K(j) {
  if (j <= 15)
    return 0x00000000;

  if (j <= 31)
    return 0x5a827999;

  if (j <= 47)
    return 0x6ed9eba1;

  if (j <= 63)
    return 0x8f1bbcdc;

  return 0xa953fd4e;
}

function Kh(j) {
  if (j <= 15)
    return 0x50a28be6;

  if (j <= 31)
    return 0x5c4dd124;

  if (j <= 47)
    return 0x6d703ef3;

  if (j <= 63)
    return 0x7a6d76e9;

  return 0x00000000;
}

function readU32(data, off) {
  return (data[off++]
        + data[off++] * 0x100
        + data[off++] * 0x10000
        + data[off] * 0x1000000);
}

function writeU32(dst, num, off) {
  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  return off;
}

/*
 * Expose
 */

module.exports = RIPEMD160;
}],
[/* 22 */ 'bcrypto', '/lib/hash256-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * hash256.js - hash256 for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(23 /* './js/hash256' */);
}],
[/* 23 */ 'bcrypto', '/lib/js/hash256.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * hash256.js - Hash256 implementation for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Resources:
 *   https://github.com/bitcoin/bitcoin/blob/master/src/hash.h
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);
const SHA256 = __node_require__(20 /* './sha256' */);
const HMAC = __node_require__(17 /* '../internal/hmac' */);

/**
 * Hash256
 */

class Hash256 {
  constructor() {
    this.ctx = new SHA256();
  }

  init() {
    this.ctx.init();
    return this;
  }

  update(data) {
    this.ctx.update(data);
    return this;
  }

  final() {
    const out = Buffer.alloc(32);

    this.ctx._final(out);
    this.ctx.init();
    this.ctx.update(out);
    this.ctx._final(out);

    return out;
  }

  static hash() {
    return new Hash256();
  }

  static hmac() {
    return new HMAC(Hash256, 64);
  }

  static digest(data) {
    return Hash256.ctx.init().update(data).final();
  }

  static root(left, right) {
    assert(Buffer.isBuffer(left) && left.length === 32);
    assert(Buffer.isBuffer(right) && right.length === 32);
    return Hash256.ctx.init().update(left).update(right).final();
  }

  static multi(x, y, z) {
    const {ctx} = Hash256;

    ctx.init();
    ctx.update(x);
    ctx.update(y);

    if (z)
      ctx.update(z);

    return ctx.final();
  }

  static mac(data, key) {
    return Hash256.hmac().init(key).update(data).final();
  }
}

/*
 * Static
 */

Hash256.native = 0;
Hash256.id = 'HASH256';
Hash256.size = 32;
Hash256.bits = 256;
Hash256.blockSize = 64;
Hash256.zero = Buffer.alloc(32, 0x00);
Hash256.ctx = new Hash256();

/*
 * Expose
 */

module.exports = Hash256;
}],
[/* 24 */ 'bcrypto', '/lib/cleanse-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * cleanse.js - cleanse for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(25 /* './js/cleanse' */);
}],
[/* 25 */ 'bcrypto', '/lib/js/cleanse.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * cleanse.js - memzero for bcrypto
 * Copyright (c) 2016-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);
const random = __node_require__(26 /* '../random' */);

/**
 * A maybe-secure memzero.
 * @param {Buffer} data
 */

function cleanse(data) {
  assert(Buffer.isBuffer(data));
  random.randomFill(data, 0, data.length);
}

/*
 * Static
 */

cleanse.native = 0;

/*
 * Expose
 */

module.exports = cleanse;
}],
[/* 26 */ 'bcrypto', '/lib/random-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * random.js - random for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(27 /* './js/random' */);
}],
[/* 27 */ 'bcrypto', '/lib/js/random.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * random.js - random number generator for bcrypto
 * Copyright (c) 2014-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Resources:
 *   https://wiki.openssl.org/index.php/Random_Numbers
 *   https://csrc.nist.gov/projects/random-bit-generation/
 *   http://www.pcg-random.org/posts/bounded-rands.html
 *   https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);

/*
 * Constants
 */

const crypto = global.crypto || global.msCrypto;
const HAS_CRYPTO = crypto && typeof crypto.getRandomValues === 'function';
const randomValues = HAS_CRYPTO ? crypto.getRandomValues.bind(crypto) : null;
const pool = new Uint32Array(16);
const MAX_BYTES = 65536;

let poolPos = 0;

/**
 * Generate pseudo-random bytes.
 * @param {Number} size
 * @returns {Buffer}
 */

function randomBytes(size) {
  assert((size >>> 0) === size);

  const data = Buffer.alloc(size);

  randomFillSync(data, 0, size);

  return data;
}

/**
 * Generate pseudo-random bytes.
 * @param {Buffer} data
 * @param {Number} [off=0]
 * @param {Number} [size=data.length-off]
 * @returns {Buffer}
 */

function randomFill(data, off, size) {
  assert(Buffer.isBuffer(data));

  if (off == null)
    off = 0;

  assert((off >>> 0) === off);

  if (size == null)
    size = data.length - off;

  assert((size >>> 0) === size);
  assert(off + size <= data.length);

  randomFillSync(data, off, size);

  return data;
}

/**
 * Generate a random uint32.
 * @returns {Number}
 */

function randomInt() {
  if ((poolPos & 15) === 0) {
    getRandomValues(pool);
    poolPos = 0;
  }

  return pool[poolPos++];
}

/**
 * Generate a random uint32 within a range.
 * @param {Number} min - Inclusive.
 * @param {Number} max - Exclusive.
 * @returns {Number}
 */

function randomRange(min, max) {
  assert((min >>> 0) === min);
  assert((max >>> 0) === max);
  assert(max >= min);

  const space = max - min;

  if (space === 0)
    return min;

  const top = -space >>> 0;

  let x, r;

  do {
    x = randomInt();
    r = x % space;
  } while (x - r > top);

  return r + min;
}

/*
 * Helpers
 */

function getRandomValues(array) {
  if (!HAS_CRYPTO)
    throw new Error('Entropy source not available.');

  return randomValues(array);
}

function randomFillSync(data, off, size) {
  assert(Buffer.isBuffer(data));
  assert(data.buffer instanceof ArrayBuffer);
  assert((data.byteOffset >>> 0) === data.byteOffset);
  assert((data.byteLength >>> 0) === data.byteLength);
  assert((off >>> 0) === off);
  assert((size >>> 0) === size);
  assert(off + size <= data.byteLength);

  if (size > 2 ** 31 - 1)
    throw new RangeError('The value "size" is out of range.');

  const offset = data.byteOffset + off;
  const array = new Uint8Array(data.buffer, offset, size);

  if (array.length > MAX_BYTES) {
    for (let i = 0; i < array.length; i += MAX_BYTES) {
      let j = i + MAX_BYTES;

      if (j > array.length)
        j = array.length;

      getRandomValues(array.subarray(i, j));
    }
  } else {
    if (array.length > 0)
      getRandomValues(array);
  }
}

/*
 * Expose
 */

exports.native = 0;
exports.randomBytes = randomBytes;
exports.randomFill = randomFill;
exports.randomInt = randomInt;
exports.randomRange = randomRange;
}],
[/* 28 */ 'bcrypto', '/lib/secp256k1-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * secp256k1.js - secp256k1 for bcrypto
 * Copyright (c) 2014-2015, Fedor Indutny (MIT License)
 * Copyright (c) 2014-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(29 /* './js/secp256k1' */);
}],
[/* 29 */ 'bcrypto', '/lib/js/secp256k1.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * secp256k1.js - secp256k1 for bcrypto
 * Copyright (c) 2014-2015, Fedor Indutny (MIT License)
 * Copyright (c) 2014-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

const ECDSA = __node_require__(30 /* './ecdsa' */);
const SHA256 = __node_require__(39 /* '../sha256' */);
const pre = __node_require__(43 /* './precomputed/secp256k1.json' */);

/*
 * Expose
 */

module.exports = new ECDSA('SECP256K1', SHA256, SHA256, pre);
}],
[/* 30 */ 'bcrypto', '/lib/js/ecdsa.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * ecdsa.js - ECDSA for bcrypto
 * Copyright (c) 2018-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on indutny/elliptic:
 *   Copyright (c) 2014, Fedor Indutny (MIT License).
 *   https://github.com/indutny/elliptic
 *
 * References:
 *
 *   [SEC1] SEC 1: Elliptic Curve Cryptography, Version 2.0
 *     Certicom Research
 *     http://www.secg.org/sec1-v2.pdf
 *
 *   [FIPS186] Suite B Implementer's Guide to FIPS 186-3 (ECDSA)
 *     https://tinyurl.com/fips186-guide
 *
 *   [GECC] Guide to Elliptic Curve Cryptography
 *     D. Hankerson, A. Menezes, and S. Vanstone
 *     https://tinyurl.com/guide-to-ecc
 *
 *   [RFC6979] Deterministic Usage of the Digital Signature
 *             Algorithm (DSA) and Elliptic Curve Digital
 *             Signature Algorithm (ECDSA)
 *     T. Pornin
 *     https://tools.ietf.org/html/rfc6979
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);
const BN = __node_require__(31 /* '../bn' */);
const rng = __node_require__(26 /* '../random' */);
const asn1 = __node_require__(34 /* '../internal/asn1' */);
const Schnorr = __node_require__(35 /* './schnorr-legacy' */);
const HmacDRBG = __node_require__(40 /* '../hmac-drbg' */);
const elliptic = __node_require__(42 /* './elliptic' */);

/**
 * ECDSA
 */

class ECDSA {
  constructor(name, hash, xof, pre) {
    assert(typeof name === 'string');
    assert(hash);
    assert(xof);

    this.id = name;
    this.type = 'ecdsa';
    this.hash = hash;
    this.xof = xof;
    this.native = 0;

    this._pre = pre || null;
    this._curve = null;
    this._schnorr = null;
  }

  get curve() {
    if (!this._curve) {
      this._curve = elliptic.curve(this.id, this._pre);
      this._curve.precompute(rng);
      this._pre = null;
    }
    return this._curve;
  }

  get schnorr() {
    if (!this._schnorr)
      this._schnorr = new Schnorr(this.curve, this.xof);
    return this._schnorr;
  }

  get size() {
    return this.curve.fieldSize;
  }

  get bits() {
    return this.curve.fieldBits;
  }

  privateKeyGenerate() {
    const a = this.curve.randomScalar(rng);
    return this.curve.encodeScalar(a);
  }

  privateKeyVerify(key) {
    assert(Buffer.isBuffer(key));

    let a;
    try {
      a = this.curve.decodeScalar(key);
    } catch (e) {
      return false;
    }

    return !a.isZero() && a.cmp(this.curve.n) < 0;
  }

  privateKeyExport(key) {
    const pub = this.publicKeyCreate(key, false);
    const {x, y} = this.publicKeyExport(pub);

    return {
      d: Buffer.from(key),
      x,
      y
    };
  }

  privateKeyImport(json) {
    assert(json && typeof json === 'object');

    const a = BN.decode(json.d, this.curve.endian);

    if (a.isZero() || a.cmp(this.curve.n) >= 0)
      throw new Error('Invalid private key.');

    return this.curve.encodeScalar(a);
  }

  privateKeyTweakAdd(key, tweak) {
    const t = this.curve.decodeScalar(tweak);

    if (t.cmp(this.curve.n) >= 0)
      throw new Error('Invalid scalar.');

    const a = this.curve.decodeScalar(key);

    if (a.isZero() || a.cmp(this.curve.n) >= 0)
      throw new Error('Invalid private key.');

    const k = a.add(t).imod(this.curve.n);

    if (k.isZero())
      throw new Error('Invalid private key.');

    return this.curve.encodeScalar(k);
  }

  privateKeyTweakMul(key, tweak) {
    const t = this.curve.decodeScalar(tweak);

    if (t.isZero() || t.cmp(this.curve.n) >= 0)
      throw new Error('Invalid scalar.');

    const a = this.curve.decodeScalar(key);

    if (a.isZero() || a.cmp(this.curve.n) >= 0)
      throw new Error('Invalid private key.');

    const k = a.mul(t).imod(this.curve.n);

    if (k.isZero())
      throw new Error('Invalid private key.');

    return this.curve.encodeScalar(k);
  }

  privateKeyNegate(key) {
    const a = this.curve.decodeScalar(key);

    if (a.isZero() || a.cmp(this.curve.n) >= 0)
      throw new Error('Invalid private key.');

    const k = a.neg().imod(this.curve.n);

    return this.curve.encodeScalar(k);
  }

  privateKeyInvert(key) {
    const a = this.curve.decodeScalar(key);

    if (a.isZero() || a.cmp(this.curve.n) >= 0)
      throw new Error('Invalid private key.');

    const k = a.invert(this.curve.n);

    return this.curve.encodeScalar(k);
  }

  publicKeyCreate(key, compress) {
    const a = this.curve.decodeScalar(key);

    if (a.isZero() || a.cmp(this.curve.n) >= 0)
      throw new Error('Invalid private key.');

    const A = this.curve.g.mulBlind(a);

    return A.encode(compress);
  }

  publicKeyConvert(key, compress) {
    const A = this.curve.decodePoint(key);
    return A.encode(compress);
  }

  publicKeyFromUniform(bytes, compress) {
    const u = this.curve.decodeUniform(bytes);
    const A = this.curve.pointFromUniform(u);

    return A.encode(compress);
  }

  publicKeyToUniform(key, hint = rng.randomInt()) {
    const A = this.curve.decodePoint(key);
    const u = this.curve.pointToUniform(A, hint);

    return this.curve.encodeUniform(u, hint >>> 8);
  }

  publicKeyFromHash(bytes, compress) {
    const A = this.curve.pointFromHash(bytes);
    return A.encode(compress);
  }

  publicKeyToHash(key) {
    const A = this.curve.decodePoint(key);
    return this.curve.pointToHash(A, 0, rng);
  }

  publicKeyVerify(key) {
    assert(Buffer.isBuffer(key));

    try {
      this.curve.decodePoint(key);
    } catch (e) {
      return false;
    }

    return true;
  }

  publicKeyExport(key) {
    const {x, y} = this.curve.decodePoint(key);

    return {
      x: this.curve.encodeField(x.fromRed()),
      y: this.curve.encodeField(y.fromRed())
    };
  }

  publicKeyImport(json, compress) {
    assert(json && typeof json === 'object');

    const x = BN.decode(json.x, this.curve.endian);

    if (x.cmp(this.curve.p) >= 0)
      throw new Error('Invalid point.');

    if (json.y != null) {
      const y = BN.decode(json.y, this.curve.endian);

      if (y.cmp(this.curve.p) >= 0)
        throw new Error('Invalid point.');

      const A = this.curve.point(x, y);

      if (!A.validate())
        throw new Error('Invalid point.');

      return A.encode(compress);
    }

    const A = this.curve.pointFromX(x, json.sign);

    return A.encode(compress);
  }

  publicKeyTweakAdd(key, tweak, compress) {
    const t = this.curve.decodeScalar(tweak);

    if (t.cmp(this.curve.n) >= 0)
      throw new Error('Invalid scalar.');

    const A = this.curve.decodePoint(key);
    const T = this.curve.g.jmul(t);
    const P = T.add(A);

    return P.encode(compress);
  }

  publicKeyTweakMul(key, tweak, compress) {
    const t = this.curve.decodeScalar(tweak);

    if (t.isZero() || t.cmp(this.curve.n) >= 0)
      throw new Error('Invalid scalar.');

    const A = this.curve.decodePoint(key);
    const P = A.mul(t);

    return P.encode(compress);
  }

  publicKeyCombine(keys, compress) {
    assert(Array.isArray(keys));

    let P = this.curve.jpoint();

    for (const key of keys) {
      const A = this.curve.decodePoint(key);

      P = P.add(A);
    }

    return P.encode(compress);
  }

  publicKeyNegate(key, compress) {
    const A = this.curve.decodePoint(key);
    const P = A.neg();

    return P.encode(compress);
  }

  signatureNormalize(sig) {
    const [r, s] = this._decodeCompact(sig);

    if (s.cmp(this.curve.nh) > 0)
      s.ineg().imod(this.curve.n);

    return this._encodeCompact(r, s);
  }

  signatureNormalizeDER(sig) {
    const [r, s] = this._decodeDER(sig, false);

    if (s.cmp(this.curve.nh) > 0)
      s.ineg().imod(this.curve.n);

    return this._encodeDER(r, s);
  }

  signatureExport(sig) {
    const [r, s] = this._decodeCompact(sig);
    return this._encodeDER(r, s);
  }

  signatureImport(sig) {
    const [r, s] = this._decodeDER(sig, false);
    return this._encodeCompact(r, s);
  }

  isLowS(sig) {
    assert(Buffer.isBuffer(sig));

    let s;
    try {
      [, s] = this._decodeCompact(sig);
    } catch (e) {
      return false;
    }

    return s.cmp(this.curve.nh) <= 0;
  }

  isLowDER(sig) {
    assert(Buffer.isBuffer(sig));

    let s;
    try {
      [, s] = this._decodeDER(sig, false);
    } catch (e) {
      return false;
    }

    return s.cmp(this.curve.nh) <= 0;
  }

  sign(msg, key) {
    const [r, s] = this._sign(msg, key);
    return this._encodeCompact(r, s);
  }

  signRecoverable(msg, key) {
    const [r, s, param] = this._sign(msg, key);
    return [this._encodeCompact(r, s), param];
  }

  signDER(msg, key) {
    const [r, s] = this._sign(msg, key);
    return this._encodeDER(r, s);
  }

  signRecoverableDER(msg, key) {
    const [r, s, param] = this._sign(msg, key);
    return [this._encodeDER(r, s), param];
  }

  _sign(msg, key) {
    // ECDSA Signing.
    //
    // [SEC1] Page 44, Section 4.1.3.
    // [GECC] Algorithm 4.29, Page 184, Section 4.4.1.
    // [RFC6979] Page 9, Section 2.4.
    // [RFC6979] Page 10, Section 3.2.
    //
    // Assumptions:
    //
    //   - Let `m` be an integer reduced from bytes.
    //   - Let `a` be a secret non-zero scalar.
    //   - Let `k` be a random non-zero scalar.
    //   - R != O, r != 0, s != 0.
    //
    // Computation:
    //
    //   k = random integer in [1,n-1]
    //   R = G * k
    //   r = x(R) mod n
    //   s = (r * a + m) / k mod n
    //   s = -s mod n, if s > n / 2
    //   S = (r, s)
    //
    // We can blind the scalar arithmetic
    // with a random integer `b` like so:
    //
    //   b = random integer in [1,n-1]
    //   s = (r * (a * b) + m * b) / (k * b) mod n
    //
    // Note that `k` must remain secret,
    // otherwise an attacker can compute:
    //
    //   a = (s * k - m) / r mod n
    //
    // This means that if two signatures
    // share the same `r` value, an attacker
    // can compute:
    //
    //   k = (m1 - m2) / (+-s1 - +-s2) mod n
    //   a = (s1 * k - m1) / r mod n
    //
    // Assuming:
    //
    //   s1 = (r * a + m1) / k mod n
    //   s2 = (r * a + m2) / k mod n
    //
    // To mitigate this, `k` can be generated
    // deterministically using the HMAC-DRBG
    // construction described in [RFC6979].
    const {n, nh} = this.curve;
    const G = this.curve.g;
    const a = this.curve.decodeScalar(key);

    if (a.isZero() || a.cmp(n) >= 0)
      throw new Error('Invalid private key.');

    const m = this._reduce(msg);
    const nonce = this.curve.encodeScalar(m);
    const drbg = new HmacDRBG(this.hash, key, nonce);

    for (;;) {
      const bytes = drbg.generate(this.curve.scalarSize);
      const k = this._truncate(bytes);

      if (k.isZero() || k.cmp(n) >= 0)
        continue;

      const R = G.mulBlind(k);

      if (R.isInfinity())
        continue;

      const x = R.getX();
      const r = x.mod(n);

      if (r.isZero())
        continue;

      const b = this.curve.randomScalar(rng);
      const ki = k.mul(b).fermat(n);
      const ba = a.mul(b).imod(n);
      const bm = m.mul(b).imod(n);
      const sk = r.mul(ba).iadd(bm).imod(n);
      const s = sk.mul(ki).imod(n);

      if (s.isZero())
        continue;

      let param = R.isOdd() | (!x.eq(r) << 1);

      if (s.cmp(nh) > 0) {
        s.ineg().imod(n);
        param ^= 1;
      }

      return [r, s, param];
    }
  }

  verify(msg, sig, key) {
    assert(Buffer.isBuffer(msg));
    assert(Buffer.isBuffer(sig));
    assert(Buffer.isBuffer(key));

    let r, s;
    try {
      [r, s] = this._decodeCompact(sig);
    } catch (e) {
      return false;
    }

    try {
      return this._verify(msg, r, s, key);
    } catch (e) {
      return false;
    }
  }

  verifyDER(msg, sig, key) {
    assert(Buffer.isBuffer(msg));
    assert(Buffer.isBuffer(sig));
    assert(Buffer.isBuffer(key));

    let r, s;
    try {
      [r, s] = this._decodeDER(sig, false);
    } catch (e) {
      return false;
    }

    try {
      return this._verify(msg, r, s, key);
    } catch (e) {
      return false;
    }
  }

  _verify(msg, r, s, key) {
    // ECDSA Verification.
    //
    // [SEC1] Page 46, Section 4.1.4.
    // [GECC] Algorithm 4.30, Page 184, Section 4.4.1.
    //
    // Assumptions:
    //
    //   - Let `m` be an integer reduced from bytes.
    //   - Let `r` and `s` be signature elements.
    //   - Let `A` be a valid group element.
    //   - r != 0, r < n.
    //   - s != 0, s < n.
    //   - R != O.
    //
    // Computation:
    //
    //   u1 = m / s mod n
    //   u2 = r / s mod n
    //   R = G * u1 + A * u2
    //   r == x(R) mod n
    //
    // Note that the signer can verify their
    // own signatures more efficiently with:
    //
    //   R = G * ((u1 + u2 * a) mod n)
    //
    // Furthermore, we can avoid affinization
    // of `R` by scaling `r` by `z^2` and
    // repeatedly adding `n * z^2` to it up
    // to a certain threshold.
    const {n} = this.curve;
    const G = this.curve.g;
    const m = this._reduce(msg);
    const A = this.curve.decodePoint(key);

    if (r.isZero() || r.cmp(n) >= 0)
      return false;

    if (s.isZero() || s.cmp(n) >= 0)
      return false;

    const si = s.invert(n);
    const u1 = m.mul(si).imod(n);
    const u2 = r.mul(si).imod(n);
    const R = G.jmulAdd(u1, A, u2);

    return R.eqR(r);
  }

  recover(msg, sig, param, compress) {
    assert(Buffer.isBuffer(msg));
    assert(Buffer.isBuffer(sig));
    assert((param >>> 0) === param);
    assert((param & 3) === param, 'The recovery param is more than two bits.');

    let r, s;
    try {
      [r, s] = this._decodeCompact(sig);
    } catch (e) {
      return null;
    }

    let A;
    try {
      A = this._recover(msg, r, s, param);
    } catch (e) {
      return null;
    }

    return A.encode(compress);
  }

  recoverDER(msg, sig, param, compress) {
    assert(Buffer.isBuffer(msg));
    assert(Buffer.isBuffer(sig));
    assert((param >>> 0) === param);
    assert((param & 3) === param, 'The recovery param is more than two bits.');

    let r, s;
    try {
      [r, s] = this._decodeDER(sig, false);
    } catch (e) {
      return null;
    }

    let A;
    try {
      A = this._recover(msg, r, s, param);
    } catch (e) {
      return null;
    }

    return A.encode(compress);
  }

  _recover(msg, r, s, param) {
    // ECDSA Public Key Recovery.
    //
    // [SEC1] Page 47, Section 4.1.6.
    //
    // Assumptions:
    //
    //   - Let `m` be an integer reduced from bytes.
    //   - Let `r` and `s` be signature elements.
    //   - Let `i` be an integer in [0,3].
    //   - x^3 + a * x + b is square in F(p).
    //   - If i > 1 then r < (p mod n).
    //   - r != 0, r < n.
    //   - s != 0, s < n.
    //   - A != O.
    //
    // Computation:
    //
    //   x = r + n, if i > 1
    //     = r, otherwise
    //   R' = (x, sqrt(x^3 + a * x + b))
    //   R = -R', if i mod 2 == 1
    //     = +R', otherwise
    //   s1 = m / r mod n
    //   s2 = s / r mod n
    //   A = R * s2 - G * s1
    //
    // Note that this implementation will have
    // trouble on curves where `p / n > 1`.
    const {n, pmodn} = this.curve;
    const G = this.curve.g;
    const m = this._reduce(msg);

    if (r.isZero() || r.cmp(n) >= 0)
      throw new Error('Invalid R value.');

    if (s.isZero() || s.cmp(n) >= 0)
      throw new Error('Invalid S value.');

    const sign = (param & 1) !== 0;
    const high = param >>> 1;

    let x = r;

    if (high) {
      if (this.curve.highOrder)
        throw new Error('Invalid high bit.');

      if (x.cmp(pmodn) >= 0)
        throw new Error('Invalid R value.');

      x = x.add(n);
    }

    const R = this.curve.pointFromX(x, sign);
    const ri = r.invert(n);
    const s1 = m.mul(ri).ineg().imod(n);
    const s2 = s.mul(ri).imod(n);
    const A = G.mulAdd(s1, R, s2);

    if (A.isInfinity())
      throw new Error('Invalid point.');

    return A;
  }

  derive(pub, priv, compress) {
    const A = this.curve.decodePoint(pub);
    const a = this.curve.decodeScalar(priv);

    if (a.isZero() || a.cmp(this.curve.n) >= 0)
      throw new Error('Invalid private key.');

    if (this.curve.h.cmpn(1) > 0) {
      if (A.isSmall())
        throw new Error('Invalid point.');
    }

    const P = A.mulBlind(a, rng);

    return P.encode(compress);
  }

  /*
   * Schnorr
   */

  schnorrSign(msg, key) {
    return this.schnorr.sign(msg, key);
  }

  schnorrVerify(msg, sig, key) {
    return this.schnorr.verify(msg, sig, key);
  }

  schnorrVerifyBatch(batch) {
    return this.schnorr.verifyBatch(batch);
  }

  /*
   * Helpers
   */

  _encodeCompact(r, s) {
    return Buffer.concat([
      this.curve.encodeScalar(r),
      this.curve.encodeScalar(s)
    ]);
  }

  _decodeCompact(sig) {
    assert(Buffer.isBuffer(sig));

    const {n} = this.curve;
    const size = this.curve.scalarSize;

    if (sig.length !== size * 2)
      throw new Error('Invalid signature size.');

    const Rraw = sig.slice(0, size);
    const Sraw = sig.slice(size, size * 2);
    const r = this.curve.decodeScalar(Rraw);
    const s = this.curve.decodeScalar(Sraw);

    if (r.cmp(n) >= 0 || s.cmp(n) >= 0)
      throw new Error('Invalid signature.');

    return [r, s];
  }

  _encodeDER(r, s) {
    const size = asn1.sizeInt(r) + asn1.sizeInt(s);
    const out = Buffer.alloc(asn1.sizeSeq(size));

    let pos = 0;

    pos = asn1.writeSeq(out, pos, size);
    pos = asn1.writeInt(out, pos, r);
    pos = asn1.writeInt(out, pos, s);

    assert(pos === out.length);

    return out;
  }

  _decodeDER(sig, strict) {
    assert(Buffer.isBuffer(sig));
    assert(typeof strict === 'boolean');

    const {n} = this.curve;

    let pos = 0;
    let r, s;

    pos = asn1.readSeq(sig, pos, strict);
    [r, pos] = asn1.readInt(sig, pos, strict);
    [s, pos] = asn1.readInt(sig, pos, strict);

    if (strict && pos !== sig.length)
      throw new Error('Trailing bytes.');

    if (r.cmp(n) >= 0 || s.cmp(n) >= 0)
      throw new Error('Invalid signature.');

    return [r, s];
  }

  _truncate(msg) {
    // Byte array to integer conversion.
    //
    // [SEC1] Step 5, Page 45, Section 4.1.3.
    // [FIPS186] Page 25, Section B.2.
    //
    // The two sources above disagree on this.
    //
    // FIPS186 simply modulos the entire byte
    // array by the order, whereas SEC1 takes
    // the left-most ceil(log2(n+1)) bits modulo
    // the order (and maybe does other stuff).
    //
    // Instead of trying to decipher all of
    // this nonsense, we simply replicate the
    // OpenSSL behavior (which, in actuality,
    // is more similar to the SEC1 behavior).
    assert(Buffer.isBuffer(msg));

    const bits = this.curve.n.bitLength();
    const bytes = (bits + 7) >>> 3;

    if (msg.length > bytes)
      msg = msg.slice(0, bytes);

    const m = BN.decode(msg, this.curve.endian);
    const d = msg.length * 8 - bits;

    if (d > 0)
      m.iushrn(d);

    return m;
  }

  _reduce(msg) {
    return this._truncate(msg).imod(this.curve.n);
  }
}

/*
 * Expose
 */

module.exports = ECDSA;
}],
[/* 31 */ 'bcrypto', '/lib/bn-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * bn.js - big numbers for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(32 /* './js/bn' */);
}],
[/* 32 */ 'bcrypto', '/lib/js/bn.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * bn.js - big numbers for bcrypto
 * Copyright (c) 2018-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on indutny/bn.js:
 *   Copyright (c) 2015, Fedor Indutny (MIT License).
 *   https://github.com/indutny/bn.js
 *
 * Parts of this software are based on golang/go:
 *   Copyright (c) 2009, The Go Authors. All rights reserved.
 *   https://github.com/golang/go
 *
 * Parts of this software are based on openssl/openssl:
 *   Copyright (c) 1998-2018, The OpenSSL Project (Apache License v2.0).
 *   Copyright (c) 1995-1998, Eric A. Young, Tim J. Hudson. All rights reserved.
 *   https://github.com/openssl/openssl
 *
 * Parts of this software are based on libgmp:
 *   Copyright (c) 1991-1997, 1999-2014, Free Software Foundation, Inc.
 *   https://gmplib.org/
 *
 * Parts of this software are based on v8/v8:
 *   Copyright (c) 2017, The V8 Project Authors (BSD-Style License).
 *   https://github.com/v8/v8
 *
 * Resources:
 *   https://github.com/indutny/bn.js/blob/master/lib/bn.js
 *   https://github.com/indutny/miller-rabin/blob/master/lib/mr.js
 *   https://github.com/golang/go/blob/master/src/math/big/int.go
 *   https://github.com/golang/go/blob/master/src/math/big/nat.go
 *   https://github.com/golang/go/blob/master/src/math/big/prime.go
 *   https://github.com/openssl/openssl/tree/master/crypto/bn
 *   https://github.com/openssl/openssl/blob/master/crypto/bn/bn_kron.c
 *   https://github.com/gnutls/nettle/blob/master/mini-gmp.c
 *   https://github.com/v8/v8/blob/master/src/objects/bigint.cc
 */

/* eslint valid-typeof: "off" */

'use strict';

const {custom} = __node_require__(33 /* '../internal/custom' */);

/*
 * Constants
 */

const zeros = [
  '',
  '0',
  '00',
  '000',
  '0000',
  '00000',
  '000000',
  '0000000',
  '00000000',
  '000000000',
  '0000000000',
  '00000000000',
  '000000000000',
  '0000000000000',
  '00000000000000',
  '000000000000000',
  '0000000000000000',
  '00000000000000000',
  '000000000000000000',
  '0000000000000000000',
  '00000000000000000000',
  '000000000000000000000',
  '0000000000000000000000',
  '00000000000000000000000',
  '000000000000000000000000',
  '0000000000000000000000000'
];

const groupSizes = [
  0x00, 0x19, 0x10, 0x0c, 0x0b, 0x0a,
  0x09, 0x08, 0x08, 0x07, 0x07, 0x07,
  0x07, 0x06, 0x06, 0x06, 0x06, 0x06,
  0x06, 0x06, 0x05, 0x05, 0x05, 0x05,
  0x05, 0x05, 0x05, 0x05, 0x05, 0x05,
  0x05, 0x05, 0x05, 0x05, 0x05, 0x05
];

const groupBases = [
  0x00000000, 0x02000000, 0x0290d741, 0x01000000,
  0x02e90edd, 0x039aa400, 0x0267bf47, 0x01000000,
  0x0290d741, 0x00989680, 0x012959c3, 0x0222c000,
  0x03bd7765, 0x0072e440, 0x00adcea1, 0x01000000,
  0x01704f61, 0x0206fc40, 0x02cddcf9, 0x03d09000,
  0x003e5185, 0x004ea360, 0x006235f7, 0x00798000,
  0x009502f9, 0x00b54ba0, 0x00daf26b, 0x01069c00,
  0x0138f9ad, 0x0172c9e0, 0x01b4d89f, 0x02000000,
  0x025528a1, 0x02b54a20, 0x03216b93, 0x039aa400
];

const primes = {
  p192: null,
  p224: null,
  p521: null,
  k256: null,
  p251: null,
  p25519: null,
  p448: null
};

const modes = {
  NONE: 0,
  QUO: 1,
  REM: 2,
  BOTH: 3,
  EUCLID: 4,
  ALL: 7
};

const WND_WIDTH = 4;
const WND_SIZE = 1 << (WND_WIDTH - 1);

const HAS_BIGINT = typeof BigInt === 'function';

/**
 * BN
 */

class BN {
  constructor(num, base, endian) {
    this.words = [0];
    this.length = 1;
    this.negative = 0;
    this.red = null;
    this.from(num, base, endian);
  }

  /*
   * Addition Engine
   */

  _iadd(a, b) {
    let carry = 0;
    let i = 0;

    // a.length > b.length
    if (a.length < b.length)
      [a, b] = [b, a];

    if (a !== this)
      this._alloc(a.length);

    for (; i < b.length; i++) {
      const r = (a.words[i] | 0) + (b.words[i] | 0) + carry;

      this.words[i] = r & 0x3ffffff;

      carry = r >>> 26;
    }

    for (; carry !== 0 && i < a.length; i++) {
      const r = (a.words[i] | 0) + carry;

      this.words[i] = r & 0x3ffffff;

      carry = r >>> 26;
    }

    this.length = a.length;

    if (carry !== 0) {
      this._alloc(this.length + 1);
      this.words[this.length++] = carry;
    } else if (a !== this) {
      // Copy the rest of the words.
      for (; i < a.length; i++)
        this.words[i] = a.words[i];
    }

    // Note: we shouldn't need to strip here.
    return this;
  }

  _iaddn(num) {
    this.words[0] += num;

    if (this.words[0] < 0x4000000)
      return this;

    // Carry.
    let i = 0;

    this._alloc(this.length + 1);

    this.words[this.length] = 0;

    for (; i < this.length && this.words[i] >= 0x4000000; i++) {
      this.words[i] -= 0x4000000;
      this.words[i + 1] += 1;
    }

    this.length = Math.max(this.length, i + 1);

    // Note: we shouldn't need to strip here.
    return this;
  }

  /*
   * Addition
   */

  iadd(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    if (this.negative === num.negative) {
      // x + y == x + y
      // (-x) + (-y) == -(x + y)
      this._iadd(this, num);
    } else {
      // x + (-y) == x - y == -(y - x)
      // (-x) + y == y - x == -(x - y)
      const cmp = this.ucmp(num);

      // x + (-x) == (-x) + x == 0
      if (cmp === 0) {
        this.words[0] = 0;
        this.length = 1;
        this.negative = 0;
        return this;
      }

      if (cmp < 0) {
        this._isub(num, this);
        this.negative ^= 1;
      } else {
        this._isub(this, num);
      }
    }

    return this;
  }

  iaddn(num) {
    enforce(isSMI(num), 'num', 'smi');

    const negative = (num < 0) | 0;

    if (negative)
      num = -num;

    if (this.negative === negative) {
      // x + y == x + y
      // (-x) + (-y) == -(x + y)
      this._iaddn(num);
    } else {
      // x + (-y) == x - y == -(y - x)
      // (-x) + y == y - x == -(x - y)
      if (this.length === 1 && this.words[0] < num) {
        this.words[0] = num - this.words[0];
        this.negative ^= 1;
      } else {
        this._isubn(num);
      }
    }

    return this;
  }

  add(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    if (num.length > this.length)
      return num.clone().iadd(this);

    return this.clone().iadd(num);
  }

  addn(num) {
    return this.clone().iaddn(num);
  }

  /*
   * Subtraction Engine
   */

  _isub(a, b) {
    let carry = 0;
    let i = 0;

    // a > b
    assert(a.length >= b.length);

    if (a !== this)
      this._alloc(a.length);

    for (; i < b.length; i++) {
      const r = (a.words[i] | 0) - (b.words[i] | 0) + carry;

      carry = r >> 26;

      this.words[i] = r & 0x3ffffff;
    }

    for (; carry !== 0 && i < a.length; i++) {
      const r = (a.words[i] | 0) + carry;

      carry = r >> 26;

      this.words[i] = r & 0x3ffffff;
    }

    assert(carry === 0);

    // Copy rest of the words.
    if (a !== this) {
      for (; i < a.length; i++)
        this.words[i] = a.words[i];
    }

    this.length = Math.max(this.length, i);

    return this._strip();
  }

  _isubn(num) {
    this.words[0] -= num;

    if (this.words[0] >= 0)
      return this._normalize();

    assert(this.length !== 1);

    // Carry.
    this._alloc(this.length + 1);

    for (let i = 0; i < this.length && this.words[i] < 0; i++) {
      this.words[i] += 0x4000000;
      this.words[i + 1] -= 1;
    }

    this.words[this.length] = 0;

    return this._strip();
  }

  /*
   * Subtraction
   */

  isub(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    if (this.negative !== num.negative) {
      // x - (-y) == x + y
      // (-x) - y == -(x + y)
      this._iadd(this, num);
    } else {
      // x - y == x - y == -(y - x)
      // (-x) - (-y) == y - x == -(x - y)
      const cmp = this.ucmp(num);

      // x - x == 0
      if (cmp === 0) {
        this.words[0] = 0;
        this.length = 1;
        this.negative = 0;
        return this;
      }

      if (cmp < 0) {
        this._isub(num, this);
        this.negative ^= 1;
      } else {
        this._isub(this, num);
      }
    }

    return this;
  }

  isubn(num) {
    enforce(isSMI(num), 'num', 'smi');

    const negative = (num < 0) | 0;

    if (negative)
      num = -num;

    if (this.negative !== negative) {
      // x - (-y) == x + y
      // (-x) - y == -(x + y)
      this._iaddn(num);
    } else {
      // x - y == x - y == -(y - x)
      // (-x) - (-y) == y - x == -(x - y)
      if (this.length === 1 && this.words[0] < num) {
        this.words[0] = num - this.words[0];
        this.negative ^= 1;
      } else {
        this._isubn(num);
      }
    }

    return this;
  }

  sub(num) {
    return this.clone().isub(num);
  }

  subn(num) {
    return this.clone().isubn(num);
  }

  /*
   * Multiplication Engine
   */

  _mul(num, out) {
    enforce(BN.isBN(num), 'num', 'bignum');
    enforce(BN.isBN(out), 'out', 'bignum');

    if (this.length === 10 && num.length === 10)
      return comb10MulTo(this, num, out);

    const len = this.length + num.length;

    if (len < 63)
      return smallMulTo(this, num, out);

    if (len < 1024)
      return bigMulTo(this, num, out);

    return jumboMulTo(this, num, out);
  }

  /*
   * Multiplication
   */

  imul(num) {
    return this.mul(num)._move(this);
  }

  imuln(num) {
    enforce(isSMI(num), 'num', 'smi');

    const neg = (num < 0) | 0;

    if (neg)
      num = -num;

    // Carry.
    let carry = 0;

    for (let i = 0; i < this.length; i++) {
      const w = this.words[i] * num;
      const lo = (w & 0x3ffffff) + (carry & 0x3ffffff);

      carry >>= 26;
      carry += (w / 0x4000000) | 0;
      carry += lo >>> 26;

      this.words[i] = lo & 0x3ffffff;
    }

    this.negative ^= neg;

    if (carry !== 0) {
      this._alloc(this.length + 1);
      this.words[this.length++] = carry;
    } else {
      this._strip();
    }

    return this;
  }

  mul(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    const len = this.length + num.length;
    const out = new BN();

    out.words = new Array(len);

    for (let i = 0; i < len; i ++)
      out.words[i] = 0;

    return this._mul(num, out);
  }

  muln(num) {
    return this.clone().imuln(num);
  }

  /*
   * Multiplication + Shift
   */

  mulShift(num, bits) {
    enforce(BN.isBN(num), 'num', 'bignum');
    enforce((bits >>> 0) === bits, 'bits', 'uint32');

    const r = this.mul(num);
    const b = r.utestn(bits - 1);

    r.iushrn(bits);

    if (this.negative ^ num.negative)
      return r.isubn(b);

    return r.iaddn(b);
  }

  /*
   * Division Engine
   */

  _div(num, flags) {
    enforce(BN.isBN(num), 'num', 'bignum');
    assert((flags & modes.ALL) === flags);
    assert(flags !== modes.NONE);

    const a = this;
    const b = num;

    nonzero(!b.isZero());

    if (a.isZero())
      return [new BN(0), new BN(0)];

    const as = a.negative;
    const bs = b.negative;

    a.negative = 0;
    b.negative = 0;

    let q = null;
    let r = null;

    if (a.ucmp(b) < 0) {
      if (flags & modes.QUO)
        q = new BN(0);

      if (flags & modes.REM)
        r = a.clone();
    } else if (b.length === 1) {
      if (flags & modes.QUO)
        q = a.quon(b.words[0]);

      if (flags & modes.REM)
        r = a.remn(b.words[0]);
    } else {
      [q, r] = a._wordDiv(b, flags);
    }

    a.negative = as;
    b.negative = bs;

    if (flags & modes.QUO) {
      q.negative = a.negative ^ b.negative;
      q._normalize();
    }

    if (flags & modes.REM) {
      r.negative = a.negative;
      r._normalize();
    }

    if (flags & modes.EUCLID) {
      if (flags & modes.QUO) {
        assert((flags & modes.REM) !== 0);

        if (r.negative !== 0) {
          if (b.negative !== 0)
            q.iaddn(1);
          else
            q.isubn(1);
        }
      }

      if (flags & modes.REM) {
        if (r.negative !== 0) {
          if (b.negative !== 0)
            r.isub(b);
          else
            r.iadd(b);
        }
      }
    }

    return [q, r];
  }

  _wordDiv(num, flags) {
    let a = this.clone();
    let b = num;
    let q = null;
    let hi;

    // Normalize.
    const word = b.words[b.length - 1] | 0;
    const shift = 26 - countBits(word);

    if (shift !== 0) {
      b = b.clone();

      a.iushln(shift);
      b.iushln(shift);

      hi = b.words[b.length - 1] | 0;
    } else {
      hi = word;
    }

    // Initialize quotient.
    const m = a.length - b.length;

    assert(m >= 0);

    if (flags & modes.QUO) {
      q = new BN(0);
      q.length = m + 1;
      q.words = new Array(q.length);

      for (let i = 0; i < q.length; i++)
        q.words[i] = 0;
    }

    // Diff.
    const d = a.clone();

    d._ishlnsubmul(b, 1, m);

    if (d.negative === 0) {
      if (q)
        q.words[m] = 1;

      a = d;
    }

    // Divide.
    for (let j = m - 1; j >= 0; j--) {
      const ahi = a.words[b.length + j];
      const alo = a.words[b.length + j - 1];
      const quo = ((ahi * 0x4000000 + alo) / hi) | 0;

      let qj = Math.min(quo, 0x3ffffff);

      a._ishlnsubmul(b, qj, j);

      while (a.negative !== 0) {
        qj -= 1;
        a.negative = 0;
        a._ishlnsubmul(b, 1, j);
        a.ineg();
      }

      if (q)
        q.words[j] = qj;
    }

    // Strip.
    if (q)
      q._strip();

    // Denormalize.
    // Note: we shouldn't need to strip `a` here.
    if ((flags & modes.REM) && shift !== 0)
      a.iushrn(shift);

    return [q, a];
  }

  _ishlnsubmul(num, mul, shift) {
    let carry = 0;
    let i = 0;

    this._expand(num.length + shift);

    for (; i < num.length; i++) {
      const k = (this.words[i + shift] | 0) + carry;
      const r = num.words[i] * mul;
      const w = k - (r & 0x3ffffff);

      carry = (w >> 26) - ((r / 0x4000000) | 0);

      this.words[i + shift] = w & 0x3ffffff;
    }

    for (; i < this.length - shift; i++) {
      const w = (this.words[i + shift] | 0) + carry;

      carry = w >> 26;

      this.words[i + shift] = w & 0x3ffffff;
    }

    if (carry === 0)
      return this._strip();

    // Subtraction overflow.
    assert(carry === -1);

    carry = 0;

    for (let i = 0; i < this.length; i++) {
      const w = -(this.words[i] | 0) + carry;

      carry = w >> 26;

      this.words[i] = w & 0x3ffffff;
    }

    this.negative = 1;

    return this._strip();
  }

  /*
   * Truncation Division + Modulo
   */

  quorem(num) {
    return this._div(num, modes.BOTH);
  }

  /*
   * Truncation Division
   */

  iquo(num) {
    return this.quo(num)._move(this);
  }

  iquon(num) {
    enforce(isSMI(num), 'num', 'smi');
    nonzero(num !== 0);

    const neg = (num < 0) | 0;

    if (neg)
      num = -num;

    let carry = 0;

    for (let i = this.length - 1; i >= 0; i--) {
      const w = (this.words[i] | 0) + carry * 0x4000000;

      this.words[i] = (w / num) | 0;

      carry = w % num;
    }

    this.negative ^= neg;

    return this._strip();
  }

  quo(num) {
    return this._div(num, modes.QUO)[0];
  }

  quon(num) {
    return this.clone().iquon(num);
  }

  /*
   * Truncation Modulo
   */

  irem(num) {
    return this.rem(num)._move(this);
  }

  iremn(num) {
    let m = this.remrn(num);

    if (m < 0)
      m = -m;

    this.words[0] = m;
    this.length = 1;

    return this._normalize();
  }

  rem(num) {
    return this._div(num, modes.REM)[1];
  }

  remn(num) {
    return this.clone().iremn(num);
  }

  remrn(num) {
    enforce(isSMI(num), 'num', 'smi');
    nonzero(num !== 0);

    if (num < 0)
      num = -num;

    const p = (1 << 26) % num;

    let acc = 0;

    for (let i = this.length - 1; i >= 0; i--)
      acc = (p * acc + (this.words[i] | 0)) % num;

    return this.negative !== 0 ? (-acc | 0) : acc;
  }

  /*
   * Euclidean Division + Modulo
   */

  divmod(num) {
    return this._div(num, modes.BOTH | modes.EUCLID);
  }

  /*
   * Euclidean Division
   */

  idiv(num) {
    return this.div(num)._move(this);
  }

  idivn(num) {
    if (this.negative === 0)
      return this.iquon(num);

    const r = this.remrn(num);

    this.iquon(num);

    if (r < 0) {
      if (num < 0)
        this.iaddn(1);
      else
        this.isubn(1);
    }

    return this;
  }

  div(num) {
    return this._div(num, modes.BOTH | modes.EUCLID)[0];
  }

  divn(num) {
    return this.clone().idivn(num);
  }

  /*
   * Euclidean Modulo
   */

  imod(num) {
    if (this.ucmp(num) < 0) {
      if (this.negative !== 0) {
        this._isub(num, this);
        this.negative = 0;
      }
      return this;
    }

    return this.mod(num)._move(this);
  }

  imodn(num) {
    this.words[0] = this.modrn(num);
    this.length = 1;
    this.negative = 0;
    return this;
  }

  mod(num) {
    return this._div(num, modes.REM | modes.EUCLID)[1];
  }

  modn(num) {
    return this.clone().imodn(num);
  }

  modrn(num) {
    enforce(isSMI(num), 'num', 'smi');

    let r = this.remrn(num);

    if (r < 0) {
      if (num < 0)
        r -= num;
      else
        r += num;
    }

    return r;
  }

  /*
   * Round Division
   */

  divRound(num) {
    const [q, r] = this.quorem(num);

    // Fast case - exact division.
    if (r.isZero())
      return q;

    const bit = num.words[0] & 1;

    num.iushrn(1);

    const cmp = r.ucmp(num);

    num.iushln(1);

    num.words[0] |= bit;

    // Round down.
    if (cmp < 0 || (num.isOdd() && cmp === 0))
      return q;

    // Round up.
    if (this.negative ^ num.negative)
      return q.isubn(1);

    return q.iaddn(1);
  }

  /*
   * Exponentiation
   */

  ipow(num) {
    return this.pow(num)._move(this);
  }

  ipown(num) {
    return this.pown(num)._move(this);
  }

  pow(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    let b = countBits(num.words[num.length - 1]);
    let r = new BN(1);

    for (let i = num.length - 1; i >= 0; i--) {
      const word = num.words[i];

      for (let j = b - 1; j >= 0; j--) {
        r = r.sqr();

        if ((word >> j) & 1)
          r = r.mul(this);
      }

      b = 26;
    }

    return r;
  }

  pown(num) {
    enforce(isSMI(num), 'num', 'smi');

    if (num < 0)
      num = -num;

    if (num === 0)
      return new BN(1);

    if (num === 1)
      return this.clone();

    const bits = countBits(num);

    let r = this;

    for (let i = bits - 2; i >= 0; i--) {
      r = r.sqr();

      if ((num >> i) & 1)
        r = r.mul(this);
    }

    return r;
  }

  isqr() {
    return this.imul(this);
  }

  sqr() {
    return this.mul(this);
  }

  /*
   * Roots Engine
   */

  _rootrem(pow, rem) {
    enforce((pow >>> 0) === pow, 'num', 'uint32');

    if (pow === 0)
      throw new RangeError('Zeroth root.');

    if (~pow & this.negative)
      throw new RangeError('Negative with even root.');

    if (this.ucmpn(1) <= 0)
      return [this.clone(), new BN(0)];

    let u = new BN(0);
    let t = BN.shift(1, this.bitLength() / pow + 1 | 0);
    let v, r;

    if (this.negative !== 0)
      t.ineg();

    if (pow === 2) {
      do {
        u = t;
        t = this.quo(u);
        t.iadd(u);
        t.iushrn(1);
      } while (t.ucmp(u) < 0);
    } else {
      do {
        u = t;
        t = u.pown(pow - 1);
        t = this.quo(t);
        v = u.muln(pow - 1);
        t.iadd(v);
        t = t.quon(pow);
      } while (t.ucmp(u) < 0);
    }

    if (rem) {
      t = u.pown(pow);
      r = this.sub(t);
    }

    return [u, r];
  }

  /*
   * Roots
   */

  rootrem(pow) {
    return this._rootrem(pow, 1);
  }

  iroot(pow) {
    return this.root(pow)._move(this);
  }

  root(pow) {
    return this._rootrem(pow, 0)[0];
  }

  isPower(pow) {
    enforce((pow >>> 0) === pow, 'num', 'uint32');

    if (pow === 0 || (~pow & this.negative))
      return false;

    const [, r] = this.rootrem(pow);

    return r.sign() === 0;
  }

  sqrtrem() {
    return this.rootrem(2);
  }

  isqrt() {
    return this.sqrt()._move(this);
  }

  sqrt() {
    return this.root(2);
  }

  isSquare() {
    return this.isPower(2);
  }

  /*
   * AND
   */

  iand(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    let x = this;
    let y = num;

    if (x === y)
      return x;

    if ((x.negative | y.negative) === 0)
      return x.iuand(y);

    if ((x.negative & y.negative) === 1) {
      // (-x) & (-y) == ~(x-1) & ~(y-1)
      //             == ~((x-1) | (y-1))
      //             == -(((x-1) | (y-1)) + 1)
      x.iaddn(1);
      y.iaddn(1);
      x.iuor(y);
      x.isubn(1);
      y.isubn(1);
      return x;
    }

    // Assume x is the positive number.
    if (x.negative !== 0)
      [x, y] = [y.clone(), x];

    // x & (-y) == x & ~(y-1)
    //          == x & ~(y-1)
    const width = x.bitLength();

    y.iaddn(1);
    y.inotn(width);
    x.iuand(y);
    y.inotn(width);
    y.isubn(1);

    return x._move(this);
  }

  iandn(num) {
    enforce(isSMI(num), 'num', 'smi');

    if ((this.negative | (num < 0)) !== 0)
      return this.iand(new BN(num));

    this.words[0] &= num;
    this.length = 1;

    return this;
  }

  and(num) {
    return this.clone().iand(num);
  }

  andn(num) {
    return this.clone().iandn(num);
  }

  andrn(num) {
    enforce(isSMI(num), 'num', 'smi');

    if ((this.negative | (num < 0)) !== 0) {
      const n = this.iand(new BN(num));

      if (n.length > 1)
        throw new RangeError('Number exceeds 26 bits.');

      return n.negative !== 0 ? -n.words[0] : n.words[0];
    }

    return this.words[0] & num;
  }

  /*
   * Unsigned AND
   */

  iuand(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    this.length = Math.min(this.length, num.length);

    for (let i = 0; i < this.length; i++)
      this.words[i] &= num.words[i];

    return this._strip();
  }

  iuandn(num) {
    enforce(isSMI(num), 'num', 'smi');

    this.words[0] &= Math.abs(num);
    this.length = 1;

    return this._normalize();
  }

  uand(num) {
    return this.clone().iuand(num);
  }

  uandn(num) {
    return this.clone().iuandn(num);
  }

  uandrn(num) {
    enforce(isSMI(num), 'num', 'smi');

    const n = this.words[0] & Math.abs(num);

    return this.negative !== 0 ? (-n | 0) : n;
  }

  /*
   * OR
   */

  ior(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    let x = this;
    let y = num;

    if (x === y)
      return x;

    if ((x.negative | y.negative) === 0)
      return x.iuor(y);

    if ((x.negative & y.negative) === 1) {
      // (-x) | (-y) == ~(x-1) | ~(y-1)
      //             == ~((x-1) & (y-1))
      //             == -(((x-1) & (y-1)) + 1)
      x.iaddn(1);
      y.iaddn(1);
      x.iuand(y);
      x.isubn(1);
      y.isubn(1);
      return x;
    }

    // Assume x is the positive number.
    y = y.clone();

    if (x.negative !== 0)
      [x, y] = [y, x];

    // x | (-y) == x | ~(y-1)
    //          == ~((y-1) & ~x)
    //          == -(((y-1) & ~x) + 1)
    y.iaddn(1);
    x.inotn(y.bitLength());
    y.iuand(x);
    y.isubn(1);

    return y._move(this);
  }

  iorn(num) {
    enforce(isSMI(num), 'num', 'smi');

    if ((this.negative | (num < 0)) !== 0)
      return this.ior(new BN(num));

    this.words[0] |= num;

    return this;
  }

  or(num) {
    return this.clone().ior(num);
  }

  orn(num) {
    return this.clone().iorn(num);
  }

  /*
   * Unsigned OR
   */

  iuor(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    this._expand(num.length);

    for (let i = 0; i < num.length; i++)
      this.words[i] |= num.words[i];

    // Note: we shouldn't need to strip here.
    return this;
  }

  iuorn(num) {
    enforce(isSMI(num), 'num', 'smi');

    this.words[0] |= Math.abs(num);

    return this;
  }

  uor(num) {
    return this.clone().iuor(num);
  }

  uorn(num) {
    return this.clone().iuorn(num);
  }

  /*
   * XOR
   */

  ixor(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    let x = this;
    let y = num;

    if (x === y) {
      x.words[0] = 0;
      x.length = 1;
      x.negative = 0;
      return x;
    }

    if ((x.negative | y.negative) === 0)
      return x.iuxor(y);

    if ((x.negative & y.negative) === 1) {
      // (-x) ^ (-y) == ~(x-1) ^ ~(y-1)
      //             == (x-1) ^ (y-1)
      x.iaddn(1);
      y.iaddn(1);
      x.iuxor(y);
      x.ineg();
      y.isubn(1);
      return x;
    }

    // Assume x is the positive number.
    if (x.negative !== 0)
      [x, y] = [y.clone(), x];

    // x ^ (-y) == x ^ ~(y-1)
    //          == ~(x ^ (y-1))
    //          == -((x ^ (y-1)) + 1)
    y.iaddn(1);
    x.iuxor(y);
    x.iaddn(1);
    x.ineg();
    y.isubn(1);

    return x._move(this);
  }

  ixorn(num) {
    enforce(isSMI(num), 'num', 'smi');

    if ((this.negative | (num < 0)) !== 0)
      return this.ixor(new BN(num));

    this.words[0] ^= num;

    return this;
  }

  xor(num) {
    return this.clone().ixor(num);
  }

  xorn(num) {
    return this.clone().ixorn(num);
  }

  /*
   * Unsigned XOR
   */

  iuxor(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    let a = this;
    let b = num;

    if (a.length < b.length)
      [a, b] = [b, a];

    let i = 0;

    for (; i < b.length; i++)
      this.words[i] = a.words[i] ^ b.words[i];

    if (a !== this) {
      this._alloc(a.length);

      for (; i < a.length; i++)
        this.words[i] = a.words[i];
    }

    this.length = a.length;

    return this._strip();
  }

  iuxorn(num) {
    enforce(isSMI(num), 'num', 'smi');

    this.words[0] ^= Math.abs(num);

    return this._normalize();
  }

  uxor(num) {
    return this.clone().iuxor(num);
  }

  uxorn(num) {
    return this.clone().iuxorn(num);
  }

  /*
   * NOT
   */

  inot() {
    if (this.negative !== 0) {
      // ~(-x) == ~(~(x-1)) == x-1
      this.ineg().isubn(1);
    } else {
      // ~x == -x-1 == -(x+1)
      this.iaddn(1).ineg();
    }
    return this;
  }

  not() {
    return this.clone().inot();
  }

  inotn(width) {
    enforce((width >>> 0) === width, 'width', 'uint32');

    const r = width % 26;

    let s = Math.ceil(width / 26);
    let i = 0;

    // Extend the buffer with leading zeroes.
    this._expand(s);

    if (r > 0)
      s -= 1;

    // Handle complete words.
    for (; i < s; i++)
      this.words[i] ^= 0x3ffffff;

    // Handle the residue.
    if (r > 0)
      this.words[i] ^= (1 << r) - 1;

    // And remove leading zeroes.
    return this._strip();
  }

  notn(width) {
    return this.clone().inotn(width);
  }

  /*
   * Left Shift
   */

  ishl(num) {
    enforce(BN.isBN(num), 'bits', 'bignum');
    enforce(num.bitLength() <= 32, 'bits', 'uint32');
    return this.ishln(num.toNumber());
  }

  ishln(bits) {
    return this.iushln(bits);
  }

  shl(num) {
    return this.clone().ishl(num);
  }

  shln(bits) {
    return this.clone().ishln(bits);
  }

  /*
   * Unsigned Left Shift
   */

  iushl(num) {
    enforce(BN.isBN(num), 'bits', 'bignum');
    enforce(num.bitLength() <= 32, 'bits', 'uint32');
    return this.iushln(num.toNumber());
  }

  iushln(bits) {
    enforce((bits >>> 0) === bits, 'bits', 'uint32');

    const r = bits % 26;
    const s = (bits - r) / 26;
    const mask = ((1 << r) - 1) << (26 - r);

    if (r !== 0) {
      let carry = 0;

      for (let i = 0; i < this.length; i++) {
        const ncarry = this.words[i] & mask;
        const c = ((this.words[i] | 0) - ncarry) << r;

        this.words[i] = c | carry;

        carry = ncarry >>> (26 - r);
      }

      if (carry !== 0) {
        this._alloc(this.length + 1);
        this.words[this.length++] = carry;
      }
    }

    if (s !== 0) {
      this._alloc(this.length + s);

      for (let i = this.length - 1; i >= 0; i--)
        this.words[i + s] = this.words[i];

      for (let i = 0; i < s; i++)
        this.words[i] = 0;

      this.length += s;
    }

    return this._strip();
  }

  ushl(num) {
    return this.clone().iushl(num);
  }

  ushln(bits) {
    return this.clone().iushln(bits);
  }

  /*
   * Right Shift Engine
   */

  _split(bits, output) {
    const r = bits % 26;
    const s = Math.min((bits - r) / 26, this.length);
    const mask = (1 << r) - 1;

    // Extended mode, copy masked part.
    if (output) {
      output._alloc(s);

      for (let i = 0; i < s; i++)
        output.words[i] = this.words[i];

      output.length = s;
    }

    if (s === 0) {
      // No-op, we should not move anything at all.
    } else if (this.length > s) {
      this.length -= s;
      for (let i = 0; i < this.length; i++)
        this.words[i] = this.words[i + s];
    } else {
      this.words[0] = 0;
      this.length = 1;
    }

    let carry = 0;

    if (r !== 0) {
      for (let i = this.length - 1; i >= 0; i--) {
        const word = this.words[i] | 0;

        this.words[i] = (carry << (26 - r)) | (word >>> r);

        carry = word & mask;
      }
    }

    // Push carried bits as a mask.
    if (output) {
      if (carry !== 0) {
        output._alloc(output.length + 1);
        output.words[output.length++] = carry;
      } else {
        if (output.length === 0)
          output.words[output.length++] = 0;

        output._strip();
      }
    }

    return this._strip();
  }

  /*
   * Right Shift
   */

  ishr(num) {
    enforce(BN.isBN(num), 'bits', 'bignum');
    enforce(num.bitLength() <= 32, 'bits', 'uint32');
    return this.ishrn(num.toNumber());
  }

  ishrn(bits) {
    enforce((bits >>> 0) === bits, 'bits', 'uint32');

    if (this.negative !== 0) {
      // (-x) >> y == ~(x-1) >> y
      //           == ~((x-1) >> y)
      //           == -(((x-1) >> y) + 1)
      this.iaddn(1);
      this.iushrn(bits);
      this.isubn(1);
      return this;
    }

    return this.iushrn(bits);
  }

  shr(num) {
    return this.clone().ishr(num);
  }

  shrn(bits) {
    return this.clone().ishrn(bits);
  }

  /*
   * Unsigned Right Shift
   */

  iushr(num) {
    enforce(BN.isBN(num), 'bits', 'bignum');
    enforce(num.bitLength() <= 32, 'bits', 'uint32');
    return this.iushrn(num.toNumber());
  }

  iushrn(bits) {
    enforce((bits >>> 0) === bits, 'bits', 'uint32');
    return this._split(bits, null);
  }

  ushr(num) {
    return this.clone().iushr(num);
  }

  ushrn(bits) {
    return this.clone().iushrn(bits);
  }

  /*
   * Bit Manipulation
   */

  setn(bit, val) {
    enforce((bit >>> 0) === bit, 'bit', 'uint32');

    if (this.negative !== 0) {
      this.iaddn(1);
      this.usetn(bit, !val);
      this.isubn(1);
      return this;
    }

    return this.usetn(bit, val);
  }

  usetn(bit, val) {
    enforce((bit >>> 0) === bit, 'bit', 'uint32');

    const r = bit % 26;
    const s = (bit - r) / 26;

    this._expand(s + 1);

    if (val)
      this.words[s] |= (1 << r);
    else
      this.words[s] &= ~(1 << r);

    return this._strip();
  }

  testn(bit) {
    enforce((bit >>> 0) === bit, 'bit', 'uint32');

    const r = bit % 26;
    const s = (bit - r) / 26;

    // Fast case: bit is much higher than all existing words.
    if (this.length <= s)
      return this.negative;

    // Check bit and return.
    const w = this.words[s];
    const val = (w >> r) & 1;

    if (this.negative !== 0) {
      if (r > 0 && (w & ((1 << r) - 1)))
        return val ^ 1;

      let j = s;

      while (j--) {
        if (this.words[j] > 0)
          return val ^ 1;
      }
    }

    return val;
  }

  utestn(bit) {
    enforce((bit >>> 0) === bit, 'bit', 'uint32');

    const r = bit % 26;
    const s = (bit - r) / 26;

    // Fast case: bit is much higher than all existing words.
    if (this.length <= s)
      return 0;

    // Check bit and return.
    return (this.words[s] >> r) & 1;
  }

  imaskn(bits) {
    enforce((bits >>> 0) === bits, 'bits', 'uint32');

    if (this.negative !== 0) {
      this.iaddn(1);
      this.inotn(bits + 1);
      this.ineg();
    }

    return this.iumaskn(bits);
  }

  maskn(bits) {
    return this.clone().imaskn(bits);
  }

  iumaskn(bits) {
    enforce((bits >>> 0) === bits, 'bits', 'uint32');

    const r = bits % 26;

    let s = (bits - r) / 26;

    if (this.length <= s)
      return this;

    if (r !== 0)
      s += 1;

    this.length = Math.min(s, this.length);

    if (r !== 0)
      this.words[this.length - 1] &= (1 << r) - 1;

    if (this.length === 0)
      this.words[this.length++] = 0;

    return this._strip();
  }

  umaskn(bits) {
    return this.clone().iumaskn(bits);
  }

  andln(num) {
    return this.words[0] & num;
  }

  bit(pos) {
    return this.utestn(pos);
  }

  bits(pos, width) {
    enforce((pos >>> 0) === pos, 'pos', 'uint32');
    enforce((width >>> 0) === width, 'width', 'uint32');
    enforce(width <= 26, 'width', 'width');

    const shift = pos % 26;
    const index = (pos - shift) / 26;

    if (index >= this.length)
      return 0;

    let bits = (this.words[index] >> shift) & ((1 << width) - 1);

    if (shift + width > 26 && index + 1 < this.length) {
      const more = shift + width - 26;
      const next = this.words[index + 1] & ((1 << more) - 1);

      bits |= next << (26 - shift);
    }

    return bits;
  }

  /*
   * Negation
   */

  ineg() {
    if (!this.isZero())
      this.negative ^= 1;

    return this;
  }

  neg() {
    return this.clone().ineg();
  }

  iabs() {
    this.negative = 0;
    return this;
  }

  abs() {
    return this.clone().iabs();
  }

  /*
   * Comparison
   */

  cmp(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    if (this.negative !== num.negative)
      return num.negative - this.negative;

    const res = this.ucmp(num);

    if (this.negative !== 0)
      return -res | 0;

    return res;
  }

  cmpn(num) {
    enforce(isSMI(num), 'num', 'smi');

    const negative = (num < 0) | 0;

    if (this.negative !== negative)
      return negative - this.negative;

    const res = this.ucmpn(num);

    if (this.negative !== 0)
      return -res | 0;

    return res;
  }

  eq(num) {
    return this.cmp(num) === 0;
  }

  eqn(num) {
    return this.cmpn(num) === 0;
  }

  gt(num) {
    return this.cmp(num) > 0;
  }

  gtn(num) {
    return this.cmpn(num) > 0;
  }

  gte(num) {
    return this.cmp(num) >= 0;
  }

  gten(num) {
    return this.cmpn(num) >= 0;
  }

  lt(num) {
    return this.cmp(num) < 0;
  }

  ltn(num) {
    return this.cmpn(num) < 0;
  }

  lte(num) {
    return this.cmp(num) <= 0;
  }

  lten(num) {
    return this.cmpn(num) <= 0;
  }

  sign() {
    if (this.negative !== 0)
      return -1;

    if (this.length === 1 && this.words[0] === 0)
      return 0;

    return 1;
  }

  isZero() {
    return this.length === 1 && this.words[0] === 0;
  }

  isNeg() {
    return this.negative !== 0;
  }

  isPos() {
    return this.negative === 0;
  }

  isOdd() {
    return (this.words[0] & 1) === 1;
  }

  isEven() {
    return (this.words[0] & 1) === 0;
  }

  /*
   * Unsigned Comparison
   */

  ucmp(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    if (this.length < num.length)
      return -1;

    if (this.length > num.length)
      return 1;

    for (let i = this.length - 1; i >= 0; i--) {
      const a = this.words[i] | 0;
      const b = num.words[i] | 0;

      if (a === b)
        continue;

      return (a > b) - (a < b);
    }

    return 0;
  }

  ucmpn(num) {
    enforce(isSMI(num), 'num', 'smi');

    if (this.length > 1)
      return 1;

    const w = this.words[0] | 0;

    if (num < 0)
      num = -num;

    return (w > num) - (w < num);
  }

  /*
   * Number Theoretic Functions
   */

  legendre(num) {
    const red = HAS_BIGINT ? BN.red(num) : BN.mont(num);
    return this.toRed(red).redLegendre();
  }

  jacobi(num) {
    // See: A Binary Algorithm for the Jacobi Symbol
    //   J. Shallit, J. Sorenson
    //   Page 3, Section 3
    enforce(BN.isBN(num), 'num', 'bignum');

    if (num.isZero() || num.isEven())
      throw new Error('jacobi: `num` must be odd.');

    let a = this._cloneNormal();
    let b = num.clone();
    let j = 1;

    if (b.isNeg()) {
      if (a.isNeg())
        j = -1;
      b.ineg();
    }

    if (a.isNeg() || a.ucmp(b) >= 0)
      a.imod(b);

    while (!a.isZero()) {
      const bits = a._makeOdd();

      if (bits & 1) {
        const bmod8 = b.andln(7);

        if (bmod8 === 3 || bmod8 === 5)
          j = -j;
      }

      if (a.ucmp(b) < 0) {
        [a, b] = [b, a];

        if (a.andln(3) === 3 && b.andln(3) === 3)
          j = -j;
      }

      a._isub(a, b).iushrn(1);

      const bmod8 = b.andln(7);

      if (bmod8 === 3 || bmod8 === 5)
        j = -j;
    }

    if (b.cmpn(1) !== 0)
      return 0;

    return j;
  }

  kronecker(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    const table = [
      0,  1, 0, -1,
      0, -1, 0,  1
    ];

    let a = this._cloneNormal();
    let b = num.clone();
    let k = 1;

    if (b.isZero())
      return a.ucmpn(1) === 0 ? k : 0;

    if (!a.isOdd() && !b.isOdd())
      return 0;

    const bits = b._makeOdd();

    if (bits & 1)
      k = table[a.andln(7)];

    if (b.isNeg()) {
      if (a.isNeg())
        k = -k;
      b.ineg();
    }

    while (!a.isZero()) {
      const bits = a._makeOdd();

      if (bits & 1)
        k *= table[b.andln(7)];

      const w = a.words[0] ^ (a.negative * 0x3ffffff);

      if (w & b.words[0] & 2)
        k = -k;

      b.imod(a);

      [a, b] = [b, a];

      b.negative = 0;
    }

    if (b.cmpn(1) !== 0)
      return 0;

    return k;
  }

  igcd(num) {
    return this.gcd(num)._move(this);
  }

  gcd(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    if (this.isZero())
      return num.abs();

    if (num.isZero())
      return this.abs();

    let a = this.clone();
    let b = num.clone();

    a.negative = 0;
    b.negative = 0;

    // Remove common factor of two.
    const shift = a._factor2(b);

    if (shift !== 0) {
      a.iushrn(shift);
      b.iushrn(shift);
    }

    for (;;) {
      a._makeOdd();
      b._makeOdd();

      const cmp = a.ucmp(b);

      if (cmp < 0) {
        // a > b
        [a, b] = [b, a];
      } else if (cmp === 0 || b.ucmpn(1) === 0) {
        // Break if a == b.
        // Break if b == 1 to avoid repeated subtraction.
        break;
      }

      a._isub(a, b);
    }

    return b.iushln(shift);
  }

  ilcm(num) {
    return this.lcm(num)._move(this);
  }

  lcm(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    if (this.isZero() || num.isZero())
      return new BN(0);

    return this.quo(this.gcd(num)).mul(num).iabs();
  }

  egcd(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    if (this.isZero()) {
      return [
        new BN(0),
        new BN(num.sign()),
        num.abs()
      ];
    }

    if (num.isZero()) {
      return [
        new BN(this.sign()),
        new BN(0),
        this.abs()
      ];
    }

    const x = this.clone();
    const y = num.clone();

    x.negative = 0;
    y.negative = 0;

    // A * x + B * y = x
    const A = new BN(1);
    const B = new BN(0);

    // C * x + D * y = y
    const C = new BN(0);
    const D = new BN(1);

    // Remove common factor of two.
    const g = x._factor2(y);

    if (g > 0) {
      x.iushrn(g);
      y.iushrn(g);
    }

    const xp = x.clone();
    const yp = y.clone();

    while (!x.isZero()) {
      let i = x._makeOdd();
      let j = y._makeOdd();

      while (i--) {
        if (A.isOdd() || B.isOdd()) {
          A.iadd(yp);
          B.isub(xp);
        }

        A.iushrn(1);
        B.iushrn(1);
      }

      while (j--) {
        if (C.isOdd() || D.isOdd()) {
          C.iadd(yp);
          D.isub(xp);
        }

        C.iushrn(1);
        D.iushrn(1);
      }

      if (x.cmp(y) >= 0) {
        x.isub(y);
        A.isub(C);
        B.isub(D);
      } else {
        y.isub(x);
        C.isub(A);
        D.isub(B);
      }
    }

    if (this.negative !== 0)
      C.ineg();

    if (num.negative !== 0)
      D.ineg();

    return [C, D, y.iushln(g)];
  }

  iinvert(num) {
    return this.invert(num)._move(this);
  }

  invert(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    range(num.sign() > 0, 'invert');

    if (num.isOdd())
      return this._invertp(num);

    if (num.cmpn(1) === 0)
      throw new RangeError('Not invertible.');

    const [s,, g] = this.egcd(num);

    if (g.cmpn(1) !== 0)
      throw new RangeError('Not invertible.');

    return s.imod(num);
  }

  ifermat(num) {
    return this.fermat(num)._move(this);
  }

  fermat(num) {
    const red = HAS_BIGINT ? BN.red(num) : BN.mont(num);
    return this.toRed(red).redFermat().fromRed();
  }

  ipowm(y, m, mont) {
    return this.powm(y, m, mont)._move(this);
  }

  powm(y, m, mont) {
    const red = !HAS_BIGINT && mont ? BN.mont(m) : BN.red(m);
    return this.toRed(red).redPow(y).fromRed();
  }

  ipowmn(y, m, mont) {
    return this.powmn(y, m, mont)._move(this);
  }

  powmn(y, m, mont) {
    const red = mont ? BN.mont(m) : BN.red(m);
    return this.toRed(red).redPown(y).fromRed();
  }

  isqrtm(p) {
    return this.sqrtm(p)._move(this);
  }

  sqrtm(p) {
    enforce(BN.isBN(p), 'p', 'bignum');

    let red;

    if (p.andln(3) === 3 || p.andln(7) === 5) {
      // Probably not worth the setup.
      red = BN.red(p);
    } else {
      red = BN.mont(p);
    }

    return this.toRed(red).redSqrt().fromRed();
  }

  isqrtpq(p, q) {
    return this.sqrtpq(p, q)._move(this);
  }

  sqrtpq(p, q) {
    const sp = this.sqrtm(p);
    const sq = this.sqrtm(q);
    const [mp, mq] = p.egcd(q);
    const lhs = sq.mul(mp).mul(p);
    const rhs = sp.mul(mq).mul(q);
    const n = p.mul(q);

    return lhs.iadd(rhs).imod(n);
  }

  /*
   * Primality Testing
   */

  isPrime(rng, reps, limit) {
    enforce((reps >>> 0) === reps, 'reps', 'uint32');

    if (!this.isPrimeMR(rng, reps + 1, true))
      return false;

    if (!this.isPrimeLucas(limit))
      return false;

    return true;
  }

  isPrimeMR(rng, reps, force2 = false) {
    enforce((reps >>> 0) === reps, 'reps', 'uint32');
    enforce(reps > 0, 'reps', 'integer');
    enforce(typeof force2 === 'boolean', 'force2', 'boolean');

    const n = this;

    if (n.cmpn(7) < 0) {
      return n.cmpn(2) === 0
          || n.cmpn(3) === 0
          || n.cmpn(5) === 0;
    }

    if (n.isEven())
      return false;

    const nm1 = n.subn(1);
    const nm3 = nm1.subn(2);
    const k = nm1.zeroBits();
    const q = nm1.ushrn(k);

    const red = BN.red(n);
    const rnm1 = nm1.toRed(red);
    const rone = new BN(1).toRed(red);

next:
    for (let i = 0; i < reps; i++) {
      let x;

      if (i === reps - 1 && force2) {
        x = new BN(2);
      } else {
        x = BN.random(rng, 0, nm3);
        x.iaddn(2);
      }

      let y = x.toRed(red).redPow(q);

      if (y.cmp(rone) === 0 || y.cmp(rnm1) === 0)
        continue;

      for (let j = 1; j < k; j++) {
        y = y.redSqr();

        if (y.cmp(rnm1) === 0)
          continue next;

        if (y.cmp(rone) === 0)
          return false;
      }

      return false;
    }

    return true;
  }

  isPrimeLucas(limit = 0) {
    enforce((limit >>> 0) === limit, 'limit', 'uint32');

    const n = this;

    // Ignore 0 and 1.
    if (n.cmpn(1) <= 0)
      return false;

    // Two is the only even prime.
    if (n.isEven())
      return n.cmpn(2) === 0;

    let p = 3;

    for (;;) {
      if (p > 10000) {
        // Thought to be impossible.
        throw new Error(`Cannot find (D/n) = -1 for ${n.toString(10)}.`);
      }

      if (limit !== 0 && p > limit) {
        // Optional DoS limit.
        return false;
      }

      const d = new BN(p * p - 4);
      const j = d.jacobi(n);

      if (j === -1)
        break;

      if (j === 0)
        return n.cmpn(p + 2) === 0;

      if (p === 40) {
        if (n.isSquare())
          return false;
      }

      p += 1;
    }

    const s = n.addn(1);
    const r = s._makeOdd();

    let vk = new BN(2);
    let vk1 = new BN(p);

    for (let i = s.bitLength(); i >= 0; i--) {
      if (s.utestn(i)) {
        vk = vk.mul(vk1).isubn(p).imod(n);
        vk1 = vk1.sqr().isubn(2).imod(n);
      } else {
        vk1 = vk1.mul(vk).isubn(p).imod(n);
        vk = vk.sqr().isubn(2).imod(n);
      }
    }

    if (vk.cmpn(2) === 0 || vk.cmp(n.subn(2)) === 0) {
      const a = vk.muln(p).imod(n);
      const b = vk1.ushln(1).imod(n);

      if (a.cmp(b) === 0)
        return true;
    }

    for (let t = 0; t < r - 1; t++) {
      if (vk.isZero())
        return true;

      if (vk.cmpn(2) === 0)
        return false;

      vk = vk.sqr().isubn(2).imod(n);
    }

    return false;
  }

  /*
   * Twos Complement
   */

  toTwos(width) {
    if (this.negative !== 0)
      return this.abs().inotn(width).iaddn(1);

    return this.clone();
  }

  fromTwos(width) {
    enforce((width >>> 0) === width, 'width', 'uint32');
    range(width > 0, 'width');

    if (this.testn(width - 1))
      return this.notn(width).iaddn(1).ineg();

    return this.clone();
  }

  /*
   * Reduction Context
   */

  toRed(ctx) {
    enforce(ctx instanceof Red, 'ctx', 'reduction context');

    if (this.red)
      throw new Error('Already in reduction context.');

    return ctx.convertTo(this);
  }

  fromRed() {
    red(this.red, 'fromRed');
    return this.red.convertFrom(this);
  }

  forceRed(ctx) {
    enforce(ctx instanceof Red, 'ctx', 'reduction context');

    if (this.red) {
      if (!ctx.m.eq(this.red.m) || ctx.mont !== this.red.mont)
        throw new Error('Already in reduction context.');
    } else {
      range(this.negative === 0, 'red');
      range(this.ucmp(ctx.m) < 0, 'red');
    }

    return this.clone()._forceRed(ctx);
  }

  redIAdd(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    red(this.red, 'redIAdd');
    return this.red.iadd(this, num);
  }

  redAdd(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    red(this.red, 'redAdd');
    return this.red.add(this, num);
  }

  redIAddn(num) {
    enforce(isSMI(num), 'num', 'smi');
    red(this.red, 'redIAddn');
    return this.red.iaddn(this, num);
  }

  redAddn(num) {
    enforce(isSMI(num), 'num', 'smi');
    red(this.red, 'redAddn');
    return this.red.addn(this, num);
  }

  redISub(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    red(this.red, 'redISub');
    return this.red.isub(this, num);
  }

  redSub(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    red(this.red, 'redSub');
    return this.red.sub(this, num);
  }

  redISubn(num) {
    enforce(isSMI(num), 'num', 'smi');
    red(this.red, 'redISubn');
    return this.red.isubn(this, num);
  }

  redSubn(num) {
    enforce(isSMI(num), 'num', 'smi');
    red(this.red, 'redSubn');
    return this.red.subn(this, num);
  }

  redIMul(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    red(this.red, 'redIMul');
    return this.red.imul(this, num);
  }

  redMul(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    red(this.red, 'redMul');
    return this.red.mul(this, num);
  }

  redIMuln(num) {
    enforce(isSMI(num), 'num', 'smi');
    red(this.red, 'redIMuln');
    return this.red.imuln(this, num);
  }

  redMuln(num) {
    enforce(isSMI(num), 'num', 'smi');
    red(this.red, 'redMuln');
    return this.red.muln(this, num);
  }

  redIDiv(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    red(this.red, 'redIDiv');
    return this.red.idiv(this, num);
  }

  redDiv(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    red(this.red, 'redDiv');
    return this.red.div(this, num);
  }

  redIDivn(num) {
    enforce(isSMI(num), 'num', 'smi');
    red(this.red, 'redIDivn');
    return this.red.idivn(this, num);
  }

  redDivn(num) {
    enforce(isSMI(num), 'num', 'smi');
    red(this.red, 'redDivn');
    return this.red.divn(this, num);
  }

  redIPow(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    red(this.red, 'redIPow');
    nonred(!num.red, 'redIPow');
    return this.red.ipow(this, num);
  }

  redPow(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    red(this.red, 'redPow');
    nonred(!num.red, 'redPow');
    return this.red.pow(this, num);
  }

  redIPown(num) {
    enforce(isSMI(num), 'num', 'smi');
    red(this.red, 'redIPown');
    return this.red.ipown(this, num);
  }

  redPown(num) {
    enforce(isSMI(num), 'num', 'smi');
    red(this.red, 'redPown');
    return this.red.pown(this, num);
  }

  redISqr() {
    red(this.red, 'redISqr');
    return this.red.isqr(this);
  }

  redSqr() {
    red(this.red, 'redSqr');
    return this.red.sqr(this);
  }

  redISqrt() {
    red(this.red, 'redISqrt');
    return this.red.isqrt(this);
  }

  redSqrt() {
    red(this.red, 'redSqrt');
    return this.red.sqrt(this);
  }

  redIDivSqrt(v) {
    red(this.red, 'redIDivSqrt');
    return this.red.idivsqrt(this, v);
  }

  redDivSqrt(v) {
    red(this.red, 'redDivSqrt');
    return this.red.divsqrt(this, v);
  }

  redIsSquare() {
    red(this.red, 'redIsSquare');
    return this.red.isSquare(this);
  }

  redIShl(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    red(this.red, 'redIShl');
    nonred(!num.red, 'redIShl');
    return this.red.ishl(this, num);
  }

  redShl(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    red(this.red, 'redShl');
    nonred(!num.red, 'redShl');
    return this.red.shl(this, num);
  }

  redIShln(num) {
    enforce((num >>> 0) === num, 'num', 'uint32');
    red(this.red, 'redIShln');
    return this.red.ishln(this, num);
  }

  redShln(num) {
    enforce((num >>> 0) === num, 'num', 'uint32');
    red(this.red, 'redShln');
    return this.red.shln(this, num);
  }

  redINeg() {
    red(this.red, 'redINeg');
    return this.red.ineg(this);
  }

  redNeg() {
    red(this.red, 'redNeg');
    return this.red.neg(this);
  }

  redEq(num) {
    enforce(BN.isBN(num), 'num', 'bignum');
    red(this.red, 'redEq');
    return this.red.eq(this, num);
  }

  redEqn(num) {
    enforce(isSMI(num), 'num', 'smi');
    red(this.red, 'redEqn');
    return this.red.eqn(this, num);
  }

  redIsHigh() {
    red(this.red, 'redIsHigh');
    return this.red.isHigh(this);
  }

  redIsLow() {
    red(this.red, 'redIsLow');
    return this.red.isLow(this);
  }

  redIsOdd() {
    red(this.red, 'redIsOdd');
    return this.red.isOdd(this);
  }

  redIsEven() {
    red(this.red, 'redIsEven');
    return this.red.isEven(this);
  }

  redLegendre() {
    red(this.red, 'redLegendre');
    return this.red.legendre(this);
  }

  redJacobi() {
    red(this.red, 'redJacobi');
    return this.red.jacobi(this);
  }

  redKronecker() {
    red(this.red, 'redKronecker');
    return this.red.kronecker(this);
  }

  redIInvert() {
    red(this.red, 'redIInvert');
    return this.red.iinvert(this);
  }

  redInvert() {
    red(this.red, 'redInvert');
    return this.red.invert(this);
  }

  redIFermat() {
    red(this.red, 'redIFermat');
    return this.red.ifermat(this);
  }

  redFermat() {
    red(this.red, 'redFermat');
    return this.red.fermat(this);
  }

  /*
   * Internal
   */

  _move(dest) {
    dest.words = this.words;
    dest.length = this.length;
    dest.negative = this.negative;
    dest.red = this.red;
    return dest;
  }

  _alloc(size) {
    while (this.words.length < size)
      this.words.push(0);

    return this;
  }

  _expand(size) {
    this._alloc(size);

    while (this.length < size)
      this.words[this.length++] = 0;

    return this;
  }

  _strip() {
    while (this.length > 1 && this.words[this.length - 1] === 0)
      this.length -= 1;

    return this._normalize();
  }

  _normalize() {
    assert(this.length > 0);

    // -0 = 0
    if (this.length === 1 && this.words[0] === 0)
      this.negative = 0;

    return this;
  }

  _check() {
    // We never have a zero length number.
    assert(this.length > 0);

    // Cannot exceed array bounds.
    assert(this.length <= this.words.length);

    if (this.length === 1) {
      // Must be normalized.
      if (this.words[0] === 0)
        assert(this.negative === 0);
      return this;
    }

    // Must be stripped.
    assert(this.words[this.length - 1] !== 0);

    return this;
  }

  _invertp(p) {
    // Penk's right shift binary EGCD.
    //
    // See: The Art of Computer Programming,
    //      Volume 2, Seminumerical Algorithms
    //   Donald E. Knuth
    //   Exercise 4.5.2.39
    enforce(BN.isBN(p), 'p', 'bignum');
    range(p.sign() > 0, 'invert');
    assert(p.isOdd());

    if (p.cmpn(1) === 0)
      throw new RangeError('Not invertible.');

    const a = this.clone();
    const b = p.clone();
    const u = new BN(1);
    const v = new BN(0);

    if (a.isNeg() || a.ucmp(b) >= 0)
      a.imod(b);

    while (!a.isZero()) {
      let i = a._makeOdd();
      let j = b._makeOdd();

      while (i--) {
        if (u.isOdd())
          u._iadd(u, p);

        u.iushrn(1);
      }

      while (j--) {
        if (v.isOdd())
          v._iadd(v, p);

        v.iushrn(1);
      }

      if (a.ucmp(b) >= 0) {
        a._isub(a, b);
        if (u.ucmp(v) < 0) {
          u._isub(v, u);
          u._isub(p, u);
        } else {
          u._isub(u, v);
        }
      } else {
        b._isub(b, a);
        if (v.ucmp(u) < 0) {
          v._isub(u, v);
          v._isub(p, v);
        } else {
          v._isub(v, u);
        }
      }
    }

    if (b.cmpn(1) !== 0)
      throw new RangeError('Not invertible.');

    assert(v.negative === 0);
    assert(v.ucmp(p) < 0);

    return v;
  }

  _makeOdd() {
    const shift = this.zeroBits();

    if (shift > 0)
      this.iushrn(shift);

    return shift;
  }

  _factor2(num) {
    // Find common factor of two.
    // Expects inputs to be non-zero.
    if ((this.words[0] | num.words[0]) & 1)
      return 0;

    const len = Math.min(this.length, num.length);

    let r = 0;

    for (let i = 0; i < len; i++) {
      const b = zeroBits(this.words[i] | num.words[i]);

      r += b;

      if (b !== 26)
        break;
    }

    return r;
  }

  _cloneNormal() {
    return this.red ? this.fromRed() : this.clone();
  }

  _forceRed(ctx) {
    this.red = ctx;
    return this;
  }

  /*
   * Helpers
   */

  clone() {
    const copy = new BN();

    copy.words = new Array(this.length);

    for (let i = 0; i < this.length; i++)
      copy.words[i] = this.words[i];

    copy.length = this.length;
    copy.negative = this.negative;
    copy.red = this.red;

    return copy;
  }

  inject(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    this._alloc(num.length);

    for (let i = 0; i < num.length; i++)
      this.words[i] = num.words[i];

    this.length = num.length;
    this.negative = num.negative;
    this.red = num.red;

    return this;
  }

  set(num, endian) {
    return this.fromNumber(num, endian);
  }

  swap(num) {
    enforce(BN.isBN(num), 'num', 'bignum');

    const x = this;
    const y = num;

    [x.words, y.words] = [y.words, x.words];
    [x.length, y.length] = [y.length, x.length];
    [x.negative, y.negative] = [y.negative, x.negative];
    [x.red, y.red] = [y.red, x.red];

    return x;
  }

  reverse() {
    const neg = this.negative;

    this.fromBuffer(this.toBuffer('be'), 'le');
    this.negative = neg;

    return this;
  }

  byteLength() {
    return Math.ceil(this.bitLength() / 8);
  }

  bitLength() {
    const w = this.words[this.length - 1];
    const hi = countBits(w);
    return (this.length - 1) * 26 + hi;
  }

  zeroBits() {
    if (this.isZero())
      return 0;

    if (this.isOdd())
      return 0;

    let r = 0;

    for (let i = 0; i < this.length; i++) {
      const b = zeroBits(this.words[i]);

      r += b;

      if (b !== 26)
        break;
    }

    return r;
  }

  isSafe() {
    if (this.length <= 2)
      return true;

    if (this.length === 3 && this.words[2] === 0x01)
      return true;

    return false;
  }

  word(pos) {
    enforce((pos >>> 0) === pos, 'pos', 'uint32');

    if (pos >= this.length)
      return 0;

    return this.words[pos];
  }

  [custom]() {
    let prefix = 'BN';

    if (this.red)
      prefix = 'BN-R';

    return `<${prefix}: ${this.toString(10)}>`;
  }

  /*
   * Conversion
   */

  toNumber() {
    let num = this.words[0];

    if (this.length === 2) {
      num += this.words[1] * 0x4000000;
    } else if (this.length === 3 && this.words[2] === 0x01) {
      // Note: at this stage it is known that the top bit is set.
      num += 0x10000000000000 + (this.words[1] * 0x4000000);
    } else if (this.length > 2) {
      throw new RangeError('Number can only safely store up to 53 bits.');
    }

    return this.negative !== 0 ? -num : num;
  }

  toDouble() {
    let num = 0;

    for (let i = this.length - 1; i >= 0; i--)
      num = (num * 0x4000000) + this.words[i];

    return this.negative !== 0 ? -num : num;
  }

  valueOf() {
    return this.toDouble();
  }

  toBigInt() {
    if (!HAS_BIGINT)
      throw new Error('BigInt is not supported!');

    const s52 = BigInt(52);
    const s26 = BigInt(26);

    let i = this.length - 1;
    let num = BigInt(0);

    for (; i >= 1; i -= 2) {
      const hi = this.words[i] * 0x4000000;
      const lo = this.words[i - 1];

      num = (num << s52) | BigInt(hi + lo);
    }

    if (i >= 0)
      num = (num << s26) | BigInt(this.words[0]);

    return this.negative !== 0 ? -num : num;
  }

  toBool() {
    return !this.isZero();
  }

  toString(base, padding) {
    base = getBase(base);

    if (padding == null)
      padding = 0;

    if (padding === 0)
      padding = 1;

    enforce((base >>> 0) === base, 'base', 'uint32');
    enforce((padding >>> 0) === padding, 'padding', 'uint32');

    if (base < 2 || base > 36)
      throw new RangeError('Base ranges between 2 and 36.');

    this._check();

    if (base === 16) {
      let out = '';
      let off = 0;
      let carry = 0;

      for (let i = 0; i < this.length; i++) {
        const w = this.words[i];
        const word = (((w << off) | carry) & 0xffffff).toString(16);

        carry = (w >>> (24 - off)) & 0xffffff;

        if (carry !== 0 || i !== this.length - 1)
          out = zeros[6 - word.length] + word + out;
        else
          out = word + out;

        off += 2;

        if (off >= 26) {
          off -= 26;
          i -= 1;
        }
      }

      if (carry !== 0)
        out = carry.toString(16) + out;

      while (out.length % padding !== 0)
        out = '0' + out;

      if (this.negative !== 0)
        out = '-' + out;

      return out;
    }

    const groupSize = groupSizes[base - 1];
    const groupBase = groupBases[base - 1];
    const c = this.clone();

    let out = '';

    c.negative = 0;

    while (!c.isZero()) {
      const r = c.remrn(groupBase).toString(base);

      c.iquon(groupBase);

      if (!c.isZero())
        out = zeros[groupSize - r.length] + r + out;
      else
        out = r + out;
    }

    if (this.isZero())
      out = '0';

    while (out.length % padding !== 0)
      out = '0' + out;

    if (this.negative !== 0)
      out = '-' + out;

    return out;
  }

  toJSON() {
    return this.toString(16, 2);
  }

  toArray(endian, length) {
    return this.toArrayLike(Array, endian, length);
  }

  toBuffer(endian, length) {
    return this.toArrayLike(Buffer, endian, length);
  }

  toArrayLike(ArrayType, endian, length) {
    if (endian == null)
      endian = 'be';

    if (length == null)
      length = 0;

    enforce(typeof ArrayType === 'function', 'ArrayType', 'function');
    enforce(endian === 'be' || endian === 'le', 'endian', 'endianness');
    enforce((length >>> 0) === length, 'length', 'uint32');

    this._check();

    const bytes = this.byteLength();
    const size = length || Math.max(1, bytes);

    if (bytes > size)
      throw new RangeError('Byte array longer than desired length.');

    const res = allocate(ArrayType, size);

    // See: https://github.com/indutny/bn.js/pull/222
    if (endian === 'be') {
      let pos = res.length - 1;
      let carry = 0;

      for (let i = 0; i < this.length; i++) {
        const shift = (i & 3) << 1;
        const word = (this.words[i] << shift) | carry;

        res[pos--] = word & 0xff;

        if (pos >= 0)
          res[pos--] = (word >>> 8) & 0xff;

        if (pos >= 0)
          res[pos--] = (word >>> 16) & 0xff;

        if (shift === 6) {
          if (pos >= 0)
            res[pos--] = (word >>> 24) & 0xff;

          carry = 0;
        } else {
          carry = word >>> 24;
        }
      }

      if (pos >= 0) {
        res[pos--] = carry;

        while (pos >= 0)
          res[pos--] = 0;

        carry = 0;
      }

      assert(carry === 0);
    } else {
      let pos = 0;
      let carry = 0;

      for (let i = 0; i < this.length; i++) {
        const shift = (i & 3) << 1;
        const word = (this.words[i] << shift) | carry;

        res[pos++] = word & 0xff;

        if (pos < res.length)
          res[pos++] = (word >>> 8) & 0xff;

        if (pos < res.length)
          res[pos++] = (word >>> 16) & 0xff;

        if (shift === 6) {
          if (pos < res.length)
            res[pos++] = (word >>> 24) & 0xff;

          carry = 0;
        } else {
          carry = word >>> 24;
        }
      }

      if (pos < res.length) {
        res[pos++] = carry;

        while (pos < res.length)
          res[pos++] = 0;

        carry = 0;
      }

      assert(carry === 0);
    }

    return res;
  }

  encode(endian, length) {
    return this.toBuffer(endian, length);
  }

  /*
   * Instantiation
   */

  of(num, endian) {
    return this.fromNumber(num, endian);
  }

  fromNumber(num, endian) {
    if (endian == null)
      endian = 'be';

    enforce(isInteger(num), 'num', 'integer');
    enforce(endian === 'be' || endian === 'le', 'endian', 'endianness');

    const neg = (num < 0) | 0;

    if (neg)
      num = -num;

    if (num < 0x4000000) {
      this.words[0] = num & 0x3ffffff;
      this.length = 1;
    } else if (num < 0x10000000000000) {
      this.words = [
        num & 0x3ffffff,
        (num / 0x4000000) & 0x3ffffff
      ];
      this.length = 2;
    } else {
      this.words = [
        num & 0x3ffffff,
        (num / 0x4000000) & 0x3ffffff,
        1
      ];
      this.length = 3;
    }

    this.negative = neg;

    if (endian === 'le')
      this.reverse();

    return this;
  }

  fromDouble(num, endian) {
    if (endian == null)
      endian = 'be';

    enforce(typeof num === 'number', 'num', 'double');
    enforce(endian === 'be' || endian === 'le', 'endian', 'endianness');

    if (!isFinite(num))
      num = 0;

    const neg = (num <= -1) | 0;

    if (num < 0)
      num = -num;

    num = Math.floor(num);

    this.words = [];

    while (num > 0) {
      const lo = num % 0x4000000;
      const hi = (num - lo) / 0x4000000;

      this.words.push(lo);

      num = hi;
    }

    if (this.words.length === 0)
      this.words.push(0);

    this.length = this.words.length;
    this.negative = neg;

    if (endian === 'le')
      this.reverse();

    return this;
  }

  fromBigInt(num, endian) {
    if (endian == null)
      endian = 'be';

    enforce(typeof num === 'bigint', 'num', 'bigint');
    enforce(endian === 'be' || endian === 'le', 'endian', 'endianness');

    if (!HAS_BIGINT)
      throw new Error('BigInt is not supported!');

    // You know the implementation has a
    // problem when strings are twice
    // as fast as bigints.
    const start = (num < BigInt(0)) | 0;

    this._fromHex(num.toString(16), start);
    this.negative = start;

    if (endian === 'le')
      this.reverse();

    return this;
  }

  fromBool(value) {
    enforce(typeof value === 'boolean', 'value', 'boolean');

    this.words[0] = value | 0;
    this.length = 1;
    this.negative = 0;

    return this;
  }

  fromString(str, base, endian) {
    if (base === 'le' || base === 'be')
      [base, endian] = [endian, base];

    base = getBase(base);

    if (endian == null)
      endian = 'be';

    enforce(typeof str === 'string', 'string', 'string');
    enforce((base >>> 0) === base, 'base', 'uint32');
    enforce(endian === 'be' || endian === 'le', 'endian', 'endianness');

    if (base < 2 || base > 36)
      throw new Error('Base ranges between 2 and 36.');

    str = str.replace(/\s+/g, '');

    let start = 0;

    if (str.length > 0 && str.charCodeAt(0) === 0x2d)
      start = 1;

    if (base === 16)
      this._fromHex(str, start);
    else
      this._fromBase(str, base, start);

    this.negative = start;

    this._normalize();

    if (endian === 'le')
      this.reverse();

    return this;
  }

  _fromHex(str, start) {
    this.length = Math.max(2, Math.ceil((str.length - start) / 6));
    this.words = new Array(this.length);

    for (let i = 0; i < this.length; i++)
      this.words[i] = 0;

    // Scan 24-bit chunks and add them to the number.
    let off = 0;
    let i = str.length - 6;
    let j = 0;

    for (; i >= start; i -= 6) {
      const w = parseHex(str, i, i + 6);

      this.words[j] |= (w << off) & 0x3ffffff;

      // `0x3fffff` is intentional here, 26bits max shift + 24bit hex limb.
      this.words[j + 1] |= (w >>> (26 - off)) & 0x3fffff;

      off += 24;

      if (off >= 26) {
        off -= 26;
        j += 1;
      }
    }

    if (i + 6 !== start) {
      const w = parseHex(str, start, i + 6);

      this.words[j] |= (w << off) & 0x3ffffff;
      this.words[j + 1] |= (w >>> (26 - off)) & 0x3fffff;
    }

    return this._strip();
  }

  _fromBase(str, base, start) {
    // Initialize as zero.
    this.words[0] = 0;
    this.length = 1;
    this.negative = 0;

    // Find length of limb in base.
    let limbLen = 0;
    let limbPow = 1;

    for (; limbPow <= 0x3ffffff; limbPow *= base)
      limbLen += 1;

    limbLen -= 1;
    limbPow = (limbPow / base) | 0;

    const total = str.length - start;
    const mod = total % limbLen;
    const end = Math.min(total, total - mod) + start;

    let i = start;

    for (; i < end; i += limbLen) {
      const word = parseBase(str, i, i + limbLen, base);

      this.imuln(limbPow);
      this._iaddn(word);
    }

    if (mod !== 0) {
      const pow = Math.pow(base, mod);
      const word = parseBase(str, i, str.length, base);

      this.imuln(pow);
      this._iaddn(word);
    }

    return this;
  }

  fromJSON(json) {
    if (BN.isBN(json)) {
      if (json.red)
        return json.fromRed();

      return json.clone();
    }

    if (Array.isArray(json)) {
      for (const chunk of json)
        enforce(typeof chunk === 'string', 'chunk', 'string');

      json = json.join('');
    }

    return this.fromString(json, 16);
  }

  fromBN(num) {
    return this.inject(num);
  }

  fromArray(data, endian) {
    enforce(Array.isArray(data), 'data', 'array');
    return this.fromArrayLike(data, endian);
  }

  fromBuffer(data, endian) {
    enforce(Buffer.isBuffer(data), 'data', 'buffer');
    return this.fromArrayLike(data, endian);
  }

  fromArrayLike(data, endian) {
    if (endian == null)
      endian = 'be';

    enforce(data && (data.length >>> 0) === data.length, 'data', 'array-like');
    enforce(endian === 'be' || endian === 'le', 'endian', 'endianness');

    if (data.length === 0) {
      this.words[0] = 0;
      this.length = 1;
      this.negative = 0;
      return this;
    }

    this.length = Math.max(2, Math.ceil(data.length / 3));
    this.words = new Array(this.length);
    this.negative = 0;

    for (let i = 0; i < this.length; i++)
      this.words[i] = 0;

    const left = data.length % 3;

    let off = 0;
    let j = 0;
    let w = 0;

    if (endian === 'be') {
      for (let i = data.length - 1; i >= 2; i -= 3) {
        const w = data[i] | (data[i - 1] << 8) | (data[i - 2] << 16);

        this.words[j] |= (w << off) & 0x3ffffff;
        this.words[j + 1] = (w >>> (26 - off)) & 0x3ffffff;

        off += 24;

        if (off >= 26) {
          off -= 26;
          j += 1;
        }
      }

      switch (left) {
        case 2:
          w = data[1] | (data[0] << 8);
          break;
        case 1:
          w = data[0];
          break;
      }
    } else {
      const len = data.length - left;

      for (let i = 0; i < len; i += 3) {
        const w = data[i] | (data[i + 1] << 8) | (data[i + 2] << 16);

        this.words[j] |= (w << off) & 0x3ffffff;
        this.words[j + 1] = (w >>> (26 - off)) & 0x3ffffff;

        off += 24;

        if (off >= 26) {
          off -= 26;
          j += 1;
        }
      }

      switch (left) {
        case 2:
          w = data[len] | (data[len + 1] << 8);
          break;
        case 1:
          w = data[len];
          break;
      }
    }

    if (left > 0) {
      this.words[j] |= (w << off) & 0x3ffffff;
      this.words[j + 1] = (w >>> (26 - off)) & 0x3ffffff;
    }

    return this._strip();
  }

  decode(data, endian) {
    return this.fromBuffer(data, endian);
  }

  from(num, base, endian) {
    if (num == null)
      return this;

    if (base === 'le' || base === 'be')
      [base, endian] = [endian, base];

    if (typeof num === 'number')
      return this.fromNumber(num, endian);

    if (typeof num === 'bigint')
      return this.fromBigInt(num, endian);

    if (typeof num === 'string')
      return this.fromString(num, base, endian);

    if (typeof num === 'object') {
      if (BN.isBN(num))
        return this.fromBN(num, endian);

      if ((num.length >>> 0) === num.length)
        return this.fromArrayLike(num, endian);
    }

    if (typeof num === 'boolean')
      return this.fromBool(num);

    throw new TypeError('Non-numeric object passed to BN.');
  }

  /*
   * Static Methods
   */

  static min(...args) {
    let min = null;

    for (const num of args) {
      enforce(BN.isBN(num), 'num', 'bignum');

      if (!min || num.cmp(min) < 0)
        min = num;
    }

    return min || new BN(0);
  }

  static max(...args) {
    let max = null;

    for (const num of args) {
      enforce(BN.isBN(num), 'num', 'bignum');

      if (!max || num.cmp(max) > 0)
        max = num;
    }

    return max || new BN(0);
  }

  static cmp(a, b) {
    enforce(BN.isBN(a), 'a', 'bignum');
    return a.cmp(b);
  }

  static ucmp(a, b) {
    enforce(BN.isBN(a), 'a', 'bignum');
    return a.ucmp(b);
  }

  static red(num) {
    return new Red(num);
  }

  static barrett(num) {
    return new Barrett(num);
  }

  static mont(num) {
    return new Mont(num);
  }

  static _prime(name) {
    if (primes[name])
      return primes[name];

    let prime;

    if (name === 'p192')
      prime = new P192();
    else if (name === 'p224')
      prime = new P224();
    else if (name === 'p521')
      prime = new P521();
    else if (name === 'k256')
      prime = new K256();
    else if (name === 'p251')
      prime = new P251();
    else if (name === 'p25519')
      prime = new P25519();
    else if (name === 'p448')
      prime = new P448();
    else
      throw new Error(`Unknown prime: "${name}".`);

    primes[name] = prime;

    return prime;
  }

  static prime(name) {
    return BN._prime(name).p.clone();
  }

  static pow(num, exp) {
    if (num === 2)
      return BN.shift(1, exp);

    return new BN().fromNumber(num).pown(exp);
  }

  static shift(num, bits) {
    if (num === 1)
      return new BN(0).usetn(bits, 1);

    return new BN().fromNumber(num).ishln(bits);
  }

  static mask(bits) {
    return BN.shift(1, bits).isubn(1);
  }

  static randomBits(rng, bits) {
    enforce(rng != null, 'rng', 'rng');
    enforce((bits >>> 0) === bits, 'bits', 'uint32');

    if (typeof rng === 'object') {
      enforce(typeof rng.randomBytes === 'function', 'rng', 'rng');

      const size = (bits + 7) >>> 3;
      const total = size * 8;
      const bytes = rng.randomBytes(size);

      enforce(Buffer.isBuffer(bytes), 'bytes', 'buffer');

      if (bytes.length !== size)
        throw new RangeError('Invalid number of bytes returned from RNG.');

      const num = BN.fromBuffer(bytes);

      if (total > bits)
        num.iushrn(total - bits);

      return num;
    }

    enforce(typeof rng === 'function', 'rng', 'rng');

    const num = rng(bits);

    enforce(BN.isBN(num), 'num', 'bignum');
    range(num.negative === 0, 'RNG');
    nonred(!num.red, 'RNG');

    if (num.bitLength() > bits)
      throw new RangeError('Invalid number of bits returned from RNG.');

    return num;
  }

  static random(rng, min, max) {
    min = BN.cast(min, 16);
    max = BN.cast(max, 16);

    if (min.cmp(max) > 0)
      throw new RangeError('Minimum cannot be greater than maximum.');

    const space = max.sub(min).iabs();
    const bits = space.bitLength();

    if (bits === 0)
      return min.clone();

    for (;;) {
      const num = BN.randomBits(rng, bits);

      // Maximum is _exclusive_!
      if (num.cmp(space) >= 0)
        continue;

      // Minimum is _inclusive_!
      num.iadd(min);

      return num;
    }
  }

  static of(num, endian) {
    return new BN().of(num, endian);
  }

  static fromNumber(num, endian) {
    return new BN().fromNumber(num, endian);
  }

  static fromDouble(num, endian) {
    return new BN().fromDouble(num, endian);
  }

  static fromBigInt(num, endian) {
    return new BN().fromBigInt(num, endian);
  }

  static fromBool(value) {
    return new BN().fromBool(value);
  }

  static fromString(str, base, endian) {
    return new BN().fromString(str, base, endian);
  }

  static fromJSON(json) {
    return new BN().fromJSON(json);
  }

  static fromBN(num) {
    return new BN().fromBN(num);
  }

  static fromArray(data, endian) {
    return new BN().fromArray(data, endian);
  }

  static fromBuffer(data, endian) {
    return new BN().fromBuffer(data, endian);
  }

  static fromArrayLike(data, endian) {
    return new BN().fromArrayLike(data, endian);
  }

  static decode(data, endian) {
    return new BN().decode(data, endian);
  }

  static from(num, base, endian) {
    return new BN().from(num, base, endian);
  }

  static cast(num, base, endian) {
    if (BN.isBN(num))
      return num;

    return new BN(num, base, endian);
  }

  static isBN(obj) {
    return obj instanceof BN;
  }
}

/*
 * Static
 */

BN.BN = BN;
BN.wordSize = 26;
BN.native = 0;

/**
 * Prime
 */

class Prime {
  constructor(name, p) {
    // P = 2^N - K
    this.name = name;
    this.p = new BN(p, 16);
    this.n = this.p.bitLength();
    this.k = BN.shift(1, this.n).isub(this.p);
    this.lo = this.p.clone();
    this.one = this.p.clone();
  }

  ireduce(num) {
    // Assumes that `num` is less than `P^2`:
    // num = HI * (2^N - K) + HI * K + LO = HI * K + LO (mod P)
    const neg = num.negative !== 0;

    // Track bits.
    let bits = num.bitLength();

    // Must be less than P^2.
    assert(bits <= this.n * 2);

    // Ensure positive.
    num.negative = 0;

    // Reduce.
    while (bits > this.n) {
      // lo = num & ((1 << n) - 1)
      // num = num >> n
      this.split(num, this.lo);

      // num = num * K
      this.imulK(num);

      // num = num + lo
      num._iadd(num, this.lo);

      // bits = bitlen(num)
      bits = num.bitLength();
    }

    // Final reduction.
    const cmp = bits < this.n ? -1 : num.ucmp(this.p);

    if (cmp === 0) {
      num.words[0] = 0;
      num.length = 1;
    } else if (cmp > 0) {
      num._isub(num, this.p);
    } else {
      // Note: we shouldn't need to strip here.
    }

    // Adjust sign.
    if (neg && !num.isZero())
      num._isub(this.p, num);

    return num;
  }

  split(input, out) {
    input._split(this.n, out);
  }

  imulK(num) {
    return num.imul(this.k);
  }

  pm2(x1) {
    // Exponent: p - 2
    throw new Error('Not implemented.');
  }

  fermat(x) {
    return this.pm2(x);
  }
}

/**
 * Prime (3 mod 4)
 */

class Prime34 extends Prime {
  constructor(name, p) {
    super(name, p);
  }

  pm3d4(x1) {
    // Exponent: (p - 3) / 4
    throw new Error('Not implemented.');
  }

  pp1d4(x1) {
    // Exponent: (p + 1) / 4
    throw new Error('Not implemented.');
  }

  sqrt(x) {
    // r = x^((p + 1) / 4) mod p
    const {red} = x;
    const r = this.pp1d4(x);

    if (!red.sqr(r).eq(x))
      throw new SquareRootError(r);

    return r;
  }

  divsqrt(u, v) {
    // x = u^3 * v * (u^5 * v^3)^((p - 3) / 4) mod p
    const {red} = u;
    const u2 = red.sqr(u);
    const u3 = red.mul(u2, u);
    const u5 = red.mul(u3, u2);
    const v3 = red.mul(red.sqr(v), v);
    const p = this.pm3d4(red.mul(u5, v3));
    const x = red.mul(red.mul(u3, v), p);
    const c = red.mul(v, red.sqr(x));

    if (c.eq(u))
      return x;

    throw new SquareRootError(x);
  }
}

/**
 * Prime (5 mod 8)
 */

class Prime58 extends Prime {
  constructor(name, p, sm1) {
    super(name, p);

    this.sm1 = new BN(sm1, 16);
  }

  pm5d8(x1) {
    // Exponent: (p - 5) / 8
    throw new Error('Not implemented.');
  }

  pp3d8(x1) {
    // Exponent: (p + 3) / 8
    throw new Error('Not implemented.');
  }

  sqrt(x) {
    // r = x^((p + 3) / 8) mod p
    const {red} = x;
    const sm1 = this.sm1._forceRed(red);
    const r = this.pp3d8(x);

    if (red.sqr(r).eq(x))
      return r;

    const c = red.mul(r, sm1);

    if (red.sqr(c).eq(x))
      return c;

    throw new SquareRootError(r);
  }

  divsqrt(u, v) {
    // x = u * v^3 * (u * v^7)^((p - 5) / 8) mod p
    const {red} = u;
    const sm1 = this.sm1._forceRed(red);
    const v3 = red.mul(red.sqr(v), v);
    const v7 = red.mul(red.sqr(v3), v);
    const p = this.pm5d8(red.mul(u, v7));
    const x = red.mul(red.mul(u, v3), p);
    const c = red.mul(v, red.sqr(x));

    if (c.eq(u))
      return x;

    const mc = red.ineg(c);

    if (mc.eq(u))
      return red.mul(x, sm1);

    if (mc.eq(red.mul(u, sm1)))
      throw new SquareRootError(red.mul(x, sm1));

    throw new SquareRootError(x);
  }
}

/**
 * Prime (1 mod 16)
 */

class Prime116 extends Prime {
  constructor(name, p, g) {
    super(name, p);

    this.g = new BN(g, 16);
    this.z = this.p.subn(1).zeroBits();
  }

  powS(x1) {
    // Exponent: (p - 1) / 2^k
    throw new Error('Not implemented.');
  }

  powE(x1) {
    // Exponent: (s + 1) / 2
    throw new Error('Not implemented.');
  }

  sqrt(x) {
    // Tonelli-Shanks (variable time).
    //
    // Constants:
    //
    //   k = factors of 2 for (p - 1)
    //   s = (p - 1) / 2^k
    //   e = (s + 1) / 2
    //   n = first non-square in F(p)
    //
    // Algorithm:
    //
    //   g = n^s mod p
    //   y = x^e mod p
    //   b = x^s mod p
    //
    //   loop:
    //     t = b
    //     m = 0
    //
    //     while t != 1:
    //       t = t^2 mod p
    //       m += 1
    //
    //     if m == 0:
    //       break
    //
    //     if m >= k:
    //       fail
    //
    //     t = g^(2^(k - m - 1)) mod p
    //     g = t^2 mod p
    //     y = y * t mod p
    //     b = b * g mod p
    //     k = m
    //
    //   return y
    //
    const {red} = x;

    switch (red.jacobi(x)) {
      case -1:
        throw new SquareRootError(x);
      case 0:
        return x.clone();
      case 1:
        break;
    }

    let g = this.g._forceRed(red);
    let y = this.powE(x);
    let b = this.powS(x);
    let k = this.z;

    for (;;) {
      let t = b;
      let m = 0;

      while (t.cmpn(1) !== 0 && m < k) {
        t = red.sqr(t);
        m += 1;
      }

      if (m === 0)
        break;

      assert(m < k);

      t = red.sqrn(g, k - m - 1);
      g = red.sqr(t);
      y = red.mul(y, t);
      b = red.mul(b, g);
      k = m;
    }

    return y;
  }

  divsqrt(u, v) {
    const {red} = u;

    if (v.isZero())
      throw new SquareRootError(v);

    return this.sqrt(red.div(u, v));
  }
}

/**
 * P192
 */

class P192 extends Prime34 {
  constructor() {
    // 2^192 - 2^64 - 1 (= 3 mod 4)
    super('p192', 'ffffffff ffffffff ffffffff fffffffe'
                + 'ffffffff ffffffff');
  }

  imulK(num) {
    // K = 0x10000000000000001
    // K = 2^64 + 1
    const one = this.one.inject(num);
    return num.iushln(64)._iadd(num, one);
  }

  core(x1) {
    // Exponent: (p - 3) / 4
    // Bits: 127x1 1x0 62x1
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const x3 = red.sqrnmul(x2, 1, x1);
    const x6 = red.sqrnmul(x3, 3, x3);
    const x12 = red.sqrnmul(x6, 6, x6);
    const x24 = red.sqrnmul(x12, 12, x12);
    const x30 = red.sqrnmul(x24, 6, x6);
    const x31 = red.sqrnmul(x30, 1, x1);
    const x62 = red.sqrnmul(x31, 31, x31);
    const x124 = red.sqrnmul(x62, 62, x62);
    const x127 = red.sqrnmul(x124, 3, x3);
    const r0 = red.sqrn(x127, 1);
    const r1 = red.sqrnmul(r0, 62, x62);

    return r1;
  }

  pm3d4(x1) {
    // Exponent: (p - 3) / 4
    // Bits: 127x1 1x0 62x1
    return this.core(x1);
  }

  pm2(x1) {
    // Exponent: p - 2
    // Bits: 127x1 1x0 62x1 1x0 1x1
    const {red} = x1;
    const r0 = this.core(x1);
    const r1 = red.sqrn(r0, 1);
    const r2 = red.sqrnmul(r1, 1, x1);

    return r2;
  }

  pp1d4(x1) {
    // Exponent: (p + 1) / 4
    // Bits: 128x1 62x0
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const x4 = red.sqrnmul(x2, 2, x2);
    const x8 = red.sqrnmul(x4, 4, x4);
    const x16 = red.sqrnmul(x8, 8, x8);
    const x32 = red.sqrnmul(x16, 16, x16);
    const x64 = red.sqrnmul(x32, 32, x32);
    const x128 = red.sqrnmul(x64, 64, x64);
    const r0 = red.sqrn(x128, 62);

    return r0;
  }
}

/**
 * P224
 */

class P224 extends Prime116 {
  constructor() {
    // 2^224 - 2^96 + 1 (1 mod 16)
    super('p224', 'ffffffff ffffffff ffffffff ffffffff'
                + '00000000 00000000 00000001',
                  '6a0fec67 8598a792 0c55b2d4 0b2d6ffb'
                + 'bea3d8ce f3fb3632 dc691b74');
  }

  imulK(num) {
    // K = 0xffffffffffffffffffffffff
    // K = 2^96 - 1
    const one = this.one.inject(num);
    return num.iushln(96)._isub(num, one);
  }

  powS(x1) {
    // Exponent: 2^128 - 1
    // Bits: 128x1
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const x4 = red.sqrnmul(x2, 2, x2);
    const x8 = red.sqrnmul(x4, 4, x4);
    const x16 = red.sqrnmul(x8, 8, x8);
    const x32 = red.sqrnmul(x16, 16, x16);
    const x64 = red.sqrnmul(x32, 32, x32);
    const x128 = red.sqrnmul(x64, 64, x64);

    return x128;
  }

  powE(x1) {
    // Exponent: 2^127
    // Bits: 1x1 127x0
    const {red} = x1;
    const r0 = red.sqrn(x1, 127);

    return r0;
  }

  pm2(x1) {
    // Exponent: p - 2
    // Bits: 127x1 1x0 96x1
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const x3 = red.sqrnmul(x2, 1, x1);
    const x6 = red.sqrnmul(x3, 3, x3);
    const x12 = red.sqrnmul(x6, 6, x6);
    const x24 = red.sqrnmul(x12, 12, x12);
    const x48 = red.sqrnmul(x24, 24, x24);
    const x96 = red.sqrnmul(x48, 48, x48);
    const x120 = red.sqrnmul(x96, 24, x24);
    const x126 = red.sqrnmul(x120, 6, x6);
    const x127 = red.sqrnmul(x126, 1, x1);
    const r0 = red.sqrn(x127, 1);
    const r1 = red.sqrnmul(r0, 96, x96);

    return r1;
  }
}

/**
 * P521
 */

class P521 extends Prime34 {
  constructor() {
    // 2^521 - 1 (= 3 mod 4)
    super('p521', '000001ff ffffffff ffffffff ffffffff'
                + 'ffffffff ffffffff ffffffff ffffffff'
                + 'ffffffff ffffffff ffffffff ffffffff'
                + 'ffffffff ffffffff ffffffff ffffffff'
                + 'ffffffff');
  }

  imulK(num) {
    // K = 0x01
    return num;
  }

  core(x1) {
    // Exponent: 2^519 - 1
    // Bits: 519x1
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const x3 = red.sqrnmul(x2, 1, x1);
    const x6 = red.sqrnmul(x3, 3, x3);
    const x7 = red.sqrnmul(x6, 1, x1);
    const x8 = red.sqrnmul(x7, 1, x1);
    const x16 = red.sqrnmul(x8, 8, x8);
    const x32 = red.sqrnmul(x16, 16, x16);
    const x64 = red.sqrnmul(x32, 32, x32);
    const x128 = red.sqrnmul(x64, 64, x64);
    const x256 = red.sqrnmul(x128, 128, x128);
    const x512 = red.sqrnmul(x256, 256, x256);
    const x519 = red.sqrnmul(x512, 7, x7);

    return x519;
  }

  pm3d4(x1) {
    // Exponent: 2^519 - 1
    // Bits: 519x1
    return this.core(x1);
  }

  pm2(x1) {
    // Exponent: p - 2
    // Bits: 519x1 1x0 1x1
    const {red} = x1;
    const r0 = this.core(x1);
    const r1 = red.sqrn(r0, 1);
    const r2 = red.sqrnmul(r1, 1, x1);

    return r2;
  }

  pp1d4(x1) {
    // Exponent: (p + 1) / 4
    // Bits: 1x1 519x0
    const {red} = x1;
    const r0 = red.sqrn(x1, 519);

    return r0;
  }
}

/**
 * K256
 */

class K256 extends Prime34 {
  constructor() {
    // 2^256 - 2^32 - 977 (= 3 mod 4)
    super('k256', 'ffffffff ffffffff ffffffff ffffffff'
                + 'ffffffff ffffffff fffffffe fffffc2f');
  }

  split(input, output) {
    // 256 = 9 * 26 + 22
    const mask = 0x3fffff;
    const len = Math.min(input.length, 9);

    output._alloc(len + 1);

    for (let i = 0; i < len; i++)
      output.words[i] = input.words[i];

    output.length = len;

    if (input.length <= 9) {
      output._strip();
      input.words[0] = 0;
      input.length = 1;
      return;
    }

    // Shift by 9 limbs.
    let prev = input.words[9];
    let i = 10;

    output.words[output.length++] = prev & mask;
    output._strip();

    for (; i < input.length; i++) {
      const next = input.words[i] | 0;

      input.words[i - 10] = ((next & mask) << 4) | (prev >>> 22);

      prev = next;
    }

    prev >>>= 22;

    input.words[i - 10] = prev;

    if (prev === 0 && input.length > 10)
      input.length -= 10;
    else
      input.length -= 9;

    input._strip(); // Unsure if we need this.
  }

  imulK(num) {
    // K = 0x1000003d1 = [0x40, 0x3d1]
    // K = 2^32 + 977
    num._expand(num.length + 2);

    // Bounded at: 0x40 * 0x3ffffff + 0x3d0 = 0x100000390
    let lo = 0;

    for (let i = 0; i < num.length; i++) {
      const w = num.words[i];

      lo += w * 0x3d1;

      num.words[i] = lo & 0x3ffffff;

      lo = w * 0x40 + Math.floor(lo / 0x4000000);
    }

    // Fast length reduction.
    if (num.words[num.length - 1] === 0) {
      num.length -= 1;
      if (num.words[num.length - 1] === 0)
        num.length -= 1;
    }

    // Note: we shouldn't need to strip here.
    return num;
  }

  core(x1, x2) {
    // Exponent: (p - 47) / 64
    // Bits: 223x1 1x0 22x1 4x0
    const {red} = x1;
    const x3 = red.sqrnmul(x2, 1, x1);
    const x6 = red.sqrnmul(x3, 3, x3);
    const x9 = red.sqrnmul(x6, 3, x3);
    const x11 = red.sqrnmul(x9, 2, x2);
    const x22 = red.sqrnmul(x11, 11, x11);
    const x44 = red.sqrnmul(x22, 22, x22);
    const x88 = red.sqrnmul(x44, 44, x44);
    const x176 = red.sqrnmul(x88, 88, x88);
    const x220 = red.sqrnmul(x176, 44, x44);
    const x223 = red.sqrnmul(x220, 3, x3);
    const r0 = red.sqrn(x223, 1);
    const r1 = red.sqrnmul(r0, 22, x22);
    const r2 = red.sqrn(r1, 4);

    return r2;
  }

  pm3d4(x1) {
    // Exponent: (p - 3) / 4
    // Bits: 223x1 1x0 22x1 4x0 1x1 1x0 2x1
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const r2 = this.core(x1, x2);
    const r3 = red.sqrnmul(r2, 1, x1);
    const r4 = red.sqrn(r3, 1);
    const r5 = red.sqrnmul(r4, 2, x2);

    return r5;
  }

  pm2(x1) {
    // Exponent: p - 2
    // Bits: 223x1 1x0 22x1 4x0 1x1 1x0 2x1 1x0 1x1
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const r2 = this.core(x1, x2);
    const r3 = red.sqrnmul(r2, 1, x1);
    const r4 = red.sqrn(r3, 1);
    const r5 = red.sqrnmul(r4, 2, x2);
    const r6 = red.sqrn(r5, 1);
    const r7 = red.sqrnmul(r6, 1, x1);

    return r7;
  }

  pp1d4(x1) {
    // Exponent: (p + 1) / 4
    // Bits: 223x1 1x0 22x1 4x0 2x1 2x0
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const r2 = this.core(x1, x2);
    const r3 = red.sqrnmul(r2, 2, x2);
    const r4 = red.sqrn(r3, 2);

    return r4;
  }
}

/**
 * P251
 */

class P251 extends Prime34 {
  constructor() {
    // 2^251 - 9
    super('p251', '07ffffff ffffffff ffffffff ffffffff'
                + 'ffffffff ffffffff ffffffff fffffff7');
  }

  imulK(num) {
    // K = 0x09
    if (num.isZero())
      return num;

    let carry = 0;

    for (let i = 0; i < num.length; i++) {
      const w = num.words[i] * 0x09 + carry;

      carry = w >>> 26;

      num.words[i] = w & 0x3ffffff;
    }

    if (carry !== 0) {
      num._alloc(num.length + 1);
      num.words[num.length++] = carry;
    }

    // Note: we shouldn't need to strip here.
    return num;
  }

  core(x1) {
    // Exponent: 2^247 - 1
    // Bits: 247x1
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const x3 = red.sqrnmul(x2, 1, x1);
    const x6 = red.sqrnmul(x3, 3, x3);
    const x12 = red.sqrnmul(x6, 6, x6);
    const x24 = red.sqrnmul(x12, 12, x12);
    const x48 = red.sqrnmul(x24, 24, x24);
    const x96 = red.sqrnmul(x48, 48, x48);
    const x192 = red.sqrnmul(x96, 96, x96);
    const x240 = red.sqrnmul(x192, 48, x48);
    const x246 = red.sqrnmul(x240, 6, x6);
    const x247 = red.sqrnmul(x246, 1, x1);

    return x247;
  }

  pm3d4(x1) {
    // Exponent: (p - 3) / 4
    // Bits: 247x1 1x0 1x1
    const {red} = x1;
    const r0 = this.core(x1);
    const r1 = red.sqrn(r0, 1);
    const r2 = red.sqrnmul(r1, 1, x1);

    return r2;
  }

  pm2(x1) {
    // Exponent: p - 2
    // Bits: 247x1 1x0 1x1 1x0 1x1
    const {red} = x1;
    const r0 = this.core(x1);
    const r1 = red.sqrn(r0, 1);
    const r2 = red.sqrnmul(r1, 1, x1);
    const r3 = red.sqrn(r2, 1);
    const r4 = red.sqrnmul(r3, 1, x1);

    return r4;
  }

  pp1d4(x1) {
    // Exponent: (p + 1) / 4
    // Bits: 248x1 1x0
    const {red} = x1;
    const r0 = this.core(x1);
    const r1 = red.sqrnmul(r0, 1, x1);
    const r2 = red.sqrn(r1, 1);

    return r2;
  }
}

/**
 * P25519
 */

class P25519 extends Prime58 {
  constructor() {
    // 2^255 - 19 (= 5 mod 8)
    super('p25519', '7fffffff ffffffff ffffffff ffffffff'
                  + 'ffffffff ffffffff ffffffff ffffffed',
                    '2b832480 4fc1df0b 2b4d0099 3dfbd7a7'
                  + '2f431806 ad2fe478 c4ee1b27 4a0ea0b0');
  }

  imulK(num) {
    // K = 0x13
    let carry = 0;

    for (let i = 0; i < num.length; i++) {
      const w = num.words[i] * 0x13 + carry;

      carry = w >>> 26;

      num.words[i] = w & 0x3ffffff;
    }

    if (carry !== 0) {
      num._alloc(num.length + 1);
      num.words[num.length++] = carry;
    }

    // Note: we shouldn't need to strip here.
    return num;
  }

  core(x1, x2) {
    // Exponent: 2^250 - 1
    // Bits: 250x1
    const {red} = x1;
    const x4 = red.sqrnmul(x2, 2, x2);
    const x5 = red.sqrnmul(x4, 1, x1);
    const x10 = red.sqrnmul(x5, 5, x5);
    const x20 = red.sqrnmul(x10, 10, x10);
    const x40 = red.sqrnmul(x20, 20, x20);
    const x50 = red.sqrnmul(x40, 10, x10);
    const x100 = red.sqrnmul(x50, 50, x50);
    const x200 = red.sqrnmul(x100, 100, x100);
    const x250 = red.sqrnmul(x200, 50, x50);

    return x250;
  }

  pm5d8(x1) {
    // Exponent: (p - 5) / 8
    // Bits: 250x1 1x0 1x1
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const r0 = this.core(x1, x2);
    const r1 = red.sqrn(r0, 1);
    const r2 = red.sqrnmul(r1, 1, x1);

    return r2;
  }

  pm2(x1) {
    // Exponent: p - 2
    // Bits: 250x1 1x0 1x1 1x0 2x1
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const r0 = this.core(x1, x2);
    const r1 = red.sqrn(r0, 1);
    const r2 = red.sqrnmul(r1, 1, x1);
    const r3 = red.sqrn(r2, 1);
    const r4 = red.sqrnmul(r3, 2, x2);

    return r4;
  }

  pp3d8(x1) {
    // Exponent: (p + 3) / 8
    // Bits: 251x1 1x0
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const r0 = this.core(x1, x2);
    const r1 = red.sqrnmul(r0, 1, x1);
    const r2 = red.sqrn(r1, 1);

    return r2;
  }
}

/**
 * P448
 */

class P448 extends Prime34 {
  constructor() {
    // 2^448 - 2^224 - 1 (= 3 mod 4)
    super('p448', 'ffffffff ffffffff ffffffff ffffffff'
                + 'ffffffff ffffffff fffffffe ffffffff'
                + 'ffffffff ffffffff ffffffff ffffffff'
                + 'ffffffff ffffffff');
  }

  imulK(num) {
    // K = 0x100000000000000000000000000000000000000000000000000000001
    // K = 2^224 + 1
    const one = this.one.inject(num);
    return num.iushln(224)._iadd(num, one);
  }

  core(x1, x2) {
    // Exponent: 2^222 - 1
    // Bits: 222x1
    const {red} = x1;
    const x3 = red.sqrnmul(x2, 1, x1);
    const x6 = red.sqrnmul(x3, 3, x3);
    const x9 = red.sqrnmul(x6, 3, x3);
    const x11 = red.sqrnmul(x9, 2, x2);
    const x22 = red.sqrnmul(x11, 11, x11);
    const x44 = red.sqrnmul(x22, 22, x22);
    const x88 = red.sqrnmul(x44, 44, x44);
    const x176 = red.sqrnmul(x88, 88, x88);
    const x220 = red.sqrnmul(x176, 44, x44);
    const x222 = red.sqrnmul(x220, 2, x2);

    return x222;
  }

  pm3d4(x1) {
    // Exponent: (p - 3) / 4
    // Bits: 223x1 1x0 222x1
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const x222 = this.core(x1, x2);
    const r0 = red.sqrnmul(x222, 1, x1);
    const r1 = red.sqrn(r0, 1);
    const r2 = red.sqrnmul(r1, 222, x222);

    return r2;
  }

  pm2(x1) {
    // Exponent: p - 2
    // Bits: 223x1 1x0 222x1 1x0 1x1
    const {red} = x1;
    const r0 = this.pm3d4(x1);
    const r1 = red.sqrn(r0, 1);
    const r2 = red.sqrnmul(r1, 1, x1);

    return r2;
  }

  pp1d4(x1) {
    // Exponent: (p + 1) / 4
    // Bits: 224x1 222x0
    const {red} = x1;
    const x2 = red.sqrnmul(x1, 1, x1);
    const r0 = this.core(x1, x2);
    const r1 = red.sqrnmul(r0, 2, x2);
    const r2 = red.sqrn(r1, 222);

    return r2;
  }
}

/**
 * Reduction Engine
 */

class Red {
  constructor(m) {
    let prime = null;

    if (typeof m === 'string') {
      prime = BN._prime(m);
      m = prime.p;
    }

    enforce(BN.isBN(m), 'm', 'bignum');
    nonred(!m.red, 'reduction');
    range(m.sign() > 0, 'reduction');

    this.m = m;
    this.prime = prime;
    this.mb = null;
    this.sm1 = null;
  }

  _verify1(a) {
    range(a.negative === 0, 'red');
    red(a.red != null, 'red');
  }

  _verify2(a, b) {
    range((a.negative | b.negative) === 0, 'red');
    red(a.red != null && a.red === b.red, 'red');
  }

  get mont() {
    return false;
  }

  precompute() {
    // Precompute `sqrt(-1)` for primes congruent to 5 mod 8.
    if (this.sm1 === null && this.m.andln(7) === 5) {
      if (this.prime) {
        this.sm1 = this.prime.sm1.clone()._forceRed(this);
      } else {
        const x = new BN(2).toRed(this);
        const e = this.m.subn(1).iushrn(2);

        // sqrt(-1) = 2^((p - 1) / 4) mod p
        this.sm1 = this.pow(x, e);
      }
    }

    return this;
  }

  convertTo(num) {
    const res = num.mod(this.m);
    res.red = this;
    return res;
  }

  convertFrom(num) {
    const res = num.clone();
    res.red = null;
    return res;
  }

  intTo(a) {
    return a;
  }

  intFrom(a) {
    return a;
  }

  imod(a) {
    if (this.prime)
      return this.prime.ireduce(a)._forceRed(this);

    return a.imod(this.m)._forceRed(this);
  }

  iadd(a, b) {
    this._verify2(a, b);

    a._iadd(a, b);

    if (a.ucmp(this.m) >= 0)
      a._isub(a, this.m);

    return a;
  }

  add(a, b) {
    if (a.length < b.length)
      return this.iadd(b.clone(), a);

    return this.iadd(a.clone(), b);
  }

  iaddn(a, num) {
    this._verify1(a);

    if (num < 0)
      return this.isubn(a, -num);

    if (this.m.length === 1)
      num %= this.m.words[0];

    a._iaddn(num);

    if (a.ucmp(this.m) >= 0)
      a._isub(a, this.m);

    return a;
  }

  addn(a, num) {
    return this.iaddn(a.clone(), num);
  }

  isub(a, b) {
    this._verify2(a, b);

    //  0: a - a mod m == 0
    // -1: a - b mod m == m - (b - a)
    // +1: a - b mod m == a - b
    const cmp = a.ucmp(b);

    if (cmp === 0) {
      a.words[0] = 0;
      a.length = 1;
      return a;
    }

    if (cmp < 0) {
      a._isub(b, a);
      a._isub(this.m, a);
    } else {
      a._isub(a, b);
    }

    return a;
  }

  sub(a, b) {
    return this.isub(a.clone(), b);
  }

  isubn(a, num) {
    this._verify1(a);

    if (num < 0)
      return this.iaddn(a, -num);

    if (this.m.length === 1)
      num %= this.m.words[0];

    //  <: a - b mod m == m - (b - a)
    // >=: a - b mod m == a - b
    if (a.length === 1 && a.words[0] < num) {
      a.words[0] = num - a.words[0];
      a._isub(this.m, a);
    } else {
      a._isubn(num);
    }

    return a;
  }

  subn(a, num) {
    return this.isubn(a.clone(), num);
  }

  imul(a, b) {
    this._verify2(a, b);
    return this.imod(a.imul(b));
  }

  mul(a, b) {
    this._verify2(a, b);
    return this.imod(a.mul(b));
  }

  imuln(a, num) {
    this._verify1(a);

    if (a.isZero())
      return a;

    if (num === 0) {
      a.words[0] = 0;
      a.length = 1;
      return a;
    }

    const neg = num < 0;

    if (neg)
      num = -num;

    if (this.m.length === 1)
      num %= this.m.words[0];

    a.imuln(num);

    if (num <= 16) {
      // Quick reduction.
      while (a.ucmp(this.m) >= 0)
        a._isub(a, this.m);
    } else {
      this.imod(a);
    }

    if (neg)
      this.ineg(a);

    return a;
  }

  muln(a, num) {
    return this.imuln(a.clone(), num);
  }

  idiv(a, b) {
    return this.div(a, b)._move(a);
  }

  div(a, b) {
    return this.mul(a, this.invert(b));
  }

  idivn(a, num) {
    return this.divn(a, num)._move(a);
  }

  divn(a, num) {
    return this.div(a, this.convertTo(new BN(num)));
  }

  ipow(a, num) {
    return this.pow(a, num)._move(a);
  }

  pow(a, num) {
    this._verify1(a);

    if (num.isNeg())
      a = this.invert(a);

    // Small exponent.
    if (num.length === 1)
      return this.pown(a, num.words[0]);

    // Call out to BigInt.
    if (HAS_BIGINT && !this.prime)
      return this.powInt(a, num);

    // Otherwise, a BN implementation.
    return this.powNum(a, num);
  }

  powNum(a, num) {
    // Sliding window (odd multiples only).
    const one = new BN(1).toRed(this);
    const wnd = new Array(WND_SIZE);
    const a2 = this.sqr(a);

    wnd[0] = a;

    for (let i = 1; i < WND_SIZE; i++)
      wnd[i] = this.mul(wnd[i - 1], a2);

    let i = num.bitLength();
    let r = one;

    while (i >= WND_WIDTH) {
      let width = WND_WIDTH;
      let bits = num.bits(i - width, width);

      if (bits < WND_SIZE) {
        r = this.sqr(r);
        i -= 1;
        continue;
      }

      while ((bits & 1) === 0) {
        width -= 1;
        bits >>= 1;
      }

      if (r === one) {
        r = wnd[bits >> 1].clone();
      } else {
        r = this.sqrn(r, width);
        r = this.mul(r, wnd[bits >> 1]);
      }

      i -= width;
    }

    if (i > 0) {
      const bits = num.bits(0, i);

      while (i--) {
        r = this.sqr(r);

        if ((bits >> i) & 1)
          r = this.mul(r, a);
      }
    }

    return r;
  }

  powInt(a, num) {
    if (this.mb === null)
      this.mb = this.m.toBigInt();

    const x = this.intFrom(a.toBigInt());
    const y = powInt(x, num, this.mb);
    const z = this.intTo(y);

    return BN.fromBigInt(z)._forceRed(this);
  }

  sqrn(a, n) {
    while (n--)
      a = this.sqr(a);

    return a;
  }

  sqrnmul(a, n, b) {
    return this.mul(this.sqrn(a, n), b);
  }

  ipown(a, num) {
    return this.pown(a, num)._move(a);
  }

  pown(a, num) {
    this._verify1(a);

    if (num < 0) {
      a = this.invert(a);
      num = -num;
    }

    if (num === 0)
      return new BN(1).toRed(this);

    if (num === 1)
      return a.clone();

    const bits = countBits(num);

    let r = a;

    for (let i = bits - 2; i >= 0; i--) {
      r = this.sqr(r);

      if ((num >> i) & 1)
        r = this.mul(r, a);
    }

    return r;
  }

  isqr(a) {
    return this.imul(a, a);
  }

  sqr(a) {
    return this.mul(a, a);
  }

  isqrt(x) {
    return this.sqrt(x)._move(x);
  }

  sqrt(x) {
    this._verify1(x);

    // Optimized square root chain.
    if (this.prime)
      return this.prime.sqrt(x);

    // Fast case (p = 3 mod 4).
    if (this.m.andln(3) === 3)
      return this.sqrt3mod4(x);

    // Fast case (p = 5 mod 8).
    if (this.m.andln(7) === 5) {
      if (this.sm1 != null)
        return this.sqrt5mod8sm1(x);
      return this.sqrt5mod8(x);
    }

    // Slow case (Tonelli-Shanks).
    return this.sqrt0(x);
  }

  sqrt3mod4(x) {
    const e = this.m.addn(1).iushrn(2); // (p + 1) / 4
    const b = this.pow(x, e);

    if (!this.sqr(b).eq(x))
      throw new SquareRootError(b);

    return b;
  }

  sqrt5mod8(x) {
    // Atkin's Algorithm.
    const one = new BN(1).toRed(this);
    const e = this.m.ushrn(3); // (p - 5) / 8
    const x2 = this.add(x, x);
    const alpha = this.pow(x2, e);
    const beta = this.mul(x2, this.sqr(alpha));
    const b = this.mul(this.mul(alpha, x), this.isub(beta, one));

    if (!this.sqr(b).eq(x))
      throw new SquareRootError(b);

    return b;
  }

  sqrt5mod8sm1(x) {
    const e = this.m.addn(3).iushrn(3); // (p + 3) / 8
    const b = this.pow(x, e);

    if (this.sqr(b).eq(x))
      return b;

    const c = this.mul(b, this.sm1);

    if (this.sqr(c).eq(x))
      return c;

    throw new SquareRootError(b);
  }

  sqrt0(x) {
    if (this.m.cmpn(1) === 0 || !this.m.isOdd())
      throw new Error('Invalid prime.');

    switch (this.jacobi(x)) {
      case -1:
        throw new SquareRootError(x);
      case 0:
        return x.clone();
      case 1:
        break;
    }

    const one = new BN(1).toRed(this);
    const s = this.m.subn(1);
    const e = s._makeOdd();
    const n = new BN(2).toRed(this);

    while (this.jacobi(n) !== -1)
      this.iadd(n, one);

    let g = this.pow(n, s);
    let b = this.pow(x, s);
    let y = this.pow(x, s.iaddn(1).iushrn(1));
    let k = e;

    for (;;) {
      let t = b;
      let m = 0;

      while (!t.eq(one) && m < k) {
        t = this.sqr(t);
        m += 1;
      }

      if (m === 0)
        break;

      assert(m < k);

      t = this.sqrn(g, k - m - 1);
      g = this.sqr(t);
      y = this.mul(y, t);
      b = this.mul(b, g);
      k = m;
    }

    return y;
  }

  idivsqrt(u, v) {
    return this.divsqrt(u, v)._move(u);
  }

  divsqrt(u, v) {
    this._verify2(u, v);

    // u = 0, v = 0
    if (u.isZero() && v.isZero())
      throw new SquareRootError(v);

    // Optimized inverse square root chain.
    if (this.prime)
      return this.prime.divsqrt(u, v);

    // p = 3 mod 4
    if (this.m.andln(3) === 3)
      return this.divsqrt3mod4(u, v);

    // p = 5 mod 8
    if (this.sm1 != null && this.m.andln(7) === 5)
      return this.divsqrt5mod8(u, v);

    // v = 0
    if (v.isZero())
      throw new SquareRootError(v);

    return this.sqrt(this.div(u, v));
  }

  divsqrt3mod4(u, v) {
    // x = u^3 * v * (u^5 * v^3)^((p - 3) / 4) mod p
    const e = this.m.subn(3).iushrn(2);
    const u2 = this.sqr(u);
    const u3 = this.mul(u2, u);
    const u5 = this.mul(u3, u2);
    const v3 = this.mul(this.sqr(v), v);
    const p = this.pow(this.mul(u5, v3), e);
    const x = this.mul(this.mul(u3, v), p);
    const c = this.mul(v, this.sqr(x));

    if (c.eq(u))
      return x;

    throw new SquareRootError(x);
  }

  divsqrt5mod8(u, v) {
    // x = u * v^3 * (u * v^7)^((p - 5) / 8) mod p
    const e = this.m.subn(5).iushrn(3);
    const v3 = this.mul(this.sqr(v), v);
    const v7 = this.mul(this.sqr(v3), v);
    const p = this.pow(this.mul(u, v7), e);
    const x = this.mul(this.mul(u, v3), p);
    const c = this.mul(v, this.sqr(x));

    if (c.eq(u))
      return x;

    const mc = this.ineg(c);

    if (mc.eq(u))
      return this.mul(x, this.sm1);

    if (mc.eq(this.mul(u, this.sm1)))
      throw new SquareRootError(this.mul(x, this.sm1));

    throw new SquareRootError(x);
  }

  isSquare(a) {
    if (this.m.isOdd())
      return this.jacobi(a) >= 0;

    return this.kronecker(a) >= 0;
  }

  ishl(a, num) {
    this._verify1(a);
    return this.imod(a.iushl(num));
  }

  shl(a, num) {
    return this.ishl(a.clone(), num);
  }

  ishln(a, num) {
    this._verify1(a);

    a.iushln(num);

    if (num <= 4) {
      // Quick reduction.
      while (a.ucmp(this.m) >= 0)
        a._isub(a, this.m);
    } else {
      this.imod(a);
    }

    return a;
  }

  shln(a, num) {
    return this.ishln(a.clone(), num);
  }

  ineg(a) {
    this._verify1(a);

    if (!a.isZero())
      a._isub(this.m, a);

    return a;
  }

  neg(a) {
    return this.ineg(a.clone());
  }

  eq(a, b) {
    this._verify2(a, b);
    return a.ucmp(b) === 0;
  }

  eqn(a, num) {
    this._verify1(a);

    if (this.m.length === 1) {
      num %= this.m.words[0];

      if (num < 0)
        num += this.m.words[0];

      return a.ucmpn(num) === 0;
    }

    if (num < 0) {
      this.m._isubn(-num);

      const cmp = a.ucmp(this.m);

      this.m._iaddn(-num);

      return cmp === 0;
    }

    return a.ucmpn(num) === 0;
  }

  isHigh(a) {
    return !this.isLow(a);
  }

  isLow(a) {
    this._verify1(a);
    return a.ucmp(this.m.ushrn(1)) <= 0;
  }

  isOdd(a) {
    this._verify1(a);
    return a.isOdd();
  }

  isEven(a) {
    this._verify1(a);
    return a.isEven();
  }

  legendre(num) {
    this._verify1(num);

    if (this.m.isEven())
      throw new Error('legendre: `num` must be odd.');

    // Euler's criterion.
    const e = this.m.subn(1).iushrn(1); // (p - 1) / 2
    const symbol = this.pow(num, e);

    if (symbol.isZero())
      return 0;

    const one = new BN(1).toRed(this);

    if (symbol.eq(one))
      return 1;

    if (symbol.eq(this.ineg(one)))
      return -1;

    throw new Error('Invalid prime.');
  }

  jacobi(a) {
    this._verify1(a);
    return a.jacobi(this.m);
  }

  kronecker(a) {
    this._verify1(a);
    return a.kronecker(this.m);
  }

  iinvert(a) {
    return this.invert(a)._move(a);
  }

  invert(a) {
    this._verify1(a);
    return a.invert(this.m)._forceRed(this);
  }

  ifermat(a) {
    return this.fermat(a)._move(a);
  }

  fermat(a) {
    this._verify1(a);

    if (a.isZero() || this.m.cmpn(1) === 0)
      throw new RangeError('Not invertible.');

    // Optimized inversion chain.
    if (this.prime)
      return this.prime.fermat(a);

    // Invert using fermat's little theorem.
    return this.pow(a, this.m.subn(2));
  }

  invertAll(elems) {
    // Montgomery's trick.
    enforce(Array.isArray(elems), 'elems', 'array');

    for (const elem of elems) {
      enforce(BN.isBN(elem), 'elem', 'bignum');

      this._verify1(elem);
    }

    if (this.m.cmpn(1) === 0 || this.m.isEven())
      throw new RangeError('Not invertible.');

    const len = elems.length;
    const invs = new Array(len);

    if (len === 0)
      return invs;

    let acc = new BN(1).toRed(this);

    for (let i = 0; i < len; i++) {
      if (elems[i].isZero()) {
        invs[i] = elems[i].clone();
        continue;
      }

      invs[i] = acc;
      acc = this.mul(acc, elems[i]);
    }

    acc = this.invert(acc);

    for (let i = len - 1; i >= 0; i--) {
      if (elems[i].isZero())
        continue;

      invs[i] = this.mul(acc, invs[i]);
      acc = this.mul(acc, elems[i]);
    }

    return invs;
  }

  [custom]() {
    if (this.prime)
      return `<Red: ${this.prime.name}>`;

    return `<Red: ${this.m.toString(10)}>`;
  }
}

/**
 * Barrett Engine
 */

class Barrett extends Red {
  constructor(m) {
    super(m);

    this.prime = null;
    this.n = this.m.bitLength();

    if ((this.n % 26) !== 0)
      this.n += 26 - (this.n % 26);

    this.k = this.n * 2;
    this.w = this.k / 26;
    this.b = BN.shift(1, this.k).div(this.m);
  }

  convertTo(num) {
    if (num.length > this.w)
      return super.convertTo(num);

    return this.imod(num.clone());
  }

  _shift(q) {
    let i = 0;
    let j = this.w;

    while (j < q.length)
      q.words[i++] = q.words[j++];

    if (i === 0)
      q.words[i++] = 0;

    q.length = i;
  }

  imod(a) {
    const neg = a.negative;

    assert(a.length <= this.w);

    a.negative = 0;

    const q = a.mul(this.b);

    // Shift right by `k` bits.
    this._shift(q);

    a._isub(a, q.mul(this.m));

    if (a.ucmp(this.m) >= 0)
      a._isub(a, this.m);

    if (neg && !a.isZero())
      a._isub(this.m, a);

    a.red = this;

    return a;
  }
}

/**
 * Montgomery Engine
 */

class Mont extends Red {
  constructor(m) {
    super(m);

    // Note that:
    //
    //   mi = (-m^-1 mod (2^(n * 2))) mod r
    //
    // and:
    //
    //   mi = (((2^n)^-1 mod m) * r^-1 - 1) / m
    //
    // are equivalent.
    this.prime = null;
    this.n = this.m.length * 26;
    this.r = BN.shift(1, this.n);
    this.r2 = BN.shift(1, this.n * 2).imod(this.m);
    this.ri = this.r.invert(this.m);
    this.mi = this.r.mul(this.ri).isubn(1).div(this.m);
    this.rib = null;
  }

  get mont() {
    return true;
  }

  convertTo(num) {
    if (num.isNeg() || num.ucmp(this.m) >= 0)
      return this.imod(num.ushln(this.n));

    // Equivalent to: (num * 2^n) mod m
    return this.mul(num, this.r2);
  }

  convertFrom(num) {
    // Equivalent to: num * r^-1 mod m
    const r = this.mul(num, new BN(1));
    r.red = null;
    return r;
  }

  intTo(a) {
    return (a << BigInt(this.n)) % this.mb;
  }

  intFrom(a) {
    if (this.rib === null)
      this.rib = this.ri.toBigInt();

    return (a * this.rib) % this.mb;
  }

  iaddn(a, num) {
    return this.iadd(a, this.convertTo(new BN(num)));
  }

  isubn(a, num) {
    return this.isub(a, this.convertTo(new BN(num)));
  }

  imul(a, b) {
    return this.mul(a, b)._move(a);
  }

  mul(a, b) {
    if (a.isZero() || b.isZero())
      return new BN(0)._forceRed(this);

    const t = a.mul(b);
    const c = t.umaskn(this.n).mul(this.mi).iumaskn(this.n);
    const u = t.iadd(c.mul(this.m)).iushrn(this.n);

    if (u.ucmp(this.m) >= 0)
      u._isub(u, this.m);

    return u._forceRed(this);
  }

  imuln(a, num) {
    this._verify1(a);

    if (a.isZero())
      return a;

    if (num === 0) {
      a.words[0] = 0;
      a.length = 1;
      return a;
    }

    const neg = num < 0;

    if (neg)
      num = -num;

    if (this.m.length === 1)
      num %= this.m.words[0];

    const bits = countBits(num);

    // Potentially compute with additions.
    // This avoids an expensive division.
    if (bits > 5) {
      // Slow case (num > 31).
      this.imul(a, this.convertTo(new BN(num)));
    } else if ((num & (num - 1)) === 0) {
      // Optimize for powers of two.
      for (let i = 0; i < bits - 1; i++)
        this.iadd(a, a);
    } else {
      // Multiply left to right.
      const c = a.clone();

      for (let i = bits - 2; i >= 0; i--) {
        this.iadd(a, a);

        if ((num >> i) & 1)
          this.iadd(a, c);
      }
    }

    if (neg)
      this.ineg(a);

    return a;
  }

  eqn(a, num) {
    this._verify1(a);

    if (num === 0)
      return a.isZero();

    return a.ucmp(this.convertTo(new BN(num))) === 0;
  }

  isLow(a) {
    this._verify1(a);
    return this.convertFrom(a).ucmp(this.m.ushrn(1)) <= 0;
  }

  isOdd(a) {
    this._verify1(a);
    return this.convertFrom(a).isOdd();
  }

  isEven(a) {
    this._verify1(a);
    return this.convertFrom(a).isEven();
  }

  invert(a) {
    this._verify1(a);

    // (AR)^-1 * R^2 = (A^-1 * R^-1) * R^2 = A^-1 * R
    return this.imod(a.invert(this.m).mul(this.r2));
  }
}

/*
 * Helpers
 */

function makeError(Error, msg, start) {
  const err = new Error(msg);

  if (Error.captureStackTrace)
    Error.captureStackTrace(err, start);

  return err;
}

function assert(value, message) {
  if (!value) {
    const msg = message || 'Assertion failed.';
    throw makeError(Error, msg, assert);
  }
}

function enforce(value, name, type) {
  if (!value) {
    const msg = `"${name}" must be a(n) ${type}.`;
    throw makeError(TypeError, msg, enforce);
  }
}

function range(value, name) {
  if (!value) {
    const msg = `"${name}" only works with positive numbers.`;
    throw makeError(RangeError, msg, range);
  }
}

function red(value, name) {
  if (!value) {
    const msg = `"${name}" only works with red numbers.`;
    throw makeError(TypeError, msg, red);
  }
}

function nonred(value, name) {
  if (!value) {
    const msg = `"${name}" only works with normal numbers.`;
    throw makeError(TypeError, msg, nonred);
  }
}

function nonzero(value) {
  if (!value) {
    const msg = 'Cannot divide by zero.';
    throw makeError(RangeError, msg, nonzero);
  }
}

class SquareRootError extends Error {
  constructor(result) {
    super();

    this.name = 'SquareRootError';
    this.message = 'X is not a square mod P.';
    this.result = result.fromRed();

    if (Error.captureStackTrace)
      Error.captureStackTrace(this, SquareRootError);
  }
}

function isInteger(num) {
  return Number.isSafeInteger(num);
}

function isSMI(num) {
  return isInteger(num)
      && num >= -0x3ffffff
      && num <= 0x3ffffff;
}

function allocate(ArrayType, size) {
  if (ArrayType.allocUnsafeSlow)
    return ArrayType.allocUnsafeSlow(size);

  return new ArrayType(size);
}

function getBase(base) {
  if (base == null)
    return 10;

  if (typeof base === 'number')
    return base;

  switch (base) {
    case 'bin':
      return 2;
    case 'oct':
      return 8;
    case 'dec':
      return 10;
    case 'hex':
      return 16;
  }

  return 0;
}

/*
 * Internal
 */

function countBits(w) {
  if (Math.clz32)
    return 32 - Math.clz32(w);

  let t = w;
  let r = 0;

  if (t >= 0x1000) {
    r += 13;
    t >>>= 13;
  }

  if (t >= 0x40) {
    r += 7;
    t >>>= 7;
  }

  if (t >= 0x8) {
    r += 4;
    t >>>= 4;
  }

  if (t >= 0x02) {
    r += 2;
    t >>>= 2;
  }

  return r + t;
}

function zeroBits(w) {
  // Shortcut.
  if (w === 0)
    return 26;

  let t = w;
  let r = 0;

  if ((t & 0x1fff) === 0) {
    r += 13;
    t >>>= 13;
  }

  if ((t & 0x7f) === 0) {
    r += 7;
    t >>>= 7;
  }

  if ((t & 0xf) === 0) {
    r += 4;
    t >>>= 4;
  }

  if ((t & 0x3) === 0) {
    r += 2;
    t >>>= 2;
  }

  if ((t & 0x1) === 0)
    r += 1;

  return r;
}

function parseHex(str, start, end) {
  const len = Math.min(str.length, end);

  let r = 0;
  let z = 0;

  for (let i = start; i < len; i++) {
    const c = str.charCodeAt(i) - 48;

    r <<= 4;

    let b;

    if (c >= 49 && c <= 54) {
      // 'a' - 'f'
      b = c - 49 + 0xa;
    } else if (c >= 17 && c <= 22) {
      // 'A' - 'F'
      b = c - 17 + 0xa;
    } else {
      // '0' - '9'
      b = c;
    }

    r |= b;
    z |= b;
  }

  if (z & ~15)
    throw new Error('Invalid string.');

  return r;
}

function parseBase(str, start, end, mul) {
  const len = Math.min(str.length, end);

  let r = 0;

  for (let i = start; i < len; i++) {
    const c = str.charCodeAt(i) - 48;

    r *= mul;

    let b;

    if (c >= 49) {
      // 'a'
      b = c - 49 + 0xa;
    } else if (c >= 17) {
      // 'A'
      b = c - 17 + 0xa;
    } else {
      // '0' - '9'
      b = c;
    }

    if (c < 0 || c > 207 || b >= mul)
      throw new Error('Invalid string.');

    r += b;
  }

  return r;
}

/*
 * Exponentiation (bigint)
 */

function powInt(x, e, m) {
  // Sliding window (odd multiples only).
  const one = BigInt(1);
  const wnd = new Array(WND_SIZE);
  const x2 = (x * x) % m;

  wnd[0] = x;

  for (let i = 1; i < WND_SIZE; i++)
    wnd[i] = (wnd[i - 1] * x2) % m;

  let i = e.bitLength();
  let r = one;

  while (i >= WND_WIDTH) {
    let width = WND_WIDTH;
    let bits = e.bits(i - width, width);

    if (bits < WND_SIZE) {
      r = (r * r) % m;
      i -= 1;
      continue;
    }

    while ((bits & 1) === 0) {
      width -= 1;
      bits >>= 1;
    }

    if (r === one) {
      r = wnd[bits >> 1];
    } else {
      r = sqrn(r, width, m);
      r = (r * wnd[bits >> 1]) % m;
    }

    i -= width;
  }

  if (i > 0) {
    const bits = e.bits(0, i);

    while (i--) {
      r = (r * r) % m;

      if ((bits >> i) & 1)
        r = (r * x) % m;
    }
  }

  return r;
}

function sqrn(x, n, m) {
  for (let i = 0; i < n; i++)
    x = (x * x) % m;
  return x;
}

/*
 * Multiplication
 */

function smallMulTo(self, num, out) {
  const len = self.length + num.length;

  out.negative = self.negative ^ num.negative;
  out._alloc(len);
  out.length = len;

  // Peel one iteration (compiler can't
  // do it, because of code complexity).
  const a = self.words[0];
  const b = num.words[0];
  const r = a * b;
  const lo = r & 0x3ffffff;

  let carry = (r / 0x4000000) | 0;
  let k = 1;

  out.words[0] = lo;

  for (; k < out.length - 1; k++) {
    // Sum all words with the same
    // `i + j = k` and accumulate
    // `ncarry`, note that ncarry
    // could be >= 0x3ffffff.
    let ncarry = carry >>> 26;
    let rword = carry & 0x3ffffff;

    const min = Math.max(0, k - self.length + 1);
    const max = Math.min(k, num.length - 1);

    for (let j = min; j <= max; j++) {
      const i = k - j;
      const a = self.words[i];
      const b = num.words[j];
      const r = a * b + rword;

      ncarry += (r / 0x4000000) | 0;
      rword = r & 0x3ffffff;
    }

    out.words[k] = rword | 0;
    carry = ncarry | 0;
  }

  if (carry !== 0)
    out.words[k] = carry | 0;
  else
    out.length -= 1;

  return out._strip();
}

function bigMulTo(self, num, out) {
  const len = self.length + num.length;

  out.negative = self.negative ^ num.negative;
  out._alloc(len);
  out.length = len;

  let carry = 0;
  let hncarry = 0;
  let k = 0;

  for (; k < out.length - 1; k++) {
    // Sum all words with the same
    // `i + j = k` and accumulate
    // `ncarry`, note that ncarry
    // could be >= 0x3ffffff.
    let ncarry = hncarry;

    hncarry = 0;

    let rword = carry & 0x3ffffff;

    const min = Math.max(0, k - self.length + 1);
    const max = Math.min(k, num.length - 1);

    for (let j = min; j <= max; j++) {
      const i = k - j;
      const a = self.words[i];
      const b = num.words[j];
      const r = a * b;

      let lo = r & 0x3ffffff;

      ncarry = (ncarry + ((r / 0x4000000) | 0)) | 0;
      lo = (lo + rword) | 0;
      rword = lo & 0x3ffffff;
      ncarry = (ncarry + (lo >>> 26)) | 0;

      hncarry += ncarry >>> 26;
      ncarry &= 0x3ffffff;
    }

    out.words[k] = rword;
    carry = ncarry;
    ncarry = hncarry;
  }

  if (carry !== 0)
    out.words[k] = carry;
  else
    out.length -= 1;

  return out._strip();
}

function jumboMulTo(x, y, out) {
  // v8 has a 2147483519 bit max (~256mb).
  if (!HAS_BIGINT || x.length + y.length > 82595519)
    return bigMulTo(x, y, out);

  const zero = BigInt(0);
  const mask = BigInt(0x3ffffff);
  const shift = BigInt(26);

  let z = x.toBigInt() * y.toBigInt();

  const neg = (z < zero) | 0;

  if (neg)
    z = -z;

  let i = 0;

  while (z > zero) {
    out.words[i++] = Number(z & mask);
    z >>= shift;
  }

  if (i === 0)
    out.words[i++] = 0;

  out.length = i;
  out.negative = neg;

  return out;
}

function comb10MulTo(self, num, out) {
  const a = self.words;
  const b = num.words;
  const o = out.words;
  const a0 = a[0] | 0;
  const al0 = a0 & 0x1fff;
  const ah0 = a0 >>> 13;
  const a1 = a[1] | 0;
  const al1 = a1 & 0x1fff;
  const ah1 = a1 >>> 13;
  const a2 = a[2] | 0;
  const al2 = a2 & 0x1fff;
  const ah2 = a2 >>> 13;
  const a3 = a[3] | 0;
  const al3 = a3 & 0x1fff;
  const ah3 = a3 >>> 13;
  const a4 = a[4] | 0;
  const al4 = a4 & 0x1fff;
  const ah4 = a4 >>> 13;
  const a5 = a[5] | 0;
  const al5 = a5 & 0x1fff;
  const ah5 = a5 >>> 13;
  const a6 = a[6] | 0;
  const al6 = a6 & 0x1fff;
  const ah6 = a6 >>> 13;
  const a7 = a[7] | 0;
  const al7 = a7 & 0x1fff;
  const ah7 = a7 >>> 13;
  const a8 = a[8] | 0;
  const al8 = a8 & 0x1fff;
  const ah8 = a8 >>> 13;
  const a9 = a[9] | 0;
  const al9 = a9 & 0x1fff;
  const ah9 = a9 >>> 13;
  const b0 = b[0] | 0;
  const bl0 = b0 & 0x1fff;
  const bh0 = b0 >>> 13;
  const b1 = b[1] | 0;
  const bl1 = b1 & 0x1fff;
  const bh1 = b1 >>> 13;
  const b2 = b[2] | 0;
  const bl2 = b2 & 0x1fff;
  const bh2 = b2 >>> 13;
  const b3 = b[3] | 0;
  const bl3 = b3 & 0x1fff;
  const bh3 = b3 >>> 13;
  const b4 = b[4] | 0;
  const bl4 = b4 & 0x1fff;
  const bh4 = b4 >>> 13;
  const b5 = b[5] | 0;
  const bl5 = b5 & 0x1fff;
  const bh5 = b5 >>> 13;
  const b6 = b[6] | 0;
  const bl6 = b6 & 0x1fff;
  const bh6 = b6 >>> 13;
  const b7 = b[7] | 0;
  const bl7 = b7 & 0x1fff;
  const bh7 = b7 >>> 13;
  const b8 = b[8] | 0;
  const bl8 = b8 & 0x1fff;
  const bh8 = b8 >>> 13;
  const b9 = b[9] | 0;
  const bl9 = b9 & 0x1fff;
  const bh9 = b9 >>> 13;

  let c = 0;
  let lo, mid, hi;

  out.negative = self.negative ^ num.negative;
  out._alloc(20);
  out.length = 19;

  /* k = 0 */
  lo = Math.imul(al0, bl0);
  mid = Math.imul(al0, bh0);
  mid = (mid + Math.imul(ah0, bl0)) | 0;
  hi = Math.imul(ah0, bh0);

  let w0 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w0 >>> 26)) | 0;
  w0 &= 0x3ffffff;

  /* k = 1 */
  lo = Math.imul(al1, bl0);
  mid = Math.imul(al1, bh0);
  mid = (mid + Math.imul(ah1, bl0)) | 0;
  hi = Math.imul(ah1, bh0);
  lo = (lo + Math.imul(al0, bl1)) | 0;
  mid = (mid + Math.imul(al0, bh1)) | 0;
  mid = (mid + Math.imul(ah0, bl1)) | 0;
  hi = (hi + Math.imul(ah0, bh1)) | 0;

  let w1 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w1 >>> 26)) | 0;
  w1 &= 0x3ffffff;

  /* k = 2 */
  lo = Math.imul(al2, bl0);
  mid = Math.imul(al2, bh0);
  mid = (mid + Math.imul(ah2, bl0)) | 0;
  hi = Math.imul(ah2, bh0);
  lo = (lo + Math.imul(al1, bl1)) | 0;
  mid = (mid + Math.imul(al1, bh1)) | 0;
  mid = (mid + Math.imul(ah1, bl1)) | 0;
  hi = (hi + Math.imul(ah1, bh1)) | 0;
  lo = (lo + Math.imul(al0, bl2)) | 0;
  mid = (mid + Math.imul(al0, bh2)) | 0;
  mid = (mid + Math.imul(ah0, bl2)) | 0;
  hi = (hi + Math.imul(ah0, bh2)) | 0;

  let w2 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w2 >>> 26)) | 0;
  w2 &= 0x3ffffff;

  /* k = 3 */
  lo = Math.imul(al3, bl0);
  mid = Math.imul(al3, bh0);
  mid = (mid + Math.imul(ah3, bl0)) | 0;
  hi = Math.imul(ah3, bh0);
  lo = (lo + Math.imul(al2, bl1)) | 0;
  mid = (mid + Math.imul(al2, bh1)) | 0;
  mid = (mid + Math.imul(ah2, bl1)) | 0;
  hi = (hi + Math.imul(ah2, bh1)) | 0;
  lo = (lo + Math.imul(al1, bl2)) | 0;
  mid = (mid + Math.imul(al1, bh2)) | 0;
  mid = (mid + Math.imul(ah1, bl2)) | 0;
  hi = (hi + Math.imul(ah1, bh2)) | 0;
  lo = (lo + Math.imul(al0, bl3)) | 0;
  mid = (mid + Math.imul(al0, bh3)) | 0;
  mid = (mid + Math.imul(ah0, bl3)) | 0;
  hi = (hi + Math.imul(ah0, bh3)) | 0;

  let w3 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w3 >>> 26)) | 0;
  w3 &= 0x3ffffff;

  /* k = 4 */
  lo = Math.imul(al4, bl0);
  mid = Math.imul(al4, bh0);
  mid = (mid + Math.imul(ah4, bl0)) | 0;
  hi = Math.imul(ah4, bh0);
  lo = (lo + Math.imul(al3, bl1)) | 0;
  mid = (mid + Math.imul(al3, bh1)) | 0;
  mid = (mid + Math.imul(ah3, bl1)) | 0;
  hi = (hi + Math.imul(ah3, bh1)) | 0;
  lo = (lo + Math.imul(al2, bl2)) | 0;
  mid = (mid + Math.imul(al2, bh2)) | 0;
  mid = (mid + Math.imul(ah2, bl2)) | 0;
  hi = (hi + Math.imul(ah2, bh2)) | 0;
  lo = (lo + Math.imul(al1, bl3)) | 0;
  mid = (mid + Math.imul(al1, bh3)) | 0;
  mid = (mid + Math.imul(ah1, bl3)) | 0;
  hi = (hi + Math.imul(ah1, bh3)) | 0;
  lo = (lo + Math.imul(al0, bl4)) | 0;
  mid = (mid + Math.imul(al0, bh4)) | 0;
  mid = (mid + Math.imul(ah0, bl4)) | 0;
  hi = (hi + Math.imul(ah0, bh4)) | 0;

  let w4 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w4 >>> 26)) | 0;
  w4 &= 0x3ffffff;

  /* k = 5 */
  lo = Math.imul(al5, bl0);
  mid = Math.imul(al5, bh0);
  mid = (mid + Math.imul(ah5, bl0)) | 0;
  hi = Math.imul(ah5, bh0);
  lo = (lo + Math.imul(al4, bl1)) | 0;
  mid = (mid + Math.imul(al4, bh1)) | 0;
  mid = (mid + Math.imul(ah4, bl1)) | 0;
  hi = (hi + Math.imul(ah4, bh1)) | 0;
  lo = (lo + Math.imul(al3, bl2)) | 0;
  mid = (mid + Math.imul(al3, bh2)) | 0;
  mid = (mid + Math.imul(ah3, bl2)) | 0;
  hi = (hi + Math.imul(ah3, bh2)) | 0;
  lo = (lo + Math.imul(al2, bl3)) | 0;
  mid = (mid + Math.imul(al2, bh3)) | 0;
  mid = (mid + Math.imul(ah2, bl3)) | 0;
  hi = (hi + Math.imul(ah2, bh3)) | 0;
  lo = (lo + Math.imul(al1, bl4)) | 0;
  mid = (mid + Math.imul(al1, bh4)) | 0;
  mid = (mid + Math.imul(ah1, bl4)) | 0;
  hi = (hi + Math.imul(ah1, bh4)) | 0;
  lo = (lo + Math.imul(al0, bl5)) | 0;
  mid = (mid + Math.imul(al0, bh5)) | 0;
  mid = (mid + Math.imul(ah0, bl5)) | 0;
  hi = (hi + Math.imul(ah0, bh5)) | 0;

  let w5 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w5 >>> 26)) | 0;
  w5 &= 0x3ffffff;

  /* k = 6 */
  lo = Math.imul(al6, bl0);
  mid = Math.imul(al6, bh0);
  mid = (mid + Math.imul(ah6, bl0)) | 0;
  hi = Math.imul(ah6, bh0);
  lo = (lo + Math.imul(al5, bl1)) | 0;
  mid = (mid + Math.imul(al5, bh1)) | 0;
  mid = (mid + Math.imul(ah5, bl1)) | 0;
  hi = (hi + Math.imul(ah5, bh1)) | 0;
  lo = (lo + Math.imul(al4, bl2)) | 0;
  mid = (mid + Math.imul(al4, bh2)) | 0;
  mid = (mid + Math.imul(ah4, bl2)) | 0;
  hi = (hi + Math.imul(ah4, bh2)) | 0;
  lo = (lo + Math.imul(al3, bl3)) | 0;
  mid = (mid + Math.imul(al3, bh3)) | 0;
  mid = (mid + Math.imul(ah3, bl3)) | 0;
  hi = (hi + Math.imul(ah3, bh3)) | 0;
  lo = (lo + Math.imul(al2, bl4)) | 0;
  mid = (mid + Math.imul(al2, bh4)) | 0;
  mid = (mid + Math.imul(ah2, bl4)) | 0;
  hi = (hi + Math.imul(ah2, bh4)) | 0;
  lo = (lo + Math.imul(al1, bl5)) | 0;
  mid = (mid + Math.imul(al1, bh5)) | 0;
  mid = (mid + Math.imul(ah1, bl5)) | 0;
  hi = (hi + Math.imul(ah1, bh5)) | 0;
  lo = (lo + Math.imul(al0, bl6)) | 0;
  mid = (mid + Math.imul(al0, bh6)) | 0;
  mid = (mid + Math.imul(ah0, bl6)) | 0;
  hi = (hi + Math.imul(ah0, bh6)) | 0;

  let w6 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w6 >>> 26)) | 0;
  w6 &= 0x3ffffff;

  /* k = 7 */
  lo = Math.imul(al7, bl0);
  mid = Math.imul(al7, bh0);
  mid = (mid + Math.imul(ah7, bl0)) | 0;
  hi = Math.imul(ah7, bh0);
  lo = (lo + Math.imul(al6, bl1)) | 0;
  mid = (mid + Math.imul(al6, bh1)) | 0;
  mid = (mid + Math.imul(ah6, bl1)) | 0;
  hi = (hi + Math.imul(ah6, bh1)) | 0;
  lo = (lo + Math.imul(al5, bl2)) | 0;
  mid = (mid + Math.imul(al5, bh2)) | 0;
  mid = (mid + Math.imul(ah5, bl2)) | 0;
  hi = (hi + Math.imul(ah5, bh2)) | 0;
  lo = (lo + Math.imul(al4, bl3)) | 0;
  mid = (mid + Math.imul(al4, bh3)) | 0;
  mid = (mid + Math.imul(ah4, bl3)) | 0;
  hi = (hi + Math.imul(ah4, bh3)) | 0;
  lo = (lo + Math.imul(al3, bl4)) | 0;
  mid = (mid + Math.imul(al3, bh4)) | 0;
  mid = (mid + Math.imul(ah3, bl4)) | 0;
  hi = (hi + Math.imul(ah3, bh4)) | 0;
  lo = (lo + Math.imul(al2, bl5)) | 0;
  mid = (mid + Math.imul(al2, bh5)) | 0;
  mid = (mid + Math.imul(ah2, bl5)) | 0;
  hi = (hi + Math.imul(ah2, bh5)) | 0;
  lo = (lo + Math.imul(al1, bl6)) | 0;
  mid = (mid + Math.imul(al1, bh6)) | 0;
  mid = (mid + Math.imul(ah1, bl6)) | 0;
  hi = (hi + Math.imul(ah1, bh6)) | 0;
  lo = (lo + Math.imul(al0, bl7)) | 0;
  mid = (mid + Math.imul(al0, bh7)) | 0;
  mid = (mid + Math.imul(ah0, bl7)) | 0;
  hi = (hi + Math.imul(ah0, bh7)) | 0;

  let w7 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w7 >>> 26)) | 0;
  w7 &= 0x3ffffff;

  /* k = 8 */
  lo = Math.imul(al8, bl0);
  mid = Math.imul(al8, bh0);
  mid = (mid + Math.imul(ah8, bl0)) | 0;
  hi = Math.imul(ah8, bh0);
  lo = (lo + Math.imul(al7, bl1)) | 0;
  mid = (mid + Math.imul(al7, bh1)) | 0;
  mid = (mid + Math.imul(ah7, bl1)) | 0;
  hi = (hi + Math.imul(ah7, bh1)) | 0;
  lo = (lo + Math.imul(al6, bl2)) | 0;
  mid = (mid + Math.imul(al6, bh2)) | 0;
  mid = (mid + Math.imul(ah6, bl2)) | 0;
  hi = (hi + Math.imul(ah6, bh2)) | 0;
  lo = (lo + Math.imul(al5, bl3)) | 0;
  mid = (mid + Math.imul(al5, bh3)) | 0;
  mid = (mid + Math.imul(ah5, bl3)) | 0;
  hi = (hi + Math.imul(ah5, bh3)) | 0;
  lo = (lo + Math.imul(al4, bl4)) | 0;
  mid = (mid + Math.imul(al4, bh4)) | 0;
  mid = (mid + Math.imul(ah4, bl4)) | 0;
  hi = (hi + Math.imul(ah4, bh4)) | 0;
  lo = (lo + Math.imul(al3, bl5)) | 0;
  mid = (mid + Math.imul(al3, bh5)) | 0;
  mid = (mid + Math.imul(ah3, bl5)) | 0;
  hi = (hi + Math.imul(ah3, bh5)) | 0;
  lo = (lo + Math.imul(al2, bl6)) | 0;
  mid = (mid + Math.imul(al2, bh6)) | 0;
  mid = (mid + Math.imul(ah2, bl6)) | 0;
  hi = (hi + Math.imul(ah2, bh6)) | 0;
  lo = (lo + Math.imul(al1, bl7)) | 0;
  mid = (mid + Math.imul(al1, bh7)) | 0;
  mid = (mid + Math.imul(ah1, bl7)) | 0;
  hi = (hi + Math.imul(ah1, bh7)) | 0;
  lo = (lo + Math.imul(al0, bl8)) | 0;
  mid = (mid + Math.imul(al0, bh8)) | 0;
  mid = (mid + Math.imul(ah0, bl8)) | 0;
  hi = (hi + Math.imul(ah0, bh8)) | 0;

  let w8 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w8 >>> 26)) | 0;
  w8 &= 0x3ffffff;

  /* k = 9 */
  lo = Math.imul(al9, bl0);
  mid = Math.imul(al9, bh0);
  mid = (mid + Math.imul(ah9, bl0)) | 0;
  hi = Math.imul(ah9, bh0);
  lo = (lo + Math.imul(al8, bl1)) | 0;
  mid = (mid + Math.imul(al8, bh1)) | 0;
  mid = (mid + Math.imul(ah8, bl1)) | 0;
  hi = (hi + Math.imul(ah8, bh1)) | 0;
  lo = (lo + Math.imul(al7, bl2)) | 0;
  mid = (mid + Math.imul(al7, bh2)) | 0;
  mid = (mid + Math.imul(ah7, bl2)) | 0;
  hi = (hi + Math.imul(ah7, bh2)) | 0;
  lo = (lo + Math.imul(al6, bl3)) | 0;
  mid = (mid + Math.imul(al6, bh3)) | 0;
  mid = (mid + Math.imul(ah6, bl3)) | 0;
  hi = (hi + Math.imul(ah6, bh3)) | 0;
  lo = (lo + Math.imul(al5, bl4)) | 0;
  mid = (mid + Math.imul(al5, bh4)) | 0;
  mid = (mid + Math.imul(ah5, bl4)) | 0;
  hi = (hi + Math.imul(ah5, bh4)) | 0;
  lo = (lo + Math.imul(al4, bl5)) | 0;
  mid = (mid + Math.imul(al4, bh5)) | 0;
  mid = (mid + Math.imul(ah4, bl5)) | 0;
  hi = (hi + Math.imul(ah4, bh5)) | 0;
  lo = (lo + Math.imul(al3, bl6)) | 0;
  mid = (mid + Math.imul(al3, bh6)) | 0;
  mid = (mid + Math.imul(ah3, bl6)) | 0;
  hi = (hi + Math.imul(ah3, bh6)) | 0;
  lo = (lo + Math.imul(al2, bl7)) | 0;
  mid = (mid + Math.imul(al2, bh7)) | 0;
  mid = (mid + Math.imul(ah2, bl7)) | 0;
  hi = (hi + Math.imul(ah2, bh7)) | 0;
  lo = (lo + Math.imul(al1, bl8)) | 0;
  mid = (mid + Math.imul(al1, bh8)) | 0;
  mid = (mid + Math.imul(ah1, bl8)) | 0;
  hi = (hi + Math.imul(ah1, bh8)) | 0;
  lo = (lo + Math.imul(al0, bl9)) | 0;
  mid = (mid + Math.imul(al0, bh9)) | 0;
  mid = (mid + Math.imul(ah0, bl9)) | 0;
  hi = (hi + Math.imul(ah0, bh9)) | 0;

  let w9 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w9 >>> 26)) | 0;
  w9 &= 0x3ffffff;

  /* k = 10 */
  lo = Math.imul(al9, bl1);
  mid = Math.imul(al9, bh1);
  mid = (mid + Math.imul(ah9, bl1)) | 0;
  hi = Math.imul(ah9, bh1);
  lo = (lo + Math.imul(al8, bl2)) | 0;
  mid = (mid + Math.imul(al8, bh2)) | 0;
  mid = (mid + Math.imul(ah8, bl2)) | 0;
  hi = (hi + Math.imul(ah8, bh2)) | 0;
  lo = (lo + Math.imul(al7, bl3)) | 0;
  mid = (mid + Math.imul(al7, bh3)) | 0;
  mid = (mid + Math.imul(ah7, bl3)) | 0;
  hi = (hi + Math.imul(ah7, bh3)) | 0;
  lo = (lo + Math.imul(al6, bl4)) | 0;
  mid = (mid + Math.imul(al6, bh4)) | 0;
  mid = (mid + Math.imul(ah6, bl4)) | 0;
  hi = (hi + Math.imul(ah6, bh4)) | 0;
  lo = (lo + Math.imul(al5, bl5)) | 0;
  mid = (mid + Math.imul(al5, bh5)) | 0;
  mid = (mid + Math.imul(ah5, bl5)) | 0;
  hi = (hi + Math.imul(ah5, bh5)) | 0;
  lo = (lo + Math.imul(al4, bl6)) | 0;
  mid = (mid + Math.imul(al4, bh6)) | 0;
  mid = (mid + Math.imul(ah4, bl6)) | 0;
  hi = (hi + Math.imul(ah4, bh6)) | 0;
  lo = (lo + Math.imul(al3, bl7)) | 0;
  mid = (mid + Math.imul(al3, bh7)) | 0;
  mid = (mid + Math.imul(ah3, bl7)) | 0;
  hi = (hi + Math.imul(ah3, bh7)) | 0;
  lo = (lo + Math.imul(al2, bl8)) | 0;
  mid = (mid + Math.imul(al2, bh8)) | 0;
  mid = (mid + Math.imul(ah2, bl8)) | 0;
  hi = (hi + Math.imul(ah2, bh8)) | 0;
  lo = (lo + Math.imul(al1, bl9)) | 0;
  mid = (mid + Math.imul(al1, bh9)) | 0;
  mid = (mid + Math.imul(ah1, bl9)) | 0;
  hi = (hi + Math.imul(ah1, bh9)) | 0;

  let w10 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w10 >>> 26)) | 0;
  w10 &= 0x3ffffff;

  /* k = 11 */
  lo = Math.imul(al9, bl2);
  mid = Math.imul(al9, bh2);
  mid = (mid + Math.imul(ah9, bl2)) | 0;
  hi = Math.imul(ah9, bh2);
  lo = (lo + Math.imul(al8, bl3)) | 0;
  mid = (mid + Math.imul(al8, bh3)) | 0;
  mid = (mid + Math.imul(ah8, bl3)) | 0;
  hi = (hi + Math.imul(ah8, bh3)) | 0;
  lo = (lo + Math.imul(al7, bl4)) | 0;
  mid = (mid + Math.imul(al7, bh4)) | 0;
  mid = (mid + Math.imul(ah7, bl4)) | 0;
  hi = (hi + Math.imul(ah7, bh4)) | 0;
  lo = (lo + Math.imul(al6, bl5)) | 0;
  mid = (mid + Math.imul(al6, bh5)) | 0;
  mid = (mid + Math.imul(ah6, bl5)) | 0;
  hi = (hi + Math.imul(ah6, bh5)) | 0;
  lo = (lo + Math.imul(al5, bl6)) | 0;
  mid = (mid + Math.imul(al5, bh6)) | 0;
  mid = (mid + Math.imul(ah5, bl6)) | 0;
  hi = (hi + Math.imul(ah5, bh6)) | 0;
  lo = (lo + Math.imul(al4, bl7)) | 0;
  mid = (mid + Math.imul(al4, bh7)) | 0;
  mid = (mid + Math.imul(ah4, bl7)) | 0;
  hi = (hi + Math.imul(ah4, bh7)) | 0;
  lo = (lo + Math.imul(al3, bl8)) | 0;
  mid = (mid + Math.imul(al3, bh8)) | 0;
  mid = (mid + Math.imul(ah3, bl8)) | 0;
  hi = (hi + Math.imul(ah3, bh8)) | 0;
  lo = (lo + Math.imul(al2, bl9)) | 0;
  mid = (mid + Math.imul(al2, bh9)) | 0;
  mid = (mid + Math.imul(ah2, bl9)) | 0;
  hi = (hi + Math.imul(ah2, bh9)) | 0;

  let w11 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w11 >>> 26)) | 0;
  w11 &= 0x3ffffff;

  /* k = 12 */
  lo = Math.imul(al9, bl3);
  mid = Math.imul(al9, bh3);
  mid = (mid + Math.imul(ah9, bl3)) | 0;
  hi = Math.imul(ah9, bh3);
  lo = (lo + Math.imul(al8, bl4)) | 0;
  mid = (mid + Math.imul(al8, bh4)) | 0;
  mid = (mid + Math.imul(ah8, bl4)) | 0;
  hi = (hi + Math.imul(ah8, bh4)) | 0;
  lo = (lo + Math.imul(al7, bl5)) | 0;
  mid = (mid + Math.imul(al7, bh5)) | 0;
  mid = (mid + Math.imul(ah7, bl5)) | 0;
  hi = (hi + Math.imul(ah7, bh5)) | 0;
  lo = (lo + Math.imul(al6, bl6)) | 0;
  mid = (mid + Math.imul(al6, bh6)) | 0;
  mid = (mid + Math.imul(ah6, bl6)) | 0;
  hi = (hi + Math.imul(ah6, bh6)) | 0;
  lo = (lo + Math.imul(al5, bl7)) | 0;
  mid = (mid + Math.imul(al5, bh7)) | 0;
  mid = (mid + Math.imul(ah5, bl7)) | 0;
  hi = (hi + Math.imul(ah5, bh7)) | 0;
  lo = (lo + Math.imul(al4, bl8)) | 0;
  mid = (mid + Math.imul(al4, bh8)) | 0;
  mid = (mid + Math.imul(ah4, bl8)) | 0;
  hi = (hi + Math.imul(ah4, bh8)) | 0;
  lo = (lo + Math.imul(al3, bl9)) | 0;
  mid = (mid + Math.imul(al3, bh9)) | 0;
  mid = (mid + Math.imul(ah3, bl9)) | 0;
  hi = (hi + Math.imul(ah3, bh9)) | 0;

  let w12 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w12 >>> 26)) | 0;
  w12 &= 0x3ffffff;

  /* k = 13 */
  lo = Math.imul(al9, bl4);
  mid = Math.imul(al9, bh4);
  mid = (mid + Math.imul(ah9, bl4)) | 0;
  hi = Math.imul(ah9, bh4);
  lo = (lo + Math.imul(al8, bl5)) | 0;
  mid = (mid + Math.imul(al8, bh5)) | 0;
  mid = (mid + Math.imul(ah8, bl5)) | 0;
  hi = (hi + Math.imul(ah8, bh5)) | 0;
  lo = (lo + Math.imul(al7, bl6)) | 0;
  mid = (mid + Math.imul(al7, bh6)) | 0;
  mid = (mid + Math.imul(ah7, bl6)) | 0;
  hi = (hi + Math.imul(ah7, bh6)) | 0;
  lo = (lo + Math.imul(al6, bl7)) | 0;
  mid = (mid + Math.imul(al6, bh7)) | 0;
  mid = (mid + Math.imul(ah6, bl7)) | 0;
  hi = (hi + Math.imul(ah6, bh7)) | 0;
  lo = (lo + Math.imul(al5, bl8)) | 0;
  mid = (mid + Math.imul(al5, bh8)) | 0;
  mid = (mid + Math.imul(ah5, bl8)) | 0;
  hi = (hi + Math.imul(ah5, bh8)) | 0;
  lo = (lo + Math.imul(al4, bl9)) | 0;
  mid = (mid + Math.imul(al4, bh9)) | 0;
  mid = (mid + Math.imul(ah4, bl9)) | 0;
  hi = (hi + Math.imul(ah4, bh9)) | 0;

  let w13 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w13 >>> 26)) | 0;
  w13 &= 0x3ffffff;

  /* k = 14 */
  lo = Math.imul(al9, bl5);
  mid = Math.imul(al9, bh5);
  mid = (mid + Math.imul(ah9, bl5)) | 0;
  hi = Math.imul(ah9, bh5);
  lo = (lo + Math.imul(al8, bl6)) | 0;
  mid = (mid + Math.imul(al8, bh6)) | 0;
  mid = (mid + Math.imul(ah8, bl6)) | 0;
  hi = (hi + Math.imul(ah8, bh6)) | 0;
  lo = (lo + Math.imul(al7, bl7)) | 0;
  mid = (mid + Math.imul(al7, bh7)) | 0;
  mid = (mid + Math.imul(ah7, bl7)) | 0;
  hi = (hi + Math.imul(ah7, bh7)) | 0;
  lo = (lo + Math.imul(al6, bl8)) | 0;
  mid = (mid + Math.imul(al6, bh8)) | 0;
  mid = (mid + Math.imul(ah6, bl8)) | 0;
  hi = (hi + Math.imul(ah6, bh8)) | 0;
  lo = (lo + Math.imul(al5, bl9)) | 0;
  mid = (mid + Math.imul(al5, bh9)) | 0;
  mid = (mid + Math.imul(ah5, bl9)) | 0;
  hi = (hi + Math.imul(ah5, bh9)) | 0;

  let w14 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w14 >>> 26)) | 0;
  w14 &= 0x3ffffff;

  /* k = 15 */
  lo = Math.imul(al9, bl6);
  mid = Math.imul(al9, bh6);
  mid = (mid + Math.imul(ah9, bl6)) | 0;
  hi = Math.imul(ah9, bh6);
  lo = (lo + Math.imul(al8, bl7)) | 0;
  mid = (mid + Math.imul(al8, bh7)) | 0;
  mid = (mid + Math.imul(ah8, bl7)) | 0;
  hi = (hi + Math.imul(ah8, bh7)) | 0;
  lo = (lo + Math.imul(al7, bl8)) | 0;
  mid = (mid + Math.imul(al7, bh8)) | 0;
  mid = (mid + Math.imul(ah7, bl8)) | 0;
  hi = (hi + Math.imul(ah7, bh8)) | 0;
  lo = (lo + Math.imul(al6, bl9)) | 0;
  mid = (mid + Math.imul(al6, bh9)) | 0;
  mid = (mid + Math.imul(ah6, bl9)) | 0;
  hi = (hi + Math.imul(ah6, bh9)) | 0;

  let w15 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w15 >>> 26)) | 0;
  w15 &= 0x3ffffff;

  /* k = 16 */
  lo = Math.imul(al9, bl7);
  mid = Math.imul(al9, bh7);
  mid = (mid + Math.imul(ah9, bl7)) | 0;
  hi = Math.imul(ah9, bh7);
  lo = (lo + Math.imul(al8, bl8)) | 0;
  mid = (mid + Math.imul(al8, bh8)) | 0;
  mid = (mid + Math.imul(ah8, bl8)) | 0;
  hi = (hi + Math.imul(ah8, bh8)) | 0;
  lo = (lo + Math.imul(al7, bl9)) | 0;
  mid = (mid + Math.imul(al7, bh9)) | 0;
  mid = (mid + Math.imul(ah7, bl9)) | 0;
  hi = (hi + Math.imul(ah7, bh9)) | 0;

  let w16 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w16 >>> 26)) | 0;
  w16 &= 0x3ffffff;

  /* k = 17 */
  lo = Math.imul(al9, bl8);
  mid = Math.imul(al9, bh8);
  mid = (mid + Math.imul(ah9, bl8)) | 0;
  hi = Math.imul(ah9, bh8);
  lo = (lo + Math.imul(al8, bl9)) | 0;
  mid = (mid + Math.imul(al8, bh9)) | 0;
  mid = (mid + Math.imul(ah8, bl9)) | 0;
  hi = (hi + Math.imul(ah8, bh9)) | 0;

  let w17 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w17 >>> 26)) | 0;
  w17 &= 0x3ffffff;

  /* k = 18 */
  lo = Math.imul(al9, bl9);
  mid = Math.imul(al9, bh9);
  mid = (mid + Math.imul(ah9, bl9)) | 0;
  hi = Math.imul(ah9, bh9);

  let w18 = (((c + lo) | 0) + ((mid & 0x1fff) << 13)) | 0;
  c = (((hi + (mid >>> 13)) | 0) + (w18 >>> 26)) | 0;
  w18 &= 0x3ffffff;

  o[0] = w0;
  o[1] = w1;
  o[2] = w2;
  o[3] = w3;
  o[4] = w4;
  o[5] = w5;
  o[6] = w6;
  o[7] = w7;
  o[8] = w8;
  o[9] = w9;
  o[10] = w10;
  o[11] = w11;
  o[12] = w12;
  o[13] = w13;
  o[14] = w14;
  o[15] = w15;
  o[16] = w16;
  o[17] = w17;
  o[18] = w18;

  if (c !== 0) {
    o[19] = c;
    out.length += 1;
  }

  // Note: we shouldn't need to strip here.
  return out;
}

// Polyfill comb.
if (!Math.imul)
  comb10MulTo = smallMulTo;

/*
 * Expose
 */

BN.Red = Red;

module.exports = BN;
}],
[/* 33 */ 'bcrypto', '/lib/internal/custom-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * custom.js - custom inspect symbol for bcrypto
 * Copyright (c) 2018-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

exports.custom = 'inspect';
}],
[/* 34 */ 'bcrypto', '/lib/internal/asn1.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * asn1.js - asn1 parsing for bcrypto
 * Copyright (c) 2020, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

const assert = require('assert');
const BN = __node_require__(31 /* '../bn' */);

/*
 * ASN1
 */

function readSize(data, pos, strict) {
  assert(Buffer.isBuffer(data));
  assert((pos >>> 0) === pos);
  assert(typeof strict === 'boolean');

  if (pos >= data.length)
    throw new Error('Invalid size.');

  const field = data[pos];
  const bytes = field & 0x7f;

  pos += 1;

  // Definite form.
  if ((field & 0x80) === 0) {
    // Short form.
    return [bytes, pos];
  }

  // Indefinite form.
  if (strict && bytes === 0)
    throw new Error('Indefinite length.');

  // Long form.
  let size = 0;

  for (let i = 0; i < bytes; i++) {
    assert(pos < data.length);

    const ch = data[pos];

    pos += 1;

    if (size >= (1 << 24))
      throw new Error('Length too large.');

    size *= 0x100;
    size += ch;

    if (strict && size === 0)
      throw new Error('Unexpected leading zeroes.');
  }

  if (strict && size < 0x80)
    throw new Error('Non-minimal length.');

  return [size, pos];
}

function readSeq(data, pos, strict = true) {
  assert(Buffer.isBuffer(data));
  assert((pos >>> 0) === pos);
  assert(typeof strict === 'boolean');

  if (pos >= data.length || data[pos] !== 0x30)
    throw new Error('Invalid sequence tag.');

  pos += 1;

  let size;
  [size, pos] = readSize(data, pos, strict);

  if (strict && pos + size !== data.length)
    throw new Error('Trailing bytes.');

  return pos;
}

function readInt(data, pos, strict = true) {
  assert(Buffer.isBuffer(data));
  assert((pos >>> 0) === pos);
  assert(typeof strict === 'boolean');

  if (pos >= data.length || data[pos] !== 0x02)
    throw new Error('Invalid integer tag.');

  pos += 1;

  let size;
  [size, pos] = readSize(data, pos, strict);

  if (pos + size > data.length)
    throw new Error('Integer body out of bounds.');

  if (strict) {
    // Zero length integer.
    if (size === 0)
      throw new Error('Zero length integer.');

    // No negatives.
    if (data[pos] & 0x80)
      throw new Error('Integers must be positive.');

    // Allow zero only if it prefixes a high bit.
    if (size > 1) {
      if (data[pos] === 0x00 && (data[pos + 1] & 0x80) === 0x00)
        throw new Error('Unexpected leading zeroes.');
    }
  }

  // Eat leading zeroes.
  while (size > 0 && data[pos] === 0x00) {
    pos += 1;
    size -= 1;
  }

  // No reason to have an integer larger than this.
  if (size > 2048)
    throw new Error('Invalid integer size.');

  const num = BN.decode(data.slice(pos, pos + size));

  pos += size;

  return [num, pos];
}

function readVersion(data, pos, version, strict = true) {
  assert(Buffer.isBuffer(data));
  assert((pos >>> 0) === pos);
  assert((version & 0xff) === version);
  assert(typeof strict === 'boolean');

  let num;
  [num, pos] = readInt(data, pos, strict);

  if (num.cmpn(version) !== 0)
    throw new Error('Invalid version.');

  return pos;
}

function sizeSize(size) {
  assert((size >>> 0) === size);

  if (size <= 0x7f) // [size]
    return 1;

  if (size <= 0xff) // 0x81 [size]
    return 2;

  assert(size <= 0xffff);

  return 3; // 0x82 [size-hi] [size-lo]
}

function sizeSeq(size) {
  return 1 + sizeSize(size) + size;
}

function sizeInt(num) {
  assert(num instanceof BN);

  // 0x02 [size] [0x00?] [int]
  const bits = num.bitLength();

  let size = (bits + 7) >>> 3;

  if (bits > 0 && (bits & 7) === 0)
    size += num.testn(bits - 1);

  if (bits === 0)
    size = 1;

  return 1 + sizeSize(size) + size;
}

function sizeVersion(version) {
  assert((version & 0xff) === version);
  return 3;
}

function writeSize(data, pos, size) {
  assert(Buffer.isBuffer(data));
  assert((pos >>> 0) === pos);
  assert((size >>> 0) === size);

  if (size <= 0x7f)  {
    // [size]
    data[pos++] = size;
  } else if (size <= 0xff) {
    // 0x81 [size]
    data[pos++] = 0x81;
    data[pos++] = size;
  } else {
    // 0x82 [size-hi] [size-lo]
    assert(size <= 0xffff);
    data[pos++] = 0x82;
    data[pos++] = size >> 8;
    data[pos++] = size & 0xff;
  }

  assert(pos <= data.length);

  return pos;
}

function writeSeq(data, pos, size) {
  assert(Buffer.isBuffer(data));
  assert((pos >>> 0) === pos);

  data[pos++] = 0x30;

  return writeSize(data, pos, size);
}

function writeInt(data, pos, num) {
  assert(Buffer.isBuffer(data));
  assert((pos >>> 0) === pos);
  assert(num instanceof BN);

  // 0x02 [size] [0x00?] [int]
  const bits = num.bitLength();

  let size = (bits + 7) >>> 3;
  let pad = 0;

  if (bits > 0 && (bits & 7) === 0)
    pad = num.testn(bits - 1);

  if (bits === 0)
    size = 1;

  data[pos++] = 0x02;

  pos = writeSize(data, pos, pad + size);

  if (pad)
    data[pos++] = 0x00;

  if (bits !== 0)
    num.encode().copy(data, pos);
  else
    data[pos] = 0x00;

  pos += size;

  assert(pos <= data.length);

  return pos;
}

function writeVersion(data, pos, version) {
  assert(Buffer.isBuffer(data));
  assert((pos >>> 0) === pos);
  assert((version & 0xff) === version);
  assert(pos + 3 <= data.length);

  data[pos++] = 0x02;
  data[pos++] = 0x01;
  data[pos++] = version;

  return pos;
}

/*
 * Expose
 */

exports.readSize = readSize;
exports.readSeq = readSeq;
exports.readInt = readInt;
exports.readVersion = readVersion;
exports.sizeSize = sizeSize;
exports.sizeSeq = sizeSeq;
exports.sizeInt = sizeInt;
exports.sizeVersion = sizeVersion;
exports.writeSize = writeSize;
exports.writeSeq = writeSeq;
exports.writeInt = writeInt;
exports.writeVersion = writeVersion;
}],
[/* 35 */ 'bcrypto', '/lib/js/schnorr-legacy.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * schnorr-legacy.js - bip-schnorr for bcrypto
 * Copyright (c) 2019-2020, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on sipa/bip-schnorr:
 *   Copyright (c) 2018-2019, Pieter Wuille (2-clause BSD License).
 *   https://github.com/sipa/bips/blob/d194620/bip-schnorr/reference.py
 *
 * Parts of this software are based on ElementsProject/secp256k1-zkp:
 *   Copyright (c) 2013, Pieter Wuille.
 *   https://github.com/ElementsProject/secp256k1-zkp
 *
 * Resources:
 *   https://github.com/sipa/bips/blob/d194620/bip-schnorr.mediawiki
 *   https://github.com/sipa/bips/blob/d194620/bip-schnorr/reference.py
 *   https://github.com/sipa/bips/blob/d194620/bip-schnorr/test-vectors.csv
 *   https://github.com/ElementsProject/secp256k1-zkp/tree/11af701/src/modules/schnorrsig
 *   https://github.com/bitcoincashorg/bitcoincash.org/blob/master/spec/2019-05-15-schnorr.md
 *
 * References:
 *
 *   [SCHNORR] Schnorr Signatures for secp256k1
 *     Pieter Wuille
 *     https://github.com/sipa/bips/blob/d194620/bip-schnorr.mediawiki
 *
 *   [CASH] Schnorr Signature specification
 *     Mark B. Lundeberg
 *     https://github.com/bitcoincashorg/bitcoincash.org/blob/master/spec/2019-05-15-schnorr.md
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);
const BatchRNG = __node_require__(36 /* './batch-rng' */);
const BN = __node_require__(31 /* '../bn' */);

/**
 * Schnorr
 */

class Schnorr {
  constructor(curve, hash) {
    this.curve = curve;
    this.hash = hash;
    this.rng = new BatchRNG(this.curve, this.encode.bind(this));
  }

  check() {
    // [SCHNORR] "Footnotes".
    // Must be congruent to 3 mod 4.
    if (this.curve.p.andln(3) !== 3)
      throw new Error(`Schnorr is not supported for ${this.curve.id}.`);
  }

  encode(key) {
    // Extra speedy key reserialization.
    assert(Buffer.isBuffer(key));

    const {fieldSize} = this.curve;

    if (key.length === 1 + fieldSize)
      return key;

    if (key.length !== 1 + fieldSize * 2)
      throw new Error('Invalid point.');

    const out = Buffer.alloc(1 + fieldSize);

    out[0] = 0x02 | (key[key.length - 1] & 1);
    key.copy(out, 1, 1, 1 + fieldSize);

    return out;
  }

  hashInt(...items) {
    // [SCHNORR] "Specification".
    // eslint-disable-next-line
    const h = new this.hash();

    h.init();

    for (const item of items)
      h.update(item);

    let hash = h.final(this.curve.scalarSize);

    if (hash.length > this.curve.scalarSize)
      hash = hash.slice(0, this.curve.scalarSize);

    const num = BN.decode(hash, this.curve.endian);

    num.iumaskn(this.curve.scalarBits);

    return num.imod(this.curve.n);
  }

  hashNonce(a, m) {
    return this.hashInt(a, m);
  }

  hashChallenge(R, A, m) {
    return this.hashInt(R, this.encode(A), m);
  }

  sign(msg, key) {
    assert(Buffer.isBuffer(msg));

    this.check();

    return this._sign(msg, key);
  }

  _sign(msg, key) {
    // Schnorr Signing.
    //
    // [SCHNORR] "Signing".
    // [CASH] "Recommended practices for secure signature generation".
    //
    // Assumptions:
    //
    //   - Let `H` be a cryptographic hash function.
    //   - Let `m` be a 32-byte array.
    //   - Let `a` be a secret non-zero scalar.
    //   - k != 0.
    //
    // Computation:
    //
    //   A = G * a
    //   k = H(a, m) mod n
    //   R = G * k
    //   k = -k mod n, if y(R) is not square
    //   r = x(R)
    //   e = H(r, A, m) mod n
    //   s = (k + e * a) mod n
    //   S = (r, s)
    //
    // Note that `k` must remain secret,
    // otherwise an attacker can compute:
    //
    //   a = (s - k) / e mod n
    const {n} = this.curve;
    const G = this.curve.g;
    const a = this.curve.decodeScalar(key);

    if (a.isZero() || a.cmp(n) >= 0)
      throw new Error('Invalid private key.');

    const A = G.mulBlind(a);
    const k = this.hashNonce(key, msg);

    if (k.isZero())
      throw new Error('Signing failed (k\' = 0).');

    const R = G.mulBlind(k);

    if (!R.isSquare())
      k.ineg().imod(n);

    const Rraw = R.encodeX();
    const Araw = A.encode();
    const e = this.hashChallenge(Rraw, Araw, msg);
    const s = k.add(e.mul(a)).imod(n);

    return Buffer.concat([Rraw, this.curve.encodeScalar(s)]);
  }

  verify(msg, sig, key) {
    assert(Buffer.isBuffer(msg));
    assert(Buffer.isBuffer(sig));
    assert(Buffer.isBuffer(key));

    this.check();

    if (sig.length !== this.curve.fieldSize + this.curve.scalarSize)
      return false;

    try {
      return this._verify(msg, sig, key);
    } catch (e) {
      return false;
    }
  }

  _verify(msg, sig, key) {
    // Schnorr Verification.
    //
    // [SCHNORR] "Verification".
    // [CASH] "Signature verification algorithm".
    //
    // Assumptions:
    //
    //   - Let `H` be a cryptographic hash function.
    //   - Let `m` be a 32-byte array.
    //   - Let `r` and `s` be signature elements.
    //   - Let `A` be a valid group element.
    //   - r^3 + a * r + b is square in F(p).
    //   - sqrt(r^3 + a * r + b) is square in F(p).
    //   - r < p, s < n.
    //   - R != O.
    //
    // Computation:
    //
    //   R = (r, sqrt(r^3 + a * r + b))
    //   e = H(r, A, m) mod n
    //   R == G * s - A * e
    //
    // We can skip a square root with:
    //
    //   e = H(r, A, m) mod n
    //   R = G * s - A * e
    //   y(R) is square
    //   x(R) == r
    //
    // We can also avoid affinization by
    // replacing the two assertions with:
    //
    //   (y(R) * z(R) mod p) is square
    //   x(R) == r * z(R)^2 mod p
    //
    // Furthermore, squareness can be calculated
    // with a variable time Jacobi symbol algorithm.
    const {p, n} = this.curve;
    const G = this.curve.g;
    const Rraw = sig.slice(0, this.curve.fieldSize);
    const sraw = sig.slice(this.curve.fieldSize);
    const r = this.curve.decodeField(Rraw);
    const s = this.curve.decodeScalar(sraw);
    const A = this.curve.decodePoint(key);

    if (r.cmp(p) >= 0 || s.cmp(n) >= 0)
      return false;

    const e = this.hashChallenge(Rraw, key, msg);
    const R = G.jmulAdd(s, A, e.ineg().imod(n));

    if (!R.isSquare())
      return false;

    if (!R.eqX(r))
      return false;

    return true;
  }

  verifyBatch(batch) {
    assert(Array.isArray(batch));

    this.check();

    for (const item of batch) {
      assert(Array.isArray(item) && item.length === 3);

      const [msg, sig, key] = item;

      assert(Buffer.isBuffer(msg));
      assert(Buffer.isBuffer(sig));
      assert(Buffer.isBuffer(key));

      if (sig.length !== this.curve.fieldSize + this.curve.scalarSize)
        return false;
    }

    try {
      return this._verifyBatch(batch);
    } catch (e) {
      return false;
    }
  }

  _verifyBatch(batch) {
    // Schnorr Batch Verification.
    //
    // [SCHNORR] "Batch Verification".
    //
    // Assumptions:
    //
    //   - Let `H` be a cryptographic hash function.
    //   - Let `m` be a 32-byte array.
    //   - Let `r` and `s` be signature elements.
    //   - Let `A` be a valid group element.
    //   - Let `i` be the batch item index.
    //   - r^3 + a * r + b is square in F(p).
    //   - sqrt(r^3 + a * r + b) is square in F(p).
    //   - r < p, s < n.
    //   - a1 = 1 mod n.
    //
    // Computation:
    //
    //   Ri = (ri, sqrt(ri^3 + a * ri + b))
    //   ei = H(ri, Ai, mi) mod n
    //   ai = random integer in [1,n-1]
    //   lhs = si * ai + ... mod n
    //   rhs = Ri * ai + Ai * (ei * ai mod n) + ...
    //   G * -lhs + rhs == O
    const {n} = this.curve;
    const G = this.curve.g;
    const points = new Array(1 + batch.length * 2);
    const coeffs = new Array(1 + batch.length * 2);
    const sum = new BN(0);

    this.rng.init(batch);

    points[0] = G;
    coeffs[0] = sum;

    for (let i = 0; i < batch.length; i++) {
      const [msg, sig, key] = batch[i];
      const Rraw = sig.slice(0, this.curve.fieldSize);
      const sraw = sig.slice(this.curve.fieldSize);
      const R = this.curve.decodeSquare(Rraw);
      const s = this.curve.decodeScalar(sraw);
      const A = this.curve.decodePoint(key);

      if (s.cmp(n) >= 0)
        return false;

      const e = this.hashChallenge(Rraw, key, msg);
      const a = this.rng.generate(i);
      const ea = e.mul(a).imod(n);

      sum.iadd(s.mul(a)).imod(n);

      points[1 + i * 2 + 0] = R;
      coeffs[1 + i * 2 + 0] = a;
      points[1 + i * 2 + 1] = A;
      coeffs[1 + i * 2 + 1] = ea;
    }

    sum.ineg().imod(n);

    return this.curve.jmulAll(points, coeffs).isInfinity();
  }
}

/*
 * Expose
 */

module.exports = Schnorr;
}],
[/* 36 */ 'bcrypto', '/lib/js/batch-rng.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * batch-rng.js - batch rng for bcrypto
 * Copyright (c) 2019-2020, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on ElementsProject/secp256k1-zkp:
 *   Copyright (c) 2013, Pieter Wuille.
 *   https://github.com/ElementsProject/secp256k1-zkp
 *
 * Resources:
 *   https://github.com/ElementsProject/secp256k1-zkp/blob/11af701/src/modules/schnorrsig/main_impl.h#L166
 *   https://github.com/ElementsProject/secp256k1-zkp/blob/11af701/src/scalar_4x64_impl.h#L972
 *   https://github.com/ElementsProject/secp256k1-zkp/blob/11af701/src/scalar_8x32_impl.h#L747
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);
const BN = __node_require__(31 /* '../bn' */);
const ChaCha20 = __node_require__(37 /* '../chacha20' */);
const SHA256 = __node_require__(39 /* '../sha256' */);

/**
 * BatchRNG
 */

class BatchRNG {
  constructor(curve, encode = key => key) {
    this.curve = curve;
    this.encode = encode;
    this.hash = new SHA256();
    this.chacha = new ChaCha20();
    this.key = Buffer.alloc(32, 0x00);
    this.iv = Buffer.alloc(8, 0x00);
    this.cache = [new BN(1), new BN(1)];
  }

  init(batch) {
    assert(Array.isArray(batch));

    this.hash.init();

    for (const [msg, sig, key] of batch) {
      this.hash.update(SHA256.digest(msg));
      this.hash.update(sig);
      this.hash.update(this.encode(key));
    }

    this.key = this.hash.final();
    this.cache[0] = new BN(1);
    this.cache[1] = new BN(1);

    return this;
  }

  encrypt(counter) {
    const size = this.curve.scalarSize * 2;
    const data = Buffer.alloc(size, 0x00);
    const left = data.slice(0, this.curve.scalarSize);
    const right = data.slice(this.curve.scalarSize);

    this.chacha.init(this.key, this.iv, counter);
    this.chacha.encrypt(data);

    return [
      this.curve.decodeScalar(left),
      this.curve.decodeScalar(right)
    ];
  }

  refresh(counter) {
    let overflow = 0;

    for (;;) {
      // First word is always zero.
      this.iv[4] = overflow;
      this.iv[5] = overflow >>> 8;
      this.iv[6] = overflow >>> 16;
      this.iv[7] = overflow >>> 24;

      overflow += 1;

      const [s1, s2] = this.encrypt(counter);

      if (s1.isZero() || s1.cmp(this.curve.n) >= 0)
        continue;

      if (s2.isZero() || s2.cmp(this.curve.n) >= 0)
        continue;

      this.cache[0] = s1;
      this.cache[1] = s2;

      break;
    }
  }

  generate(index) {
    assert((index >>> 0) === index);

    if (index & 1)
      this.refresh(index >>> 1);

    return this.cache[index & 1];
  }
}

/*
 * Expose
 */

module.exports = BatchRNG;
}],
[/* 37 */ 'bcrypto', '/lib/chacha20-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * chacha20.js - chacha20 for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(38 /* './js/chacha20' */);
}],
[/* 38 */ 'bcrypto', '/lib/js/chacha20.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * chacha20.js - chacha20 for bcrypto
 * Copyright (c) 2016-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Resources
 *   https://en.wikipedia.org/wiki/Chacha20
 *   https://tools.ietf.org/html/rfc7539#section-2
 *   https://cr.yp.to/chacha.html
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);

/*
 * Constants
 */

const BIG_ENDIAN = new Int8Array(new Int16Array([1]).buffer)[0] === 0;

/**
 * ChaCha20
 */

class ChaCha20 {
  /**
   * Create a ChaCha20 context.
   * @constructor
   */

  constructor() {
    this.state = new Uint32Array(16);
    this.stream = new Uint32Array(16);
    this.bytes = new Uint8Array(this.stream.buffer);
    this.pos = -1;

    if (BIG_ENDIAN)
      this.bytes = Buffer.alloc(64);
  }

  /**
   * Initialize chacha20 with a key, nonce, and counter.
   * @param {Buffer} key
   * @param {Buffer} nonce
   * @param {Number} counter
   */

  init(key, nonce, counter) {
    if (counter == null)
      counter = 0;

    assert(Buffer.isBuffer(key));
    assert(Buffer.isBuffer(nonce));
    assert(Number.isSafeInteger(counter));

    if (key.length !== 16 && key.length !== 32)
      throw new RangeError('Invalid key size.');

    if (nonce.length >= 24) {
      key = ChaCha20.derive(key, nonce.slice(0, 16));
      nonce = nonce.slice(16);
    }

    this.state[0] = 0x61707865;
    this.state[1] = key.length < 32 ? 0x3120646e : 0x3320646e;
    this.state[2] = key.length < 32 ? 0x79622d36 : 0x79622d32;
    this.state[3] = 0x6b206574;
    this.state[4] = readU32(key, 0);
    this.state[5] = readU32(key, 4);
    this.state[6] = readU32(key, 8);
    this.state[7] = readU32(key, 12);
    this.state[8] = readU32(key, 16 % key.length);
    this.state[9] = readU32(key, 20 % key.length);
    this.state[10] = readU32(key, 24 % key.length);
    this.state[11] = readU32(key, 28 % key.length);
    this.state[12] = counter >>> 0;

    if (nonce.length === 8) {
      this.state[13] = (counter / 0x100000000) >>> 0;
      this.state[14] = readU32(nonce, 0);
      this.state[15] = readU32(nonce, 4);
    } else if (nonce.length === 12) {
      this.state[13] = readU32(nonce, 0);
      this.state[14] = readU32(nonce, 4);
      this.state[15] = readU32(nonce, 8);
    } else if (nonce.length === 16) {
      this.state[12] = readU32(nonce, 0);
      this.state[13] = readU32(nonce, 4);
      this.state[14] = readU32(nonce, 8);
      this.state[15] = readU32(nonce, 12);
    } else {
      throw new RangeError('Invalid nonce size.');
    }

    this.pos = 0;

    return this;
  }

  /**
   * Encrypt/decrypt data.
   * @param {Buffer} data - Will be mutated.
   * @returns {Buffer}
   */

  encrypt(data) {
    assert(Buffer.isBuffer(data));

    if (this.pos === -1)
      throw new Error('Context is not initialized.');

    for (let i = 0; i < data.length; i++) {
      if ((this.pos & 63) === 0) {
        this._block();
        this.pos = 0;
      }

      data[i] ^= this.bytes[this.pos++];
    }

    return data;
  }

  /**
   * Stir the stream.
   */

  _block() {
    for (let i = 0; i < 16; i++)
      this.stream[i] = this.state[i];

    for (let i = 0; i < 10; i++) {
      qround(this.stream, 0, 4, 8, 12);
      qround(this.stream, 1, 5, 9, 13);
      qround(this.stream, 2, 6, 10, 14);
      qround(this.stream, 3, 7, 11, 15);
      qround(this.stream, 0, 5, 10, 15);
      qround(this.stream, 1, 6, 11, 12);
      qround(this.stream, 2, 7, 8, 13);
      qround(this.stream, 3, 4, 9, 14);
    }

    for (let i = 0; i < 16; i++)
      this.stream[i] += this.state[i];

    if (BIG_ENDIAN) {
      for (let i = 0; i < 16; i++)
        writeU32(this.bytes, this.stream[i], i * 4);
    }

    this.state[12] += 1;

    if (this.state[12] === 0)
      this.state[13] += 1;
  }

  /**
   * Destroy context.
   */

  destroy() {
    for (let i = 0; i < 16; i++) {
      this.state[i] = 0;
      this.stream[i] = 0;
    }

    if (BIG_ENDIAN) {
      for (let i = 0; i < 64; i++)
        this.bytes[i] = 0;
    }

    this.pos = -1;

    return this;
  }

  /**
   * Derive key with XChaCha20.
   * @param {Buffer} key
   * @param {Buffer} nonce
   * @returns {Buffer}
   */

  static derive(key, nonce) {
    assert(Buffer.isBuffer(key));
    assert(Buffer.isBuffer(nonce));

    if (key.length !== 16 && key.length !== 32)
      throw new RangeError('Invalid key size.');

    if (nonce.length !== 16)
      throw new RangeError('Invalid nonce size.');

    const state = new Uint32Array(16);

    state[0] = 0x61707865;
    state[1] = key.length < 32 ? 0x3120646e : 0x3320646e;
    state[2] = key.length < 32 ? 0x79622d36 : 0x79622d32;
    state[3] = 0x6b206574;
    state[4] = readU32(key, 0);
    state[5] = readU32(key, 4);
    state[6] = readU32(key, 8);
    state[7] = readU32(key, 12);
    state[8] = readU32(key, 16 % key.length);
    state[9] = readU32(key, 20 % key.length);
    state[10] = readU32(key, 24 % key.length);
    state[11] = readU32(key, 28 % key.length);
    state[12] = readU32(nonce, 0);
    state[13] = readU32(nonce, 4);
    state[14] = readU32(nonce, 8);
    state[15] = readU32(nonce, 12);

    for (let i = 0; i < 10; i++) {
      qround(state, 0, 4, 8, 12);
      qround(state, 1, 5, 9, 13);
      qround(state, 2, 6, 10, 14);
      qround(state, 3, 7, 11, 15);
      qround(state, 0, 5, 10, 15);
      qround(state, 1, 6, 11, 12);
      qround(state, 2, 7, 8, 13);
      qround(state, 3, 4, 9, 14);
    }

    const out = Buffer.alloc(32);

    writeU32(out, state[0], 0);
    writeU32(out, state[1], 4);
    writeU32(out, state[2], 8);
    writeU32(out, state[3], 12);
    writeU32(out, state[12], 16);
    writeU32(out, state[13], 20);
    writeU32(out, state[14], 24);
    writeU32(out, state[15], 28);

    return out;
  }
}

/*
 * Static
 */

ChaCha20.native = 0;

/*
 * Helpers
 */

function qround(x, a, b, c, d) {
  x[a] += x[b];
  x[d] = rotl32(x[d] ^ x[a], 16);

  x[c] += x[d];
  x[b] = rotl32(x[b] ^ x[c], 12);

  x[a] += x[b];
  x[d] = rotl32(x[d] ^ x[a], 8);

  x[c] += x[d];
  x[b] = rotl32(x[b] ^ x[c], 7);
}

function rotl32(w, b) {
  return (w << b) | (w >>> (32 - b));
}

function readU32(data, off) {
  return (data[off++]
        + data[off++] * 0x100
        + data[off++] * 0x10000
        + data[off] * 0x1000000);
}

function writeU32(dst, num, off) {
  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  num >>>= 8;
  dst[off++] = num;
  return off;
}

/*
 * Expose
 */

module.exports = ChaCha20;
}],
[/* 39 */ 'bcrypto', '/lib/sha256-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * sha256.js - sha256 for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(20 /* './js/sha256' */);
}],
[/* 40 */ 'bcrypto', '/lib/hmac-drbg-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * hmac-drbg.js - hmac-drbg for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(41 /* './js/hmac-drbg' */);
}],
[/* 41 */ 'bcrypto', '/lib/js/hmac-drbg.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * hmac-drbg.js - hmac-drbg implementation for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on indutny/hmac-drbg:
 *   Copyright Fedor Indutny, 2017.
 *   https://github.com/indutny/hmac-drbg
 *
 * Resources:
 *   https://tools.ietf.org/html/rfc6979
 *   https://csrc.nist.gov/publications/detail/sp/800-90a/archive/2012-01-23
 *   https://github.com/indutny/hmac-drbg/blob/master/lib/hmac-drbg.js
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);

/*
 * Constants
 */

const RESEED_INTERVAL = 0x1000000000000;
const ZERO = Buffer.from([0x00]);
const ONE = Buffer.from([0x01]);

/**
 * HmacDRBG
 */

class HmacDRBG {
  constructor(hash, entropy, nonce, pers) {
    assert(hash && typeof hash.id === 'string');

    this.hash = hash;
    this.minEntropy = hash.id === 'SHA1' ? 10 : 24;

    this.K = Buffer.alloc(hash.size);
    this.V = Buffer.alloc(hash.size);
    this.rounds = 0;

    if (entropy)
      this.init(entropy, nonce, pers);
  }

  init(entropy, nonce, pers) {
    if (nonce == null)
      nonce = Buffer.alloc(0);

    if (pers == null)
      pers = Buffer.alloc(0);

    assert(Buffer.isBuffer(entropy));
    assert(Buffer.isBuffer(nonce));
    assert(Buffer.isBuffer(pers));

    for (let i = 0; i < this.V.length; i++) {
      this.K[i] = 0x00;
      this.V[i] = 0x01;
    }

    const seed = Buffer.concat([entropy, nonce, pers]);

    if (seed.length < this.minEntropy)
      throw new Error('Not enough entropy.');

    this.update(seed);
    this.rounds = 1;

    return this;
  }

  reseed(entropy, add) {
    if (add == null)
      add = Buffer.alloc(0);

    assert(Buffer.isBuffer(entropy));
    assert(Buffer.isBuffer(add));

    if (this.rounds === 0)
      throw new Error('DRBG not initialized.');

    const seed = Buffer.concat([entropy, add]);

    if (seed.length < this.minEntropy)
     throw new Error('Not enough entropy.');

    this.update(seed);
    this.rounds = 1;

    return this;
  }

  generate(len, add) {
    assert((len >>> 0) === len);
    assert(add == null || Buffer.isBuffer(add));

    if (this.rounds === 0)
      throw new Error('DRBG not initialized.');

    if (this.rounds > RESEED_INTERVAL)
      throw new Error('Reseed is required.');

    if (add && add.length > 0)
      this.update(add);

    const blocks = Math.ceil(len / this.hash.size);
    const out = Buffer.alloc(blocks * this.hash.size);

    for (let i = 0; i < blocks; i++) {
      this.V = this.mac(this.V);
      this.V.copy(out, i * this.hash.size);
    }

    this.update(add);
    this.rounds += 1;

    return out.slice(0, len);
  }

  randomBytes(size) {
    return this.generate(size);
  }

  /*
   * Helpers
   */

  mac(data) {
    return this.hash.mac(data, this.K);
  }

  hmac() {
    return this.hash.hmac().init(this.K);
  }

  update(seed) {
    assert(seed == null || Buffer.isBuffer(seed));

    const kmac = this.hmac();

    kmac.update(this.V);
    kmac.update(ZERO);

    if (seed)
      kmac.update(seed);

    this.K = kmac.final();
    this.V = this.mac(this.V);

    if (seed && seed.length > 0) {
      const kmac = this.hmac();

      kmac.update(this.V);
      kmac.update(ONE);
      kmac.update(seed);

      this.K = kmac.final();
      this.V = this.mac(this.V);
    }

    return this;
  }
}

/*
 * Static
 */

HmacDRBG.native = 0;

/*
 * Expose
 */

module.exports = HmacDRBG;
}],
[/* 42 */ 'bcrypto', '/lib/js/elliptic.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * elliptic.js - elliptic curves for bcrypto
 * Copyright (c) 2018-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on indutny/elliptic:
 *   Copyright (c) 2014, Fedor Indutny (MIT License).
 *   https://github.com/indutny/elliptic
 *
 * Formulas from DJB and Tanja Lange [EFD].
 *
 * References:
 *
 *   [GECC] Guide to Elliptic Curve Cryptography
 *     D. Hankerson, A. Menezes, and S. Vanstone
 *     https://tinyurl.com/guide-to-ecc
 *
 *   [GLV] Faster Point Multiplication on Elliptic Curves
 *     R. Gallant, R. Lambert, and S. Vanstone
 *     https://link.springer.com/content/pdf/10.1007/3-540-44647-8_11.pdf
 *
 *   [MONT1] Montgomery curves and the Montgomery ladder
 *     Daniel J. Bernstein, Tanja Lange
 *     https://eprint.iacr.org/2017/293.pdf
 *
 *   [SQUARED] Elligator Squared
 *     Mehdi Tibouchi
 *     https://eprint.iacr.org/2014/043.pdf
 *
 *   [SEC1] SEC 1 - Standards for Efficient Cryptography Group
 *     Certicom Research
 *     https://www.secg.org/sec1-v2.pdf
 *
 *   [SEC2] SEC 2: Recommended Elliptic Curve Domain Parameters
 *     Certicom Research
 *     https://www.secg.org/sec2-v2.pdf
 *
 *   [SIDE1] Elliptic Curves and Side-Channel Attacks
 *     Marc Joye
 *     https://pdfs.semanticscholar.org/8d69/9645033e25d74fcfd4cbf07a770d2e943e14.pdf
 *
 *   [BLIND] Side-Channel Analysis on Blinding Regular Scalar Multiplications
 *     B. Feix, M. Roussellet, A. Venelli
 *     https://eprint.iacr.org/2014/191.pdf
 *
 *   [ALT] Alternative Elliptic Curve Representations
 *     R. Struik
 *     https://tools.ietf.org/id/draft-ietf-lwig-curve-representations-02.html
 *
 *   [ARITH1] Arithmetic of Elliptic Curves
 *     Christophe Doche, Tanja Lange
 *     Handbook of Elliptic and Hyperelliptic Curve Cryptography
 *     Page 267, Section 13 (978-1-58488-518-4)
 *     https://hyperelliptic.org/HEHCC/index.html
 *
 *   [ARITH2] The Arithmetic of Elliptic Curves, 2nd Edition
 *     Joseph H. Silverman
 *     http://www.pdmi.ras.ru/~lowdimma/BSD/Silverman-Arithmetic_of_EC.pdf
 *
 *   [EFD] Explicit-Formulas Database
 *     Daniel J. Bernstein, Tanja Lange
 *     https://hyperelliptic.org/EFD/index.html
 *
 *   [SAFE] SafeCurves: choosing safe curves for elliptic-curve cryptography
 *     Daniel J. Bernstein
 *     https://safecurves.cr.yp.to/
 *
 *   [4GLV] Refinement of the Four-Dimensional GLV Method on Elliptic Curves
 *     Hairong Yi, Yuqing Zhu, and Dongdai Lin
 *     http://www.site.uottawa.ca/~cadams/papers/prepro/paper_19_slides.pdf
 *
 *   [SSWU1] Efficient Indifferentiable Hashing into Ordinary Elliptic Curves
 *     E. Brier, J. Coron, T. Icart, D. Madore, H. Randriam, M. Tibouchi
 *     https://eprint.iacr.org/2009/340.pdf
 *
 *   [SSWU2] Rational points on certain hyperelliptic curves over finite fields
 *     Maciej Ulas
 *     https://arxiv.org/abs/0706.1448
 *
 *   [H2EC] Hashing to Elliptic Curves
 *     A. Faz-Hernandez, S. Scott, N. Sullivan, R. S. Wahby, C. A. Wood
 *     https://git.io/JeWz6
 *     https://github.com/cfrg/draft-irtf-cfrg-hash-to-curve
 *
 *   [SVDW1] Construction of Rational Points on Elliptic Curves
 *     A. Shallue, C. E. van de Woestijne
 *     https://works.bepress.com/andrew_shallue/1/download/
 *
 *   [SVDW2] Indifferentiable Hashing to Barreto-Naehrig Curves
 *     Pierre-Alain Fouque, Mehdi Tibouchi
 *     https://www.di.ens.fr/~fouque/pub/latincrypt12.pdf
 *
 *   [SVDW3] Covert ECDH over secp256k1
 *     Pieter Wuille
 *     https://gist.github.com/sipa/29118d3fcfac69f9930d57433316c039
 *
 *   [MONT2] Montgomery Curve (wikipedia)
 *     https://en.wikipedia.org/wiki/Montgomery_curve
 *
 *   [MONT3] Montgomery Curves and their arithmetic
 *     C. Costello, B. Smith
 *     https://eprint.iacr.org/2017/212.pdf
 *
 *   [ELL2] Elliptic-curve points indistinguishable from uniform random strings
 *     D. Bernstein, M. Hamburg, A. Krasnova, T. Lange
 *     https://elligator.cr.yp.to/elligator-20130828.pdf
 *
 *   [RFC7748] Elliptic Curves for Security
 *     A. Langley, M. Hamburg, S. Turner
 *     https://tools.ietf.org/html/rfc7748
 *
 *   [TWISTED] Twisted Edwards Curves
 *     D. Bernstein, P. Birkner, M. Joye, T. Lange, C. Peters
 *     https://eprint.iacr.org/2008/013.pdf
 *
 *   [ELL1] Injective Encodings to Elliptic Curves
 *     P. Fouque, A. Joux, M. Tibouchi
 *     https://eprint.iacr.org/2013/373.pdf
 *
 *   [ISOGENY] Twisting Edwards curves with isogenies
 *     Mike Hamburg
 *     https://www.shiftleft.org/papers/isogeny/isogeny.pdf
 *
 *   [RFC8032] Edwards-Curve Digital Signature Algorithm (EdDSA)
 *     S. Josefsson, SJD AB, I. Liusvaara
 *     https://tools.ietf.org/html/rfc8032
 *
 *   [SCHNORR] Schnorr Signatures for secp256k1
 *     Pieter Wuille
 *     https://github.com/sipa/bips/blob/d194620/bip-schnorr.mediawiki
 *
 *   [BIP340] Schnorr Signatures for secp256k1
 *     Pieter Wuille, Jonas Nick, Tim Ruffing
 *     https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki
 *
 *   [JCEN12] Efficient Software Implementation of Public-Key Cryptography
 *            on Sensor Networks Using the MSP430X Microcontroller
 *     C. P. L. Gouvea, L. B. Oliveira, J. Lopez
 *     http://conradoplg.cryptoland.net/files/2010/12/jcen12.pdf
 *
 *   [FIPS186] Federal Information Processing Standards Publication
 *     National Institute of Standards and Technology
 *     https://tinyurl.com/fips-186-3
 *
 *   [RFC5639] Elliptic Curve Cryptography (ECC) Brainpool
 *             Standard Curves and Curve Generation
 *     M. Lochter, BSI, J. Merkle
 *     https://tools.ietf.org/html/rfc5639
 *
 *   [TWISTEQ] Twisted Edwards & Short Weierstrass Equivalence
 *     Christopher Jeffrey
 *     https://gist.github.com/chjj/16ba7fa08d64e8dda269a9fe5b2a8bbc
 *
 *   [ECPM] Elliptic Curve Point Multiplication (wikipedia)
 *     https://en.wikipedia.org/wiki/Elliptic_curve_point_multiplication
 */

'use strict';

const {custom} = __node_require__(33 /* '../internal/custom' */);
const BN = __node_require__(31 /* '../bn' */);

/*
 * Constants
 */

const types = {
  AFFINE: 0,
  JACOBIAN: 1,
  PROJECTIVE: 2,
  EXTENDED: 3
};

const jsfIndex = [
  -3, // -1 -1
  -1, // -1 0
  -5, // -1 1
  -7, // 0 -1
  0, // 0 0
  7, // 0 1
  5, // 1 -1
  1, // 1 0
  3  // 1 1
];

const USE_FIXED = false;

let uid = 0;

/**
 * Curve
 */

class Curve {
  constructor(Point, type, conf) {
    this.Point = null;
    this.id = null;
    this.uid = uid++;
    this.ossl = null;
    this.type = 'base';
    this.endian = 'be';
    this.hash = null;
    this.prefix = null;
    this.context = false;
    this.prime = null;
    this.p = null;
    this.red = null;
    this.fieldSize = 0;
    this.fieldBits = 0;
    this.adjustedSize = 0;
    this.signBit = 0;
    this.mask = 0;
    this.n = null;
    this.h = null;
    this.q = null;
    this.z = null;
    this.g = null;
    this.nh = null;
    this.scalarSize = 0;
    this.scalarBits = 0;
    this.zero = null;
    this.one = null;
    this.two = null;
    this.three = null;
    this.four = null;
    this.i2 = null;
    this.i3 = null;
    this.i4 = null;
    this.i6 = null;
    this.torsion = null;
    this.endo = null;
    this.hi = null;
    this._init(Point, type, conf);
  }

  _init(Point, type, conf) {
    assert(typeof Point === 'function');
    assert(typeof type === 'string');
    assert(conf && typeof conf === 'object');
    assert(conf.red == null || (conf.red instanceof BN.Red));
    assert(conf.p != null, 'Must pass a prime.');
    assert(conf.id == null || typeof conf.id === 'string');
    assert(conf.ossl == null || typeof conf.ossl === 'string');
    assert(conf.endian == null || typeof conf.endian === 'string');
    assert(conf.hash == null || typeof conf.hash === 'string');
    assert(conf.prefix == null || typeof conf.prefix === 'string');
    assert(conf.context == null || typeof conf.context === 'boolean');
    assert(conf.prime == null || typeof conf.prime === 'string');
    assert(conf.torsion == null || Array.isArray(conf.torsion));

    // Point class.
    this.Point = Point;

    // Meta.
    this.id = conf.id || null;
    this.ossl = conf.ossl || null;
    this.type = type;
    this.endian = conf.endian || (type === 'short' ? 'be' : 'le');
    this.hash = conf.hash || null;
    this.prefix = conf.prefix ? Buffer.from(conf.prefix, 'binary') : null;
    this.context = conf.context || false;
    this.prime = conf.prime || null;

    // Prime.
    this.p = BN.fromJSON(conf.p);

    // Reduction.
    if (conf.red) {
      this.red = conf.red;
    } else {
      // Use Montgomery when there is no fast reduction for the prime.
      this.red = conf.prime ? BN.red(conf.prime) : BN.mont(this.p);
      this.red.precompute();
    }

    // Precalculate encoding length.
    this.fieldSize = this.p.byteLength();
    this.fieldBits = this.p.bitLength();
    this.adjustedSize = this.fieldSize + ((this.fieldBits & 7) === 0);
    this.signBit = this.adjustedSize * 8 - 1;
    this.mask = 0xff;

    if ((this.fieldBits & 7) !== 0)
      this.mask = (1 << (this.fieldBits & 7)) - 1;

    // Curve configuration, optional.
    this.n = BN.fromJSON(conf.n || '0');
    this.h = BN.fromJSON(conf.h || '1');
    this.q = this.n.mul(this.h);
    this.z = BN.fromJSON(conf.z || '0').toRed(this.red);
    this.g = null;
    this.nh = this.n.ushrn(1);
    this.scalarSize = this.n.byteLength();
    this.scalarBits = this.n.bitLength();

    // Useful for many curves.
    this.zero = new BN(0).toRed(this.red);
    this.one = new BN(1).toRed(this.red);
    this.two = new BN(2).toRed(this.red);
    this.three = new BN(3).toRed(this.red);
    this.four = new BN(4).toRed(this.red);

    // Inverses.
    this.i2 = this.two.redInvert();
    this.i3 = this.three.redInvert();
    this.i4 = this.i2.redSqr();
    this.i6 = this.i2.redMul(this.i3);

    // Torsion.
    this.torsion = new Array(this.h.word(0));

    for (let i = 0; i < this.torsion.length; i++)
      this.torsion[i] = this.point();

    // Endomorphism.
    this.endo = null;

    // Cache.
    this.hi = null;

    // Memoize.
    this._scale = memoize(this._scale, this);
    this.isIsomorphic = memoize(this.isIsomorphic, this);
    this.isIsogenous = memoize(this.isIsogenous, this);

    // Sanity checks.
    assert(this.p.sign() > 0 && this.p.isOdd());
    assert(this.n.sign() >= 0);
    assert(this.h.sign() > 0 && this.h.cmpn(255) <= 0);
    assert(this.endian === 'be' || this.endian === 'le');

    return this;
  }

  _finalize(conf) {
    assert(conf && typeof conf === 'object');

    // Create base point.
    this.g = conf.g ? this.pointFromJSON(conf.g) : this.point();

    // Parse small order points.
    if (conf.torsion) {
      assert(conf.torsion.length === this.torsion.length);

      for (let i = 0; i < this.torsion.length; i++)
        this.torsion[i] = this.pointFromJSON(conf.torsion[i]);
    }

    return this;
  }

  _findTorsion() {
    // Find all torsion points by grinding.
    assert(!this.n.isZero());

    const h = this.h.word(0);
    const x = this.one.redNeg();
    const out = [this.point()];
    const set = new Set();

    let len = h;

    while (out.length < len) {
      let p;

      x.redIAdd(this.one);

      try {
        p = this.pointFromX(x.clone());
      } catch (e) {
        continue;
      }

      try {
        p = p.mul(this.n);
      } catch (e) {
        len = 2;
        continue;
      }

      if (p.isInfinity())
        continue;

      p.normalize();

      for (const point of [p, p.neg()]) {
        const key = point.key();

        if (!set.has(key)) {
          out.push(point);
          set.add(key);
        }
      }
    }

    out.sort((a, b) => a.cmp(b));

    while (out.length < h)
      out.push(this.point());

    return out;
  }

  _fixedMul(p, k) {
    // Fixed-base method for point multiplication.
    //
    // [ECPM] "Windowed method".
    // [GECC] Page 95, Section 3.3.
    //
    // Windows are appropriately shifted to avoid any
    // doublings. This reduces a 256 bit multiplication
    // down to 64 additions with a window size of 4.
    assert(p instanceof Point);
    assert(k instanceof BN);
    assert(p.pre && p.pre.windows);

    // Get precomputed windows.
    const {width, points} = p._getWindows(0, 0);

    // Recompute window size.
    const size = 1 << width;

    // Recompute steps.
    const bits = k.bitLength();
    const steps = ((bits + width - 1) / width) >>> 0;

    // Multiply.
    let acc = this.jpoint();

    for (let i = 0; i < steps; i++) {
      const bits = k.bits(i * width, width);

      acc = acc.add(points[i * size + bits]);
    }

    // Adjust sign.
    if (k.isNeg())
      acc = acc.neg();

    return acc;
  }

  _fixedNafMul(p, k) {
    // Fixed-base NAF windowing method for point multiplication.
    //
    // [GECC] Algorithm 3.42, Page 105, Section 3.3.
    assert(p instanceof Point);
    assert(k instanceof BN);
    assert(p.pre && p.pre.doubles);

    // Get precomputed doubles.
    const {step, points} = p._getDoubles(0, 0);

    // Get fixed NAF (in a more windowed form).
    const naf = getFixedNAF(k, 2, k.bitLength() + 1, step);

    // Compute steps.
    const I = ((1 << (step + 1)) - (step % 2 === 0 ? 2 : 1)) / 3;

    // Multiply.
    let a = this.jpoint();
    let b = this.jpoint();

    for (let i = I; i > 0; i--) {
      for (let j = 0; j < naf.length; j++) {
        const nafW = naf[j];

        if (nafW === i)
          b = b.add(points[j]);
        else if (nafW === -i)
          b = b.sub(points[j]);
      }

      a = a.add(b);
    }

    return a;
  }

  _wnafMul(w, p, k) {
    // Window NAF method for point multiplication.
    //
    // [GECC] Algorithm 3.36, Page 100, Section 3.3.
    assert(p instanceof Point);
    assert(k instanceof BN);

    // Precompute window.
    const {width, points} = p._safeNAF(w);

    // Get NAF form.
    const naf = getNAF(k, width, k.bitLength() + 1);

    // Add `this`*(N+1) for every w-NAF index.
    let acc = this.jpoint();

    for (let i = naf.length - 1; i >= 0; i--) {
      const z = naf[i];

      if (i !== naf.length - 1)
        acc = acc.dbl();

      if (z > 0)
        acc = acc.add(points[(z - 1) >> 1]);
      else if (z < 0)
        acc = acc.sub(points[(-z - 1) >> 1]);
    }

    return acc;
  }

  _wnafMulAdd(w, points, coeffs) {
    // Multiple point multiplication, also known
    // as "Shamir's trick" (with interleaved NAFs).
    //
    // [GECC] Algorithm 3.48, Page 109, Section 3.3.3.
    //        Algorithm 3.51, Page 112, Section 3.3.
    //
    // This is particularly useful for signature
    // verifications and mutiplications after an
    // endomorphism split.
    assert((w >>> 0) === w);
    assert(Array.isArray(points));
    assert(Array.isArray(coeffs));
    assert(points.length === coeffs.length);

    const length = points.length;
    const wnd = new Array(length);
    const naf = new Array(length);

    // Check arrays and calculate size.
    let max = 0;

    for (let i = 0; i < length; i++) {
      const point = points[i];
      const coeff = coeffs[i];

      assert(point instanceof Point);
      assert(coeff instanceof BN);

      if (i > 0 && point.type !== points[i - 1].type)
        throw new Error('Cannot mix points.');

      // Avoid sparse arrays.
      wnd[i] = null;
      naf[i] = null;

      // Compute max scalar size.
      max = Math.max(max, coeff.bitLength() + 1);
    }

    // Compute NAFs.
    let ppoint = null;
    let pcoeff = null;
    let len = 0;

    for (let i = 0; i < length; i++) {
      const point = points[i];
      const coeff = coeffs[i];
      const pre = point._getNAF(0);

      // Use precomputation if available.
      if (pre) {
        wnd[len] = pre.points;
        naf[len] = getNAF(coeff, pre.width, max);
        len += 1;
        continue;
      }

      // Save last non-precomputed point.
      if (!ppoint) {
        ppoint = point;
        pcoeff = coeff;
        continue;
      }

      // Compute JSF in NAF form.
      wnd[len] = ppoint._getJNAF(point);
      naf[len] = getJNAF(pcoeff, coeff, max);

      ppoint = null;
      pcoeff = null;

      len += 1;
    }

    // Regular NAF for odd points.
    if (ppoint) {
      const nafw = ppoint._safeNAF(w);

      wnd[len] = nafw.points;
      naf[len] = getNAF(pcoeff, nafw.width, max);

      len += 1;
    }

    // Multiply and add.
    let acc = this.jpoint();

    for (let i = max - 1; i >= 0; i--) {
      if (i !== max - 1)
        acc = acc.dbl();

      for (let j = 0; j < len; j++) {
        const z = naf[j][i];

        if (z > 0)
          acc = acc.add(wnd[j][(z - 1) >> 1]);
        else if (z < 0)
          acc = acc.sub(wnd[j][(-z - 1) >> 1]);
      }
    }

    return acc;
  }

  _endoWnafMulAdd(points, coeffs) {
    throw new Error('Not implemented.');
  }

  _scale(curve, invert) {
    assert(curve instanceof Curve);
    assert(curve.p.eq(this.p));

    switch (curve.type) {
      case 'short':
        return this._scaleShort(curve, invert);
      case 'mont':
        return this._scaleMont(curve, invert);
      case 'edwards':
        return this._scaleEdwards(curve, invert);
      default:
        throw new Error('Not implemented.');
    }
  }

  _scaleShort(curve, invert) {
    throw new Error('Not implemented.');
  }

  _scaleMont(curve, invert) {
    throw new Error('Not implemented.');
  }

  _scaleEdwards(curve, invert) {
    throw new Error('Not implemented.');
  }

  isElliptic() {
    throw new Error('Not implemented.');
  }

  jinv() {
    throw new Error('Not implemented.');
  }

  isComplete() {
    return false;
  }

  precompute(rng) {
    assert(!this.g.isInfinity(), 'Must have base point.');
    assert(!this.n.isZero(), 'Must have order.');

    this.g.precompute(this.n.bitLength(), rng);

    return this;
  }

  scalar(num, base, endian) {
    const k = new BN(num, base, endian);

    assert(!k.red);

    if (this.n.isZero())
      return k;

    return k.imod(this.n);
  }

  field(num, base, endian) {
    const x = BN.cast(num, base, endian);

    if (x.red)
      return x.forceRed(this.red);

    return x.toRed(this.red);
  }

  point(x, y) {
    throw new Error('Not implemented.');
  }

  jpoint(x, y, z) {
    throw new Error('Not implemented.');
  }

  xpoint(x, z) {
    throw new Error('Not implemented.');
  }

  cpoint(xx, xz, yy, yz) {
    assert(xx instanceof BN);
    assert(xz instanceof BN);
    assert(yy instanceof BN);
    assert(yz instanceof BN);

    if (xz.isZero() || yz.isZero())
      return this.point();

    const z = xz.redMul(yz).redInvert();
    const x = xx.redMul(yz).redMul(z);
    const y = yy.redMul(xz).redMul(z);

    return this.point(x, y);
  }

  solveX2(y) {
    throw new Error('Not implemented.');
  }

  solveX(y) {
    return this.solveX2(y).redSqrt();
  }

  solveY2(x) {
    throw new Error('Not implemented.');
  }

  solveY(x) {
    return this.solveY2(x).redSqrt();
  }

  validate(point) {
    throw new Error('Not implemented.');
  }

  pointFromX(x, sign) {
    throw new Error('Not implemented.');
  }

  pointFromY(y, sign) {
    throw new Error('Not implemented.');
  }

  isIsomorphic(curve) {
    throw new Error('Not implemented.');
  }

  isIsogenous(curve) {
    throw new Error('Not implemented.');
  }

  pointFromShort(point) {
    throw new Error('Not implemented.');
  }

  pointFromMont(point, sign) {
    throw new Error('Not implemented.');
  }

  pointFromEdwards(point) {
    throw new Error('Not implemented.');
  }

  pointFromUniform(u) {
    throw new Error('Not implemented.');
  }

  pointToUniform(p) {
    throw new Error('Not implemented.');
  }

  pointFromHash(bytes, pake = false) {
    // [H2EC] "Roadmap".
    assert(Buffer.isBuffer(bytes));
    assert(typeof pake === 'boolean');

    if (bytes.length !== this.fieldSize * 2)
      throw new Error('Invalid hash size.');

    // Random oracle encoding.
    // Ensure a proper distribution.
    const s1 = bytes.slice(0, this.fieldSize);
    const s2 = bytes.slice(this.fieldSize);
    const u1 = this.decodeUniform(s1);
    const u2 = this.decodeUniform(s2);
    const p1 = this.pointFromUniform(u1);
    const p2 = this.pointFromUniform(u2);
    const p3 = p1.add(p2);

    return pake ? p3.mulH() : p3;
  }

  pointToHash(p, subgroup, rng) {
    // [SQUARED] Algorithm 1, Page 8, Section 3.3.
    assert(p instanceof this.Point);
    assert((subgroup >>> 0) === subgroup);

    // Add a random torsion component.
    const i = subgroup % this.torsion.length;
    const p0 = p.add(this.torsion[i]);

    // Average Cost (R = sqrt):
    //
    //   SSWU (~4 iterations) => 8I + 16R
    //   SVDW (~4 iterations) => 12I + 28R
    //   Elligator 1 (~2 iterations) => 6I + 10R
    //   Elligator 2 (~2 iterations) => 4I + 6R
    //   Ristretto (~1 iteration) => 1I + 2R + h*1R
    for (;;) {
      const u1 = this.randomField(rng);
      const p1 = this.pointFromUniform(u1);

      // Avoid 2-torsion points:
      //   Short Weierstrass: ((A / 3) / B, 0)
      //   Montgomery: (0, 0)
      //   Twisted Edwards: (0, -1)
      if (p1.neg().eq(p1))
        continue;

      const p2 = p0.sub(p1);
      const hint = randomInt(rng);

      let u2;
      try {
        u2 = this.pointToUniform(p2, hint & 15);
      } catch (e) {
        if (e.message === 'Invalid point.')
          continue;
        throw e;
      }

      const s1 = this.encodeUniform(u1, hint >>> 8);
      const s2 = this.encodeUniform(u2, hint >>> 16);

      return Buffer.concat([s1, s2]);
    }
  }

  randomScalar(rng) {
    const max = this.n.isZero() ? this.p : this.n;
    return BN.random(rng, 1, max);
  }

  randomField(rng) {
    return BN.random(rng, 1, this.p).toRed(this.red);
  }

  randomPoint(rng) {
    let p;

    for (;;) {
      const x = this.randomField(rng);
      const sign = (randomInt(rng) & 1) !== 0;

      try {
        p = this.pointFromX(x, sign);
      } catch (e) {
        continue;
      }

      assert(p.validate());

      return p.mulH();
    }
  }

  mulAll(points, coeffs) {
    return this.jmulAll(points, coeffs);
  }

  jmulAll(points, coeffs) {
    assert(Array.isArray(points));
    assert(points.length === 0 || (points[0] instanceof Point));

    // Multiply with endomorphism if we're using affine points.
    if (this.endo && points.length > 0 && points[0].type === types.AFFINE)
      return this._endoWnafMulAdd(points, coeffs);

    // Otherwise, a regular Shamir's trick.
    return this._wnafMulAdd(5, points, coeffs);
  }

  mulH(k) {
    assert(k instanceof BN);
    return this.imulH(k.clone());
  }

  imulH(k) {
    assert(k instanceof BN);
    assert(!k.red);

    const word = this.h.word(0);

    // Optimize for powers of two.
    if ((word & (word - 1)) === 0) {
      const bits = this.h.bitLength();
      return k.iushln(bits - 1).imod(this.n);
    }

    return k.imuln(word).imod(this.n);
  }

  normalizeAll(points) {
    assert(Array.isArray(points));

    const len = points.length;
    const z = new Array(len);

    for (let i = 0; i < len; i++) {
      const p = points[i];

      assert(p instanceof Point);
      assert(p.curve === this);

      if (p.type === types.AFFINE) {
        z[i] = this.one;
        continue;
      }

      z[i] = p.z;
    }

    const zi = this.red.invertAll(z);
    const out = new Array(len);

    for (let i = 0; i < len; i++)
      out[i] = points[i].scale(zi[i]);

    return out;
  }

  affinizeAll(points) {
    return this.normalizeAll(points);
  }

  clamp(scalar) {
    // [RFC7748] Page 8, Section 5.
    // [RFC8032] Section 5.1.5 & 5.2.5.
    assert(Buffer.isBuffer(scalar));
    assert(scalar.length === this.scalarSize);
    assert(this.scalarSize <= this.fieldSize);

    let top = (this.fieldBits & 7) || 8;
    let lsb = 0;
    let msb = this.scalarSize - 1;

    // Swap endianness.
    if (this.endian === 'be')
      [lsb, msb] = [msb, lsb];

    // Adjust for low order.
    if (this.scalarSize < this.fieldSize)
      top = 8;

    // Ensure a multiple of the cofactor.
    scalar[lsb] &= -this.h.word(0) & 0xff;

    // Clamp to the prime.
    scalar[msb] &= (1 << top) - 1;

    // Set the high bit.
    scalar[msb] |= 1 << (top - 1);

    return scalar;
  }

  splitHash(bytes) {
    // [RFC8032] Section 5.1.6 & 5.2.6.
    assert(Buffer.isBuffer(bytes));
    assert(bytes.length === this.adjustedSize * 2);
    assert(this.scalarSize <= this.adjustedSize);

    let off = 0;

    if (this.endian === 'be')
      off = this.adjustedSize - this.scalarSize;

    const scalar = bytes.slice(off, off + this.scalarSize);
    const prefix = bytes.slice(this.adjustedSize);

    this.clamp(scalar);

    return [scalar, prefix];
  }

  encodeField(x) {
    // [SEC1] Page 12, Section 2.3.5.
    assert(x instanceof BN);
    assert(!x.red);

    return x.encode(this.endian, this.fieldSize);
  }

  decodeField(bytes) {
    // [SEC1] Page 13, Section 2.3.6.
    assert(Buffer.isBuffer(bytes));

    if (bytes.length !== this.fieldSize)
      throw new Error('Invalid field element size.');

    return BN.decode(bytes, this.endian);
  }

  encodeAdjusted(x) {
    assert(x instanceof BN);
    assert(!x.red);

    return x.encode(this.endian, this.adjustedSize);
  }

  decodeAdjusted(bytes) {
    assert(Buffer.isBuffer(bytes));

    if (bytes.length !== this.adjustedSize)
      throw new Error('Invalid field element size.');

    return BN.decode(bytes, this.endian);
  }

  encodeScalar(k) {
    // [SEC1] Page 13, Section 2.3.7.
    assert(k instanceof BN);
    assert(!k.red);

    return k.encode(this.endian, this.scalarSize);
  }

  decodeScalar(bytes) {
    // [SEC1] Page 14, Section 2.3.8.
    assert(Buffer.isBuffer(bytes));

    if (bytes.length !== this.scalarSize)
      throw new Error('Invalid scalar size.');

    return BN.decode(bytes, this.endian);
  }

  encodeClamped(k) {
    // [RFC7748] Page 8, Section 5.
    // [RFC8032] Section 5.1.5 & 5.2.5.
    return this.clamp(this.encodeScalar(k));
  }

  decodeClamped(bytes) {
    // [RFC7748] Page 8, Section 5.
    // [RFC8032] Section 5.1.5 & 5.2.5.
    assert(Buffer.isBuffer(bytes));

    if (bytes.length !== this.scalarSize)
      throw new Error('Invalid scalar size.');

    const clamped = this.clamp(Buffer.from(bytes));

    return BN.decode(clamped, this.endian);
  }

  encodeUniform(x, bits) {
    assert(x instanceof BN);
    assert((bits >>> 0) === bits);

    const msb = this.endian === 'le' ? this.fieldSize - 1 : 0;
    const bytes = x.fromRed().encode(this.endian, this.fieldSize);

    bytes[msb] |= (bits & ~this.mask) & 0xff;

    return bytes;
  }

  decodeUniform(bytes) {
    assert(Buffer.isBuffer(bytes));

    if (bytes.length !== this.fieldSize)
      throw new Error('Invalid field size.');

    const x = BN.decode(bytes, this.endian);

    x.iumaskn(this.fieldBits);

    return x.toRed(this.red);
  }

  encodePoint(point, compact) {
    assert(point instanceof Point);
    return point.encode(compact);
  }

  decodePoint(bytes) {
    throw new Error('Not implemented.');
  }

  encodeX(point) {
    throw new Error('Not implemented.');
  }

  decodeX(bytes) {
    throw new Error('Not implemented.');
  }

  decodeEven(bytes) {
    throw new Error('Not implemented.');
  }

  decodeSquare(bytes) {
    throw new Error('Not implemented.');
  }

  toShort() {
    throw new Error('Not implemented.');
  }

  toMont(b0) {
    throw new Error('Not implemented.');
  }

  toEdwards(a0) {
    throw new Error('Not implemented.');
  }

  pointToJSON(point, pre) {
    assert(point instanceof Point);
    return point.toJSON(pre);
  }

  pointFromJSON(json) {
    throw new Error('Not implemented.');
  }

  toJSON(pre) {
    let prefix, context;
    let n, z, endo;

    if (this.type === 'edwards') {
      prefix = this.prefix ? this.prefix.toString() : null;
      context = this.context;
    }

    if (!this.n.isZero())
      n = this.n.toJSON();

    if (!this.z.isZero()) {
      z = this.z.fromRed();

      if (this.z.redIsHigh())
        z.isub(this.p);

      z = z.toString(16);
    }

    if (this.endo)
      endo = this.endo.toJSON();

    return {
      id: this.id,
      ossl: this.ossl,
      type: this.type,
      endian: this.endian,
      hash: this.hash,
      prefix,
      context,
      prime: this.prime,
      p: this.p.toJSON(),
      a: undefined,
      b: undefined,
      d: undefined,
      n,
      h: this.h.toString(16),
      s: undefined,
      z,
      c: undefined,
      g: this.g.toJSON(pre),
      endo
    };
  }

  static fromJSON(json) {
    return new this(json);
  }
}

/**
 * Point
 */

class Point {
  constructor(curve, type) {
    assert(curve instanceof Curve);
    assert((type >>> 0) === type);

    this.curve = curve;
    this.type = type;
    this.pre = null;
  }

  _init() {
    throw new Error('Not implemented.');
  }

  _safeNAF(width) {
    assert((width >>> 0) === width);

    if (this.pre && this.pre.naf)
      return this.pre.naf;

    if (width === 0)
      return null;

    const size = 1 << (width - 2);
    const points = new Array(size);
    const p = this.toJ();
    const dbl = size === 1 ? null : p.dbl();

    points[0] = p;

    for (let i = 1; i < size; i++)
      points[i] = points[i - 1].add(dbl);

    return new NAF(width, points);
  }

  _getNAF(width) {
    assert((width >>> 0) === width);

    if (this.pre && this.pre.naf)
      return this.pre.naf;

    if (width === 0)
      return null;

    const odds = this._safeNAF(width).points;
    const points = this.curve.affinizeAll(odds);

    return new NAF(width, points);
  }

  _getWindows(width, bits) {
    assert((width >>> 0) === width);
    assert((bits >>> 0) === bits);

    if (this.pre && this.pre.windows)
      return this.pre.windows;

    if (width === 0)
      return null;

    const size = 1 << width;
    const steps = ((bits + width - 1) / width) >>> 0;
    const wnds = new Array(steps * size);

    let g = this.toJ();

    for (let i = 0; i < steps; i++) {
      wnds[i * size] = this.curve.jpoint();

      for (let j = 1; j < size; j++)
        wnds[i * size + j] = wnds[i * size + j - 1].add(g);

      g = g.dblp(width);
    }

    const points = this.curve.affinizeAll(wnds);

    return new Windows(width, bits, points);
  }

  _getDoubles(step, power) {
    assert((step >>> 0) === step);
    assert((power >>> 0) === power);

    if (this.pre && this.pre.doubles)
      return this.pre.doubles;

    if (step === 0)
      return null;

    const len = Math.ceil(power / step) + 1;
    const dbls = new Array(len);

    let acc = this.toJ();
    let k = 0;

    dbls[k++] = acc;

    for (let i = 0; i < power; i += step) {
      for (let j = 0; j < step; j++)
        acc = acc.dbl();

      dbls[k++] = acc;
    }

    assert(k === len);

    const points = this.curve.affinizeAll(dbls);

    return new Doubles(step, points);
  }

  _getBeta() {
    return null;
  }

  _getBlinding(rng) {
    if (this.pre && this.pre.blinding)
      return this.pre.blinding;

    if (!rng)
      return null;

    if (this.curve.n.isZero())
      return null;

    // Pregenerate a random blinding value:
    //
    //   blind = random integer in [1,n-1]
    //   unblind = G * blind
    //
    // We intend to subtract the blinding value
    // from scalars before multiplication. We
    // can add the unblinding point once the
    // multiplication is complete.
    const blind = this.curve.randomScalar(rng);
    const unblind = this.mul(blind);

    return new Blinding(blind, unblind);
  }

  _hasWindows(k) {
    assert(k instanceof BN);

    if (!this.pre || !this.pre.windows)
      return false;

    const {width, bits} = this.pre.windows;
    const steps = ((bits + width - 1) / width) >>> 0;

    return k.bitLength() <= steps * width;
  }

  _hasDoubles(k) {
    assert(k instanceof BN);

    if (!this.pre || !this.pre.doubles)
      return false;

    const {step, points} = this.pre.doubles;
    const power = k.bitLength() + 1;

    return points.length >= Math.ceil(power / step) + 1;
  }

  _getJNAF(point) {
    assert(point instanceof Point);
    assert(point.type === this.type);

    // Create comb for JSF.
    return [
      this, // 1
      this.add(point), // 3
      this.sub(point), // 5
      point // 7
    ];
  }

  _blind(k, rng) {
    // [SIDE1] Page 5, Section 4.
    // [BLIND] Page 20, Section 7.
    assert(k instanceof BN);
    assert(!k.red);

    // Scalar splitting (requires precomputation).
    //
    // Blind a multiplication by first subtracting
    // a blinding value from the scalar. Example:
    //
    //   b = random integer in [1,n-1]
    //   B = P * b (precomputed)
    //   Q = P * (k - b) + B
    //
    // Note that Joye describes a different method
    // (multiplier randomization) which computes:
    //
    //   B = random point in E
    //   Q = (P + B) * k - B * k
    //
    // Our method is more similar to the "scalar
    // splitting" technique described in the
    // second source above.
    //
    // The blinding value and its corresponding
    // point are randomly generated and computed
    // on boot. As long as an attacker is not
    // able to observe the boot, this should give
    // a decent bit of protection against various
    // channel attacks.
    if (this.pre && this.pre.blinding) {
      const {blind, unblind} = this.pre.blinding;
      const t = k.sub(blind);

      return [this, t, unblind];
    }

    // Randomization is not possible without
    // an RNG. Do a normal multiplication.
    if (!rng)
      return [this, k, null];

    // If we have no precomputed blinding
    // factor, there are two possibilities
    // for randomization:
    //
    // 1. Randomize the multiplier by adding
    //    a random multiple of `n`.
    //
    // 2. Re-scale the point itself by a
    //    random factor.
    //
    // The first option can be accomplished
    // with some like:
    //
    //   a = random integer in [1,n-1]
    //   r = a * n
    //   Q = P * (k + r)
    //
    // The second is accomplished with:
    //
    //   a = random element in F(p)
    //   R = (x * a^2, y * a^3, z * a)
    //   Q = R * k
    //
    // If we have precomputed doubles / naf
    // points, we opt for the first method
    // to avoid randomizing everything.
    if (this.pre) {
      if (this.curve.n.isZero())
        return [this, k, null];

      const a = this.curve.randomScalar(rng);
      const r = a.mul(this.curve.n);
      const t = r.iadd(k);

      return [this, t, null];
    }

    // If there is no precomputation _at all_,
    // we opt for the second method.
    const p = this.randomize(rng);

    return [p, k, null];
  }

  clone() {
    throw new Error('Not implemented.');
  }

  precompute(bits, rng) {
    assert((bits >>> 0) === bits);

    if (!this.pre)
      this.pre = new Precomp();

    if (!this.pre.naf)
      this.pre.naf = this._getNAF(9);

    if (USE_FIXED && !this.pre.windows)
      this.pre.windows = this._getWindows(4, bits);

    if (!this.pre.doubles)
      this.pre.doubles = this._getDoubles(4, bits + 1);

    if (!this.pre.beta)
      this.pre.beta = this._getBeta();

    if (!this.pre.blinding)
      this.pre.blinding = this._getBlinding(rng);

    return this;
  }

  validate() {
    return this.curve.validate(this);
  }

  normalize() {
    return this;
  }

  scale(a) {
    throw new Error('Not implemented.');
  }

  randomize(rng) {
    const z = this.curve.randomField(rng);
    return this.scale(z);
  }

  neg() {
    throw new Error('Not implemented.');
  }

  add(point) {
    throw new Error('Not implemented.');
  }

  sub(point) {
    assert(point instanceof Point);
    return this.add(point.neg());
  }

  dbl() {
    throw new Error('Not implemented.');
  }

  dblp(pow) {
    // Repeated doubling. This can
    // be optimized by child classes.
    assert((pow >>> 0) === pow);

    let r = this;

    for (let i = 0; i < pow; i++)
      r = r.dbl();

    return r;
  }

  diffAddDbl(p, q) {
    throw new Error('Not implemented.');
  }

  getX() {
    throw new Error('Not implemented.');
  }

  getY() {
    throw new Error('Not implemented.');
  }

  eq(point) {
    throw new Error('Not implemented.');
  }

  cmp(point) {
    throw new Error('Not implemented.');
  }

  isInfinity() {
    throw new Error('Not implemented.');
  }

  isOrder2() {
    throw new Error('Not implemented.');
  }

  isOdd() {
    throw new Error('Not implemented.');
  }

  isEven() {
    throw new Error('Not implemented.');
  }

  isSquare() {
    throw new Error('Not implemented.');
  }

  eqX(x) {
    throw new Error('Not implemented.');
  }

  eqR(x) {
    throw new Error('Not implemented.');
  }

  isSmall() {
    // Test whether the point is of small order.
    if (this.isInfinity())
      return false;

    // P * h = O
    return this.jmulH().isInfinity();
  }

  hasTorsion() {
    // Test whether the point is in another subgroup.
    if (this.isInfinity())
      return false;

    // P * n != O
    return !this.jmul(this.curve.n).isInfinity();
  }

  order() {
    // Calculate point order.
    const {h, n} = this.curve;

    let p = this.toJ();
    let q = new BN(1);

    while (!p.isInfinity()) {
      q.iaddn(1);

      if (q.cmp(h) > 0) {
        q = n.clone();
        break;
      }

      p = p.add(this);
    }

    return q;
  }

  mul(k) {
    return this.jmul(k);
  }

  muln(k) {
    return this.jmuln(k);
  }

  mulBlind(k, rng) {
    return this.jmulBlind(k, rng);
  }

  mulAdd(k1, p2, k2) {
    return this.jmulAdd(k1, p2, k2);
  }

  mulH() {
    return this.jmulH();
  }

  div(k) {
    return this.jdiv(k);
  }

  divn(k) {
    return this.jdivn(k);
  }

  divH() {
    return this.jdivH();
  }

  jmul(k) {
    if (USE_FIXED && this._hasWindows(k))
      return this.curve._fixedMul(this, k);

    if (this._hasDoubles(k))
      return this.curve._fixedNafMul(this, k);

    if (this.curve.endo && this.type === types.AFFINE)
      return this.curve._endoWnafMulAdd([this], [k]);

    return this.curve._wnafMul(5, this, k);
  }

  jmuln(k) {
    assert((k | 0) === k);
    return this.jmul(new BN(k));
  }

  jmulBlind(k, rng = null) {
    const [p, t, unblind] = this._blind(k, rng);
    const q = p.jmul(t);

    if (unblind)
      return q.add(unblind);

    return q;
  }

  jmulAdd(k1, p2, k2) {
    if (this.curve.endo && this.type === types.AFFINE)
      return this.curve._endoWnafMulAdd([this, p2], [k1, k2]);

    return this.curve._wnafMulAdd(5, [this, p2], [k1, k2]);
  }

  jmulH() {
    const word = this.curve.h.word(0);

    // Optimize for powers of two.
    if ((word & (word - 1)) === 0) {
      const bits = this.curve.h.bitLength();
      return this.toJ().dblp(bits - 1);
    }

    return this.jmul(this.curve.h);
  }

  jdiv(k) {
    assert(k instanceof BN);
    assert(!k.red);

    return this.jmul(k.invert(this.curve.n));
  }

  jdivn(k) {
    assert(!this.curve.n.isZero());

    if (this.curve.h.cmpn(k) === 0)
      return this.jdivH();

    return this.jdiv(new BN(k));
  }

  jdivH() {
    if (this.curve.n.isZero())
      return this.toJ();

    if (this.curve.h.cmpn(1) === 0)
      return this.toJ();

    if (this.curve.hi === null)
      this.curve.hi = this.curve.h.invert(this.curve.n);

    return this.jmul(this.curve.hi);
  }

  toP() {
    return this.normalize();
  }

  toJ() {
    return this;
  }

  toX() {
    return this;
  }

  key() {
    if (this.isInfinity())
      return `${this.curve.uid}:oo`;

    this.normalize();

    const x = this.getX().toString(16);
    const y = this.getY().toString(16);

    return `${this.curve.uid}:${x},${y}`;
  }

  encode(compact) {
    throw new Error('Not implemented.');
  }

  static decode(curve, bytes) {
    throw new Error('Not implemented.');
  }

  encodeX() {
    throw new Error('Not implemented.');
  }

  static decodeX(curve, bytes) {
    throw new Error('Not implemented.');
  }

  static decodeEven(curve, bytes) {
    throw new Error('Not implemented.');
  }

  static decodeSquare(curve, bytes) {
    throw new Error('Not implemented.');
  }

  toJSON(pre) {
    throw new Error('Not implemented.');
  }

  static fromJSON(curve, json) {
    throw new Error('Not implemented.');
  }

  [custom]() {
    return '<Point>';
  }
}

/**
 * ShortCurve
 */

class ShortCurve extends Curve {
  constructor(conf) {
    super(ShortPoint, 'short', conf);

    this.a = BN.fromJSON(conf.a).toRed(this.red);
    this.b = BN.fromJSON(conf.b).toRed(this.red);
    this.c = BN.fromJSON(conf.c || '0').toRed(this.red);
    this.ai = this.a.isZero() ? this.zero : this.a.redInvert();
    this.zi = this.z.isZero() ? this.zero : this.z.redInvert();

    this.zeroA = this.a.isZero();
    this.threeA = this.a.eq(this.three.redNeg());
    this.redN = this.n.toRed(this.red);
    this.pmodn = this.p.clone();
    this.highOrder = this.n.cmp(this.p) >= 0;
    this.smallGap = false;

    this._finalize(conf);
  }

  _finalize(conf) {
    super._finalize(conf);

    // Precalculate endomorphism.
    if (conf.endo != null)
      this.endo = Endo.fromJSON(this, conf.endo);
    else
      this.endo = this._getEndomorphism();

    if (!this.n.isZero()) {
      this.pmodn = this.p.mod(this.n);

      // Check for Maxwell's trick (see eqR).
      this.smallGap = this.p.div(this.n).cmpn(1) <= 0;
    }

    return this;
  }

  static _isomorphism(curveA, curveB, custom, odd) {
    // Short Weierstrass Isomorphism.
    //
    // [GECC] Page 84, Section 3.1.5.
    // [ARITH1] Page 274, Section 13.1.5.
    // [ALT] Appendix F.3 (Isomorphic Mapping between Weierstrass Curves).
    //
    // Find `u` such that `a * u^4 = a'` and `b * u^6 = b'`.
    //
    // Transformation:
    //
    //   u4 = a' / a
    //   u2 = +-sqrt(u4)
    //   u6 = u4 * u2
    //   a' = a * u4
    //   b' = b * u6
    //
    // Where `u2` is any root that is square.
    //
    // If a = 0, we can do:
    //
    //   a' = 0
    //   b' = b'
    //
    // Where (b' / b)^(1 / 3) is square.
    //
    // If b = 0, we can do:
    //
    //   a' = a'
    //   b' = 0
    //
    // Where sqrt(a' / a) is square.
    assert(curveA instanceof BN);
    assert(curveB instanceof BN);
    assert(custom instanceof BN);
    assert(odd == null || typeof odd === 'boolean');
    assert(!curveA.isZero() || !curveB.isZero());

    if (custom.isZero())
      throw new Error('Invalid coefficient.');

    if (curveA.isZero()) {
      const customB = custom;
      const u6 = customB.redDiv(curveB);
      // Todo: allow index flag.
      const u2 = uncube(u6);

      // Already checked in uncube().
      assert(u2.redJacobi() === 1);

      return [curveA.clone(), customB.clone()];
    }

    if (curveB.isZero()) {
      const customA = custom;
      const u4 = customA.redDiv(curveA);
      const u2 = u4.redSqrt();

      // Todo: allow odd flag.
      if (u2.redJacobi() !== 1)
        u2.redINeg();

      if (u2.redJacobi() !== 1)
        throw new Error('Invalid `a` coefficient.');

      return [customA.clone(), curveB.clone()];
    }

    const customA = custom;
    const u4 = customA.redDiv(curveA);
    const u2 = u4.redSqrt();

    if (odd != null) {
      if (u2.redIsOdd() !== odd)
        u2.redINeg();
    } else {
      if (u2.redJacobi() !== 1)
        u2.redINeg();
    }

    if (u2.redJacobi() !== 1)
      throw new Error('Invalid `a` coefficient.');

    const u6 = u4.redMul(u2);
    const a = curveA.redMul(u4);
    const b = curveB.redMul(u6);

    assert(a.eq(customA));

    return [a, b];
  }

  _short(a0, odd) {
    return ShortCurve._isomorphism(this.a, this.b, a0, odd);
  }

  _mont(b0, odd) {
    // Short Weierstrass->Montgomery Equivalence.
    //
    // [ARITH1] Page 286, Section 13.2.3.c.
    // [SAFE] "Ladders".
    //
    // Transformation:
    //
    //   r = A / (3 * B)
    //   s = +-sqrt(3 * r^2 + a)
    //   A = 3 * r / s
    //   B = 1 / s
    const [r, s] = this._findRS(odd);
    const b = s.redInvert();
    const a = r.redMuln(3).redMul(b);

    if (b0 != null)
      return MontCurve._isomorphism(a, b, b0);

    return [a, b];
  }

  _edwards(a0, odd) {
    // Short Weierstrass->Twisted Edwards Equivalence.
    //
    // [TWISTEQ] Section 1.
    //
    // Transformation:
    //
    //   r = (a' + d') / 6
    //   s = +-sqrt(3 * r^2 + a)
    //   a' = 3 * r + 2 * s
    //   d' = 3 * r - 2 * s
    const [r, s] = this._findRS(odd);
    const r3 = r.redMuln(3);
    const s2 = s.redMuln(2);
    const a = r3.redAdd(s2);
    const d = r3.redSub(s2);

    if (a0 != null)
      return EdwardsCurve._isomorphism(a, d, a0);

    return [a, d];
  }

  _findRS(sign) {
    // Find `r` and `s` for equivalence.
    //
    // [ARITH1] Page 286, Section 13.2.3.c.
    // [SAFE] "Ladders".
    //
    // Computation:
    //
    //   r = solve(r^3 + a * r + b == 0, r)
    //   s = +-sqrt(3 * r^2 + a)
    //
    // Computing `r` is non-trivial. We need
    // to solve `r^3 + a * r + b = 0`, but we
    // don't have a polynomial solver, so we
    // loop over random points until we find
    // one with 2-torsion. Multiplying by the
    // subgroup order should yield a point of
    // ((A / 3) / B, 0) which is a solution.
    assert(sign == null || typeof sign === 'boolean');
    assert(this.h.word(0) >= 4);
    assert(!this.n.isZero());

    const x = this.one.redNeg();

    let p;

    for (;;) {
      x.redIAdd(this.one);

      try {
        p = this.pointFromX(x.clone());
      } catch (e) {
        continue;
      }

      p = p.mul(this.n);

      if (p.isInfinity())
        continue;

      if (!p.y.isZero())
        continue;

      break;
    }

    const r = p.x;
    const r2 = r.redSqr();
    const s = r2.redMuln(3).redIAdd(this.a).redSqrt();

    if (sign != null) {
      if (s.redIsOdd() !== sign)
        s.redINeg();
    }

    return [r, s];
  }

  _scale0(a, b) {
    // We can extract the isomorphism factors with:
    //
    //   u4 = a' / a
    //   u6 = b' / b
    //   u2 = +-sqrt(u4)
    //   u = +-sqrt(u2)
    //   u3 = u2 * u
    //
    // `u2` should be picked such that `u4 * u2 = u6`.
    //
    // If a = 0, we can do:
    //
    //   u6 = b' / b
    //   u2 = u6^(1 / 3)
    //   u = +-sqrt(u2)
    //   u3 = u2 * u
    //
    // Where `u2` is any root that is square.
    //
    // If b = 0, we can do:
    //
    //   u4 = a' / a
    //   u2 = +-sqrt(u4)
    //   u = +-sqrt(u2)
    //   u3 = u2 * u
    //
    // Where `u2` is any root that is square.
    assert(this.a.isZero() === a.isZero());
    assert(this.b.isZero() === b.isZero());

    if (this.a.isZero()) {
      const u6 = this.b.redDiv(this.field(b));
      // Todo: figure out how to check index.
      const u2 = uncube(u6);
      const u = u2.redSqrt();
      const u3 = u2.redMul(u);

      assert(u3.redSqr().eq(u6));
      assert(!u.isZero());

      return [u2, u3];
    }

    if (this.b.isZero()) {
      const u4 = this.a.redDiv(this.field(a));
      const u2 = u4.redSqrt();

      // Todo: figure out how to check oddness.
      if (u2.redJacobi() !== 1)
        u2.redINeg();

      const u = u2.redSqrt();
      const u3 = u2.redMul(u);

      assert(u3.redMul(u).eq(u4));
      assert(!u.isZero());

      return [u2, u3];
    }

    const u4 = this.a.redDiv(this.field(a));
    const u6 = this.b.redDiv(this.field(b));
    const u2 = u4.redSqrt();

    if (!u4.redMul(u2).eq(u6))
      u2.redINeg();

    assert(u4.redMul(u2).eq(u6));

    const u = u2.redSqrt();
    const u3 = u2.redMul(u);

    assert(!u.isZero());

    return [u2, u3];
  }

  _scale1(x, y) {
    // If base points are available, it is much
    // easier, with:
    //
    //   u2 = x' / x
    //   u3 = y' / y
    //   u = +-sqrt(u2)
    //
    // `u` should be picked such that `u2 * u = u3`.
    const u2 = this.g.x.redDiv(this.field(x));
    const u3 = this.g.y.redDiv(this.field(y));
    const u = u2.redSqrt();

    if (!u2.redMul(u).eq(u3))
      u.redINeg();

    assert(u2.redMul(u).eq(u3));
    assert(!u.isZero());

    return [u2, u3];
  }

  _scaleShort(curve) {
    assert(curve instanceof ShortCurve);

    if (this.g.isInfinity() || curve.g.isInfinity())
      return this._scale0(curve.a, curve.b);

    return this._scale1(curve.g.x, curve.g.y);
  }

  _scaleMont(curve) {
    assert(curve instanceof MontCurve);

    if (this.g.isInfinity() || curve.g.isInfinity()) {
      const [a, b] = curve._short();
      return this._scale0(a, b);
    }

    const {x, y} = curve.g;
    const nx = x.redAdd(curve.a3).redMul(curve.bi);
    const ny = y.redMul(curve.bi);

    return this._scale1(nx, ny);
  }

  _scaleEdwards(curve) {
    assert(curve instanceof EdwardsCurve);

    if (this.g.isInfinity() || curve.g.isInfinity()) {
      const [a, b] = curve._short();
      return this._scale0(a, b);
    }

    const {x, y, z} = curve.g;
    const a5 = curve.a.redMuln(5);
    const d5 = curve.d.redMuln(5);
    const dma = curve.d.redSub(curve.a);
    const d5a = d5.redSub(curve.a);
    const da5 = curve.d.redSub(a5);
    const ypz = y.redAdd(z);
    const ymz = y.redSub(z);
    const xx = d5a.redMul(y).redIAdd(da5.redMul(z));
    const xz = ymz.redMuln(12);
    const yy = dma.redMul(ypz).redMul(z);
    const yz = ymz.redMul(x).redIMuln(4);
    const zi = xz.redMul(yz).redInvert();
    const nx = xx.redMul(yz).redMul(zi);
    const ny = yy.redMul(xz).redMul(zi);

    return this._scale1(nx, ny);
  }

  _getEndomorphism(index = 0) {
    // Compute endomorphism.
    //
    // [GECC] Example 3.76, Page 128, Section 3.5.

    // No curve params.
    if (this.n.isZero() || this.g.isInfinity())
      return null;

    // No efficient endomorphism.
    if (!this.zeroA || this.p.modrn(3) !== 1 || this.n.modrn(3) !== 1)
      return null;

    // Solve beta^3 mod p = 1.
    const [b1, b2] = this._getEndoRoots(this.p);

    // Choose the smallest beta by default.
    const beta = [b1, b2][index & 1].toRed(this.red);

    // Solve lambda^3 mod n = 1.
    const [l1, l2] = this._getEndoRoots(this.n);

    // Choose the lambda matching selected beta.
    // Note that P * lambda = (x * beta, y).
    const p = this.point(this.g.x.redMul(beta), this.g.y);

    let lambda;

    if (this.g.mul(l1).eq(p)) {
      lambda = l1;
    } else {
      assert(this.g.mul(l2).eq(p));
      lambda = l2;
    }

    // Get basis vectors.
    const basis = this._getEndoBasis(lambda);

    // Precompute `g1` and `g2`.
    const pre = this._getEndoPrecomp(basis);

    return new Endo(beta, lambda, basis, pre);
  }

  _getEndoRoots(num) {
    // Find roots for x^2 + x + 1 in F.
    //
    // [GECC] Example 3.76, Page 128, Section 3.5.
    // [GLV] Page 192, Section 2 (Endomorphisms).
    //
    // The above document doesn't fully explain how
    // to derive these and only "hints" at it, as
    // mentioned by Hal Finney[1], but we're basically
    // computing two possible cube roots of 1 here.
    //
    // Note that we could also compute[2]:
    //
    //   beta = 2^((p - 1) / 3) mod p
    //   lambda = 3^((n - 1) / 3) mod n
    //
    // As an extension of Fermat's little theorem:
    //
    //   g^(p - 1) mod p == 1
    //
    // It is suspected[3] this is how Hal Finney[4]
    // computed his original endomorphism roots.
    //
    // @indutny's method for computing cube roots
    // of unity[5] appears to be the method described
    // on wikipedia[6][7].
    //
    // Sage produces the same solution:
    //
    //   sage: solve(x^2 + x + 1 == 0, x)
    //   [x == -1/2*I*sqrt(3) - 1/2, x == 1/2*I*sqrt(3) - 1/2]
    //
    // This can be reduced to:
    //
    //   x = (+-sqrt(-3) - 1) / 2
    //
    // [1] https://bitcointalk.org/index.php?topic=3238.msg45565#msg45565
    // [2] https://crypto.stackexchange.com/a/22739
    // [3] https://bitcoin.stackexchange.com/a/35872
    // [4] https://github.com/halfinney/bitcoin/commit/dc411b5
    // [5] https://en.wikipedia.org/wiki/Cube_root_of_unity
    // [6] https://en.wikipedia.org/wiki/Splitting_field#Cubic_example
    // [7] http://mathworld.wolfram.com/SplittingField.html
    const red = num === this.p ? this.red : BN.mont(num);
    const two = new BN(2).toRed(red);
    const three = new BN(3).toRed(red);
    const i2 = two.redInvert();

    // S1 = sqrt(-3) / 2
    const s1 = three.redNeg().redSqrt().redMul(i2);

    // S2 = -S1
    const s2 = s1.redNeg();

    // R1 = S1 - 1 / 2
    const r1 = s1.redSub(i2).fromRed();

    // R2 = S2 - 1 / 2
    const r2 = s2.redSub(i2).fromRed();

    return [r1, r2].sort(BN.cmp);
  }

  _getEndoBasis(lambda) {
    // Compute endomorphic basis.
    //
    // This essentially computes Cornacchia's algorithm
    // for solving x^2 + d * y^2 = m (d = lambda, m = order).
    //
    // https://en.wikipedia.org/wiki/Cornacchia%27s_algorithm
    //
    // [GECC] Algorithm 3.74, Page 127, Section 3.5.
    // [GLV] Page 196, Section 4 (Decomposing K).
    //
    // Balanced length-two representation of a multiplier.
    //
    // 1. Run the extended euclidean algorithm with inputs n
    //    and lambda. The algorithm produces a sequence of
    //    equations si*n + ti*lam = ri where s0=1, t0=0,
    //    r0=n, s1=0, t1=1, r1=lam, and the remainders ri
    //    and are non-negative and strictly decreasing. Let
    //    l be the greatest index for which rl >= sqrt(n).
    const [rl, tl, rl1, tl1, rl2, tl2] = this._egcdSqrt(lambda);

    // 2. Set (a1, b1) <- (rl+1, -tl+1).
    const a1 = rl1;
    const b1 = tl1.neg();

    // 3. If (rl^2 + tl^2) <= (rl+2^2 + tl+2^2)
    //    then set (a2, b2) <- (rl, -tl).
    //    else set (a2, b2) <- (rl+2, -tl+2).
    const lhs = rl.sqr().iadd(tl.sqr());
    const rhs = rl2.sqr().iadd(tl2.sqr());

    let a2, b2;

    if (lhs.cmp(rhs) <= 0) {
      a2 = rl;
      b2 = tl.neg();
    } else {
      a2 = rl2;
      b2 = tl2.neg();
    }

    return [
      new Vector(a1, b1),
      new Vector(a2, b2)
    ];
  }

  _egcdSqrt(lambda) {
    // Extended Euclidean algorithm for integers.
    //
    // [GECC] Algorithm 2.19, Page 40, Section 2.2.
    // [GLV] Page 196, Section 4 (Decomposing K).
    assert(lambda instanceof BN);
    assert(!lambda.red);
    assert(lambda.sign() > 0);
    assert(this.n.sign() > 0);

    // Note that we insert the approximate square
    // root checks as described in algorithm 3.74.
    //
    // Algorithm 2.19 is defined as:
    //
    // 1. u <- a
    //    v <- b
    //
    // 2. x1 <- 1
    //    y1 <- 0
    //    x2 <- 0
    //    y2 <- 1
    //
    // 3. while u != 0 do
    //
    // 3.1. q <- floor(v / u)
    //      r <- v - q * u
    //      x <- x2 - q * x1
    //      y <- y2 - q * y1
    //
    // 3.2. v <- u
    //      u <- r
    //      x2 <- x1
    //      x1 <- x
    //      y2 <- y1
    //      y1 <- y
    //
    // 4. d <- v
    //    x <- x2
    //    y <- y2
    //
    // 5. Return (d, x, y).

    // Start with an approximate square root of n.
    const sqrtn = this.n.ushrn(this.n.bitLength() >>> 1);

    let u = lambda; // r1
    let v = this.n.clone(); // r0
    let x1 = new BN(1); // t1
    let y1 = new BN(0); // t0
    let x2 = new BN(0); // s1
    let y2 = new BN(1); // s0

    // All vectors are roots of: a + b * lambda = 0 (mod n).
    let rl, tl;

    // First vector.
    let rl1, tl1;

    // Inner.
    let i = 0;
    let j = 0;
    let p;

    // Compute EGCD.
    while (!u.isZero() && i < 2) {
      const q = v.quo(u);
      const r = v.sub(q.mul(u));
      const x = x2.sub(q.mul(x1));
      const y = y2.sub(q.mul(y1));

      // Check for r < sqrt(n).
      if (j === 0 && r.cmp(sqrtn) < 0) {
        rl = p;
        tl = x1;
        rl1 = r;
        tl1 = x;
        j = 1; // 1 more round.
      }

      p = r;
      v = u;
      u = r;
      x2 = x1;
      x1 = x;
      y2 = y1;
      y1 = y;

      i += j;
    }

    // Should never happen.
    assert(j !== 0, 'Could not find r < sqrt(n).');

    // Second vector.
    const rl2 = x2;
    const tl2 = x1;

    return [
      rl,
      tl,
      rl1,
      tl1,
      rl2,
      tl2
    ];
  }

  _getEndoPrecomp(basis) {
    // Precompute `g1` and `g2` to avoid round division.
    //
    // [JCEN12] Page 5, Section 4.3.
    //
    // Computation:
    //
    //   d = a1 * b2 - b1 * a2
    //   t = ceil(log2(d+1)) + p
    //   g1 = round((2^t * b2) / d)
    //   g2 = round((2^t * b1) / d)
    //
    // Where:
    //
    //   `p` is the number of precision bits.
    //   `d` is equal to `n` (the curve order).
    //
    // The paper above uses 2 as the value of `p`,
    // whereas libsecp256k1 uses 128 (total=384).
    //
    // We pick precision for `g1` and `g2` such that:
    //
    //   abs(g1) < n
    //   abs(g2) < n
    //
    // This ensures maximum precision for the constants
    // while also ensuring they fit into a fixed number
    // of scalar limbs in more optimized implementations.
    //
    // Furthermore, we attempt to align to a limb width
    // of 64 bits. This allows us to optimize the shift,
    // a la libsecp256k1[1].
    //
    // [1] https://github.com/bitcoin-core/secp256k1/pull/822
    assert(Array.isArray(basis));
    assert(basis.length === 2);
    assert(basis[0] instanceof Vector);
    assert(basis[1] instanceof Vector);

    const [v1, v2] = basis;
    const d = v1.a.mul(v2.b).isub(v1.b.mul(v2.a));
    const bits = d.bitLength();
    const align = bits >= 160;

    assert(d.eq(this.n));

    // Start with a rough estimate.
    let shift = bits + Math.ceil(bits / 2) + 1;
    let g1, g2;

    if (align)
      shift -= shift & 63;

    while (shift > bits) {
      g1 = v2.b.ushln(shift).divRound(d);
      g2 = v1.b.ushln(shift).divRound(d);

      if (g1.ucmp(d) < 0 && g2.ucmp(d) < 0)
        break;

      if (align)
        shift -= 64;
      else
        shift -= 1;
    }

    if (shift <= bits)
      throw new Error('Could not calculate g1 and g2.');

    return [shift, g1, g2];
  }

  _endoSplit(k) {
    // Balanced length-two representation of a multiplier.
    //
    // [GECC] Algorithm 3.74, Page 127, Section 3.5.
    //
    // Also note that it is possible to precompute[1]
    // values in order to avoid the division[2][3][4].
    //
    // This involves precomputing `g1` and `g2 (see
    // above). `c1` and `c2` can then be computed as
    // follows:
    //
    //   t = ceil(log2(n+1)) + p
    //   c1 = (k * g1) >> t
    //   c2 = -((k * g2) >> t)
    //
    // Where `>>` is an _unsigned_ right shift. Also
    // note that the last bit discarded in the shift
    // must be stored. If it is 1, then add 1 to the
    // scalar (absolute addition).
    //
    // It's worth noting that libsecp256k1 uses a
    // different calculation along the lines of:
    //
    //   t = ceil(log2(n+1)) + p
    //   c1 = ((k * g1) >> t) * -b1
    //   c2 = ((k * -g2) >> t) * -b2
    //   k2 = c1 + c2
    //   k1 = k2 * -lambda + k
    //
    // So, in the future, we can consider changing
    // step 4 to:
    //
    //   4. Compute c1 = (k * g1) >> t
    //          and c2 = -((k * g2) >> t).
    //
    //   const [shift, g1, g2] = this.endo.pre;
    //   const c1 = k.mulShift(g1, shift);
    //   const c2 = k.mulShift(g2, shift).ineg();
    //
    // Once we're brave enough, that is.
    //
    // [1] [JCEN12] Page 5, Section 4.3.
    // [2] https://github.com/bitcoin-core/secp256k1/blob/0b70241/src/scalar_impl.h#L259
    // [3] https://github.com/bitcoin-core/secp256k1/pull/21
    // [4] https://github.com/bitcoin-core/secp256k1/pull/127
    assert(k instanceof BN);
    assert(!k.red);
    assert(!this.n.isZero());

    const [v1, v2] = this.endo.basis;

    // 4. Compute c1 = round(b2 * k / n)
    //        and c2 = round(-b1 * k / n).
    const c1 = v2.b.mul(k).divRound(this.n);
    const c2 = v1.b.neg().mul(k).divRound(this.n);

    // 5. Compute k1 = k - c1 * a1 - c2 * a2
    //        and k2 = -c1 * b1 - c2 * b2.
    const p1 = c1.mul(v1.a);
    const p2 = c2.mul(v2.a);
    const q1 = c1.ineg().mul(v1.b);
    const q2 = c2.mul(v2.b);

    // Calculate answer.
    const k1 = k.sub(p1).isub(p2);
    const k2 = q1.isub(q2);

    // 6. Return (k1, k2).
    return [k1, k2];
  }

  _endoBeta(point) {
    assert(point instanceof ShortPoint);
    return [point, point._getBeta()];
  }

  _endoWnafMulAdd(points, coeffs) {
    // Point multiplication with efficiently computable endomorphisms.
    //
    // [GECC] Algorithm 3.77, Page 129, Section 3.5.
    // [GLV] Page 193, Section 3 (Using Efficient Endomorphisms).
    //
    // Note it may be possible to do this 4-dimensionally [4GLV].
    assert(Array.isArray(points));
    assert(Array.isArray(coeffs));
    assert(points.length === coeffs.length);
    assert(this.endo != null);

    const len = points.length;
    const npoints = new Array(len * 2);
    const ncoeffs = new Array(len * 2);

    for (let i = 0; i < len; i++) {
      const [p1, p2] = this._endoBeta(points[i]);
      const [k1, k2] = this._endoSplit(coeffs[i]);

      npoints[i * 2 + 0] = p1;
      ncoeffs[i * 2 + 0] = k1;
      npoints[i * 2 + 1] = p2;
      ncoeffs[i * 2 + 1] = k2;
    }

    return this._wnafMulAdd(5, npoints, ncoeffs);
  }

  _sswu(u) {
    // Simplified Shallue-Woestijne-Ulas Method.
    //
    // Distribution: 3/8.
    //
    // [SSWU1] Page 15-16, Section 7. Appendix G.
    // [SSWU2] Page 5, Theorem 2.3.
    // [H2EC] "Simplified Shallue-van de Woestijne-Ulas Method".
    //
    // Assumptions:
    //
    //   - a != 0, b != 0.
    //   - Let z be a non-square in F(p).
    //   - z != -1.
    //   - The polynomial g(x) - z is irreducible over F(p).
    //   - g(b / (z * a)) is square in F(p).
    //   - u != 0, u != +-sqrt(-1 / z).
    //
    // Map:
    //
    //   g(x) = x^3 + a * x + b
    //   t1 = 1 / (z^2 * u^4 + z * u^2)
    //   x1 = (-b / a) * (1 + t1)
    //   x1 = b / (z * a), if t1 = 0
    //   x2 = z * u^2 * x1
    //   x = x1, if g(x1) is square
    //     = x2, otherwise
    //   y = sign(u) * abs(sqrt(g(x)))
    const {b, z, ai, zi, one} = this;
    const z2 = z.redSqr();
    const ba = b.redNeg().redMul(ai);
    const bza = b.redMul(zi).redMul(ai);
    const u2 = u.redSqr();
    const u4 = u2.redSqr();
    const t0 = z2.redMul(u4).redIAdd(z.redMul(u2));
    const t1 = t0.isZero() ? t0 : t0.redInvert();
    const x1 = t1.isZero() ? bza : ba.redMul(one.redAdd(t1));
    const x2 = z.redMul(u2).redMul(x1);
    const y1 = this.solveY2(x1);
    const y2 = this.solveY2(x2);
    const alpha = y1.redIsSquare() | 0;
    const x = [x1, x2][alpha ^ 1];
    const y = [y1, y2][alpha ^ 1].redSqrt();

    if (y.redIsOdd() !== u.redIsOdd())
      y.redINeg();

    return this.point(x, y);
  }

  _sswui(p, hint) {
    // Inverting the Map (Simplified Shallue-Woestijne-Ulas).
    //
    // Assumptions:
    //
    //   - a^2 * x^2 - 2 * a * b * x - 3 * b^2 is square in F(p).
    //   - If r < 3 then x != -b / a.
    //
    // Unlike SVDW, the preimages here are evenly
    // distributed (more or less). SSWU covers ~3/8
    // of the curve points. Each preimage has a 1/2
    // chance of mapping to either x1 or x2.
    //
    // Assuming the point is within that set, each
    // point has a 1/4 chance of inverting to any
    // of the preimages. This means we can simply
    // randomly select a preimage if one exists.
    //
    // However, the [SVDW2] sampling method seems
    // slighly faster in practice for [SQUARED].
    //
    // Map:
    //
    //   c = sqrt(a^2 * x^2 - 2 * a * b * x - 3 * b^2)
    //   u1 = -(a * x + b - c) / (2 * (a * x + b) * z)
    //   u2 = -(a * x + b + c) / (2 * (a * x + b) * z)
    //   u3 = -(a * x + b - c) / (2 * b * z)
    //   u4 = -(a * x + b + c) / (2 * b * z)
    //   r = random integer in [1,4]
    //   u = sign(y) * abs(sqrt(ur))
    const {a, b, z} = this;
    const {x, y} = p;
    const r = hint & 3;
    const a2x2 = a.redSqr().redMul(x.redSqr());
    const abx2 = a.redMul(b).redMul(x).redIMuln(2);
    const b23 = b.redSqr().redMuln(3);
    const axb = a.redMul(x).redIAdd(b);
    const c = a2x2.redISub(abx2).redISub(b23).redSqrt();
    const n0 = axb.redSub(c).redINeg();
    const n1 = axb.redAdd(c).redINeg();
    const d0 = axb.redMul(z).redIMuln(2);
    const d1 = b.redMul(z).redIMuln(2);
    const n = [n0, n1][r & 1]; // r = 1 or 3
    const d = [d0, d1][r >>> 1]; // r = 2 or 3
    const u = n.redDivSqrt(d);

    if (u.redIsOdd() !== y.redIsOdd())
      u.redINeg();

    return u;
  }

  _svdwf(u) {
    // Shallue-van de Woestijne Method.
    //
    // Distribution: 9/16.
    //
    // [SVDW1] Section 5.
    // [SVDW2] Page 8, Section 3.
    //         Page 15, Section 6, Algorithm 1.
    // [H2EC] "Shallue-van de Woestijne Method".
    //
    // Assumptions:
    //
    //   - p = 1 (mod 3).
    //   - a = 0, b != 0.
    //   - Let z be a unique element in F(p).
    //   - g((sqrt(-3 * z^2) - z) / 2) is square in F(p).
    //   - u != 0, u != +-sqrt(-g(z)).
    //
    // Map:
    //
    //   g(x) = x^3 + b
    //   c = sqrt(-3 * z^2)
    //   t1 = u^2 + g(z)
    //   t2 = 1 / (u^2 * t1)
    //   t3 = u^4 * t2 * c
    //   x1 = (c - z) / 2 - t3
    //   x2 = t3 - (c + z) / 2
    //   x3 = z - t1^3 * t2 / (3 * z^2)
    //   x = x1, if g(x1) is square
    //     = x2, if g(x2) is square
    //     = x3, otherwise
    //   y = sign(u) * abs(sqrt(g(x)))
    const {c, z, zi, i2, i3} = this;
    const gz = this.solveY2(z);
    const z3 = i3.redMul(zi.redSqr());
    const u2 = u.redSqr();
    const u4 = u2.redSqr();
    const t1 = u2.redAdd(gz);
    const u2t1 = u2.redMul(t1);
    const t2 = u2t1.isZero() ? u2t1 : u2t1.redInvert();
    const t3 = u4.redMul(t2).redMul(c);
    const t4 = t1.redSqr().redMul(t1);
    const x1 = c.redSub(z).redMul(i2).redISub(t3);
    const x2 = t3.redSub(c.redAdd(z).redMul(i2));
    const x3 = z.redSub(t4.redMul(t2).redMul(z3));
    const y1 = this.solveY2(x1);
    const y2 = this.solveY2(x2);
    const y3 = this.solveY2(x3);
    const alpha = y1.redJacobi() | 1;
    const beta = y2.redJacobi() | 1;
    const i = mod((alpha - 1) * beta, 3);
    const x = [x1, x2, x3][i];
    const y = [y1, y2, y3][i];

    return [x, y];
  }

  _svdw(u) {
    const [x, yy] = this._svdwf(u);
    const y = yy.redSqrt();

    if (y.redIsOdd() !== u.redIsOdd())
      y.redINeg();

    return this.point(x, y);
  }

  _svdwi(p, hint) {
    // Inverting the Map (Shallue-van de Woestijne).
    //
    // [SQUARED] Algorithm 1, Page 8, Section 3.3.
    // [SVDW2] Page 12, Section 5.
    // [SVDW3] "Inverting the map".
    //
    // Assumptions:
    //
    //   - If r = 1 then x != -(c + z) / 2.
    //   - If r = 2 then x != (c - z) / 2.
    //   - If r > 2 then (t0 - t1 + t2) is square in F(p).
    //   - f(f^-1(x)) = x where f is the map function.
    //
    // We use the sampling method from [SVDW2],
    // _not_ [SQUARED]. This seems to have a
    // better distribution in practice.
    //
    // Note that [SVDW3] also appears to be
    // incorrect in terms of distribution.
    //
    // The distribution of f(u), assuming u is
    // random, is (1/2, 1/4, 1/4).
    //
    // To mirror this, f^-1(x) should simply
    // pick (1/2, 1/4, 1/8, 1/8).
    //
    // To anyone running the forward map, our
    // strings will appear to be random.
    //
    // Map:
    //
    //   g(x) = x^3 + b
    //   c = sqrt(-3 * z^2)
    //   t0 = 9 * (x^2 * z^2 + z^4)
    //   t1 = 18 * x * z^3
    //   t2 = 12 * g(z) * (x - z)
    //   t3 = sqrt(t0 - t1 + t2)
    //   t4 = t3 * z
    //   u1 = g(z) * (c - 2 * x - z) / (c + 2 * x + z)
    //   u2 = g(z) * (c + 2 * x + z) / (c - 2 * x - z)
    //   u3 = (3 * (z^3 - x * z^2) - 2 * g(z) + t4) / 2
    //   u4 = (3 * (z^3 - x * z^2) - 2 * g(z) - t4) / 2
    //   r = random integer in [1,4]
    //   u = sign(y) * abs(sqrt(ur))
    const {b, c, z, zero, two} = this;
    const {x, y} = p;
    const r = hint & 3;
    const z2 = z.redSqr();
    const z3 = z2.redMul(z);
    const z4 = z2.redSqr();
    const gz = z3.redAdd(b);
    const gz2 = gz.redMuln(2);
    const xx = x.redSqr();
    const x2z = x.redMuln(2).redIAdd(z);
    const xz2 = x.redMul(z2);
    const c0 = c.redSub(x2z);
    const c1 = c.redAdd(x2z);
    const t0 = xx.redMul(z2).redIAdd(z4).redIMuln(9);
    const t1 = x.redMul(z3).redIMuln(18);
    const t2 = gz.redMul(x.redSub(z)).redIMuln(12);
    const t3 = r >= 2 ? t0.redISub(t1).redIAdd(t2).redSqrt() : zero;
    const t4 = t3.redMul(z);
    const t5 = z3.redISub(xz2).redIMuln(3).redISub(gz2);
    const n0 = gz.redMul(c0);
    const n1 = gz.redMul(c1);
    const n2 = t5.redAdd(t4);
    const n3 = t5.redSub(t4);
    const d2 = two;
    const n = [n0, n1, n2, n3][r];
    const d = [c1, c0, d2, d2][r];
    const u = n.redDivSqrt(d);
    const [x0] = this._svdwf(u);

    if (!x0.eq(x))
      throw new Error('Invalid point.');

    if (u.redIsOdd() !== y.redIsOdd())
      u.redINeg();

    return u;
  }

  isElliptic() {
    const {a, b} = this;
    const a2 = a.redSqr();
    const a3 = a2.redMul(a);
    const b2 = b.redSqr();
    const d = b2.redMuln(27).redIAdd(a3.redMuln(4));

    // 4 * a^3 + 27 * b^2 != 0
    return !d.isZero();
  }

  jinv() {
    // [ARITH1] Page 71, Section 4.4.
    // http://mathworld.wolfram.com/j-Invariant.html
    const {a, b} = this;
    const a2 = a.redSqr();
    const a3 = a2.redMul(a);
    const b2 = b.redSqr();
    const t0 = a3.redMuln(4);
    const lhs = t0.redMuln(1728);
    const rhs = b2.redMuln(27).redIAdd(t0);

    if (rhs.isZero())
      throw new Error('Curve is not elliptic.');

    // (1728 * 4 * a^3) / (4 * a^3 + 27 * b^2)
    return lhs.redDiv(rhs).fromRed();
  }

  point(x, y) {
    return new ShortPoint(this, x, y);
  }

  jpoint(x, y, z) {
    return new JPoint(this, x, y, z);
  }

  solveX(y) {
    assert(y instanceof BN);

    if (!this.a.isZero())
      throw new Error('Not implemented.');

    // x^3 = y^2 - b
    const y2 = y.redSqr();
    const x3 = y2.redSub(this.b);

    return cubeRoots(x3);
  }

  solveY2(x) {
    // [GECC] Page 89, Section 3.2.2.
    // https://hyperelliptic.org/EFD/g1p/auto-shortw.html
    assert(x instanceof BN);

    // y^2 = x^3 + a * x + b
    const x3 = x.redSqr().redMul(x);
    const y2 = x3.redIAdd(this.b);

    if (!this.zeroA) {
      // Save some cycles for a = -3.
      if (this.threeA)
        y2.redIAdd(x.redMuln(-3));
      else
        y2.redIAdd(this.a.redMul(x));
    }

    return y2;
  }

  validate(point) {
    assert(point instanceof ShortPoint);

    if (point.inf)
      return true;

    const {x, y} = point;
    const y2 = this.solveY2(x);

    return y.redSqr().eq(y2);
  }

  pointFromX(x, sign = null) {
    assert(x instanceof BN);
    assert(sign == null || typeof sign === 'boolean');

    if (!x.red)
      x = x.toRed(this.red);

    const y = this.solveY(x);

    if (sign != null) {
      if (this.h.cmpn(1) > 0) {
        if (y.isZero() && sign)
          throw new Error('Invalid point.');
      }

      if (y.redIsOdd() !== sign)
        y.redINeg();
    }

    return this.point(x, y);
  }

  pointFromY(y, index = 0) {
    assert(y instanceof BN);
    assert((index >>> 0) === index);

    if (!y.red)
      y = y.toRed(this.red);

    const coords = this.solveX(y);

    if (index >= coords.length)
      throw new Error('Invalid X coordinate index.');

    const x = coords[index];

    return this.point(x, y);
  }

  isIsomorphic(curve) {
    // [GECC] Page 84, Section 3.1.5.
    // [ARITH1] Page 286, Section 13.2.3.c.
    assert(curve instanceof Curve);

    if (!curve.p.eq(this.p))
      return false;

    let u2, u3;
    try {
      [u2, u3] = this._scale(curve);
    } catch (e) {
      return false;
    }

    // E(a,b) <-> E(au^4,bu^6)
    if (curve.type === 'short') {
      // a' = a * u^4, b' = b * u^6
      const a = this.field(curve.a).redMul(u2.redSqr());
      const b = this.field(curve.b).redMul(u3.redSqr());

      return this.a.eq(a) && this.b.eq(b);
    }

    // E(a,b) <-> M(A,B)
    if (curve.type === 'mont') {
      // (A / (3 * B))^3 + a * (A / (3 * B)) + b = 0
      const {a3, bi} = curve;
      const x = this.field(a3.redMul(bi)).redMul(u2);
      const y2 = this.solveY2(x);

      return y2.isZero();
    }

    // E(a,b) <-> E(a,d)
    if (curve.type === 'edwards') {
      // ((a' + d') / 6)^3 + a * ((a' + d') / 6) + b = 0
      const x = this.field(curve.ad6).redMul(u2);
      const y2 = this.solveY2(x);

      return y2.isZero();
    }

    return false;
  }

  isIsogenous(curve) {
    assert(curve instanceof Curve);
    return false;
  }

  pointFromShort(point) {
    // [GECC] Page 84, Section 3.1.5.
    // [ALT] Appendix F.3 (Isomorphic Mapping between Weierstrass Curves).
    assert(point instanceof ShortPoint);

    if (this.isIsomorphic(point.curve)) {
      // Isomorphic maps for E(a,b)<->E(au^4,bu^6):
      //
      //   x' = x * u^2
      //   y' = y * u^3
      //
      // Where a * u^4 = a' and b * u^6 = b'.
      if (point.isInfinity())
        return this.point();

      const [u2, u3] = this._scale(point.curve);
      const x = this.field(point.x);
      const y = this.field(point.y);
      const nx = x.redMul(u2);
      const ny = y.redMul(u3);

      return this.point(nx, ny);
    }

    throw new Error('Not implemented.');
  }

  pointFromMont(point) {
    // [ALT] Appendix E.2 (Switching between Alternative Representations).
    // [MONT2] "Equivalence with Weierstrass curves"
    assert(point instanceof MontPoint);

    if (this.isIsomorphic(point.curve)) {
      // Equivalence for M(A,B)->E(a,b):
      //
      //   x = (u + A / 3) / B
      //   y = v / B
      //
      // Undefined if ((u^3 + A * u^2 + u) / B) is not square.
      if (point.isInfinity())
        return this.point();

      const {a3, bi} = point.curve;
      const [u2, u3] = this._scale(point.curve);
      const nx = point.x.redAdd(a3).redMul(bi);
      const ny = point.y.redMul(bi);

      return this.point(this.field(nx).redMul(u2),
                        this.field(ny).redMul(u3));
    }

    throw new Error('Not implemented.');
  }

  pointFromEdwards(point) {
    // [TWISTEQ] Section 2.
    assert(point instanceof EdwardsPoint);

    if (this.isIsomorphic(point.curve)) {
      // Equivalence for E(a,d)->E(a',b'):
      //
      //   x' = ((5 * d - a) * y + d - 5 * a) / (12 * (y - 1))
      //   y' = (d - a) * (y + 1) / (4 * x * (y - 1))
      //
      // Undefined for x = 0 or y = 1.
      //
      // Exceptional Cases:
      //   - (0, 1) -> O
      //   - (0, -1) -> ((a + d) / 6, 0)
      //
      // Unexceptional Cases:
      //   - (sqrt(1 / a), 0) -> ((5 * a - d) / 12, (a - d) / 4 * sqrt(a))
      const {a, d, ad6} = point.curve;
      const [u2, u3] = this._scale(point.curve);

      if (point.isInfinity())
        return this.point();

      if (point.x.isZero()) {
        const x = this.field(ad6).redMul(u2);
        return this.point(x, this.zero);
      }

      const {x, y, z} = point;
      const a5 = a.redMuln(5);
      const d5 = d.redMuln(5);
      const dma = d.redSub(a);
      const d5a = d5.redSub(a);
      const da5 = d.redSub(a5);
      const ypz = y.redAdd(z);
      const ymz = y.redSub(z);
      const xx = d5a.redMul(y).redIAdd(da5.redMul(z));
      const xz = ymz.redMuln(12);
      const yy = dma.redMul(ypz).redMul(z);
      const yz = ymz.redMul(x).redIMuln(4);

      return this.cpoint(this.field(xx).redMul(u2),
                         this.field(xz),
                         this.field(yy).redMul(u3),
                         this.field(yz));
    }

    throw new Error('Not implemented.');
  }

  pointFromUniform(u) {
    assert(u instanceof BN);

    // z = 0 or b = 0
    if (this.z.isZero() || this.b.isZero())
      throw new Error('Not implemented.');

    // a != 0, b != 0
    if (!this.a.isZero())
      return this._sswu(u);

    // p = 1 mod 3, a = 0, b != 0
    if (!this.c.isZero())
      return this._svdw(u);

    throw new Error('Not implemented.');
  }

  pointToUniform(p, hint) {
    // Convert a short weierstrass point to a field
    // element by inverting either the SSWU or SVDW
    // map.
    //
    // Hint Layout:
    //
    //   [00000000] [0000] [0000]
    //        |        |      |
    //        |        |      +-- preimage index
    //        |        +--- subgroup
    //        +-- bits to OR with uniform bytes
    assert(p instanceof ShortPoint);
    assert((hint >>> 0) === hint);

    // z = 0 or b = 0
    if (this.z.isZero() || this.b.isZero())
      throw new Error('Not implemented.');

    // P = O
    if (p.isInfinity())
      throw new Error('Invalid point.');

    // Add a random torsion component.
    const i = ((hint >>> 4) & 15) % this.torsion.length;
    const q = p.add(this.torsion[i]);

    return wrapErrors(() => {
      // a != 0, b != 0
      if (!this.a.isZero())
        return this._sswui(q, hint);

      // p = 1 mod 3, a = 0, b != 0
      if (!this.c.isZero())
        return this._svdwi(q, hint);

      throw new Error('Not implemented.');
    });
  }

  mulAll(points, coeffs) {
    return super.mulAll(points, coeffs).toP();
  }

  affinizeAll(points) {
    const out = this.normalizeAll(points);

    for (let i = 0; i < out.length; i++)
      out[i] = out[i].toP();

    return out;
  }

  decodePoint(bytes) {
    return ShortPoint.decode(this, bytes);
  }

  encodeX(point) {
    assert(point instanceof Point);
    return point.encodeX();
  }

  decodeEven(bytes) {
    return ShortPoint.decodeEven(this, bytes);
  }

  decodeSquare(bytes) {
    return ShortPoint.decodeSquare(this, bytes);
  }

  toShort(a0, odd, sign = null) {
    const [a, b] = this._short(a0, odd);

    const curve = new ShortCurve({
      red: this.red,
      prime: this.prime,
      p: this.p,
      a: a,
      b: b,
      n: this.n,
      h: this.h
    });

    if (sign != null) {
      const [, u3] = curve._scale(this);

      if (u3.redIsOdd() !== sign)
        u3.redINeg();
    }

    if (!this.g.isInfinity())
      curve.g = curve.pointFromShort(this.g);

    for (let i = 0; i < this.h.word(0); i++)
      curve.torsion[i] = curve.pointFromShort(this.torsion[i]);

    return curve;
  }

  toMont(b0, odd, sign = null) {
    const [a, b] = this._mont(b0, odd);

    const curve = new MontCurve({
      red: this.red,
      prime: this.prime,
      p: this.p,
      a: a,
      b: b,
      n: this.n,
      h: this.h
    });

    if (sign != null) {
      const [, u3] = this._scale(curve);

      if (u3.redIsOdd() !== sign)
        u3.redINeg();
    }

    if (!this.g.isInfinity())
      curve.g = curve.pointFromShort(this.g);

    for (let i = 0; i < this.h.word(0); i++)
      curve.torsion[i] = curve.pointFromShort(this.torsion[i]);

    return curve;
  }

  toEdwards(a0, odd, sign = null) {
    const [a, d] = this._edwards(a0, odd);

    const curve = new EdwardsCurve({
      red: this.red,
      prime: this.prime,
      p: this.p,
      a: a,
      d: d,
      n: this.n,
      h: this.h
    });

    if (sign != null) {
      const [, u3] = this._scale(curve);

      if (u3.redIsOdd() !== sign)
        u3.redINeg();
    }

    if (!this.g.isInfinity()) {
      curve.g = curve.pointFromShort(this.g);
      curve.g.normalize();
    }

    if (curve.isComplete()) {
      for (let i = 0; i < this.h.word(0); i++) {
        curve.torsion[i] = curve.pointFromShort(this.torsion[i]);
        curve.torsion[i].normalize();
      }
    }

    return curve;
  }

  pointFromJSON(json) {
    return ShortPoint.fromJSON(this, json);
  }

  toJSON(pre) {
    const json = super.toJSON(pre);

    json.a = this.a.fromRed().toJSON();
    json.b = this.b.fromRed().toJSON();

    if (!this.c.isZero())
      json.c = this.c.fromRed().toJSON();

    return json;
  }
}

/**
 * ShortPoint
 */

class ShortPoint extends Point {
  constructor(curve, x, y) {
    assert(curve instanceof ShortCurve);

    super(curve, types.AFFINE);

    this.x = this.curve.zero;
    this.y = this.curve.zero;
    this.inf = true;

    if (x != null)
      this._init(x, y);
  }

  _init(x, y) {
    assert(x instanceof BN);
    assert(y instanceof BN);

    this.x = x;
    this.y = y;

    if (!this.x.red)
      this.x = this.x.toRed(this.curve.red);

    if (!this.y.red)
      this.y = this.y.toRed(this.curve.red);

    this.inf = false;
  }

  _getBeta() {
    if (!this.curve.endo)
      return null;

    if (this.pre && this.pre.beta)
      return this.pre.beta;

    // Augment the point with our beta value.
    // This is the counterpart to `k2` after
    // the endomorphism split of `k`.
    //
    // Note that if we have precomputation,
    // we have to clone and update all of the
    // precomputed points below.
    const xb = this.x.redMul(this.curve.endo.beta);
    const beta = this.curve.point(xb, this.y);

    if (this.pre) {
      beta.pre = this.pre.map((point) => {
        const xb = point.x.redMul(this.curve.endo.beta);
        return this.curve.point(xb, point.y);
      });

      this.pre.beta = beta;
    }

    return beta;
  }

  _getJNAF(point) {
    assert(point instanceof ShortPoint);

    if (this.inf || point.inf)
      return super._getJNAF(point);

    // Create comb for JSF.
    const comb = [
      this, // 1
      null, // 3
      null, // 5
      point // 7
    ];

    // Try to avoid Jacobian points, if possible.
    if (this.y.eq(point.y)) {
      comb[1] = this.add(point);
      comb[2] = this.toJ().sub(point);
    } else if (this.y.eq(point.y.redNeg())) {
      comb[1] = this.toJ().add(point);
      comb[2] = this.sub(point);
    } else {
      comb[1] = this.toJ().add(point);
      comb[2] = this.toJ().sub(point);
    }

    return comb;
  }

  clone() {
    if (this.inf)
      return this.curve.point();

    return this.curve.point(this.x, this.y);
  }

  scale(a) {
    return this.toJ().scale(a);
  }

  neg() {
    // P = O
    if (this.inf)
      return this;

    // -(X1, Y1) = (X1, -Y1)
    return this.curve.point(this.x, this.y.redNeg());
  }

  add(p) {
    // [GECC] Page 80, Section 3.1.2.
    //
    // Addition Law:
    //
    //   l = (y1 - y2) / (x1 - x2)
    //   x3 = l^2 - x1 - x2
    //   y3 = l * (x1 - x3) - y1
    //
    // 1I + 2M + 1S + 6A
    assert(p instanceof ShortPoint);

    // O + P = P
    if (this.inf)
      return p;

    // P + O = P
    if (p.inf)
      return this;

    // P + P, P + -P
    if (this.x.eq(p.x)) {
      // P + -P = O
      if (!this.y.eq(p.y))
        return this.curve.point();

      // P + P = 2P
      return this.dbl();
    }

    // X1 != X2, Y1 = Y2
    if (this.y.eq(p.y)) {
      // X3 = -X1 - X2
      const nx = this.x.redNeg().redISub(p.x);

      // Y3 = -Y1
      const ny = this.y.redNeg();

      // Skip the inverse.
      return this.curve.point(nx, ny);
    }

    // H = X1 - X2
    const h = this.x.redSub(p.x);

    // R = Y1 - Y2
    const r = this.y.redSub(p.y);

    // L = R / H
    const l = r.redDiv(h);

    // X3 = L^2 - X1 - X2
    const nx = l.redSqr().redISub(this.x).redISub(p.x);

    // Y3 = L * (X1 - X3) - Y1
    const ny = l.redMul(this.x.redSub(nx)).redISub(this.y);

    return this.curve.point(nx, ny);
  }

  dbl() {
    // [GECC] Page 80, Section 3.1.2.
    //
    // Addition Law (doubling):
    //
    //   l = (3 * x1^2 + a) / (2 * y1)
    //   x3 = l^2 - 2 * x1
    //   y3 = l * (x1 - x3) - y1
    //
    // 1I + 2M + 2S + 3A + 2*2 + 1*3

    // P = O
    if (this.inf)
      return this;

    // Y1 = 0
    if (this.y.isZero())
      return this.curve.point();

    // XX = X1^2
    const xx = this.x.redSqr();

    // M = 3 * XX + a
    const m = xx.redIMuln(3).redIAdd(this.curve.a);

    // Z = 2 * Y1
    const z = this.y.redMuln(2);

    // L = M / Z
    const l = m.redDiv(z);

    // X3 = L^2 - 2 * X1
    const nx = l.redSqr().redISub(this.x).redISub(this.x);

    // Y3 = L * (X1 - X3) - Y1
    const ny = l.redMul(this.x.redSub(nx)).redISub(this.y);

    return this.curve.point(nx, ny);
  }

  dblp(pow) {
    return this.toJ().dblp(pow).toP();
  }

  getX() {
    if (this.inf)
      throw new Error('Invalid point.');

    return this.x.fromRed();
  }

  getY() {
    if (this.inf)
      throw new Error('Invalid point.');

    return this.y.fromRed();
  }

  eq(p) {
    assert(p instanceof ShortPoint);

    // P = Q
    if (this === p)
      return true;

    // P = O
    if (this.inf)
      return p.inf;

    // Q = O
    if (p.inf)
      return false;

    // X1 = X2, Y1 = Y2
    return this.x.eq(p.x)
        && this.y.eq(p.y);
  }

  cmp(point) {
    assert(point instanceof ShortPoint);

    if (this.inf && !point.inf)
      return -1;

    if (!this.inf && point.inf)
      return 1;

    if (this.inf && point.inf)
      return 0;

    return this.order().cmp(point.order())
        || this.getX().cmp(point.getX())
        || this.getY().cmp(point.getY());
  }

  isInfinity() {
    // Infinity cannot be represented in
    // the affine space, except by a flag.
    return this.inf;
  }

  isOrder2() {
    if (this.inf)
      return false;

    return this.y.isZero();
  }

  isOdd() {
    if (this.inf)
      return false;

    return this.y.redIsOdd();
  }

  isEven() {
    if (this.inf)
      return false;

    return this.y.redIsEven();
  }

  isSquare() {
    if (this.inf)
      return false;

    return this.y.redJacobi() !== -1;
  }

  eqX(x) {
    assert(x instanceof BN);
    assert(!x.red);

    if (this.inf)
      return false;

    return this.getX().eq(x);
  }

  eqR(x) {
    assert(x instanceof BN);
    assert(!x.red);
    assert(!this.curve.n.isZero());

    if (this.inf)
      return false;

    return this.getX().imod(this.curve.n).eq(x);
  }

  mul(k) {
    return super.mul(k).toP();
  }

  muln(k) {
    return super.muln(k).toP();
  }

  mulBlind(k, rng) {
    return super.mulBlind(k, rng).toP();
  }

  mulAdd(k1, p2, k2) {
    return super.mulAdd(k1, p2, k2).toP();
  }

  mulH() {
    return super.mulH().toP();
  }

  div(k) {
    return super.div(k).toP();
  }

  divn(k) {
    return super.divn(k).toP();
  }

  divH() {
    return super.divH().toP();
  }

  toP() {
    return this;
  }

  toJ() {
    // (X3, Y3, Z3) = (1, 1, 0)
    if (this.inf)
      return this.curve.jpoint();

    // (X3, Y3, Z3) = (X1, Y1, 1)
    return this.curve.jpoint(this.x, this.y, this.curve.one);
  }

  encode(compact) {
    // [SEC1] Page 10, Section 2.3.3.
    if (compact == null)
      compact = true;

    assert(typeof compact === 'boolean');

    const {fieldSize} = this.curve;

    // We do not serialize points at infinity.
    if (this.inf)
      throw new Error('Invalid point.');

    // Compressed form (0x02 = even, 0x03 = odd).
    if (compact) {
      const p = Buffer.alloc(1 + fieldSize);
      const x = this.curve.encodeField(this.getX());

      p[0] = 0x02 | this.y.redIsOdd();
      x.copy(p, 1);

      return p;
    }

    // Uncompressed form (0x04).
    const p = Buffer.alloc(1 + fieldSize * 2);
    const x = this.curve.encodeField(this.getX());
    const y = this.curve.encodeField(this.getY());

    p[0] = 0x04;
    x.copy(p, 1);
    y.copy(p, 1 + fieldSize);

    return p;
  }

  static decode(curve, bytes) {
    // [SEC1] Page 11, Section 2.3.4.
    assert(curve instanceof ShortCurve);
    assert(Buffer.isBuffer(bytes));

    const len = curve.fieldSize;

    if (bytes.length < 1 + len)
      throw new Error('Not a point.');

    // Point forms:
    //
    //   0x00 -> Infinity (openssl, unsupported)
    //   0x02 -> Compressed Even
    //   0x03 -> Compressed Odd
    //   0x04 -> Uncompressed
    //   0x06 -> Hybrid Even (openssl)
    //   0x07 -> Hybrid Odd (openssl)
    //
    // Note that openssl supports serializing points
    // at infinity as {0}. We choose not to support it
    // because it's strange and not terribly useful.
    const form = bytes[0];

    switch (form) {
      case 0x02:
      case 0x03: {
        if (bytes.length !== 1 + len)
          throw new Error('Invalid point size for compressed.');

        const x = curve.decodeField(bytes.slice(1, 1 + len));

        if (x.cmp(curve.p) >= 0)
          throw new Error('Invalid point.');

        const p = curve.pointFromX(x, form === 0x03);

        assert(!p.isInfinity());

        return p;
      }

      case 0x04:
      case 0x06:
      case 0x07: {
        if (bytes.length !== 1 + len * 2)
          throw new Error('Invalid point size for uncompressed.');

        const x = curve.decodeField(bytes.slice(1, 1 + len));
        const y = curve.decodeField(bytes.slice(1 + len, 1 + 2 * len));

        // [GECC] Algorithm 4.3, Page 180, Section 4.
        if (x.cmp(curve.p) >= 0 || y.cmp(curve.p) >= 0)
          throw new Error('Invalid point.');

        // OpenSSL hybrid encoding.
        if (form !== 0x04 && form !== (0x06 | y.isOdd()))
          throw new Error('Invalid hybrid encoding.');

        const p = curve.point(x, y);

        if (!p.validate())
          throw new Error('Invalid point.');

        assert(!p.isInfinity());

        return p;
      }

      default: {
        throw new Error('Unknown point format.');
      }
    }
  }

  encodeX() {
    // [SCHNORR] "Specification".
    // [BIP340] "Specification".
    return this.curve.encodeField(this.getX());
  }

  static decodeEven(curve, bytes) {
    // [BIP340] "Specification".
    assert(curve instanceof ShortCurve);

    const x = curve.decodeField(bytes);

    if (x.cmp(curve.p) >= 0)
      throw new Error('Invalid point.');

    return curve.pointFromX(x, false);
  }

  static decodeSquare(curve, bytes) {
    // [SCHNORR] "Specification".
    assert(curve instanceof ShortCurve);

    const x = curve.decodeField(bytes);

    if (x.cmp(curve.p) >= 0)
      throw new Error('Invalid point.');

    return curve.pointFromX(x);
  }

  toJSON(pre) {
    if (this.inf)
      return [];

    const x = this.getX().toJSON();
    const y = this.getY().toJSON();

    if (pre === true && this.pre)
      return [x, y, this.pre.toJSON()];

    return [x, y];
  }

  toPretty() {
    if (this.inf)
      return [];

    const size = this.curve.fieldSize * 2;
    const x = toPretty(this.getX(), size);
    const y = toPretty(this.getY(), size);

    return [x, y];
  }

  static fromJSON(curve, json) {
    assert(curve instanceof ShortCurve);
    assert(Array.isArray(json));
    assert(json.length === 0
        || json.length === 2
        || json.length === 3);

    if (json.length === 0)
      return curve.point();

    const x = BN.fromJSON(json[0]);
    const y = BN.fromJSON(json[1]);
    const point = curve.point(x, y);

    if (json.length > 2 && json[2] != null)
      point.pre = Precomp.fromJSON(point, json[2]);

    return point;
  }

  [custom]() {
    if (this.inf)
      return '<ShortPoint: Infinity>';

    return '<ShortPoint:'
         + ' x=' + this.x.fromRed().toString(16, 2)
         + ' y=' + this.y.fromRed().toString(16, 2)
         + '>';
  }
}

/**
 * JPoint
 */

class JPoint extends Point {
  constructor(curve, x, y, z) {
    assert(curve instanceof ShortCurve);

    super(curve, types.JACOBIAN);

    this.x = this.curve.one;
    this.y = this.curve.one;
    this.z = this.curve.zero;
    this.zOne = false;

    if (x != null)
      this._init(x, y, z);
  }

  _init(x, y, z) {
    assert(x instanceof BN);
    assert(y instanceof BN);
    assert(z == null || (z instanceof BN));

    this.x = x;
    this.y = y;
    this.z = z || this.curve.one;

    if (!this.x.red)
      this.x = this.x.toRed(this.curve.red);

    if (!this.y.red)
      this.y = this.y.toRed(this.curve.red);

    if (!this.z.red)
      this.z = this.z.toRed(this.curve.red);

    this.zOne = this.z.eq(this.curve.one);
  }

  clone() {
    return this.curve.jpoint(this.x, this.y, this.z);
  }

  validate() {
    // [GECC] Example 3.20, Page 88, Section 3.
    const {a, b} = this.curve;

    // P = O
    if (this.isInfinity())
      return true;

    // Z1 = 1
    if (this.zOne)
      return this.curve.validate(this.toP());

    // y^2 = x^3 + a * x * z^4 + b * z^6
    const lhs = this.y.redSqr();
    const x3 = this.x.redSqr().redMul(this.x);
    const z2 = this.z.redSqr();
    const z4 = z2.redSqr();
    const z6 = z4.redMul(z2);
    const rhs = x3.redIAdd(b.redMul(z6));

    if (!this.curve.zeroA) {
      // Save some cycles for a = -3.
      if (this.curve.threeA)
        rhs.redIAdd(z4.redIMuln(-3).redMul(this.x));
      else
        rhs.redIAdd(a.redMul(z4).redMul(this.x));
    }

    return lhs.eq(rhs);
  }

  normalize() {
    // https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#scaling-z
    // 1I + 3M + 1S

    // Z = 1
    if (this.zOne)
      return this;

    // P = O
    if (this.isInfinity())
      return this;

    // A = 1 / Z1
    const a = this.z.redInvert();

    // AA = A^2
    const aa = a.redSqr();

    // X3 = X1 * AA
    this.x = this.x.redMul(aa);

    // Y3 = Y1 * AA * A
    this.y = this.y.redMul(aa).redMul(a);

    // Z3 = 1
    this.z = this.curve.one;
    this.zOne = true;

    return this;
  }

  scale(a) {
    assert(a instanceof BN);

    // P = O
    if (this.isInfinity())
      return this.curve.jpoint();

    // AA = A^2
    const aa = a.redSqr();

    // X3 = X1 * AA
    const nx = this.x.redMul(aa);

    // Y3 = Y1 * AA * A
    const ny = this.y.redMul(aa).redMul(a);

    // Z3 = Z1 * A
    const nz = this.z.redMul(a);

    return this.curve.jpoint(nx, ny, nz);
  }

  neg() {
    // -(X1, Y1, Z1) = (X1, -Y1, Z1)
    return this.curve.jpoint(this.x, this.y.redNeg(), this.z);
  }

  add(p) {
    assert(p instanceof Point);

    if (p.type === types.AFFINE)
      return this._mixedAdd(p);

    return this._add(p);
  }

  _add(p) {
    assert(p instanceof JPoint);

    // O + P = P
    if (this.isInfinity())
      return p;

    // P + O = P
    if (p.isInfinity())
      return this;

    // Z1 = 1
    if (this.zOne)
      return p._addJA(this);

    // Z2 = 1
    if (p.zOne)
      return this._addJA(p);

    return this._addJJ(p);
  }

  _mixedAdd(p) {
    assert(p instanceof ShortPoint);

    // O + P = P
    if (this.isInfinity())
      return p.toJ();

    // P + O = P
    if (p.isInfinity())
      return this;

    return this._addJA(p);
  }

  _addJJ(p) {
    // No assumptions.
    // https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#addition-add-1998-cmo-2
    // 12M + 4S + 6A + 1*2 (implemented as: 12M + 4S + 7A)

    // Z1Z1 = Z1^2
    const z1z1 = this.z.redSqr();

    // Z2Z2 = Z2^2
    const z2z2 = p.z.redSqr();

    // U1 = X1 * Z2Z2
    const u1 = this.x.redMul(z2z2);

    // U2 = X2 * Z1Z1
    const u2 = p.x.redMul(z1z1);

    // S1 = Y1 * Z2 * Z2Z2
    const s1 = this.y.redMul(p.z).redMul(z2z2);

    // S2 = Y2 * Z1 * Z1Z1
    const s2 = p.y.redMul(this.z).redMul(z1z1);

    // H = U2 - U1
    const h = u2.redISub(u1);

    // r = S2 - S1
    const r = s2.redISub(s1);

    // H = 0
    if (h.isZero()) {
      if (!r.isZero())
        return this.curve.jpoint();

      return this.dbl();
    }

    // HH = H^2
    const hh = h.redSqr();

    // HHH = H * HH
    const hhh = h.redMul(hh);

    // V = U1 * HH
    const v = u1.redMul(hh);

    // X3 = r^2 - HHH - 2 * V
    const nx = r.redSqr().redISub(hhh).redISub(v).redISub(v);

    // Y3 = r * (V - X3) - S1 * HHH
    const ny = r.redMul(v.redISub(nx)).redISub(s1.redMul(hhh));

    // Z3 = Z1 * Z2 * H
    const nz = this.z.redMul(p.z).redMul(h);

    return this.curve.jpoint(nx, ny, nz);
  }

  _addJA(p) {
    // Assumes Z2 = 1.
    // https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#addition-madd
    // 8M + 3S + 6A + 5*2 (implemented as: 8M + 3S + 7A + 4*2)

    // Z1Z1 = Z1^2
    const z1z1 = this.z.redSqr();

    // U2 = X2 * Z1Z1
    const u2 = p.x.redMul(z1z1);

    // S2 = Y2 * Z1 * Z1Z1
    const s2 = p.y.redMul(this.z).redMul(z1z1);

    // H = U2 - X1
    const h = u2.redISub(this.x);

    // r = 2 * (S2 - Y1)
    const r = s2.redISub(this.y).redIMuln(2);

    // H = 0
    if (h.isZero()) {
      if (!r.isZero())
        return this.curve.jpoint();

      return this.dbl();
    }

    // I = (2 * H)^2
    const i = h.redMuln(2).redSqr();

    // J = H * I
    const j = h.redMul(i);

    // V = X1 * I
    const v = this.x.redMul(i);

    // X3 = r^2 - J - 2 * V
    const nx = r.redSqr().redISub(j).redISub(v).redISub(v);

    // Y3 = r * (V - X3) - 2 * Y1 * J
    const ny = r.redMul(v.redISub(nx)).redISub(this.y.redMul(j).redIMuln(2));

    // Z3 = 2 * Z1 * H
    const nz = this.z.redMul(h).redIMuln(2);

    return this.curve.jpoint(nx, ny, nz);
  }

  dbl() {
    // P = O
    if (this.isInfinity())
      return this;

    // Y1 = 0
    if (this.y.isZero())
      return this.curve.jpoint();

    // a = 0
    if (this.curve.zeroA)
      return this._dbl0();

    // a = -3
    if (this.curve.threeA)
      return this._dbl3();

    return this._dblJ();
  }

  _dblJ() {
    // https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#doubling-dbl-1998-cmo-2
    // 3M + 6S + 4A + 1*a + 2*2 + 1*3 + 1*4 + 1*8
    // (implemented as: 3M + 6S + 5A + 1*a + 1*2 + 1*3 + 1*4 + 1*8)

    // XX = X1^2
    const xx = this.x.redSqr();

    // YY = Y1^2
    const yy = this.y.redSqr();

    // ZZ = Z1^2
    const zz = this.z.redSqr();

    // S = 4 * X1 * YY
    const s = this.x.redMul(yy).redIMuln(4);

    // M = 3 * XX + a * ZZ^2
    const m = xx.redIMuln(3).redIAdd(this.curve.a.redMul(zz.redSqr()));

    // T = M^2 - 2 * S
    const t = m.redSqr().redISub(s).redISub(s);

    // X3 = T
    const nx = t;

    // Y3 = M * (S - T) - 8 * YY^2
    const ny = m.redMul(s.redISub(t)).redISub(yy.redSqr().redIMuln(8));

    // Z3 = 2 * Y1 * Z1
    const nz = this.y.redMul(this.z).redIMuln(2);

    return this.curve.jpoint(nx, ny, nz);
  }

  _dbl0() {
    // Assumes a = 0.
    // https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-0.html#doubling-dbl-2009-l
    // 2M + 5S + 6A + 3*2 + 1*3 + 1*8
    // (implemented as: 2M + 5S + 7A + 2*2 + 1*3 + 1*8)

    // A = X1^2
    const a = this.x.redSqr();

    // B = Y1^2
    const b = this.y.redSqr();

    // C = B^2
    const c = b.redSqr();

    // + XB2 = (X1 + B)^2
    const xb2 = b.redIAdd(this.x).redSqr();

    // D = 2 * ((X1 + B)^2 - A - C)
    const d = xb2.redISub(a).redISub(c).redIMuln(2);

    // E = 3 * A
    const e = a.redIMuln(3);

    // F = E^2
    const f = e.redSqr();

    // X3 = F - 2 * D
    const nx = f.redISub(d).redISub(d);

    // Y3 = E * (D - X3) - 8 * C
    const ny = e.redMul(d.redISub(nx)).redISub(c.redIMuln(8));

    // Z3 = 2 * Y1 * Z1
    const nz = this.y.redMul(this.z).redIMuln(2);

    return this.curve.jpoint(nx, ny, nz);
  }

  _dbl3() {
    // Assumes a = -3.
    // https://hyperelliptic.org/EFD/g1p/auto-shortw-jacobian-3.html#doubling-dbl-2001-b
    // 3M + 5S + 8A + 1*3 + 1*4 + 2*8
    // (implemented as: 3M + 5S + 8A + 1*2 + 1*3 + 1*4 + 1*8)

    // delta = Z1^2
    const delta = this.z.redSqr();

    // gamma = Y1^2
    const gamma = this.y.redSqr();

    // beta = X1 * gamma
    const beta = this.x.redMul(gamma);

    // + xmdelta = X1 - delta
    const xmdelta = this.x.redSub(delta);

    // + xpdelta = X1 + delta
    const xpdelta = this.x.redAdd(delta);

    // alpha = 3 * (X1 - delta) * (X1 + delta)
    const alpha = xmdelta.redMul(xpdelta).redIMuln(3);

    // + beta4 = 4 * beta
    const beta4 = beta.redIMuln(4);

    // + beta8 = 2 * beta4
    const beta8 = beta4.redMuln(2);

    // + gamma28 = 8 * gamma^2
    const gamma28 = gamma.redSqr().redIMuln(8);

    // X3 = alpha^2 - 8 * beta
    const nx = alpha.redSqr().redISub(beta8);

    // Z3 = (Y1 + Z1)^2 - gamma - delta
    const nz = this.y.redAdd(this.z).redSqr().redISub(gamma).redISub(delta);

    // Y3 = alpha * (4 * beta - X3) - 8 * gamma^2
    const ny = alpha.redMul(beta4.redISub(nx)).redISub(gamma28);

    return this.curve.jpoint(nx, ny, nz);
  }

  getX() {
    if (this.isInfinity())
      throw new Error('Invalid point.');

    this.normalize();

    return this.x.fromRed();
  }

  getY() {
    if (this.isInfinity())
      throw new Error('Invalid point.');

    this.normalize();

    return this.y.fromRed();
  }

  eq(p) {
    assert(p instanceof JPoint);

    // P = Q
    if (this === p)
      return true;

    // P = O
    if (this.isInfinity())
      return p.isInfinity();

    // Q = O
    if (p.isInfinity())
      return false;

    // Z1 = Z2
    if (this.z.eq(p.z)) {
      return this.x.eq(p.x)
          && this.y.eq(p.y);
    }

    // X1 * Z2^2 = X2 * Z1^2
    const zz1 = this.z.redSqr();
    const zz2 = p.z.redSqr();
    const x1 = this.x.redMul(zz2);
    const x2 = p.x.redMul(zz1);

    if (!x1.eq(x2))
      return false;

    // Y1 * Z2^3 = Y2 * Z1^3
    const zzz1 = zz1.redMul(this.z);
    const zzz2 = zz2.redMul(p.z);
    const y1 = this.y.redMul(zzz2);
    const y2 = p.y.redMul(zzz1);

    return y1.eq(y2);
  }

  cmp(point) {
    assert(point instanceof JPoint);

    const inf1 = this.isInfinity();
    const inf2 = point.isInfinity();

    if (inf1 && !inf2)
      return -1;

    if (!inf1 && inf2)
      return 1;

    if (inf1 && inf2)
      return 0;

    return this.order().cmp(point.order())
        || this.getX().cmp(point.getX())
        || this.getY().cmp(point.getY());
  }

  isInfinity() {
    // Z1 = 0
    return this.z.isZero();
  }

  isOrder2() {
    if (this.isInfinity())
      return false;

    return this.y.isZero();
  }

  isOdd() {
    if (this.isInfinity())
      return false;

    this.normalize();

    return this.y.redIsOdd();
  }

  isEven() {
    if (this.isInfinity())
      return false;

    this.normalize();

    return this.y.redIsEven();
  }

  isSquare() {
    if (this.isInfinity())
      return false;

    return this.y.redMul(this.z).redJacobi() !== -1;
  }

  eqX(x) {
    // Verify that integer `x` is equal to field
    // element `x` by scaling it by our z coordinate.
    // This optimization is mentioned in and used for
    // bip-schnorr[1]. This avoids having to affinize
    // the resulting point during verification.
    //
    // [1] [SCHNORR] "Optimizations".
    assert(x instanceof BN);
    assert(!x.red);

    if (this.isInfinity())
      return false;

    const zz = this.z.redSqr();
    const rx = x.toRed(this.curve.red).redMul(zz);

    return this.x.eq(rx);
  }

  eqR(x) {
    // Similar to the optimization above, this
    // optimization, suggested by Maxwell[1],
    // compares an integer to an X coordinate
    // by scaling it.
    //
    // Since a signature's R value is modulo N
    // in ECDSA, we may be dealing with an R
    // value greater than N in actuality.
    //
    // If the equality check fails, we can
    // scale N itself by Z and add it to the
    // X field element.
    //
    // [1] https://github.com/bitcoin-core/secp256k1/commit/ce7eb6f
    assert(x instanceof BN);
    assert(!x.red);

    if (!this.curve.smallGap)
      return this.toP().eqR(x);

    if (this.isInfinity())
      return false;

    if (x.cmp(this.curve.p) >= 0)
      return false;

    const zz = this.z.redSqr();
    const rx = x.toRed(this.curve.red).redMul(zz);

    if (this.x.eq(rx))
      return true;

    if (this.curve.highOrder)
      return false;

    if (x.cmp(this.curve.pmodn) >= 0)
      return false;

    const rn = this.curve.redN.redMul(zz);

    rx.redIAdd(rn);

    return this.x.eq(rx);
  }

  toP() {
    // P = O
    if (this.isInfinity())
      return this.curve.point();

    this.normalize();

    // (X3, Y3) = (X1 / Z1^2, Y1 / Z1^3)
    return this.curve.point(this.x, this.y);
  }

  toJ() {
    return this;
  }

  encode(compact) {
    return this.toP().encode(compact);
  }

  static decode(curve, bytes) {
    return ShortPoint.decode(curve, bytes).toJ();
  }

  encodeX() {
    return this.toP().encodeX();
  }

  static decodeEven(curve, bytes) {
    return ShortPoint.decodeEven(curve, bytes).toJ();
  }

  static decodeSquare(curve, bytes) {
    return ShortPoint.decodeSquare(curve, bytes).toJ();
  }

  toJSON(pre) {
    return this.toP().toJSON(pre);
  }

  toPretty() {
    return this.toP().toPretty();
  }

  static fromJSON(curve, json) {
    return ShortPoint.fromJSON(curve, json).toJ();
  }

  [custom]() {
    if (this.isInfinity())
      return '<JPoint: Infinity>';

    return '<JPoint:'
         + ' x=' + this.x.fromRed().toString(16, 2)
         + ' y=' + this.y.fromRed().toString(16, 2)
         + ' z=' + this.z.fromRed().toString(16, 2)
         + '>';
  }
}

/**
 * MontCurve
 */

class MontCurve extends Curve {
  constructor(conf) {
    super(MontPoint, 'mont', conf);

    this.a = BN.fromJSON(conf.a).toRed(this.red);
    this.b = BN.fromJSON(conf.b).toRed(this.red);

    this.bi = this.b.redInvert();
    this.a2 = this.a.redAdd(this.two);
    this.a24 = this.a2.redMul(this.i4);
    this.a3 = this.a.redMul(this.i3);
    this.a0 = this.a.redMul(this.bi);
    this.b0 = this.bi.redSqr();

    this._finalize(conf);
  }

  static _isomorphism(curveA, curveB, customB) {
    // Montgomery Isomorphism.
    //
    // [MONT3] Page 3, Section 2.1.
    //
    // Transformation:
    //
    //   A' = A
    //   B' = B'
    //
    // Where (B / B') is square.
    assert(curveA instanceof BN);
    assert(curveB instanceof BN);
    assert(customB instanceof BN);

    const a = curveA.clone();
    const b = customB.clone();
    const c = curveB.redDiv(customB);

    if (c.redJacobi() !== 1)
      throw new Error('Invalid `b` coefficient.');

    return [a, b];
  }

  _short(a0, odd) {
    // Montgomery->Short Weierstrass Equivalence.
    //
    // [MONT2] "Equivalence with Weierstrass curves".
    //
    // Transformation:
    //
    //   a = (3 - A^2) / (3 * B^2)
    //   b = (2 * A^3 - 9 * A) / (27 * B^3)
    const {a, b, three} = this;
    const a2 = a.redSqr();
    const a3 = a2.redMul(a);
    const b2 = b.redSqr();
    const b3 = b2.redMul(b);
    const n0 = three.redSub(a2);
    const d0 = b2.redMuln(3);
    const n1 = a3.redMuln(2).redISub(a.redMuln(9));
    const d1 = b3.redMuln(27);
    const wa = n0.redDiv(d0);
    const wb = n1.redDiv(d1);

    if (a0 != null)
      return ShortCurve._isomorphism(wa, wb, a0, odd);

    return [wa, wb];
  }

  _mont(b0) {
    return MontCurve._isomorphism(this.a, this.b, b0);
  }

  _edwards(a0, invert = false) {
    // Montgomery->Twisted Edwards Transformation.
    //
    // [MONT1] Page 11, Section 4.3.5.
    // [TWISTED] Theorem 3.2, Page 4, Section 3.
    //
    // Equivalence:
    //
    //   a = (A + 2) / B
    //   d = (A - 2) / B
    //
    // Isomorphism:
    //
    //   a = a'
    //   d = a' * (A - 2) / (A + 2)
    //
    // Where ((A + 2) / (B * a')) is square.
    //
    // If `d` is square, we can usually find
    // a complete curve by using the `invert`
    // option. This will create an isomorphism
    // chain of: M(A,B)->E(a,d)->E(d,a).
    //
    // The equivalence between E(a,d) and
    // E(d,a) is:
    //
    //   (x, y) = (x, 1 / y)
    //
    // Meaning our map to E(d,a) is:
    //
    //   x = u / v
    //   y = 1 / ((u - 1) / (u + 1))
    //     = (u + 1) / (u - 1)
    assert(typeof invert === 'boolean');

    const {two, bi} = this;
    const a = this.a.redAdd(two).redMul(bi);
    const d = this.a.redSub(two).redMul(bi);

    if (invert)
      a.swap(d);

    if (a0 != null)
      return EdwardsCurve._isomorphism(a, d, a0);

    return [a, d];
  }

  _scaleShort(curve) {
    assert(curve instanceof ShortCurve);

    const [u2, u3] = curve._scale(this);

    return [this.field(u2.redInvert()),
            this.field(u3.redInvert())];
  }

  _scaleMont(curve) {
    // We can extract the isomorphism factor with:
    //
    //   c = +-sqrt(B / B')
    //
    // If base points are available, we can do:
    //
    //   c = v' / v
    assert(curve instanceof MontCurve);

    if (this.g.isInfinity() || curve.g.isInfinity())
      return this.field(curve.b).redDivSqrt(this.b);

    return this.g.y.redDiv(this.field(curve.g.y));
  }

  _scaleEdwards(curve, invert) {
    // We _could_ do something like:
    //
    //   B = 4 / (a - d)
    //   c = +-sqrt(B / B')
    //
    // Which can be reduced to:
    //
    //   c = +-sqrt(4 / ((a - d) * B'))
    //
    // If base points are available:
    //
    //   v = u' / x
    //   c = v' / v
    //
    // Which can be reduced to:
    //
    //   c = v' * x / u'
    //
    // However, the way our maps are
    // written, we can re-use the Edwards
    // isomorphism factor when going the
    // other direction.
    assert(curve instanceof EdwardsCurve);

    const c = curve._scale(this, invert);

    return this.field(c);
  }

  _solveY0(x) {
    assert(x instanceof BN);

    // y^2 = x^3 + A * x^2 + B * x
    const a = this.a0;
    const b = this.b0;
    const x2 = x.redSqr();
    const x3 = x2.redMul(x);
    const y2 = x3.redIAdd(a.redMul(x2)).redIAdd(b.redMul(x));

    return y2;
  }

  _elligator2(u) {
    // Elligator 2.
    //
    // Distribution: 1/2.
    //
    // [ELL2] Page 11, Section 5.2.
    // [H2EC] "Elligator 2 Method".
    //        "Mappings for Montgomery curves".
    // [SAFE] "Indistinguishability from uniform random strings".
    //
    // Assumptions:
    //
    //   - y^2 = x^3 + A * x^2 + B * x.
    //   - A != 0, B != 0.
    //   - A^2 - 4 * B is non-zero and non-square in F(p).
    //   - Let z be a non-square in F(p).
    //   - u != +-sqrt(-1 / z).
    //
    // Note that Elligator 2 is defined over the form:
    //
    //   y'^2 = x'^3 + A' * x'^2 + B' * x'
    //
    // Instead of:
    //
    //   B * y^2 = x^3 + A * x^2 + x
    //
    // Where:
    //
    //   A' = A / B
    //   B' = 1 / B^2
    //   x' = x / B
    //   y' = y / B
    //
    // And:
    //
    //   x = B * x'
    //   y = B * y'
    //
    // This is presumably the result of Elligator 2
    // being designed in long Weierstrass form. If
    // we want to support B != 1, we need to do the
    // conversion.
    //
    // Map:
    //
    //   g(x) = x^3 + A * x^2 + B * x
    //   x1 = -A / (1 + z * u^2)
    //   x1 = -A, if x1 = 0
    //   x2 = -x1 - A
    //   x = x1, if g(x1) is square
    //     = x2, otherwise
    //   y = sign(u) * abs(sqrt(g(x)))
    const lhs = this.a0.redNeg();
    const rhs = this.one.redAdd(this.z.redMul(u.redSqr()));

    if (rhs.isZero())
      rhs.inject(this.one);

    const x1 = lhs.redMul(rhs.redInvert());
    const x2 = x1.redNeg().redISub(this.a0);
    const y1 = this._solveY0(x1);
    const y2 = this._solveY0(x2);
    const alpha = y1.redIsSquare() | 0;
    const x0 = [x1, x2][alpha ^ 1];
    const y0 = [y1, y2][alpha ^ 1].redSqrt();

    if (y0.redIsOdd() !== u.redIsOdd())
      y0.redINeg();

    const x = this.b.redMul(x0);
    const y = this.b.redMul(y0);

    return this.point(x, y);
  }

  _invert2(p, hint) {
    // Inverting the Map (Elligator 2).
    //
    // [ELL2] Page 12, Section 5.3.
    //
    // Assumptions:
    //
    //   - -z * x * (x + A) is square in F(p).
    //   - If r = 1 then x != 0.
    //   - If r = 2 then x != -A.
    //
    // Map:
    //
    //   u1 = -(x + A) / (x * z)
    //   u2 = -x / ((x + A) * z)
    //   r = random integer in [1,2]
    //   u = sign(y) * abs(sqrt(ur))
    //
    // Note that `0 / 0` can only occur if A = 0
    // (this violates the assumptions of Elligator 2).
    const {x, y} = p;
    const r = hint & 1;
    const x0 = x.redMul(this.bi);
    const y0 = y.redMul(this.bi);
    const n = x0.redAdd(this.a0);
    const d = x0;
    const lhs = [n, d][r].redINeg();
    const rhs = [d, n][r].redMul(this.z);
    const u = lhs.redDivSqrt(rhs);

    if (u.redIsOdd() !== y0.redIsOdd())
      u.redINeg();

    return u;
  }

  isElliptic() {
    const a2 = this.a.redSqr();
    const d = this.b.redMul(a2.redSub(this.four));

    // B * (A^2 - 4) != 0
    return !d.isZero();
  }

  jinv() {
    // [MONT3] Page 3, Section 2.
    const {a, three, four} = this;
    const a2 = a.redSqr();
    const t0 = a2.redSub(three);
    const lhs = t0.redPown(3).redIMuln(256);
    const rhs = a2.redSub(four);

    if (rhs.isZero())
      throw new Error('Curve is not elliptic.');

    // (256 * (A^2 - 3)^3) / (A^2 - 4)
    return lhs.redDiv(rhs).fromRed();
  }

  point(x, y) {
    return new MontPoint(this, x, y);
  }

  jpoint(x, y, z) {
    assert(x == null && y == null && z == null);
    return this.point();
  }

  xpoint(x, z) {
    return new XPoint(this, x, z);
  }

  solveY2(x) {
    // [MONT3] Page 3, Section 2.
    // https://hyperelliptic.org/EFD/g1p/auto-montgom.html
    assert(x instanceof BN);

    // B * y^2 = x^3 + A * x^2 + x
    const x2 = x.redSqr();
    const x3 = x2.redMul(x);
    const by2 = x3.redIAdd(this.a.redMul(x2)).redIAdd(x);
    const y2 = by2.redMul(this.bi);

    return y2;
  }

  validate(point) {
    assert(point instanceof MontPoint);

    if (point.isInfinity())
      return true;

    const {x, y} = point;
    const y2 = this.solveY2(x);

    return y.redSqr().eq(y2);
  }

  pointFromX(x, sign = null) {
    assert(x instanceof BN);
    assert(sign == null || typeof sign === 'boolean');

    if (!x.red)
      x = x.toRed(this.red);

    const y = this.solveY(x);

    if (sign != null) {
      if (y.isZero() && sign)
        throw new Error('Invalid point.');

      if (y.redIsOdd() !== sign)
        y.redINeg();
    }

    return this.point(x, y);
  }

  isIsomorphic(curve, invert) {
    // [MONT3] Page 3, Section 2.1.
    assert(curve instanceof Curve);

    if (!curve.p.eq(this.p))
      return false;

    // M(A,B) <-> M(A,B')
    if (curve.type === 'mont') {
      const a = this.field(curve.a);
      const b = this.field(curve.b);

      // A' = A
      if (!this.a.eq(a))
        return false;

      // B' != 0
      if (this.b.isZero())
        return false;

      // jacobi(B / B') = 1
      const c = b.redDiv(this.b);

      return c.redJacobi() === 1;
    }

    return curve.isIsomorphic(this, invert);
  }

  isIsogenous(curve) {
    assert(curve instanceof Curve);

    if (curve.type === 'mont')
      return false;

    return curve.isIsogenous(this);
  }

  pointFromShort(point) {
    // [ALT] Appendix E.2 (Switching between Alternative Representations).
    // [MONT2] "Equivalence with Weierstrass curves"
    assert(point instanceof ShortPoint);

    if (this.isIsomorphic(point.curve)) {
      // Equivalence for E(a,b)->M(A,B):
      //
      //   u = B * x - A / 3
      //   v = B * y
      //
      // Undefined if ((u^3 + A * u^2 + u) / B) is not square.
      if (point.isInfinity())
        return this.point();

      const {a3, b} = this;
      const [u2, u3] = this._scale(point.curve);
      const x = this.field(point.x).redMul(u2);
      const y = this.field(point.y).redMul(u3);
      const u = b.redMul(x).redISub(a3);
      const v = b.redMul(y);

      return this.point(u, v);
    }

    throw new Error('Not implemented.');
  }

  pointFromMont(point) {
    // [MONT3] Page 3, Section 2.1.
    assert(point instanceof MontPoint);

    if (this.isIsomorphic(point.curve)) {
      // Isomorphic maps for M(A,B)<->M(A,B'):
      //
      //   u' = u
      //   v' = +-sqrt(B / B') * v
      //
      // Undefined if (B / B') is not square.
      if (point.isInfinity())
        return this.point();

      const c = this._scale(point.curve);
      const u = this.field(point.x);
      const v = this.field(point.y);
      const nu = u;
      const nv = c.redMul(v);

      return this.point(nu, nv);
    }

    throw new Error('Not implemented.');
  }

  pointFromEdwards(point) {
    // [RFC7748] Section 4.1 & 4.2.
    // [MONT3] Page 6, Section 2.5.
    // [TWISTED] Theorem 3.2, Page 4, Section 3.
    assert(point instanceof EdwardsPoint);
    assert(point.curve.p.eq(this.p));

    // Edwards `x`, `y`, `z`.
    const x = this.field(point.x);
    const y = this.field(point.y);
    const z = this.field(point.z);

    if (this.isIsogenous(point.curve)) {
      // 4-isogeny maps for E(1,d)->M(2-4d,1):
      //
      //   u = y^2 / x^2
      //   v = (2 - x^2 - y^2) * y / x^3
      //
      // Undefined for x = 0.
      //
      // Exceptional Cases:
      //   - (0, 1) -> O
      //   - (0, -1) -> (0, 0)
      //
      // Unexceptional Cases:
      //   - (+-1, 0) -> (0, 0)
      if (point.isInfinity())
        return this.point();

      if (point.x.isZero())
        return this.point(this.zero, this.zero);

      const c = z.redSqr().redIMuln(2);
      const uu = y.redSqr();
      const uz = x.redSqr();
      const vv = c.redISub(uz).redISub(uu).redMul(y);
      const vz = uz.redMul(x);

      return this.cpoint(uu, uz, vv, vz);
    }

    if (this.isIsomorphic(point.curve, true)) {
      // Isomorphic maps for E(d,a)->M(A,B):
      //
      //   u = (y + 1) / (y - 1)
      //   v = +-sqrt((A - 2) / (B * a)) * u / x
      //
      // Undefined for x = 0 or y = 1.
      //
      // Exceptional Cases:
      //   - (0, 1) -> O
      //   - (0, -1) -> (0, 0)
      //
      // Unexceptional Cases:
      //   - (+-sqrt(1 / a), 0) -> (-1, +-sqrt((A - 2) / B))
      if (point.isInfinity())
        return this.point();

      if (point.x.isZero())
        return this.point(this.zero, this.zero);

      const c = this._scale(point.curve, true);
      const uu = y.redAdd(z);
      const uz = y.redSub(z);
      const vv = c.redMul(z).redMul(uu);
      const vz = x.redMul(uz);

      return this.cpoint(uu, uz, vv, vz);
    }

    if (this.isIsomorphic(point.curve, false)) {
      // Isomorphic maps for E(a,d)->M(A,B):
      //
      //   u = (1 + y) / (1 - y)
      //   v = +-sqrt((A + 2) / (B * a)) * u / x
      //
      // Undefined for x = 0 or y = 1.
      //
      // Exceptional Cases:
      //   - (0, 1) -> O
      //   - (0, -1) -> (0, 0)
      //
      // Unexceptional Cases:
      //   - (+-sqrt(1 / a), 0) -> (1, +-sqrt((A + 2) / B))
      if (point.isInfinity())
        return this.point();

      if (point.x.isZero())
        return this.point(this.zero, this.zero);

      const c = this._scale(point.curve, false);
      const uu = z.redAdd(y);
      const uz = z.redSub(y);
      const vv = c.redMul(z).redMul(uu);
      const vz = x.redMul(uz);

      return this.cpoint(uu, uz, vv, vz);
    }

    throw new Error('Not implemented.');
  }

  pointFromUniform(u) {
    assert(u instanceof BN);

    // z = 0 or A = 0
    if (this.z.isZero() || this.a.isZero())
      throw new Error('Not implemented.');

    return this._elligator2(u);
  }

  pointToUniform(p, hint) {
    // Convert a montgomery point to a field
    // element by inverting the elligator2 map.
    //
    // Hint Layout:
    //
    //   [00000000] [0000] [0000]
    //        |        |      |
    //        |        |      +-- preimage index
    //        |        +--- subgroup
    //        +-- bits to OR with uniform bytes
    assert(p instanceof MontPoint);
    assert((hint >>> 0) === hint);

    // z = 0 or A = 0
    if (this.z.isZero() || this.a.isZero())
      throw new Error('Not implemented.');

    // P = O
    if (p.isInfinity())
      throw new Error('Invalid point.');

    // Add a random torsion component.
    const i = ((hint >>> 4) & 15) % this.torsion.length;
    const q = p.add(this.torsion[i]);

    return wrapErrors(() => {
      return this._invert2(q, hint);
    });
  }

  decodePoint(bytes, sign) {
    return MontPoint.decode(this, bytes, sign);
  }

  encodeX(point) {
    assert(point instanceof XPoint);
    return point.encode();
  }

  decodeX(bytes) {
    return XPoint.decode(this, bytes);
  }

  toShort(a0, odd, sign = null) {
    const [a, b] = this._short(a0, odd);

    const curve = new ShortCurve({
      red: this.red,
      prime: this.prime,
      p: this.p,
      a: a,
      b: b,
      n: this.n,
      h: this.h
    });

    if (sign != null) {
      const [, u3] = curve._scale(this);

      if (u3.redIsOdd() !== sign)
        u3.redINeg();
    }

    if (!this.g.isInfinity())
      curve.g = curve.pointFromMont(this.g);

    for (let i = 0; i < this.h.word(0); i++)
      curve.torsion[i] = curve.pointFromMont(this.torsion[i]);

    return curve;
  }

  toMont(b0, sign = null) {
    const [a, b] = this._mont(b0);

    const curve = new MontCurve({
      red: this.red,
      prime: this.prime,
      p: this.p,
      a: a,
      b: b,
      n: this.n,
      h: this.h,
      z: this.z
    });

    if (sign != null) {
      const c = curve._scale(this);

      if (c.redIsOdd() !== sign)
        c.redINeg();
    }

    if (!this.g.isInfinity())
      curve.g = curve.pointFromMont(this.g);

    for (let i = 0; i < this.h.word(0); i++)
      curve.torsion[i] = curve.pointFromMont(this.torsion[i]);

    return curve;
  }

  toEdwards(a0, invert, sign = null) {
    const [a, d] = this._edwards(a0, invert);

    const curve = new EdwardsCurve({
      red: this.red,
      prime: this.prime,
      p: this.p,
      a: a,
      d: d,
      n: this.n,
      h: this.h,
      z: this.z
    });

    if (sign != null) {
      const c = curve._scale(this, invert);

      if (c.redIsOdd() !== sign)
        c.redINeg();
    }

    if (!this.g.isInfinity()) {
      curve.g = curve.pointFromMont(this.g);
      curve.g.normalize();
    }

    if (curve.isComplete()) {
      for (let i = 0; i < this.h.word(0); i++) {
        curve.torsion[i] = curve.pointFromMont(this.torsion[i]);
        curve.torsion[i].normalize();
      }
    }

    return curve;
  }

  pointFromJSON(json) {
    return MontPoint.fromJSON(this, json);
  }

  toJSON(pre) {
    const json = super.toJSON(pre);
    json.a = this.a.fromRed().toJSON();
    json.b = this.b.fromRed().toJSON();
    return json;
  }
}

/**
 * MontPoint
 */

class MontPoint extends Point {
  constructor(curve, x, y) {
    assert(curve instanceof MontCurve);

    super(curve, types.AFFINE);

    this.x = this.curve.zero;
    this.y = this.curve.zero;
    this.inf = true;

    if (x != null)
      this._init(x, y);
  }

  _init(x, y) {
    assert(x instanceof BN);
    assert(y instanceof BN);

    this.x = x;
    this.y = y;

    if (!this.x.red)
      this.x = this.x.toRed(this.curve.red);

    if (!this.y.red)
      this.y = this.y.toRed(this.curve.red);

    this.inf = false;
  }

  clone() {
    if (this.inf)
      return this.curve.point();

    return this.curve.point(this.x, this.y);
  }

  scale(a) {
    return this.clone();
  }

  randomize(rng) {
    return this.clone();
  }

  neg() {
    // P = O
    if (this.inf)
      return this;

    // -(X1, Y1) = (X1, -Y1)
    return this.curve.point(this.x, this.y.redNeg());
  }

  add(p) {
    // [MONT1] Page 8, Section 4.3.2.
    //
    // Addition Law:
    //
    //   l = (y2 - y1) / (x2 - x1)
    //   x3 = b * l^2 - a - x1 - x2
    //   y3 = l * (x1 - x3) - y1
    //
    // 1I + 2M + 1S + 7A + 1*b
    assert(p instanceof MontPoint);

    // O + P = P
    if (this.inf)
      return p;

    // P + O = P
    if (p.inf)
      return this;

    // P + P, P + -P
    if (this.x.eq(p.x)) {
      // P + -P = O
      if (!this.y.eq(p.y))
        return this.curve.point();

      // P + P = 2P
      return this.dbl();
    }

    // H = X2 - X1
    const h = p.x.redSub(this.x);

    // R = Y2 - Y1
    const r = p.y.redSub(this.y);

    // L = R / H
    const l = r.redDiv(h);

    // K = b * L^2
    const k = this.curve.b.redMul(l.redSqr());

    // X3 = K - a - X1 - X2
    const nx = k.redISub(this.curve.a).redISub(this.x).redISub(p.x);

    // Y3 = L * (X1 - X3) - Y1
    const ny = l.redMul(this.x.redSub(nx)).redISub(this.y);

    return this.curve.point(nx, ny);
  }

  dbl() {
    // [MONT1] Page 8, Section 4.3.2.
    //
    // Addition Law (doubling):
    //
    //   l = (3 * x1^2 + 2 * a * x1 + 1) / (2 * b * y1)
    //   x3 = b * l^2 - a - 2 * x1
    //   y3 = l * (x1 - x3) - y1
    //
    // 1I + 3M + 2S + 7A + 1*a + 1*b + 1*b + 2*2 + 1*3

    // P = O
    if (this.inf)
      return this;

    // Y1 = 0
    if (this.y.isZero())
      return this.curve.point();

    // M1 = 3 * X1^2
    const m1 = this.x.redSqr().redIMuln(3);

    // M2 = 2 * a * X1
    const m2 = this.curve.a.redMul(this.x).redIMuln(2);

    // M = M1 + M2 + 1
    const m = m1.redIAdd(m2).redIAdd(this.curve.one);

    // Z = 2 * b * Y1
    const z = this.curve.b.redMul(this.y).redIMuln(2);

    // L = M / Z
    const l = m.redDiv(z);

    // K = b * L^2
    const k = this.curve.b.redMul(l.redSqr());

    // X3 = K - a - 2 * X1
    const nx = k.redISub(this.curve.a).redISub(this.x).redISub(this.x);

    // Y3 = L * (X1 - X3) - Y1
    const ny = l.redMul(this.x.redSub(nx)).redISub(this.y);

    return this.curve.point(nx, ny);
  }

  getX() {
    if (this.inf)
      throw new Error('Invalid point.');

    return this.x.fromRed();
  }

  getY() {
    if (this.inf)
      throw new Error('Invalid point.');

    return this.y.fromRed();
  }

  eq(p) {
    assert(p instanceof MontPoint);

    // P = Q
    if (this === p)
      return true;

    // P = O
    if (this.inf)
      return p.inf;

    // Q = O
    if (p.inf)
      return false;

    // X1 = X2, Y1 = Y2
    return this.x.eq(p.x)
        && this.y.eq(p.y);
  }

  cmp(point) {
    assert(point instanceof MontPoint);

    if (this.inf && !point.inf)
      return -1;

    if (!this.inf && point.inf)
      return 1;

    if (this.inf && point.inf)
      return 0;

    return this.order().cmp(point.order())
        || this.getX().cmp(point.getX())
        || this.getY().cmp(point.getY());
  }

  isInfinity() {
    // Infinity cannot be represented in
    // the affine space, except by a flag.
    return this.inf;
  }

  isOrder2() {
    if (this.inf)
      return false;

    return this.y.isZero();
  }

  isOdd() {
    if (this.inf)
      return false;

    return this.y.redIsOdd();
  }

  isEven() {
    if (this.inf)
      return false;

    return this.y.redIsEven();
  }

  toP() {
    return this;
  }

  toJ() {
    return this;
  }

  toX() {
    // (X3, Z3) = (1, 0)
    if (this.inf)
      return this.curve.xpoint();

    // (X3, Z3) = (X1, 1)
    return this.curve.xpoint(this.x, this.curve.one);
  }

  encode() {
    return this.toX().encode();
  }

  static decode(curve, bytes, sign) {
    assert(curve instanceof MontCurve);
    return curve.decodeX(bytes).toP(sign);
  }

  toJSON(pre) {
    if (this.inf)
      return [];

    const x = this.getX().toJSON();
    const y = this.getY().toJSON();

    return [x, y];
  }

  toPretty() {
    if (this.inf)
      return [];

    const size = this.curve.fieldSize * 2;
    const x = toPretty(this.getX(), size);
    const y = toPretty(this.getY(), size);

    return [x, y];
  }

  static fromJSON(curve, json) {
    assert(curve instanceof MontCurve);
    assert(Array.isArray(json));
    assert(json.length === 0
        || json.length === 2
        || json.length === 3);

    if (json.length === 0)
      return curve.point();

    const x = BN.fromJSON(json[0]);
    const y = BN.fromJSON(json[1]);

    return curve.point(x, y);
  }

  [custom]() {
    if (this.inf)
      return '<MontPoint: Infinity>';

    return '<MontPoint:'
         + ' x=' + this.x.fromRed().toString(16, 2)
         + ' y=' + this.y.fromRed().toString(16, 2)
         + '>';
  }
}

/**
 * XPoint
 */

class XPoint extends Point {
  constructor(curve, x, z) {
    assert(curve instanceof MontCurve);

    super(curve, types.PROJECTIVE);

    this.x = this.curve.one;
    this.z = this.curve.zero;

    if (x != null)
      this._init(x, z);
  }

  _init(x, z) {
    assert(x instanceof BN);
    assert(z == null || (z instanceof BN));

    this.x = x;
    this.z = z || this.curve.one;

    if (!this.x.red)
      this.x = this.x.toRed(this.curve.red);

    if (!this.z.red)
      this.z = this.z.toRed(this.curve.red);
  }

  clone() {
    return this.curve.xpoint(this.x, this.z);
  }

  precompute(power, rng) {
    // No-op.
    return this;
  }

  validate() {
    if (this.isInfinity())
      return true;

    // B * y^2 * z = x^3 + A * x^2 * z + x * z^2
    const {x, z} = this;
    const x2 = x.redSqr();
    const x3 = x2.redMul(x);
    const z2 = z.redSqr();
    const ax2 = this.curve.a.redMul(x2).redMul(z);
    const by2 = x3.redIAdd(ax2).redIAdd(x.redMul(z2));
    const y2 = by2.redMul(this.curve.bi);

    // sqrt(y^2 * z^4) = y * z^2
    return y2.redMul(z).redJacobi() !== -1;
  }

  normalize() {
    // https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html#scaling-scale
    // 1I + 1M

    // P = O
    if (this.isInfinity())
      return this;

    // Z1 = 1
    if (this.z.eq(this.curve.one))
      return this;

    // X3 = X1 / Z1
    this.x = this.x.redDiv(this.z);

    // Z3 = 1
    this.z = this.curve.one;

    return this;
  }

  scale(a) {
    assert(a instanceof BN);

    // P = O
    if (this.isInfinity())
      return this.curve.xpoint();

    // X3 = X1 * A
    const nx = this.x.redMul(a);

    // Y3 = Y1 * A
    const nz = this.z.redMul(a);

    return this.curve.xpoint(nx, nz);
  }

  neg() {
    // -(X1, Z1) = (X1, Z1)
    return this;
  }

  dbl() {
    // https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html#doubling-dbl-1987-m-3
    // 2M + 2S + 4A + 1*a24

    // A = X1 + Z1
    const a = this.x.redAdd(this.z);

    // AA = A^2
    const aa = a.redSqr();

    // B = X1 - Z1
    const b = this.x.redSub(this.z);

    // BB = B^2
    const bb = b.redSqr();

    // C = AA - BB
    const c = aa.redSub(bb);

    // X3 = AA * BB
    const nx = aa.redMul(bb);

    // Z3 = C * (BB + a24 * C)
    const nz = c.redMul(bb.redIAdd(this.curve.a24.redMul(c)));

    return this.curve.xpoint(nx, nz);
  }

  diffAddDbl(p2, p3) {
    // https://hyperelliptic.org/EFD/g1p/auto-montgom-xz.html#ladder-ladd-1987-m-3
    // 6M + 4S + 8A + 1*a24
    assert(p2 instanceof XPoint);
    assert(p3 instanceof XPoint);

    // A = X2 + Z2
    const a = p2.x.redAdd(p2.z);

    // AA = A^2
    const aa = a.redSqr();

    // B = X2 - Z2
    const b = p2.x.redSub(p2.z);

    // BB = B^2
    const bb = b.redSqr();

    // E = AA - BB
    const e = aa.redSub(bb);

    // C = X3 + Z3
    const c = p3.x.redAdd(p3.z);

    // D = X3 - Z3
    const d = p3.x.redSub(p3.z);

    // DA = D * A
    const da = d.redMul(a);

    // CB = C * B
    const cb = c.redMul(b);

    // X5 = Z1 * (DA + CB)^2
    const x5 = this.z.redMul(da.redAdd(cb).redSqr());

    // Z5 = X1 * (DA - CB)^2
    const z5 = this.x.redMul(da.redISub(cb).redSqr());

    // X4 = AA * BB
    const x4 = aa.redMul(bb);

    // Z4 = E * (BB + a24 * E)
    const z4 = e.redMul(bb.redIAdd(this.curve.a24.redMul(e)));

    return [
      this.curve.xpoint(x4, z4),
      this.curve.xpoint(x5, z5)
    ];
  }

  getX() {
    if (this.isInfinity())
      throw new Error('Invalid point.');

    this.normalize();

    return this.x.fromRed();
  }

  getY(sign) {
    return this.toP(sign).getY();
  }

  eq(p) {
    assert(p instanceof XPoint);

    // P = Q
    if (this === p)
      return true;

    // P = O
    if (this.isInfinity())
      return p.isInfinity();

    // Q = O
    if (p.isInfinity())
      return false;

    // Z1 = Z2
    if (this.z.eq(p.z))
      return this.x.eq(p.x);

    // X1 * Z2 = X2 * Z1
    const x1 = this.x.redMul(p.z);
    const x2 = p.x.redMul(this.z);

    return x1.eq(x2);
  }

  cmp(point) {
    assert(point instanceof XPoint);

    const inf1 = this.isInfinity();
    const inf2 = point.isInfinity();

    if (inf1 && !inf2)
      return -1;

    if (!inf1 && inf2)
      return 1;

    if (inf1 && inf2)
      return 0;

    return this.order().cmp(point.order())
        || this.getX().cmp(point.getX());
  }

  isInfinity() {
    // Z1 = 0
    return this.z.isZero();
  }

  isOrder2() {
    if (this.isInfinity())
      return false;

    return this.x.isZero();
  }

  isOdd() {
    return false;
  }

  isEven() {
    return false;
  }

  hasTorsion() {
    if (this.isInfinity())
      return false;

    // X1 = 0, Z1 != 0 (edge case)
    if (this.x.isZero())
      return true;

    return super.hasTorsion();
  }

  order() {
    try {
      return this.toP().order();
    } catch (e) {
      return new BN(1);
    }
  }

  jmul(k) {
    // Multiply with the Montgomery Ladder.
    //
    // [MONT3] Algorithm 4, Page 12, Section 4.2.
    //
    // Note that any clamping is meant to
    // be done _outside_ of this function.
    assert(k instanceof BN);
    assert(!k.red);

    const bits = k.bitLength();

    let a = this.curve.xpoint();
    let b = this;

    for (let i = bits - 1; i >= 0; i--) {
      const bit = k.bit(i);

      if (bit === 0)
        [a, b] = this.diffAddDbl(a, b);
      else
        [b, a] = this.diffAddDbl(b, a);
    }

    return a;
  }

  jmulBlind(k, rng) {
    if (!rng)
      return this.jmul(k);

    // Randomize if available.
    return this.randomize(rng).jmul(k);
  }

  jmulAdd(k1, p2, k2) {
    throw new Error('Not implemented.');
  }

  toP(sign = null) {
    assert(sign == null || typeof sign === 'boolean');

    if (this.isInfinity())
      return this.curve.point();

    this.normalize();

    return this.curve.pointFromX(this.x, sign);
  }

  toJ() {
    return this;
  }

  toX() {
    return this;
  }

  key() {
    if (this.isInfinity())
      return `${this.curve.uid}:oo`;

    this.normalize();

    const x = this.getX().toString(16);

    return `${this.curve.uid}:${x}`;
  }

  encode() {
    // [RFC7748] Section 5.
    return this.curve.encodeField(this.getX());
  }

  static decode(curve, bytes) {
    assert(curve instanceof MontCurve);

    // [RFC7748] Section 5.
    const x = curve.decodeField(bytes);

    // We're supposed to ignore the hi bit
    // on montgomery points... I think. If
    // we don't, the X25519 test vectors
    // break, which is pretty convincing
    // evidence. This is a no-op for X448.
    x.iumaskn(curve.fieldBits);

    // Note: montgomery points are meant to be
    // reduced by the prime and do not have to
    // be explicitly validated in order to do
    // the montgomery ladder.
    const p = curve.xpoint(x, curve.one);

    assert(!p.isInfinity());

    return p;
  }

  toJSON(pre) {
    return this.toP().toJSON(pre);
  }

  toPretty() {
    return this.toP().toPretty();
  }

  static fromJSON(curve, json) {
    return MontPoint.fromJSON(curve, json).toX();
  }

  [custom]() {
    if (this.isInfinity())
      return '<XPoint: Infinity>';

    return '<XPoint:'
        + ' x=' + this.x.fromRed().toString(16, 2)
        + ' z=' + this.z.fromRed().toString(16, 2)
        + '>';
  }
}

/**
 * EdwardsCurve
 */

class EdwardsCurve extends Curve {
  constructor(conf) {
    super(EdwardsPoint, 'edwards', conf);

    this.a = BN.fromJSON(conf.a).toRed(this.red);
    this.d = BN.fromJSON(conf.d).toRed(this.red);
    this.s = BN.fromJSON(conf.s || '0').toRed(this.red);
    this.si = this.s.isZero() ? this.zero : this.s.redInvert();

    this.k = this.d.redMuln(2);
    this.smi = -this.d.redNeg().word(0);
    this.ad6 = this.a.redAdd(this.d).redMul(this.i6);

    this.twisted = !this.a.eq(this.one);
    this.oneA = this.a.eq(this.one);
    this.mOneA = this.a.eq(this.one.redNeg());
    this.smallD = this.prime != null && this.d.redNeg().length === 1;
    this.alt = null;

    this._finalize(conf);
  }

  static _isomorphism(curveA, curveD, customA) {
    // Twisted Edwards Isomorphism.
    //
    // [TWISTED] Definition 2.1, Page 3, Section 2.
    //
    // Transformation:
    //
    //   a' = a'
    //   d' = a' * d / a
    //
    // Where (a / a') is square.
    assert(curveA instanceof BN);
    assert(curveD instanceof BN);
    assert(customA instanceof BN);

    const a = customA.clone();
    const d = customA.redMul(curveD).redDiv(curveA);
    const c = curveA.redDiv(customA);

    if (c.redJacobi() !== 1)
      throw new Error('Invalid `a` coefficient.');

    return [a, d];
  }

  _short(a0, odd) {
    // Twisted Edwards->Short Weierstrass Equivalence.
    //
    // [TWISTEQ] Section 2.
    //
    // Transformation:
    //
    //   a' = -(a^2 + 14 * a * d + d^2) / 48
    //   b' = (33 * (a^2 * d + a * d^2) - a^3 - d^3) / 864
    const {a, d} = this;
    const a2 = a.redSqr();
    const a3 = a2.redMul(a);
    const d2 = d.redSqr();
    const d3 = d2.redMul(d);
    const ad14 = a.redMul(d).redIMuln(14);
    const a2d = a2.redMul(d);
    const ad2 = a.redMul(d2);
    const t0 = a2d.redIAdd(ad2).redIMuln(33);
    const wa = a2.redAdd(ad14).redIAdd(d2).redDivn(-48);
    const wb = t0.redISub(a3).redISub(d3).redDivn(864);

    if (a0 != null)
      return ShortCurve._isomorphism(wa, wb, a0, odd);

    return [wa, wb];
  }

  _mont(b0, invert = false) {
    // Twisted Edwards->Montgomery Transformation.
    //
    // [TWISTED] Theorem 3.2, Page 4, Section 3.
    //
    // Equivalence:
    //
    //   A = 2 * (a + d) / (a - d)
    //   B = 4 / (a - d)
    //
    // Isomorphism:
    //
    //   A = 2 * (a + d) / (a - d)
    //   B = B'
    //
    // Where ((4 / (a - d)) / B') is square.
    //
    // If `4 / (a - d)` is non-square, we can
    // usually force B=1 by using the `invert`
    // option. This will create an isomorphism
    // chain of: E(a,d)->E(d,a)->M(-A,-B).
    //
    // The equivalence between E(a,d) and E(d,a)
    // is:
    //
    //   (x, y) = (x, 1 / y)
    //
    // Meaning our map to M(-A,-B) is:
    //
    //   u = (1 + 1 / y) / (1 - 1 / y)
    //     = (y + 1) / (y - 1)
    //   v = u / x
    assert(typeof invert === 'boolean');

    let apd, amd;

    if (invert) {
      apd = this.d.redAdd(this.a);
      amd = this.d.redSub(this.a);
    } else {
      apd = this.a.redAdd(this.d);
      amd = this.a.redSub(this.d);
    }

    const z = amd.redInvert();
    const a = apd.redMuln(2).redMul(z);
    const b = z.redMuln(4);

    if (b0 != null)
      return MontCurve._isomorphism(a, b, b0);

    return [a, b];
  }

  _edwards(a0) {
    return EdwardsCurve._isomorphism(this.a, this.d, a0);
  }

  _scaleShort(curve) {
    assert(curve instanceof ShortCurve);

    const [u2, u3] = curve._scale(this);

    return [this.field(u2.redInvert()),
            this.field(u3.redInvert())];
  }

  _scaleMont(curve, invert = false) {
    // Calculate isomorphism factor between
    // Twisted Edwards and Montgomery with:
    //
    //   a = (A + 2) / B
    //   c = +-sqrt(a / a')
    //
    // Which can be reduced to:
    //
    //   c = +-sqrt((A + 2) / (B * a'))
    //
    // If base points are available, we can do:
    //
    //   x = u / v
    //   c = x' / x
    //
    // Which can be reduced to:
    //
    //   c = v * x' / u
    //
    // We can now calculate the Edwards `x` with:
    //
    //   x' = c * u / v
    //
    // And likewise, the Montgomery `v`:
    //
    //   v = c * u / x'
    assert(curve instanceof MontCurve);
    assert(typeof invert === 'boolean');

    if (this.g.isInfinity() || curve.g.isInfinity()) {
      const [a] = curve._edwards(null, invert);

      return this.field(a).redDivSqrt(this.a);
    }

    const x = curve.g.x.redDiv(curve.g.y);

    return this.g.x.redDiv(this.field(x));
  }

  _scaleEdwards(curve) {
    // We can extract the isomorphism factor with:
    //
    //   c = +-sqrt(a / a')
    //
    // If base points are available, we can do:
    //
    //   c = x' / x
    assert(curve instanceof EdwardsCurve);

    if (this.g.isInfinity() || curve.g.isInfinity())
      return this.field(curve.a).redDivSqrt(this.a);

    return this.g.x.redDiv(this.field(curve.g.x));
  }

  _mulA(num) {
    assert(num instanceof BN);

    // n * a = n
    if (this.oneA)
      return num.clone();

    // n * a = -n
    if (this.mOneA)
      return num.redNeg();

    return this.a.redMul(num);
  }

  _mulD(num) {
    assert(num instanceof BN);

    // -d < 0x4000000
    if (this.smallD)
      return num.redMuln(this.smi);

    return this.d.redMul(num);
  }

  _elligator1(t) {
    // Elligator 1.
    //
    // Distribution: 1/2.
    //
    // [ELL1] Page 6, Section 3.
    //        Page 15, Appendix A.
    // [ELL2] Page 7, Section 3.2.
    //
    // Assumptions:
    //
    //   - Let p be a prime power congruent to 3 mod 4.
    //   - Let s be a nonzero element of F(p).
    //   - Let c = 2 / s^2.
    //   - Let r = c + 1 / c.
    //   - Let d = -(c + 1)^2 / (c - 1)^2.
    //   - (s^2 - 2) * (s^2 + 2) != 0.
    //   - c * (c - 1) * (c + 1) != 0.
    //   - r != 0.
    //   - d is not square.
    //   - x^2 + y^2 = 1 + d * x^2 * y^2.
    //   - u * v * X * Y * x * (Y + 1) != 0.
    //   - Y^2 = X^5 + (r^2 - 2) * X^3 + X.
    //
    // Elligator 1, as devised by Fouque et al,
    // takes place on the hyperelliptic curve of:
    //
    //   y^2 = x^5 + (r^2 - 2) * x^3 + x
    //
    // Not only must our Edwards curve be complete,
    // with a prime congruent to 3 mod 4, and a = 1,
    // our curve must be isomorphic to a hyperelliptic
    // curve of the above form. Roughly one half of
    // all Edwards curves are isomorphic to a curve
    // of said form.
    //
    // We can derive the isomorphism with:
    //
    //   c = (d +- 2 * sqrt(-d) - 1) / (d + 1)
    //   s = +-sqrt(2 / c)
    //   r = c + 1 / c
    //
    // Note that even if your curve is an Elligator 1
    // curve, Elligator 2 is probably still preferable,
    // as it has nearly the same properties (i.e. the
    // same distribution), and is much less complex.
    //
    // Map:
    //
    //   f(a) = a^((p - 1) / 2)
    //   u = (1 - t) / (1 + t)
    //   v = u^5 + (r^2 - 2) * u^3 + u
    //   X = f(v) * u
    //   Y = (f(v) * v)^((p + 1) / 4) * f(v) * f(u^2 + 1 / c^2)
    //   Y = 1, if u = 0
    //   x = (c - 1) * s * X * (1 + X) / Y
    //   y = (r * X - (1 + X)^2) / (r * X + (1 + X)^2)
    //
    // When t = +-1, we create the hyperelliptic
    // 2-torsion point of (0, 0). This needs to be
    // mapped to (0, -1) in Edwards form, but the x
    // denominator becomes zero. As far as I can
    // tell, this is the only exceptional case.
    //
    // The only other exceptional case initially
    // appears to be when the y denominator sums to
    // zero (when t = sqrt(4 / r + 1)), however, the
    // hyperelliptic `X` is negated by the sign of
    // `v`, making this impossible.
    const {s, si, i2, one, two} = this;
    const c = si.redSqr().redIMuln(2);
    const ci = s.redSqr().redMul(i2);
    const ci2 = ci.redSqr();
    const r = c.redAdd(ci);
    const r2 = r.redSqr().redISub(two);
    const cm1 = c.redSub(one);
    const uu = one.redSub(t);
    const uz = one.redAdd(t);
    const u = uz.isZero() ? uz : uu.redDiv(uz);
    const u2 = u.redSqr();
    const u3 = u2.redMul(u);
    const u5 = u3.redMul(u2);
    const v = u5.redAdd(r2.redMul(u3)).redIAdd(u);
    const f0 = this.field(v.redJacobi());
    const f1 = this.field(u2.redAdd(ci2).redJacobi());
    const f2 = f0.redMul(f1);
    const X = f0.redMul(u);
    const Y = f0.redMul(v).redSqrt().redMul(f2);
    const X1 = one.redAdd(X);
    const rX = r.redMul(X);
    const X12 = X1.redSqr();
    const xx = cm1.redMul(s).redMul(X).redMul(X1);
    const xz = u.isZero() ? this.one : Y;
    const yy = rX.redSub(X12);
    const yz = rX.redAdd(X12);

    return this.cpoint(xx, xz, yy, yz);
  }

  _invert1(p, hint) {
    // Inverting the Map (Elligator 1).
    //
    // [ELL1] Page 6, Section 3.
    //        Page 15, Appendix A.
    // [ELL2] Page 7, Section 3.3.
    //
    // Assumptions:
    //
    //   - y + 1 != 0.
    //   - (1 + n * r)^2 - 1 is square in F(p).
    //   - If n * r = -2 then x = 2 * s * (c - 1) * f(c) / r.
    //   - Y = (c - 1) * s * X * (1 + X) / x.
    //
    // Map:
    //
    //   f(a) = a^((p - 1) / 2)
    //   n = (y - 1) / (2 * (y + 1))
    //   X = -(1 + n * r) + ((1 + n * r)^2 - 1)^((p + 1) / 4)
    //   z = f((c - 1) * s * X * (1 + X) * x * (X^2 + 1 / c^2))
    //   u = z * X
    //   t = (1 - u) / (1 + u)
    const {s, si, i2, one} = this;
    const {x, y, z} = p;
    const sign = hint & 1;
    const c = si.redSqr().redIMuln(2);
    const ci = s.redSqr().redMul(i2);
    const ci2 = ci.redSqr();
    const r = c.redAdd(ci);
    const cm1 = c.redSub(one);
    const nn = y.redSub(z);
    const nz = y.redAdd(z).redIMuln(2);
    const n = nz.isZero() ? nz : nn.redDiv(nz);
    const nr1 = one.redAdd(n.redMul(r));
    const w2 = nr1.redSqr().redISub(one);
    const w = w2.redSqrt();
    const X = w.redSub(nr1);
    const X1 = one.redAdd(X);
    const YY = cm1.redMul(s).redMul(X).redMul(X1);
    const Y = YY.redMul(x.redMul(z));
    const X2 = X.redSqr().redIAdd(ci2);
    const Z = this.field(Y.redMul(X2).redJacobi());
    const u = Z.redMul(X);
    const tt = one.redSub(u);
    const tz = one.redAdd(u);
    const t = tz.isZero() ? tz : tt.redDiv(tz);

    if (t.redIsOdd() !== Boolean(sign))
      t.redINeg();

    return t;
  }

  _alt() {
    if (!this.alt)
      this.alt = this.toMont();

    return this.alt;
  }

  isElliptic() {
    const ad = this.a.redMul(this.d);
    const amd = this.a.redSub(this.d);

    // a * d * (a - d) != 0
    return !ad.redMul(amd).isZero();
  }

  jinv() {
    // [TWISTED] Definition 2.1, Page 3, Section 2.
    const {a, d} = this;
    const ad = a.redMul(d);
    const amd4 = a.redSub(d).redPown(4);
    const a2 = a.redSqr();
    const d2 = d.redSqr();
    const t0 = a2.redAdd(ad.redMuln(14)).redIAdd(d2);
    const lhs = t0.redPown(3).redIMuln(16);
    const rhs = ad.redMul(amd4);

    if (rhs.isZero())
      throw new Error('Curve is not elliptic.');

    // 16 * (a^2 + 14 * a * d + d^2)^3 / (a * d * (a - d)^4)
    return lhs.redDiv(rhs).fromRed();
  }

  isComplete() {
    return this.a.redJacobi() === 1
        && this.d.redJacobi() === -1;
  }

  point(x, y, z, t) {
    return new EdwardsPoint(this, x, y, z, t);
  }

  jpoint(x, y, z) {
    assert(x == null && y == null && z == null);
    return this.point();
  }

  cpoint(xx, xz, yy, yz) {
    assert(xx instanceof BN);
    assert(xz instanceof BN);
    assert(yy instanceof BN);
    assert(yz instanceof BN);

    const x = xx.redMul(yz);
    const y = yy.redMul(xz);
    const z = xz.redMul(yz);
    const t = xx.redMul(yy);

    return this.point(x, y, z, t);
  }

  solveX2(y) {
    // [RFC8032] Section 5.1.3 & 5.2.3.
    assert(y instanceof BN);

    // x^2 = (y^2 - 1) / (d * y^2 - a)
    const y2 = y.redSqr();
    const rhs = this._mulD(y2).redISub(this.a);
    const lhs = y2.redISub(this.one);
    const x2 = lhs.redDiv(rhs);

    return x2;
  }

  solveX(y) {
    // Optimize with inverse square root trick.
    //
    // Note that `0 / 0` can only occur if
    // `a == d` (i.e. the curve is singular).
    const y2 = y.redSqr();
    const rhs = this._mulD(y2).redISub(this.a);
    const lhs = y2.redISub(this.one);

    return lhs.redDivSqrt(rhs);
  }

  solveY2(x) {
    assert(x instanceof BN);

    // y^2 = (a * x^2 - 1) / (d * x^2 - 1)
    const x2 = x.redSqr();
    const lhs = this._mulA(x2).redISub(this.one);
    const rhs = this._mulD(x2).redISub(this.one);
    const y2 = lhs.redDiv(rhs);

    return y2;
  }

  solveY(x) {
    // Optimize with inverse square root trick.
    //
    // Note that `0 / 0` can only occur if
    // `a == d` (i.e. the curve is singular).
    const x2 = x.redSqr();
    const lhs = this._mulA(x2).redISub(this.one);
    const rhs = this._mulD(x2).redISub(this.one);

    return lhs.redDivSqrt(rhs);
  }

  validate(point) {
    // [TWISTED] Definition 2.1, Page 3, Section 2.
    //           Page 11, Section 6.
    assert(point instanceof EdwardsPoint);

    // Z1 = 1
    if (point.zOne) {
      // a * x^2 + y^2 = 1 + d * x^2 * y^2
      const x2 = point.x.redSqr();
      const y2 = point.y.redSqr();
      const dxy = this._mulD(x2).redMul(y2);
      const lhs = this._mulA(x2).redIAdd(y2);
      const rhs = this.one.redAdd(dxy);
      const tz = point.t;
      const xy = point.x.redMul(point.y);

      return lhs.eq(rhs) && tz.eq(xy);
    }

    // (a * x^2 + y^2) * z^2 = z^4 + d * x^2 * y^2
    const x2 = point.x.redSqr();
    const y2 = point.y.redSqr();
    const z2 = point.z.redSqr();
    const z4 = z2.redSqr();
    const dxy = this._mulD(x2).redMul(y2);
    const lhs = this._mulA(x2).redIAdd(y2).redMul(z2);
    const rhs = z4.redIAdd(dxy);
    const tz = point.t.redMul(point.z);
    const xy = point.x.redMul(point.y);

    return lhs.eq(rhs) && tz.eq(xy);
  }

  pointFromX(x, sign = null) {
    assert(x instanceof BN);
    assert(sign == null || typeof sign === 'boolean');

    if (!x.red)
      x = x.toRed(this.red);

    const y = this.solveY(x);

    if (sign != null) {
      if (y.isZero() && sign)
        throw new Error('Invalid point.');

      if (y.redIsOdd() !== sign)
        y.redINeg();
    }

    return this.point(x, y);
  }

  pointFromY(y, sign = null) {
    assert(y instanceof BN);
    assert(sign == null || typeof sign === 'boolean');

    if (!y.red)
      y = y.toRed(this.red);

    const x = this.solveX(y);

    if (sign != null) {
      if (x.isZero() && sign)
        throw new Error('Invalid point.');

      if (x.redIsOdd() !== sign)
        x.redINeg();
    }

    return this.point(x, y);
  }

  isIsomorphic(curve, invert = false) {
    // [TWISTED] Theorem 3.2, Page 4, Section 3.
    //           Definition 2.1, Page 3, Section 2.
    assert(curve instanceof Curve);
    assert(typeof invert === 'boolean');

    if (!curve.p.eq(this.p))
      return false;

    // E(a,d) <-> E(a,b)
    if (curve.type === 'short')
      return curve.isIsomorphic(this);

    // E(a,d) <-> M(A,B)
    // E(a,d) <-> M(-A,-B)
    if (curve.type === 'mont') {
      // A * (a - d) = 2 * (a + d)
      const a = this.field(curve.a);

      let apd, amd;

      if (invert) {
        apd = this.d.redAdd(this.a);
        amd = this.d.redSub(this.a);
      } else {
        apd = this.a.redAdd(this.d);
        amd = this.a.redSub(this.d);
      }

      return a.redMul(amd).eq(apd.redIMuln(2));
    }

    // E(a,d) <-> E(a',a'd/a)
    if (curve.type === 'edwards') {
      // a' * d = a * d'
      const a = this.field(curve.a);
      const d = this.field(curve.d);

      return this.a.redMul(d).eq(a.redMul(this.d));
    }

    return false;
  }

  isIsogenous(curve) {
    // Check for the 4-isogenies described by Hamburg:
    // https://moderncrypto.org/mail-archive/curves/2016/000806.html
    assert(curve instanceof Curve);

    if (!curve.p.eq(this.p))
      return false;

    // E(1,d) <-> M(2-4d,1)
    if (curve.type === 'mont') {
      if (!this.a.eq(this.one))
        return false;

      const a = this.field(curve.a);
      const b = this.field(curve.b);
      const d24 = this.two.redSub(this.d.redMuln(4));

      return a.eq(d24) && b.eq(this.one);
    }

    // E(a,d) <-> E(-a,d-a)
    if (curve.type === 'edwards') {
      const a = this.field(curve.a);
      const d = this.field(curve.d);

      return a.eq(this.a.redNeg())
          && d.eq(this.d.redSub(this.a));
    }

    return false;
  }

  pointFromShort(point) {
    // [TWISTEQ] Section 1.
    assert(point instanceof ShortPoint);

    if (this.isIsomorphic(point.curve)) {
      // Equivalence for E(a,b)->E(a',d'):
      //
      //   x' = (6 * x - a' - d') / (6 * y)
      //   y' = (12 * x - 5 * a' + d') / (12 * x + a' - 5 * d')
      //
      // Undefined for x = (5 * d' - a') / 12 or y = 0.
      //
      // Exceptional Cases:
      //   - O -> (0, 1)
      //   - ((a' + d') / 6, 0) -> (0, -1)
      //   - ((5 * d' - a') / 12, (d' - a') / 4 * sqrt(d')) -> (sqrt(1/d'), oo)
      //
      // Unexceptional Cases:
      //   - ((5 * a' - d') / 12, (a' - d') / 4 * sqrt(a')) -> (sqrt(1/a'), 0)
      if (point.isInfinity())
        return this.point();

      if (point.y.isZero())
        return this.point(this.zero, this.one.redNeg());

      const {a, d} = this;
      const [u2, u3] = this._scale(point.curve);
      const a5 = a.redMuln(5);
      const d5 = d.redMuln(5);
      const x = this.field(point.x).redMul(u2);
      const y = this.field(point.y).redMul(u3);
      const x6 = x.redMuln(6);
      const x12 = x.redMuln(12);
      const xx = x6.redSub(a).redISub(d);
      const xz = y.redMuln(6);
      const yy = x12.redSub(a5).redIAdd(d);
      const yz = x12.redAdd(a).redISub(d5);

      return this.cpoint(xx, xz, yy, yz);
    }

    throw new Error('Not implemented.');
  }

  pointFromMont(point) {
    // [RFC7748] Section 4.1 & 4.2.
    // [MONT3] Page 6, Section 2.5.
    // [TWISTED] Theorem 3.2, Page 4, Section 3.
    assert(point instanceof MontPoint);
    assert(point.curve.p.eq(this.p));

    // Montgomery `u`, `v`.
    const u = this.field(point.x);
    const v = this.field(point.y);

    if (this.isIsogenous(point.curve)) {
      // 4-isogeny maps for M(2-4d,1)->E(1,d):
      //
      //   x = 4 * v * (u^2 - 1) / (u^4 - 2 * u^2 + 4 * v^2 + 1)
      //   y = -(u^5 - 2 * u^3 - 4 * u * v^2 + u) /
      //        (u^5 - 2 * u^2 * v^2 - 2 * u^3 - 2 * v^2 + u)
      //
      // Undefined for u = 0 and v = 0.
      //
      // Exceptional Cases:
      //   - O -> (0, 1)
      //   - (0, 0) -> (0, 1)
      //
      // Unexceptional Cases:
      //   - (-1, +-sqrt(A - 2)) -> (0, 1)
      //   - (1, +-sqrt(A + 2)) -> (0, -1)
      //
      // The point (1, v) is invalid on Curve448.
      if (point.isInfinity())
        return this.point();

      if (point.x.isZero())
        return this.point();

      const u2 = u.redSqr();
      const u3 = u2.redMul(u);
      const u4 = u3.redMul(u);
      const u5 = u4.redMul(u);
      const v2 = v.redSqr();
      const a = v.redMuln(4);
      const b = u2.redSub(this.one);
      const c = u2.redMuln(2);
      const d = v2.redMuln(4);
      const e = u3.redIMuln(2);
      const f = u.redMul(v2).redIMuln(4);
      const g = u2.redMul(v2).redIMuln(2);
      const h = v2.redIMuln(2);
      const xx = a.redMul(b);
      const xz = u4.redISub(c).redIAdd(d).redIAdd(this.one);
      const yy = u5.redSub(e).redISub(f).redIAdd(u).redINeg();
      const yz = u5.redISub(g).redISub(e).redISub(h).redIAdd(u);

      return this.cpoint(xx, xz, yy, yz).divn(4);
    }

    if (this.isIsomorphic(point.curve, true)) {
      // Isomorphic maps for M(-A,-B)->E(a,d):
      //
      //   x = +-sqrt((A - 2) / (B * a)) * u / v
      //   y = (u + 1) / (u - 1)
      //
      // Undefined for u = 1 or v = 0.
      //
      // Exceptional Cases:
      //   - O -> (0, 1)
      //   - (0, 0) -> (0, -1)
      //   - (1, +-sqrt((A + 2) / B)) -> (+-sqrt(1 / d), oo)
      //
      // Unexceptional Cases:
      //   - (-1, +-sqrt((A - 2) / B)) -> (+-sqrt(1 / a), 0)
      //
      // The point (1, v) is invalid on Curve448.
      if (point.isInfinity())
        return this.point();

      if (point.x.isZero())
        return this.point(this.zero, this.one.redNeg());

      const c = this._scale(point.curve, true);
      const xx = c.redMul(u);
      const xz = v;
      const yy = u.redAdd(this.one);
      const yz = u.redSub(this.one);

      return this.cpoint(xx, xz, yy, yz);
    }

    if (this.isIsomorphic(point.curve, false)) {
      // Isomorphic maps for M(A,B)->E(a,d):
      //
      //   x = +-sqrt((A + 2) / (B * a)) * u / v
      //   y = (u - 1) / (u + 1)
      //
      // Undefined for u = -1 or v = 0.
      //
      // Exceptional Cases:
      //   - O -> (0, 1)
      //   - (0, 0) -> (0, -1)
      //   - (-1, +-sqrt((A - 2) / B)) -> (+-sqrt(1 / d), oo)
      //
      // Unexceptional Cases:
      //   - (1, +-sqrt((A + 2) / B)) -> (+-sqrt(1 / a), 0)
      //
      // The point (-1, v) is invalid on Curve25519.
      if (point.isInfinity())
        return this.point();

      if (point.x.isZero())
        return this.point(this.zero, this.one.redNeg());

      const c = this._scale(point.curve, false);
      const xx = c.redMul(u);
      const xz = v;
      const yy = u.redSub(this.one);
      const yz = u.redAdd(this.one);

      return this.cpoint(xx, xz, yy, yz);
    }

    throw new Error('Not implemented.');
  }

  pointFromEdwards(point) {
    // [TWISTED] Definition 2.1, Page 3, Section 2.
    // [ISOGENY] Page 2, Section 2.
    assert(point instanceof EdwardsPoint);
    assert(point.curve.p.eq(this.p));

    // Edwards `x`, `y`, `z`, `t`.
    const a = this.field(point.curve.a);
    const x = this.field(point.x);
    const y = this.field(point.y);
    const z = this.field(point.z);
    const t = this.field(point.t);

    if (this.isIsogenous(point.curve)) {
      // 4-isogeny maps for E(a,d)<->E(-a,d-a):
      //
      //   x' = (2 * x * y) / (y^2 - a * x^2)
      //   y' = (y^2 + a * x^2) / (2 - y^2 - a * x^2)
      //
      // Undefined for y^2 - a * x^2 = 0
      //            or y^2 + a * x^2 = 2.
      const xy = x.redMul(y);
      const x2 = x.redSqr();
      const y2 = y.redSqr();
      const z2 = z.redSqr();
      const ax2 = a.redMul(x2);
      const xx = xy.redIMuln(2);
      const xz = y2.redSub(ax2);
      const yy = y2.redAdd(ax2);
      const yz = z2.redIMuln(2).redISub(yy);
      const p = this.cpoint(xx, xz, yy, yz);

      return !this.twisted ? p.divn(4) : p;
    }

    if (this.isIsomorphic(point.curve)) {
      // Isomorphic maps for E(a,d)<->E(a',a'd/a):
      //
      //   x' = +-sqrt(a / a') * x
      //   y' = y
      //
      // Undefined when (a / a') is not square.
      const c = this._scale(point.curve);
      const nx = c.redMul(x);
      const ny = y;
      const nz = z;
      const nt = c.redMul(t);

      return this.point(nx, ny, nz, nt);
    }

    throw new Error('Not implemented.');
  }

  pointFromUniform(u, curve = null) {
    assert(u instanceof BN);
    assert(u.red === this.red);
    assert(curve == null || (curve instanceof MontCurve));

    if (!curve)
      curve = this._alt();

    const u0 = curve.field(u);
    const p0 = curve.pointFromUniform(u0);

    return this.pointFromMont(p0);
  }

  pointToUniform(p, hint, curve = null) {
    // Convert an edwards point to a field
    // element by inverting the elligator2 map.
    //
    // Hint Layout:
    //
    //   [00000000] [0000] [0000]
    //        |        |      |
    //        |        |      +-- preimage index
    //        |        +--- subgroup
    //        +-- bits to OR with uniform bytes
    assert(p instanceof EdwardsPoint);
    assert((hint >>> 0) === hint);
    assert(curve == null || (curve instanceof MontCurve));

    if (!curve)
      curve = this._alt();

    // Add a random torsion component.
    const i = ((hint >> 4) & 15) % this.torsion.length;
    const q = p.add(this.torsion[i]);

    // Convert and invert.
    const p0 = curve.pointFromEdwards(q);
    const u0 = curve.pointToUniform(p0, hint & 15);

    return this.field(u0);
  }

  pointFromHash(bytes, pake, curve = null) {
    assert(curve == null || (curve instanceof MontCurve));

    if (!curve)
      curve = this._alt();

    const p0 = curve.pointFromHash(bytes, pake);

    return this.pointFromMont(p0);
  }

  pointToHash(p, subgroup, rng, curve = null) {
    assert(p instanceof EdwardsPoint);
    assert((subgroup >>> 0) === subgroup);
    assert(curve == null || (curve instanceof MontCurve));

    if (!curve)
      curve = this._alt();

    // Add a random torsion component.
    const i = subgroup % this.torsion.length;
    const q = p.add(this.torsion[i]);

    // Convert and invert.
    const p0 = curve.pointFromEdwards(q);

    return curve.pointToHash(p0, 0, rng);
  }

  decodePoint(bytes) {
    return EdwardsPoint.decode(this, bytes);
  }

  toShort(a0, odd, sign = null) {
    const [a, b] = this._short(a0, odd);

    const curve = new ShortCurve({
      red: this.red,
      prime: this.prime,
      p: this.p,
      a: a,
      b: b,
      n: this.n,
      h: this.h
    });

    if (sign != null) {
      const [, u3] = curve._scale(this);

      if (u3.redIsOdd() !== sign)
        u3.redINeg();
    }

    if (!this.g.isInfinity())
      curve.g = curve.pointFromEdwards(this.g);

    for (let i = 0; i < this.h.word(0); i++)
      curve.torsion[i] = curve.pointFromEdwards(this.torsion[i]);

    return curve;
  }

  toMont(b0, invert, sign = null) {
    const [a, b] = this._mont(b0, invert);

    const curve = new MontCurve({
      red: this.red,
      prime: this.prime,
      p: this.p,
      a: a,
      b: b,
      n: this.n,
      h: this.h,
      z: this.z
    });

    if (sign != null) {
      const c = this._scale(curve, invert);

      if (c.redIsOdd() !== sign)
        c.redINeg();
    }

    if (!this.g.isInfinity())
      curve.g = curve.pointFromEdwards(this.g);

    for (let i = 0; i < this.h.word(0); i++)
      curve.torsion[i] = curve.pointFromEdwards(this.torsion[i]);

    return curve;
  }

  toEdwards(a0, sign = null) {
    const [a, d] = this._edwards(a0);

    const curve = new EdwardsCurve({
      red: this.red,
      prime: this.prime,
      p: this.p,
      a: a,
      d: d,
      n: this.n,
      h: this.h,
      z: this.z
    });

    if (sign != null) {
      const c = curve._scale(this);

      if (c.redIsOdd() !== sign)
        c.redINeg();
    }

    if (!this.g.isInfinity()) {
      curve.g = curve.pointFromEdwards(this.g);
      curve.g.normalize();
    }

    if (curve.isComplete()) {
      for (let i = 0; i < this.h.word(0); i++) {
        curve.torsion[i] = curve.pointFromEdwards(this.torsion[i]);
        curve.torsion[i].normalize();
      }
    }

    return curve;
  }

  pointFromJSON(json) {
    return EdwardsPoint.fromJSON(this, json);
  }

  toJSON(pre) {
    const json = super.toJSON(pre);

    json.a = this.a.fromRed().toJSON();
    json.d = this.d.fromRed().toJSON();

    if (!this.s.isZero())
      json.s = this.s.fromRed().toJSON();

    return json;
  }
}

/**
 * EdwardsPoint
 */

class EdwardsPoint extends Point {
  constructor(curve, x, y, z, t) {
    assert(curve instanceof EdwardsCurve);

    super(curve, types.EXTENDED);

    this.x = this.curve.zero;
    this.y = this.curve.one;
    this.z = this.curve.one;
    this.t = this.curve.zero;
    this.zOne = true;

    if (x != null)
      this._init(x, y, z, t);
  }

  _init(x, y, z, t) {
    assert(x instanceof BN);
    assert(y instanceof BN);
    assert(z == null || (z instanceof BN));
    assert(t == null || (t instanceof BN));

    this.x = x;
    this.y = y;
    this.z = z || this.curve.one;
    this.t = t || null;

    if (!this.x.red)
      this.x = this.x.toRed(this.curve.red);

    if (!this.y.red)
      this.y = this.y.toRed(this.curve.red);

    if (!this.z.red)
      this.z = this.z.toRed(this.curve.red);

    if (this.t && !this.t.red)
      this.t = this.t.toRed(this.curve.red);

    this.zOne = this.z.eq(this.curve.one);

    this._check();

    if (!this.t) {
      this.t = this.x.redMul(this.y);
      if (!this.zOne)
        this.t = this.t.redDiv(this.z);
    }
  }

  _check() {
    // In order to achieve complete
    // addition formulas, `a` must
    // be a square (always the case
    // for a=1), and `d` must be a
    // non-square.
    //
    // If this is not the case, the
    // addition formulas may have
    // exceptional cases where Z3=0.
    //
    // In particular, this can occur
    // when: Q*h = -P*h and Q != -P.
    //
    // This is assuming 4-torsion is
    // involved (the 4-torsion point
    // is _not_ representable when
    // `d` is square).
    if (this.z.isZero())
      throw new Error('Invalid point.');
  }

  clone() {
    return this.curve.point(this.x, this.y, this.z, this.t);
  }

  normalize() {
    // https://hyperelliptic.org/EFD/g1p/auto-edwards-projective.html#scaling-z
    // 1I + 2M (+ 1M if extended)

    // Z1 = 1
    if (this.zOne)
      return this;

    // A = 1 / Z1
    const a = this.z.redInvert();

    // X3 = X1 * A
    this.x = this.x.redMul(a);

    // Y3 = Y1 * A
    this.y = this.y.redMul(a);

    // T3 = T1 * A
    this.t = this.t.redMul(a);

    // Z3 = 1
    this.z = this.curve.one;
    this.zOne = true;

    return this;
  }

  scale(a) {
    assert(a instanceof BN);

    // X3 = X1 * A
    const nx = this.x.redMul(a);

    // Y3 = Y1 * A
    const ny = this.y.redMul(a);

    // Z3 = Z1 * A
    const nz = this.z.redMul(a);

    // T3 = T1 * A
    const nt = this.t.redMul(a);

    return this.curve.point(nx, ny, nz, nt);
  }

  neg() {
    // -(X1, Y1, Z1, T1) = (-X1, Y1, Z1, -T1)
    const nx = this.x.redNeg();
    const ny = this.y;
    const nz = this.z;
    const nt = this.t.redNeg();

    return this.curve.point(nx, ny, nz, nt);
  }

  add(p) {
    assert(p instanceof EdwardsPoint);

    // P = O
    if (this.isInfinity())
      return p;

    // Q = O
    if (p.isInfinity())
      return this;

    // Z1 = 1
    if (this.zOne)
      return p._add(this);

    return this._add(p);
  }

  _add(p) {
    // a = -1
    if (this.curve.mOneA)
      return this._addM1(p);

    return this._addA(p);
  }

  _addM1(p) {
    // Assumes a = -1.
    //
    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html#addition-add-2008-hwcd-3
    // 8M + 8A + 1*k + 1*2
    //
    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html#addition-madd-2008-hwcd-3
    // 7M + 8A + 1*k + 1*2

    // A = (Y1 - X1) * (Y2 - X2)
    const a = this.y.redSub(this.x).redMul(p.y.redSub(p.x));

    // B = (Y1 + X1) * (Y2 + X2)
    const b = this.y.redAdd(this.x).redMul(p.y.redAdd(p.x));

    // C = T1 * k * T2
    const c = this.t.redMul(this.curve.k).redMul(p.t);

    // D = Z1 * 2 * Z2
    const d = p.zOne ? this.z.redAdd(this.z) : this.z.redMul(p.z).redIMuln(2);

    // E = B - A
    const e = b.redSub(a);

    // F = D - C
    const f = d.redSub(c);

    // G = D + C
    const g = d.redIAdd(c);

    // H = B + A
    const h = b.redIAdd(a);

    // X3 = E * F
    const nx = e.redMul(f);

    // Y3 = G * H
    const ny = g.redMul(h);

    // T3 = E * H
    const nt = e.redMul(h);

    // Z3 = F * G
    const nz = f.redMul(g);

    return this.curve.point(nx, ny, nz, nt);
  }

  _addA(p) {
    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
    // 9M + 7A + 1*a + 1*d
    //
    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-madd-2008-hwcd
    // 8M + 7A + 1*a + 1*d

    // A = X1 * X2
    const a = this.x.redMul(p.x);

    // B = Y1 * Y2
    const b = this.y.redMul(p.y);

    // C = T1 * d * T2
    const c = this.curve._mulD(this.t).redMul(p.t);

    // D = Z1 * Z2
    const d = p.zOne ? this.z.clone() : this.z.redMul(p.z);

    // + XYXY = (X1 + Y1) * (X2 + Y2)
    const xyxy = this.x.redAdd(this.y).redMul(p.x.redAdd(p.y));

    // E = (X1 + Y1) * (X2 + Y2) - A - B
    const e = xyxy.redISub(a).redISub(b);

    // F = D - C
    const f = d.redSub(c);

    // G = D + C
    const g = d.redIAdd(c);

    // H = B - a * A
    const h = b.redISub(this.curve._mulA(a));

    // X3 = E * F
    const nx = e.redMul(f);

    // Y3 = G * H
    const ny = g.redMul(h);

    // T3 = E * H
    const nt = e.redMul(h);

    // Z3 = F * G
    const nz = f.redMul(g);

    return this.curve.point(nx, ny, nz, nt);
  }

  dbl() {
    // P = O
    if (this.isInfinity())
      return this;

    return this._dbl();
  }

  _dbl() {
    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
    // 4M + 4S + 6A + 1*a + 1*2
    //
    // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-mdbl-2008-hwcd
    // 3M + 4S + 7A + 1*a + 1*2

    // A = X1^2
    const a = this.x.redSqr();

    // B = Y1^2
    const b = this.y.redSqr();

    // C = 2 * Z1^2
    const c = this.zOne ? this.curve.two : this.z.redSqr().redIMuln(2);

    // D = a * A
    const d = this.curve._mulA(a);

    // E = (X1 + Y1)^2 - A - B
    const e = this.x.redAdd(this.y).redSqr().redISub(a).redISub(b);

    // G = D + B
    const g = d.redAdd(b);

    // F = G - C
    const f = g.redSub(c);

    // H = D - B
    const h = d.redISub(b);

    // X3 = E * F
    const nx = e.redMul(f);

    // Y3 = G * H
    const ny = g.redMul(h);

    // T3 = E * H
    const nt = e.redMul(h);

    // Z3 = F * G
    const nz = f.redMul(g);

    return this.curve.point(nx, ny, nz, nt);
  }

  getX() {
    this.normalize();
    return this.x.fromRed();
  }

  getY() {
    this.normalize();
    return this.y.fromRed();
  }

  eq(p) {
    assert(p instanceof EdwardsPoint);
    assert(!this.z.isZero());
    assert(!p.z.isZero());

    // P = Q
    if (this === p)
      return true;

    // Z1 = Z2
    if (this.z.eq(p.z)) {
      return this.x.eq(p.x)
          && this.y.eq(p.y);
    }

    // X1 * Z2 = X2 * Z1
    const x1 = this.x.redMul(p.z);
    const x2 = p.x.redMul(this.z);

    if (!x1.eq(x2))
      return false;

    const y1 = this.y.redMul(p.z);
    const y2 = p.y.redMul(this.z);

    return y1.eq(y2);
  }

  cmp(point) {
    assert(point instanceof EdwardsPoint);

    return this.order().cmp(point.order())
        || this.getY().cmp(point.getY())
        || this.getX().cmp(point.getX());
  }

  isInfinity() {
    assert(!this.z.isZero());

    // X1 = 0
    if (!this.x.isZero())
      return false;

    // Y1 = Z1
    return this.y.eq(this.z);
  }

  isOrder2() {
    if (this.isInfinity())
      return false;

    return this.x.isZero();
  }

  isOdd() {
    this.normalize();
    return this.x.redIsOdd();
  }

  isEven() {
    this.normalize();
    return this.x.redIsEven();
  }

  toP() {
    return this.normalize();
  }

  toJ() {
    return this;
  }

  encode() {
    // [RFC8032] Section 5.1.2.
    const y = this.getY();

    // Note: `x` normalized from `getY()` call.
    y.setn(this.curve.signBit, this.x.redIsOdd());

    return this.curve.encodeAdjusted(y);
  }

  static decode(curve, bytes) {
    // [RFC8032] Section 5.1.3.
    assert(curve instanceof EdwardsCurve);

    const y = curve.decodeAdjusted(bytes);
    const sign = y.testn(curve.signBit) !== 0;

    y.setn(curve.signBit, 0);

    if (y.cmp(curve.p) >= 0)
      throw new Error('Invalid point.');

    return curve.pointFromY(y, sign);
  }

  toJSON(pre) {
    if (this.isInfinity())
      return [];

    const x = this.getX().toJSON();
    const y = this.getY().toJSON();

    if (pre === true && this.pre)
      return [x, y, this.pre.toJSON()];

    return [x, y];
  }

  toPretty() {
    const size = this.curve.fieldSize * 2;
    const x = toPretty(this.getX(), size);
    const y = toPretty(this.getY(), size);

    return [x, y];
  }

  static fromJSON(curve, json) {
    assert(curve instanceof EdwardsCurve);
    assert(Array.isArray(json));
    assert(json.length === 0
        || json.length === 2
        || json.length === 3);

    if (json.length === 0)
      return curve.point();

    const x = BN.fromJSON(json[0]);
    const y = BN.fromJSON(json[1]);
    const point = curve.point(x, y);

    if (json.length > 2 && json[2] != null)
      point.pre = Precomp.fromJSON(point, json[2]);

    return point;
  }

  [custom]() {
    if (this.isInfinity())
      return '<EdwardsPoint: Infinity>';

    return '<EdwardsPoint:'
        + ' x=' + this.x.fromRed().toString(16, 2)
        + ' y=' + this.y.fromRed().toString(16, 2)
        + ' z=' + this.z.fromRed().toString(16, 2)
        + '>';
  }
}

/**
 * Precomp
 */

class Precomp {
  constructor() {
    this.naf = null;
    this.windows = null;
    this.doubles = null;
    this.blinding = null;
    this.beta = null;
  }

  map(func) {
    assert(typeof func === 'function');

    const out = new this.constructor();

    if (this.naf)
      out.naf = this.naf.map(func);

    if (this.doubles)
      out.doubles = this.doubles.map(func);

    return out;
  }

  toJSON() {
    return {
      naf: this.naf ? this.naf.toJSON() : null,
      windows: this.windows ? this.windows.toJSON() : null,
      doubles: this.doubles ? this.doubles.toJSON() : null,
      blinding: this.blinding ? this.blinding.toJSON() : undefined
    };
  }

  fromJSON(point, json) {
    assert(point instanceof Point);
    assert(json && typeof json === 'object');

    if (json.naf != null)
      this.naf = NAF.fromJSON(point, json.naf);

    if (json.windows != null)
      this.windows = Windows.fromJSON(point, json.windows);

    if (json.doubles != null)
      this.doubles = Doubles.fromJSON(point, json.doubles);

    if (json.blinding != null)
      this.blinding = Blinding.fromJSON(point, json.blinding);

    return this;
  }

  static fromJSON(point, json) {
    return new this().fromJSON(point, json);
  }
}

/**
 * NAF
 */

class NAF {
  constructor(width, points) {
    this.width = width;
    this.points = points;
  }

  map(func) {
    assert(typeof func === 'function');

    const {width} = this;
    const points = [];

    for (const point of this.points)
      points.push(func(point));

    return new this.constructor(width, points);
  }

  toJSON() {
    return {
      width: this.width,
      points: this.points.slice(1).map((point) => {
        return point.toJSON();
      })
    };
  }

  static fromJSON(point, json) {
    assert(point instanceof Point);
    assert(json && typeof json === 'object');
    assert((json.width >>> 0) === json.width);
    assert(Array.isArray(json.points));

    const {curve} = point;
    const {width} = json;
    const points = [point];

    for (const item of json.points)
      points.push(curve.pointFromJSON(item));

    return new this(width, points);
  }
}

/**
 * Windows
 */

class Windows {
  constructor(width, bits, points) {
    this.width = width;
    this.bits = bits;
    this.points = points;
  }

  toJSON() {
    return {
      width: this.width,
      bits: this.bits,
      points: this.points.slice(1).map((point) => {
        return point.toJSON();
      })
    };
  }

  static fromJSON(point, json) {
    assert(point instanceof Point);
    assert(json && typeof json === 'object');
    assert((json.width >>> 0) === json.width);
    assert((json.bits >>> 0) === json.bits);
    assert(Array.isArray(json.points));

    const {curve} = point;
    const {width, bits} = json;
    const points = [point];

    for (const item of json.points)
      points.push(curve.pointFromJSON(item));

    return new this(width, bits, points);
  }
}

/**
 * Doubles
 */

class Doubles {
  constructor(step, points) {
    this.step = step;
    this.points = points;
  }

  map(func) {
    assert(typeof func === 'function');

    const {step} = this;
    const points = [];

    for (const point of this.points)
      points.push(func(point));

    return new this.constructor(step, points);
  }

  toJSON() {
    return {
      step: this.step,
      points: this.points.slice(1).map((point) => {
        return point.toJSON();
      })
    };
  }

  static fromJSON(point, json) {
    assert(point instanceof Point);
    assert(json && typeof json === 'object');
    assert((json.step >>> 0) === json.step);
    assert(Array.isArray(json.points));

    const {curve} = point;
    const {step} = json;
    const points = [point];

    for (const item of json.points)
      points.push(curve.pointFromJSON(item));

    return new this(step, points);
  }
}

/**
 * Blinding
 */

class Blinding {
  constructor(blind, unblind) {
    this.blind = blind;
    this.unblind = unblind;
  }

  toJSON() {
    return {
      blind: this.blind.toJSON(),
      unblind: this.unblind.toJSON()
    };
  }

  static fromJSON(point, json) {
    assert(point instanceof Point);
    assert(json && typeof json === 'object');

    const {curve} = point;
    const blind = BN.fromJSON(json.blind);
    const unblind = curve.pointFromJSON(json.unblind);

    return new this(blind, unblind);
  }
}

/**
 * Endo
 */

class Endo {
  constructor(beta, lambda, basis, pre) {
    this.beta = beta;
    this.lambda = lambda;
    this.basis = basis;
    this.pre = pre;
  }

  toJSON() {
    return {
      beta: this.beta.fromRed().toJSON(),
      lambda: this.lambda.toJSON(),
      basis: [
        this.basis[0].toJSON(),
        this.basis[1].toJSON()
      ],
      pre: [
        this.pre[0],
        this.pre[1].toJSON(),
        this.pre[2].toJSON()
      ]
    };
  }

  static fromJSON(curve, json) {
    assert(curve instanceof Curve);
    assert(json && typeof json === 'object');
    assert(Array.isArray(json.basis));
    assert(Array.isArray(json.pre));
    assert(json.basis.length === 2);
    assert(json.pre.length === 3);
    assert((json.pre[0] >>> 0) === json.pre[0]);

    const beta = BN.fromJSON(json.beta).toRed(curve.red);
    const lambda = BN.fromJSON(json.lambda);

    const basis = [
      Vector.fromJSON(json.basis[0]),
      Vector.fromJSON(json.basis[1])
    ];

    const pre = [
      json.pre[0],
      BN.fromJSON(json.pre[1]),
      BN.fromJSON(json.pre[2])
    ];

    return new this(beta, lambda, basis, pre);
  }
}

/**
 * Vector
 */

class Vector {
  constructor(a, b) {
    this.a = a;
    this.b = b;
  }

  toJSON() {
    return {
      a: this.a.toJSON(),
      b: this.b.toJSON()
    };
  }

  static fromJSON(json) {
    assert(json && typeof json === 'object');

    const a = BN.fromJSON(json.a);
    const b = BN.fromJSON(json.b);

    return new this(a, b);
  }
}

/**
 * P192
 * https://tinyurl.com/fips-186-2 (page 29)
 * https://tinyurl.com/fips-186-3 (page 88)
 */

class P192 extends ShortCurve {
  constructor(pre) {
    super({
      id: 'P192',
      ossl: 'prime192v1',
      type: 'short',
      endian: 'be',
      hash: 'SHA256',
      prime: 'p192',
      // 2^192 - 2^64 - 1 (= 3 mod 4)
      p: ['ffffffff ffffffff ffffffff fffffffe',
          'ffffffff ffffffff'],
      // -3 mod p
      a: ['ffffffff ffffffff ffffffff fffffffe',
          'ffffffff fffffffc'],
      b: ['64210519 e59c80e7 0fa7e9ab 72243049',
          'feb8deec c146b9b1'],
      n: ['ffffffff ffffffff ffffffff 99def836',
          '146bc9b1 b4d22831'],
      h: '1',
      // Icart
      z: '-5',
      g: [
        ['188da80e b03090f6 7cbf20eb 43a18800',
         'f4ff0afd 82ff1012'],
        ['07192b95 ffc8da78 631011ed 6b24cdd5',
         '73f977a1 1e794811'],
        pre
      ]
    });
  }
}

/**
 * P224
 * https://tinyurl.com/fips-186-2 (page 30)
 * https://tinyurl.com/fips-186-3 (page 88)
 */

class P224 extends ShortCurve {
  constructor(pre) {
    super({
      id: 'P224',
      ossl: 'secp224r1',
      type: 'short',
      endian: 'be',
      hash: 'SHA256',
      prime: 'p224',
      // 2^224 - 2^96 + 1 (1 mod 16)
      p: ['ffffffff ffffffff ffffffff ffffffff',
          '00000000 00000000 00000001'],
      // -3 mod p
      a: ['ffffffff ffffffff ffffffff fffffffe',
          'ffffffff ffffffff fffffffe'],
      b: ['b4050a85 0c04b3ab f5413256 5044b0b7',
          'd7bfd8ba 270b3943 2355ffb4'],
      n: ['ffffffff ffffffff ffffffff ffff16a2',
          'e0b8f03e 13dd2945 5c5c2a3d'],
      h: '1',
      // SSWU
      z: '1f',
      g: [
        ['b70e0cbd 6bb4bf7f 321390b9 4a03c1d3',
         '56c21122 343280d6 115c1d21'],
        ['bd376388 b5f723fb 4c22dfe6 cd4375a0',
         '5a074764 44d58199 85007e34'],
        pre
      ]
    });
  }
}

/**
 * P256
 * https://tinyurl.com/fips-186-2 (page 31)
 * https://tinyurl.com/fips-186-3 (page 89)
 */

class P256 extends ShortCurve {
  constructor(pre) {
    super({
      id: 'P256',
      ossl: 'prime256v1',
      type: 'short',
      endian: 'be',
      hash: 'SHA256',
      prime: null,
      // 2^256 - 2^224 + 2^192 + 2^96 - 1 (= 3 mod 4)
      p: ['ffffffff 00000001 00000000 00000000',
          '00000000 ffffffff ffffffff ffffffff'],
      // -3 mod p
      a: ['ffffffff 00000001 00000000 00000000',
          '00000000 ffffffff ffffffff fffffffc'],
      b: ['5ac635d8 aa3a93e7 b3ebbd55 769886bc',
          '651d06b0 cc53b0f6 3bce3c3e 27d2604b'],
      n: ['ffffffff 00000000 ffffffff ffffffff',
          'bce6faad a7179e84 f3b9cac2 fc632551'],
      h: '1',
      // SSWU
      z: '-a',
      g: [
        ['6b17d1f2 e12c4247 f8bce6e5 63a440f2',
         '77037d81 2deb33a0 f4a13945 d898c296'],
        ['4fe342e2 fe1a7f9b 8ee7eb4a 7c0f9e16',
         '2bce3357 6b315ece cbb64068 37bf51f5'],
        pre
      ]
    });
  }
}

/**
 * P384
 * https://tinyurl.com/fips-186-2 (page 32)
 * https://tinyurl.com/fips-186-3 (page 89)
 */

class P384 extends ShortCurve {
  constructor(pre) {
    super({
      id: 'P384',
      ossl: 'secp384r1',
      type: 'short',
      endian: 'be',
      hash: 'SHA384',
      prime: null,
      // 2^384 - 2^128 - 2^96 + 2^32 - 1 (= 3 mod 4)
      p: ['ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff fffffffe',
          'ffffffff 00000000 00000000 ffffffff'],
      // -3 mod p
      a: ['ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff fffffffe',
          'ffffffff 00000000 00000000 fffffffc'],
      b: ['b3312fa7 e23ee7e4 988e056b e3f82d19',
          '181d9c6e fe814112 0314088f 5013875a',
          'c656398d 8a2ed19d 2a85c8ed d3ec2aef'],
      n: ['ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff c7634d81 f4372ddf',
          '581a0db2 48b0a77a ecec196a ccc52973'],
      h: '1',
      // Icart
      z: '-c',
      g: [
        ['aa87ca22 be8b0537 8eb1c71e f320ad74',
         '6e1d3b62 8ba79b98 59f741e0 82542a38',
         '5502f25d bf55296c 3a545e38 72760ab7'],
        ['3617de4a 96262c6f 5d9e98bf 9292dc29',
         'f8f41dbd 289a147c e9da3113 b5f0b8c0',
         '0a60b1ce 1d7e819d 7a431d7c 90ea0e5f'],
        pre
      ]
    });
  }
}

/**
 * P521
 * https://tinyurl.com/fips-186-2 (page 33)
 * https://tinyurl.com/fips-186-3 (page 90)
 */

class P521 extends ShortCurve {
  constructor(pre) {
    super({
      id: 'P521',
      ossl: 'secp521r1',
      type: 'short',
      endian: 'be',
      hash: 'SHA512',
      prime: 'p521',
      // 2^521 - 1 (= 3 mod 4)
      p: ['000001ff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff ffffffff',
          'ffffffff'],
      // -3 mod p
      a: ['000001ff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff ffffffff',
          'fffffffc'],
      b: ['00000051 953eb961 8e1c9a1f 929a21a0',
          'b68540ee a2da725b 99b315f3 b8b48991',
          '8ef109e1 56193951 ec7e937b 1652c0bd',
          '3bb1bf07 3573df88 3d2c34f1 ef451fd4',
          '6b503f00'],
      n: ['000001ff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff ffffffff',
          'fffffffa 51868783 bf2f966b 7fcc0148',
          'f709a5d0 3bb5c9b8 899c47ae bb6fb71e',
          '91386409'],
      h: '1',
      // SSWU
      z: '-4',
      g: [
        ['000000c6 858e06b7 0404e9cd 9e3ecb66',
         '2395b442 9c648139 053fb521 f828af60',
         '6b4d3dba a14b5e77 efe75928 fe1dc127',
         'a2ffa8de 3348b3c1 856a429b f97e7e31',
         'c2e5bd66'],
        ['00000118 39296a78 9a3bc004 5c8a5fb4',
         '2c7d1bd9 98f54449 579b4468 17afbd17',
         '273e662c 97ee7299 5ef42640 c550b901',
         '3fad0761 353c7086 a272c240 88be9476',
         '9fd16650'],
        pre
      ]
    });
  }
}

/**
 * SECP256K1
 * https://www.secg.org/SEC2-Ver-1.0.pdf (page 15, section 2.7.1)
 * https://www.secg.org/sec2-v2.pdf (page 9, section 2.4.1)
 */

class SECP256K1 extends ShortCurve {
  constructor(pre) {
    super({
      id: 'SECP256K1',
      ossl: 'secp256k1',
      type: 'short',
      endian: 'be',
      hash: 'SHA256',
      prime: 'k256',
      // 2^256 - 2^32 - 977 (= 3 mod 4)
      p: ['ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff fffffffe fffffc2f'],
      a: '0',
      b: '7',
      n: ['ffffffff ffffffff ffffffff fffffffe',
          'baaedce6 af48a03b bfd25e8c d0364141'],
      h: '1',
      // SVDW
      z: '1',
      // sqrt(-3)
      c: ['0a2d2ba9 3507f1df 233770c2 a797962c',
          'c61f6d15 da14ecd4 7d8d27ae 1cd5f852'],
      g: [
        ['79be667e f9dcbbac 55a06295 ce870b07',
         '029bfcdb 2dce28d9 59f2815b 16f81798'],
        ['483ada77 26a3c465 5da4fbfc 0e1108a8',
         'fd17b448 a6855419 9c47d08f fb10d4b8'],
        pre
      ],
      // Precomputed endomorphism.
      endo: {
        beta: ['7ae96a2b 657c0710 6e64479e ac3434e9',
               '9cf04975 12f58995 c1396c28 719501ee'],
        lambda: ['5363ad4c c05c30e0 a5261c02 8812645a',
                 '122e22ea 20816678 df02967c 1b23bd72'],
        basis: [
          {
            a: '3086d221a7d46bcde86c90e49284eb15',
            b: '-e4437ed6010e88286f547fa90abfe4c3'
          },
          {
            a: '114ca50f7a8e2f3f657c1108d9d44cfd8',
            b: '3086d221a7d46bcde86c90e49284eb15'
          }
        ],
        pre: [
          384,
          ['3086d221 a7d46bcd e86c90e4 9284eb15',
           '3daa8a14 71e8ca7f e893209a 45dbb031'],
          ['-',
           'e4437ed6 010e8828 6f547fa9 0abfe4c4',
           '221208ac 9df506c6 1571b4ae 8ac47f71']
        ]
      }
    });
  }
}

/**
 * BRAINPOOLP256
 * https://tools.ietf.org/html/rfc5639#section-3.4
 */

class BRAINPOOLP256 extends ShortCurve {
  constructor(pre) {
    super({
      id: 'BRAINPOOLP256',
      ossl: 'brainpoolP256r1',
      type: 'short',
      endian: 'be',
      hash: 'SHA256',
      prime: null,
      // (= 3 mod 4)
      p: ['a9fb57db a1eea9bc 3e660a90 9d838d72',
          '6e3bf623 d5262028 2013481d 1f6e5377'],
      a: ['7d5a0975 fc2c3057 eef67530 417affe7',
          'fb8055c1 26dc5c6c e94a4b44 f330b5d9'],
      b: ['26dc5c6c e94a4b44 f330b5d9 bbd77cbf',
          '95841629 5cf7e1ce 6bccdc18 ff8c07b6'],
      n: ['a9fb57db a1eea9bc 3e660a90 9d838d71',
          '8c397aa3 b561a6f7 901e0e82 974856a7'],
      h: '1',
      // Icart
      z: '-2',
      g: [
        ['8bd2aeb9 cb7e57cb 2c4b482f fc81b7af',
         'b9de27e1 e3bd23c2 3a4453bd 9ace3262'],
        ['547ef835 c3dac4fd 97f8461a 14611dc9',
         'c2774513 2ded8e54 5c1d54c7 2f046997'],
        pre
      ]
    });
  }
}

/**
 * BRAINPOOLP384
 * https://tools.ietf.org/html/rfc5639#section-3.6
 */

class BRAINPOOLP384 extends ShortCurve {
  constructor(pre) {
    super({
      id: 'BRAINPOOLP384',
      ossl: 'brainpoolP384r1',
      type: 'short',
      endian: 'be',
      hash: 'SHA384',
      prime: null,
      // (= 3 mod 4)
      p: ['8cb91e82 a3386d28 0f5d6f7e 50e641df',
          '152f7109 ed5456b4 12b1da19 7fb71123',
          'acd3a729 901d1a71 87470013 3107ec53'],
      a: ['7bc382c6 3d8c150c 3c72080a ce05afa0',
          'c2bea28e 4fb22787 139165ef ba91f90f',
          '8aa5814a 503ad4eb 04a8c7dd 22ce2826'],
      b: ['04a8c7dd 22ce2826 8b39b554 16f0447c',
          '2fb77de1 07dcd2a6 2e880ea5 3eeb62d5',
          '7cb43902 95dbc994 3ab78696 fa504c11'],
      n: ['8cb91e82 a3386d28 0f5d6f7e 50e641df',
          '152f7109 ed5456b3 1f166e6c ac0425a7',
          'cf3ab6af 6b7fc310 3b883202 e9046565'],
      h: '1',
      // SSWU
      z: '-5',
      g: [
        ['1d1c64f0 68cf45ff a2a63a81 b7c13f6b',
         '8847a3e7 7ef14fe3 db7fcafe 0cbd10e8',
         'e826e034 36d646aa ef87b2e2 47d4af1e'],
        ['8abe1d75 20f9c2a4 5cb1eb8e 95cfd552',
         '62b70b29 feec5864 e19c054f f9912928',
         '0e464621 77918111 42820341 263c5315'],
        pre
      ]
    });
  }
}

/**
 * BRAINPOOLP512
 * https://tools.ietf.org/html/rfc5639#section-3.7
 */

class BRAINPOOLP512 extends ShortCurve {
  constructor(pre) {
    super({
      id: 'BRAINPOOLP512',
      ossl: 'brainpoolP512r1',
      type: 'short',
      endian: 'be',
      hash: 'SHA512',
      prime: null,
      // (= 3 mod 4)
      p: ['aadd9db8 dbe9c48b 3fd4e6ae 33c9fc07',
          'cb308db3 b3c9d20e d6639cca 70330871',
          '7d4d9b00 9bc66842 aecda12a e6a380e6',
          '2881ff2f 2d82c685 28aa6056 583a48f3'],
      a: ['7830a331 8b603b89 e2327145 ac234cc5',
          '94cbdd8d 3df91610 a83441ca ea9863bc',
          '2ded5d5a a8253aa1 0a2ef1c9 8b9ac8b5',
          '7f1117a7 2bf2c7b9 e7c1ac4d 77fc94ca'],
      b: ['3df91610 a83441ca ea9863bc 2ded5d5a',
          'a8253aa1 0a2ef1c9 8b9ac8b5 7f1117a7',
          '2bf2c7b9 e7c1ac4d 77fc94ca dc083e67',
          '984050b7 5ebae5dd 2809bd63 8016f723'],
      n: ['aadd9db8 dbe9c48b 3fd4e6ae 33c9fc07',
          'cb308db3 b3c9d20e d6639cca 70330870',
          '553e5c41 4ca92619 41866119 7fac1047',
          '1db1d381 085ddadd b5879682 9ca90069'],
      h: '1',
      // Icart
      z: '7',
      g: [
        ['81aee4bd d82ed964 5a21322e 9c4c6a93',
         '85ed9f70 b5d916c1 b43b62ee f4d0098e',
         'ff3b1f78 e2d0d48d 50d1687b 93b97d5f',
         '7c6d5047 406a5e68 8b352209 bcb9f822'],
        ['7dde385d 566332ec c0eabfa9 cf7822fd',
         'f209f700 24a57b1a a000c55b 881f8111',
         'b2dcde49 4a5f485e 5bca4bd8 8a2763ae',
         'd1ca2b2f a8f05406 78cd1e0f 3ad80892'],
        pre
      ]
    });
  }
}

/**
 * X25519
 * https://tools.ietf.org/html/rfc7748#section-4.1
 */

class X25519 extends MontCurve {
  constructor() {
    super({
      id: 'X25519',
      ossl: 'X25519',
      type: 'mont',
      endian: 'le',
      hash: 'SHA512',
      prime: 'p25519',
      // 2^255 - 19 (= 5 mod 8)
      p: ['7fffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff ffffffed'],
      // 486662
      a: '76d06',
      b: '1',
      n: ['10000000 00000000 00000000 00000000',
          '14def9de a2f79cd6 5812631a 5cf5d3ed'],
      h: '8',
      // Elligator 2
      z: '2',
      g: [
        ['00000000 00000000 00000000 00000000',
         '00000000 00000000 00000000 00000009'],
        // See: https://www.rfc-editor.org/errata/eid4730
        ['5f51e65e 475f794b 1fe122d3 88b72eb3',
         '6dc2b281 92839e4d d6163a5d 81312c14']
      ],
      torsion: [
        [],
        [
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000'],
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000']
        ],
        [
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000001'],
          ['6be4f497 f9a9c2af c21fa77a d7f4a6ef',
           '635a11c7 284a9363 e9a248ef 9c884415']
        ],
        [
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000001'],
          ['141b0b68 06563d50 3de05885 280b5910',
           '9ca5ee38 d7b56c9c 165db710 6377bbd8']
        ],
        [
          ['57119fd0 dd4e22d8 868e1c58 c45c4404',
           '5bef839c 55b1d0b1 248c50a3 bc959c5f'],
          ['68c59389 3d458e64 31c6ca00 45fb5015',
           '20a44346 8eaa68dd 0f103842 048065b7']
        ],
        [
          ['57119fd0 dd4e22d8 868e1c58 c45c4404',
           '5bef839c 55b1d0b1 248c50a3 bc959c5f'],
          ['173a6c76 c2ba719b ce3935ff ba04afea',
           'df5bbcb9 71559722 f0efc7bd fb7f9a36']
        ],
        [
          ['00b8495f 16056286 fdb1329c eb8d09da',
           '6ac49ff1 fae35616 aeb8413b 7c7aebe0'],
          ['3931c129 569e83a5 29482c14 e628b457',
           '933bfc29 ed801b4d 68871483 92507b1a']
        ],
        [
          ['00b8495f 16056286 fdb1329c eb8d09da',
           '6ac49ff1 fae35616 aeb8413b 7c7aebe0'],
          ['46ce3ed6 a9617c5a d6b7d3eb 19d74ba8',
           '6cc403d6 127fe4b2 9778eb7c 6daf84d3']
        ]
      ]
    });
  }
}

/**
 * X448
 * https://tools.ietf.org/html/rfc7748#section-4.2
 */

class X448 extends MontCurve {
  constructor() {
    super({
      id: 'X448',
      ossl: 'X448',
      type: 'mont',
      endian: 'le',
      hash: 'SHAKE256',
      prime: 'p448',
      // 2^448 - 2^224 - 1 (= 3 mod 4)
      p: ['ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff fffffffe ffffffff',
          'ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff'],
      // 156326
      a: '262a6',
      b: '1',
      n: ['3fffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff 7cca23e9',
          'c44edb49 aed63690 216cc272 8dc58f55',
          '2378c292 ab5844f3'],
      h: '4',
      // Elligator 2
      z: '-1',
      g: [
        ['00000000 00000000 00000000 00000000',
         '00000000 00000000 00000000 00000000',
         '00000000 00000000 00000000 00000000',
         '00000000 00000005'],
        ['7d235d12 95f5b1f6 6c98ab6e 58326fce',
         'cbae5d34 f55545d0 60f75dc2 8df3f6ed',
         'b8027e23 46430d21 1312c4b1 50677af7',
         '6fd7223d 457b5b1a']
      ],
      torsion: [
        [],
        [
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000'],
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000']
        ],
        [
          ['ffffffff ffffffff ffffffff ffffffff',
           'ffffffff ffffffff fffffffe ffffffff',
           'ffffffff ffffffff ffffffff ffffffff',
           'ffffffff fffffffe'],
          ['ba4d3a08 29b6112f 8812e51b a0bb2abe',
           'bc1cb08e b48e5569 36ba50fd d2e7d68a',
           'f8cb3216 0522425b 3f990812 abbe635a',
           'd37a21e1 7551b193']
        ],
        [
          ['ffffffff ffffffff ffffffff ffffffff',
           'ffffffff ffffffff fffffffe ffffffff',
           'ffffffff ffffffff ffffffff ffffffff',
           'ffffffff fffffffe'],
          ['45b2c5f7 d649eed0 77ed1ae4 5f44d541',
           '43e34f71 4b71aa96 c945af01 2d182975',
           '0734cde9 faddbda4 c066f7ed 54419ca5',
           '2c85de1e 8aae4e6c']
        ]
      ]
    });
  }
}

/**
 * MONT448
 * Isomorphic to Ed448-Goldilocks.
 */

class MONT448 extends MontCurve {
  constructor() {
    super({
      id: 'MONT448',
      ossl: null,
      type: 'mont',
      endian: 'le',
      hash: 'SHAKE256',
      prime: 'p448',
      // 2^448 - 2^224 - 1 (= 3 mod 4)
      p: ['ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff fffffffe ffffffff',
          'ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff'],
      // -78160 / -39082 mod p
      a: ['b2cf97d2 d43459a9 31ed36b1 fc4e3cb5',
          '5d93f8d2 22746997 60ccffc6 49961ed6',
          'c5b05fca c24864ed 6fb59697 931b78da',
          '84ddecd8 ca2b5cfb'],
      b: '1',
      n: ['3fffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff 7cca23e9',
          'c44edb49 aed63690 216cc272 8dc58f55',
          '2378c292 ab5844f3'],
      h: '4',
      // Elligator 2
      z: '-1',
      g: [
        ['ac0d24cc c6c75cb0 eb71f81e 7a6edf51',
         '48e88aee 009a2a24 e795687e c28e125a',
         '3e6730a6 0d46367b aa7fe99d 152128dc',
         '41321bc7 7817f059'],
        ['5a4437f6 80c0d0db 9b061276 d5d0ffcc',
         'e786ff33 b6a53d30 98746425 82e66f09',
         '4433dae7 7244a6e2 6b11e905 7228f483',
         '556c41a5 913f55fe']
      ],
      torsion: [
        [],
        [
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000'],
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000']
        ],
        [
          ['ffffffff ffffffff ffffffff ffffffff',
           'ffffffff ffffffff fffffffe ffffffff',
           'ffffffff ffffffff ffffffff ffffffff',
           'ffffffff fffffffe'],
          ['bec92fd0 6da2acf2 b4e261e8 7cef0d34',
           '22e75c18 3c589857 b71924e5 73c2f9ce',
           'e18da5f2 466e2f39 3c2eedf0 f105a60a',
           'b40c717d 4f1e1fd7']
        ],
        [
          ['ffffffff ffffffff ffffffff ffffffff',
           'ffffffff ffffffff fffffffe ffffffff',
           'ffffffff ffffffff ffffffff ffffffff',
           'ffffffff fffffffe'],
          ['4136d02f 925d530d 4b1d9e17 8310f2cb',
           'dd18a3e7 c3a767a8 48e6db19 8c3d0631',
           '1e725a0d b991d0c6 c3d1120f 0efa59f5',
           '4bf38e82 b0e1e028']
        ]
      ]
    });
  }
}

/**
 * ED25519
 * https://tools.ietf.org/html/rfc8032#section-5.1
 */

class ED25519 extends EdwardsCurve {
  constructor(pre) {
    super({
      id: 'ED25519',
      ossl: 'ED25519',
      type: 'edwards',
      endian: 'le',
      hash: 'SHA512',
      prefix: 'SigEd25519 no Ed25519 collisions',
      context: false,
      prime: 'p25519',
      // 2^255 - 19 (= 5 mod 8)
      p: ['7fffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff ffffffed'],
      a: '-1',
      // -121665 / 121666 mod p
      d: ['52036cee 2b6ffe73 8cc74079 7779e898',
          '00700a4d 4141d8ab 75eb4dca 135978a3'],
      n: ['10000000 00000000 00000000 00000000',
          '14def9de a2f79cd6 5812631a 5cf5d3ed'],
      h: '8',
      // Elligator 2
      z: '2',
      g: [
        ['216936d3 cd6e53fe c0a4e231 fdd6dc5c',
         '692cc760 9525a7b2 c9562d60 8f25d51a'],
        // 4/5
        ['66666666 66666666 66666666 66666666',
         '66666666 66666666 66666666 66666658'],
        pre
      ],
      torsion: [
        [
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000'],
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000001']
        ],
        [
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000'],
          ['7fffffff ffffffff ffffffff ffffffff',
           'ffffffff ffffffff ffffffff ffffffec']
        ],
        [
          ['2b832480 4fc1df0b 2b4d0099 3dfbd7a7',
           '2f431806 ad2fe478 c4ee1b27 4a0ea0b0'],
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000']
        ],
        [
          ['547cdb7f b03e20f4 d4b2ff66 c2042858',
           'd0bce7f9 52d01b87 3b11e4d8 b5f15f3d'],
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000']
        ],
        [
          ['1fd5b9a0 06394a28 e9339932 38de4abb',
           '5c193c70 13e5e238 dea14646 c545d14a'],
          ['05fc536d 880238b1 3933c6d3 05acdfd5',
           'f098eff2 89f4c345 b027b2c2 8f95e826']
        ],
        [
          ['602a465f f9c6b5d7 16cc66cd c721b544',
           'a3e6c38f ec1a1dc7 215eb9b9 3aba2ea3'],
          ['05fc536d 880238b1 3933c6d3 05acdfd5',
           'f098eff2 89f4c345 b027b2c2 8f95e826']
        ],
        [
          ['1fd5b9a0 06394a28 e9339932 38de4abb',
           '5c193c70 13e5e238 dea14646 c545d14a'],
          ['7a03ac92 77fdc74e c6cc392c fa53202a',
           '0f67100d 760b3cba 4fd84d3d 706a17c7']
        ],
        [
          ['602a465f f9c6b5d7 16cc66cd c721b544',
           'a3e6c38f ec1a1dc7 215eb9b9 3aba2ea3'],
          ['7a03ac92 77fdc74e c6cc392c fa53202a',
           '0f67100d 760b3cba 4fd84d3d 706a17c7']
        ]
      ]
    });
  }
}

/**
 * ISO448
 * https://tools.ietf.org/html/rfc7748#section-4.2
 * https://git.zx2c4.com/goldilocks/tree/_aux/ristretto/ristretto.sage#n658
 */

class ISO448 extends EdwardsCurve {
  constructor(pre) {
    super({
      id: 'ISO448',
      ossl: null,
      type: 'edwards',
      endian: 'le',
      hash: 'SHAKE256',
      prefix: 'SigEd448',
      context: true,
      prime: 'p448',
      // 2^448 - 2^224 - 1 (= 3 mod 4)
      p: ['ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff fffffffe ffffffff',
          'ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff'],
      a: '1',
      // 39082 / 39081 mod p
      d: ['d78b4bdc 7f0daf19 f24f38c2 9373a2cc',
          'ad461572 42a50f37 809b1da3 412a12e7',
          '9ccc9c81 264cfe9a d0809970 58fb61c4',
          '243cc32d baa156b9'],
      n: ['3fffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff 7cca23e9',
          'c44edb49 aed63690 216cc272 8dc58f55',
          '2378c292 ab5844f3'],
      h: '4',
      // Elligator 2
      z: '-1',
      g: [
        ['79a70b2b 70400553 ae7c9df4 16c792c6',
         '1128751a c9296924 0c25a07d 728bdc93',
         'e21f7787 ed697224 9de732f3 8496cd11',
         '69871309 3e9c04fc'],
        // Note: the RFC has this wrong.
        ['7fffffff ffffffff ffffffff ffffffff',
         'ffffffff ffffffff ffffffff 80000000',
         '00000000 00000000 00000000 00000000',
         '00000000 00000001'],
        pre
      ],
      torsion: [
        [
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000'],
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000001']
        ],
        [
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000'],
          ['ffffffff ffffffff ffffffff ffffffff',
           'ffffffff ffffffff fffffffe ffffffff',
           'ffffffff ffffffff ffffffff ffffffff',
           'ffffffff fffffffe']
        ],
        [
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000001'],
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000']
        ],
        [
          ['ffffffff ffffffff ffffffff ffffffff',
           'ffffffff ffffffff fffffffe ffffffff',
           'ffffffff ffffffff ffffffff ffffffff',
           'ffffffff fffffffe'],
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000']
        ]
      ]
    });
  }
}

/**
 * ED448
 * https://tools.ietf.org/html/rfc8032#section-5.2
 */

class ED448 extends EdwardsCurve {
  constructor(pre) {
    super({
      id: 'ED448',
      ossl: 'ED448',
      type: 'edwards',
      endian: 'le',
      hash: 'SHAKE256',
      prefix: 'SigEd448',
      context: true,
      prime: 'p448',
      // 2^448 - 2^224 - 1 (= 3 mod 4)
      p: ['ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff fffffffe ffffffff',
          'ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff'],
      a: '1',
      // -39081 mod p
      d: ['ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff fffffffe ffffffff',
          'ffffffff ffffffff ffffffff ffffffff',
          'ffffffff ffff6756'],
      n: ['3fffffff ffffffff ffffffff ffffffff',
          'ffffffff ffffffff ffffffff 7cca23e9',
          'c44edb49 aed63690 216cc272 8dc58f55',
          '2378c292 ab5844f3'],
      h: '4',
      // Elligator 2
      z: '-1',
      g: [
        ['4f1970c6 6bed0ded 221d15a6 22bf36da',
         '9e146570 470f1767 ea6de324 a3d3a464',
         '12ae1af7 2ab66511 433b80e1 8b00938e',
         '2626a82b c70cc05e'],
        ['693f4671 6eb6bc24 88762037 56c9c762',
         '4bea7373 6ca39840 87789c1e 05a0c2d7',
         '3ad3ff1c e67c39c4 fdbd132c 4ed7c8ad',
         '9808795b f230fa14'],
        pre
      ],
      torsion: [
        [
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000'],
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000001']
        ],
        [
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000'],
          ['ffffffff ffffffff ffffffff ffffffff',
           'ffffffff ffffffff fffffffe ffffffff',
           'ffffffff ffffffff ffffffff ffffffff',
           'ffffffff fffffffe']
        ],
        [
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000001'],
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000']
        ],
        [
          ['ffffffff ffffffff ffffffff ffffffff',
           'ffffffff ffffffff fffffffe ffffffff',
           'ffffffff ffffffff ffffffff ffffffff',
           'ffffffff fffffffe'],
          ['00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000 00000000 00000000',
           '00000000 00000000']
        ]
      ]
    });
  }
}

/*
 * Curve Registry
 */

const curves = {
  __proto__: null,
  P192,
  P224,
  P256,
  P384,
  P521,
  SECP256K1,
  BRAINPOOLP256,
  BRAINPOOLP384,
  BRAINPOOLP512,
  X25519,
  X448,
  MONT448,
  ED25519,
  ISO448,
  ED448
};

const cache = {
  __proto__: null,
  P192: null,
  P224: null,
  P256: null,
  P384: null,
  P521: null,
  SECP256K1: null,
  BRAINPOOLP256: null,
  BRAINPOOLP384: null,
  BRAINPOOLP512: null,
  X25519: null,
  X448: null,
  MONT448: null,
  ED25519: null,
  ISO448: null,
  ED448: null
};

function curve(name, ...args) {
  assert(typeof name === 'string');

  const key = name.toUpperCase();

  let curve = cache[key];

  if (!curve) {
    const Curve = curves[key];

    if (!Curve)
      throw new Error(`Curve not found: "${name}".`);

    curve = new Curve(...args);
    cache[key] = curve;
  }

  return curve;
}

function register(name, Curve) {
  assert(typeof name === 'string');
  assert(typeof Curve === 'function');

  const key = name.toUpperCase();

  if (curves[key])
    throw new Error(`Curve already registered: "${name}".`);

  curves[key] = Curve;
  cache[key] = null;
}

/*
 * Scalar Recoding
 */

function getNAF(k, width, max) {
  // Computing the width-w NAF of a positive integer.
  //
  // [GECC] Algorithm 3.35, Page 100, Section 3.3.
  //
  // The above document describes a rather abstract
  // method of recoding. The more optimal method
  // below was ported from libsecp256k1.
  assert(k instanceof BN);
  assert(!k.red);
  assert((width >>> 0) === width);
  assert((max >>> 0) === max);

  const naf = new Array(max);
  const bits = k.bitLength() + 1;
  const sign = k.sign() | 1;

  assert(bits <= max);

  for (let i = 0; i < max; i++)
    naf[i] = 0;

  let i = 0;
  let carry = 0;
  let word;

  while (i < bits) {
    if (k.bit(i) === carry) {
      i += 1;
      continue;
    }

    word = k.bits(i, width) + carry;
    carry = (word >> (width - 1)) & 1;
    word -= carry << width;

    naf[i] = sign * word;

    i += width;
  }

  assert(carry === 0);

  return naf;
}

function getFixedNAF(k, width, max, step) {
  assert((step >>> 0) === step);

  // Recode to NAF.
  const naf = getNAF(k, width, max);

  // Translate into more windowed form.
  const len = Math.ceil(naf.length / step);
  const repr = new Array(len);

  let i = 0;

  for (let j = 0; j < naf.length; j += step) {
    let nafW = 0;

    for (let k = j + step - 1; k >= j; k--)
      nafW = (nafW << 1) + naf[k];

    repr[i++] = nafW;
  }

  assert(i === len);

  return repr;
}

function getJSF(k1, k2, max) {
  // Joint sparse form.
  //
  // [GECC] Algorithm 3.50, Page 111, Section 3.3.
  assert(k1 instanceof BN);
  assert(k2 instanceof BN);
  assert(!k1.red);
  assert(!k2.red);
  assert((max >>> 0) === max);

  const jsf = [new Array(max), new Array(max)];
  const bits = Math.max(k1.bitLength(), k2.bitLength()) + 1;
  const s1 = k1.sign() | 1;
  const s2 = k2.sign() | 1;

  assert(bits <= max);

  let d1 = 0;
  let d2 = 0;

  for (let i = 0; i < bits; i++) {
    const b1 = k1.bits(i, 3);
    const b2 = k2.bits(i, 3);

    // First phase.
    let m14 = ((b1 & 3) + d1) & 3;
    let m24 = ((b2 & 3) + d2) & 3;
    let u1 = 0;
    let u2 = 0;

    if (m14 === 3)
      m14 = -1;

    if (m24 === 3)
      m24 = -1;

    if (m14 & 1) {
      const m8 = ((b1 & 7) + d1) & 7;

      if ((m8 === 3 || m8 === 5) && m24 === 2)
        u1 = -m14;
      else
        u1 = m14;
    }

    if (m24 & 1) {
      const m8 = ((b2 & 7) + d2) & 7;

      if ((m8 === 3 || m8 === 5) && m14 === 2)
        u2 = -m24;
      else
        u2 = m24;
    }

    jsf[0][i] = u1 * s1;
    jsf[1][i] = u2 * s2;

    // Second phase.
    if (2 * d1 === 1 + u1)
      d1 = 1 - d1;

    if (2 * d2 === 1 + u2)
      d2 = 1 - d2;
  }

  for (let i = bits; i < max; i++) {
    jsf[0][i] = 0;
    jsf[1][i] = 0;
  }

  return jsf;
}

function getJNAF(c1, c2, max) {
  const jsf = getJSF(c1, c2, max);
  const naf = new Array(max);

  // JSF -> NAF conversion.
  for (let i = 0; i < max; i++) {
    const ja = jsf[0][i];
    const jb = jsf[1][i];

    naf[i] = jsfIndex[(ja + 1) * 3 + (jb + 1)];
  }

  return naf;
}

/*
 * Helpers
 */

function assert(val, msg) {
  if (!val) {
    const err = new Error(msg || 'Assertion failed');

    if (Error.captureStackTrace)
      Error.captureStackTrace(err, assert);

    throw err;
  }
}

function wrapErrors(fn) {
  assert(typeof fn === 'function');

  try {
    return fn();
  } catch (e) {
    if (e.message === 'X is not a square mod P.'
        || e.message === 'Not invertible.') {
      throw new Error('Invalid point.');
    }
    throw e;
  }
}

function mod(x, y) {
  // Euclidean modulo.
  let r = x % y;

  if (r < 0) {
    if (y < 0)
      r -= y;
    else
      r += y;
  }

  return r;
}

function cubeRoot(x) {
  assert(x instanceof BN);
  assert(x.red);

  const p = x.red.m;

  if (p.cmpn(3) <= 0)
    return x.clone();

  // p = 2 mod 3
  if (p.modrn(3) === 2) {
    // e = (2 * p - 1) / 3
    const e = p.ushln(1).isubn(1).idivn(3);
    return x.redPow(e);
  }

  const mod9 = p.modrn(9);

  // p = 4 mod 9
  if (mod9 === 4) {
    // e = (2 * p + 1) / 9
    const e = p.ushln(1).iaddn(1).idivn(9);
    const r = x.redPow(e);
    const c = r.redSqr().redMul(r);

    if (!c.eq(x))
      throw new Error('X is not a cube mod P.');

    return r;
  }

  // p = 7 mod 9
  if (mod9 === 7) {
    // e = (p + 2) / 9
    const e = p.addn(2).idivn(9);
    const r = x.redPow(e);
    const c = r.redSqr().redMul(r);

    if (!c.eq(x))
      throw new Error('X is not a cube mod P.');

    return r;
  }

  throw new Error('Not implemented.');
}

function cubeRoots(x) {
  const r0 = cubeRoot(x);

  // p = 1 mod 3
  if (x.red.m.modrn(3) === 1) {
    // Multiply by roots of unity to find other roots.
    const two = new BN(2).toRed(x.red);
    const three = new BN(3).toRed(x.red);
    const i2 = two.redInvert();
    const s1 = three.redNeg().redSqrt().redMul(i2);
    const s2 = s1.redNeg();
    const u1 = s1.redSub(i2);
    const u2 = s2.redSub(i2);
    const r1 = r0.redMul(u1);
    const r2 = r0.redMul(u2);

    return [r0, r1, r2];
  }

  // p = 2 mod 3 guarantees 1 cube root per element.
  return [r0];
}

function uncube(x) {
  // Find a cube root which is also a quadratic residue.
  for (const root of cubeRoots(x)) {
    if (root.redJacobi() >= 0)
      return root;
  }

  throw new Error('X^(1/3) is not a square mod P.');
}

function randomInt(rng) {
  return BN.randomBits(rng, 32).toNumber();
}

function memoize(method, self) {
  const cache = new WeakMap();

  return function memoized(curve, invert) {
    const i = invert & 1;
    const item = cache.get(curve);

    if (item && item[i] !== null)
      return item[i];

    const result = method.call(self, curve, invert);

    if (!cache.has(curve))
      cache.set(curve, [null, null]);

    cache.get(curve)[i] = result;

    return result;
  };
}

function toPretty(x, size) {
  assert(x instanceof BN);
  assert((size >>> 0) === size);

  if (size & 7)
    size += 8 - (size & 7);

  const str = x.toString(16, size);
  const chunks = [];
  const out = [];

  assert((str.length & 7) === 0);

  for (let i = 0; i < str.length; i += 8)
    chunks.push(str.slice(i, i + 8));

  for (let i = 0; i < chunks.length; i += 4)
    out.push(chunks.slice(i, i + 4).join(' '));

  return out;
}

/*
 * Expose
 */

exports.Curve = Curve;
exports.Point = Point;
exports.ShortCurve = ShortCurve;
exports.ShortPoint = ShortPoint;
exports.JPoint = JPoint;
exports.MontCurve = MontCurve;
exports.MontPoint = MontPoint;
exports.XPoint = XPoint;
exports.EdwardsCurve = EdwardsCurve;
exports.EdwardsPoint = EdwardsPoint;
exports.curves = curves;
exports.curve = curve;
exports.register = register;
}],
[/* 43 */ 'bcrypto', '/lib/js/precomputed/secp256k1.json', function(exports, module, __filename, __dirname, __meta) {
module.exports = {
  "naf": {
    "width": 9,
    "points": [
      [
        "f9308a019258c31049344f85f89d5229b531c845836f99b08601f113bce036f9",
        "388f7b0f632de8140fe337e62a37f3566500a99934c2231b6cb9fd7584b8e672"
      ],
      [
        "2f8bde4d1a07209355b4a7250a5c5128e88b84bddc619ab7cba8d569b240efe4",
        "d8ac222636e5e3d6d4dba9dda6c9c426f788271bab0d6840dca87d3aa6ac62d6"
      ],
      [
        "5cbdf0646e5db4eaa398f365f2ea7a0e3d419b7e0330e39ce92bddedcac4f9bc",
        "6aebca40ba255960a3178d6d861a54dba813d0b813fde7b5a5082628087264da"
      ],
      [
        "acd484e2f0c7f65309ad178a9f559abde09796974c57e714c35f110dfc27ccbe",
        "cc338921b0a7d9fd64380971763b61e9add888a4375f8e0f05cc262ac64f9c37"
      ],
      [
        "774ae7f858a9411e5ef4246b70c65aac5649980be5c17891bbec17895da008cb",
        "d984a032eb6b5e190243dd56d7b7b365372db1e2dff9d6a8301d74c9c953c61b"
      ],
      [
        "f28773c2d975288bc7d1d205c3748651b075fbc6610e58cddeeddf8f19405aa8",
        "0ab0902e8d880a89758212eb65cdaf473a1a06da521fa91f29b5cb52db03ed81"
      ],
      [
        "d7924d4f7d43ea965a465ae3095ff41131e5946f3c85f79e44adbcf8e27e080e",
        "581e2872a86c72a683842ec228cc6defea40af2bd896d3a5c504dc9ff6a26b58"
      ],
      [
        "defdea4cdb677750a420fee807eacf21eb9898ae79b9768766e4faa04a2d4a34",
        "4211ab0694635168e997b0ead2a93daeced1f4a04a95c0f6cfb199f69e56eb77"
      ],
      [
        "2b4ea0a797a443d293ef5cff444f4979f06acfebd7e86d277475656138385b6c",
        "85e89bc037945d93b343083b5a1c86131a01f60c50269763b570c854e5c09b7a"
      ],
      [
        "352bbf4a4cdd12564f93fa332ce333301d9ad40271f8107181340aef25be59d5",
        "321eb4075348f534d59c18259dda3e1f4a1b3b2e71b1039c67bd3d8bcf81998c"
      ],
      [
        "2fa2104d6b38d11b0230010559879124e42ab8dfeff5ff29dc9cdadd4ecacc3f",
        "02de1068295dd865b64569335bd5dd80181d70ecfc882648423ba76b532b7d67"
      ],
      [
        "9248279b09b4d68dab21a9b066edda83263c3d84e09572e269ca0cd7f5453714",
        "73016f7bf234aade5d1aa71bdea2b1ff3fc0de2a887912ffe54a32ce97cb3402"
      ],
      [
        "daed4f2be3a8bf278e70132fb0beb7522f570e144bf615c07e996d443dee8729",
        "a69dce4a7d6c98e8d4a1aca87ef8d7003f83c230f3afa726ab40e52290be1c55"
      ],
      [
        "c44d12c7065d812e8acf28d7cbb19f9011ecd9e9fdf281b0e6a3b5e87d22e7db",
        "2119a460ce326cdc76c45926c982fdac0e106e861edf61c5a039063f0e0e6482"
      ],
      [
        "6a245bf6dc698504c89a20cfded60853152b695336c28063b61c65cbd269e6b4",
        "e022cf42c2bd4a708b3f5126f16a24ad8b33ba48d0423b6efd5e6348100d8a82"
      ],
      [
        "1697ffa6fd9de627c077e3d2fe541084ce13300b0bec1146f95ae57f0d0bd6a5",
        "b9c398f186806f5d27561506e4557433a2cf15009e498ae7adee9d63d01b2396"
      ],
      [
        "605bdb019981718b986d0f07e834cb0d9deb8360ffb7f61df982345ef27a7479",
        "02972d2de4f8d20681a78d93ec96fe23c26bfae84fb14db43b01e1e9056b8c49"
      ],
      [
        "62d14dab4150bf497402fdc45a215e10dcb01c354959b10cfe31c7e9d87ff33d",
        "80fc06bd8cc5b01098088a1950eed0db01aa132967ab472235f5642483b25eaf"
      ],
      [
        "80c60ad0040f27dade5b4b06c408e56b2c50e9f56b9b8b425e555c2f86308b6f",
        "1c38303f1cc5c30f26e66bad7fe72f70a65eed4cbe7024eb1aa01f56430bd57a"
      ],
      [
        "7a9375ad6167ad54aa74c6348cc54d344cc5dc9487d847049d5eabb0fa03c8fb",
        "0d0e3fa9eca8726909559e0d79269046bdc59ea10c70ce2b02d499ec224dc7f7"
      ],
      [
        "d528ecd9b696b54c907a9ed045447a79bb408ec39b68df504bb51f459bc3ffc9",
        "eecf41253136e5f99966f21881fd656ebc4345405c520dbc063465b521409933"
      ],
      [
        "049370a4b5f43412ea25f514e8ecdad05266115e4a7ecb1387231808f8b45963",
        "758f3f41afd6ed428b3081b0512fd62a54c3f3afbb5b6764b653052a12949c9a"
      ],
      [
        "77f230936ee88cbbd73df930d64702ef881d811e0e1498e2f1c13eb1fc345d74",
        "958ef42a7886b6400a08266e9ba1b37896c95330d97077cbbe8eb3c7671c60d6"
      ],
      [
        "f2dac991cc4ce4b9ea44887e5c7c0bce58c80074ab9d4dbaeb28531b7739f530",
        "e0dedc9b3b2f8dad4da1f32dec2531df9eb5fbeb0598e4fd1a117dba703a3c37"
      ],
      [
        "463b3d9f662621fb1b4be8fbbe2520125a216cdfc9dae3debcba4850c690d45b",
        "5ed430d78c296c3543114306dd8622d7c622e27c970a1de31cb377b01af7307e"
      ],
      [
        "f16f804244e46e2a09232d4aff3b59976b98fac14328a2d1a32496b49998f247",
        "cedabd9b82203f7e13d206fcdf4e33d92a6c53c26e5cce26d6579962c4e31df6"
      ],
      [
        "caf754272dc84563b0352b7a14311af55d245315ace27c65369e15f7151d41d1",
        "cb474660ef35f5f2a41b643fa5e460575f4fa9b7962232a5c32f908318a04476"
      ],
      [
        "2600ca4b282cb986f85d0f1709979d8b44a09c07cb86d7c124497bc86f082120",
        "4119b88753c15bd6a693b03fcddbb45d5ac6be74ab5f0ef44b0be9475a7e4b40"
      ],
      [
        "7635ca72d7e8432c338ec53cd12220bc01c48685e24f7dc8c602a7746998e435",
        "091b649609489d613d1d5e590f78e6d74ecfc061d57048bad9e76f302c5b9c61"
      ],
      [
        "754e3239f325570cdbbf4a87deee8a66b7f2b33479d468fbc1a50743bf56cc18",
        "0673fb86e5bda30fb3cd0ed304ea49a023ee33d0197a695d0c5d98093c536683"
      ],
      [
        "e3e6bd1071a1e96aff57859c82d570f0330800661d1c952f9fe2694691d9b9e8",
        "59c9e0bba394e76f40c0aa58379a3cb6a5a2283993e90c4167002af4920e37f5"
      ],
      [
        "186b483d056a033826ae73d88f732985c4ccb1f32ba35f4b4cc47fdcf04aa6eb",
        "3b952d32c67cf77e2e17446e204180ab21fb8090895138b4a4a797f86e80888b"
      ],
      [
        "df9d70a6b9876ce544c98561f4be4f725442e6d2b737d9c91a8321724ce0963f",
        "55eb2dafd84d6ccd5f862b785dc39d4ab157222720ef9da217b8c45cf2ba2417"
      ],
      [
        "5edd5cc23c51e87a497ca815d5dce0f8ab52554f849ed8995de64c5f34ce7143",
        "efae9c8dbc14130661e8cec030c89ad0c13c66c0d17a2905cdc706ab7399a868"
      ],
      [
        "290798c2b6476830da12fe02287e9e777aa3fba1c355b17a722d362f84614fba",
        "e38da76dcd440621988d00bcf79af25d5b29c094db2a23146d003afd41943e7a"
      ],
      [
        "af3c423a95d9f5b3054754efa150ac39cd29552fe360257362dfdecef4053b45",
        "f98a3fd831eb2b749a93b0e6f35cfb40c8cd5aa667a15581bc2feded498fd9c6"
      ],
      [
        "766dbb24d134e745cccaa28c99bf274906bb66b26dcf98df8d2fed50d884249a",
        "744b1152eacbe5e38dcc887980da38b897584a65fa06cedd2c924f97cbac5996"
      ],
      [
        "59dbf46f8c94759ba21277c33784f41645f7b44f6c596a58ce92e666191abe3e",
        "c534ad44175fbc300f4ea6ce648309a042ce739a7919798cd85e216c4a307f6e"
      ],
      [
        "f13ada95103c4537305e691e74e9a4a8dd647e711a95e73cb62dc6018cfd87b8",
        "e13817b44ee14de663bf4bc808341f326949e21a6a75c2570778419bdaf5733d"
      ],
      [
        "7754b4fa0e8aced06d4167a2c59cca4cda1869c06ebadfb6488550015a88522c",
        "30e93e864e669d82224b967c3020b8fa8d1e4e350b6cbcc537a48b57841163a2"
      ],
      [
        "948dcadf5990e048aa3874d46abef9d701858f95de8041d2a6828c99e2262519",
        "e491a42537f6e597d5d28a3224b1bc25df9154efbd2ef1d2cbba2cae5347d57e"
      ],
      [
        "7962414450c76c1689c7b48f8202ec37fb224cf5ac0bfa1570328a8a3d7c77ab",
        "100b610ec4ffb4760d5c1fc133ef6f6b12507a051f04ac5760afa5b29db83437"
      ],
      [
        "3514087834964b54b15b160644d915485a16977225b8847bb0dd085137ec47ca",
        "ef0afbb2056205448e1652c48e8127fc6039e77c15c2378b7e7d15a0de293311"
      ],
      [
        "d3cc30ad6b483e4bc79ce2c9dd8bc54993e947eb8df787b442943d3f7b527eaf",
        "8b378a22d827278d89c5e9be8f9508ae3c2ad46290358630afb34db04eede0a4"
      ],
      [
        "1624d84780732860ce1c78fcbfefe08b2b29823db913f6493975ba0ff4847610",
        "68651cf9b6da903e0914448c6cd9d4ca896878f5282be4c8cc06e2a404078575"
      ],
      [
        "733ce80da955a8a26902c95633e62a985192474b5af207da6df7b4fd5fc61cd4",
        "f5435a2bd2badf7d485a4d8b8db9fcce3e1ef8e0201e4578c54673bc1dc5ea1d"
      ],
      [
        "15d9441254945064cf1a1c33bbd3b49f8966c5092171e699ef258dfab81c045c",
        "d56eb30b69463e7234f5137b73b84177434800bacebfc685fc37bbe9efe4070d"
      ],
      [
        "a1d0fcf2ec9de675b612136e5ce70d271c21417c9d2b8aaaac138599d0717940",
        "edd77f50bcb5a3cab2e90737309667f2641462a54070f3d519212d39c197a629"
      ],
      [
        "e22fbe15c0af8ccc5780c0735f84dbe9a790badee8245c06c7ca37331cb36980",
        "0a855babad5cd60c88b430a69f53a1a7a38289154964799be43d06d77d31da06"
      ],
      [
        "311091dd9860e8e20ee13473c1155f5f69635e394704eaa74009452246cfa9b3",
        "66db656f87d1f04fffd1f04788c06830871ec5a64feee685bd80f0b1286d8374"
      ],
      [
        "34c1fd04d301be89b31c0442d3e6ac24883928b45a9340781867d4232ec2dbdf",
        "09414685e97b1b5954bd46f730174136d57f1ceeb487443dc5321857ba73abee"
      ],
      [
        "f219ea5d6b54701c1c14de5b557eb42a8d13f3abbcd08affcc2a5e6b049b8d63",
        "4cb95957e83d40b0f73af4544cccf6b1f4b08d3c07b27fb8d8c2962a400766d1"
      ],
      [
        "d7b8740f74a8fbaab1f683db8f45de26543a5490bca627087236912469a0b448",
        "fa77968128d9c92ee1010f337ad4717eff15db5ed3c049b3411e0315eaa4593b"
      ],
      [
        "32d31c222f8f6f0ef86f7c98d3a3335ead5bcd32abdd94289fe4d3091aa824bf",
        "5f3032f5892156e39ccd3d7915b9e1da2e6dac9e6f26e961118d14b8462e1661"
      ],
      [
        "7461f371914ab32671045a155d9831ea8793d77cd59592c4340f86cbc18347b5",
        "8ec0ba238b96bec0cbdddcae0aa442542eee1ff50c986ea6b39847b3cc092ff6"
      ],
      [
        "ee079adb1df1860074356a25aa38206a6d716b2c3e67453d287698bad7b2b2d6",
        "8dc2412aafe3be5c4c5f37e0ecc5f9f6a446989af04c4e25ebaac479ec1c8c1e"
      ],
      [
        "16ec93e447ec83f0467b18302ee620f7e65de331874c9dc72bfd8616ba9da6b5",
        "5e4631150e62fb40d0e8c2a7ca5804a39d58186a50e497139626778e25b0674d"
      ],
      [
        "eaa5f980c245f6f038978290afa70b6bd8855897f98b6aa485b96065d537bd99",
        "f65f5d3e292c2e0819a528391c994624d784869d7e6ea67fb18041024edc07dc"
      ],
      [
        "078c9407544ac132692ee1910a02439958ae04877151342ea96c4b6b35a49f51",
        "f3e0319169eb9b85d5404795539a5e68fa1fbd583c064d2462b675f194a3ddb4"
      ],
      [
        "494f4be219a1a77016dcd838431aea0001cdc8ae7a6fc688726578d9702857a5",
        "42242a969283a5f339ba7f075e36ba2af925ce30d767ed6e55f4b031880d562c"
      ],
      [
        "a598a8030da6d86c6bc7f2f5144ea549d28211ea58faa70ebf4c1e665c1fe9b5",
        "204b5d6f84822c307e4b4a7140737aec23fc63b65b35f86a10026dbd2d864e6b"
      ],
      [
        "c41916365abb2b5d09192f5f2dbeafec208f020f12570a184dbadc3e58595997",
        "04f14351d0087efa49d245b328984989d5caf9450f34bfc0ed16e96b58fa9913"
      ],
      [
        "841d6063a586fa475a724604da03bc5b92a2e0d2e0a36acfe4c73a5514742881",
        "073867f59c0659e81904f9a1c7543698e62562d6744c169ce7a36de01a8d6154"
      ],
      [
        "5e95bb399a6971d376026947f89bde2f282b33810928be4ded112ac4d70e20d5",
        "39f23f366809085beebfc71181313775a99c9aed7d8ba38b161384c746012865"
      ],
      [
        "36e4641a53948fd476c39f8a99fd974e5ec07564b5315d8bf99471bca0ef2f66",
        "d2424b1b1abe4eb8164227b085c9aa9456ea13493fd563e06fd51cf5694c78fc"
      ],
      [
        "0336581ea7bfbbb290c191a2f507a41cf5643842170e914faeab27c2c579f726",
        "ead12168595fe1be99252129b6e56b3391f7ab1410cd1e0ef3dcdcabd2fda224"
      ],
      [
        "8ab89816dadfd6b6a1f2634fcf00ec8403781025ed6890c4849742706bd43ede",
        "6fdcef09f2f6d0a044e654aef624136f503d459c3e89845858a47a9129cdd24e"
      ],
      [
        "1e33f1a746c9c5778133344d9299fcaa20b0938e8acff2544bb40284b8c5fb94",
        "060660257dd11b3aa9c8ed618d24edff2306d320f1d03010e33a7d2057f3b3b6"
      ],
      [
        "85b7c1dcb3cec1b7ee7f30ded79dd20a0ed1f4cc18cbcfcfa410361fd8f08f31",
        "3d98a9cdd026dd43f39048f25a8847f4fcafad1895d7a633c6fed3c35e999511"
      ],
      [
        "29df9fbd8d9e46509275f4b125d6d45d7fbe9a3b878a7af872a2800661ac5f51",
        "0b4c4fe99c775a606e2d8862179139ffda61dc861c019e55cd2876eb2a27d84b"
      ],
      [
        "a0b1cae06b0a847a3fea6e671aaf8adfdfe58ca2f768105c8082b2e449fce252",
        "ae434102edde0958ec4b19d917a6a28e6b72da1834aff0e650f049503a296cf2"
      ],
      [
        "04e8ceafb9b3e9a136dc7ff67e840295b499dfb3b2133e4ba113f2e4c0e121e5",
        "cf2174118c8b6d7a4b48f6d534ce5c79422c086a63460502b827ce62a326683c"
      ],
      [
        "d24a44e047e19b6f5afb81c7ca2f69080a5076689a010919f42725c2b789a33b",
        "6fb8d5591b466f8fc63db50f1c0f1c69013f996887b8244d2cdec417afea8fa3"
      ],
      [
        "ea01606a7a6c9cdd249fdfcfacb99584001edd28abbab77b5104e98e8e3b35d4",
        "322af4908c7312b0cfbfe369f7a7b3cdb7d4494bc2823700cfd652188a3ea98d"
      ],
      [
        "af8addbf2b661c8a6c6328655eb96651252007d8c5ea31be4ad196de8ce2131f",
        "6749e67c029b85f52a034eafd096836b2520818680e26ac8f3dfbcdb71749700"
      ],
      [
        "e3ae1974566ca06cc516d47e0fb165a674a3dabcfca15e722f0e3450f45889",
        "2aeabe7e4531510116217f07bf4d07300de97e4874f81f533420a72eeb0bd6a4"
      ],
      [
        "591ee355313d99721cf6993ffed1e3e301993ff3ed258802075ea8ced397e246",
        "b0ea558a113c30bea60fc4775460c7901ff0b053d25ca2bdeee98f1a4be5d196"
      ],
      [
        "11396d55fda54c49f19aa97318d8da61fa8584e47b084945077cf03255b52984",
        "998c74a8cd45ac01289d5833a7beb4744ff536b01b257be4c5767bea93ea57a4"
      ],
      [
        "3c5d2a1ba39c5a1790000738c9e0c40b8dcdfd5468754b6405540157e017aa7a",
        "b2284279995a34e2f9d4de7396fc18b80f9b8b9fdd270f6661f79ca4c81bd257"
      ],
      [
        "cc8704b8a60a0defa3a99a7299f2e9c3fbc395afb04ac078425ef8a1793cc030",
        "bdd46039feed17881d1e0862db347f8cf395b74fc4bcdc4e940b74e3ac1f1b13"
      ],
      [
        "c533e4f7ea8555aacd9777ac5cad29b97dd4defccc53ee7ea204119b2889b197",
        "6f0a256bc5efdf429a2fb6242f1a43a2d9b925bb4a4b3a26bb8e0f45eb596096"
      ],
      [
        "0c14f8f2ccb27d6f109f6d08d03cc96a69ba8c34eec07bbcf566d48e33da6593",
        "c359d6923bb398f7fd4473e16fe1c28475b740dd098075e6c0e8649113dc3a38"
      ],
      [
        "a6cbc3046bc6a450bac24789fa17115a4c9739ed75f8f21ce441f72e0b90e6ef",
        "021ae7f4680e889bb130619e2c0f95a360ceb573c70603139862afd617fa9b9f"
      ],
      [
        "347d6d9a02c48927ebfb86c1359b1caf130a3c0267d11ce6344b39f99d43cc38",
        "60ea7f61a353524d1c987f6ecec92f086d565ab687870cb12689ff1e31c74448"
      ],
      [
        "da6545d2181db8d983f7dcb375ef5866d47c67b1bf31c8cf855ef7437b72656a",
        "49b96715ab6878a79e78f07ce5680c5d6673051b4935bd897fea824b77dc208a"
      ],
      [
        "c40747cc9d012cb1a13b8148309c6de7ec25d6945d657146b9d5994b8feb1111",
        "5ca560753be2a12fc6de6caf2cb489565db936156b9514e1bb5e83037e0fa2d4"
      ],
      [
        "4e42c8ec82c99798ccf3a610be870e78338c7f713348bd34c8203ef4037f3502",
        "7571d74ee5e0fb92a7a8b33a07783341a5492144cc54bcc40a94473693606437"
      ],
      [
        "3775ab7089bc6af823aba2e1af70b236d251cadb0c86743287522a1b3b0dedea",
        "be52d107bcfa09d8bcb9736a828cfa7fac8db17bf7a76a2c42ad961409018cf7"
      ],
      [
        "cee31cbf7e34ec379d94fb814d3d775ad954595d1314ba8846959e3e82f74e26",
        "8fd64a14c06b589c26b947ae2bcf6bfa0149ef0be14ed4d80f448a01c43b1c6d"
      ],
      [
        "b4f9eaea09b6917619f6ea6a4eb5464efddb58fd45b1ebefcdc1a01d08b47986",
        "39e5c9925b5a54b07433a4f18c61726f8bb131c012ca542eb24a8ac07200682a"
      ],
      [
        "d4263dfc3d2df923a0179a48966d30ce84e2515afc3dccc1b77907792ebcc60e",
        "62dfaf07a0f78feb30e30d6295853ce189e127760ad6cf7fae164e122a208d54"
      ],
      [
        "48457524820fa65a4f8d35eb6930857c0032acc0a4a2de422233eeda897612c4",
        "25a748ab367979d98733c38a1fa1c2e7dc6cc07db2d60a9ae7a76aaa49bd0f77"
      ],
      [
        "dfeeef1881101f2cb11644f3a2afdfc2045e19919152923f367a1767c11cceda",
        "ecfb7056cf1de042f9420bab396793c0c390bde74b4bbdff16a83ae09a9a7517"
      ],
      [
        "6d7ef6b17543f8373c573f44e1f389835d89bcbc6062ced36c82df83b8fae859",
        "cd450ec335438986dfefa10c57fea9bcc521a0959b2d80bbf74b190dca712d10"
      ],
      [
        "e75605d59102a5a2684500d3b991f2e3f3c88b93225547035af25af66e04541f",
        "f5c54754a8f71ee540b9b48728473e314f729ac5308b06938360990e2bfad125"
      ],
      [
        "eb98660f4c4dfaa06a2be453d5020bc99a0c2e60abe388457dd43fefb1ed620c",
        "6cb9a8876d9cb8520609af3add26cd20a0a7cd8a9411131ce85f44100099223e"
      ],
      [
        "13e87b027d8514d35939f2e6892b19922154596941888336dc3563e3b8dba942",
        "fef5a3c68059a6dec5d624114bf1e91aac2b9da568d6abeb2570d55646b8adf1"
      ],
      [
        "ee163026e9fd6fe017c38f06a5be6fc125424b371ce2708e7bf4491691e5764a",
        "1acb250f255dd61c43d94ccc670d0f58f49ae3fa15b96623e5430da0ad6c62b2"
      ],
      [
        "b268f5ef9ad51e4d78de3a750c2dc89b1e626d43505867999932e5db33af3d80",
        "5f310d4b3c99b9ebb19f77d41c1dee018cf0d34fd4191614003e945a1216e423"
      ],
      [
        "ff07f3118a9df035e9fad85eb6c7bfe42b02f01ca99ceea3bf7ffdba93c4750d",
        "438136d603e858a3a5c440c38eccbaddc1d2942114e2eddd4740d098ced1f0d8"
      ],
      [
        "8d8b9855c7c052a34146fd20ffb658bea4b9f69e0d825ebec16e8c3ce2b526a1",
        "cdb559eedc2d79f926baf44fb84ea4d44bcf50fee51d7ceb30e2e7f463036758"
      ],
      [
        "52db0b5384dfbf05bfa9d472d7ae26dfe4b851ceca91b1eba54263180da32b63",
        "0c3b997d050ee5d423ebaf66a6db9f57b3180c902875679de924b69d84a7b375"
      ],
      [
        "e62f9490d3d51da6395efd24e80919cc7d0f29c3f3fa48c6fff543becbd43352",
        "6d89ad7ba4876b0b22c2ca280c682862f342c8591f1daf5170e07bfd9ccafa7d"
      ],
      [
        "7f30ea2476b399b4957509c88f77d0191afa2ff5cb7b14fd6d8e7d65aaab1193",
        "ca5ef7d4b231c94c3b15389a5f6311e9daff7bb67b103e9880ef4bff637acaec"
      ],
      [
        "5098ff1e1d9f14fb46a210fada6c903fef0fb7b4a1dd1d9ac60a0361800b7a00",
        "09731141d81fc8f8084d37c6e7542006b3ee1b40d60dfe5362a5b132fd17ddc0"
      ],
      [
        "32b78c7de9ee512a72895be6b9cbefa6e2f3c4ccce445c96b9f2c81e2778ad58",
        "ee1849f513df71e32efc3896ee28260c73bb80547ae2275ba497237794c8753c"
      ],
      [
        "e2cb74fddc8e9fbcd076eef2a7c72b0ce37d50f08269dfc074b581550547a4f7",
        "d3aa2ed71c9dd2247a62df062736eb0baddea9e36122d2be8641abcb005cc4a4"
      ],
      [
        "8438447566d4d7bedadc299496ab357426009a35f235cb141be0d99cd10ae3a8",
        "c4e1020916980a4da5d01ac5e6ad330734ef0d7906631c4f2390426b2edd791f"
      ],
      [
        "4162d488b89402039b584c6fc6c308870587d9c46f660b878ab65c82c711d67e",
        "67163e903236289f776f22c25fb8a3afc1732f2b84b4e95dbda47ae5a0852649"
      ],
      [
        "3fad3fa84caf0f34f0f89bfd2dcf54fc175d767aec3e50684f3ba4a4bf5f683d",
        "0cd1bc7cb6cc407bb2f0ca647c718a730cf71872e7d0d2a53fa20efcdfe61826"
      ],
      [
        "674f2600a3007a00568c1a7ce05d0816c1fb84bf1370798f1c69532faeb1a86b",
        "299d21f9413f33b3edf43b257004580b70db57da0b182259e09eecc69e0d38a5"
      ],
      [
        "d32f4da54ade74abb81b815ad1fb3b263d82d6c692714bcff87d29bd5ee9f08f",
        "f9429e738b8e53b968e99016c059707782e14f4535359d582fc416910b3eea87"
      ],
      [
        "30e4e670435385556e593657135845d36fbb6931f72b08cb1ed954f1e3ce3ff6",
        "462f9bce619898638499350113bbc9b10a878d35da70740dc695a559eb88db7b"
      ],
      [
        "be2062003c51cc3004682904330e4dee7f3dcd10b01e580bf1971b04d4cad297",
        "62188bc49d61e5428573d48a74e1c655b1c61090905682a0d5558ed72dccb9bc"
      ],
      [
        "93144423ace3451ed29e0fb9ac2af211cb6e84a601df5993c419859fff5df04a",
        "7c10dfb164c3425f5c71a3f9d7992038f1065224f72bb9d1d902a6d13037b47c"
      ],
      [
        "b015f8044f5fcbdcf21ca26d6c34fb8197829205c7b7d2a7cb66418c157b112c",
        "ab8c1e086d04e813744a655b2df8d5f83b3cdc6faa3088c1d3aea1454e3a1d5f"
      ],
      [
        "d5e9e1da649d97d89e4868117a465a3a4f8a18de57a140d36b3f2af341a21b52",
        "4cb04437f391ed73111a13cc1d4dd0db1693465c2240480d8955e8592f27447a"
      ],
      [
        "d3ae41047dd7ca065dbf8ed77b992439983005cd72e16d6f996a5316d36966bb",
        "bd1aeb21ad22ebb22a10f0303417c6d964f8cdd7df0aca614b10dc14d125ac46"
      ],
      [
        "463e2763d885f958fc66cdd22800f0a487197d0a82e377b49f80af87c897b065",
        "bfefacdb0e5d0fd7df3a311a94de062b26b80c61fbc97508b79992671ef7ca7f"
      ],
      [
        "7985fdfd127c0567c6f53ec1bb63ec3158e597c40bfe747c83cddfc910641917",
        "603c12daf3d9862ef2b25fe1de289aed24ed291e0ec6708703a5bd567f32ed03"
      ],
      [
        "74a1ad6b5f76e39db2dd249410eac7f99e74c59cb83d2d0ed5ff1543da7703e9",
        "cc6157ef18c9c63cd6193d83631bbea0093e0968942e8c33d5737fd790e0db08"
      ],
      [
        "30682a50703375f602d416664ba19b7fc9bab42c72747463a71d0896b22f6da3",
        "553e04f6b018b4fa6c8f39e7f311d3176290d0e0f19ca73f17714d9977a22ff8"
      ],
      [
        "9e2158f0d7c0d5f26c3791efefa79597654e7a2b2464f52b1ee6c1347769ef57",
        "0712fcdd1b9053f09003a3481fa7762e9ffd7c8ef35a38509e2fbf2629008373"
      ],
      [
        "176e26989a43c9cfeba4029c202538c28172e566e3c4fce7322857f3be327d66",
        "ed8cc9d04b29eb877d270b4878dc43c19aefd31f4eee09ee7b47834c1fa4b1c3"
      ],
      [
        "75d46efea3771e6e68abb89a13ad747ecf1892393dfc4f1b7004788c50374da8",
        "9852390a99507679fd0b86fd2b39a868d7efc22151346e1a3ca4726586a6bed8"
      ],
      [
        "809a20c67d64900ffb698c4c825f6d5f2310fb0451c869345b7319f645605721",
        "9e994980d9917e22b76b061927fa04143d096ccc54963e6a5ebfa5f3f8e286c1"
      ],
      [
        "1b38903a43f7f114ed4500b4eac7083fdefece1cf29c63528d563446f972c180",
        "4036edc931a60ae889353f77fd53de4a2708b26b6f5da72ad3394119daf408f9"
      ]
    ]
  },
  "doubles": {
    "step": 4,
    "points": [
      [
        "e60fce93b59e9ec53011aabc21c23e97b2a31369b87a5ae9c44ee89e2a6dec0a",
        "f7e3507399e595929db99f34f57937101296891e44d23f0be1f32cce69616821"
      ],
      [
        "8282263212c609d9ea2a6e3e172de238d8c39cabd5ac1ca10646e23fd5f51508",
        "11f8a8098557dfe45e8256e830b60ace62d613ac2f7b17bed31b6eaff6e26caf"
      ],
      [
        "175e159f728b865a72f99cc6c6fc846de0b93833fd2222ed73fce5b551e5b739",
        "d3506e0d9e3c79eba4ef97a51ff71f5eacb5955add24345c6efa6ffee9fed695"
      ],
      [
        "363d90d447b00c9c99ceac05b6262ee053441c7e55552ffe526bad8f83ff4640",
        "04e273adfc732221953b445397f3363145b9a89008199ecb62003c7f3bee9de9"
      ],
      [
        "8b4b5f165df3c2be8c6244b5b745638843e4a781a15bcd1b69f79a55dffdf80c",
        "4aad0a6f68d308b4b3fbd7813ab0da04f9e336546162ee56b3eff0c65fd4fd36"
      ],
      [
        "723cbaa6e5db996d6bf771c00bd548c7b700dbffa6c0e77bcb6115925232fcda",
        "96e867b5595cc498a921137488824d6e2660a0653779494801dc069d9eb39f5f"
      ],
      [
        "eebfa4d493bebf98ba5feec812c2d3b50947961237a919839a533eca0e7dd7fa",
        "5d9a8ca3970ef0f269ee7edaf178089d9ae4cdc3a711f712ddfd4fdae1de8999"
      ],
      [
        "100f44da696e71672791d0a09b7bde459f1215a29b3c03bfefd7835b39a48db0",
        "cdd9e13192a00b772ec8f3300c090666b7ff4a18ff5195ac0fbd5cd62bc65a09"
      ],
      [
        "e1031be262c7ed1b1dc9227a4a04c017a77f8d4464f3b3852c8acde6e534fd2d",
        "9d7061928940405e6bb6a4176597535af292dd419e1ced79a44f18f29456a00d"
      ],
      [
        "feea6cae46d55b530ac2839f143bd7ec5cf8b266a41d6af52d5e688d9094696d",
        "e57c6b6c97dce1bab06e4e12bf3ecd5c981c8957cc41442d3155debf18090088"
      ],
      [
        "da67a91d91049cdcb367be4be6ffca3cfeed657d808583de33fa978bc1ec6cb1",
        "9bacaa35481642bc41f463f7ec9780e5dec7adc508f740a17e9ea8e27a68be1d"
      ],
      [
        "53904faa0b334cdda6e000935ef22151ec08d0f7bb11069f57545ccc1a37b7c0",
        "5bc087d0bc80106d88c9eccac20d3c1c13999981e14434699dcb096b022771c8"
      ],
      [
        "8e7bcd0bd35983a7719cca7764ca906779b53a043a9b8bcaeff959f43ad86047",
        "10b7770b2a3da4b3940310420ca9514579e88e2e47fd68b3ea10047e8460372a"
      ],
      [
        "385eed34c1cdff21e6d0818689b81bde71a7f4f18397e6690a841e1599c43862",
        "283bebc3e8ea23f56701de19e9ebf4576b304eec2086dc8cc0458fe5542e5453"
      ],
      [
        "06f9d9b803ecf191637c73a4413dfa180fddf84a5947fbc9c606ed86c3fac3a7",
        "7c80c68e603059ba69b8e2a30e45c4d47ea4dd2f5c281002d86890603a842160"
      ],
      [
        "3322d401243c4e2582a2147c104d6ecbf774d163db0f5e5313b7e0e742d0e6bd",
        "56e70797e9664ef5bfb019bc4ddaf9b72805f63ea2873af624f3a2e96c28b2a0"
      ],
      [
        "85672c7d2de0b7da2bd1770d89665868741b3f9af7643397721d74d28134ab83",
        "7c481b9b5b43b2eb6374049bfa62c2e5e77f17fcc5298f44c8e3094f790313a6"
      ],
      [
        "0948bf809b1988a46b06c9f1919413b10f9226c60f668832ffd959af60c82a0a",
        "53a562856dcb6646dc6b74c5d1c3418c6d4dff08c97cd2bed4cb7f88d8c8e589"
      ],
      [
        "6260ce7f461801c34f067ce0f02873a8f1b0e44dfc69752accecd819f38fd8e8",
        "bc2da82b6fa5b571a7f09049776a1ef7ecd292238051c198c1a84e95b2b4ae17"
      ],
      [
        "e5037de0afc1d8d43d8348414bbf4103043ec8f575bfdc432953cc8d2037fa2d",
        "4571534baa94d3b5f9f98d09fb990bddbd5f5b03ec481f10e0e5dc841d755bda"
      ],
      [
        "e06372b0f4a207adf5ea905e8f1771b4e7e8dbd1c6a6c5b725866a0ae4fce725",
        "7a908974bce18cfe12a27bb2ad5a488cd7484a7787104870b27034f94eee31dd"
      ],
      [
        "213c7a715cd5d45358d0bbf9dc0ce02204b10bdde2a3f58540ad6908d0559754",
        "4b6dad0b5ae462507013ad06245ba190bb4850f5f36a7eeddff2c27534b458f2"
      ],
      [
        "4e7c272a7af4b34e8dbb9352a5419a87e2838c70adc62cddf0cc3a3b08fbd53c",
        "17749c766c9d0b18e16fd09f6def681b530b9614bff7dd33e0b3941817dcaae6"
      ],
      [
        "fea74e3dbe778b1b10f238ad61686aa5c76e3db2be43057632427e2840fb27b6",
        "6e0568db9b0b13297cf674deccb6af93126b596b973f7b77701d3db7f23cb96f"
      ],
      [
        "76e64113f677cf0e10a2570d599968d31544e179b760432952c02a4417bdde39",
        "c90ddf8dee4e95cf577066d70681f0d35e2a33d2b56d2032b4b1752d1901ac01"
      ],
      [
        "c738c56b03b2abe1e8281baa743f8f9a8f7cc643df26cbee3ab150242bcbb891",
        "893fb578951ad2537f718f2eacbfbbbb82314eef7880cfe917e735d9699a84c3"
      ],
      [
        "d895626548b65b81e264c7637c972877d1d72e5f3a925014372e9f6588f6c14b",
        "febfaa38f2bc7eae728ec60818c340eb03428d632bb067e179363ed75d7d991f"
      ],
      [
        "b8da94032a957518eb0f6433571e8761ceffc73693e84edd49150a564f676e03",
        "2804dfa44805a1e4d7c99cc9762808b092cc584d95ff3b511488e4e74efdf6e7"
      ],
      [
        "e80fea14441fb33a7d8adab9475d7fab2019effb5156a792f1a11778e3c0df5d",
        "eed1de7f638e00771e89768ca3ca94472d155e80af322ea9fcb4291b6ac9ec78"
      ],
      [
        "a301697bdfcd704313ba48e51d567543f2a182031efd6915ddc07bbcc4e16070",
        "7370f91cfb67e4f5081809fa25d40f9b1735dbf7c0a11a130c0d1a041e177ea1"
      ],
      [
        "90ad85b389d6b936463f9d0512678de208cc330b11307fffab7ac63e3fb04ed4",
        "0e507a3620a38261affdcbd9427222b839aefabe1582894d991d4d48cb6ef150"
      ],
      [
        "8f68b9d2f63b5f339239c1ad981f162ee88c5678723ea3351b7b444c9ec4c0da",
        "662a9f2dba063986de1d90c2b6be215dbbea2cfe95510bfdf23cbf79501fff82"
      ],
      [
        "e4f3fb0176af85d65ff99ff9198c36091f48e86503681e3e6686fd5053231e11",
        "1e63633ad0ef4f1c1661a6d0ea02b7286cc7e74ec951d1c9822c38576feb73bc"
      ],
      [
        "8c00fa9b18ebf331eb961537a45a4266c7034f2f0d4e1d0716fb6eae20eae29e",
        "efa47267fea521a1a9dc343a3736c974c2fadafa81e36c54e7d2a4c66702414b"
      ],
      [
        "e7a26ce69dd4829f3e10cec0a9e98ed3143d084f308b92c0997fddfc60cb3e41",
        "2a758e300fa7984b471b006a1aafbb18d0a6b2c0420e83e20e8a9421cf2cfd51"
      ],
      [
        "b6459e0ee3662ec8d23540c223bcbdc571cbcb967d79424f3cf29eb3de6b80ef",
        "067c876d06f3e06de1dadf16e5661db3c4b3ae6d48e35b2ff30bf0b61a71ba45"
      ],
      [
        "d68a80c8280bb840793234aa118f06231d6f1fc67e73c5a5deda0f5b496943e8",
        "db8ba9fff4b586d00c4b1f9177b0e28b5b0e7b8f7845295a294c84266b133120"
      ],
      [
        "324aed7df65c804252dc0270907a30b09612aeb973449cea4095980fc28d3d5d",
        "648a365774b61f2ff130c0c35aec1f4f19213b0c7e332843967224af96ab7c84"
      ],
      [
        "4df9c14919cde61f6d51dfdbe5fee5dceec4143ba8d1ca888e8bd373fd054c96",
        "35ec51092d8728050974c23a1d85d4b5d506cdc288490192ebac06cad10d5d"
      ],
      [
        "9c3919a84a474870faed8a9c1cc66021523489054d7f0308cbfc99c8ac1f98cd",
        "ddb84f0f4a4ddd57584f044bf260e641905326f76c64c8e6be7e5e03d4fc599d"
      ],
      [
        "6057170b1dd12fdf8de05f281d8e06bb91e1493a8b91d4cc5a21382120a959e5",
        "9a1af0b26a6a4807add9a2daf71df262465152bc3ee24c65e899be932385a2a8"
      ],
      [
        "a576df8e23a08411421439a4518da31880cef0fba7d4df12b1a6973eecb94266",
        "40a6bf20e76640b2c92b97afe58cd82c432e10a7f514d9f3ee8be11ae1b28ec8"
      ],
      [
        "7778a78c28dec3e30a05fe9629de8c38bb30d1f5cf9a3a208f763889be58ad71",
        "34626d9ab5a5b22ff7098e12f2ff580087b38411ff24ac563b513fc1fd9f43ac"
      ],
      [
        "0928955ee637a84463729fd30e7afd2ed5f96274e5ad7e5cb09eda9c06d903ac",
        "c25621003d3f42a827b78a13093a95eeac3d26efa8a8d83fc5180e935bcd091f"
      ],
      [
        "85d0fef3ec6db109399064f3a0e3b2855645b4a907ad354527aae75163d82751",
        "1f03648413a38c0be29d496e582cf5663e8751e96877331582c237a24eb1f962"
      ],
      [
        "ff2b0dce97eece97c1c9b6041798b85dfdfb6d8882da20308f5404824526087e",
        "493d13fef524ba188af4c4dc54d07936c7b7ed6fb90e2ceb2c951e01f0c29907"
      ],
      [
        "827fbbe4b1e880ea9ed2b2e6301b212b57f1ee148cd6dd28780e5e2cf856e241",
        "c60f9c923c727b0b71bef2c67d1d12687ff7a63186903166d605b68baec293ec"
      ],
      [
        "eaa649f21f51bdbae7be4ae34ce6e5217a58fdce7f47f9aa7f3b58fa2120e2b3",
        "be3279ed5bbbb03ac69a80f89879aa5a01a6b965f13f7e59d47a5305ba5ad93d"
      ],
      [
        "e4a42d43c5cf169d9391df6decf42ee541b6d8f0c9a137401e23632dda34d24f",
        "4d9f92e716d1c73526fc99ccfb8ad34ce886eedfa8d8e4f13a7f7131deba9414"
      ],
      [
        "1ec80fef360cbdd954160fadab352b6b92b53576a88fea4947173b9d4300bf19",
        "aeefe93756b5340d2f3a4958a7abbf5e0146e77f6295a07b671cdc1cc107cefd"
      ],
      [
        "146a778c04670c2f91b00af4680dfa8bce3490717d58ba889ddb5928366642be",
        "b318e0ec3354028add669827f9d4b2870aaa971d2f7e5ed1d0b297483d83efd0"
      ],
      [
        "fa50c0f61d22e5f07e3acebb1aa07b128d0012209a28b9776d76a8793180eef9",
        "6b84c6922397eba9b72cd2872281a68a5e683293a57a213b38cd8d7d3f4f2811"
      ],
      [
        "da1d61d0ca721a11b1a5bf6b7d88e8421a288ab5d5bba5220e53d32b5f067ec2",
        "8157f55a7c99306c79c0766161c91e2966a73899d279b48a655fba0f1ad836f1"
      ],
      [
        "a8e282ff0c9706907215ff98e8fd416615311de0446f1e062a73b0610d064e13",
        "7f97355b8db81c09abfb7f3c5b2515888b679a3e50dd6bd6cef7c73111f4cc0c"
      ],
      [
        "174a53b9c9a285872d39e56e6913cab15d59b1fa512508c022f382de8319497c",
        "ccc9dc37abfc9c1657b4155f2c47f9e6646b3a1d8cb9854383da13ac079afa73"
      ],
      [
        "959396981943785c3d3e57edf5018cdbe039e730e4918b3d884fdff09475b7ba",
        "2e7e552888c331dd8ba0386a4b9cd6849c653f64c8709385e9b8abf87524f2fd"
      ],
      [
        "d2a63a50ae401e56d645a1153b109a8fcca0a43d561fba2dbb51340c9d82b151",
        "e82d86fb6443fcb7565aee58b2948220a70f750af484ca52d4142174dcf89405"
      ],
      [
        "64587e2335471eb890ee7896d7cfdc866bacbdbd3839317b3436f9b45617e073",
        "d99fcdd5bf6902e2ae96dd6447c299a185b90a39133aeab358299e5e9faf6589"
      ],
      [
        "8481bde0e4e4d885b3a546d3e549de042f0aa6cea250e7fd358d6c86dd45e458",
        "38ee7b8cba5404dd84a25bf39cecb2ca900a79c42b262e556d64b1b59779057e"
      ],
      [
        "13464a57a78102aa62b6979ae817f4637ffcfed3c4b1ce30bcd6303f6caf666b",
        "69be159004614580ef7e433453ccb0ca48f300a81d0942e13f495a907f6ecc27"
      ],
      [
        "bc4a9df5b713fe2e9aef430bcc1dc97a0cd9ccede2f28588cada3a0d2d83f366",
        "0d3a81ca6e785c06383937adf4b798caa6e8a9fbfa547b16d758d666581f33c1"
      ],
      [
        "8c28a97bf8298bc0d23d8c749452a32e694b65e30a9472a3954ab30fe5324caa",
        "40a30463a3305193378fedf31f7cc0eb7ae784f0451cb9459e71dc73cbef9482"
      ],
      [
        "08ea9666139527a8c1dd94ce4f071fd23c8b350c5a4bb33748c4ba111faccae0",
        "620efabbc8ee2782e24e7c0cfb95c5d735b783be9cf0f8e955af34a30e62b945"
      ],
      [
        "dd3625faef5ba06074669716bbd3788d89bdde815959968092f76cc4eb9a9787",
        "7a188fa3520e30d461da2501045731ca941461982883395937f68d00c644a573"
      ],
      [
        "f710d79d9eb962297e4f6232b40e8f7feb2bc63814614d692c12de752408221e",
        "ea98e67232d3b3295d3b535532115ccac8612c721851617526ae47a9c77bfc82"
      ]
    ]
  }
};
}],
[/* 44 */ 'hsd', '/lib/protocol/network.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * network.js - network object for hsd
 * Copyright (c) 2017-2018, Christopher Jeffrey (MIT License).
 * https://github.com/handshake-org/hsd
 */

'use strict';

const assert = __node_require__(2 /* 'bsert' */);
const binary = __node_require__(45 /* '../utils/binary' */);
const networks = __node_require__(46 /* './networks' */);
const TimeData = __node_require__(49 /* './timedata' */);

/**
 * Network
 * Represents a network.
 * @alias module:protocol.Network
 */

class Network {
  /**
   * Create a network.
   * @constructor
   * @param {Object} options
   */

  constructor(options) {
    assert(!Network[options.type], 'Cannot create two networks.');

    this.type = options.type;
    this.seeds = options.seeds;
    this.magic = options.magic;
    this.port = options.port;
    this.brontidePort = options.brontidePort;
    this.checkpointMap = options.checkpointMap;
    this.lastCheckpoint = options.lastCheckpoint;
    this.checkpoints = [];
    this.halvingInterval = options.halvingInterval;
    this.coinbaseMaturity = options.coinbaseMaturity;
    this.genesis = options.genesis;
    this.genesisBlock = options.genesisBlock;
    this.pow = options.pow;
    this.names = options.names;
    this.goosigStop = options.goosigStop;
    this.block = options.block;
    this.activationThreshold = options.activationThreshold;
    this.minerWindow = options.minerWindow;
    this.deployments = options.deployments;
    this.deploys = options.deploys;
    this.unknownBits = 0;
    this.keyPrefix = options.keyPrefix;
    this.addressPrefix = options.addressPrefix;
    this.requireStandard = options.requireStandard;
    this.rpcPort = options.rpcPort;
    this.walletPort = options.walletPort;
    this.nsPort = options.nsPort;
    this.rsPort = options.rsPort;
    this.minRelay = options.minRelay;
    this.feeRate = options.feeRate;
    this.maxFeeRate = options.maxFeeRate;
    this.identityKey = options.identityKey;
    this.selfConnect = options.selfConnect;
    this.requestMempool = options.requestMempool;
    this.claimPrefix = options.claimPrefix;
    this.deflationHeight = options.deflationHeight;
    this.time = new TimeData();
    this.txStart = options.txStart;

    this.init();
  }

  /**
   * Get a deployment by bit index.
   * @param {Number} bit
   * @returns {Object}
   */

  init() {
    let bits = 0;

    for (const deployment of this.deploys)
      bits |= 1 << deployment.bit;

    this.unknownBits = ~bits >>> 0;

    for (const key of Object.keys(this.checkpointMap)) {
      const hash = this.checkpointMap[key];
      const height = Number(key);

      this.checkpoints.push({ hash, height });
    }

    this.checkpoints.sort(cmpNode);
  }

  /**
   * Get a deployment by bit index.
   * @param {Number} bit
   * @returns {Object}
   */

  byBit(bit) {
    const index = binary.search(this.deploys, bit, cmpBit);

    if (index === -1)
      return null;

    return this.deploys[index];
  }

  /**
   * Get network adjusted time.
   * @returns {Number}
   */

  now() {
    return this.time.now();
  }

  /**
   * Get network adjusted time in milliseconds.
   * @returns {Number}
   */

  ms() {
    return this.time.ms();
  }

  /**
   * Create a network. Get existing network if possible.
   * @param {NetworkType|Object} options
   * @returns {Network}
   */

  static create(options) {
    if (typeof options === 'string')
      options = networks[options];

    assert(options, 'Unknown network.');

    if (Network[options.type])
      return Network[options.type];

    const network = new Network(options);

    Network[network.type] = network;

    if (!Network.primary)
      Network.primary = network;

    return network;
  }

  /**
   * Set the default network. This network will be used
   * if nothing is passed as the `network` option for
   * certain objects.
   * @param {NetworkType} type - Network type.
   * @returns {Network}
   */

  static set(type) {
    assert(typeof type === 'string', 'Bad network.');
    Network.primary = Network.get(type);
    Network.type = type;
    return Network.primary;
  }

  /**
   * Get a network with a string or a Network object.
   * @param {NetworkType|Network} type - Network type.
   * @returns {Network}
   */

  static get(type) {
    if (!type) {
      assert(Network.primary, 'No default network.');
      return Network.primary;
    }

    if (type instanceof Network)
      return type;

    if (typeof type === 'string')
      return Network.create(type);

    throw new Error('Unknown network.');
  }

  /**
   * Get a network with a string or a Network object.
   * @param {NetworkType|Network} type - Network type.
   * @returns {Network}
   */

  static ensure(type) {
    if (!type) {
      assert(Network.primary, 'No default network.');
      return Network.primary;
    }

    if (type instanceof Network)
      return type;

    if (typeof type === 'string') {
      if (networks[type])
        return Network.create(type);
    }

    assert(Network.primary, 'No default network.');

    return Network.primary;
  }

  /**
   * Get a network by an associated comparator.
   * @private
   * @param {Object} value
   * @param {Function} compare
   * @param {Network|null} network
   * @param {String} name
   * @returns {Network}
   */

  static by(value, compare, network, name) {
    if (network) {
      network = Network.get(network);
      if (compare(network, value))
        return network;
      throw new Error(`Network mismatch for ${name}.`);
    }

    for (const type of networks.types) {
      network = networks[type];
      if (compare(network, value))
        return Network.get(type);
    }

    throw new Error(`Network not found for ${name}.`);
  }

  /**
   * Get a network by its magic number.
   * @param {Number} value
   * @param {Network?} network
   * @returns {Network}
   */

  static fromMagic(value, network) {
    return Network.by(value, cmpMagic, network, 'magic number');
  }

  /**
   * Get a network by its WIF prefix.
   * @param {Number} value
   * @param {Network?} network
   * @returns {Network}
   */

  static fromWIF(prefix, network) {
    return Network.by(prefix, cmpWIF, network, 'WIF');
  }

  /**
   * Get a network by its xpubkey prefix.
   * @param {Number} value
   * @param {Network?} network
   * @returns {Network}
   */

  static fromPublic(prefix, network) {
    return Network.by(prefix, cmpPub, network, 'xpubkey');
  }

  /**
   * Get a network by its xprivkey prefix.
   * @param {Number} value
   * @param {Network?} network
   * @returns {Network}
   */

  static fromPrivate(prefix, network) {
    return Network.by(prefix, cmpPriv, network, 'xprivkey');
  }

  /**
   * Get a network by its xpubkey base58 prefix.
   * @param {String} prefix
   * @param {Network?} network
   * @returns {Network}
   */

  static fromPublic58(prefix, network) {
    return Network.by(prefix, cmpPub58, network, 'xpubkey');
  }

  /**
   * Get a network by its xprivkey base58 prefix.
   * @param {String} prefix
   * @param {Network?} network
   * @returns {Network}
   */

  static fromPrivate58(prefix, network) {
    return Network.by(prefix, cmpPriv58, network, 'xprivkey');
  }

  /**
   * Get a network by its bech32 address prefix.
   * @param {String} hrp
   * @param {Network?} network
   * @returns {Network}
   */

  static fromAddress(hrp, network) {
    return Network.by(hrp, cmpAddress, network, 'address');
  }

  /**
   * Convert the network to a string.
   * @returns {String}
   */

  toString() {
    return this.type;
  }

  /**
   * Inspect the network.
   * @returns {String}
   */

  inspect() {
    return `<Network: ${this.type}>`;
  }

  /**
   * Test an object to see if it is a Network.
   * @param {Object} obj
   * @returns {Boolean}
   */

  static isNetwork(obj) {
    return obj instanceof Network;
  }
}

/**
 * Default network.
 * @type {Network}
 */

Network.primary = null;

/**
 * Default network type.
 * @type {String}
 */

Network.type = null;

/*
 * Networks (to avoid hash table mode).
 */

Network.main = null;
Network.testnet = null;
Network.regtest = null;
Network.segnet4 = null;
Network.simnet = null;

/*
 * Set initial network.
 */

Network.set(process.env.HSD_NETWORK || 'main');

/*
 * Helpers
 */

function cmpBit(a, b) {
  return a.bit - b;
}

function cmpNode(a, b) {
  return a.height - b.height;
}

function cmpMagic(network, magic) {
  return network.magic === magic;
}

function cmpWIF(network, prefix) {
  return network.keyPrefix.privkey === prefix;
}

function cmpPub(network, prefix) {
  return network.keyPrefix.xpubkey === prefix;
}

function cmpPriv(network, prefix) {
  return network.keyPrefix.xprivkey === prefix;
}

function cmpPub58(network, prefix) {
  return network.keyPrefix.xpubkey58 === prefix;
}

function cmpPriv58(network, prefix) {
  return network.keyPrefix.xprivkey58 === prefix;
}

function cmpAddress(network, hrp) {
  return network.addressPrefix === hrp;
}

/*
 * Expose
 */

module.exports = Network;
}],
[/* 45 */ 'hsd', '/lib/utils/binary.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * binary.js - binary search utils for hsd
 * Copyright (c) 2017-2018, Christopher Jeffrey (MIT License).
 * https://github.com/handshake-org/hsd
 */

'use strict';

/**
 * Perform a binary search on a sorted array.
 * @param {Array} items
 * @param {Object} key
 * @param {Function} compare
 * @param {Boolean?} insert
 * @returns {Number} Index.
 */

exports.search = function search(items, key, compare, insert) {
  let start = 0;
  let end = items.length - 1;

  while (start <= end) {
    const pos = (start + end) >>> 1;
    const cmp = compare(items[pos], key);

    if (cmp === 0)
      return pos;

    if (cmp < 0)
      start = pos + 1;
    else
      end = pos - 1;
  }

  if (!insert)
    return -1;

  return start;
};

/**
 * Perform a binary insert on a sorted array.
 * @param {Array} items
 * @param {Object} item
 * @param {Function} compare
 * @returns {Number} index
 */

exports.insert = function insert(items, item, compare, uniq) {
  const i = exports.search(items, item, compare, true);

  if (uniq && i < items.length) {
    if (compare(items[i], item) === 0)
      return -1;
  }

  if (i === 0)
    items.unshift(item);
  else if (i === items.length)
    items.push(item);
  else
    items.splice(i, 0, item);

  return i;
};

/**
 * Perform a binary removal on a sorted array.
 * @param {Array} items
 * @param {Object} item
 * @param {Function} compare
 * @returns {Boolean}
 */

exports.remove = function remove(items, item, compare) {
  const i = exports.search(items, item, compare, false);

  if (i === -1)
    return false;

  splice(items, i);

  return true;
};

/*
 * Helpers
 */

function splice(list, i) {
  if (i === 0) {
    list.shift();
    return;
  }

  let k = i + 1;

  while (k < list.length)
    list[i++] = list[k++];

  list.pop();
}
}],
[/* 46 */ 'hsd', '/lib/protocol/networks.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * network.js - handshake networks for hsd
 * Copyright (c) 2017-2018, Christopher Jeffrey (MIT License).
 * https://github.com/handshake-org/hsd
 */

/* eslint no-implicit-coercion: "off" */

'use strict';

/**
 * @module protocol/networks
 */

const BN = __node_require__(31 /* 'bcrypto/lib/bn.js' */);
const genesis = __node_require__(47 /* './genesis' */);
const network = exports;

/**
 * Network type list.
 * @memberof module:protocol/networks
 * @const {String[]}
 * @default
 */

network.types = ['main', 'testnet', 'regtest', 'simnet'];

/**
 * Mainnet
 * @static
 * @lends module:protocol/networks
 * @type {Object}
 */

const main = {};

/**
 * Symbolic network type.
 * @const {String}
 * @default
 */

main.type = 'main';

/**
 * Default DNS seeds.
 * @const {String[]}
 * @default
 */

main.seeds = [
  'hs-mainnet.bcoin.ninja', // Christopher Jeffrey
  'seed.easyhandshake.com' // Matthew Zipkin
];

/**
 * Packet magic number.
 * @const {Number}
 * @default
 */

main.magic = genesis.main.magic;

/**
 * Default network port.
 * @const {Number}
 * @default
 */

main.port = 12038;

/**
 * Default brontide port.
 * @const {Number}
 * @default
 */

main.brontidePort = 44806;

/**
 * Checkpoint block list.
 * @const {Object}
 */

main.checkpointMap = {
  1008: Buffer.from(
    '0000000000001013c28fa079b545fb805f04c496687799b98e35e83cbbb8953e', 'hex'),
  2016: Buffer.from(
    '0000000000000424ee6c2a5d6e0da5edfc47a4a10328c1792056ee48303c3e40', 'hex'),
  10000: Buffer.from(
    '00000000000001a86811a6f520bf67cefa03207dc84fd315f58153b28694ec51', 'hex'),
  20000: Buffer.from(
    '0000000000000162c7ac70a582256f59c189b5c90d8e9861b3f374ed714c58de', 'hex'),
  30000: Buffer.from(
    '0000000000000004f790862846b23c3a81585aea0fa79a7d851b409e027bcaa7', 'hex'),
  40000: Buffer.from(
    '0000000000000002966206a40b10a575cb46531253b08dae8e1b356cfa277248', 'hex'),
  50000: Buffer.from(
    '00000000000000020c7447e7139feeb90549bfc77a7f18d4ff28f327c04f8d6e', 'hex'),
  56880: Buffer.from(
    '0000000000000001d4ef9ea6908bb4eb970d556bd07cbd7d06a634e1cd5bbf4e', 'hex'),
  61043: Buffer.from(
    '00000000000000015b84385e0307370f8323420eaa27ef6e407f2d3162f1fd05', 'hex')
};

/**
 * Last checkpoint height.
 * @const {Number}
 * @default
 */

main.lastCheckpoint = 61043;

/**
 * Reward halving interval.
 * Roughly every 3.25 years.
 * @const {Number}
 * @default
 */

main.halvingInterval = 170000;

/**
 * Number of blocks before a coinbase
 * spend can occur (consensus).
 * @const {Number}
 * @default
 */

main.coinbaseMaturity = 100;

/**
 * Genesis block header.
 * @const {Object}
 */

main.genesis = genesis.main;

/**
 * The network's genesis block in a hex string.
 * @const {String}
 */

main.genesisBlock = genesis.mainData;

/**
 * POW-related constants.
 * @enum {Number}
 * @default
 */

main.pow = {};

/**
 * Default target.
 * @const {BN}
 */

main.pow.limit = new BN(
  '0000000000ffff00000000000000000000000000000000000000000000000000',
  'hex'
);

/**
 * Compact pow limit.
 * @const {Number}
 * @default
 */

main.pow.bits = 0x1c00ffff;

/**
 * Minimum chainwork for best chain.
 * @const {BN}
 */

main.pow.chainwork = new BN(
  '00000000000000000000000000000000000000000000000075b5a2b7bf522d45',
  'hex'
);

/**
 * Retarget window in blocks.
 * @const {Number}
 * @default
 */

main.pow.targetWindow = 144;

/**
 * Average block time.
 * @const {Number}
 * @default
 */

main.pow.targetSpacing = 10 * 60;

/**
 * Average blocks per day.
 * @const {Number}
 * @default
 */

main.pow.blocksPerDay = ((24 * 60 * 60) / main.pow.targetSpacing) >>> 0;

/**
 * Desired retarget period in seconds.
 * @const {Number}
 * @default
 */

main.pow.targetTimespan = main.pow.targetWindow * main.pow.targetSpacing;

/**
 * Minimum actual time.
 * @const {Number}
 * @default
 */

main.pow.minActual = (main.pow.targetTimespan / 4) >>> 0;

/**
 * Maximum actual time.
 * @const {Number}
 * @default
 */

main.pow.maxActual = main.pow.targetTimespan * 4;

/**
 * Whether to reset target if a block
 * has not been mined recently.
 * @const {Boolean}
 * @default
 */

main.pow.targetReset = false;

/**
 * Do not allow retargetting.
 * @const {Boolean}
 * @default
 */

main.pow.noRetargeting = false;

/**
 * Prohibit all transactions until
 * sufficient chainwork has been accumulated.
 * @const {Number}
 */

main.txStart = 14 * main.pow.blocksPerDay;

/**
 * Name-related constants.
 * @enum {Number}
 * @default
 */

main.names = {
  /**
   * Height at which the auction system activates.
   * Must be greater or equal to txStart.
   * @const {Number}
   */

  auctionStart: 14 * main.pow.blocksPerDay,

  /**
   * Interval at which names are rolled out.
   * @const {Number}
   */

  rolloutInterval: 7 * main.pow.blocksPerDay,

  /**
   * Amount of time a name is locked for after being claimed.
   * @const {Number}
   */

  lockupPeriod: 30 * main.pow.blocksPerDay,

  /**
   * Time period after which names expire.
   * @const {Number}
   */

  renewalWindow: (2 * 365) * main.pow.blocksPerDay,

  /**
   * Committed renewal block hashes
   * must be no older than this.
   * @const {Number}
   */

  renewalPeriod: 182 * main.pow.blocksPerDay,

  /**
   * Committed renewal block hashes
   * must be at least this old.
   * @const {Number}
   */

  renewalMaturity: 30 * main.pow.blocksPerDay,

  /**
   * The time window in which the
   * nameholders can claim reserved names.
   * @const {Number}
   */

  claimPeriod: (4 * 365) * main.pow.blocksPerDay,

  /**
   * Amount of time required in between
   * replacement claims.
   * @const {Number}
   */

  claimFrequency: 2 * main.pow.blocksPerDay,

  /**
   * Bidding time period.
   * @const {Number}
   */

  biddingPeriod: 5 * main.pow.blocksPerDay,

  /**
   * Reveal time period.
   * @const {Number}
   */

  revealPeriod: 10 * main.pow.blocksPerDay,

  /**
   * Interval at which the name tree is updated.
   * @const {Number}
   */

  treeInterval: main.pow.blocksPerDay >>> 2,

  /**
   * Amount of time transfers are locked up for.
   * @const {Number}
   */

  transferLockup: 2 * main.pow.blocksPerDay,

  /**
   * Amount of time before a transfer
   * or revocation is possible.
   * @const {Number}
   */

  revocationDelay: 14 * main.pow.blocksPerDay,

  /**
   * Sum of total period and revocation delay.
   * @const {Number}
   */

  auctionMaturity: (5 + 10 + 14) * main.pow.blocksPerDay,

  /**
   * Whether there is no weekly rollout.
   * @const {Boolean}
   */

  noRollout: false,

  /**
   * Whether there are no names reserved.
   * @const {Boolean}
   */

  noReserved: false
};

/**
 * Block constants.
 * @enum {Number}
 * @default
 */

main.block = {
  /**
   * Safe height to start pruning.
   */

  pruneAfterHeight: 1000,

  /**
   * Safe number of blocks to keep.
   */

  keepBlocks: 288,

  /**
   * Age used for the time delta to
   * determine whether the chain is synced.
   */

  maxTipAge: 12 * 60 * 60,

  /**
   * Height at which block processing is
   * slow enough that we can output
   * logs without spamming.
   */

  slowHeight: 0
};

/**
 * Block height at which GooSig claims are
 * disabled. This limits risk associated
 * with newly discovered cryptography
 * attacks or social engineering attacks.
 *
 * Estimated to be disabled at 1 year +
 * 1 month from the start of the network
 * on mainnet.
 */

main.goosigStop = (365 + 30) * main.pow.blocksPerDay;

/**
 * For versionbits.
 * @const {Number}
 * @default
 */

main.activationThreshold = 1916;

/**
 * Confirmation window for versionbits.
 * @const {Number}
 * @default
 */

main.minerWindow = 2016;

/**
 * Deployments for versionbits.
 * @const {Object}
 * @default
 */

main.deployments = {
  hardening: {
    name: 'hardening',
    bit: 0,
    startTime: 1581638400, // February 14th, 2020
    timeout: 1707868800, // February 14th, 2024
    threshold: -1,
    window: -1,
    required: false,
    force: false
  },
  testdummy: {
    name: 'testdummy',
    bit: 28,
    startTime: 1199145601, // January 1, 2008
    timeout: 1230767999, // December 31, 2008
    threshold: -1,
    window: -1,
    required: false,
    force: true
  }
};

/**
 * Deployments for versionbits (array form, sorted).
 * @const {Array}
 * @default
 */

main.deploys = [
  main.deployments.hardening,
  main.deployments.testdummy
];

/**
 * Key prefixes.
 * @enum {Number}
 * @default
 */

main.keyPrefix = {
  privkey: 0x80,
  xpubkey: 0x0488b21e,
  xprivkey: 0x0488ade4,
  xpubkey58: 'xpub',
  xprivkey58: 'xprv',
  coinType: 5353
};

/**
 * Address prefix.
 * @const {String}
 */

main.addressPrefix = 'hs';

/**
 * Default value for whether the mempool
 * accepts non-standard transactions.
 * @const {Boolean}
 * @default
 */

main.requireStandard = true;

/**
 * Default http port.
 * @const {Number}
 * @default
 */

main.rpcPort = 12037;

/**
 * Default wallet port.
 * @const {Number}
 * @default
 */

main.walletPort = 12039;

/**
 * Default DNS port.
 * @const {Number}
 * @default
 */

main.nsPort = 5349;

/**
 * Default recursive DNS port.
 * @const {Number}
 * @default
 */

main.rsPort = 5350;

/**
 * Default min relay rate.
 * @const {Rate}
 * @default
 */

main.minRelay = 1000;

/**
 * Default normal relay rate.
 * @const {Rate}
 * @default
 */

main.feeRate = 100000;

/**
 * Maximum normal relay rate.
 * @const {Rate}
 * @default
 */

main.maxFeeRate = 400000;

/**
 * Default identity key (testing only).
 * @const {Buffer|null}
 * @default
 */

main.identityKey = null;

/**
 * Whether to allow self-connection.
 * @const {Boolean}
 */

main.selfConnect = false;

/**
 * Whether to request mempool on sync.
 * @const {Boolean}
 */

main.requestMempool = false;

/**
 * DNSSEC ownership prefix.
 * @const {String}
 */

main.claimPrefix = 'hns-claim:';

/**
 * Activation height for inflation bug fix.
 * @const {Number}
 */

main.deflationHeight = 61043;

/*
 * Testnet
 */

const testnet = {};

testnet.type = 'testnet';

testnet.seeds = [
  'hs-testnet.bcoin.ninja' // Christopher Jeffrey
];

testnet.magic = genesis.testnet.magic;

testnet.port = 13038;

testnet.brontidePort = 45806;

testnet.checkpointMap = {};

testnet.lastCheckpoint = 0;

testnet.halvingInterval = 170000;
testnet.coinbaseMaturity = 100;

testnet.genesis = genesis.testnet;
testnet.genesisBlock = genesis.testnetData;

testnet.pow = {};

// Probably minable very quick with 1 GPU.
testnet.pow.limit = new BN(
  '00000000ffff0000000000000000000000000000000000000000000000000000',
  'hex'
);
testnet.pow.bits = 0x1d00ffff;
testnet.pow.chainwork = new BN(
  '0000000000000000000000000000000000000000000000000000000000000000',
  'hex'
);
testnet.pow.targetWindow = 144;
testnet.pow.targetSpacing = 10 * 60;
testnet.pow.blocksPerDay = ((24 * 60 * 60) / testnet.pow.targetSpacing) >>> 0;
testnet.pow.targetTimespan =
  testnet.pow.targetWindow * testnet.pow.targetSpacing;
testnet.pow.minActual = (testnet.pow.targetTimespan / 4) >>> 0;
testnet.pow.maxActual = testnet.pow.targetTimespan * 4;
testnet.pow.targetReset = true;
testnet.pow.noRetargeting = false;
testnet.txStart = 0;

testnet.names = {
  auctionStart: (0.25 * testnet.pow.blocksPerDay) | 0,
  rolloutInterval: (0.25 * testnet.pow.blocksPerDay) | 0,
  lockupPeriod: (0.25 * testnet.pow.blocksPerDay) | 0,
  renewalWindow: 30 * testnet.pow.blocksPerDay,
  renewalPeriod: 7 * testnet.pow.blocksPerDay,
  renewalMaturity: 1 * testnet.pow.blocksPerDay,
  claimPeriod: 90 * testnet.pow.blocksPerDay,
  claimFrequency: 2 * testnet.pow.blocksPerDay,
  biddingPeriod: 1 * testnet.pow.blocksPerDay,
  revealPeriod: 2 * testnet.pow.blocksPerDay,
  treeInterval: testnet.pow.blocksPerDay >>> 2,
  transferLockup: 2 * testnet.pow.blocksPerDay,
  revocationDelay: 4 * testnet.pow.blocksPerDay,
  auctionMaturity: (1 + 2 + 4) * testnet.pow.blocksPerDay,
  noRollout: false,
  noReserved: false
};

testnet.block = {
  pruneAfterHeight: 1000,
  keepBlocks: 10000,
  maxTipAge: 12 * 60 * 60,
  slowHeight: 0
};

testnet.goosigStop = 20 * testnet.pow.blocksPerDay;

testnet.activationThreshold = 1512;

testnet.minerWindow = 2016;

testnet.deployments = {
  hardening: {
    name: 'hardening',
    bit: 0,
    startTime: 1581638400, // February 14th, 2020
    timeout: 1707868800, // February 14th, 2024
    threshold: -1,
    window: -1,
    required: false,
    force: false
  },
  testdummy: {
    name: 'testdummy',
    bit: 28,
    startTime: 1199145601, // January 1, 2008
    timeout: 1230767999, // December 31, 2008
    threshold: -1,
    window: -1,
    required: false,
    force: true
  }
};

testnet.deploys = [
  testnet.deployments.hardening,
  testnet.deployments.testdummy
];

testnet.keyPrefix = {
  privkey: 0xef,
  xpubkey: 0x043587cf,
  xprivkey: 0x04358394,
  xpubkey58: 'tpub',
  xprivkey58: 'tprv',
  coinType: 5354
};

testnet.addressPrefix = 'ts';

testnet.requireStandard = false;

testnet.rpcPort = 13037;

testnet.walletPort = 13039;

testnet.nsPort = 15349;

testnet.rsPort = 15350;

testnet.minRelay = 1000;

testnet.feeRate = 20000;

testnet.maxFeeRate = 60000;

testnet.identityKey = null;

testnet.selfConnect = false;

testnet.requestMempool = false;

testnet.claimPrefix = 'hns-testnet:';

testnet.deflationHeight = 0;

/*
 * Regtest
 */

const regtest = {};

regtest.type = 'regtest';

regtest.seeds = [];

regtest.magic = genesis.regtest.magic;

regtest.port = 14038;

regtest.brontidePort = 46806;

regtest.checkpointMap = {};
regtest.lastCheckpoint = 0;

regtest.halvingInterval = 2500;
regtest.coinbaseMaturity = 2;

regtest.genesis = genesis.regtest;
regtest.genesisBlock = genesis.regtestData;

regtest.pow = {};
regtest.pow.limit = new BN(
  '7fffff0000000000000000000000000000000000000000000000000000000000',
  'hex'
);
regtest.pow.bits = 0x207fffff;
regtest.pow.chainwork = new BN(
  '0000000000000000000000000000000000000000000000000000000000000000',
  'hex'
);
regtest.pow.targetWindow = 144;
regtest.pow.targetSpacing = 10 * 60;
regtest.pow.blocksPerDay = ((24 * 60 * 60) / regtest.pow.targetSpacing) >>> 0;
regtest.pow.targetTimespan =
  regtest.pow.targetWindow * regtest.pow.targetSpacing;
regtest.pow.minActual = (regtest.pow.targetTimespan / 4) >>> 0;
regtest.pow.maxActual = regtest.pow.targetTimespan * 4;
regtest.pow.targetReset = true;
regtest.pow.noRetargeting = true;
regtest.txStart = 0;

regtest.names = {
  auctionStart: 0,
  rolloutInterval: 2,
  lockupPeriod: 2,
  renewalWindow: 5000,
  renewalPeriod: 2500,
  renewalMaturity: 50,
  claimPeriod: 250000,
  claimFrequency: 0,
  biddingPeriod: 5,
  revealPeriod: 10,
  treeInterval: 5,
  transferLockup: 10,
  revocationDelay: 50,
  auctionMaturity: 5 + 10 + 50,
  noRollout: false,
  noReserved: false
};

regtest.block = {
  pruneAfterHeight: 1000,
  keepBlocks: 10000,
  maxTipAge: 0xffffffff,
  slowHeight: 0
};

regtest.goosigStop = -1 >>> 0;

regtest.activationThreshold = 108;

regtest.minerWindow = 144;

regtest.deployments = {
  hardening: {
    name: 'hardening',
    bit: 0,
    startTime: 1581638400, // February 14th, 2020
    timeout: 1707868800, // February 14th, 2024
    threshold: -1,
    window: -1,
    required: false,
    force: false
  },
  testdummy: {
    name: 'testdummy',
    bit: 28,
    startTime: 0,
    timeout: 0xffffffff,
    threshold: -1,
    window: -1,
    required: false,
    force: true
  }
};

regtest.deploys = [
  regtest.deployments.hardening,
  regtest.deployments.testdummy
];

regtest.keyPrefix = {
  privkey: 0x5a,
  xpubkey: 0xeab4fa05,
  xprivkey: 0xeab404c7,
  xpubkey58: 'rpub',
  xprivkey58: 'rprv',
  coinType: 5355
};

regtest.addressPrefix = 'rs';

regtest.requireStandard = false;

regtest.rpcPort = 14037;

regtest.walletPort = 14039;

regtest.nsPort = 25349;

regtest.rsPort = 25350;

regtest.minRelay = 1000;

regtest.feeRate = 20000;

regtest.maxFeeRate = 60000;

regtest.identityKey = Buffer.from(
  '104932181cfed7584105c728cdc0eb9af1e7ffdc4a00743fd45e5de66cac7668',
  'hex'
);

regtest.selfConnect = true;

regtest.requestMempool = true;

regtest.claimPrefix = 'hns-regtest:';

regtest.deflationHeight = 200;

/*
 * Simnet
 */

const simnet = {};

simnet.type = 'simnet';

simnet.seeds = [];

simnet.magic = genesis.simnet.magic;

simnet.port = 15038;

simnet.brontidePort = 47806;

simnet.checkpointMap = {};

simnet.lastCheckpoint = 0;

simnet.halvingInterval = 170000;
simnet.coinbaseMaturity = 6;

simnet.genesis = genesis.simnet;
simnet.genesisBlock = genesis.simnetData;

simnet.pow = {};
simnet.pow.limit = new BN(
  '7fffff0000000000000000000000000000000000000000000000000000000000',
  'hex'
);
simnet.pow.bits = 0x207fffff;
simnet.pow.chainwork = new BN(
  '0000000000000000000000000000000000000000000000000000000000000000',
  'hex'
);
simnet.pow.targetWindow = 144;
simnet.pow.targetSpacing = 10 * 60;
simnet.pow.blocksPerDay = ((24 * 60 * 60) / simnet.pow.targetSpacing) >>> 0;
simnet.pow.targetTimespan =
  simnet.pow.targetWindow * simnet.pow.targetSpacing;
simnet.pow.minActual = (simnet.pow.targetTimespan / 4) >>> 0;
simnet.pow.maxActual = simnet.pow.targetTimespan * 4;
simnet.pow.targetReset = false;
simnet.pow.noRetargeting = false;
simnet.txStart = 0;

simnet.names = {
  auctionStart: 0,
  rolloutInterval: 1,
  lockupPeriod: 1,
  renewalWindow: 2500,
  renewalPeriod: 1250,
  renewalMaturity: 25,
  claimPeriod: 75000,
  claimFrequency: 0,
  biddingPeriod: 25,
  revealPeriod: 50,
  treeInterval: 2,
  transferLockup: 5,
  revocationDelay: 25,
  auctionMaturity: 25 + 50 + 25,
  noRollout: false,
  noReserved: false
};

simnet.block = {
  pruneAfterHeight: 1000,
  keepBlocks: 10000,
  maxTipAge: 0xffffffff,
  slowHeight: 0
};

simnet.goosigStop = -1 >>> 0;

simnet.activationThreshold = 75;

simnet.minerWindow = 100;

simnet.deployments = {
  hardening: {
    name: 'hardening',
    bit: 0,
    startTime: 1581638400, // February 14th, 2020
    timeout: 1707868800, // February 14th, 2024
    threshold: -1,
    window: -1,
    required: false,
    force: false
  },
  testdummy: {
    name: 'testdummy',
    bit: 28,
    startTime: 1199145601, // January 1, 2008
    timeout: 1230767999, // December 31, 2008
    threshold: -1,
    window: -1,
    required: false,
    force: true
  }
};

simnet.deploys = [
  simnet.deployments.hardening,
  simnet.deployments.testdummy
];

simnet.keyPrefix = {
  privkey: 0x64,
  xpubkey: 0x0420bd3a,
  xprivkey: 0x0420b900,
  xpubkey58: 'spub',
  xprivkey58: 'sprv',
  coinType: 5356
};

simnet.addressPrefix = 'ss';

simnet.requireStandard = false;

simnet.rpcPort = 15037;

simnet.walletPort = 15039;

simnet.nsPort = 35349;

simnet.rsPort = 35350;

simnet.minRelay = 1000;

simnet.feeRate = 20000;

simnet.maxFeeRate = 60000;

simnet.identityKey = Buffer.from(
  '104932181cfed7584105c728cdc0eb9af1e7ffdc4a00743fd45e5de66cac7668',
  'hex'
);

simnet.selfConnect = true;

simnet.requestMempool = false;

simnet.claimPrefix = 'hns-simnet:';

simnet.deflationHeight = 0;

/*
 * Expose
 */

network.main = main;
network.testnet = testnet;
network.regtest = regtest;
network.simnet = simnet;
}],
[/* 47 */ 'hsd', '/lib/protocol/genesis.js', function(exports, module, __filename, __dirname, __meta) {
// Autogenerated, do not edit.

'use strict';

const data = __node_require__(48 /* './genesis-data.json' */);
const genesis = exports;

/*
 * Main
 */

genesis.main = {
  version: 0,
  hash: Buffer.from(
    '5b6ef2d3c1f3cdcadfd9a030ba1811efdd17740f14e166489760741d075992e0',
    'hex'),
  prevBlock: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  merkleRoot: Buffer.from(
    '8e4c9756fef2ad10375f360e0560fcc7587eb5223ddf8cd7c7e06e60a1140b15',
    'hex'),
  witnessRoot: Buffer.from(
    '1a2c60b9439206938f8d7823782abdb8b211a57431e9c9b6a6365d8d42893351',
    'hex'),
  treeRoot: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  reservedRoot: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  time: 1580745078,
  bits: 0x1c00ffff,
  nonce: 0x00000000,
  extraNonce: Buffer.from(
    '000000000000000000000000000000000000000000000000',
    'hex'),
  mask: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  height: 0,
  magic: 1533997779
};

genesis.mainData = Buffer.from(data.main, 'base64');

/*
 * Testnet
 */

genesis.testnet = {
  version: 0,
  hash: Buffer.from(
    'b1520dd24372f82ec94ebf8cf9d9b037d419c4aa3575d05dec70aedd1b427901',
    'hex'),
  prevBlock: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  merkleRoot: Buffer.from(
    '8e4c9756fef2ad10375f360e0560fcc7587eb5223ddf8cd7c7e06e60a1140b15',
    'hex'),
  witnessRoot: Buffer.from(
    '1a2c60b9439206938f8d7823782abdb8b211a57431e9c9b6a6365d8d42893351',
    'hex'),
  treeRoot: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  reservedRoot: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  time: 1580745079,
  bits: 0x1d00ffff,
  nonce: 0x00000000,
  extraNonce: Buffer.from(
    '000000000000000000000000000000000000000000000000',
    'hex'),
  mask: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  height: 0,
  magic: 2974944722
};

genesis.testnetData = Buffer.from(data.testnet, 'base64');

/*
 * Regtest
 */

genesis.regtest = {
  version: 0,
  hash: Buffer.from(
    'ae3895cf597eff05b19e02a70ceeeecb9dc72dbfe6504a50e9343a72f06a87c5',
    'hex'),
  prevBlock: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  merkleRoot: Buffer.from(
    '8e4c9756fef2ad10375f360e0560fcc7587eb5223ddf8cd7c7e06e60a1140b15',
    'hex'),
  witnessRoot: Buffer.from(
    '1a2c60b9439206938f8d7823782abdb8b211a57431e9c9b6a6365d8d42893351',
    'hex'),
  treeRoot: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  reservedRoot: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  time: 1580745080,
  bits: 0x207fffff,
  nonce: 0x00000000,
  extraNonce: Buffer.from(
    '000000000000000000000000000000000000000000000000',
    'hex'),
  mask: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  height: 0,
  magic: 2922943951
};

genesis.regtestData = Buffer.from(data.regtest, 'base64');

/*
 * Simnet
 */

genesis.simnet = {
  version: 0,
  hash: Buffer.from(
    '0e648edc9cddb179014658061ea3f666a45cf44881877ae506e6babefbef6992',
    'hex'),
  prevBlock: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  merkleRoot: Buffer.from(
    '8e4c9756fef2ad10375f360e0560fcc7587eb5223ddf8cd7c7e06e60a1140b15',
    'hex'),
  witnessRoot: Buffer.from(
    '1a2c60b9439206938f8d7823782abdb8b211a57431e9c9b6a6365d8d42893351',
    'hex'),
  treeRoot: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  reservedRoot: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  time: 1580745081,
  bits: 0x207fffff,
  nonce: 0x00000000,
  extraNonce: Buffer.from(
    '000000000000000000000000000000000000000000000000',
    'hex'),
  mask: Buffer.from(
    '0000000000000000000000000000000000000000000000000000000000000000',
    'hex'),
  height: 0,
  magic: 241471196
};

genesis.simnetData = Buffer.from(data.simnet, 'base64');
}],
[/* 48 */ 'hsd', '/lib/protocol/genesis-data.json', function(exports, module, __filename, __dirname, __meta) {
module.exports = {
  "main": "AAAAAHZBOF4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGixguUOSBpOPjXgjeCq9uLIRpXQx6cm2pjZdjUKJM1GOTJdW/vKtEDdfNg4FYPzHWH61Ij3fjNfH4G5goRQLFQAAAAD//wAcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP//////////AdBMV3cAAAAAABTwI3ri6Phg99eRJPxRPwEuWqqNIwAAAAAAAAQgULiTf8Xe8I+fPL2n5fCMcG7bgKuliAwAAAAAAAAAAAAgLV3lhgnUlw+1SPha0HqH20DgVONMyByVHKmVpY9nTbcgENdI7aG5xnuU0yROAhFndhiptLMp6JatkEMfn0gDS60g4sApmh5GZ3NRZlXwmmSx4WsleVMN5sSlnOVlTepFGA8=",
  "testnet": "AAAAAHdBOF4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGixguUOSBpOPjXgjeCq9uLIRpXQx6cm2pjZdjUKJM1GOTJdW/vKtEDdfNg4FYPzHWH61Ij3fjNfH4G5goRQLFQAAAAD//wAdAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP//////////AdBMV3cAAAAAABTwI3ri6Phg99eRJPxRPwEuWqqNIwAAAAAAAAQgULiTf8Xe8I+fPL2n5fCMcG7bgKuliAwAAAAAAAAAAAAgLV3lhgnUlw+1SPha0HqH20DgVONMyByVHKmVpY9nTbcgENdI7aG5xnuU0yROAhFndhiptLMp6JatkEMfn0gDS60g4sApmh5GZ3NRZlXwmmSx4WsleVMN5sSlnOVlTepFGA8=",
  "regtest": "AAAAAHhBOF4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGixguUOSBpOPjXgjeCq9uLIRpXQx6cm2pjZdjUKJM1GOTJdW/vKtEDdfNg4FYPzHWH61Ij3fjNfH4G5goRQLFQAAAAD//38gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP//////////AdBMV3cAAAAAABTwI3ri6Phg99eRJPxRPwEuWqqNIwAAAAAAAAQgULiTf8Xe8I+fPL2n5fCMcG7bgKuliAwAAAAAAAAAAAAgLV3lhgnUlw+1SPha0HqH20DgVONMyByVHKmVpY9nTbcgENdI7aG5xnuU0yROAhFndhiptLMp6JatkEMfn0gDS60g4sApmh5GZ3NRZlXwmmSx4WsleVMN5sSlnOVlTepFGA8=",
  "simnet": "AAAAAHlBOF4AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGixguUOSBpOPjXgjeCq9uLIRpXQx6cm2pjZdjUKJM1GOTJdW/vKtEDdfNg4FYPzHWH61Ij3fjNfH4G5goRQLFQAAAAD//38gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP//////////AdBMV3cAAAAAABTwI3ri6Phg99eRJPxRPwEuWqqNIwAAAAAAAAQgULiTf8Xe8I+fPL2n5fCMcG7bgKuliAwAAAAAAAAAAAAgLV3lhgnUlw+1SPha0HqH20DgVONMyByVHKmVpY9nTbcgENdI7aG5xnuU0yROAhFndhiptLMp6JatkEMfn0gDS60g4sApmh5GZ3NRZlXwmmSx4WsleVMN5sSlnOVlTepFGA8="
};
}],
[/* 49 */ 'hsd', '/lib/protocol/timedata.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * timedata.js - time management for hsd
 * Copyright (c) 2017-2018, Christopher Jeffrey (MIT License).
 * https://github.com/handshake-org/hsd
 */

'use strict';

const EventEmitter = require('events');
const util = __node_require__(50 /* '../utils/util' */);
const binary = __node_require__(45 /* '../utils/binary' */);

/**
 * Time Data
 * An object which handles "adjusted time". This may not
 * look it, but this is actually a semi-consensus-critical
 * piece of code. It handles version packets from peers
 * and calculates what to offset our system clock's time by.
 * @alias module:protocol.TimeData
 * @extends EventEmitter
 * @property {Array} samples
 * @property {Object} known
 * @property {Number} limit
 * @property {Number} offset
 */

class TimeData extends EventEmitter {
  /**
   * Create time data.
   * @constructor
   * @param {Number} [limit=200]
   */

  constructor(limit) {
    super();

    if (limit == null)
      limit = 200;

    this.samples = [];
    this.known = new Map();
    this.limit = limit;
    this.offset = 0;
    this.checked = false;
  }

  /**
   * Add time data.
   * @param {String} id
   * @param {Number} time
   */

  add(id, time) {
    if (this.samples.length >= this.limit)
      return;

    if (this.known.has(id))
      return;

    const sample = time - util.now();

    this.known.set(id, sample);

    binary.insert(this.samples, sample, compare);

    this.emit('sample', sample, this.samples.length);

    if (this.samples.length >= 5 && this.samples.length % 2 === 1) {
      let median = this.samples[this.samples.length >>> 1];

      if (Math.abs(median) >= 70 * 60) {
        if (!this.checked) {
          let match = false;

          for (const offset of this.samples) {
            if (offset !== 0 && Math.abs(offset) < 5 * 60) {
              match = true;
              break;
            }
          }

          if (!match) {
            this.checked = true;
            this.emit('mismatch');
          }
        }

        median = 0;
      }

      this.offset = median;
      this.emit('offset', this.offset);
    }
  }

  /**
   * Get the current adjusted time.
   * @returns {Number} Adjusted Time.
   */

  now() {
    return util.now() + this.offset;
  }

  /**
   * Adjust a timestamp.
   * @param {Number} time
   * @returns {Number} Adjusted Time.
   */

  adjust(time) {
    return time + this.offset;
  }

  /**
   * Unadjust a timestamp.
   * @param {Number} time
   * @returns {Number} Local Time.
   */

  local(time) {
    return time - this.offset;
  }

  /**
   * Get the current adjusted time in milliseconds.
   * @returns {Number} Adjusted Time.
   */

  ms() {
    return Date.now() + this.offset * 1000;
  }
}

/*
 * Helpers
 */

function compare(a, b) {
  return a - b;
}

/*
 * Expose
 */

module.exports = TimeData;
}],
[/* 50 */ 'hsd', '/lib/utils/util.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * util.js - utils for hsd
 * Copyright (c) 2017-2018, Christopher Jeffrey (MIT License).
 * https://github.com/handshake-org/hsd
 */

'use strict';

const assert = __node_require__(2 /* 'bsert' */);

/**
 * @exports utils/util
 */

const util = exports;

/**
 * Return hrtime (shim for browser).
 * @param {Array} time
 * @returns {Array} [seconds, nanoseconds]
 */

util.bench = function bench(time) {
  if (!process.hrtime) {
    const now = Date.now();

    if (time) {
      const [hi, lo] = time;
      const start = hi * 1000 + lo / 1e6;
      return now - start;
    }

    const ms = now % 1000;

    // Seconds
    const hi = (now - ms) / 1000;

    // Nanoseconds
    const lo = ms * 1e6;

    return [hi, lo];
  }

  if (time) {
    const [hi, lo] = process.hrtime(time);
    return hi * 1000 + lo / 1e6;
  }

  return process.hrtime();
};

/**
 * Get current time in unix time (seconds).
 * @returns {Number}
 */

util.now = function now() {
  return Math.floor(Date.now() / 1000);
};

/**
 * Get current time in unix time (milliseconds).
 * @returns {Number}
 */

util.ms = function ms() {
  return Date.now();
};

/**
 * Create a Date ISO string from time in unix time (seconds).
 * @param {Number?} time - Seconds in unix time.
 * @returns {String}
 */

util.date = function date(time) {
  if (time == null)
    time = util.now();

  return new Date(time * 1000).toISOString().slice(0, -5) + 'Z';
};

/**
 * Get unix seconds from a Date string.
 * @param {String?} date - Date ISO String.
 * @returns {Number}
 */

util.time = function time(date) {
  if (date == null)
    return util.now();

  return new Date(date) / 1000 | 0;
};

/**
 * Convert u32 to padded hex.
 * @param {Number} num
 * @returns {String}
 */

util.hex32 = function hex32(num) {
  assert((num >>> 0) === num);
  num = num.toString(16);
  switch (num.length) {
    case 1:
      return `0000000${num}`;
    case 2:
      return `000000${num}`;
    case 3:
      return `00000${num}`;
    case 4:
      return `0000${num}`;
    case 5:
      return `000${num}`;
    case 6:
      return `00${num}`;
    case 7:
      return `0${num}`;
    case 8:
      return `${num}`;
    default:
      throw new Error();
  }
};

/**
 * Parse hex.
 * @param {String} str
 * @param {Number} size
 * @returns {Buffer}
 */

util.parseHex = function parseHex(str, size) {
  if (size == null)
    size = -1;

  assert(typeof str === 'string');
  assert(size === -1 || (size >>> 0) === size);

  if (str.length & 1)
    throw new Error('Invalid hex string.');

  if (size !== -1) {
    if ((str.length >>> 1) !== size)
      throw new Error('Invalid hex string.');
  }

  const data = Buffer.from(str, 'hex');

  if (data.length !== (str.length >>> 1))
    throw new Error('Invalid hex string.');

  return data;
};

/**
 * Test whether a number is a safe uint64.
 * @param {Number} num
 * @returns {Boolean}
 */

util.isU64 = function isU64(num) {
  return Number.isSafeInteger(num) && num >= 0;
};

/**
 * Encode a uint32.
 * @param {Number} num
 * @returns {Buffer}
 */

util.encodeU32 = function encodeU32(num) {
  assert(Number.isSafeInteger(num));
  const buf = Buffer.allocUnsafe(4);
  buf[0] = num;
  num >>>= 8;
  buf[1] = num;
  num >>>= 8;
  buf[2] = num;
  num >>>= 8;
  buf[3] = num;
  return buf;
};
}],
[/* 51 */ 'hsd', '/lib/protocol/consensus.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * consensus.js - consensus constants and helpers for hsd
 * Copyright (c) 2017-2018, Christopher Jeffrey (MIT License).
 * https://github.com/handshake-org/hsd
 */

'use strict';

/**
 * @module protocol/consensus
 */

const assert = __node_require__(2 /* 'bsert' */);
const BN = __node_require__(31 /* 'bcrypto/lib/bn.js' */);

/**
 * Coin exponent.
 * @const {Number}
 * @default
 */

exports.EXP = 6;

/**
 * One handshake in dollarydoos.
 * @const {Amount}
 * @default
 */

exports.COIN = Math.pow(10, exports.EXP);

/**
 * Maximum creators amount in dollarydoos (consensus).
 * @const {Amount}
 * @default
 */

exports.MAX_CREATORS = 102e6 * exports.COIN;

/**
 * Maximum sponsors amount in dollarydoos (consensus).
 * @const {Amount}
 * @default
 */

exports.MAX_SPONSORS = 102e6 * exports.COIN;

/**
 * Maximum TLD holder amount in dollarydoos (consensus).
 * @const {Amount}
 * @default
 */

exports.MAX_TLD = 51e6 * exports.COIN;

/**
 * Maximum domain holder amount in dollarydoos (consensus).
 * @const {Amount}
 * @default
 */

exports.MAX_DOMAIN = 51e6 * exports.COIN;

/**
 * Maximum CA/naming amount in dollarydoos (consensus).
 * @const {Amount}
 * @default
 */

exports.MAX_CA_NAMING = 102e6 * exports.COIN;

/**
 * Maximum airdrop amount in dollarydoos (consensus).
 * @const {Amount}
 * @default
 */

exports.MAX_AIRDROP = 0.952e9 * exports.COIN;

/**
 * Maximum initial supply in dollarydoos (consensus).
 * @const {Amount}
 * @default
 */

exports.MAX_INITIAL = 1.36e9 * exports.COIN;

assert(exports.MAX_CREATORS
     + exports.MAX_SPONSORS
     + exports.MAX_TLD
     + exports.MAX_DOMAIN
     + exports.MAX_CA_NAMING
     + exports.MAX_AIRDROP === exports.MAX_INITIAL);

/**
 * Maximum amount of subsidies in dollarydoos (consensus).
 * @const {Amount}
 * @default
 */

exports.MAX_SUBSIDY = 0.68e9 * exports.COIN;

assert(exports.MAX_INITIAL / 2 === exports.MAX_SUBSIDY);

/**
 * Maximum amount of money in dollarydoos (consensus).
 * @const {Amount}
 * @default
 */

exports.MAX_MONEY = 2.04e9 * exports.COIN;

assert(exports.MAX_INITIAL + exports.MAX_SUBSIDY === exports.MAX_MONEY);

/**
 * Base block subsidy (consensus).
 * @const {Amount}
 * @default
 */

exports.BASE_REWARD = 2000 * exports.COIN;

assert(2 * exports.BASE_REWARD * 170000 === exports.MAX_SUBSIDY);

/**
 * Block subsidy specifically for the genesis block.
 *
 * Explanation:
 * The max miner subsidy is 680000000, but due
 * to the halving interval it actually ends up
 * as 679999995.79, so add 2.21 coins to the
 * genesis reward output to make MAX_MONEY a
 * thoroughly true value.
 *
 * This, combined with the 3 1/4 year halving
 * interval, causes the supply to run dry
 * after about 100 years (around the year 2119,
 * or height=5,270,000).
 *
 * @const {Amount}
 * @default
 */

exports.GENESIS_REWARD = exports.BASE_REWARD + ((2.21 * exports.COIN) | 0);

/**
 * Genesis key.
 * @const {Buffer}
 */

exports.GENESIS_KEY =
  Buffer.from('f0237ae2e8f860f7d79124fc513f012e5aaa8d23', 'hex');

/**
 * Maximum block base size (consensus).
 * @const {Number}
 * @default
 */

exports.MAX_BLOCK_SIZE = 1000000;

/**
 * Maximum block serialization size (protocol).
 * @const {Number}
 * @default
 */

exports.MAX_RAW_BLOCK_SIZE = 4000000;

/**
 * Maximum block weight (consensus).
 * @const {Number}
 * @default
 */

exports.MAX_BLOCK_WEIGHT = 4000000;

/**
 * Maximum block sigops cost (consensus).
 * @const {Number}
 * @default
 */

exports.MAX_BLOCK_SIGOPS = 80000;

/**
 * Maximum block tree opens.
 * @const {Number}
 * @default
 */

exports.MAX_BLOCK_OPENS = 300;

/**
 * Maximum block tree updates.
 * @const {Number}
 * @default
 */

exports.MAX_BLOCK_UPDATES = 600;

/**
 * Maximum block tree renewals.
 * @const {Number}
 * @default
 */

exports.MAX_BLOCK_RENEWALS = 600;

/**
 * Size of set to pick median time from.
 * @const {Number}
 * @default
 */

exports.MEDIAN_TIMESPAN = 11;

/**
 * Amount to multiply base/non-witness sizes by.
 * @const {Number}
 * @default
 */

exports.WITNESS_SCALE_FACTOR = 4;

/**
 * Maximum TX base size (consensus).
 * @const {Number}
 * @default
 */

exports.MAX_TX_SIZE = 1000000;

/**
 * Maximum TX weight (consensus).
 * @const {Number}
 * @default
 */

exports.MAX_TX_WEIGHT = 4000000;

/**
 * Locktime flag.
 * @const {Number}
 * @default
 */

exports.LOCKTIME_FLAG = (1 << 31) >>> 0;

/**
 * Locktime mask.
 * @const {Number}
 * @default
 */

exports.LOCKTIME_MASK = exports.LOCKTIME_FLAG - 1;

/**
 * Locktime granularity.
 * @const {Number}
 * @default
 */

exports.LOCKTIME_GRANULARITY = 9;

/**
 * Locktime multiplier.
 * @const {Number}
 * @default
 */

exports.LOCKTIME_MULT = 2 ** exports.LOCKTIME_GRANULARITY;

/**
 * Highest nSequence bit -- disables
 * sequence locktimes (consensus).
 * @const {Number}
 */

exports.SEQUENCE_DISABLE_FLAG = (1 << 31) >>> 0;

/**
 * Sequence time: height or time (consensus).
 * @const {Number}
 * @default
 */

exports.SEQUENCE_TYPE_FLAG = 1 << 22;

/**
 * Sequence granularity for time (consensus).
 * @const {Number}
 * @default
 */

exports.SEQUENCE_GRANULARITY = 9;

/**
 * Sequence mask (consensus).
 * @const {Number}
 * @default
 */

exports.SEQUENCE_MASK = 0x0000ffff;

/**
 * Max serialized script size (consensus).
 * @const {Number}
 * @default
 */

exports.MAX_SCRIPT_SIZE = 10000;

/**
 * Max stack size during execution (consensus).
 * @const {Number}
 * @default
 */

exports.MAX_SCRIPT_STACK = 1000;

/**
 * Max script element size (consensus).
 * @const {Number}
 * @default
 */

exports.MAX_SCRIPT_PUSH = 520;

/**
 * Max opcodes executed (consensus).
 * @const {Number}
 * @default
 */

exports.MAX_SCRIPT_OPS = 201;

/**
 * Max `n` value for multisig (consensus).
 * @const {Number}
 * @default
 */

exports.MAX_MULTISIG_PUBKEYS = 20;

/**
 * A hash of all zeroes.
 * @const {Buffer}
 * @default
 */

exports.ZERO_HASH = Buffer.alloc(32, 0x00);

/**
 * Block header size.
 * @const {Number}
 * @default
 */

exports.HEADER_SIZE = 236;

/**
 * Block header nonce size.
 * @const {Number}
 * @default
 */

exports.NONCE_SIZE = 24;

/**
 * Block header of all zeroes.
 * @const {Buffer}
 * @default
 */

exports.ZERO_HEADER = Buffer.alloc(exports.HEADER_SIZE, 0x00);

/**
 * Block header nonce of all zeroes.
 * @const {Buffer}
 * @default
 */

exports.ZERO_NONCE = Buffer.alloc(exports.NONCE_SIZE, 0x00);

/**
 * Convert a compact number to a big number.
 * Used for `block.bits` -> `target` conversion.
 * @param {Number} compact
 * @returns {BN}
 */

exports.fromCompact = function fromCompact(compact) {
  if (compact === 0)
    return new BN(0);

  const exponent = compact >>> 24;
  const negative = (compact >>> 23) & 1;

  let mantissa = compact & 0x7fffff;
  let num;

  if (exponent <= 3) {
    mantissa >>>= 8 * (3 - exponent);
    num = new BN(mantissa);
  } else {
    num = new BN(mantissa);
    num.iushln(8 * (exponent - 3));
  }

  if (negative)
    num.ineg();

  return num;
};

/**
 * Convert a big number to a compact number.
 * Used for `target` -> `block.bits` conversion.
 * @param {BN} num
 * @returns {Number}
 */

exports.toCompact = function toCompact(num) {
  if (num.isZero())
    return 0;

  let exponent = num.byteLength();
  let mantissa;

  if (exponent <= 3) {
    mantissa = num.toNumber();
    mantissa <<= 8 * (3 - exponent);
  } else {
    mantissa = num.ushrn(8 * (exponent - 3)).toNumber();
  }

  if (mantissa & 0x800000) {
    mantissa >>>= 8;
    exponent += 1;
  }

  let compact = (exponent << 24) | mantissa;

  if (num.isNeg())
    compact |= 0x800000;

  compact >>>= 0;

  return compact;
};

/**
 * Verify proof-of-work.
 * @param {Hash} hash
 * @param {Number} bits
 * @returns {Boolean}
 */

exports.verifyPOW = function verifyPOW(hash, bits) {
  const target = exports.fromCompact(bits);

  if (target.isNeg() || target.isZero())
    return false;

  if (target.bitLength() > 256)
    return false;

  const num = new BN(hash, 'be');

  if (num.gt(target))
    return false;

  return true;
};

/**
 * Calculate block subsidy.
 * @param {Number} height - Reward era by height.
 * @returns {Amount}
 */

exports.getReward = function getReward(height, interval) {
  assert((height >>> 0) === height, 'Bad height for reward.');
  assert((interval >>> 0) === interval);

  const halvings = Math.floor(height / interval);

  if (halvings >= 52)
    return 0;

  return Math.floor(exports.BASE_REWARD / Math.pow(2, halvings));
};

/**
 * Test version bit.
 * @param {Number} version
 * @param {Number} bit
 * @returns {Boolean}
 */

exports.hasBit = function hasBit(version, bit) {
  return (version & (1 << bit)) !== 0;
};
}],
[/* 52 */ 'hsd', '/lib/hd/common.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * common.js - common functions for hd
 * Copyright (c) 2017-2018, Christopher Jeffrey (MIT License).
 * https://github.com/handshake-org/hsd
 */

'use strict';

const assert = __node_require__(2 /* 'bsert' */);
const LRU = __node_require__(53 /* 'blru' */);
const common = exports;

/**
 * Index at which hardening begins.
 * @const {Number}
 * @default
 */

common.HARDENED = 0x80000000;

/**
 * Min entropy bits.
 * @const {Number}
 * @default
 */

common.MIN_ENTROPY = 128;

/**
 * Max entropy bits.
 * @const {Number}
 * @default
 */

common.MAX_ENTROPY = 512;

/**
 * LRU cache to avoid deriving keys twice.
 * @type {LRU}
 */

common.cache = new LRU(500);

/**
 * Parse a derivation path and return an array of indexes.
 * @see https://github.com/bitcoin/bips/blob/master/bip-0044.mediawiki
 * @param {String} path
 * @param {Boolean} hard
 * @returns {Number[]}
 */

common.parsePath = function parsePath(path, hard) {
  assert(typeof path === 'string');
  assert(typeof hard === 'boolean');
  assert(path.length >= 1);
  assert(path.length <= 3062);

  const parts = path.split('/');
  const root = parts[0];

  if (root !== 'm'
      && root !== 'M'
      && root !== 'm\''
      && root !== 'M\'') {
    throw new Error('Invalid path root.');
  }

  const result = [];

  for (let i = 1; i < parts.length; i++) {
    let part = parts[i];

    const hardened = part[part.length - 1] === '\'';

    if (hardened)
      part = part.slice(0, -1);

    if (part.length > 10)
      throw new Error('Path index too large.');

    if (!/^\d+$/.test(part))
      throw new Error('Path index is non-numeric.');

    let index = parseInt(part, 10);

    if ((index >>> 0) !== index)
      throw new Error('Path index out of range.');

    if (hardened) {
      index |= common.HARDENED;
      index >>>= 0;
    }

    if (!hard && (index & common.HARDENED))
      throw new Error('Path index cannot be hardened.');

    result.push(index);
  }

  return result;
};

/**
 * Test whether the key is a master key.
 * @param {HDPrivateKey|HDPublicKey} key
 * @returns {Boolean}
 */

common.isMaster = function isMaster(key) {
  return key.depth === 0
    && key.childIndex === 0
    && key.parentFingerPrint === 0;
};

/**
 * Test whether the key is (most likely) a BIP44 account key.
 * @param {HDPrivateKey|HDPublicKey} key
 * @param {Number?} account
 * @returns {Boolean}
 */

common.isAccount = function isAccount(key, account) {
  if (account != null) {
    const index = (common.HARDENED | account) >>> 0;
    if (key.childIndex !== index)
      return false;
  }
  return key.depth === 3 && (key.childIndex & common.HARDENED) !== 0;
};

/**
 * A compressed pubkey of all zeroes.
 * @const {Buffer}
 * @default
 */

common.ZERO_KEY = Buffer.alloc(33, 0x00);
}],
[/* 53 */ 'blru', '/lib/blru.js', function(exports, module, __filename, __dirname, __meta) {
'use strict';

module.exports = __node_require__(54 /* './lru' */);
}],
[/* 54 */ 'blru', '/lib/lru.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * lru.js - LRU cache for bcoin
 * Copyright (c) 2014-2018, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcoin
 */

'use strict';

const assert = __node_require__(2 /* 'bsert' */);

/**
 * LRU Cache
 */

class LRU {
  /**
   * Create an LRU cache.
   * @constructor
   * @param {Number} capacity
   * @param {Function?} getSize
   * @param {Function?} CustomMap
   */

  constructor(capacity, getSize, CustomMap) {
    assert(typeof capacity === 'number', 'Capacity must be a number.');
    assert(capacity >= 0, 'Capacity cannot be negative.');
    assert(!getSize || typeof getSize === 'function', 'Bad size callback.');
    assert(!CustomMap || typeof CustomMap === 'function');

    this.map = CustomMap ? new CustomMap() : new Map();
    this.size = 0;
    this.items = 0;
    this.head = null;
    this.tail = null;
    this.pending = null;

    this.capacity = capacity;
    this.getSize = getSize;
  }

  /**
   * Calculate size of an item.
   * @private
   * @param {LRUItem} item
   * @returns {Number} Size.
   */

  _getSize(item) {
    if (this.getSize)
      return 120 + this.getSize(item.value, item.key);

    return 1;
  }

  /**
   * Compact the LRU linked list.
   * @private
   */

  _compact() {
    if (this.size <= this.capacity)
      return;

    let item = null;
    let next = null;

    for (item = this.head; item; item = next) {
      if (this.size <= this.capacity)
        break;

      this.size -= this._getSize(item);
      this.items -= 1;
      this.map.delete(item.key);

      next = item.next;

      item.prev = null;
      item.next = null;
    }

    if (!item) {
      this.head = null;
      this.tail = null;
      return;
    }

    this.head = item;
    item.prev = null;
  }

  /**
   * Reset the cache. Clear all items.
   */

  reset() {
    let item, next;

    for (item = this.head; item; item = next) {
      this.map.delete(item.key);
      this.items -= 1;
      next = item.next;
      item.prev = null;
      item.next = null;
    }

    assert(!item);

    this.size = 0;
    this.head = null;
    this.tail = null;
  }

  /**
   * Add an item to the cache.
   * @param {String|Number} key
   * @param {Object} value
   */

  set(key, value) {
    if (this.capacity === 0)
      return;

    let item = this.map.get(key);

    if (item) {
      this.size -= this._getSize(item);
      item.value = value;
      this.size += this._getSize(item);
      this._removeList(item);
      this._appendList(item);
      this._compact();
      return;
    }

    item = new LRUItem(key, value);

    this.map.set(key, item);

    this._appendList(item);

    this.size += this._getSize(item);
    this.items += 1;

    this._compact();
  }

  /**
   * Retrieve an item from the cache.
   * @param {String|Number} key
   * @returns {Object} Item.
   */

  get(key) {
    if (this.capacity === 0)
      return null;

    const item = this.map.get(key);

    if (!item)
      return null;

    this._removeList(item);
    this._appendList(item);

    return item.value;
  }

  /**
   * Test whether the cache contains a key.
   * @param {String|Number} key
   * @returns {Boolean}
   */

  has(key) {
    if (this.capacity === 0)
      return false;
    return this.map.has(key);
  }

  /**
   * Remove an item from the cache.
   * @param {String|Number} key
   * @returns {Boolean} Whether an item was removed.
   */

  remove(key) {
    if (this.capacity === 0)
      return false;

    const item = this.map.get(key);

    if (!item)
      return false;

    this.size -= this._getSize(item);
    this.items -= 1;

    this.map.delete(key);

    this._removeList(item);

    return true;
  }

  /**
   * Prepend an item to the linked list (sets new head).
   * @private
   * @param {LRUItem}
   */

  _prependList(item) {
    this._insertList(null, item);
  }

  /**
   * Append an item to the linked list (sets new tail).
   * @private
   * @param {LRUItem}
   */

  _appendList(item) {
    this._insertList(this.tail, item);
  }

  /**
   * Insert item into the linked list.
   * @private
   * @param {LRUItem|null} ref
   * @param {LRUItem} item
   */

  _insertList(ref, item) {
    assert(!item.next);
    assert(!item.prev);

    if (ref == null) {
      if (!this.head) {
        this.head = item;
        this.tail = item;
      } else {
        this.head.prev = item;
        item.next = this.head;
        this.head = item;
      }
      return;
    }

    item.next = ref.next;
    item.prev = ref;
    ref.next = item;

    if (item.next)
      item.next.prev = item;

    if (ref === this.tail)
      this.tail = item;
  }

  /**
   * Remove item from the linked list.
   * @private
   * @param {LRUItem}
   */

  _removeList(item) {
    if (item.prev)
      item.prev.next = item.next;

    if (item.next)
      item.next.prev = item.prev;

    if (item === this.head)
      this.head = item.next;

    if (item === this.tail)
      this.tail = item.prev || this.head;

    if (!this.head)
      assert(!this.tail);

    if (!this.tail)
      assert(!this.head);

    item.prev = null;
    item.next = null;
  }

  /**
   * Collect all keys in the cache, sorted by LRU.
   * @returns {String[]}
   */

  keys() {
    const items = [];

    for (let item = this.head; item; item = item.next) {
      if (item === this.head)
        assert(!item.prev);
      if (!item.prev)
        assert(item === this.head);
      if (!item.next)
        assert(item === this.tail);
      items.push(item.key);
    }

    return items;
  }

  /**
   * Collect all values in the cache, sorted by LRU.
   * @returns {String[]}
   */

  values() {
    const items = [];

    for (let item = this.head; item; item = item.next)
      items.push(item.value);

    return items;
  }

  /**
   * Convert the LRU cache to an array of items.
   * @returns {Object[]}
   */

  toArray() {
    const items = [];

    for (let item = this.head; item; item = item.next)
      items.push(item);

    return items;
  }

  /**
   * Create an atomic batch for the lru
   * (used for caching database writes).
   * @returns {LRUBatch}
   */

  batch() {
    return new LRUBatch(this);
  }

  /**
   * Start the pending batch.
   */

  start() {
    assert(!this.pending);
    this.pending = this.batch();
  }

  /**
   * Clear the pending batch.
   */

  clear() {
    assert(this.pending);
    this.pending.clear();
  }

  /**
   * Drop the pending batch.
   */

  drop() {
    assert(this.pending);
    this.pending = null;
  }

  /**
   * Commit the pending batch.
   */

  commit() {
    assert(this.pending);
    this.pending.commit();
    this.pending = null;
  }

  /**
   * Push an item onto the pending batch.
   * @param {String} key
   * @param {Object} value
   */

  push(key, value) {
    assert(this.pending);

    if (this.capacity === 0)
      return;

    this.pending.set(key, value);
  }

  /**
   * Push a removal onto the pending batch.
   * @param {String} key
   */

  unpush(key) {
    assert(this.pending);

    if (this.capacity === 0)
      return;

    this.pending.remove(key);
  }
}

/**
 * LRU Item
 * @alias module:utils.LRUItem
 */

class LRUItem {
  /**
   * Create an LRU item.
   * @constructor
   * @private
   * @param {String} key
   * @param {Object} value
   */

  constructor(key, value) {
    this.key = key;
    this.value = value;
    this.next = null;
    this.prev = null;
  }
}

/**
 * LRU Batch
 * @alias module:utils.LRUBatch
 */

class LRUBatch {
  /**
   * Create an LRU batch.
   * @constructor
   * @param {LRU} lru
   */

  constructor(lru) {
    this.lru = lru;
    this.ops = [];
  }

  /**
   * Push an item onto the batch.
   * @param {String} key
   * @param {Object} value
   */

  set(key, value) {
    this.ops.push(new LRUOp(false, key, value));
  }

  /**
   * Push a removal onto the batch.
   * @param {String} key
   */

  remove(key) {
    this.ops.push(new LRUOp(true, key, null));
  }

  /**
   * Clear the batch.
   */

  clear() {
    this.ops.length = 0;
  }

  /**
   * Commit the batch.
   */

  commit() {
    for (const op of this.ops) {
      if (op.remove) {
        this.lru.remove(op.key);
        continue;
      }
      this.lru.set(op.key, op.value);
    }

    this.ops.length = 0;
  }
}

/**
 * LRU Op
 * @alias module:utils.LRUOp
 * @private
 */

class LRUOp {
  /**
   * Create an LRU op.
   * @constructor
   * @param {Boolean} remove
   * @param {String} key
   * @param {Object} value
   */

  constructor(remove, key, value) {
    this.remove = remove;
    this.key = key;
    this.value = value;
  }
}

/*
 * Expose
 */

module.exports = LRU;
}],
[/* 55 */ 'hsd', '/lib/primitives/address.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * address.js - address object for hsd
 * Copyright (c) 2017-2018, Christopher Jeffrey (MIT License).
 * https://github.com/handshake-org/hsd
 */

'use strict';

const assert = __node_require__(2 /* 'bsert' */);
const bio = __node_require__(3 /* 'bufio' */);
const bech32 = __node_require__(56 /* 'bcrypto/lib/encoding/bech32' */);
const blake2b = __node_require__(58 /* 'bcrypto/lib/blake2b' */);
const sha3 = __node_require__(60 /* 'bcrypto/lib/sha3' */);
const Network = __node_require__(44 /* '../protocol/network' */);
const consensus = __node_require__(51 /* '../protocol/consensus' */);

/*
 * Constants
 */

const ZERO_HASH160 = Buffer.alloc(20, 0x00);

/**
 * Address
 * Represents an address.
 * @alias module:primitives.Address
 * @property {Number} version
 * @property {Buffer} hash
 */

class Address extends bio.Struct {
  /**
   * Create an address.
   * @constructor
   * @param {Object?} options
   */

  constructor(options, network) {
    super();

    this.version = 0;
    this.hash = ZERO_HASH160;

    if (options)
      this.fromOptions(options, network);
  }

  /**
   * Inject properties from options object.
   * @private
   * @param {Object} options
   */

  fromOptions(options, network) {
    if (typeof options === 'string')
      return this.fromString(options, network);

    assert(options);

    const {hash, version} = options;

    return this.fromHash(hash, version);
  }

  /**
   * Count the sigops in a script, taking into account witness programs.
   * @param {Witness} witness
   * @returns {Number} sigop count
   */

  getSigops(witness) {
    if (this.version === 0) {
      if (this.hash.length === 20)
        return 1;

      if (this.hash.length === 32 && witness.items.length > 0) {
        const redeem = witness.getRedeem();
        return redeem.getSigops();
      }
    }

    return 0;
  }

  /**
   * Get the address hash.
   * @returns {Hash}
   */

  getHash() {
    return this.hash;
  }

  /**
   * Test whether the address is null.
   * @returns {Boolean}
   */

  isNull() {
    if (this.hash.length === 20)
      return this.hash.equals(ZERO_HASH160);

    if (this.hash.length === 32)
      return this.hash.equals(consensus.ZERO_HASH);

    for (let i = 0; i < this.hash.length; i++) {
      if (this.hash[i] !== 0)
        return false;
    }

    return true;
  }

  /**
   * Test whether the address is unspendable.
   * @returns {Boolean}
   */

  isUnspendable() {
    return this.isNulldata();
  }

  /**
   * Test equality against another address.
   * @param {Address} addr
   * @returns {Boolean}
   */

  equals(addr) {
    assert(addr instanceof Address);

    return this.version === addr.version
      && this.hash.equals(addr.hash);
  }

  /**
   * Compare against another address.
   * @param {Address} addr
   * @returns {Boolean}
   */

  compare(addr) {
    assert(addr instanceof Address);

    const cmp = this.version - addr.version;

    if (cmp !== 0)
      return cmp;

    return this.hash.compare(addr.hash);
  }

  /**
   * Inject properties from another address.
   * @param {Address} addr
   * @returns {Boolean}
   */

  inject(addr) {
    this.version = addr.version;
    this.hash = addr.hash;
    return this;
  }

  /**
   * Clone address.
   * @returns {Address}
   */

  clone() {
    return new this.constructor().inject(this);
  }

  /**
   * Compile the address object to a bech32 address.
   * @param {{NetworkType|Network)?} network
   * @returns {String}
   * @throws Error on bad hash/prefix.
   */

  toString(network) {
    const version = this.version;
    const hash = this.hash;

    assert(version <= 31);
    assert(hash.length >= 2 && hash.length <= 40);

    network = Network.get(network);

    const hrp = network.addressPrefix;

    return bech32.encode(hrp, version, hash);
  }

  /**
   * Instantiate address from pubkey.
   * @param {Buffer} key
   * @returns {Address}
   */

  fromPubkey(key) {
    assert(Buffer.isBuffer(key) && key.length === 33);
    return this.fromHash(blake2b.digest(key, 20), 0);
  }

  /**
   * Instantiate address from script.
   * @param {Script} script
   * @returns {Address}
   */

  fromScript(script) {
    assert(script && typeof script.encode === 'function');
    return this.fromHash(sha3.digest(script.encode()), 0);
  }

  /**
   * Inject properties from bech32 address.
   * @private
   * @param {String} data
   * @param {Network?} network
   * @throws Parse error
   */

  fromString(data, network) {
    assert(typeof data === 'string');

    const [hrp, version, hash] = bech32.decode(data);

    Network.fromAddress(hrp, network);

    return this.fromHash(hash, version);
  }

  /**
   * Inject properties from witness.
   * @private
   * @param {Witness} witness
   */

  fromWitness(witness) {
    const [, pk] = witness.getPubkeyhashInput();

    if (pk) {
      this.hash = blake2b.digest(pk, 20);
      this.version = 0;
      return this;
    }

    const redeem = witness.getScripthashInput();

    if (redeem) {
      this.hash = sha3.digest(redeem);
      this.version = 0;
      return this;
    }

    return null;
  }

  /**
   * Inject properties from a hash.
   * @private
   * @param {Buffer|Hash} hash
   * @param {Number} [version=-1]
   * @throws on bad hash size
   */

  fromHash(hash, version) {
    if (version == null)
      version = 0;

    assert(Buffer.isBuffer(hash));
    assert((version & 0xff) === version);

    assert(version >= 0 && version <= 31, 'Bad program version.');
    assert(hash.length >= 2 && hash.length <= 40, 'Hash is the wrong size.');

    if (version === 0) {
      assert(hash.length === 20 || hash.length === 32,
        'Witness program hash is the wrong size.');
    }

    this.hash = hash;
    this.version = version;

    return this;
  }

  /**
   * Inject properties from witness pubkeyhash.
   * @private
   * @param {Buffer} hash
   * @returns {Address}
   */

  fromPubkeyhash(hash) {
    assert(hash && hash.length === 20, 'P2WPKH must be 20 bytes.');
    return this.fromHash(hash, 0);
  }

  /**
   * Inject properties from witness scripthash.
   * @private
   * @param {Buffer} hash
   * @returns {Address}
   */

  fromScripthash(hash) {
    assert(hash && hash.length === 32, 'P2WSH must be 32 bytes.');
    return this.fromHash(hash, 0);
  }

  /**
   * Inject properties from witness program.
   * @private
   * @param {Number} version
   * @param {Buffer} hash
   * @returns {Address}
   */

  fromProgram(version, hash) {
    assert(version >= 0, 'Bad version for witness program.');
    return this.fromHash(hash, version);
  }

  /**
   * Instantiate address from nulldata.
   * @param {Buffer} data
   * @returns {Address}
   */

  fromNulldata(data) {
    return this.fromHash(data, 31);
  }

  /**
   * Test whether the address is witness pubkeyhash.
   * @returns {Boolean}
   */

  isPubkeyhash() {
    return this.version === 0 && this.hash.length === 20;
  }

  /**
   * Test whether the address is witness scripthash.
   * @returns {Boolean}
   */

  isScripthash() {
    return this.version === 0 && this.hash.length === 32;
  }

  /**
   * Test whether the address is unspendable.
   * @returns {Boolean}
   */

  isNulldata() {
    return this.version === 31;
  }

  /**
   * Test whether the address is an unknown witness program.
   * @returns {Boolean}
   */

  isUnknown() {
    switch (this.version) {
      case 0:
        return this.hash.length !== 20 && this.hash.length !== 32;
      case 31:
        return false;
    }
    return true;
  }

  /**
   * Test address validity.
   * @returns {Boolean}
   */

  isValid() {
    assert(this.version >= 0);

    if (this.version > 31)
      return false;

    if (this.hash.length < 2 || this.hash.length > 40)
      return false;

    return true;
  }

  /**
   * Calculate address size.
   * @returns {Number}
   */

  getSize() {
    return 1 + 1 + this.hash.length;
  }

  /**
   * Write address to buffer writer.
   * @param {BufferWriter} bw
   * @returns {BufferWriter}
   */

  write(bw) {
    bw.writeU8(this.version);
    bw.writeU8(this.hash.length);
    bw.writeBytes(this.hash);
    return bw;
  }

  /**
   * Read address from buffer reader.
   * @param {BufferReader} br
   * @returns {Address}
   */

  read(br) {
    const version = br.readU8();
    assert(version <= 31);

    const size = br.readU8();
    assert(size >= 2 && size <= 40);

    const hash = br.readBytes(size);

    return this.fromHash(hash, version);
  }

  /**
   * Inspect the Address.
   * @returns {Object}
   */

  format() {
    return '<Address:'
      + ` version=${this.version}`
      + ` str=${this.toString()}`
      + '>';
  }

  /**
   * Instantiate address from pubkey.
   * @param {Buffer} key
   * @returns {Address}
   */

  static fromPubkey(key) {
    return new this().fromPubkey(key);
  }

  /**
   * Instantiate address from script.
   * @param {Script} script
   * @returns {Address}
   */

  static fromScript(script) {
    return new this().fromScript(script);
  }

  /**
   * Create an Address from a witness.
   * Attempt to extract address
   * properties from a witness.
   * @param {Witness}
   * @returns {Address|null}
   */

  static fromWitness(witness) {
    return new this().fromWitness(witness);
  }

  /**
   * Create a naked address from hash/version.
   * @param {Hash} hash
   * @param {Number} [version=-1]
   * @returns {Address}
   * @throws on bad hash size
   */

  static fromHash(hash, version) {
    return new this().fromHash(hash, version);
  }

  /**
   * Instantiate address from witness pubkeyhash.
   * @param {Buffer} hash
   * @returns {Address}
   */

  static fromPubkeyhash(hash) {
    return new this().fromPubkeyhash(hash);
  }

  /**
   * Instantiate address from witness scripthash.
   * @param {Buffer} hash
   * @returns {Address}
   */

  static fromScripthash(hash) {
    return new this().fromScripthash(hash);
  }

  /**
   * Instantiate address from witness program.
   * @param {Number} version
   * @param {Buffer} hash
   * @returns {Address}
   */

  static fromProgram(version, hash) {
    return new this().fromProgram(version, hash);
  }

  /**
   * Instantiate address from nulldata.
   * @param {Buffer} data
   * @returns {Address}
   */

  static fromNulldata(data) {
    return new this().fromNulldata(data);
  }

  /**
   * Get the hash of a base58 address or address-related object.
   * @param {String|Address|Hash} data
   * @param {Network?} network
   * @returns {Hash}
   */

  static getHash(data, network) {
    if (!data)
      throw new Error('Object is not an address.');

    if (Buffer.isBuffer(data)) {
      return data;
    }

    if (data instanceof Address)
      return data.hash;

    throw new Error('Object is not an address.');
  }
}

/*
 * Expose
 */

module.exports = Address;
}],
[/* 56 */ 'bcrypto', '/lib/encoding/bech32-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * bech32.js - bech32 for bcrypto
 * Copyright (c) 2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(57 /* '../js/bech32' */);
}],
[/* 57 */ 'bcrypto', '/lib/js/bech32.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * bech32.js - bech32 for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on sipa/bech32:
 *   Copyright (c) 2017, Pieter Wuille (MIT License).
 *   https://github.com/sipa/bech32
 *
 * Resources:
 *   https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki
 *   https://github.com/sipa/bech32/blob/master/ref/c/segwit_addr.c
 *   https://github.com/bitcoin/bitcoin/blob/master/src/bech32.cpp
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);

/**
 * Constants
 */

const POOL65 = Buffer.alloc(65);
const CHARSET = 'qpzry9x8gf2tvdw0s3jn54khce6mua7l';

const TABLE = [
  -1, -1, -1, -1, -1, -1, -1, -1,
  -1, -1, -1, -1, -1, -1, -1, -1,
  -1, -1, -1, -1, -1, -1, -1, -1,
  -1, -1, -1, -1, -1, -1, -1, -1,
  -1, -1, -1, -1, -1, -1, -1, -1,
  -1, -1, -1, -1, -1, -1, -1, -1,
  15, -1, 10, 17, 21, 20, 26, 30,
   7,  5, -1, -1, -1, -1, -1, -1,
  -1, 29, -1, 24, 13, 25,  9,  8,
  23, -1, 18, 22, 31, 27, 19, -1,
   1,  0,  3, 16, 11, 28, 12, 14,
   6,  4,  2, -1, -1, -1, -1, -1,
  -1, 29, -1, 24, 13, 25,  9,  8,
  23, -1, 18, 22, 31, 27, 19, -1,
   1,  0,  3, 16, 11, 28, 12, 14,
   6,  4,  2, -1, -1, -1, -1, -1
];

/**
 * Update checksum.
 * @ignore
 * @param {Number} c
 * @returns {Number}
 */

function polymod(c) {
  const b = c >>> 25;

  return ((c & 0x1ffffff) << 5)
    ^ (0x3b6a57b2 & -((b >> 0) & 1))
    ^ (0x26508e6d & -((b >> 1) & 1))
    ^ (0x1ea119fa & -((b >> 2) & 1))
    ^ (0x3d4233dd & -((b >> 3) & 1))
    ^ (0x2a1462b3 & -((b >> 4) & 1));
}

/**
 * Encode hrp and data as a bech32 string.
 * @param {String} hrp
 * @param {Buffer} data
 * @returns {String}
 */

function serialize(hrp, data) {
  assert(typeof hrp === 'string');
  assert(Buffer.isBuffer(data));

  if (hrp.length === 0 || hrp.length > 83)
    throw new Error('Invalid bech32 human-readable part.');

  if (hrp.length + 1 + data.length + 6 > 90)
    throw new Error('Invalid bech32 data length.');

  let str = '';
  let chk = 1;
  let i;

  for (i = 0; i < hrp.length; i++) {
    const ch = hrp.charCodeAt(i);

    if (ch < 33 || ch > 126)
      throw new Error('Invalid bech32 character.');

    if (ch >= 65 && ch <= 90)
      throw new Error('Invalid bech32 character.');

    chk = polymod(chk) ^ (ch >> 5);
  }

  chk = polymod(chk);

  for (let i = 0; i < hrp.length; i++) {
    const ch = hrp.charCodeAt(i);

    chk = polymod(chk) ^ (ch & 0x1f);

    str += hrp[i];
  }

  str += '1';

  for (let i = 0; i < data.length; i++) {
    const ch = data[i];

    if (ch >> 5)
      throw new Error('Invalid bech32 value.');

    chk = polymod(chk) ^ ch;

    str += CHARSET[ch];
  }

  for (let i = 0; i < 6; i++)
    chk = polymod(chk);

  chk ^= 1;

  for (let i = 0; i < 6; i++)
    str += CHARSET[(chk >>> ((5 - i) * 5)) & 0x1f];

  return str;
}

/**
 * Decode a bech32 string.
 * @param {String} str
 * @returns {Array} [hrp, data]
 */

function deserialize(str) {
  assert(typeof str === 'string');

  if (str.length < 8 || str.length > 90)
    throw new Error('Invalid bech32 string length.');

  let lower = false;
  let upper = false;
  let hlen = 0;

  for (let i = 0; i < str.length; i++) {
    const ch = str.charCodeAt(i);

    if (ch < 33 || ch > 126)
      throw new Error('Invalid bech32 character.');

    if (ch >= 97 && ch <= 122)
      lower = true;
    else if (ch >= 65 && ch <= 90)
      upper = true;
    else if (ch === 49)
      hlen = i;
  }

  if (hlen === 0)
    throw new Error('Invalid bech32 human-readable part.');

  const dlen = str.length - (hlen + 1);

  if (dlen < 6)
    throw new Error('Invalid bech32 data length.');

  if (lower && upper)
    throw new Error('Invalid bech32 casing.');

  let chk = 1;
  let hrp = '';

  for (let i = 0; i < hlen; i++) {
    let ch = str.charCodeAt(i);

    if (ch >= 65 && ch <= 90)
      ch += 32;

    chk = polymod(chk) ^ (ch >> 5);

    hrp += String.fromCharCode(ch);
  }

  chk = polymod(chk);

  for (let i = 0; i < hlen; i++)
    chk = polymod(chk) ^ (str.charCodeAt(i) & 0x1f);

  const data = Buffer.alloc(dlen - 6);

  let j = 0;

  for (let i = hlen + 1; i < str.length; i++) {
    const val = TABLE[str.charCodeAt(i)];

    if (val === -1)
      throw new Error('Invalid bech32 character.');

    chk = polymod(chk) ^ val;

    if (i < str.length - 6)
      data[j++] = val;
  }

  if (chk !== 1)
    throw new Error('Invalid bech32 checksum.');

  assert(j === data.length);

  return [hrp, data];
}

/**
 * Test whether a string is a bech32 string.
 * @param {String} str
 * @returns {Boolean}
 */

function is(str) {
  assert(typeof str === 'string');

  try {
    deserialize(str);
    return true;
  } catch (e) {
    return false;
  }
}

/**
 * Convert serialized data to another base.
 * @param {Buffer} dst
 * @param {Number} dstoff
 * @param {Number} dstbits
 * @param {Buffer} src
 * @param {Number} srcoff
 * @param {Number} srcbits
 * @param {Boolean} pad
 * @returns {Buffer}
 */

function convert(dst, dstoff, dstbits, src, srcoff, srcbits, pad) {
  assert(Buffer.isBuffer(dst));
  assert((dstoff >>> 0) === dstoff);
  assert((dstbits >>> 0) === dstbits);
  assert(Buffer.isBuffer(src));
  assert((srcoff >>> 0) === srcoff);
  assert((srcbits >>> 0) === srcbits);
  assert(typeof pad === 'boolean');
  assert(dstbits >= 1 && dstbits <= 8);
  assert(srcbits >= 1 && srcbits <= 8);

  const mask = (1 << dstbits) - 1;

  let acc = 0;
  let bits = 0;
  let i = srcoff;
  let j = dstoff;

  for (; i < src.length; i++) {
    acc = (acc << srcbits) | src[i];
    bits += srcbits;

    while (bits >= dstbits) {
      bits -= dstbits;
      dst[j++] = (acc >>> bits) & mask;
    }
  }

  const left = dstbits - bits;

  if (pad) {
    if (bits)
      dst[j++] = (acc << left) & mask;
  } else {
    if (((acc << left) & mask) || bits >= srcbits)
      throw new Error('Invalid bits.');
  }

  assert(j <= dst.length);

  return dst.slice(0, j);
}

/**
 * Calculate size required for bit conversion.
 * @param {Number} len
 * @param {Number} srcbits
 * @param {Number} dstbits
 * @param {Boolean} pad
 * @returns {Number}
 */

function convertSize(len, srcbits, dstbits, pad) {
  assert((len >>> 0) === len);
  assert((srcbits >>> 0) === srcbits);
  assert((dstbits >>> 0) === dstbits);
  assert(typeof pad === 'boolean');
  assert(srcbits >= 1 && srcbits <= 8);
  assert(dstbits >= 1 && dstbits <= 8);

  return ((len * srcbits + (dstbits - 1) * (pad | 0)) / dstbits) >>> 0;
}

/**
 * Convert serialized data to another base.
 * @param {Buffer} data
 * @param {Number} srcbits
 * @param {Number} dstbits
 * @param {Boolean} pad
 * @returns {Buffer}
 */

function convertBits(data, srcbits, dstbits, pad) {
  assert(Buffer.isBuffer(data));

  const size = convertSize(data.length, srcbits, dstbits, pad);
  const out = Buffer.alloc(size);

  return convert(out, 0, dstbits, data, 0, srcbits, pad);
}

/**
 * Serialize data to bech32 address.
 * @param {String} hrp
 * @param {Number} version
 * @param {Buffer} hash
 * @returns {String}
 */

function encode(hrp, version, hash) {
  assert(typeof hrp === 'string');
  assert((version >>> 0) === version);
  assert(Buffer.isBuffer(hash));

  if (version > 31)
    throw new Error('Invalid bech32 version.');

  if (hash.length < 2 || hash.length > 40)
    throw new Error('Invalid bech32 data length.');

  const out = POOL65;

  out[0] = version;

  const data = convert(out, 1, 5, hash, 0, 8, true);

  return serialize(hrp, data);
}

/**
 * Deserialize data from bech32 address.
 * @param {String} addr
 * @returns {Array}
 */

function decode(addr) {
  const [hrp, data] = deserialize(addr);

  if (data.length === 0 || data.length > 65)
    throw new Error('Invalid bech32 data length.');

  const version = data[0];

  if (version > 31)
    throw new Error('Invalid bech32 version.');

  const output = data; // Works because dstbits > srcbits.
  const hash = convert(output, 0, 8, data, 1, 5, false);

  if (hash.length < 2 || hash.length > 40)
    throw new Error('Invalid bech32 data length.');

  return [hrp, version, hash];
}

/**
 * Test whether a string is a bech32 string.
 * @param {String} addr
 * @returns {Boolean}
 */

function test(addr) {
  assert(typeof addr === 'string');

  try {
    decode(addr);
    return true;
  } catch (e) {
    return false;
  }
}

/*
 * Expose
 */

exports.native = 0;
exports.serialize = serialize;
exports.deserialize = deserialize;
exports.is = is;
exports.convertBits = convertBits;
exports.encode = encode;
exports.decode = decode;
exports.test = test;
}],
[/* 58 */ 'bcrypto', '/lib/blake2b-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * blake2b.js - blake2b for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(59 /* './js/blake2b' */);
}],
[/* 59 */ 'bcrypto', '/lib/js/blake2b.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * blake2b.js - BLAKE2b implementation for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on dcposch/blakejs:
 *   Daniel Clemens Posch (CC0)
 *   https://github.com/dcposch/blakejs/blob/master/blake2b.js
 *
 * Resources:
 *   https://en.wikipedia.org/wiki/BLAKE_(hash_function)
 *   https://tools.ietf.org/html/rfc7693
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);
const HMAC = __node_require__(17 /* '../internal/hmac' */);

/*
 * Constants
 */

const FINALIZED = 0x80000000;

const IV = new Uint32Array([
  0xf3bcc908, 0x6a09e667, 0x84caa73b, 0xbb67ae85,
  0xfe94f82b, 0x3c6ef372, 0x5f1d36f1, 0xa54ff53a,
  0xade682d1, 0x510e527f, 0x2b3e6c1f, 0x9b05688c,
  0xfb41bd6b, 0x1f83d9ab, 0x137e2179, 0x5be0cd19
]);

const SIGMA = new Uint8Array([
  0x00, 0x02, 0x04, 0x06, 0x08, 0x0a, 0x0c, 0x0e,
  0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,
  0x1c, 0x14, 0x08, 0x10, 0x12, 0x1e, 0x1a, 0x0c,
  0x02, 0x18, 0x00, 0x04, 0x16, 0x0e, 0x0a, 0x06,
  0x16, 0x10, 0x18, 0x00, 0x0a, 0x04, 0x1e, 0x1a,
  0x14, 0x1c, 0x06, 0x0c, 0x0e, 0x02, 0x12, 0x08,
  0x0e, 0x12, 0x06, 0x02, 0x1a, 0x18, 0x16, 0x1c,
  0x04, 0x0c, 0x0a, 0x14, 0x08, 0x00, 0x1e, 0x10,
  0x12, 0x00, 0x0a, 0x0e, 0x04, 0x08, 0x14, 0x1e,
  0x1c, 0x02, 0x16, 0x18, 0x0c, 0x10, 0x06, 0x1a,
  0x04, 0x18, 0x0c, 0x14, 0x00, 0x16, 0x10, 0x06,
  0x08, 0x1a, 0x0e, 0x0a, 0x1e, 0x1c, 0x02, 0x12,
  0x18, 0x0a, 0x02, 0x1e, 0x1c, 0x1a, 0x08, 0x14,
  0x00, 0x0e, 0x0c, 0x06, 0x12, 0x04, 0x10, 0x16,
  0x1a, 0x16, 0x0e, 0x1c, 0x18, 0x02, 0x06, 0x12,
  0x0a, 0x00, 0x1e, 0x08, 0x10, 0x0c, 0x04, 0x14,
  0x0c, 0x1e, 0x1c, 0x12, 0x16, 0x06, 0x00, 0x10,
  0x18, 0x04, 0x1a, 0x0e, 0x02, 0x08, 0x14, 0x0a,
  0x14, 0x04, 0x10, 0x08, 0x0e, 0x0c, 0x02, 0x0a,
  0x1e, 0x16, 0x12, 0x1c, 0x06, 0x18, 0x1a, 0x00,
  0x00, 0x02, 0x04, 0x06, 0x08, 0x0a, 0x0c, 0x0e,
  0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,
  0x1c, 0x14, 0x08, 0x10, 0x12, 0x1e, 0x1a, 0x0c,
  0x02, 0x18, 0x00, 0x04, 0x16, 0x0e, 0x0a, 0x06
]);

/**
 * BLAKE2b
 */

class BLAKE2b {
  constructor() {
    this.state = new Uint32Array(16);
    this.V = new Uint32Array(32);
    this.M = new Uint32Array(32);
    this.block = Buffer.alloc(128);
    this.size = 32;
    this.count = 0;
    this.pos = FINALIZED;
  }

  init(size, key) {
    if (size == null)
      size = 32;

    assert((size >>> 0) === size);
    assert(key == null || Buffer.isBuffer(key));

    if (size === 0 || size > 64)
      throw new Error('Bad output length.');

    if (key && key.length > 64)
      throw new Error('Bad key length.');

    const klen = key ? key.length : 0;

    for (let i = 0; i < 16; i++)
      this.state[i] = IV[i];

    this.size = size;
    this.count = 0;
    this.pos = 0;

    this.state[0] ^= 0x01010000 ^ (klen << 8) ^ this.size;

    if (klen > 0) {
      const block = Buffer.alloc(128, 0x00);

      key.copy(block, 0);

      this.update(block);
    }

    return this;
  }

  update(data) {
    assert(Buffer.isBuffer(data));
    assert(!(this.pos & FINALIZED), 'Context is not initialized.');

    let off = 0;
    let len = data.length;

    if (len > 0) {
      const left = this.pos;
      const fill = 128 - left;

      if (len > fill) {
        this.pos = 0;

        data.copy(this.block, left, off, off + fill);

        this.count += 128;
        this._compress(this.block, 0, false);

        off += fill;
        len -= fill;

        while (len > 128) {
          this.count += 128;
          this._compress(data, off, false);
          off += 128;
          len -= 128;
        }
      }

      data.copy(this.block, this.pos, off, off + len);

      this.pos += len;
    }

    return this;
  }

  final() {
    assert(!(this.pos & FINALIZED), 'Context is not initialized.');

    this.count += this.pos;
    this.block.fill(0, this.pos, 128);
    this._compress(this.block, 0, true);
    this.pos = FINALIZED;

    const out = Buffer.alloc(this.size);

    for (let i = 0; i < this.size; i++)
      out[i] = this.state[i >>> 2] >>> (8 * (i & 3));

    for (let i = 0; i < 16; i++)
      this.state[i] = 0;

    for (let i = 0; i < 32; i++) {
      this.V[i] = 0;
      this.M[i] = 0;
    }

    for (let i = 0; i < 128; i++)
      this.block[i] = 0;

    return out;
  }

  _compress(block, off, last) {
    const {V, M} = this;

    for (let i = 0; i < 16; i++) {
      V[i] = this.state[i];
      V[i + 16] = IV[i];
    }

    // uint128
    V[24] ^= this.count;
    V[25] ^= this.count * (1 / 0x100000000);
    V[26] ^= 0;
    V[27] ^= 0;

    if (last) {
      // last block
      V[28] ^= -1;
      V[29] ^= -1;

      // last node
      V[29] ^= 0;
      V[30] ^= 0;
    }

    for (let i = 0; i < 32; i++) {
      M[i] = readU32(block, off);
      off += 4;
    }

    for (let i = 0; i < 12; i++) {
      G(V, M, 0, 8, 16, 24, SIGMA[i * 16 + 0], SIGMA[i * 16 + 1]);
      G(V, M, 2, 10, 18, 26, SIGMA[i * 16 + 2], SIGMA[i * 16 + 3]);
      G(V, M, 4, 12, 20, 28, SIGMA[i * 16 + 4], SIGMA[i * 16 + 5]);
      G(V, M, 6, 14, 22, 30, SIGMA[i * 16 + 6], SIGMA[i * 16 + 7]);
      G(V, M, 0, 10, 20, 30, SIGMA[i * 16 + 8], SIGMA[i * 16 + 9]);
      G(V, M, 2, 12, 22, 24, SIGMA[i * 16 + 10], SIGMA[i * 16 + 11]);
      G(V, M, 4, 14, 16, 26, SIGMA[i * 16 + 12], SIGMA[i * 16 + 13]);
      G(V, M, 6, 8, 18, 28, SIGMA[i * 16 + 14], SIGMA[i * 16 + 15]);
    }

    for (let i = 0; i < 16; i++)
      this.state[i] ^= V[i] ^ V[i + 16];
  }

  static hash() {
    return new BLAKE2b();
  }

  static hmac(size) {
    return new HMAC(BLAKE2b, 128, [size]);
  }

  static digest(data, size, key) {
    const {ctx} = BLAKE2b;

    ctx.init(size, key);
    ctx.update(data);

    return ctx.final();
  }

  static root(left, right, size, key) {
    if (size == null)
      size = 32;

    assert(Buffer.isBuffer(left) && left.length === size);
    assert(Buffer.isBuffer(right) && right.length === size);

    const {ctx} = BLAKE2b;

    ctx.init(size, key);
    ctx.update(left);
    ctx.update(right);

    return ctx.final();
  }

  static multi(x, y, z, size, key) {
    const {ctx} = BLAKE2b;

    ctx.init(size, key);
    ctx.update(x);
    ctx.update(y);

    if (z)
      ctx.update(z);

    return ctx.final();
  }

  static mac(data, key, size) {
    return BLAKE2b.hmac(size).init(key).update(data).final();
  }
}

/*
 * Static
 */

BLAKE2b.native = 0;
BLAKE2b.id = 'BLAKE2B256';
BLAKE2b.size = 32;
BLAKE2b.bits = 256;
BLAKE2b.blockSize = 128;
BLAKE2b.zero = Buffer.alloc(32, 0x00);
BLAKE2b.ctx = new BLAKE2b();

/*
 * Helpers
 */

function sum64i(v, a, b) {
  const o0 = v[a + 0] + v[b + 0];
  const o1 = v[a + 1] + v[b + 1];
  const c = (o0 >= 0x100000000) | 0;

  v[a + 0] = o0;
  v[a + 1] = o1 + c;
}

function sum64w(v, a, b0, b1) {
  const o0 = v[a + 0] + b0;
  const o1 = v[a + 1] + b1;
  const c = (o0 >= 0x100000000) | 0;

  v[a + 0] = o0;
  v[a + 1] = o1 + c;
}

function G(v, m, a, b, c, d, ix, iy) {
  const x0 = m[ix + 0];
  const x1 = m[ix + 1];
  const y0 = m[iy + 0];
  const y1 = m[iy + 1];

  sum64i(v, a, b);
  sum64w(v, a, x0, x1);

  const xor0 = v[d + 0] ^ v[a + 0];
  const xor1 = v[d + 1] ^ v[a + 1];

  v[d + 0] = xor1;
  v[d + 1] = xor0;

  sum64i(v, c, d);

  const xor2 = v[b + 0] ^ v[c + 0];
  const xor3 = v[b + 1] ^ v[c + 1];

  v[b + 0] = (xor2 >>> 24) ^ (xor3 << 8);
  v[b + 1] = (xor3 >>> 24) ^ (xor2 << 8);

  sum64i(v, a, b);
  sum64w(v, a, y0, y1);

  const xor4 = v[d + 0] ^ v[a + 0];
  const xor5 = v[d + 1] ^ v[a + 1];

  v[d + 0] = (xor4 >>> 16) ^ (xor5 << 16);
  v[d + 1] = (xor5 >>> 16) ^ (xor4 << 16);

  sum64i(v, c, d);

  const xor6 = v[b + 0] ^ v[c + 0];
  const xor7 = v[b + 1] ^ v[c + 1];

  v[b + 0] = (xor7 >>> 31) ^ (xor6 << 1);
  v[b + 1] = (xor6 >>> 31) ^ (xor7 << 1);
}

function readU32(data, off) {
  return (data[off++]
        + data[off++] * 0x100
        + data[off++] * 0x10000
        + data[off] * 0x1000000);
}

/*
 * Expose
 */

module.exports = BLAKE2b;
}],
[/* 60 */ 'bcrypto', '/lib/sha3-browser.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * sha3.js - sha3 for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 */

'use strict';

module.exports = __node_require__(61 /* './js/sha3' */);
}],
[/* 61 */ 'bcrypto', '/lib/js/sha3.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * sha3.js - SHA3 implementation for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Resources:
 *   https://en.wikipedia.org/wiki/SHA-3
 *   https://keccak.team/specifications.html
 *   https://csrc.nist.gov/projects/hash-functions/sha-3-project/sha-3-standardization
 *   http://dx.doi.org/10.6028/NIST.FIPS.202
 */

'use strict';

const Keccak = __node_require__(62 /* './keccak' */);

/**
 * SHA3
 */

class SHA3 extends Keccak {
  constructor() {
    super();
  }

  final() {
    return super.final(0x06, null);
  }

  static hash() {
    return new SHA3();
  }

  static hmac(bits) {
    return super.hmac(bits, 0x06, null);
  }

  static digest(data, bits) {
    return super.digest(data, bits, 0x06, null);
  }

  static root(left, right, bits) {
    return super.root(left, right, bits, 0x06, null);
  }

  static multi(x, y, z, bits) {
    return super.multi(x, y, z, bits, 0x06, null);
  }

  static mac(data, key, bits) {
    return super.mac(data, key, bits, 0x06, null);
  }
}

/*
 * Static
 */

SHA3.native = 0;
SHA3.id = 'SHA3_256';
SHA3.size = 32;
SHA3.bits = 256;
SHA3.blockSize = 136;
SHA3.zero = Buffer.alloc(32, 0x00);
SHA3.ctx = new SHA3();

/*
 * Expose
 */

module.exports = SHA3;
}],
[/* 62 */ 'bcrypto', '/lib/js/keccak.js', function(exports, module, __filename, __dirname, __meta) {
/*!
 * keccak.js - Keccak/SHA3 implementation for bcrypto
 * Copyright (c) 2017-2019, Christopher Jeffrey (MIT License).
 * https://github.com/bcoin-org/bcrypto
 *
 * Parts of this software are based on emn178/js-sha3:
 *   Copyright (c) 2015-2017, Chen, Yi-Cyuan (MIT License).
 *   https://github.com/emn178/js-sha3
 *
 * Parts of this software are based on rhash/RHash:
 *   Copyright (c) 2005-2014, Aleksey Kravchenko
 *   https://github.com/rhash/RHash
 *
 * Resources:
 *   https://en.wikipedia.org/wiki/SHA-3
 *   https://keccak.team/specifications.html
 *   https://csrc.nist.gov/projects/hash-functions/sha-3-project/sha-3-standardization
 *   http://dx.doi.org/10.6028/NIST.FIPS.202
 *   https://github.com/rhash/RHash/blob/master/librhash/sha3.c
 *   https://github.com/emn178/js-sha3/blob/master/src/sha3.js
 */

'use strict';

const assert = __node_require__(14 /* '../internal/assert' */);
const HMAC = __node_require__(17 /* '../internal/hmac' */);

/*
 * Constants
 */

const FINALIZED = 0x80000000;

const ROUND_CONST = new Uint32Array([
  0x00000001, 0x00000000, 0x00008082, 0x00000000,
  0x0000808a, 0x80000000, 0x80008000, 0x80000000,
  0x0000808b, 0x00000000, 0x80000001, 0x00000000,
  0x80008081, 0x80000000, 0x00008009, 0x80000000,
  0x0000008a, 0x00000000, 0x00000088, 0x00000000,
  0x80008009, 0x00000000, 0x8000000a, 0x00000000,
  0x8000808b, 0x00000000, 0x0000008b, 0x80000000,
  0x00008089, 0x80000000, 0x00008003, 0x80000000,
  0x00008002, 0x80000000, 0x00000080, 0x80000000,
  0x0000800a, 0x00000000, 0x8000000a, 0x80000000,
  0x80008081, 0x80000000, 0x00008080, 0x80000000,
  0x80000001, 0x00000000, 0x80008008, 0x80000000
]);

/**
 * Keccak
 */

class Keccak {
  constructor() {
    this.state = new Uint32Array(50);
    this.block = Buffer.alloc(200);
    this.bs = 136;
    this.pos = FINALIZED;
  }

  init(bits) {
    if (bits == null)
      bits = 256;

    assert((bits >>> 0) === bits);
    assert(bits >= 128);
    assert(bits <= 512);

    const rate = 1600 - bits * 2;

    assert(rate >= 0 && (rate & 63) === 0);

    this.bs = rate >>> 3;
    this.pos = 0;

    return this;
  }

  update(data) {
    assert(Buffer.isBuffer(data));
    assert(!(this.pos & FINALIZED), 'Context is not initialized.');

    let len = data.length;
    let pos = this.pos;
    let off = 0;

    this.pos = (this.pos + len) % this.bs;

    if (pos > 0) {
      let want = this.bs - pos;

      if (want > len)
        want = len;

      data.copy(this.block, pos, off, off + want);

      pos += want;
      len -= want;
      off += want;

      if (pos < this.bs)
        return this;

      this._transform(this.block, 0);
    }

    while (len >= this.bs) {
      this._transform(data, off);
      off += this.bs;
      len -= this.bs;
    }

    if (len > 0)
      data.copy(this.block, 0, off, off + len);

    return this;
  }

  final(pad, len) {
    if (pad == null)
      pad = 0x01;

    if (len == null || len === 0)
      len = 100 - (this.bs >>> 1);

    assert((pad & 0xff) === pad);
    assert((len >>> 0) === len);
    assert(!(this.pos & FINALIZED), 'Context is not initialized.');

    this.block.fill(0, this.pos, this.bs);
    this.block[this.pos] |= pad;
    this.block[this.bs - 1] |= 0x80;
    this._transform(this.block, 0);
    this.pos = FINALIZED;

    assert(len <= this.bs);

    const out = Buffer.alloc(len);

    for (let i = 0; i < len; i++)
      out[i] = this.state[i >>> 2] >>> (8 * (i & 3));

    for (let i = 0; i < 50; i++)
      this.state[i] = 0;

    for (let i = 0; i < this.bs; i++)
      this.block[i] = 0;

    return out;
  }

  _transform(block, off) {
    const count = this.bs >>> 2;
    const s = this.state;

    for (let i = 0; i < count; i++)
      s[i] ^= readU32(block, off + i * 4);

    for (let n = 0; n < 48; n += 2) {
      const c0 = s[0] ^ s[10] ^ s[20] ^ s[30] ^ s[40];
      const c1 = s[1] ^ s[11] ^ s[21] ^ s[31] ^ s[41];
      const c2 = s[2] ^ s[12] ^ s[22] ^ s[32] ^ s[42];
      const c3 = s[3] ^ s[13] ^ s[23] ^ s[33] ^ s[43];
      const c4 = s[4] ^ s[14] ^ s[24] ^ s[34] ^ s[44];
      const c5 = s[5] ^ s[15] ^ s[25] ^ s[35] ^ s[45];
      const c6 = s[6] ^ s[16] ^ s[26] ^ s[36] ^ s[46];
      const c7 = s[7] ^ s[17] ^ s[27] ^ s[37] ^ s[47];
      const c8 = s[8] ^ s[18] ^ s[28] ^ s[38] ^ s[48];
      const c9 = s[9] ^ s[19] ^ s[29] ^ s[39] ^ s[49];

      const h0 = c8 ^ ((c2 << 1) | (c3 >>> 31));
      const l0 = c9 ^ ((c3 << 1) | (c2 >>> 31));
      const h1 = c0 ^ ((c4 << 1) | (c5 >>> 31));
      const l1 = c1 ^ ((c5 << 1) | (c4 >>> 31));
      const h2 = c2 ^ ((c6 << 1) | (c7 >>> 31));
      const l2 = c3 ^ ((c7 << 1) | (c6 >>> 31));
      const h3 = c4 ^ ((c8 << 1) | (c9 >>> 31));
      const l3 = c5 ^ ((c9 << 1) | (c8 >>> 31));
      const h4 = c6 ^ ((c0 << 1) | (c1 >>> 31));
      const l4 = c7 ^ ((c1 << 1) | (c0 >>> 31));

      s[0] ^= h0;
      s[1] ^= l0;
      s[10] ^= h0;
      s[11] ^= l0;
      s[20] ^= h0;
      s[21] ^= l0;
      s[30] ^= h0;
      s[31] ^= l0;
      s[40] ^= h0;
      s[41] ^= l0;

      s[2] ^= h1;
      s[3] ^= l1;
      s[12] ^= h1;
      s[13] ^= l1;
      s[22] ^= h1;
      s[23] ^= l1;
      s[32] ^= h1;
      s[33] ^= l1;
      s[42] ^= h1;
      s[43] ^= l1;

      s[4] ^= h2;
      s[5] ^= l2;
      s[14] ^= h2;
      s[15] ^= l2;
      s[24] ^= h2;
      s[25] ^= l2;
      s[34] ^= h2;
      s[35] ^= l2;
      s[44] ^= h2;
      s[45] ^= l2;

      s[6] ^= h3;
      s[7] ^= l3;
      s[16] ^= h3;
      s[17] ^= l3;
      s[26] ^= h3;
      s[27] ^= l3;
      s[36] ^= h3;
      s[37] ^= l3;
      s[46] ^= h3;
      s[47] ^= l3;

      s[8] ^= h4;
      s[9] ^= l4;
      s[18] ^= h4;
      s[19] ^= l4;
      s[28] ^= h4;
      s[29] ^= l4;
      s[38] ^= h4;
      s[39] ^= l4;
      s[48] ^= h4;
      s[49] ^= l4;

      const b0 = s[0];
      const b1 = s[1];
      const b32 = (s[11] << 4) | (s[10] >>> 28);
      const b33 = (s[10] << 4) | (s[11] >>> 28);
      const b14 = (s[20] << 3) | (s[21] >>> 29);
      const b15 = (s[21] << 3) | (s[20] >>> 29);
      const b46 = (s[31] << 9) | (s[30] >>> 23);
      const b47 = (s[30] << 9) | (s[31] >>> 23);
      const b28 = (s[40] << 18) | (s[41] >>> 14);
      const b29 = (s[41] << 18) | (s[40] >>> 14);
      const b20 = (s[2] << 1) | (s[3] >>> 31);
      const b21 = (s[3] << 1) | (s[2] >>> 31);
      const b2 = (s[13] << 12) | (s[12] >>> 20);
      const b3 = (s[12] << 12) | (s[13] >>> 20);
      const b34 = (s[22] << 10) | (s[23] >>> 22);
      const b35 = (s[23] << 10) | (s[22] >>> 22);
      const b16 = (s[33] << 13) | (s[32] >>> 19);
      const b17 = (s[32] << 13) | (s[33] >>> 19);
      const b48 = (s[42] << 2) | (s[43] >>> 30);
      const b49 = (s[43] << 2) | (s[42] >>> 30);
      const b40 = (s[5] << 30) | (s[4] >>> 2);
      const b41 = (s[4] << 30) | (s[5] >>> 2);
      const b22 = (s[14] << 6) | (s[15] >>> 26);
      const b23 = (s[15] << 6) | (s[14] >>> 26);
      const b4 = (s[25] << 11) | (s[24] >>> 21);
      const b5 = (s[24] << 11) | (s[25] >>> 21);
      const b36 = (s[34] << 15) | (s[35] >>> 17);
      const b37 = (s[35] << 15) | (s[34] >>> 17);
      const b18 = (s[45] << 29) | (s[44] >>> 3);
      const b19 = (s[44] << 29) | (s[45] >>> 3);
      const b10 = (s[6] << 28) | (s[7] >>> 4);
      const b11 = (s[7] << 28) | (s[6] >>> 4);
      const b42 = (s[17] << 23) | (s[16] >>> 9);
      const b43 = (s[16] << 23) | (s[17] >>> 9);
      const b24 = (s[26] << 25) | (s[27] >>> 7);
      const b25 = (s[27] << 25) | (s[26] >>> 7);
      const b6 = (s[36] << 21) | (s[37] >>> 11);
      const b7 = (s[37] << 21) | (s[36] >>> 11);
      const b38 = (s[47] << 24) | (s[46] >>> 8);
      const b39 = (s[46] << 24) | (s[47] >>> 8);
      const b30 = (s[8] << 27) | (s[9] >>> 5);
      const b31 = (s[9] << 27) | (s[8] >>> 5);
      const b12 = (s[18] << 20) | (s[19] >>> 12);
      const b13 = (s[19] << 20) | (s[18] >>> 12);
      const b44 = (s[29] << 7) | (s[28] >>> 25);
      const b45 = (s[28] << 7) | (s[29] >>> 25);
      const b26 = (s[38] << 8) | (s[39] >>> 24);
      const b27 = (s[39] << 8) | (s[38] >>> 24);
      const b8 = (s[48] << 14) | (s[49] >>> 18);
      const b9 = (s[49] << 14) | (s[48] >>> 18);

      s[0] = b0 ^ (~b2 & b4);
      s[1] = b1 ^ (~b3 & b5);
      s[10] = b10 ^ (~b12 & b14);
      s[11] = b11 ^ (~b13 & b15);
      s[20] = b20 ^ (~b22 & b24);
      s[21] = b21 ^ (~b23 & b25);
      s[30] = b30 ^ (~b32 & b34);
      s[31] = b31 ^ (~b33 & b35);
      s[40] = b40 ^ (~b42 & b44);
      s[41] = b41 ^ (~b43 & b45);
      s[2] = b2 ^ (~b4 & b6);
      s[3] = b3 ^ (~b5 & b7);
      s[12] = b12 ^ (~b14 & b16);
      s[13] = b13 ^ (~b15 & b17);
      s[22] = b22 ^ (~b24 & b26);
      s[23] = b23 ^ (~b25 & b27);
      s[32] = b32 ^ (~b34 & b36);
      s[33] = b33 ^ (~b35 & b37);
      s[42] = b42 ^ (~b44 & b46);
      s[43] = b43 ^ (~b45 & b47);
      s[4] = b4 ^ (~b6 & b8);
      s[5] = b5 ^ (~b7 & b9);
      s[14] = b14 ^ (~b16 & b18);
      s[15] = b15 ^ (~b17 & b19);
      s[24] = b24 ^ (~b26 & b28);
      s[25] = b25 ^ (~b27 & b29);
      s[34] = b34 ^ (~b36 & b38);
      s[35] = b35 ^ (~b37 & b39);
      s[44] = b44 ^ (~b46 & b48);
      s[45] = b45 ^ (~b47 & b49);
      s[6] = b6 ^ (~b8 & b0);
      s[7] = b7 ^ (~b9 & b1);
      s[16] = b16 ^ (~b18 & b10);
      s[17] = b17 ^ (~b19 & b11);
      s[26] = b26 ^ (~b28 & b20);
      s[27] = b27 ^ (~b29 & b21);
      s[36] = b36 ^ (~b38 & b30);
      s[37] = b37 ^ (~b39 & b31);
      s[46] = b46 ^ (~b48 & b40);
      s[47] = b47 ^ (~b49 & b41);
      s[8] = b8 ^ (~b0 & b2);
      s[9] = b9 ^ (~b1 & b3);
      s[18] = b18 ^ (~b10 & b12);
      s[19] = b19 ^ (~b11 & b13);
      s[28] = b28 ^ (~b20 & b22);
      s[29] = b29 ^ (~b21 & b23);
      s[38] = b38 ^ (~b30 & b32);
      s[39] = b39 ^ (~b31 & b33);
      s[48] = b48 ^ (~b40 & b42);
      s[49] = b49 ^ (~b41 & b43);

      s[0] ^= ROUND_CONST[n + 0];
      s[1] ^= ROUND_CONST[n + 1];
    }
  }

  static hash() {
    return new Keccak();
  }

  static hmac(bits, pad, len) {
    if (bits == null)
      bits = 256;

    assert((bits >>> 0) === bits);

    const rate = 1600 - bits * 2;

    assert(rate >= 0 && (rate & 63) === 0);

    return new HMAC(Keccak, rate >>> 3, [bits], [pad, len]);
  }

  static digest(data, bits, pad, len) {
    return Keccak.ctx.init(bits).update(data).final(pad, len);
  }

  static root(left, right, bits, pad, len) {
    if (bits == null)
      bits = 256;

    if (len == null)
      len = 0;

    if (len === 0)
      len = bits >>> 3;

    assert((bits >>> 0) === bits);
    assert((bits & 7) === 0);
    assert((len >>> 0) === len);
    assert(Buffer.isBuffer(left) && left.length === len);
    assert(Buffer.isBuffer(right) && right.length === len);

    return Keccak.ctx.init(bits).update(left).update(right).final(pad, len);
  }

  static multi(x, y, z, bits, pad, len) {
    const {ctx} = Keccak;

    ctx.init(bits);
    ctx.update(x);
    ctx.update(y);

    if (z)
      ctx.update(z);

    return ctx.final(pad, len);
  }

  static mac(data, key, bits, pad, len) {
    return Keccak.hmac(bits, pad, len).init(key).update(data).final();
  }
}

/*
 * Static
 */

Keccak.native = 0;
Keccak.id = 'KECCAK256';
Keccak.size = 32;
Keccak.bits = 256;
Keccak.blockSize = 136;
Keccak.zero = Buffer.alloc(32, 0x00);
Keccak.ctx = new Keccak();

/*
 * Helpers
 */

function readU32(data, off) {
  return (data[off++]
        + data[off++] * 0x100
        + data[off++] * 0x10000
        + data[off] * 0x1000000);
}

/*
 * Expose
 */

module.exports = Keccak;
}]
];

var __node_cache__ = [];

function __node_error__(location) {
  var err = new Error('Cannot find module \'' + location + '\'');
  err.code = 'MODULE_NOT_FOUND';
  throw err;
}

function __node_require__(id) {
  if ((id >>> 0) !== id || id > __node_modules__.length)
    return __node_error__(id);

  while (__node_cache__.length <= id)
    __node_cache__.push(null);

  var cache = __node_cache__[id];

  if (cache)
    return cache.exports;

  var mod = __node_modules__[id];
  var name = mod[0];
  var path = mod[1];
  var func = mod[2];
  var meta;

  var _exports = exports;
  var _module = module;

  if (id !== 0) {
    _exports = {};
    _module = {
      id: '/' + name + path,
      exports: _exports,
      parent: module.parent,
      filename: module.filename,
      loaded: false,
      children: module.children,
      paths: module.paths
    };
  }

  __node_cache__[id] = _module;

  try {
    func.call(_exports, _exports, _module,
              __filename, __dirname, meta);
  } catch (e) {
    __node_cache__[id] = null;
    throw e;
  }

  __node_modules__[id] = null;

  if (id !== 0)
    _module.loaded = true;

  return _module.exports;
}

__node_require__(0);