@blamejs/blamejs-shop 0.5.19 → 0.5.21

package/lib/vendor/blamejs/lib/vendor/noble-post-quantum.cjs

@@ -1,4 +1,4 @@
-// @noble/post-quantum v0.6.1 — vendored from Paul Miller
+// @noble/post-quantum v0.7.0 — vendored from Paul Miller
 // License: MIT — https://github.com/paulmillr/noble-post-quantum
 // Bundled with esbuild. Exports: ml_kem512 / ml_kem768 / ml_kem1024 (FIPS 203 KEM),
 //   ml_dsa44 / ml_dsa65 / ml_dsa87 (FIPS 204 lattice signatures),
@@ -40,7 +40,7 @@ __export(entry_exports, {
 module.exports = __toCommonJS(entry_exports);
 
 // node_modules/@noble/hashes/_u64.js
-var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+var U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
 var _32n = /* @__PURE__ */ BigInt(32);
 function fromBig(n, le = false) {
   if (le)
@@ -57,16 +57,20 @@ function split(lst, le = false) {
   }
   return [Ah, Al];
 }
+var fromNumH = (n) => n / 2 ** 32 | 0;
+var fromNumL = (n) => n >>> 0;
+function setU64FromNum(view, byteOffset, n, isLE2) {
+  const h = fromNumH(n);
+  const l = fromNumL(n);
+  view.setUint32(byteOffset, isLE2 ? l : h, isLE2);
+  view.setUint32(byteOffset + 4, isLE2 ? h : l, isLE2);
+}
 var shrSH = (h, _l, s) => h >>> s;
 var shrSL = (h, l, s) => h << 32 - s | l >>> s;
 var rotrSH = (h, l, s) => h >>> s | l << 32 - s;
 var rotrSL = (h, l, s) => h << 32 - s | l >>> s;
 var rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
 var rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
-var rotlSH = (h, l, s) => h << s | l >>> 32 - s;
-var rotlSL = (h, l, s) => l << s | h >>> 32 - s;
-var rotlBH = (h, l, s) => l << s - 32 | h >>> 64 - s;
-var rotlBL = (h, l, s) => h << s - 32 | l >>> 64 - s;
 function add(Ah, Al, Bh, Bl) {
   const l = (Al >>> 0) + (Bl >>> 0);
   return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
@@ -82,52 +86,55 @@ var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
+var atitle = (title) => title ? `"${title}" ` : "";
 function anumber(n, title = "") {
-  if (typeof n !== "number") {
-    const prefix = title && `"${title}" `;
-    throw new TypeError(`${prefix}expected number, got ${typeof n}`);
-  }
-  if (!Number.isSafeInteger(n) || n < 0) {
-    const prefix = title && `"${title}" `;
-    throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
-  }
+  if (typeof n !== "number")
+    throw new TypeError(atitle(title) + "expected number, got " + typeof n);
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new RangeError(atitle(title) + "expected integer >= 0, got " + n);
+  return n;
+}
+function abool(value, title = "") {
+  if (typeof value !== "boolean")
+    throw new TypeError(atitle(title) + "expected boolean, got type=" + typeof value);
+  return value;
 }
 function abytes(value, length, title = "") {
+  if (isBytes(value) && (length === void 0 || value.length === length))
+    return value;
+  if (length !== void 0)
+    anumber(length, "length");
   const bytes = isBytes(value);
-  const len = value?.length;
-  const needsLen = length !== void 0;
-  if (!bytes || needsLen && len !== length) {
-    const prefix = title && `"${title}" `;
-    const ofLen = needsLen ? ` of length ${length}` : "";
-    const got = bytes ? `length=${len}` : `type=${typeof value}`;
-    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
-    if (!bytes)
-      throw new TypeError(message);
-    throw new RangeError(message);
-  }
-  return value;
+  const ofLen = length !== void 0 ? ` of length ${length}` : "";
+  const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+  const message = atitle(title) + "expected Uint8Array" + ofLen + ", got " + got;
+  if (!bytes)
+    throw new TypeError(message);
+  throw new RangeError(message);
 }
 function ahash(h) {
   if (typeof h !== "function" || typeof h.create !== "function")
-    throw new TypeError("Hash must wrapped by utils.createHasher");
+    throw new TypeError("expected hash wrapped by utils.createHasher");
   anumber(h.outputLen);
   anumber(h.blockLen);
-  if (h.outputLen < 1)
-    throw new Error('"outputLen" must be >= 1');
-  if (h.blockLen < 1)
-    throw new Error('"blockLen" must be >= 1');
+  if (h.outputLen < 1 || h.blockLen < 1)
+    throw new Error("hash blockLen / outputLen must be >= 1");
 }
+var aobject = (value, label) => {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
+};
 function aexists(instance, checkFinished = true) {
   if (instance.destroyed)
-    throw new Error("Hash instance has been destroyed");
+    throw new Error("hash was destroyed");
   if (checkFinished && instance.finished)
-    throw new Error("Hash#digest() has already been called");
+    throw new Error("digest() was already called");
 }
 function aoutput(out, instance) {
-  abytes(out, void 0, "digestInto() output");
+  abytes(out, void 0, "output");
   const min = instance.outputLen;
-  if (out.length < min) {
-    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+  if (!(out.length >= min)) {
+    throw new RangeError('"output" expected length >= ' + min);
   }
 }
 function u32(arr) {
@@ -170,15 +177,8 @@ function bytesToHex(bytes) {
   }
   return hex;
 }
-var asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
 function asciiToBase16(ch) {
-  if (ch >= asciis._0 && ch <= asciis._9)
-    return ch - asciis._0;
-  if (ch >= asciis.A && ch <= asciis.F)
-    return ch - (asciis.A - 10);
-  if (ch >= asciis.a && ch <= asciis.f)
-    return ch - (asciis.a - 10);
-  return;
+  return ch >= 48 && ch <= 57 ? ch - 48 : ch >= 65 && ch <= 70 ? ch - (65 - 10) : ch >= 97 && ch <= 102 ? ch - (97 - 10) : void 0;
 }
 function hexToBytes(hex) {
   if (typeof hex !== "string")
@@ -223,7 +223,17 @@ function concatBytes(...arrays) {
   }
   return res;
 }
+function checkOpts(defaults, opts2, title = "opts") {
+  aobject(defaults, "defaults");
+  if (opts2 !== void 0)
+    aobject(opts2, title);
+  const merged = Object.assign(defaults, opts2);
+  return merged;
+}
 function createHasher(hashCons, info = {}) {
+  if (typeof hashCons !== "function")
+    throw new TypeError('"hashCons" expected function, got type=' + typeof hashCons);
+  info = checkOpts({}, info, "info");
   const hashC = (msg, opts2) => hashCons(opts2).update(msg).digest();
   const tmp = hashCons(void 0);
   hashC.outputLen = tmp.outputLen;
@@ -273,13 +283,21 @@ for (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {
 var IOTAS = split(_SHA3_IOTA, true);
 var SHA3_IOTA_H = IOTAS[0];
 var SHA3_IOTA_L = IOTAS[1];
+var rotlSH = (h, l, s) => h << s | l >>> 32 - s;
+var rotlSL = (h, l, s) => l << s | h >>> 32 - s;
+var rotlBH = (h, l, s) => l << s - 32 | h >>> 64 - s;
+var rotlBL = (h, l, s) => h << s - 32 | l >>> 64 - s;
 var rotlH = (h, l, s) => s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s);
 var rotlL = (h, l, s) => s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s);
+var B = new Uint32Array(5 * 2);
 function keccakP(s, rounds = 24) {
+  if (!(s instanceof Uint32Array))
+    throw new TypeError('"s" expected Uint32Array(50), got type=' + typeof s);
+  if (s.length !== 50)
+    throw new RangeError('"s" expected Uint32Array(50), got length=' + s.length);
   anumber(rounds, "rounds");
   if (rounds < 1 || rounds > 24)
     throw new Error('"rounds" expected integer 1..24');
-  const B = new Uint32Array(5 * 2);
   for (let round = 24 - rounds; round < 24; round++) {
     for (let x = 0; x < 10; x++)
       B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
@@ -340,6 +358,10 @@ var Keccak = class _Keccak {
   rounds;
   // NOTE: we accept arguments in bytes instead of bits here.
   constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
+    anumber(blockLen, "blockLen");
+    anumber(suffix, "suffix");
+    anumber(rounds, "rounds");
+    abool(enableXOF, "enableXOF");
     this.blockLen = blockLen;
     this.suffix = suffix;
     this.outputLen = outputLen;
@@ -348,7 +370,7 @@ var Keccak = class _Keccak {
     this.rounds = rounds;
     anumber(outputLen, "outputLen");
     if (!(0 < blockLen && blockLen < 200))
-      throw new Error("only keccak-f1600 function is supported");
+      throw new Error('"blockLen" must be 1..199');
     this.state = new Uint8Array(200);
     this.state32 = u32(this.state);
   }
@@ -365,9 +387,20 @@ var Keccak = class _Keccak {
   update(data) {
     aexists(this);
     abytes(data);
-    const { blockLen, state } = this;
+    const { blockLen, state, state32 } = this;
     const len = data.length;
+    const canUseU32 = blockLen % 4 === 0 && data.byteOffset % 4 === 0;
+    const blockLen32 = blockLen / 4;
+    const data32 = canUseU32 && len >= blockLen ? u32(data) : void 0;
     for (let pos = 0; pos < len; ) {
+      if (data32 !== void 0 && this.pos === 0 && pos % 4 === 0 && len - pos >= blockLen) {
+        for (let i = 0, o = pos / 4; i < blockLen32; i++)
+          state32[i] ^= data32[o + i];
+        pos += blockLen;
+        this.pos = blockLen;
+        this.keccak();
+        continue;
+      }
       const take = Math.min(blockLen - this.pos, len - pos);
       for (let i = 0; i < take; i++)
         state[this.pos++] ^= data[pos++];
@@ -405,7 +438,7 @@ var Keccak = class _Keccak {
   }
   xofInto(out) {
     if (!this.enableXOF)
-      throw new Error("XOF is not possible for this instance");
+      throw new Error("XOF is not enabled");
     return this.writeInto(out);
   }
   xof(bytes) {
@@ -416,7 +449,7 @@ var Keccak = class _Keccak {
     aoutput(out, this);
     if (this.finished)
       throw new Error("digest() was already called");
-    this.writeInto(out.subarray(0, this.outputLen));
+    this.writeInto(out.length === this.outputLen ? out : out.subarray(0, this.outputLen));
     this.destroy();
   }
   digest() {
@@ -458,22 +491,94 @@ var sha3_512 = /* @__PURE__ */ genKeccak(
   64,
   /* @__PURE__ */ oidNist(10)
 );
-var genShake = (suffix, blockLen, outputLen, info = {}) => createHasher((opts2 = {}) => new Keccak(blockLen, suffix, opts2.dkLen === void 0 ? outputLen : opts2.dkLen, true), info);
+var genShake = (suffix, blockLen, outputLen, info = {}) => createHasher((opts2 = {}) => {
+  opts2 = checkOpts({}, opts2);
+  return new Keccak(blockLen, suffix, opts2.dkLen === void 0 ? outputLen : opts2.dkLen, true);
+}, info);
 var shake128 = /* @__PURE__ */ genShake(31, 168, 16, /* @__PURE__ */ oidNist(11));
 var shake256 = /* @__PURE__ */ genShake(31, 136, 32, /* @__PURE__ */ oidNist(12));
 
+// node_modules/@noble/curves/utils.js
+var anumber2 = anumber;
+function aobject2(value, title = "object") {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError(title === "object" ? "expected valid options object" : `"${title}" expected object, got type=${typeof value}`);
+  return value;
+}
+var _0n2 = /* @__PURE__ */ BigInt(0);
+var atitle2 = (title) => title ? `"${title}" ` : "";
+function abool2(value, title = "") {
+  if (typeof value !== "boolean")
+    throw new TypeError(atitle2(title) + "expected boolean, got type=" + typeof value);
+  return value;
+}
+function abignumber(n) {
+  if (typeof n === "bigint") {
+    if (!isPosBig(n))
+      throw new RangeError("positive bigint expected, got " + n);
+  } else
+    anumber2(n);
+  return n;
+}
+function hexToNumber(hex) {
+  if (typeof hex !== "string")
+    throw new TypeError("hex string expected, got " + typeof hex);
+  return hex === "" ? _0n2 : BigInt("0x" + hex);
+}
+function bytesToNumberBE(bytes) {
+  return hexToNumber(bytesToHex(bytes));
+}
+function numberToBytesBE(n, len) {
+  anumber(len);
+  if (len === 0)
+    throw new Error("zero output length is invalid");
+  n = abignumber(n);
+  const expectedLen = len * 2;
+  const hex = n.toString(16);
+  if (hex.length > expectedLen)
+    throw new RangeError("number is too large");
+  return hexToBytes(hex.padStart(expectedLen, "0"));
+}
+function isPosBig(n) {
+  return typeof n === "bigint" && _0n2 <= n;
+}
+function validateObject(object, fields = {}, optFields = {}, title = "object") {
+  aobject2(object, title);
+  aobject2(fields, "fields");
+  aobject2(optFields, "optFields");
+  function checkField(fieldName, expectedType, isOpt) {
+    const label = title === "object" ? `param "${String(fieldName)}"` : `"${title}.${String(fieldName)}"`;
+    const val = object[fieldName];
+    if (!Object.hasOwn(object, fieldName) && (isOpt ? val !== void 0 : expectedType !== "function")) {
+      throw new TypeError(`${label} is invalid: expected own property`);
+    }
+    if (isOpt && val === void 0)
+      return;
+    const current = typeof val;
+    if (current !== expectedType || val === null)
+      throw new TypeError(`${label} is invalid: expected ${expectedType}, got ${current}`);
+  }
+  const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));
+  iter(fields, false);
+  iter(optFields, true);
+}
+
 // node_modules/@noble/curves/abstract/fft.js
-function checkU32(n) {
+function checkU32(n, title = "n") {
+  if (typeof n !== "number")
+    throw new TypeError(`wrong u32 integer "${title}": expected number, got type=${typeof n}`);
   if (!Number.isSafeInteger(n) || n < 0 || n > 4294967295)
-    throw new Error("wrong u32 integer:" + n);
+    throw new RangeError(`wrong u32 integer "${title}": expected 0..4294967295, got ${n}`);
   return n;
 }
 function isPowerOfTwo(x) {
-  checkU32(x);
+  checkU32(x, "x");
   return (x & x - 1) === 0 && x !== 0;
 }
 function reverseBits(n, bits) {
   checkU32(n);
+  if (typeof bits !== "number")
+    throw new TypeError('"bits" expected number, got type=' + typeof bits);
   if (!Number.isSafeInteger(bits) || bits < 0 || bits > 32)
     throw new Error(`expected integer 0 <= bits <= 32, got ${bits}`);
   let reversed = 0;
@@ -486,6 +591,8 @@ function log2(n) {
   return 31 - Math.clz32(n);
 }
 function bitReversalInplace(values) {
+  if (!values || typeof values !== "object" || typeof values.length !== "number")
+    throw new TypeError('"values" expected array-like, got type=' + typeof values);
   const n = values.length;
   if (!isPowerOfTwo(n))
     throw new Error("expected positive power-of-two length, got " + n);
@@ -501,14 +608,19 @@ function bitReversalInplace(values) {
   return values;
 }
 var FFTCore = (F3, coreOpts) => {
+  validateObject(coreOpts, { N: "number", roots: "object", dit: "boolean" }, { invertButterflies: "boolean", skipStages: "number", brp: "boolean" }, "coreOpts");
   const { N: N3, roots, dit, invertButterflies = false, skipStages = 0, brp = true } = coreOpts;
+  checkU32(N3, "coreOpts.N");
   const bits = log2(N3);
   if (!isPowerOfTwo(N3))
     throw new Error("FFT: Polynomial size should be power of two");
+  checkU32(skipStages, "coreOpts.skipStages");
+  const maxSkipStages = bits === 0 ? 0 : bits - 1;
+  if (skipStages > maxSkipStages)
+    throw new Error(`FFT: wrong skipStages: expected 0 <= skipStages <= ${maxSkipStages}`);
   if (roots.length !== N3)
     throw new Error(`FFT: wrong roots length: expected ${N3}, got ${roots.length}`);
   const isDit = dit !== invertButterflies;
-  isDit;
   return (values) => {
     if (values.length !== N3)
       throw new Error("FFT: wrong Polynomial length");
@@ -550,7 +662,22 @@ var FFTCore = (F3, coreOpts) => {
 // node_modules/@noble/post-quantum/utils.js
 var abytesDoc = abytes;
 var randomBytes2 = randomBytes;
+function aarray2(item, title, inner = () => {
+}) {
+  if (!Array.isArray(item))
+    throw new TypeError(`"${title}" expected array, got type=${typeof item}`);
+  for (let i = 0; i < item.length; i++)
+    inner(item[i], `${title}[${i}]`);
+  return item;
+}
+function aobject3(value, title = "object") {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError(title === "object" ? "expected valid options object" : `"${title}" expected object, got type=${typeof value}`);
+  return value;
+}
 function equalBytes(a, b) {
+  a = abytes(a);
+  b = abytes(b);
   if (a.length !== b.length)
     return false;
   let diff = 0;
@@ -562,8 +689,9 @@ function copyBytes(bytes) {
   return Uint8Array.from(abytes(bytes));
 }
 function validateOpts(opts2) {
-  if (Object.prototype.toString.call(opts2) !== "[object Object]")
-    throw new TypeError("expected valid options object");
+  if (isBytes(opts2))
+    throw new TypeError('"opts" expected object, got Uint8Array');
+  aobject3(opts2, "opts");
 }
 function validateVerOpts(opts2) {
   validateOpts(opts2);
@@ -613,11 +741,12 @@ function vecCoder(c, vecLen) {
   return {
     bytesLen,
     encode: (u) => {
-      if (u.length !== vecLen)
-        throw new RangeError(`vecCoder.encode: wrong length=${u.length}. Expected: ${vecLen}`);
+      const uArr = aarray2(u, "u");
+      if (uArr.length !== vecLen)
+        throw new RangeError(`vecCoder.encode: wrong length=${uArr.length}. Expected: ${vecLen}`);
       const res = new Uint8Array(bytesLen);
-      for (let i = 0, pos = 0; i < u.length; i++) {
-        const b = coder.encode(u[i]);
+      for (let i = 0, pos = 0; i < uArr.length; i++) {
+        const b = coder.encode(uArr[i]);
         res.set(b, pos);
         b.fill(0);
         pos += b.length;
@@ -643,30 +772,38 @@ function cleanBytes(...list) {
   }
 }
 function getMask(bits) {
-  if (!Number.isSafeInteger(bits) || bits < 0 || bits > 32)
-    throw new RangeError(`expected bits in [0..32], got ${bits}`);
+  anumber(bits, "bits");
+  if (bits > 32)
+    throw new RangeError('"bits" expected <= 32, got ' + bits);
   return bits === 32 ? 4294967295 : ~(-1 << bits) >>> 0;
 }
 var EMPTY = /* @__PURE__ */ Uint8Array.of();
 function getMessage(msg, ctx = EMPTY) {
-  abytes(msg);
-  abytes(ctx);
+  abytes(msg, void 0, "msg");
+  abytes(ctx, void 0, "ctx");
   if (ctx.length > 255)
     throw new RangeError("context should be 255 bytes or less");
   return concatBytes(new Uint8Array([0, ctx.length]), ctx, msg);
 }
 var oidNistP = /* @__PURE__ */ Uint8Array.from([6, 9, 96, 134, 72, 1, 101, 3, 4, 2]);
 function checkHash(hash, requiredStrength = 0) {
-  if (!hash.oid || !equalBytes(hash.oid.subarray(0, 10), oidNistP))
-    throw new Error("hash.oid is invalid: expected NIST hash");
+  if (typeof hash !== "function" || typeof hash.create !== "function")
+    throw new TypeError('"hash" expected hash function, got type=' + typeof hash);
+  ahash(hash);
+  anumber(requiredStrength, "requiredStrength");
+  const oid = hash.oid;
+  abytes(oid, void 0, "hash.oid");
+  if (!equalBytes(oid.subarray(0, 10), oidNistP))
+    throw new Error('"hash.oid" is invalid: expected NIST hash');
   const collisionResistance = hash.outputLen * 8 / 2;
   if (requiredStrength > collisionResistance) {
     throw new Error("Pre-hash security strength too low: " + collisionResistance + ", required: " + requiredStrength);
   }
 }
 function getMessagePrehash(hash, msg, ctx = EMPTY) {
-  abytes(msg);
-  abytes(ctx);
+  checkHash(hash);
+  abytes(msg, void 0, "msg");
+  abytes(ctx, void 0, "ctx");
   if (ctx.length > 255)
     throw new RangeError("context should be 255 bytes or less");
   const hashed = hash(msg);
@@ -694,13 +831,25 @@ var genCrystals = (opts2) => {
     return out;
   }
   const nttZetas = getZettas();
-  const field = {
+  const inv = (_a) => {
+    throw new Error("not implemented");
+  };
+  const field = isKyber ? {
+    add: (a, b) => {
+      const r = a + b | 0;
+      return r >= Q3 ? r - Q3 | 0 : r;
+    },
+    sub: (a, b) => {
+      const r = a - b | 0;
+      return r < 0 ? r + Q3 | 0 : r;
+    },
+    mul: (a, b) => mod((a | 0) * (b | 0)) | 0,
+    inv
+  } : {
     add: (a, b) => mod((a | 0) + (b | 0)) | 0,
     sub: (a, b) => mod((a | 0) - (b | 0)) | 0,
     mul: (a, b) => mod((a | 0) * (b | 0)) | 0,
-    inv: (_a) => {
-      throw new Error("not implemented");
-    }
+    inv
   };
   const nttOpts = {
     N: N3,
@@ -723,6 +872,12 @@ var genCrystals = (opts2) => {
     }
   };
   const bitsCoder = (d, c) => {
+    for (let i = 0, bufLen = 0; i < N3; i++) {
+      bufLen += d;
+      if (bufLen > 32)
+        getMask(bufLen);
+      bufLen %= 8;
+    }
     const mask = getMask(d);
     const bytesLen = d * (N3 / 8);
     return {
@@ -734,7 +889,7 @@ var genCrystals = (opts2) => {
           buf |= (c.encode(poly[i]) & mask) << bufLen;
           bufLen += d;
           for (; bufLen >= 8; bufLen -= 8, buf >>= 8)
-            r[pos++] = buf & getMask(bufLen);
+            r[pos++] = buf & 255;
         }
         return r;
       },
@@ -828,17 +983,21 @@ var polyCoder = (d) => d === 12 ? byteCoder(12) : crystals.bitsCoder(d, compress
 function polyAdd(a_, b_) {
   const a = a_;
   const b = b_;
-  for (let i = 0; i < N; i++)
-    a[i] = crystals.mod(a[i] + b[i]);
+  for (let i = 0; i < N; i++) {
+    const r = a[i] + b[i];
+    a[i] = r >= Q ? r - Q : r;
+  }
 }
 function polySub(a_, b_) {
   const a = a_;
   const b = b_;
-  for (let i = 0; i < N; i++)
-    a[i] = crystals.mod(a[i] - b[i]);
+  for (let i = 0; i < N; i++) {
+    const r = a[i] - b[i];
+    a[i] = r < 0 ? r + Q : r;
+  }
 }
 function BaseCaseMultiply(a0, a1, b0, b1, zeta) {
-  const c0 = crystals.mod(a1 * b1 * zeta + a0 * b0);
+  const c0 = crystals.mod(crystals.mod(a1 * b1) * zeta + a0 * b0);
   const c1 = crystals.mod(a0 * b1 + a1 * b0);
   return { c0, c1 };
 }
@@ -913,6 +1072,31 @@ var genKPKE = (opts_) => {
   const secretCoder = vecCoder(polyCoder(12), K);
   const cipherCoder = splitCoder("ciphertext", vecCoder(polyU, K), polyV);
   const seedCoder = splitCoder("seed", 32, 32);
+  const encryptCore = (tHat, getA, msg, seed) => {
+    const rHat = [];
+    for (let i = 0; i < K; i++)
+      rHat.push(crystals.NTT.encode(sampleCBD(PRF, seed, i, ETA1)));
+    const tmp2 = new Uint16Array(N);
+    const u = [];
+    for (let i = 0; i < K; i++) {
+      const e1 = sampleCBD(PRF, seed, K + i, ETA2);
+      const tmp = new Uint16Array(N);
+      for (let j = 0; j < K; j++) {
+        const aij = getA(i, j);
+        polyAdd(tmp, MultiplyNTTs(aij, rHat[j]));
+      }
+      polyAdd(e1, crystals.NTT.decode(tmp));
+      u.push(e1);
+      polyAdd(tmp2, MultiplyNTTs(tHat[i], rHat[i]));
+      cleanBytes(tmp);
+    }
+    const e2 = sampleCBD(PRF, seed, 2 * K, ETA2);
+    polyAdd(e2, crystals.NTT.decode(tmp2));
+    const v = poly1.decode(msg);
+    polyAdd(v, e2);
+    cleanBytes(tHat, rHat, tmp2, e2);
+    return cipherCoder.encode([u, v]);
+  };
   return {
     secretCoder,
     lengths: {
@@ -950,31 +1134,26 @@ var genKPKE = (opts_) => {
     },
     encrypt: (publicKey, msg, seed) => {
       const [tHat, rho] = publicCoder.decode(publicKey);
-      const rHat = [];
-      for (let i = 0; i < K; i++)
-        rHat.push(crystals.NTT.encode(sampleCBD(PRF, seed, i, ETA1)));
       const x = XOF(rho);
-      const tmp2 = new Uint16Array(N);
-      const u = [];
-      for (let i = 0; i < K; i++) {
-        const e1 = sampleCBD(PRF, seed, K + i, ETA2);
-        const tmp = new Uint16Array(N);
-        for (let j = 0; j < K; j++) {
-          const aij = SampleNTT(x.get(i, j));
-          polyAdd(tmp, MultiplyNTTs(aij, rHat[j]));
-        }
-        polyAdd(e1, crystals.NTT.decode(tmp));
-        u.push(e1);
-        polyAdd(tmp2, MultiplyNTTs(tHat[i], rHat[i]));
-        cleanBytes(tmp);
-      }
+      const res = encryptCore(tHat, (i, j) => SampleNTT(x.get(i, j)), msg, seed);
       x.clean();
-      const e2 = sampleCBD(PRF, seed, 2 * K, ETA2);
-      polyAdd(e2, crystals.NTT.decode(tmp2));
-      const v = poly1.decode(msg);
-      polyAdd(v, e2);
-      cleanBytes(tHat, rHat, tmp2, e2);
-      return cipherCoder.encode([u, v]);
+      return res;
+    },
+    // Expands the full  matrix (public data derived from rho) once, so repeated encryptions
+    // against the same ek skip the K² SampleNTT XOF expansions. Cached polys are copied per
+    // call because encryptCore mutates its inputs in place.
+    prepare: (publicKey) => {
+      const [tHat, rho] = publicCoder.decode(publicKey);
+      const x = XOF(rho);
+      const A = [];
+      for (let i = 0; i < K; i++)
+        for (let j = 0; j < K; j++)
+          A.push(SampleNTT(x.get(i, j)));
+      x.clean();
+      return {
+        encrypt: (msg, seed) => encryptCore(tHat.map((p) => p.slice()), (i, j) => A[i * K + j].slice(), msg, seed),
+        clean: () => cleanBytes(tHat, A)
+      };
     },
     decrypt: (cipherText, privateKey) => {
       const [u, v] = cipherCoder.decode(cipherText);
@@ -996,6 +1175,14 @@ function createKyber(opts2) {
   const secretCoder = splitCoder("secretKey", lengths.secretKey, lengths.publicKey, 32, 32);
   const msgLen = 32;
   const seedLen = 64;
+  const validateModulus = (publicKey, fn) => {
+    const eke = publicKey.subarray(0, 384 * rawOpts.K);
+    const ek = KPKESecretCoder.encode(KPKESecretCoder.decode(copyBytes(eke)));
+    const ok = equalBytes(ek, eke);
+    cleanBytes(ek);
+    if (!ok)
+      throw new Error(`ML-KEM.${fn}: wrong publicKey modulus`);
+  };
   const kemLengths = Object.freeze({
     ...lengths,
     seed: 64,
@@ -1024,13 +1211,7 @@ function createKyber(opts2) {
     encapsulate: (publicKey, msg = randomBytes2(msgLen)) => {
       abytesDoc(publicKey, lengths.publicKey, "publicKey");
       abytesDoc(msg, msgLen, "message");
-      const eke = publicKey.subarray(0, 384 * opts2.K);
-      const ek = KPKESecretCoder.encode(KPKESecretCoder.decode(copyBytes(eke)));
-      if (!equalBytes(ek, eke)) {
-        cleanBytes(ek);
-        throw new Error("ML-KEM.encapsulate: wrong publicKey modulus");
-      }
-      cleanBytes(ek);
+      validateModulus(publicKey, "encapsulate");
       const kr = HASH512.create().update(msg).update(HASH256(publicKey)).digest();
       const cipherText = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
       cleanBytes(kr.subarray(32));
@@ -1054,8 +1235,49 @@ function createKyber(opts2) {
       const cipherText2 = KPKE.encrypt(publicKey, msg, kr.subarray(32, 64));
       const isValid = equalBytes(cipherText, cipherText2);
       const Kbar = KDF.create({ dkLen: 32 }).update(z).update(cipherText).digest();
-      cleanBytes(msg, cipherText2, !isValid ? Khat : Kbar);
+      cleanBytes(msg, cipherText2, kr.subarray(32), !isValid ? Khat : Kbar);
       return isValid ? Khat : Kbar;
+    },
+    /**
+     * Experimental prototype: pre-expand a public key so repeated encapsulate/decapsulate
+     * against the same key skip re-validation, H(ek), t̂ decoding and the K² SampleNTT
+     * XOF expansions of Â. Only public data is cached; see {@link KEMPrepared}.
+     */
+    prepare: (publicKey) => {
+      abytesDoc(publicKey, lengths.publicKey, "publicKey");
+      validateModulus(publicKey, "prepare");
+      const ek = copyBytes(publicKey);
+      const publicKeyHash = HASH256(ek);
+      const cached = KPKE.prepare(ek);
+      return Object.freeze({
+        publicKey: ek,
+        encapsulate: (msg = randomBytes2(msgLen)) => {
+          abytesDoc(msg, msgLen, "message");
+          const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
+          const cipherText = cached.encrypt(msg, kr.subarray(32, 64));
+          cleanBytes(kr.subarray(32));
+          return {
+            cipherText,
+            sharedSecret: kr.subarray(0, 32)
+          };
+        },
+        decapsulate: (cipherText, secretKey) => {
+          abytesDoc(secretKey, secretCoder.bytesLen, "secretKey");
+          abytesDoc(cipherText, lengths.cipherText, "cipherText");
+          const [sk, ekEmbedded, storedHash, z] = secretCoder.decode(secretKey);
+          if (!equalBytes(ekEmbedded, ek) || !equalBytes(storedHash, publicKeyHash))
+            throw new Error("ML-KEM.decapsulate: secretKey does not match prepared publicKey");
+          const msg = KPKE.decrypt(cipherText, sk);
+          const kr = HASH512.create().update(msg).update(publicKeyHash).digest();
+          const Khat = kr.subarray(0, 32);
+          const cipherText2 = cached.encrypt(msg, kr.subarray(32, 64));
+          const isValid = equalBytes(cipherText, cipherText2);
+          const Kbar = KDF.create({ dkLen: 32 }).update(z).update(cipherText).digest();
+          cleanBytes(msg, cipherText2, kr.subarray(32), !isValid ? Khat : Kbar);
+          return isValid ? Khat : Kbar;
+        },
+        clean: cached.clean
+      });
     }
   });
 }
@@ -1077,20 +1299,11 @@ var ml_kem512 = /* @__PURE__ */ (() => mk(PARAMS[512]))();
 var ml_kem768 = /* @__PURE__ */ (() => mk(PARAMS[768]))();
 var ml_kem1024 = /* @__PURE__ */ (() => mk(PARAMS[1024]))();
 
-// node_modules/@noble/curves/utils.js
-function abool(value, title = "") {
-  if (typeof value !== "boolean") {
-    const prefix = title && `"${title}" `;
-    throw new TypeError(prefix + "expected boolean, got type=" + typeof value);
-  }
-  return value;
-}
-
 // node_modules/@noble/post-quantum/ml-dsa.js
 function validateInternalOpts(opts2) {
   validateOpts(opts2);
   if (opts2.externalMu !== void 0)
-    abool(opts2.externalMu, "opts.externalMu");
+    abool2(opts2.externalMu, "opts.externalMu");
 }
 var N2 = 256;
 var Q2 = 8380417;
@@ -1166,10 +1379,10 @@ var polyShiftl = (p_) => {
     p[i] <<= D;
   return p;
 };
-var polyChknorm = (p_, B) => {
+var polyChknorm = (p_, B2) => {
   const p = p_;
   for (let i = 0; i < N2; i++)
-    if (Math.abs(crystals2.smod(p[i])) >= B)
+    if (Math.abs(crystals2.smod(p[i])) >= B2)
       return true;
   return false;
 };
@@ -1221,11 +1434,11 @@ function getDilithium(opts_) {
     const res0 = z <= GAMMA2 || z > Q2 - GAMMA2 || z === Q2 - GAMMA2 && r === 0 ? 0 : 1;
     return res0;
   };
+  const HINT_M = Math.floor((Q2 - 1) / (2 * GAMMA2));
   const UseHint = (h, r) => {
-    const m = Math.floor((Q2 - 1) / (2 * GAMMA2));
     const { r1, r0 } = decompose(r);
     if (h === 1)
-      return r0 > 0 ? crystals2.mod(r1 + 1, m) | 0 : crystals2.mod(r1 - 1, m) | 0;
+      return r0 > 0 ? crystals2.mod(r1 + 1, HINT_M) | 0 : crystals2.mod(r1 - 1, HINT_M) | 0;
     return r1 | 0;
   };
   const Power2Round = (r) => {
@@ -1435,8 +1648,22 @@ function getDilithium(opts_) {
     sign: (msg, secretKey, opts3 = {}) => {
       validateSigOpts(opts3);
       validateInternalOpts(opts3);
-      let { extraEntropy: random, externalMu = false } = opts3;
-      const [rho, _K, tr, s1, s2, t0] = secretCoder.decode(secretKey);
+      const { extraEntropy: random, externalMu = false } = opts3;
+      if (externalMu)
+        abytesDoc(msg, CRH_BYTES, "mu");
+      const ownRnd = random === false || random === void 0;
+      const rnd = random === false ? new Uint8Array(32) : random === void 0 ? randomBytes2(signRandBytes) : random;
+      abytesDoc(rnd, 32, "extraEntropy");
+      const decoded = (() => {
+        try {
+          return secretCoder.decode(secretKey);
+        } catch (error) {
+          if (ownRnd)
+            cleanBytes(rnd);
+          throw error;
+        }
+      })();
+      const [rho, _K, tr, s1, s2, t0] = decoded;
       const A = [];
       const xof = XOF1282(rho);
       for (let i = 0; i < K; i++) {
@@ -1457,9 +1684,9 @@ function getDilithium(opts_) {
         //    ▷ Compute message representative µ
         shake256.create({ dkLen: CRH_BYTES }).update(tr).update(msg).digest()
       );
-      const rnd = random === false ? new Uint8Array(32) : random === void 0 ? randomBytes2(signRandBytes) : random;
-      abytesDoc(rnd, 32, "extraEntropy");
       const rhoprime = shake256.create({ dkLen: CRH_BYTES }).update(_K).update(rnd).update(mu).digest();
+      if (ownRnd)
+        cleanBytes(rnd);
       abytesDoc(rhoprime, CRH_BYTES);
       const x256 = XOF2562(rhoprime, ZCoder.bytesLen);
       main_loop: for (let kappa = 0; ; ) {
@@ -1513,6 +1740,8 @@ function getDilithium(opts_) {
     verify: (sig, msg, publicKey, opts3 = {}) => {
       validateInternalOpts(opts3);
       const { externalMu = false } = opts3;
+      if (externalMu)
+        abytesDoc(msg, CRH_BYTES, "mu");
       const [rho, t1] = publicCoder.decode(publicKey);
       const tr = shake256(publicKey, { dkLen: TR_BYTES });
       if (sig.length !== sigCoder.bytesLen)
@@ -1572,10 +1801,12 @@ function getDilithium(opts_) {
     },
     verify: (sig, msg, publicKey, opts3 = {}) => {
       validateVerOpts(opts3);
+      abytesDoc(sig, void 0, "signature");
       return internal.verify(sig, getMessage(msg, opts3.context), publicKey);
     },
     prehash: (hash) => {
       checkHash(hash, securityLevel);
+      const rawHash = hash;
       return Object.freeze({
         info: Object.freeze({ type: "hashml-dsa" }),
         securityLevel,
@@ -1584,14 +1815,15 @@ function getDilithium(opts_) {
         getPublicKey: internal.getPublicKey,
         sign: (msg, secretKey, opts3 = {}) => {
           validateSigOpts(opts3);
-          const M = getMessagePrehash(hash, msg, opts3.context);
+          const M = getMessagePrehash(rawHash, msg, opts3.context);
           const res = internal.sign(M, secretKey, opts3);
           cleanBytes(M);
           return res;
         },
         verify: (sig, msg, publicKey, opts3 = {}) => {
           validateVerOpts(opts3);
-          return internal.verify(sig, getMessagePrehash(hash, msg, opts3.context), publicKey);
+          abytesDoc(sig, void 0, "signature");
+          return internal.verify(sig, getMessagePrehash(rawHash, msg, opts3.context), publicKey);
         }
       });
     }
@@ -1639,7 +1871,7 @@ var _HMAC = class {
     abytes(key, void 0, "key");
     this.iHash = hash.create();
     if (typeof this.iHash.update !== "function")
-      throw new Error("Expected instance of class which extends utils.Hash");
+      throw new Error("expected Hash instance");
     this.blockLen = this.iHash.blockLen;
     this.outputLen = this.iHash.outputLen;
     const blockLen = this.blockLen;
@@ -1676,12 +1908,13 @@ var _HMAC = class {
   }
   _cloneInto(to) {
     to ||= Object.create(Object.getPrototypeOf(this), {});
-    const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+    const { oHash, iHash, finished, destroyed, blockLen, outputLen, canXOF } = this;
     to = to;
     to.finished = finished;
     to.destroyed = destroyed;
     to.blockLen = blockLen;
     to.outputLen = outputLen;
+    to.canXOF = canXOF;
     to.oHash = oHash._cloneInto(to.oHash);
     to.iHash = iHash._cloneInto(to.iHash);
     return to;
@@ -1734,24 +1967,28 @@ var HashMD = class {
     abytes(data);
     const { view, buffer, blockLen } = this;
     const len = data.length;
+    let processed = false;
     for (let pos = 0; pos < len; ) {
       const take = Math.min(blockLen - this.pos, len - pos);
       if (take === blockLen) {
         const dataView = createView(data);
         for (; blockLen <= len - pos; pos += blockLen)
           this.process(dataView, pos);
+        processed = true;
         continue;
       }
-      buffer.set(data.subarray(pos, pos + take), this.pos);
+      buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
       this.pos += take;
       pos += take;
       if (this.pos === blockLen) {
         this.process(view, 0);
         this.pos = 0;
+        processed = true;
       }
     }
     this.length += data.length;
-    this.roundClean();
+    if (processed)
+      this.roundClean();
     return this;
   }
   digestInto(out) {
@@ -1761,23 +1998,20 @@ var HashMD = class {
     const { buffer, view, blockLen, isLE: isLE2 } = this;
     let { pos } = this;
     buffer[pos++] = 128;
-    clean(this.buffer.subarray(pos));
+    buffer.fill(0, pos);
     if (this.padOffset > blockLen - pos) {
       this.process(view, 0);
-      pos = 0;
+      buffer.fill(0);
     }
-    for (let i = pos; i < blockLen; i++)
-      buffer[i] = 0;
-    view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE2);
+    setU64FromNum(view, blockLen - 8, this.length * 8, isLE2);
     this.process(view, 0);
-    const oview = createView(out);
+    this.roundClean();
+    const oview = out === buffer ? view : createView(out);
     const len = this.outputLen;
-    if (len % 4)
-      throw new Error("_sha2: outputLen must be aligned to 32bit");
     const outLen = len / 4;
     const state = this.get();
-    if (outLen > state.length)
-      throw new Error("_sha2: outputLen bigger than state");
+    if (len % 4 || outLen > state.length)
+      throw new Error("invalid outputLen");
     for (let i = 0; i < outLen; i++)
       oview.setUint32(4 * i, state[i], isLE2);
   }
@@ -1788,15 +2022,13 @@ var HashMD = class {
     this.destroy();
     return res;
   }
-  _cloneInto(to) {
-    to ||= new this.constructor();
-    to.set(...this.get());
-    const { blockLen, buffer, length, finished, destroyed, pos } = this;
+  _cloneIntoMeta(to) {
+    const { buffer, length, finished, destroyed, pos } = this;
     to.destroyed = destroyed;
     to.finished = finished;
     to.length = length;
     to.pos = pos;
-    if (length % blockLen)
+    if (pos)
       to.buffer.set(buffer);
     return to;
   }
@@ -1902,17 +2134,37 @@ var SHA256_K = /* @__PURE__ */ Uint32Array.from([
 ]);
 var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
 var SHA2_32B = class extends HashMD {
-  constructor(outputLen) {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  // Numeric initializers matter: starting the fields as `undefined` changes
+  // V8's field representation and makes sha256 3x slower (measured).
+  A = 0;
+  B = 0;
+  C = 0;
+  D = 0;
+  E = 0;
+  F = 0;
+  G = 0;
+  H = 0;
+  constructor(outputLen, IV) {
     super(64, outputLen, 8, false);
+    this.A = IV[0] | 0;
+    this.B = IV[1] | 0;
+    this.C = IV[2] | 0;
+    this.D = IV[3] | 0;
+    this.E = IV[4] | 0;
+    this.F = IV[5] | 0;
+    this.G = IV[6] | 0;
+    this.H = IV[7] | 0;
   }
   get() {
-    const { A, B, C, D: D2, E, F: F3, G, H } = this;
-    return [A, B, C, D2, E, F3, G, H];
+    const { A, B: B2, C, D: D2, E, F: F3, G, H } = this;
+    return [A, B2, C, D2, E, F3, G, H];
   }
   // prettier-ignore
-  set(A, B, C, D2, E, F3, G, H) {
+  set(A, B2, C, D2, E, F3, G, H) {
     this.A = A | 0;
-    this.B = B | 0;
+    this.B = B2 | 0;
     this.C = C | 0;
     this.D = D2 | 0;
     this.E = E | 0;
@@ -1920,6 +2172,10 @@ var SHA2_32B = class extends HashMD {
     this.G = G | 0;
     this.H = H | 0;
   }
+  _cloneInto(to) {
+    (to ||= new this.constructor()).set(...this.get());
+    return this._cloneIntoMeta(to);
+  }
   process(view, offset) {
     for (let i = 0; i < 16; i++, offset += 4)
       SHA256_W[i] = view.getUint32(offset, false);
@@ -1930,30 +2186,30 @@ var SHA2_32B = class extends HashMD {
       const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ W2 >>> 10;
       SHA256_W[i] = s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16] | 0;
     }
-    let { A, B, C, D: D2, E, F: F3, G, H } = this;
+    let { A, B: B2, C, D: D2, E, F: F3, G, H } = this;
     for (let i = 0; i < 64; i++) {
       const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
       const T1 = H + sigma1 + Chi(E, F3, G) + SHA256_K[i] + SHA256_W[i] | 0;
       const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
-      const T2 = sigma0 + Maj(A, B, C) | 0;
+      const T2 = sigma0 + Maj(A, B2, C) | 0;
       H = G;
       G = F3;
       F3 = E;
       E = D2 + T1 | 0;
       D2 = C;
-      C = B;
-      B = A;
+      C = B2;
+      B2 = A;
       A = T1 + T2 | 0;
     }
     A = A + this.A | 0;
-    B = B + this.B | 0;
+    B2 = B2 + this.B | 0;
     C = C + this.C | 0;
     D2 = D2 + this.D | 0;
     E = E + this.E | 0;
     F3 = F3 + this.F | 0;
     G = G + this.G | 0;
     H = H + this.H | 0;
-    this.set(A, B, C, D2, E, F3, G, H);
+    this.set(A, B2, C, D2, E, F3, G, H);
   }
   roundClean() {
     clean(SHA256_W);
@@ -1965,18 +2221,8 @@ var SHA2_32B = class extends HashMD {
   }
 };
 var _SHA256 = class extends SHA2_32B {
-  // We cannot use array here since array allows indexing by variable
-  // which means optimizer/compiler cannot use registers.
-  A = SHA256_IV[0] | 0;
-  B = SHA256_IV[1] | 0;
-  C = SHA256_IV[2] | 0;
-  D = SHA256_IV[3] | 0;
-  E = SHA256_IV[4] | 0;
-  F = SHA256_IV[5] | 0;
-  G = SHA256_IV[6] | 0;
-  H = SHA256_IV[7] | 0;
   constructor() {
-    super(32);
+    super(32, SHA256_IV);
   }
 };
 var K512 = /* @__PURE__ */ (() => split([
@@ -2066,8 +2312,45 @@ var SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
 var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
 var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
 var SHA2_64B = class extends HashMD {
-  constructor(outputLen) {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  // h -- high 32 bits, l -- low 32 bits
+  // Numeric initializers matter: starting the fields as `undefined` changes
+  // V8's field representation and slows hashing down (measured on sha256).
+  Ah = 0;
+  Al = 0;
+  Bh = 0;
+  Bl = 0;
+  Ch = 0;
+  Cl = 0;
+  Dh = 0;
+  Dl = 0;
+  Eh = 0;
+  El = 0;
+  Fh = 0;
+  Fl = 0;
+  Gh = 0;
+  Gl = 0;
+  Hh = 0;
+  Hl = 0;
+  constructor(outputLen, IV) {
     super(128, outputLen, 16, false);
+    this.Ah = IV[0] | 0;
+    this.Al = IV[1] | 0;
+    this.Bh = IV[2] | 0;
+    this.Bl = IV[3] | 0;
+    this.Ch = IV[4] | 0;
+    this.Cl = IV[5] | 0;
+    this.Dh = IV[6] | 0;
+    this.Dl = IV[7] | 0;
+    this.Eh = IV[8] | 0;
+    this.El = IV[9] | 0;
+    this.Fh = IV[10] | 0;
+    this.Fl = IV[11] | 0;
+    this.Gh = IV[12] | 0;
+    this.Gl = IV[13] | 0;
+    this.Hh = IV[14] | 0;
+    this.Hl = IV[15] | 0;
   }
   // prettier-ignore
   get() {
@@ -2093,6 +2376,10 @@ var SHA2_64B = class extends HashMD {
     this.Hh = Hh | 0;
     this.Hl = Hl | 0;
   }
+  _cloneInto(to) {
+    (to ||= new this.constructor()).set(...this.get());
+    return this._cloneIntoMeta(to);
+  }
   process(view, offset) {
     for (let i = 0; i < 16; i++, offset += 4) {
       SHA512_W_H[i] = view.getUint32(offset);
@@ -2162,24 +2449,8 @@ var SHA2_64B = class extends HashMD {
   }
 };
 var _SHA512 = class extends SHA2_64B {
-  Ah = SHA512_IV[0] | 0;
-  Al = SHA512_IV[1] | 0;
-  Bh = SHA512_IV[2] | 0;
-  Bl = SHA512_IV[3] | 0;
-  Ch = SHA512_IV[4] | 0;
-  Cl = SHA512_IV[5] | 0;
-  Dh = SHA512_IV[6] | 0;
-  Dl = SHA512_IV[7] | 0;
-  Eh = SHA512_IV[8] | 0;
-  El = SHA512_IV[9] | 0;
-  Fh = SHA512_IV[10] | 0;
-  Fl = SHA512_IV[11] | 0;
-  Gh = SHA512_IV[12] | 0;
-  Gl = SHA512_IV[13] | 0;
-  Hh = SHA512_IV[14] | 0;
-  Hl = SHA512_IV[15] | 0;
   constructor() {
-    super(64);
+    super(64, SHA512_IV);
   }
 };
 var sha256 = /* @__PURE__ */ createHasher(
@@ -2209,17 +2480,6 @@ var AddressType = {
   WOTSPRF: 5,
   FORSPRF: 6
 };
-function hexToNumber(hex) {
-  if (typeof hex !== "string")
-    throw new Error("hex string expected, got " + typeof hex);
-  return BigInt(hex === "" ? "0" : "0x" + hex);
-}
-function bytesToNumberBE(bytes) {
-  return hexToNumber(bytesToHex(bytes));
-}
-function numberToBytesBE(n, len) {
-  return hexToBytes(n.toString(16).padStart(len * 2, "0"));
-}
 var base2b = (outLen, b) => {
   const mask = getMask(b);
   return (bytes) => {
@@ -2235,8 +2495,11 @@ var base2b = (outLen, b) => {
     return baseB;
   };
 };
+var _1n2 = /* @__PURE__ */ BigInt(1);
+var _8n = /* @__PURE__ */ BigInt(8);
+var _0xffn = /* @__PURE__ */ BigInt(255);
 function getMaskBig(bits) {
-  return (1n << BigInt(bits)) - 1n;
+  return (_1n2 << BigInt(bits)) - _1n2;
 }
 function gen(opts2, hashOpts_) {
   const hashOpts = hashOpts_;
@@ -2272,7 +2535,6 @@ function gen(opts2, hashOpts_) {
   const setAddr = (opts3, addr = new Uint8Array(ADDR_BYTES)) => {
     const { type, height, tree, layer, index, chain, hash, keypair } = opts3;
     const { subtreeAddr, keypairAddr } = opts3;
-    const v = createView(addr);
     if (height !== void 0)
       addr[OFFSET_CHAIN_ADDR] = height;
     if (layer !== void 0)
@@ -2283,12 +2545,19 @@ function gen(opts2, hashOpts_) {
       addr[OFFSET_CHAIN_ADDR] = chain;
     if (hash !== void 0)
       addr[OFFSET_HASH_ADDR] = hash;
-    if (index !== void 0)
-      v.setUint32(OFFSET_TREE_INDEX, index, false);
+    if (index !== void 0) {
+      addr[OFFSET_TREE_INDEX + 0] = index >>> 24;
+      addr[OFFSET_TREE_INDEX + 1] = index >>> 16;
+      addr[OFFSET_TREE_INDEX + 2] = index >>> 8;
+      addr[OFFSET_TREE_INDEX + 3] = index;
+    }
     if (subtreeAddr)
       addr.set(subtreeAddr.subarray(0, OFFSET_TREE + 8));
-    if (tree !== void 0)
-      v.setBigUint64(OFFSET_TREE, tree, false);
+    if (tree !== void 0) {
+      let t = tree;
+      for (let i = 7; i >= 0; i--, t >>= _8n)
+        addr[OFFSET_TREE + i] = Number(t & _0xffn);
+    }
     if (keypair !== void 0) {
       addr[OFFSET_KP_ADDR1] = keypair;
       if (TREE_HEIGHT > 8)
@@ -2333,10 +2602,10 @@ function gen(opts2, hashOpts_) {
     const maxIdx = (1 << height) - 1;
     const stack = new Uint8Array(height * N3);
     const authPath = new Uint8Array(height * N3);
+    const current = new Uint8Array(2 * N3);
+    const cur0 = current.subarray(0, N3);
+    const cur1 = current.subarray(N3);
     for (let idx = 0; ; idx++) {
-      const current = new Uint8Array(2 * N3);
-      const cur0 = current.subarray(0, N3);
-      const cur1 = current.subarray(N3);
       const addrOffset = idx + idxOffset;
       cur1.set(leafFn(leafIdx, addrOffset, rawContext, info));
       let h = 0;
@@ -2497,7 +2766,7 @@ function gen(opts2, hashOpts_) {
           height: 0,
           index: indices[i] + idxOffset
         }, forsTreeAddr);
-        const prf = context.PRFaddr(forsTreeAddr);
+        const prf = copyBytes(context.PRFaddr(forsTreeAddr));
         setAddr({ type: AddressType.FORSTREE }, forsTreeAddr);
         const { root: root2, authPath } = forsTreehash(context, indices[i], idxOffset, forsTreeAddr, forsLeaf);
         roots.push(root2);
@@ -2507,7 +2776,7 @@ function gen(opts2, hashOpts_) {
         type: AddressType.FORSPK,
         keypairAddr: wotsAddr
       });
-      const root = context.thashN(K, concatBytes(...roots), forsPkAddr);
+      const root = copyBytes(context.thashN(K, concatBytes(...roots), forsPkAddr));
       const treeAddr = setAddr({ type: AddressType.HASHTREE });
       const wots = [];
       for (let i = 0; i < D2; i++, tree >>= BigInt(TREE_HEIGHT)) {
@@ -2526,10 +2795,11 @@ function gen(opts2, hashOpts_) {
     },
     verify: (sig, msg, publicKey) => {
       const [pkSeed, pubRoot] = publicCoder.decode(publicKey);
-      const [random, forsVec, wotsVec] = sigCoder.decode(sig);
       const pk = publicKey;
+      abytesDoc(sig, void 0, "signature");
       if (sig.length !== sigCoder.bytesLen)
         return false;
+      const [random, forsVec, wotsVec] = sigCoder.decode(sig);
       const context = getContext(pkSeed);
       let { tree, leafIdx, md } = hashMessage(random, pk, msg, context);
       const wotsAddr = setAddr({
@@ -2548,13 +2818,13 @@ function gen(opts2, hashOpts_) {
         const idxOffset = i << A;
         setAddr({ height: 0, index: indices[i] + idxOffset }, forsTreeAddr);
         const leaf = context.thash1(prf, forsTreeAddr);
-        roots.push(computeRoot(leaf, indices[i], idxOffset, authPath, A, context, forsTreeAddr));
+        roots.push(copyBytes(computeRoot(leaf, indices[i], idxOffset, authPath, A, context, forsTreeAddr)));
       }
       const forsPkAddr = setAddr({
         type: AddressType.FORSPK,
         keypairAddr: wotsAddr
       });
-      let root = context.thashN(K, concatBytes(...roots), forsPkAddr);
+      let root = copyBytes(context.thashN(K, concatBytes(...roots), forsPkAddr));
       const treeAddr = setAddr({ type: AddressType.HASHTREE });
       const wotsPkAddr = setAddr({ type: AddressType.WOTSPK });
       const wotsPk = new Uint8Array(WOTS_LEN * N3);
@@ -2576,7 +2846,7 @@ function gen(opts2, hashOpts_) {
           }
         }
         const leaf = context.thashN(WOTS_LEN, wotsPk, wotsPkAddr);
-        root = computeRoot(leaf, leafIdx, 0, sigAuth, TREE_HEIGHT, context, treeAddr);
+        root = copyBytes(computeRoot(leaf, leafIdx, 0, sigAuth, TREE_HEIGHT, context, treeAddr));
         leafIdx = Number(tree & getMaskBig(TREE_HEIGHT));
       }
       return equalBytes(root, pubRoot);
@@ -2628,17 +2898,21 @@ var genShake2 = () => (opts2) => (pubSeed, skSeed) => {
   const stats = { prf: 0, thash: 0, hmsg: 0, gen_message_random: 0 };
   const h0 = shake256.create({}).update(pubSeed);
   const h0tmp = h0.clone();
+  const thashOut = new Uint8Array(N3);
+  const prfOut = new Uint8Array(N3);
   const thash = (blocks, input, addr) => {
     stats.thash++;
-    return h0._cloneInto(h0tmp).update(addr).update(input.subarray(0, blocks * N3)).xof(N3);
+    const len = blocks * N3;
+    h0._cloneInto(h0tmp).update(addr).update(input.length === len ? input : input.subarray(0, len)).xofInto(thashOut);
+    return thashOut;
   };
   return {
     PRFaddr: (addr) => {
       if (!skSeed)
         throw new Error("no sk seed");
       stats.prf++;
-      const res = h0._cloneInto(h0tmp).update(addr).update(skSeed).xof(N3);
-      return res;
+      h0._cloneInto(h0tmp).update(addr).update(skSeed).xofInto(prfOut);
+      return prfOut;
     },
     PRFmsg: (skPRF, random, msg) => {
       stats.gen_message_random++;
@@ -2653,6 +2927,7 @@ var genShake2 = () => (opts2) => (pubSeed, skSeed) => {
     clean: () => {
       h0.destroy();
       h0tmp.destroy();
+      cleanBytes(thashOut, prfOut);
     }
   };
 };
@@ -2669,6 +2944,12 @@ var genSha = (h0, h1) => (opts2) => (pub_seed, sk_seed) => {
   const h1ps = h1.create().update(pub_seed).update(new Uint8Array(h1.blockLen - N3));
   const h0tmp = h0ps.clone();
   const h1tmp = h1ps.clone();
+  const h0out = new Uint8Array(h0.outputLen);
+  const h1out = new Uint8Array(h1.outputLen);
+  const prfOut = new Uint8Array(h0.outputLen);
+  const h0outN = h0out.subarray(0, N3);
+  const h1outN = h1out.subarray(0, N3);
+  const prfOutN = prfOut.subarray(0, N3);
   function mgf1(seed, length, hash) {
     stats.mgf1++;
     const out = new Uint8Array(Math.ceil(length / hash.outputLen) * hash.outputLen);
@@ -2682,18 +2963,19 @@ var genSha = (h0, h1) => (opts2) => (pub_seed, sk_seed) => {
     cleanBytes(out.subarray(length));
     return out.subarray(0, length);
   }
-  const thash = (_, h, hTmp) => (blocks, input, addr) => {
+  const thash = (h, hTmp, out, outN) => (blocks, input, addr) => {
     stats.thash++;
-    const d = h._cloneInto(hTmp).update(addr).update(input.subarray(0, blocks * N3)).digest();
-    return d.subarray(0, N3);
+    const len = blocks * N3;
+    h._cloneInto(hTmp).update(addr).update(input.length === len ? input : input.subarray(0, len)).digestInto(out);
+    return outN;
   };
   return {
     PRFaddr: (addr) => {
       if (!sk_seed)
         throw new Error("No sk seed");
       stats.prf++;
-      const res = h0ps._cloneInto(h0tmp).update(addr).update(sk_seed).digest().subarray(0, N3);
-      return res;
+      h0ps._cloneInto(h0tmp).update(addr).update(sk_seed).digestInto(prfOut);
+      return prfOutN;
     },
     PRFmsg: (skPRF, random, msg) => {
       stats.gen_message_random++;
@@ -2704,13 +2986,14 @@ var genSha = (h0, h1) => (opts2) => (pub_seed, sk_seed) => {
       const seed = concatBytes(R.subarray(0, N3), pk.subarray(0, N3), h1.create().update(R.subarray(0, N3)).update(pk).update(m).digest());
       return mgf1(seed, outLen, h1);
     },
-    thash1: thash(h0, h0ps, h0tmp).bind(null, 1),
-    thashN: thash(h1, h1ps, h1tmp),
+    thash1: thash(h0ps, h0tmp, h0out, h0outN).bind(null, 1),
+    thashN: thash(h1ps, h1tmp, h1out, h1outN),
     clean: () => {
       h0ps.destroy();
       h1ps.destroy();
       h0tmp.destroy();
       h1tmp.destroy();
+      cleanBytes(h0out, h1out, prfOut);
     }
   };
 };
@@ -2742,13 +3025,13 @@ var slh_dsa_sha2_256f = /* @__PURE__ */ (() => gen(PARAMS3["256f"], SHA512_SIMPL
 });
 /*! Bundled license information:
 
+@noble/curves/utils.js:
+  (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
+
 @noble/post-quantum/utils.js:
 @noble/post-quantum/_crystals.js:
 @noble/post-quantum/ml-kem.js:
 @noble/post-quantum/ml-dsa.js:
 @noble/post-quantum/slh-dsa.js:
   (*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) *)
-
-@noble/curves/utils.js:
-  (*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) *)
 */