// Code generated by Fiat Cryptography. DO NOT EDIT.
//
// Autogenerated: word_by_word_montgomery --lang Go --cmovznz-by-mul --relax-primitive-carry-to-bitwidth 32,64 --public-function-case camelCase --public-type-case camelCase --private-function-case camelCase --private-type-case camelCase --doc-text-before-function-name '' --doc-newline-before-package-declaration --doc-prepend-header 'Code generated by Fiat Cryptography. DO NOT EDIT.' --package-name edwards25519 Scalar 64 '2^252 + 27742317777372353535851937790883648493' mul add sub opp nonzero from_montgomery to_montgomery to_bytes from_bytes
//
// curve description: Scalar
//
// machine_wordsize = 64 (from "64")
//
// requested operations: mul, add, sub, opp, nonzero, from_montgomery, to_montgomery, to_bytes, from_bytes
//
// m = 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3ed (from "2^252 + 27742317777372353535851937790883648493")
//
//
//
// NOTE: In addition to the bounds specified above each function, all
//
//   functions synthesized for this Montgomery arithmetic require the
//
//   input to be strictly less than the prime modulus (m), and also
//
//   require the input to be in the unique saturated representation.
//
//   All functions also ensure that these two properties are true of
//
//   return values.
//
//
//
// Computed values:
//
//   eval z = z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192)
//
//   bytes_eval z = z[0] + (z[1] << 8) + (z[2] << 16) + (z[3] << 24) + (z[4] << 32) + (z[5] << 40) + (z[6] << 48) + (z[7] << 56) + (z[8] << 64) + (z[9] << 72) + (z[10] << 80) + (z[11] << 88) + (z[12] << 96) + (z[13] << 104) + (z[14] << 112) + (z[15] << 120) + (z[16] << 128) + (z[17] << 136) + (z[18] << 144) + (z[19] << 152) + (z[20] << 160) + (z[21] << 168) + (z[22] << 176) + (z[23] << 184) + (z[24] << 192) + (z[25] << 200) + (z[26] << 208) + (z[27] << 216) + (z[28] << 224) + (z[29] << 232) + (z[30] << 240) + (z[31] << 248)
//
//   twos_complement_eval z = let x1 := z[0] + (z[1] << 64) + (z[2] << 128) + (z[3] << 192) in
//
//                            if x1 & (2^256-1) < 2^255 then x1 & (2^256-1) else (x1 & (2^256-1)) - 2^256

package edwards25519

import 

type fiatScalarUint1 uint64 // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927
type fiatScalarInt1 int64   // We use uint64 instead of a more narrow type for performance reasons; see https://github.com/mit-plv/fiat-crypto/pull/1006#issuecomment-892625927

// The type fiatScalarMontgomeryDomainFieldElement is a field element in the Montgomery domain.
//
// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
type fiatScalarMontgomeryDomainFieldElement [4]uint64

// The type fiatScalarNonMontgomeryDomainFieldElement is a field element NOT in the Montgomery domain.
//
// Bounds: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
type fiatScalarNonMontgomeryDomainFieldElement [4]uint64

// fiatScalarCmovznzU64 is a single-word conditional move.
//
// Postconditions:
//
//	out1 = (if arg1 = 0 then arg2 else arg3)
//
// Input Bounds:
//
//	arg1: [0x0 ~> 0x1]
//	arg2: [0x0 ~> 0xffffffffffffffff]
//	arg3: [0x0 ~> 0xffffffffffffffff]
//
// Output Bounds:
//
//	out1: [0x0 ~> 0xffffffffffffffff]
func fiatScalarCmovznzU64( *uint64,  fiatScalarUint1,  uint64,  uint64) {
	 := (uint64() * 0xffffffffffffffff)
	 := (( & ) | ((^) & ))
	* = 
}

// fiatScalarMul multiplies two field elements in the Montgomery domain.
//
// Preconditions:
//
//	0 ≤ eval arg1 < m
//	0 ≤ eval arg2 < m
//
// Postconditions:
//
//	eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) * eval (from_montgomery arg2)) mod m
//	0 ≤ eval out1 < m
func fiatScalarMul( *fiatScalarMontgomeryDomainFieldElement,  *fiatScalarMontgomeryDomainFieldElement,  *fiatScalarMontgomeryDomainFieldElement) {
	 := [1]
	 := [2]
	 := [3]
	 := [0]
	var  uint64
	var  uint64
	,  = bits.Mul64(, [3])
	var  uint64
	var  uint64
	,  = bits.Mul64(, [2])
	var  uint64
	var  uint64
	,  = bits.Mul64(, [1])
	var  uint64
	var  uint64
	,  = bits.Mul64(, [0])
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	 := (uint64(fiatScalarUint1()) + )
	var  uint64
	_,  = bits.Mul64(, 0xd2b51da312547e1b)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x1000000000000000)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x14def9dea2f79cd6)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x5812631a5cf5d3ed)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	 := (uint64(fiatScalarUint1()) + )
	var  uint64
	_,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Mul64(, [3])
	var  uint64
	var  uint64
	,  = bits.Mul64(, [2])
	var  uint64
	var  uint64
	,  = bits.Mul64(, [1])
	var  uint64
	var  uint64
	,  = bits.Mul64(, [0])
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	 := (uint64(fiatScalarUint1()) + )
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(uint64(fiatScalarUint1()), , uint64(fiatScalarUint1()))
	var  uint64
	_,  = bits.Mul64(, 0xd2b51da312547e1b)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x1000000000000000)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x14def9dea2f79cd6)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x5812631a5cf5d3ed)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	 := (uint64(fiatScalarUint1()) + )
	var  uint64
	_,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	 := (uint64(fiatScalarUint1()) + uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Mul64(, [3])
	var  uint64
	var  uint64
	,  = bits.Mul64(, [2])
	var  uint64
	var  uint64
	,  = bits.Mul64(, [1])
	var  uint64
	var  uint64
	,  = bits.Mul64(, [0])
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	 := (uint64(fiatScalarUint1()) + )
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	_,  = bits.Mul64(, 0xd2b51da312547e1b)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x1000000000000000)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x14def9dea2f79cd6)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x5812631a5cf5d3ed)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	 := (uint64(fiatScalarUint1()) + )
	var  uint64
	_,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	 := (uint64(fiatScalarUint1()) + uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Mul64(, [3])
	var  uint64
	var  uint64
	,  = bits.Mul64(, [2])
	var  uint64
	var  uint64
	,  = bits.Mul64(, [1])
	var  uint64
	var  uint64
	,  = bits.Mul64(, [0])
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	 := (uint64(fiatScalarUint1()) + )
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	_,  = bits.Mul64(, 0xd2b51da312547e1b)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x1000000000000000)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x14def9dea2f79cd6)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x5812631a5cf5d3ed)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	 := (uint64(fiatScalarUint1()) + )
	var  uint64
	_,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	 := (uint64(fiatScalarUint1()) + uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64(, 0x5812631a5cf5d3ed, uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Sub64(, 0x14def9dea2f79cd6, uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64(, uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64(, 0x1000000000000000, uint64(fiatScalarUint1()))
	var  uint64
	_,  = bits.Sub64(, uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	[0] = 
	[1] = 
	[2] = 
	[3] = 
}

// fiatScalarAdd adds two field elements in the Montgomery domain.
//
// Preconditions:
//
//	0 ≤ eval arg1 < m
//	0 ≤ eval arg2 < m
//
// Postconditions:
//
//	eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) + eval (from_montgomery arg2)) mod m
//	0 ≤ eval out1 < m
func fiatScalarAdd( *fiatScalarMontgomeryDomainFieldElement,  *fiatScalarMontgomeryDomainFieldElement,  *fiatScalarMontgomeryDomainFieldElement) {
	var  uint64
	var  uint64
	,  = bits.Add64([0], [0], uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64([1], [1], uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64([2], [2], uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64([3], [3], uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64(, 0x5812631a5cf5d3ed, uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Sub64(, 0x14def9dea2f79cd6, uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64(, uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64(, 0x1000000000000000, uint64(fiatScalarUint1()))
	var  uint64
	_,  = bits.Sub64(uint64(fiatScalarUint1()), uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	[0] = 
	[1] = 
	[2] = 
	[3] = 
}

// fiatScalarSub subtracts two field elements in the Montgomery domain.
//
// Preconditions:
//
//	0 ≤ eval arg1 < m
//	0 ≤ eval arg2 < m
//
// Postconditions:
//
//	eval (from_montgomery out1) mod m = (eval (from_montgomery arg1) - eval (from_montgomery arg2)) mod m
//	0 ≤ eval out1 < m
func fiatScalarSub( *fiatScalarMontgomeryDomainFieldElement,  *fiatScalarMontgomeryDomainFieldElement,  *fiatScalarMontgomeryDomainFieldElement) {
	var  uint64
	var  uint64
	,  = bits.Sub64([0], [0], uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Sub64([1], [1], uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64([2], [2], uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64([3], [3], uint64(fiatScalarUint1()))
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), uint64(0x0), 0xffffffffffffffff)
	var  uint64
	var  uint64
	,  = bits.Add64(, ( & 0x5812631a5cf5d3ed), uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, ( & 0x14def9dea2f79cd6), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	, _ = bits.Add64(, ( & 0x1000000000000000), uint64(fiatScalarUint1()))
	[0] = 
	[1] = 
	[2] = 
	[3] = 
}

// fiatScalarOpp negates a field element in the Montgomery domain.
//
// Preconditions:
//
//	0 ≤ eval arg1 < m
//
// Postconditions:
//
//	eval (from_montgomery out1) mod m = -eval (from_montgomery arg1) mod m
//	0 ≤ eval out1 < m
func fiatScalarOpp( *fiatScalarMontgomeryDomainFieldElement,  *fiatScalarMontgomeryDomainFieldElement) {
	var  uint64
	var  uint64
	,  = bits.Sub64(uint64(0x0), [0], uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Sub64(uint64(0x0), [1], uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64(uint64(0x0), [2], uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64(uint64(0x0), [3], uint64(fiatScalarUint1()))
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), uint64(0x0), 0xffffffffffffffff)
	var  uint64
	var  uint64
	,  = bits.Add64(, ( & 0x5812631a5cf5d3ed), uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, ( & 0x14def9dea2f79cd6), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	, _ = bits.Add64(, ( & 0x1000000000000000), uint64(fiatScalarUint1()))
	[0] = 
	[1] = 
	[2] = 
	[3] = 
}

// fiatScalarNonzero outputs a single non-zero word if the input is non-zero and zero otherwise.
//
// Preconditions:
//
//	0 ≤ eval arg1 < m
//
// Postconditions:
//
//	out1 = 0 ↔ eval (from_montgomery arg1) mod m = 0
//
// Input Bounds:
//
//	arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff]]
//
// Output Bounds:
//
//	out1: [0x0 ~> 0xffffffffffffffff]
func fiatScalarNonzero( *uint64,  *[4]uint64) {
	 := ([0] | ([1] | ([2] | [3])))
	* = 
}

// fiatScalarFromMontgomery translates a field element out of the Montgomery domain.
//
// Preconditions:
//
//	0 ≤ eval arg1 < m
//
// Postconditions:
//
//	eval out1 mod m = (eval arg1 * ((2^64)⁻¹ mod m)^4) mod m
//	0 ≤ eval out1 < m
func fiatScalarFromMontgomery( *fiatScalarNonMontgomeryDomainFieldElement,  *fiatScalarMontgomeryDomainFieldElement) {
	 := [0]
	var  uint64
	_,  = bits.Mul64(, 0xd2b51da312547e1b)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x1000000000000000)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x14def9dea2f79cd6)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x5812631a5cf5d3ed)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	_,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(uint64(0x0), , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, [1], uint64(0x0))
	var  uint64
	_,  = bits.Mul64(, 0xd2b51da312547e1b)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x1000000000000000)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x14def9dea2f79cd6)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x5812631a5cf5d3ed)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	_,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64((uint64(fiatScalarUint1()) + (uint64(fiatScalarUint1()) + (uint64(fiatScalarUint1()) + ))), , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, (uint64(fiatScalarUint1()) + ), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, [2], uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	_,  = bits.Mul64(, 0xd2b51da312547e1b)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x1000000000000000)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x14def9dea2f79cd6)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x5812631a5cf5d3ed)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	_,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, (uint64(fiatScalarUint1()) + ), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64((uint64(fiatScalarUint1()) + (uint64(fiatScalarUint1()) + )), , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, [3], uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	_,  = bits.Mul64(, 0xd2b51da312547e1b)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x1000000000000000)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x14def9dea2f79cd6)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x5812631a5cf5d3ed)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	_,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, (uint64(fiatScalarUint1()) + ), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64((uint64(fiatScalarUint1()) + (uint64(fiatScalarUint1()) + )), , uint64(fiatScalarUint1()))
	 := (uint64(fiatScalarUint1()) + )
	var  uint64
	var  uint64
	,  = bits.Sub64(, 0x5812631a5cf5d3ed, uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Sub64(, 0x14def9dea2f79cd6, uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64(, uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64(, 0x1000000000000000, uint64(fiatScalarUint1()))
	var  uint64
	_,  = bits.Sub64(uint64(0x0), uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	[0] = 
	[1] = 
	[2] = 
	[3] = 
}

// fiatScalarToMontgomery translates a field element into the Montgomery domain.
//
// Preconditions:
//
//	0 ≤ eval arg1 < m
//
// Postconditions:
//
//	eval (from_montgomery out1) mod m = eval arg1 mod m
//	0 ≤ eval out1 < m
func fiatScalarToMontgomery( *fiatScalarMontgomeryDomainFieldElement,  *fiatScalarNonMontgomeryDomainFieldElement) {
	 := [1]
	 := [2]
	 := [3]
	 := [0]
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x399411b7c309a3d)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0xceec73d217f5be65)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0xd00e1ba768859347)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0xa40611e3449c0f01)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	_,  = bits.Mul64(, 0xd2b51da312547e1b)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x1000000000000000)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x14def9dea2f79cd6)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x5812631a5cf5d3ed)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	_,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, (uint64(fiatScalarUint1()) + ), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x399411b7c309a3d)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0xceec73d217f5be65)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0xd00e1ba768859347)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0xa40611e3449c0f01)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(((uint64(fiatScalarUint1()) + (uint64(fiatScalarUint1()) + )) + ), , uint64(fiatScalarUint1()))
	var  uint64
	_,  = bits.Mul64(, 0xd2b51da312547e1b)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x1000000000000000)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x14def9dea2f79cd6)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x5812631a5cf5d3ed)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	_,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, (uint64(fiatScalarUint1()) + ), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x399411b7c309a3d)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0xceec73d217f5be65)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0xd00e1ba768859347)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0xa40611e3449c0f01)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(((uint64(fiatScalarUint1()) + (uint64(fiatScalarUint1()) + (uint64(fiatScalarUint1()) + ))) + ), , uint64(fiatScalarUint1()))
	var  uint64
	_,  = bits.Mul64(, 0xd2b51da312547e1b)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x1000000000000000)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x14def9dea2f79cd6)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x5812631a5cf5d3ed)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	_,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, (uint64(fiatScalarUint1()) + ), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x399411b7c309a3d)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0xceec73d217f5be65)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0xd00e1ba768859347)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0xa40611e3449c0f01)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(((uint64(fiatScalarUint1()) + (uint64(fiatScalarUint1()) + (uint64(fiatScalarUint1()) + ))) + ), , uint64(fiatScalarUint1()))
	var  uint64
	_,  = bits.Mul64(, 0xd2b51da312547e1b)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x1000000000000000)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x14def9dea2f79cd6)
	var  uint64
	var  uint64
	,  = bits.Mul64(, 0x5812631a5cf5d3ed)
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(0x0))
	var  uint64
	_,  = bits.Add64(, , uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, (uint64(fiatScalarUint1()) + ), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Add64(, , uint64(fiatScalarUint1()))
	 := ((uint64(fiatScalarUint1()) + (uint64(fiatScalarUint1()) + (uint64(fiatScalarUint1()) + ))) + )
	var  uint64
	var  uint64
	,  = bits.Sub64(, 0x5812631a5cf5d3ed, uint64(0x0))
	var  uint64
	var  uint64
	,  = bits.Sub64(, 0x14def9dea2f79cd6, uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64(, uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	var  uint64
	,  = bits.Sub64(, 0x1000000000000000, uint64(fiatScalarUint1()))
	var  uint64
	_,  = bits.Sub64(uint64(0x0), uint64(0x0), uint64(fiatScalarUint1()))
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	var  uint64
	fiatScalarCmovznzU64(&, fiatScalarUint1(), , )
	[0] = 
	[1] = 
	[2] = 
	[3] = 
}

// fiatScalarToBytes serializes a field element NOT in the Montgomery domain to bytes in little-endian order.
//
// Preconditions:
//
//	0 ≤ eval arg1 < m
//
// Postconditions:
//
//	out1 = map (λ x, ⌊((eval arg1 mod m) mod 2^(8 * (x + 1))) / 2^(8 * x)⌋) [0..31]
//
// Input Bounds:
//
//	arg1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]]
//
// Output Bounds:
//
//	out1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]]
func fiatScalarToBytes( *[32]uint8,  *[4]uint64) {
	 := [3]
	 := [2]
	 := [1]
	 := [0]
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := uint8(( >> 8))
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := uint8(( >> 8))
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := uint8(( >> 8))
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := ( >> 8)
	 := (uint8() & 0xff)
	 := uint8(( >> 8))
	[0] = 
	[1] = 
	[2] = 
	[3] = 
	[4] = 
	[5] = 
	[6] = 
	[7] = 
	[8] = 
	[9] = 
	[10] = 
	[11] = 
	[12] = 
	[13] = 
	[14] = 
	[15] = 
	[16] = 
	[17] = 
	[18] = 
	[19] = 
	[20] = 
	[21] = 
	[22] = 
	[23] = 
	[24] = 
	[25] = 
	[26] = 
	[27] = 
	[28] = 
	[29] = 
	[30] = 
	[31] = 
}

// fiatScalarFromBytes deserializes a field element NOT in the Montgomery domain from bytes in little-endian order.
//
// Preconditions:
//
//	0 ≤ bytes_eval arg1 < m
//
// Postconditions:
//
//	eval out1 mod m = bytes_eval arg1 mod m
//	0 ≤ eval out1 < m
//
// Input Bounds:
//
//	arg1: [[0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0xff], [0x0 ~> 0x1f]]
//
// Output Bounds:
//
//	out1: [[0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0xffffffffffffffff], [0x0 ~> 0x1fffffffffffffff]]
func fiatScalarFromBytes( *[4]uint64,  *[32]uint8) {
	 := (uint64([31]) << 56)
	 := (uint64([30]) << 48)
	 := (uint64([29]) << 40)
	 := (uint64([28]) << 32)
	 := (uint64([27]) << 24)
	 := (uint64([26]) << 16)
	 := (uint64([25]) << 8)
	 := [24]
	 := (uint64([23]) << 56)
	 := (uint64([22]) << 48)
	 := (uint64([21]) << 40)
	 := (uint64([20]) << 32)
	 := (uint64([19]) << 24)
	 := (uint64([18]) << 16)
	 := (uint64([17]) << 8)
	 := [16]
	 := (uint64([15]) << 56)
	 := (uint64([14]) << 48)
	 := (uint64([13]) << 40)
	 := (uint64([12]) << 32)
	 := (uint64([11]) << 24)
	 := (uint64([10]) << 16)
	 := (uint64([9]) << 8)
	 := [8]
	 := (uint64([7]) << 56)
	 := (uint64([6]) << 48)
	 := (uint64([5]) << 40)
	 := (uint64([4]) << 32)
	 := (uint64([3]) << 24)
	 := (uint64([2]) << 16)
	 := (uint64([1]) << 8)
	 := [0]
	 := ( + uint64())
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + uint64())
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + uint64())
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + uint64())
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + )
	 := ( + )
	[0] = 
	[1] = 
	[2] = 
	[3] = 
}