@blamejs/core 0.18.13 → 0.18.14

package/lib/vendor/noble-curves.cjs

@@ -1,4 +1,4 @@
-// @noble/curves v2.2.0 — vendored from Paul Miller
+// @noble/curves v2.3.0 — vendored from Paul Miller
 // License: MIT — https://github.com/paulmillr/noble-curves
 // Bundled with esbuild. Exports the RFC 9497 OPRF suites:
 //   ristretto255_oprf (ristretto255-SHA512), p256_oprf (P-256-SHA256),
@@ -32,46 +32,89 @@ __export(entry_exports, {
 });
 module.exports = __toCommonJS(entry_exports);
 
+// node_modules/@noble/hashes/_u64.js
+var U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
+var _32n = /* @__PURE__ */ BigInt(32);
+function fromBig(n, le = false) {
+  if (le)
+    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
+  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+function split(lst, le = false) {
+  const len = lst.length;
+  let Ah = new Uint32Array(len);
+  let Al = new Uint32Array(len);
+  for (let i = 0; i < len; i++) {
+    const { h, l } = fromBig(lst[i], le);
+    [Ah[i], Al[i]] = [h, l];
+  }
+  return [Ah, Al];
+}
+var fromNumH = (n) => n / 2 ** 32 | 0;
+var fromNumL = (n) => n >>> 0;
+function setU64FromNum(view, byteOffset, n, isLE) {
+  const h = fromNumH(n);
+  const l = fromNumL(n);
+  view.setUint32(byteOffset, isLE ? l : h, isLE);
+  view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
+}
+var shrSH = (h, _l, s) => h >>> s;
+var shrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrSH = (h, l, s) => h >>> s | l << 32 - s;
+var rotrSL = (h, l, s) => h << 32 - s | l >>> s;
+var rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
+var rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
+function add(Ah, Al, Bh, Bl) {
+  const l = (Al >>> 0) + (Bl >>> 0);
+  return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
+}
+var add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+var add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
+var add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
+var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
+
 // node_modules/@noble/hashes/utils.js
 function isBytes(a) {
   return a instanceof Uint8Array || ArrayBuffer.isView(a) && a.constructor.name === "Uint8Array" && "BYTES_PER_ELEMENT" in a && a.BYTES_PER_ELEMENT === 1;
 }
+var atitle = (title) => title ? `"${title}" ` : "";
 function anumber(n, title = "") {
-  if (typeof n !== "number") {
-    const prefix = title && `"${title}" `;
-    throw new TypeError(`${prefix}expected number, got ${typeof n}`);
-  }
-  if (!Number.isSafeInteger(n) || n < 0) {
-    const prefix = title && `"${title}" `;
-    throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
-  }
+  if (typeof n !== "number")
+    throw new TypeError(atitle(title) + "expected number, got " + typeof n);
+  if (!Number.isSafeInteger(n) || n < 0)
+    throw new RangeError(atitle(title) + "expected integer >= 0, got " + n);
+  return n;
 }
 function abytes(value, length, title = "") {
+  if (isBytes(value) && (length === void 0 || value.length === length))
+    return value;
+  if (length !== void 0)
+    anumber(length, "length");
   const bytes = isBytes(value);
-  const len = value?.length;
-  const needsLen = length !== void 0;
-  if (!bytes || needsLen && len !== length) {
-    const prefix = title && `"${title}" `;
-    const ofLen = needsLen ? ` of length ${length}` : "";
-    const got = bytes ? `length=${len}` : `type=${typeof value}`;
-    const message = prefix + "expected Uint8Array" + ofLen + ", got " + got;
-    if (!bytes)
-      throw new TypeError(message);
-    throw new RangeError(message);
-  }
-  return value;
-}
+  const ofLen = length !== void 0 ? ` of length ${length}` : "";
+  const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+  const message = atitle(title) + "expected Uint8Array" + ofLen + ", got " + got;
+  if (!bytes)
+    throw new TypeError(message);
+  throw new RangeError(message);
+}
+var aobject = (value, label) => {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError((label === "object" ? "" : `"${label}" `) + "expected object, got type=" + typeof value);
+};
 function aexists(instance, checkFinished = true) {
   if (instance.destroyed)
-    throw new Error("Hash instance has been destroyed");
+    throw new Error("hash was destroyed");
   if (checkFinished && instance.finished)
-    throw new Error("Hash#digest() has already been called");
+    throw new Error("digest() was already called");
 }
 function aoutput(out, instance) {
-  abytes(out, void 0, "digestInto() output");
+  abytes(out, void 0, "output");
   const min = instance.outputLen;
-  if (out.length < min) {
-    throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+  if (!(out.length >= min)) {
+    throw new RangeError('"output" expected length >= ' + min);
   }
 }
 function clean(...arrays) {
@@ -100,15 +143,8 @@ function bytesToHex(bytes) {
   }
   return hex;
 }
-var asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
 function asciiToBase16(ch) {
-  if (ch >= asciis._0 && ch <= asciis._9)
-    return ch - asciis._0;
-  if (ch >= asciis.A && ch <= asciis.F)
-    return ch - (asciis.A - 10);
-  if (ch >= asciis.a && ch <= asciis.f)
-    return ch - (asciis.a - 10);
-  return;
+  return ch >= 48 && ch <= 57 ? ch - 48 : ch >= 65 && ch <= 70 ? ch - (65 - 10) : ch >= 97 && ch <= 102 ? ch - (97 - 10) : void 0;
 }
 function hexToBytes(hex) {
   if (typeof hex !== "string")
@@ -153,7 +189,17 @@ function concatBytes(...arrays) {
   }
   return res;
 }
+function checkOpts(defaults, opts, title = "opts") {
+  aobject(defaults, "defaults");
+  if (opts !== void 0)
+    aobject(opts, title);
+  const merged = Object.assign(defaults, opts);
+  return merged;
+}
 function createHasher(hashCons, info = {}) {
+  if (typeof hashCons !== "function")
+    throw new TypeError('"hashCons" expected function, got type=' + typeof hashCons);
+  info = checkOpts({}, info, "info");
   const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
   const tmp = hashCons(void 0);
   hashC.outputLen = tmp.outputLen;
@@ -211,24 +257,28 @@ var HashMD = class {
     abytes(data);
     const { view, buffer, blockLen } = this;
     const len = data.length;
+    let processed = false;
     for (let pos = 0; pos < len; ) {
       const take = Math.min(blockLen - this.pos, len - pos);
       if (take === blockLen) {
         const dataView = createView(data);
         for (; blockLen <= len - pos; pos += blockLen)
           this.process(dataView, pos);
+        processed = true;
         continue;
       }
-      buffer.set(data.subarray(pos, pos + take), this.pos);
+      buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
       this.pos += take;
       pos += take;
       if (this.pos === blockLen) {
         this.process(view, 0);
         this.pos = 0;
+        processed = true;
       }
     }
     this.length += data.length;
-    this.roundClean();
+    if (processed)
+      this.roundClean();
     return this;
   }
   digestInto(out) {
@@ -238,23 +288,20 @@ var HashMD = class {
     const { buffer, view, blockLen, isLE } = this;
     let { pos } = this;
     buffer[pos++] = 128;
-    clean(this.buffer.subarray(pos));
+    buffer.fill(0, pos);
     if (this.padOffset > blockLen - pos) {
       this.process(view, 0);
-      pos = 0;
+      buffer.fill(0);
     }
-    for (let i = pos; i < blockLen; i++)
-      buffer[i] = 0;
-    view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
+    setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
     this.process(view, 0);
-    const oview = createView(out);
+    this.roundClean();
+    const oview = out === buffer ? view : createView(out);
     const len = this.outputLen;
-    if (len % 4)
-      throw new Error("_sha2: outputLen must be aligned to 32bit");
     const outLen = len / 4;
     const state = this.get();
-    if (outLen > state.length)
-      throw new Error("_sha2: outputLen bigger than state");
+    if (len % 4 || outLen > state.length)
+      throw new Error("invalid outputLen");
     for (let i = 0; i < outLen; i++)
       oview.setUint32(4 * i, state[i], isLE);
   }
@@ -265,15 +312,13 @@ var HashMD = class {
     this.destroy();
     return res;
   }
-  _cloneInto(to) {
-    to ||= new this.constructor();
-    to.set(...this.get());
-    const { blockLen, buffer, length, finished, destroyed, pos } = this;
+  _cloneIntoMeta(to) {
+    const { buffer, length, finished, destroyed, pos } = this;
     to.destroyed = destroyed;
     to.finished = finished;
     to.length = length;
     to.pos = pos;
-    if (length % blockLen)
+    if (pos)
       to.buffer.set(buffer);
     return to;
   }
@@ -328,41 +373,6 @@ var SHA512_IV = /* @__PURE__ */ Uint32Array.from([
   327033209
 ]);
 
-// node_modules/@noble/hashes/_u64.js
-var U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
-var _32n = /* @__PURE__ */ BigInt(32);
-function fromBig(n, le = false) {
-  if (le)
-    return { h: Number(n & U32_MASK64), l: Number(n >> _32n & U32_MASK64) };
-  return { h: Number(n >> _32n & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
-}
-function split(lst, le = false) {
-  const len = lst.length;
-  let Ah = new Uint32Array(len);
-  let Al = new Uint32Array(len);
-  for (let i = 0; i < len; i++) {
-    const { h, l } = fromBig(lst[i], le);
-    [Ah[i], Al[i]] = [h, l];
-  }
-  return [Ah, Al];
-}
-var shrSH = (h, _l, s) => h >>> s;
-var shrSL = (h, l, s) => h << 32 - s | l >>> s;
-var rotrSH = (h, l, s) => h >>> s | l << 32 - s;
-var rotrSL = (h, l, s) => h << 32 - s | l >>> s;
-var rotrBH = (h, l, s) => h << 64 - s | l >>> s - 32;
-var rotrBL = (h, l, s) => h >>> s - 32 | l << 64 - s;
-function add(Ah, Al, Bh, Bl) {
-  const l = (Al >>> 0) + (Bl >>> 0);
-  return { h: Ah + Bh + (l / 2 ** 32 | 0) | 0, l: l | 0 };
-}
-var add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
-var add3H = (low, Ah, Bh, Ch) => Ah + Bh + Ch + (low / 2 ** 32 | 0) | 0;
-var add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
-var add4H = (low, Ah, Bh, Ch, Dh) => Ah + Bh + Ch + Dh + (low / 2 ** 32 | 0) | 0;
-var add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
-var add5H = (low, Ah, Bh, Ch, Dh, Eh) => Ah + Bh + Ch + Dh + Eh + (low / 2 ** 32 | 0) | 0;
-
 // node_modules/@noble/hashes/sha2.js
 var SHA256_K = /* @__PURE__ */ Uint32Array.from([
   1116352408,
@@ -432,8 +442,28 @@ var SHA256_K = /* @__PURE__ */ Uint32Array.from([
 ]);
 var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
 var SHA2_32B = class extends HashMD {
-  constructor(outputLen) {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  // Numeric initializers matter: starting the fields as `undefined` changes
+  // V8's field representation and makes sha256 3x slower (measured).
+  A = 0;
+  B = 0;
+  C = 0;
+  D = 0;
+  E = 0;
+  F = 0;
+  G = 0;
+  H = 0;
+  constructor(outputLen, IV) {
     super(64, outputLen, 8, false);
+    this.A = IV[0] | 0;
+    this.B = IV[1] | 0;
+    this.C = IV[2] | 0;
+    this.D = IV[3] | 0;
+    this.E = IV[4] | 0;
+    this.F = IV[5] | 0;
+    this.G = IV[6] | 0;
+    this.H = IV[7] | 0;
   }
   get() {
     const { A, B, C, D, E, F, G, H } = this;
@@ -450,6 +480,10 @@ var SHA2_32B = class extends HashMD {
     this.G = G | 0;
     this.H = H | 0;
   }
+  _cloneInto(to) {
+    (to ||= new this.constructor()).set(...this.get());
+    return this._cloneIntoMeta(to);
+  }
   process(view, offset) {
     for (let i = 0; i < 16; i++, offset += 4)
       SHA256_W[i] = view.getUint32(offset, false);
@@ -495,18 +529,8 @@ var SHA2_32B = class extends HashMD {
   }
 };
 var _SHA256 = class extends SHA2_32B {
-  // We cannot use array here since array allows indexing by variable
-  // which means optimizer/compiler cannot use registers.
-  A = SHA256_IV[0] | 0;
-  B = SHA256_IV[1] | 0;
-  C = SHA256_IV[2] | 0;
-  D = SHA256_IV[3] | 0;
-  E = SHA256_IV[4] | 0;
-  F = SHA256_IV[5] | 0;
-  G = SHA256_IV[6] | 0;
-  H = SHA256_IV[7] | 0;
   constructor() {
-    super(32);
+    super(32, SHA256_IV);
   }
 };
 var K512 = /* @__PURE__ */ (() => split([
@@ -596,8 +620,45 @@ var SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
 var SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
 var SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
 var SHA2_64B = class extends HashMD {
-  constructor(outputLen) {
+  // We cannot use array here since array allows indexing by variable
+  // which means optimizer/compiler cannot use registers.
+  // h -- high 32 bits, l -- low 32 bits
+  // Numeric initializers matter: starting the fields as `undefined` changes
+  // V8's field representation and slows hashing down (measured on sha256).
+  Ah = 0;
+  Al = 0;
+  Bh = 0;
+  Bl = 0;
+  Ch = 0;
+  Cl = 0;
+  Dh = 0;
+  Dl = 0;
+  Eh = 0;
+  El = 0;
+  Fh = 0;
+  Fl = 0;
+  Gh = 0;
+  Gl = 0;
+  Hh = 0;
+  Hl = 0;
+  constructor(outputLen, IV) {
     super(128, outputLen, 16, false);
+    this.Ah = IV[0] | 0;
+    this.Al = IV[1] | 0;
+    this.Bh = IV[2] | 0;
+    this.Bl = IV[3] | 0;
+    this.Ch = IV[4] | 0;
+    this.Cl = IV[5] | 0;
+    this.Dh = IV[6] | 0;
+    this.Dl = IV[7] | 0;
+    this.Eh = IV[8] | 0;
+    this.El = IV[9] | 0;
+    this.Fh = IV[10] | 0;
+    this.Fl = IV[11] | 0;
+    this.Gh = IV[12] | 0;
+    this.Gl = IV[13] | 0;
+    this.Hh = IV[14] | 0;
+    this.Hl = IV[15] | 0;
   }
   // prettier-ignore
   get() {
@@ -623,6 +684,10 @@ var SHA2_64B = class extends HashMD {
     this.Hh = Hh | 0;
     this.Hl = Hl | 0;
   }
+  _cloneInto(to) {
+    (to ||= new this.constructor()).set(...this.get());
+    return this._cloneIntoMeta(to);
+  }
   process(view, offset) {
     for (let i = 0; i < 16; i++, offset += 4) {
       SHA512_W_H[i] = view.getUint32(offset);
@@ -692,45 +757,13 @@ var SHA2_64B = class extends HashMD {
   }
 };
 var _SHA512 = class extends SHA2_64B {
-  Ah = SHA512_IV[0] | 0;
-  Al = SHA512_IV[1] | 0;
-  Bh = SHA512_IV[2] | 0;
-  Bl = SHA512_IV[3] | 0;
-  Ch = SHA512_IV[4] | 0;
-  Cl = SHA512_IV[5] | 0;
-  Dh = SHA512_IV[6] | 0;
-  Dl = SHA512_IV[7] | 0;
-  Eh = SHA512_IV[8] | 0;
-  El = SHA512_IV[9] | 0;
-  Fh = SHA512_IV[10] | 0;
-  Fl = SHA512_IV[11] | 0;
-  Gh = SHA512_IV[12] | 0;
-  Gl = SHA512_IV[13] | 0;
-  Hh = SHA512_IV[14] | 0;
-  Hl = SHA512_IV[15] | 0;
   constructor() {
-    super(64);
+    super(64, SHA512_IV);
   }
 };
 var _SHA384 = class extends SHA2_64B {
-  Ah = SHA384_IV[0] | 0;
-  Al = SHA384_IV[1] | 0;
-  Bh = SHA384_IV[2] | 0;
-  Bl = SHA384_IV[3] | 0;
-  Ch = SHA384_IV[4] | 0;
-  Cl = SHA384_IV[5] | 0;
-  Dh = SHA384_IV[6] | 0;
-  Dl = SHA384_IV[7] | 0;
-  Eh = SHA384_IV[8] | 0;
-  El = SHA384_IV[9] | 0;
-  Fh = SHA384_IV[10] | 0;
-  Fl = SHA384_IV[11] | 0;
-  Gh = SHA384_IV[12] | 0;
-  Gl = SHA384_IV[13] | 0;
-  Hh = SHA384_IV[14] | 0;
-  Hl = SHA384_IV[15] | 0;
   constructor() {
-    super(48);
+    super(48, SHA384_IV);
   }
 };
 var sha256 = /* @__PURE__ */ createHasher(
@@ -747,8 +780,26 @@ var sha384 = /* @__PURE__ */ createHasher(
 );
 
 // node_modules/@noble/curves/utils.js
+function aarray(item, title, inner = () => {
+}) {
+  if (!Array.isArray(item))
+    throw new TypeError(`"${title}" expected array, got type=${typeof item}`);
+  for (let i = 0; i < item.length; i++)
+    inner(item[i], `${title}[${i}]`);
+  return item;
+}
 var abytes2 = (value, length, title) => abytes(value, length, title);
 var anumber2 = anumber;
+function aobject2(value, title = "object") {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw new TypeError(title === "object" ? "expected valid options object" : `"${title}" expected object, got type=${typeof value}`);
+  return value;
+}
+function afunction(value, title) {
+  if (typeof value !== "function")
+    throw new TypeError(`"${title}" is invalid: expected function, got ${typeof value}`);
+  return value;
+}
 var bytesToHex2 = bytesToHex;
 var concatBytes2 = (...arrays) => concatBytes(...arrays);
 var hexToBytes2 = (hex) => hexToBytes(hex);
@@ -756,11 +807,10 @@ var isBytes2 = isBytes;
 var randomBytes2 = (bytesLength) => randomBytes(bytesLength);
 var _0n = /* @__PURE__ */ BigInt(0);
 var _1n = /* @__PURE__ */ BigInt(1);
+var atitle2 = (title) => title ? `"${title}" ` : "";
 function abool(value, title = "") {
-  if (typeof value !== "boolean") {
-    const prefix = title && `"${title}" `;
-    throw new TypeError(prefix + "expected boolean, got type=" + typeof value);
-  }
+  if (typeof value !== "boolean")
+    throw new TypeError(atitle2(title) + "expected boolean, got type=" + typeof value);
   return value;
 }
 function abignumber(n) {
@@ -781,10 +831,6 @@ function asafenumber(value, title = "") {
     throw new RangeError(prefix + "expected safe integer, got " + value);
   }
 }
-function numberToHexUnpadded(num) {
-  const hex = abignumber(num).toString(16);
-  return hex.length & 1 ? "0" + hex : hex;
-}
 function hexToNumber(hex) {
   if (typeof hex !== "string")
     throw new TypeError("hex string expected, got " + typeof hex);
@@ -799,12 +845,13 @@ function bytesToNumberLE(bytes) {
 function numberToBytesBE(n, len) {
   anumber(len);
   if (len === 0)
-    throw new RangeError("zero length");
+    throw new Error("zero output length is invalid");
   n = abignumber(n);
+  const expectedLen = len * 2;
   const hex = n.toString(16);
-  if (hex.length > len * 2)
-    throw new RangeError("number too large");
-  return hexToBytes(hex.padStart(len * 2, "0"));
+  if (hex.length > expectedLen)
+    throw new RangeError("number is too large");
+  return hexToBytes(hex.padStart(expectedLen, "0"));
 }
 function numberToBytesLE(n, len) {
   return numberToBytesBE(n, len).reverse();
@@ -833,7 +880,9 @@ function asciiToBytes(ascii) {
     return charCode;
   });
 }
-var isPosBig = (n) => typeof n === "bigint" && _0n <= n;
+function isPosBig(n) {
+  return typeof n === "bigint" && _0n <= n;
+}
 function inRange(n, min, max) {
   return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;
 }
@@ -844,24 +893,27 @@ function aInRange(title, n, min, max) {
 function bitLen(n) {
   if (n < _0n)
     throw new Error("expected non-negative bigint, got " + n);
-  let len;
-  for (len = 0; n > _0n; n >>= _1n, len += 1)
-    ;
-  return len;
-}
-var bitMask = (n) => (_1n << BigInt(n)) - _1n;
-function validateObject(object, fields = {}, optFields = {}) {
-  if (Object.prototype.toString.call(object) !== "[object Object]")
-    throw new TypeError("expected valid options object");
+  return n === _0n ? 0 : n.toString(2).length;
+}
+var bitMask = (n) => {
+  asafenumber(n, "n");
+  return (_1n << BigInt(n)) - _1n;
+};
+function validateObject(object, fields = {}, optFields = {}, title = "object") {
+  aobject2(object, title);
+  aobject2(fields, "fields");
+  aobject2(optFields, "optFields");
   function checkField(fieldName, expectedType, isOpt) {
-    if (!isOpt && expectedType !== "function" && !Object.hasOwn(object, fieldName))
-      throw new TypeError(`param "${fieldName}" is invalid: expected own property`);
+    const label = title === "object" ? `param "${String(fieldName)}"` : `"${title}.${String(fieldName)}"`;
     const val = object[fieldName];
+    if (!Object.hasOwn(object, fieldName) && (isOpt ? val !== void 0 : expectedType !== "function")) {
+      throw new TypeError(`${label} is invalid: expected own property`);
+    }
     if (isOpt && val === void 0)
       return;
     const current = typeof val;
     if (current !== expectedType || val === null)
-      throw new TypeError(`param "${fieldName}" is invalid: expected ${expectedType}, got ${current}`);
+      throw new TypeError(`${label} is invalid: expected ${expectedType}, got ${current}`);
   }
   const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));
   iter(fields, false);
@@ -881,14 +933,64 @@ var _5n = /* @__PURE__ */ BigInt(5);
 var _7n = /* @__PURE__ */ BigInt(7);
 var _8n = /* @__PURE__ */ BigInt(8);
 var _9n = /* @__PURE__ */ BigInt(9);
+var _15n = /* @__PURE__ */ BigInt(15);
 var _16n = /* @__PURE__ */ BigInt(16);
+var POW_WINDOWED_MIN = /* @__PURE__ */ BigInt("0x10000000000000000");
 function mod(a, b) {
   if (b <= _0n2)
     throw new Error("mod: expected positive modulus, got " + b);
   const result = a % b;
   return result >= _0n2 ? result : b + result;
 }
+function pow(num, power, modulo) {
+  if (modulo <= _1n2)
+    throw new Error("pow: expected modulus > 1, got " + modulo);
+  if (typeof power !== "bigint")
+    throw new TypeError("invalid exponent: expected bigint, got " + typeof power);
+  if (power < _0n2)
+    throw new Error("invalid exponent, negatives unsupported");
+  if (power === _0n2)
+    return _1n2;
+  if (power === _1n2)
+    return num;
+  let d = num % modulo;
+  if (d < _0n2)
+    d += modulo;
+  if (power < POW_WINDOWED_MIN) {
+    let p2 = _1n2;
+    while (power > _0n2) {
+      if (power & _1n2)
+        p2 = p2 * d % modulo;
+      d = d * d % modulo;
+      power >>= _1n2;
+    }
+    return p2;
+  }
+  const digits = [];
+  while (power > _0n2) {
+    digits.push(Number(power & _15n));
+    power >>= _4n;
+  }
+  const table = new Array(16);
+  table[0] = _1n2;
+  table[1] = d;
+  for (let i = 2; i < 16; i++)
+    table[i] = table[i - 1] * d % modulo;
+  let p = table[digits[digits.length - 1]];
+  for (let w = digits.length - 2; w >= 0; w--) {
+    p = p * p % modulo;
+    p = p * p % modulo;
+    p = p * p % modulo;
+    p = p * p % modulo;
+    const digit = digits[w];
+    if (digit !== 0)
+      p = p * table[digit] % modulo;
+  }
+  return p;
+}
 function pow2(x, power, modulo) {
+  if (modulo <= _1n2)
+    throw new Error("pow2: expected modulus > 1, got " + modulo);
   if (power < _0n2)
     throw new Error("pow2: expected non-negative exponent, got " + power);
   let res = x;
@@ -901,17 +1003,16 @@ function pow2(x, power, modulo) {
 function invert(number, modulo) {
   if (number === _0n2)
     throw new Error("invert: expected non-zero number");
-  if (modulo <= _0n2)
-    throw new Error("invert: expected positive modulus, got " + modulo);
+  if (modulo <= _1n2)
+    throw new Error("invert: expected modulus > 1, got " + modulo);
   let a = mod(number, modulo);
   let b = modulo;
-  let x = _0n2, y = _1n2, u = _1n2, v = _0n2;
+  let x = _0n2, u = _1n2;
   while (a !== _0n2) {
     const q = b / a;
     const r = b - a * q;
     const m = x - u * q;
-    const n = y - v * q;
-    b = a, a = r, x = u, y = v, u = m, v = n;
+    b = a, a = r, x = u, u = m;
   }
   const gcd = b;
   if (gcd !== _1n2)
@@ -923,6 +1024,10 @@ function assertIsSquare(Fp2, root, n) {
   if (!F.eql(F.sqr(root), n))
     throw new Error("Cannot find square root");
 }
+function aoddModulus(order, fnName) {
+  if ((order & _1n2) === _0n2)
+    throw new Error(fnName + ": expected odd modulus, got " + order);
+}
 function sqrt3mod4(Fp2, n) {
   const F = Fp2;
   const p1div4 = (F.ORDER + _1n2) / _4n;
@@ -967,6 +1072,7 @@ function sqrt9mod16(P) {
 function tonelliShanks(P) {
   if (P < _3n)
     throw new Error("sqrt is not defined for small field");
+  aoddModulus(P, "tonelliShanks");
   let Q = P - _1n2;
   let S = 0;
   while (Q % _2n === _0n2) {
@@ -995,7 +1101,7 @@ function tonelliShanks(P) {
     let R = F.pow(n, Q1div2);
     while (!F.eql(t, F.ONE)) {
       if (F.is0(t))
-        return F.ZERO;
+        throw new Error("Cannot find square root: probably non-prime P");
       let i = 1;
       let t_tmp = F.sqr(t);
       while (!F.eql(t_tmp, F.ONE)) {
@@ -1015,6 +1121,7 @@ function tonelliShanks(P) {
   };
 }
 function FpSqrt(P) {
+  aoddModulus(P, "Fp.sqrt");
   if (P % _4n === _3n)
     return sqrt3mod4;
   if (P % _8n === _5n)
@@ -1044,43 +1151,23 @@ var FIELD_FIELDS = [
   "sqrN"
 ];
 function validateField(field) {
-  const initial = {
-    ORDER: "bigint",
-    BYTES: "number",
-    BITS: "number"
-  };
-  const opts = FIELD_FIELDS.reduce((map, val) => {
-    map[val] = "function";
-    return map;
-  }, initial);
-  validateObject(field, opts);
+  aobject2(field, "field");
+  if (typeof field.ORDER !== "bigint")
+    throw new TypeError('param "ORDER" is invalid: expected bigint, got ' + typeof field.ORDER);
   asafenumber(field.BYTES, "BYTES");
   asafenumber(field.BITS, "BITS");
+  for (const name of FIELD_FIELDS)
+    afunction(field[name], "field." + name);
   if (field.BYTES < 1 || field.BITS < 1)
     throw new Error("invalid field: expected BYTES/BITS > 0");
   if (field.ORDER <= _1n2)
     throw new Error("invalid field: expected ORDER > 1, got " + field.ORDER);
   return field;
 }
-function FpPow(Fp2, num, power) {
-  const F = Fp2;
-  if (power < _0n2)
-    throw new Error("invalid exponent, negatives unsupported");
-  if (power === _0n2)
-    return F.ONE;
-  if (power === _1n2)
-    return num;
-  let p = F.ONE;
-  let d = num;
-  while (power > _0n2) {
-    if (power & _1n2)
-      p = F.mul(p, d);
-    d = F.sqr(d);
-    power >>= _1n2;
-  }
-  return p;
-}
 function FpInvertBatch(Fp2, nums, passZero = false) {
+  validateField(Fp2);
+  aarray(nums, "nums");
+  abool(passZero, "passZero");
   const F = Fp2;
   const inverted = new Array(nums.length).fill(passZero ? F.ZERO : void 0);
   const multipliedAcc = nums.reduce((acc, num, i) => {
@@ -1099,7 +1186,9 @@ function FpInvertBatch(Fp2, nums, passZero = false) {
   return inverted;
 }
 function FpLegendre(Fp2, n) {
+  validateField(Fp2);
   const F = Fp2;
+  aoddModulus(F.ORDER, "FpLegendre");
   const p1mod2 = (F.ORDER - _1n2) / _2n;
   const powered = F.pow(n, p1mod2);
   const yes = F.eql(powered, F.ONE);
@@ -1122,7 +1211,7 @@ function nLength(n, nBitLength) {
     throw new Error("invalid n length: expected positive bit length, got " + nBitLength);
   const bits = bitLen(n);
   if (nBitLength !== void 0 && nBitLength < bits)
-    throw new Error(`invalid n length: expected bit length (${bits}) >= n.length (${nBitLength})`);
+    throw new Error(`invalid n length: expected nBitLength (${nBitLength}) >= bitLen(n) (${bits})`);
   const _nBitLength = nBitLength !== void 0 ? nBitLength : bits;
   const nByteLength = Math.ceil(_nBitLength / 8);
   return { nBitLength: _nBitLength, nByteLength };
@@ -1199,7 +1288,7 @@ var _Field = class {
     return mod(lhs * rhs, this.ORDER);
   }
   pow(num, power) {
-    return FpPow(this, num, power);
+    return pow(num, power, this.ORDER);
   }
   div(lhs, rhs) {
     return mod(lhs * invert(rhs, this.ORDER), this.ORDER);
@@ -1253,7 +1342,7 @@ var _Field = class {
   }
   // TODO: we don't need it here, move out to separate fn
   invertBatch(lst) {
-    return FpInvertBatch(this, lst);
+    return FpInvertBatch(this, lst, true);
   }
   // We can't move this out because Fp6, Fp12 implement it
   // and it's unclear what to return in there.
@@ -1262,8 +1351,8 @@ var _Field = class {
     return condition ? b : a;
   }
 };
-Object.freeze(_Field.prototype);
 function Field(ORDER, opts = {}) {
+  Object.freeze(_Field.prototype);
   return new _Field(ORDER, opts);
 }
 function getFieldBytesLength(fieldOrder) {
@@ -1293,274 +1382,348 @@ function mapHashToField(key, fieldOrder, isLE = false) {
 // node_modules/@noble/curves/abstract/curve.js
 var _0n3 = /* @__PURE__ */ BigInt(0);
 var _1n3 = /* @__PURE__ */ BigInt(1);
+var _4n2 = /* @__PURE__ */ BigInt(4);
+var BLIND_BYTES = 16;
+var BLIND_BITS = 128;
+var FW_WINDOW = 5;
+var TABLE_BYTES_MAX = /* @__PURE__ */ (() => 2 ** 31)();
 function validatePointCons(Point) {
   const pc = Point;
   if (typeof pc !== "function")
-    throw new TypeError("Point must be a constructor");
-  validateObject({
-    Fp: pc.Fp,
-    Fn: pc.Fn,
-    fromAffine: pc.fromAffine,
-    fromBytes: pc.fromBytes,
-    fromHex: pc.fromHex
-  }, {
-    Fp: "object",
-    Fn: "object",
-    fromAffine: "function",
-    fromBytes: "function",
-    fromHex: "function"
-  });
+    throw new TypeError('"Point" expected constructor, got type=' + typeof Point);
+  afunction(pc.fromAffine, "Point.fromAffine");
+  afunction(pc.fromBytes, "Point.fromBytes");
+  afunction(pc.fromHex, "Point.fromHex");
+  aobject2(pc.BASE, "Point.BASE");
+  aobject2(pc.ZERO, "Point.ZERO");
   validateField(pc.Fp);
   validateField(pc.Fn);
 }
-function negateCt(condition, item) {
-  const neg = item.negate();
-  return condition ? neg : item;
-}
 function normalizeZ(c, points) {
+  validatePointCons(c);
+  validateMSMPoints(points, c);
   const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));
   return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));
 }
-function validateW(W, bits) {
-  if (!Number.isSafeInteger(W) || W <= 0 || W > bits)
-    throw new Error("invalid window size, expected [1.." + bits + "], got W=" + W);
+function validateW(W, bits, min = 1) {
+  if (!Number.isSafeInteger(W) || W < min || W > bits)
+    throw new Error("invalid window size, expected [" + min + ".." + bits + "], got W=" + W);
 }
-function calcWOpts(W, scalarBits) {
-  validateW(W, scalarBits);
-  const windows = Math.ceil(scalarBits / W) + 1;
-  const windowSize = 2 ** (W - 1);
-  const maxNumber = 2 ** W;
-  const mask = bitMask(W);
-  const shiftBy = BigInt(W);
-  return { windows, windowSize, mask, maxNumber, shiftBy };
-}
-function calcOffsets(n, window, wOpts) {
-  const { windowSize, mask, maxNumber, shiftBy } = wOpts;
-  let wbits = Number(n & mask);
-  let nextN = n >> shiftBy;
-  if (wbits > windowSize) {
-    wbits -= maxNumber;
-    nextN += _1n3;
-  }
-  const offsetStart = window * windowSize;
-  const offset = offsetStart + Math.abs(wbits) - 1;
-  const isZero = wbits === 0;
-  const isNeg = wbits < 0;
-  const isNegF = window % 2 !== 0;
-  const offsetF = offsetStart;
-  return { nextN, offset, isZero, isNeg, isNegF, offsetF };
+function validateTableBytes(numPoints, fpBytes) {
+  const bytes = numPoints * (4 * fpBytes + 128);
+  if (bytes > TABLE_BYTES_MAX)
+    throw new Error("invalid window size: table would need ~" + Math.ceil(bytes / 2 ** 20) + " MiB, max " + TABLE_BYTES_MAX / 2 ** 20 + " MiB");
+}
+function probeRandomBytes(randomBytes3, length) {
+  if (randomBytes3 === void 0)
+    return void 0;
+  afunction(randomBytes3, "randomBytes");
+  try {
+    const probe = randomBytes3(length);
+    if (!isBytes2(probe) || probe.length !== length)
+      return void 0;
+  } catch {
+    return void 0;
+  }
+  return randomBytes3;
 }
 function validateMSMPoints(points, c) {
-  if (!Array.isArray(points))
-    throw new Error("array expected");
+  aarray(points, "points");
   points.forEach((p, i) => {
     if (!(p instanceof c))
       throw new Error("invalid point at index " + i);
   });
 }
-function validateMSMScalars(scalars, field) {
+function validateMSMScalars(scalars, field, maxScalar) {
   if (!Array.isArray(scalars))
     throw new Error("array of scalars expected");
   scalars.forEach((s, i) => {
-    if (!field.isValid(s))
+    const ok = maxScalar === void 0 ? field.isValid(s) : isPosBig(s) && s < maxScalar;
+    if (!ok)
       throw new Error("invalid scalar at index " + i);
   });
 }
-var pointPrecomputes = /* @__PURE__ */ new WeakMap();
 var pointWindowSizes = /* @__PURE__ */ new WeakMap();
-function getW(P) {
+function getWindowSize(P) {
   return pointWindowSizes.get(P) || 1;
 }
-function assert0(n) {
+function oddMultiples(p, size) {
+  const dbl = p.double();
+  const t = [p];
+  for (let j = 1; j < size; j++)
+    t.push(t[j - 1].add(dbl));
+  return t;
+}
+function wnafDigits(n, W) {
+  const size = 2 ** W;
+  const half = size / 2;
+  const mask = BigInt(size - 1);
+  const d = [];
+  while (n > _0n3) {
+    let w = 0;
+    if (n & _1n3) {
+      w = Number(n & mask);
+      if (w >= half)
+        w -= size;
+      n -= BigInt(w);
+    }
+    d.push(w);
+    n >>= _1n3;
+  }
+  return d;
+}
+function signedWindowDigits(n, W, windows) {
+  const size = 2 ** W;
+  const half = size / 2;
+  const mask = BigInt(size - 1);
+  const shiftBy = BigInt(W);
+  const d = [];
+  for (let w = 0; w < windows; w++) {
+    let v = Number(n & mask);
+    n >>= shiftBy;
+    if (v > half) {
+      v -= size;
+      n += _1n3;
+    }
+    d.push(v);
+  }
   if (n !== _0n3)
-    throw new Error("invalid wNAF");
+    throw new Error("invalid wnaf");
+  return d;
+}
+function wnafWalk(zero, tables, digits) {
+  let max = 0;
+  for (const d of digits)
+    max = Math.max(max, d.length);
+  let acc = zero;
+  for (let bit = max - 1; bit >= 0; bit--) {
+    if (bit !== max - 1)
+      acc = acc.double();
+    for (let i = 0; i < digits.length; i++) {
+      const w = digits[i][bit];
+      if (w) {
+        const item = tables[i][Math.abs(w) - 1 >> 1];
+        acc = acc.add(w < 0 ? item.negate() : item);
+      }
+    }
+  }
+  return acc;
 }
-var wNAF = class {
+var ScalarMultiplier = class {
+  Point;
   BASE;
   ZERO;
-  Fn;
+  randomBytes;
+  wnafPrecomputes = /* @__PURE__ */ new WeakMap();
+  baseCanBeBlinded;
   bits;
   // Parametrized with a given Point class (not individual point)
-  constructor(Point, bits) {
+  constructor(Point, randomBytes3) {
+    validatePointCons(Point);
+    this.randomBytes = probeRandomBytes(randomBytes3, BLIND_BYTES);
+    this.Point = Point;
     this.BASE = Point.BASE;
     this.ZERO = Point.ZERO;
-    this.Fn = Point.Fn;
-    this.bits = bits;
-  }
-  // non-const time multiplication ladder
-  _unsafeLadder(elm, n, p = this.ZERO) {
-    let d = elm;
-    while (n > _0n3) {
-      if (n & _1n3)
-        p = p.add(d);
-      d = d.double();
-      n >>= _1n3;
-    }
-    return p;
+    this.bits = Point.Fn.BITS;
   }
   /**
-   * Creates a wNAF precomputation window. Used for caching.
-   * Default window size is set by `utils.precompute()` and is equal to 8.
-   * Number of precomputed points depends on the curve size:
-   * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
-   * - 𝑊 is the window size
-   * - 𝑛 is the bitlength of the curve order.
-   * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+   * Creates a signed fixed-window wNAF precomputation table: for every window w, the
+   * multiples `[1..2^(W−1)]⋅2^(w⋅W)⋅P`, flattened. All doublings are baked into the table,
+   * so cached multiplication is additions-only. `windows = ceil(bits/W) + 1`: the extra
+   * window absorbs the final carry of signed-digit recoding.
+   * For a 256-bit curve and W=6, the table is 44⋅32 = 1408 points.
    * @param point - Point instance
    * @param W - window size
-   * @returns precomputed point tables flattened to a single array
+   * @param bits - scalar bitlength the table must cover
    */
-  precomputeWindow(point, W) {
-    const { windows, windowSize } = calcWOpts(W, this.bits);
-    const points = [];
-    let p = point;
-    let base = p;
-    for (let window = 0; window < windows; window++) {
-      base = p;
-      points.push(base);
-      for (let i = 1; i < windowSize; i++) {
-        base = base.add(p);
-        points.push(base);
+  buildWnafTable(point, W, bits) {
+    const windows = Math.ceil(bits / W) + 1;
+    const half = 2 ** (W - 1);
+    const comp = [];
+    let base = point;
+    for (let w = 0; w < windows; w++) {
+      let acc = base;
+      for (let i = 0; i < half; i++) {
+        comp.push(acc);
+        acc = acc.add(base);
       }
-      p = base.double();
+      base = comp[comp.length - 1].double();
     }
-    return points;
+    return { W, bits, windows, comp };
   }
   /**
-   * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
-   * More compact implementation:
-   * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
+   * Implements ec multiplication using precomputed signed fixed-window wNAF tables.
+   * Constant-time: fixed window count with one table addition per window — zero digits feed
+   * the fake accumulator — and no doublings; the lookup scans the whole window slice.
+   * Scalar bounds are validated by the public entry points ({@link ScalarMultiplier.mulCT},
+   * {@link ScalarMultiplier.mulCTBlinded}, {@link ScalarMultiplier.mulUnsafe});
+   * signedWindowDigits throws if `n` exceeds the table.
    * @returns real and fake (for const-time) points
    */
-  wNAF(W, precomputes, n) {
-    if (!this.Fn.isValid(n))
-      throw new Error("invalid scalar");
+  wnafCachedCT(precomputes, n) {
+    const { W, windows, comp } = precomputes;
+    const half = 2 ** (W - 1);
+    const digits = signedWindowDigits(n, W, windows);
     let p = this.ZERO;
     let f = this.BASE;
-    const wo = calcWOpts(W, this.bits);
-    for (let window = 0; window < wo.windows; window++) {
-      const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);
-      n = nextN;
-      if (isZero) {
-        f = f.add(negateCt(isNegF, precomputes[offsetF]));
-      } else {
-        p = p.add(negateCt(isNeg, precomputes[offset]));
-      }
+    for (let w = 0; w < windows; w++) {
+      const digit = digits[w];
+      const start = w * half;
+      const idx = Math.abs(digit) - 1;
+      let sel = comp[start];
+      for (let i = 1; i < half; i++)
+        sel = i === idx ? comp[start + i] : sel;
+      const neg = sel.negate();
+      if (digit === 0)
+        f = f.add(comp[start]);
+      else
+        p = p.add(digit < 0 ? neg : sel);
     }
-    assert0(n);
     return { p, f };
   }
-  /**
-   * Implements unsafe EC multiplication using precomputed tables
-   * and w-ary non-adjacent form.
-   * @param acc - accumulator point to add result of multiplication
-   * @returns point
-   */
-  wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {
-    const wo = calcWOpts(W, this.bits);
-    for (let window = 0; window < wo.windows; window++) {
-      if (n === _0n3)
-        break;
-      const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);
-      n = nextN;
-      if (isZero) {
-        continue;
-      } else {
-        const item = precomputes[offset];
-        acc = acc.add(isNeg ? item.negate() : item);
-      }
-    }
-    assert0(n);
-    return acc;
-  }
-  getPrecomputes(W, point, transform) {
-    let comp = pointPrecomputes.get(point);
+  // Cache key is point identity plus (W, bits); at most two entries exist per point (public-width
+  // `Fn.BITS` and blinded `Fn.BITS + BLIND_BITS`). Callers must not reuse the same point with
+  // incompatible `transform(...)` layouts and expect a separate cache entry.
+  getWnafPrecomputes(W, point, bits, transform) {
+    let entries = this.wnafPrecomputes.get(point);
+    let comp = entries?.find((entry) => entry.W === W && entry.bits === bits);
     if (!comp) {
-      comp = this.precomputeWindow(point, W);
-      if (W !== 1) {
-        if (typeof transform === "function")
-          comp = transform(comp);
-        pointPrecomputes.set(point, comp);
+      comp = this.buildWnafTable(point, W, bits);
+      if (typeof transform === "function")
+        comp = { ...comp, comp: transform(comp.comp) };
+      if (!entries) {
+        entries = [];
+        this.wnafPrecomputes.set(point, entries);
       }
+      entries.push(comp);
     }
     return comp;
   }
-  cached(point, scalar, transform) {
-    const W = getW(point);
-    return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);
+  assertPoint(point) {
+    if (!(point instanceof this.Point))
+      throw new TypeError('"point" expected Point instance, got type=' + typeof point);
   }
-  unsafe(point, scalar, transform, prev) {
-    const W = getW(point);
+  // Shared prologue of the constant-time entry points. Rejects scalar 0: in key/signature-style
+  // callers a zero scalar means broken upstream plumbing, and concrete Points already reject it.
+  // Uses inRange instead of Fn.isValidNot0: validateField() only certifies the arithmetic subset.
+  validateMulInput(point, scalar) {
+    this.assertPoint(point);
+    if (!inRange(scalar, _1n3, this.Point.Fn.ORDER))
+      throw new Error("invalid scalar");
+  }
+  // Constant-time dispatch shared by mulCT / mulCTBlinded. Un-precomputed points (W===1, e.g.
+  // ECDH peer keys) skip building a throwaway cached table in favor of a small fixed-window
+  // multiply. `n` must be < 2^bits.
+  runCT(point, n, bits, transform) {
+    const W = getWindowSize(point);
     if (W === 1)
-      return this._unsafeLadder(point, scalar, prev);
-    return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);
+      return this.fixedWindowCT(point, n, bits);
+    return this.wnafCachedCT(this.getWnafPrecomputes(W, point, bits, transform), n);
+  }
+  mulCT(point, scalar, transform) {
+    this.validateMulInput(point, scalar);
+    return this.runCT(point, scalar, this.bits, transform);
+  }
+  mulCTBlinded(point, scalar, transform) {
+    this.validateMulInput(point, scalar);
+    if (this.randomBytes === void 0)
+      throw new Error("randomBytes is required for scalar blinding");
+    const bits = this.Point.Fn.BITS + BLIND_BITS;
+    const blind = this.randomBytes(BLIND_BYTES);
+    if (!isBytes2(blind) || blind.length !== BLIND_BYTES)
+      throw new Error("randomBytes returned invalid byte array");
+    blind[0] = blind[0] & 63 | 128;
+    const n = scalar + bytesToNumberBE(blind) * this.Point.Fn.ORDER;
+    return this.runCT(point, n, bits, transform);
   }
-  // We calculate precomputes for elliptic curve point multiplication
-  // using windowed method. This specifies window size and
-  // stores precomputed values. Usually only base point would be precomputed.
-  createCache(P, W) {
+  /**
+   * Constant-time multiplication `n*point` for an un-precomputed point, via a small fixed window.
+   * A cached wNAF table only pays off when reused; a flat 2^FW_WINDOW table (`size-1` adds) is
+   * far cheaper to build for a single use. The point-operation sequence is independent of `n`:
+   * build the table, then per window exactly FW_WINDOW doublings, a data-oblivious scan over
+   * every table entry, and one addition (adds the identity when the window digit is 0 — never
+   * skipped).
+   *
+   * `n` must be `< 2^bits`. Assumes complete addition (adding the identity costs the same as any
+   * add), which holds for the Weierstrass/Edwards point types used here. The table is left in
+   * projective form (no normalizeZ): normalizing this small a table costs more than the
+   * mixed-add savings it would buy for a single multiply.
+   * @returns real point `p`; `f` duplicates it only to match {@link wnafCachedCT}'s return shape
+   * (this path needs no fake accumulator — its op-count is already scalar-independent).
+   */
+  fixedWindowCT(point, n, bits) {
+    const W = FW_WINDOW;
+    const size = 1 << W;
+    const mask = bitMask(W);
+    const table = new Array(size);
+    table[0] = this.ZERO;
+    for (let i = 1; i < size; i++)
+      table[i] = table[i - 1].add(point);
+    const windows = Math.ceil(bits / W);
+    let acc = this.ZERO;
+    for (let window = windows - 1; window >= 0; window--) {
+      if (window !== windows - 1)
+        for (let d = 0; d < W; d++)
+          acc = acc.double();
+      const digit = Number(n >> BigInt(window * W) & mask);
+      let sel = table[0];
+      for (let i = 1; i < size; i++)
+        sel = i === digit ? table[i] : sel;
+      acc = acc.add(sel);
+    }
+    return { p: acc, f: acc };
+  }
+  shouldBlind(point, cofactor) {
+    if (this.randomBytes === void 0)
+      return false;
+    if (cofactor === _1n3)
+      return true;
+    if (point !== this.BASE)
+      return false;
+    if (this.baseCanBeBlinded === void 0)
+      this.baseCanBeBlinded = this.mulUnsafe(this.BASE, this.Point.Fn.ORDER).is0();
+    return this.baseCanBeBlinded;
+  }
+  mulSecret(point, scalar, cofactor, transform) {
+    return this.shouldBlind(point, cofactor) ? this.mulCTBlinded(point, scalar, transform) : this.mulCT(point, scalar, transform);
+  }
+  mulUnsafe(point, scalar, transform) {
+    this.assertPoint(point);
+    if (!isPosBig(scalar))
+      throw new Error("invalid scalar");
+    const W = getWindowSize(point);
+    if (W === 1 || scalar >= this.Point.Fn.ORDER)
+      return mulAddUnsafe(this.Point, [point], [scalar], true);
+    const precomputes = this.getWnafPrecomputes(W, point, this.bits, transform);
+    return this.wnafCachedCT(precomputes, scalar).p;
+  }
+  // Remembers the window size used for precomputed wNAF multiplication of the given point
+  // and drops any previously built tables. Usually only the base point is precomputed.
+  // W=1 resets the point to the un-precomputed (table-less) paths.
+  // W is additionally capped so tables stay under ~2 GiB ({@link TABLE_BYTES_MAX}).
+  setWindowSize(point, W) {
+    this.assertPoint(point);
     validateW(W, this.bits);
-    pointWindowSizes.set(P, W);
-    pointPrecomputes.delete(P);
+    const windows = Math.ceil((this.bits + BLIND_BITS) / W) + 1;
+    validateTableBytes(windows * 2 ** (W - 1), this.Point.Fp.BYTES);
+    pointWindowSizes.set(point, W);
+    this.wnafPrecomputes.delete(point);
   }
-  hasCache(elm) {
-    return getW(elm) !== 1;
+  // True when a window size is set: tables themselves are built lazily on first multiply.
+  hasWindowSize(point) {
+    return getWindowSize(point) !== 1;
   }
 };
-function mulEndoUnsafe(Point, point, k1, k2) {
-  let acc = point;
-  let p1 = Point.ZERO;
-  let p2 = Point.ZERO;
-  while (k1 > _0n3 || k2 > _0n3) {
-    if (k1 & _1n3)
-      p1 = p1.add(acc);
-    if (k2 & _1n3)
-      p2 = p2.add(acc);
-    acc = acc.double();
-    k1 >>= _1n3;
-    k2 >>= _1n3;
-  }
-  return { p1, p2 };
-}
-function pippenger(c, points, scalars) {
-  const fieldN = c.Fn;
+function mulAddUnsafe(c, points, scalars, allowOversized = false) {
+  validatePointCons(c);
   validateMSMPoints(points, c);
-  validateMSMScalars(scalars, fieldN);
-  const plength = points.length;
-  const slength = scalars.length;
-  if (plength !== slength)
+  abool(allowOversized, "allowOversized");
+  validateMSMScalars(scalars, c.Fn, allowOversized ? c.Fn.ORDER ** _4n2 : void 0);
+  if (points.length !== scalars.length)
     throw new Error("arrays of points and scalars must have equal length");
-  const zero = c.ZERO;
-  const wbits = bitLen(BigInt(plength));
-  let windowSize = 1;
-  if (wbits > 12)
-    windowSize = wbits - 3;
-  else if (wbits > 4)
-    windowSize = wbits - 2;
-  else if (wbits > 0)
-    windowSize = 2;
-  const MASK = bitMask(windowSize);
-  const buckets = new Array(Number(MASK) + 1).fill(zero);
-  const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;
-  let sum = zero;
-  for (let i = lastBits; i >= 0; i -= windowSize) {
-    buckets.fill(zero);
-    for (let j = 0; j < slength; j++) {
-      const scalar = scalars[j];
-      const wbits2 = Number(scalar >> BigInt(i) & MASK);
-      buckets[wbits2] = buckets[wbits2].add(points[j]);
-    }
-    let resI = zero;
-    for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {
-      sumI = sumI.add(buckets[j]);
-      resI = resI.add(sumI);
-    }
-    sum = sum.add(resI);
-    if (i !== 0)
-      for (let j = 0; j < windowSize; j++)
-        sum = sum.double();
-  }
-  return sum;
+  const tables = points.map((p) => oddMultiples(p, 4));
+  const digits = scalars.map((n) => wnafDigits(n, 4));
+  return wnafWalk(c.ZERO, tables, digits);
 }
 function createField(order, field, isLE) {
   if (field) {
@@ -1573,13 +1736,16 @@ function createField(order, field, isLE) {
   }
 }
 function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
+  if (type !== "weierstrass" && type !== "edwards")
+    throw new Error('expected curve type "weierstrass" or "edwards"');
   if (FpFnLE === void 0)
     FpFnLE = type === "edwards";
   if (!CURVE || typeof CURVE !== "object")
     throw new Error(`expected valid ${type} CURVE object`);
+  validateObject(curveOpts);
   for (const p of ["p", "n", "h"]) {
     const val = CURVE[p];
-    if (!(typeof val === "bigint" && val > _0n3))
+    if (!(isPosBig(val) && val !== _0n3))
       throw new Error(`CURVE.${p} must be positive bigint`);
   }
   const Fp2 = createField(CURVE.p, curveOpts.Fp, FpFnLE);
@@ -1598,6 +1764,7 @@ function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
 var _0n4 = /* @__PURE__ */ BigInt(0);
 var _1n4 = /* @__PURE__ */ BigInt(1);
 var _2n2 = /* @__PURE__ */ BigInt(2);
+var _4n3 = /* @__PURE__ */ BigInt(4);
 var _8n2 = /* @__PURE__ */ BigInt(8);
 function isEdValidXY(Fp2, CURVE, x, y) {
   const x2 = Fp2.sqr(x);
@@ -1607,14 +1774,24 @@ function isEdValidXY(Fp2, CURVE, x, y) {
   return Fp2.eql(left, right);
 }
 function edwards(params, extraOpts = {}) {
+  validateObject(extraOpts, {}, {}, "extraOpts");
   const opts = extraOpts;
   const validated = createCurveFields("edwards", params, opts, opts.FpFnLE);
   const { Fp: Fp2, Fn: Fn2 } = validated;
   let CURVE = validated.CURVE;
   const { h: cofactor } = CURVE;
-  validateObject(opts, {}, { uvRatio: "function" });
-  const MASK = _2n2 << BigInt(Fn2.BYTES * 8) - _1n4;
-  const modP = (n) => Fp2.create(n);
+  if (FpLegendre(Fp2, CURVE.a) !== 1)
+    throw new Error("edwards: CURVE.a must be a square in Fp for complete addition formulas");
+  if (FpLegendre(Fp2, CURVE.d) !== -1)
+    throw new Error("edwards: CURVE.d must be a non-square in Fp for complete addition formulas");
+  validateObject(opts, {}, { uvRatio: "function", randomBytes: "function" });
+  const randomBytes3 = opts.randomBytes === void 0 ? randomBytes2 : opts.randomBytes;
+  const MASK = _2n2 << BigInt(Fp2.BYTES * 8) - _1n4;
+  function isOdd(n) {
+    if (!Fp2.isOdd)
+      throw new Error("Field does not have .isOdd()");
+    return Fp2.isOdd(n);
+  }
   const uvRatio2 = opts.uvRatio === void 0 ? (u, v) => {
     try {
       return { isValid: true, value: Fp2.sqrt(Fp2.div(u, v)) };
@@ -1624,6 +1801,7 @@ function edwards(params, extraOpts = {}) {
   } : opts.uvRatio;
   if (!isEdValidXY(Fp2, CURVE, CURVE.Gx, CURVE.Gy))
     throw new Error("bad curve params: generator point");
+  const mulA = Fp2.eql(CURVE.a, Fp2.neg(Fp2.ONE)) ? (x) => Fp2.neg(x) : Fp2.eql(CURVE.a, Fp2.ONE) ? (x) => x : (x) => Fp2.mul(CURVE.a, x);
   function acoord(title, n, banZero = false) {
     const min = banZero ? _1n4 : _0n4;
     aInRange("coordinate " + title, n, min, MASK);
@@ -1634,14 +1812,9 @@ function edwards(params, extraOpts = {}) {
       throw new Error("EdwardsPoint expected");
   }
   class Point {
-    // base / generator point
-    static BASE = new Point(CURVE.Gx, CURVE.Gy, _1n4, modP(CURVE.Gx * CURVE.Gy));
-    // zero / infinity / identity point
-    static ZERO = new Point(_0n4, _1n4, _1n4, _0n4);
-    // 0, 1, 1, 0
-    // math field
+    static BASE = new Point(CURVE.Gx, CURVE.Gy, Fp2.ONE, Fp2.mul(CURVE.Gx, CURVE.Gy));
+    static ZERO = new Point(Fp2.ZERO, Fp2.ONE, Fp2.ONE, Fp2.ZERO);
     static Fp = Fp2;
-    // scalar field
     static Fn = Fn2;
     X;
     Y;
@@ -1668,7 +1841,7 @@ function edwards(params, extraOpts = {}) {
       const { x, y } = p || {};
       acoord("x", x);
       acoord("y", y);
-      return new Point(x, y, _1n4, modP(x * y));
+      return new Point(x, y, Fp2.ONE, Fp2.mul(x, y));
     }
     // Uses algo from RFC8032 5.1.3.
     static fromBytes(bytes, zip215 = false) {
@@ -1682,18 +1855,18 @@ function edwards(params, extraOpts = {}) {
       const y = bytesToNumberLE(normed);
       const max = zip215 ? MASK : Fp2.ORDER;
       aInRange("point.y", y, _0n4, max);
-      const y2 = modP(y * y);
-      const u = modP(y2 - _1n4);
-      const v = modP(d * y2 - a);
+      const y2 = Fp2.sqr(y);
+      const u = Fp2.sub(y2, Fp2.ONE);
+      const v = Fp2.sub(Fp2.mulN(d, y2), a);
       let { isValid, value: x } = uvRatio2(u, v);
       if (!isValid)
         throw new Error("bad point: invalid y coordinate");
-      const isXOdd = (x & _1n4) === _1n4;
+      const isXOdd = isOdd(x);
       const isLastByteOdd = (lastByte & 128) !== 0;
-      if (!zip215 && x === _0n4 && isLastByteOdd)
+      if (!zip215 && Fp2.is0(x) && isLastByteOdd)
         throw new Error("bad point: x=0 and x_0=1");
       if (isLastByteOdd !== isXOdd)
-        x = modP(-x);
+        x = Fp2.neg(x);
       return Point.fromAffine({ x, y });
     }
     static fromHex(hex, zip215 = false) {
@@ -1705,8 +1878,8 @@ function edwards(params, extraOpts = {}) {
     get y() {
       return this.toAffine().y;
     }
-    precompute(windowSize = 8, isLazy = true) {
-      wnaf.createCache(this, windowSize);
+    precompute(windowSize = 6, isLazy = true) {
+      wnaf.setWindowSize(this, windowSize);
       if (!isLazy)
         this.multiply(_2n2);
       return this;
@@ -1718,18 +1891,18 @@ function edwards(params, extraOpts = {}) {
       if (p.is0())
         throw new Error("bad point: ZERO");
       const { X, Y, Z, T } = p;
-      const X2 = modP(X * X);
-      const Y2 = modP(Y * Y);
-      const Z2 = modP(Z * Z);
-      const Z4 = modP(Z2 * Z2);
-      const aX2 = modP(X2 * a);
-      const left = modP(Z2 * modP(aX2 + Y2));
-      const right = modP(Z4 + modP(d * modP(X2 * Y2)));
-      if (left !== right)
+      const X2 = Fp2.sqr(X);
+      const Y2 = Fp2.sqr(Y);
+      const Z2 = Fp2.sqr(Z);
+      const Z4 = Fp2.sqr(Z2);
+      const aX2 = Fp2.mul(X2, a);
+      const left = Fp2.mul(Fp2.add(aX2, Y2), Z2);
+      const right = Fp2.add(Z4, Fp2.mul(d, Fp2.mul(X2, Y2)));
+      if (!Fp2.eql(left, right))
         throw new Error("bad point: equation left != right (1)");
-      const XY = modP(X * Y);
-      const ZT = modP(Z * T);
-      if (XY !== ZT)
+      const XY = Fp2.mul(X, Y);
+      const ZT = Fp2.mul(Z, T);
+      if (!Fp2.eql(XY, ZT))
         throw new Error("bad point: equation left != right (2)");
     }
     // Compare one point to another.
@@ -1737,37 +1910,36 @@ function edwards(params, extraOpts = {}) {
       aedpoint(other);
       const { X: X1, Y: Y1, Z: Z1 } = this;
       const { X: X2, Y: Y2, Z: Z2 } = other;
-      const X1Z2 = modP(X1 * Z2);
-      const X2Z1 = modP(X2 * Z1);
-      const Y1Z2 = modP(Y1 * Z2);
-      const Y2Z1 = modP(Y2 * Z1);
-      return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+      const X1Z2 = Fp2.mul(X1, Z2);
+      const X2Z1 = Fp2.mul(X2, Z1);
+      const Y1Z2 = Fp2.mul(Y1, Z2);
+      const Y2Z1 = Fp2.mul(Y2, Z1);
+      return Fp2.eql(X1Z2, X2Z1) && Fp2.eql(Y1Z2, Y2Z1);
     }
     is0() {
       return this.equals(Point.ZERO);
     }
     negate() {
-      return new Point(modP(-this.X), this.Y, this.Z, modP(-this.T));
+      return new Point(Fp2.neg(this.X), this.Y, this.Z, Fp2.neg(this.T));
     }
     // Fast algo for doubling Extended Point.
     // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
     // Cost: 4M + 4S + 1*a + 6add + 1*2.
     double() {
-      const { a } = CURVE;
       const { X: X1, Y: Y1, Z: Z1 } = this;
-      const A = modP(X1 * X1);
-      const B = modP(Y1 * Y1);
-      const C = modP(_2n2 * modP(Z1 * Z1));
-      const D = modP(a * A);
-      const x1y1 = X1 + Y1;
-      const E = modP(modP(x1y1 * x1y1) - A - B);
-      const G = D + B;
-      const F = G - C;
-      const H = D - B;
-      const X3 = modP(E * F);
-      const Y3 = modP(G * H);
-      const T3 = modP(E * H);
-      const Z3 = modP(F * G);
+      const A = Fp2.sqr(X1);
+      const B = Fp2.sqr(Y1);
+      const C = Fp2.mul(Fp2.sqr(Z1), _2n2);
+      const D = mulA(A);
+      const x1y1 = Fp2.addN(X1, Y1);
+      const E = Fp2.sub(Fp2.subN(Fp2.sqr(x1y1), A), B);
+      const G = Fp2.addN(D, B);
+      const F = Fp2.subN(G, C);
+      const H = Fp2.subN(D, B);
+      const X3 = Fp2.mul(E, F);
+      const Y3 = Fp2.mul(G, H);
+      const T3 = Fp2.mul(E, H);
+      const Z3 = Fp2.mul(F, G);
       return new Point(X3, Y3, Z3, T3);
     }
     // Fast algo for adding 2 Extended Points.
@@ -1775,21 +1947,21 @@ function edwards(params, extraOpts = {}) {
     // Cost: 9M + 1*a + 1*d + 7add.
     add(other) {
       aedpoint(other);
-      const { a, d } = CURVE;
+      const { d } = CURVE;
       const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;
       const { X: X2, Y: Y2, Z: Z2, T: T2 } = other;
-      const A = modP(X1 * X2);
-      const B = modP(Y1 * Y2);
-      const C = modP(T1 * d * T2);
-      const D = modP(Z1 * Z2);
-      const E = modP((X1 + Y1) * (X2 + Y2) - A - B);
-      const F = D - C;
-      const G = D + C;
-      const H = modP(B - a * A);
-      const X3 = modP(E * F);
-      const Y3 = modP(G * H);
-      const T3 = modP(E * H);
-      const Z3 = modP(F * G);
+      const A = Fp2.mul(X1, X2);
+      const B = Fp2.mul(Y1, Y2);
+      const C = Fp2.mul(Fp2.mulN(T1, d), T2);
+      const D = Fp2.mul(Z1, Z2);
+      const E = Fp2.sub(Fp2.subN(Fp2.mulN(Fp2.addN(X1, Y1), Fp2.addN(X2, Y2)), A), B);
+      const F = Fp2.subN(D, C);
+      const G = Fp2.addN(D, C);
+      const H = Fp2.sub(B, mulA(A));
+      const X3 = Fp2.mul(E, F);
+      const Y3 = Fp2.mul(G, H);
+      const T3 = Fp2.mul(E, H);
+      const Z3 = Fp2.mul(F, G);
       return new Point(X3, Y3, Z3, T3);
     }
     subtract(other) {
@@ -1800,8 +1972,8 @@ function edwards(params, extraOpts = {}) {
     multiply(scalar) {
       if (!Fn2.isValidNot0(scalar))
         throw new RangeError("invalid scalar: expected 1 <= sc < curve.n");
-      const { p, f } = wnaf.cached(this, scalar, (p2) => normalizeZ(Point, p2));
-      return normalizeZ(Point, [p, f])[0];
+      const { p, f } = wnaf.mulSecret(this, scalar, cofactor, normalize);
+      return normalize([p, f])[0];
     }
     // Non-constant-time multiplication. Uses double-and-add algorithm.
     // It's faster, but should only be used when you don't care about
@@ -1815,7 +1987,7 @@ function edwards(params, extraOpts = {}) {
         return Point.ZERO;
       if (this.is0() || scalar === _1n4)
         return this;
-      return wnaf.unsafe(this, scalar, (p) => normalizeZ(Point, p));
+      return wnaf.mulUnsafe(this, scalar, normalize);
     }
     // Checks if point is of small order.
     // If you add something to small order point, you will have "dirty"
@@ -1827,35 +1999,43 @@ function edwards(params, extraOpts = {}) {
     // Multiplies point by curve order and checks if the result is 0.
     // Returns `false` is the point is dirty.
     isTorsionFree() {
-      return wnaf.unsafe(this, CURVE.n).is0();
+      return wnaf.mulUnsafe(this, CURVE.n).is0();
     }
     // Converts Extended point to default (x, y) coordinates.
     // Can accept precomputed Z^-1 - for example, from invertBatch.
     toAffine(invertedZ) {
       const p = this;
       let iz = invertedZ;
+      if (iz != null && typeof iz !== "bigint")
+        throw new TypeError('"invertedZ" expected bigint, got type=' + typeof iz);
       const { X, Y, Z } = p;
       const is0 = p.is0();
       if (iz == null)
-        iz = is0 ? _8n2 : Fp2.inv(Z);
-      const x = modP(X * iz);
-      const y = modP(Y * iz);
+        iz = is0 ? Fp2.create(_8n2) : Fp2.inv(Z);
+      const x = Fp2.mul(X, iz);
+      const y = Fp2.mul(Y, iz);
       const zz = Fp2.mul(Z, iz);
       if (is0)
-        return { x: _0n4, y: _1n4 };
-      if (zz !== _1n4)
+        return { x: Fp2.ZERO, y: Fp2.ONE };
+      if (!Fp2.eql(zz, Fp2.ONE))
         throw new Error("invZ was invalid");
       return { x, y };
     }
     clearCofactor() {
       if (cofactor === _1n4)
         return this;
+      if (cofactor === _2n2)
+        return this.double();
+      if (cofactor === _4n3)
+        return this.double().double();
+      if (cofactor === _8n2)
+        return this.double().double().double();
       return this.multiplyUnsafe(cofactor);
     }
     toBytes() {
       const { x, y } = this.toAffine();
       const bytes = Fp2.toBytes(y);
-      bytes[bytes.length - 1] |= x & _1n4 ? 128 : 0;
+      bytes[bytes.length - 1] |= isOdd(x) ? 128 : 0;
       return bytes;
     }
     toHex() {
@@ -1865,9 +2045,10 @@ function edwards(params, extraOpts = {}) {
       return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
     }
   }
-  const wnaf = new wNAF(Point, Fn2.BITS);
-  if (Fn2.BITS >= 8)
-    Point.BASE.precompute(8);
+  const normalize = (points) => normalizeZ(Point, points);
+  const wnaf = new ScalarMultiplier(Point, randomBytes3);
+  if (wnaf.bits >= 6)
+    Point.BASE.precompute(6);
   Object.freeze(Point.prototype);
   Object.freeze(Point);
   return Point;
@@ -1954,6 +2135,11 @@ var PrimeEdwardsPoint = class {
 };
 
 // node_modules/@noble/curves/abstract/hash-to-curve.js
+var _0n5 = /* @__PURE__ */ BigInt(0);
+var _1n5 = /* @__PURE__ */ BigInt(1);
+var _2n3 = /* @__PURE__ */ BigInt(2);
+var _3n2 = /* @__PURE__ */ BigInt(3);
+var _4n4 = /* @__PURE__ */ BigInt(4);
 var os2ip = bytesToNumberBE;
 function i2osp(value, length) {
   asafenumber(value);
@@ -1987,6 +2173,10 @@ function normDST(DST) {
 function expand_message_xmd(msg, DST, lenInBytes, H) {
   abytes2(msg);
   asafenumber(lenInBytes);
+  if (typeof H !== "function")
+    throw new Error("expand_message_xmd: expected hash function");
+  asafenumber(H.outputLen, "hash.outputLen");
+  asafenumber(H.blockLen, "hash.blockLen");
   DST = normDST(DST);
   if (DST.length > 255)
     DST = H(concatBytes2(asciiToBytes("H2C-OVERSIZE-DST-"), DST));
@@ -2010,13 +2200,22 @@ function expand_message_xmd(msg, DST, lenInBytes, H) {
 function expand_message_xof(msg, DST, lenInBytes, k, H) {
   abytes2(msg);
   asafenumber(lenInBytes);
+  asafenumber(k, "k");
+  if (k < 0)
+    throw new Error("expand_message_xof: invalid k");
+  if (typeof H !== "function")
+    throw new Error("expand_message_xof: expected XOF function");
+  if (typeof H.create !== "function")
+    throw new Error("expand_message_xof: expected XOF create");
   DST = normDST(DST);
+  if (lenInBytes < 0 || lenInBytes > 65535)
+    throw new Error("expand_message_xof: invalid lenInBytes");
   if (DST.length > 255) {
     const dkLen = Math.ceil(2 * k / 8);
     DST = H.create({ dkLen }).update(asciiToBytes("H2C-OVERSIZE-DST-")).update(DST).digest();
   }
-  if (lenInBytes > 65535 || DST.length > 255)
-    throw new Error("expand_message_xof: invalid lenInBytes");
+  if (DST.length > 255)
+    throw new Error("expand_message_xof: invalid DST");
   return H.create({ dkLen: lenInBytes }).update(msg).update(i2osp(lenInBytes, 2)).update(DST).update(i2osp(DST.length, 1)).digest();
 }
 function hash_to_field(msg, count, options) {
@@ -2030,10 +2229,16 @@ function hash_to_field(msg, count, options) {
   asafenumber(hash.outputLen, "valid hash");
   abytes2(msg);
   asafenumber(count);
+  asafenumber(m, "m");
+  asafenumber(k, "k");
+  if (p <= BigInt(1))
+    throw new Error("hash_to_field: expected valid field characteristic");
   if (count < 1)
     throw new Error("hash_to_field: expected count >= 1");
   if (m < 1)
     throw new Error("hash_to_field: expected m >= 1");
+  if (k < 0)
+    throw new Error("hash_to_field: invalid k");
   const log2p = p.toString(2).length;
   const L = Math.ceil((log2p + k) / 8);
   const len_in_bytes = count * m * L;
@@ -2063,12 +2268,14 @@ var _DST_scalar = "HashToScalar-";
 function createHasher2(Point, mapToCurve, defaults) {
   if (typeof mapToCurve !== "function")
     throw new Error("mapToCurve() must be defined");
+  validateObject(defaults);
   const snapshot = (src) => Object.freeze({
     ...src,
     DST: isBytes2(src.DST) ? copyBytes(src.DST) : src.DST,
     ...src.encodeDST === void 0 ? {} : { encodeDST: isBytes2(src.encodeDST) ? copyBytes(src.encodeDST) : src.encodeDST }
   });
   const safeDefaults = snapshot(defaults);
+  const dstOverride = (options) => options && options.DST !== void 0 ? { DST: options.DST } : void 0;
   function map(num) {
     return Point.fromAffine(mapToCurve(num));
   }
@@ -2085,15 +2292,15 @@ function createHasher2(Point, mapToCurve, defaults) {
     },
     Point,
     hashToCurve(msg, options) {
-      const opts = Object.assign({}, safeDefaults, options);
+      const opts = Object.assign({}, safeDefaults, dstOverride(options));
       const u = hash_to_field(msg, 2, opts);
       const u0 = map(u[0]);
       const u1 = map(u[1]);
       return clear(u0.add(u1));
     },
     encodeToCurve(msg, options) {
-      const optsDst = safeDefaults.encodeDST ? { DST: safeDefaults.encodeDST } : {};
-      const opts = Object.assign({}, safeDefaults, optsDst, options);
+      const optsDst = safeDefaults.encodeDST === void 0 ? {} : { DST: safeDefaults.encodeDST };
+      const opts = Object.assign({}, safeDefaults, optsDst, dstOverride(options));
       const u = hash_to_field(msg, 1, opts);
       const u0 = map(u[0]);
       return clear(u0);
@@ -2107,6 +2314,8 @@ function createHasher2(Point, mapToCurve, defaults) {
       }
       if (!Array.isArray(scalars))
         throw new Error("expected array of bigints");
+      if (scalars.length !== safeDefaults.m)
+        throw new Error(`expected array of ${safeDefaults.m} bigints`);
       for (const i of scalars)
         if (typeof i !== "bigint")
           throw new Error("expected array of bigints");
@@ -2117,11 +2326,123 @@ function createHasher2(Point, mapToCurve, defaults) {
     // `HashToScalar-` prefix above unless the caller overrides it per invocation.
     hashToScalar(msg, options) {
       const N = Point.Fn.ORDER;
-      const opts = Object.assign({}, safeDefaults, { p: N, m: 1, DST: _DST_scalar }, options);
+      const opts = Object.assign({}, safeDefaults, { DST: _DST_scalar }, dstOverride(options), {
+        p: N,
+        m: 1
+      });
       return hash_to_field(msg, 1, opts)[0][0];
     }
   });
 }
+function SWUFpSqrtRatio(Fp2, Z) {
+  const F = validateField(Fp2);
+  const q = F.ORDER;
+  let l = _0n5;
+  for (let o = q - _1n5; o % _2n3 === _0n5; o /= _2n3)
+    l += _1n5;
+  const c1 = l;
+  const _2n_pow_c1_1 = _2n3 << c1 - _1n5 - _1n5;
+  const _2n_pow_c1 = _2n_pow_c1_1 * _2n3;
+  const c2 = (q - _1n5) / _2n_pow_c1;
+  const c3 = (c2 - _1n5) / _2n3;
+  const c4 = _2n_pow_c1 - _1n5;
+  const c5 = _2n_pow_c1_1;
+  const c6 = F.pow(Z, c2);
+  const c7 = F.pow(Z, (c2 + _1n5) / _2n3);
+  let sqrtRatio = (u, v) => {
+    let tv1 = c6;
+    let tv2 = F.pow(v, c4);
+    let tv3 = F.sqr(tv2);
+    tv3 = F.mul(tv3, v);
+    let tv5 = F.mul(u, tv3);
+    tv5 = F.pow(tv5, c3);
+    tv5 = F.mul(tv5, tv2);
+    tv2 = F.mul(tv5, v);
+    tv3 = F.mul(tv5, u);
+    let tv4 = F.mul(tv3, tv2);
+    tv5 = F.pow(tv4, c5);
+    let isQR = F.eql(tv5, F.ONE);
+    tv2 = F.mul(tv3, c7);
+    tv5 = F.mul(tv4, tv1);
+    tv3 = F.cmov(tv2, tv3, isQR);
+    tv4 = F.cmov(tv5, tv4, isQR);
+    for (let i = c1; i > _1n5; i--) {
+      let tv52 = i - _2n3;
+      tv52 = _2n3 << tv52 - _1n5;
+      let tvv5 = F.pow(tv4, tv52);
+      const e1 = F.eql(tvv5, F.ONE);
+      tv2 = F.mul(tv3, tv1);
+      tv1 = F.mul(tv1, tv1);
+      tvv5 = F.mul(tv4, tv1);
+      tv3 = F.cmov(tv2, tv3, e1);
+      tv4 = F.cmov(tvv5, tv4, e1);
+    }
+    return { isValid: !F.is0(v) && (isQR || F.is0(u)), value: tv3 };
+  };
+  if (F.ORDER % _4n4 === _3n2) {
+    const c12 = (F.ORDER - _3n2) / _4n4;
+    const c22 = F.sqrt(F.neg(Z));
+    sqrtRatio = (u, v) => {
+      let tv1 = F.sqr(v);
+      const tv2 = F.mul(u, v);
+      tv1 = F.mul(tv1, tv2);
+      let y1 = F.pow(tv1, c12);
+      y1 = F.mul(y1, tv2);
+      const y2 = F.mul(y1, c22);
+      const tv3 = F.mul(F.sqr(y1), v);
+      const isQR = F.eql(tv3, u);
+      let y = F.cmov(y2, y1, isQR);
+      return { isValid: !F.is0(v) && isQR, value: y };
+    };
+  }
+  return sqrtRatio;
+}
+function mapToCurveSimpleSWU(Fp2, opts) {
+  const F = validateField(Fp2);
+  validateObject(opts, {}, {}, "opts");
+  const { A, B, Z } = opts;
+  if (!F.isValidNot0(A) || !F.isValidNot0(B) || !F.isValid(Z))
+    throw new Error("mapToCurveSimpleSWU: invalid opts");
+  if (F.eql(Z, F.neg(F.ONE)) || FpIsSquare(F, Z))
+    throw new Error("mapToCurveSimpleSWU: invalid opts");
+  const x = F.mul(B, F.inv(F.mul(Z, A)));
+  const gx = F.add(F.add(F.mul(F.sqr(x), x), F.mul(A, x)), B);
+  if (!FpIsSquare(F, gx))
+    throw new Error("mapToCurveSimpleSWU: invalid opts");
+  const sqrtRatio = SWUFpSqrtRatio(F, Z);
+  if (!F.isOdd)
+    throw new Error("Field does not have .isOdd()");
+  return (u) => {
+    let tv1, tv2, tv3, tv4, tv5, tv6, x2, y;
+    tv1 = F.sqr(u);
+    tv1 = F.mul(tv1, Z);
+    tv2 = F.sqr(tv1);
+    tv2 = F.add(tv2, tv1);
+    tv3 = F.add(tv2, F.ONE);
+    tv3 = F.mul(tv3, B);
+    tv4 = F.cmov(Z, F.neg(tv2), !F.eql(tv2, F.ZERO));
+    tv4 = F.mul(tv4, A);
+    tv2 = F.sqr(tv3);
+    tv6 = F.sqr(tv4);
+    tv5 = F.mul(tv6, A);
+    tv2 = F.add(tv2, tv5);
+    tv2 = F.mul(tv2, tv3);
+    tv6 = F.mul(tv6, tv4);
+    tv5 = F.mul(tv6, B);
+    tv2 = F.add(tv2, tv5);
+    x2 = F.mul(tv1, tv3);
+    const { isValid, value } = sqrtRatio(tv2, tv6);
+    y = F.mul(tv1, u);
+    y = F.mul(y, value);
+    x2 = F.cmov(x2, tv3, isValid);
+    y = F.cmov(y, value, isValid);
+    const e1 = F.isOdd(u) === F.isOdd(y);
+    y = F.cmov(F.neg(y), y, e1);
+    const tv4_inv = FpInvertBatch(F, [tv4], true)[0];
+    x2 = F.mul(x2, tv4_inv);
+    return { x: x2, y };
+  };
+}
 
 // node_modules/@noble/curves/abstract/oprf.js
 var _DST_scalarBytes = /* @__PURE__ */ asciiToBytes(_DST_scalar);
@@ -2140,10 +2461,12 @@ function createOPRF(opts) {
   });
   const hashToScalarPrefixed = (msg, ctx) => opts.hashToScalar(msg, { DST: concatBytes2(_DST_scalarBytes, ctx) });
   const randomScalar = (rng = randomBytes2) => {
+    if (typeof rng !== "function")
+      throw new TypeError('"rng" expected function, got type=' + typeof rng);
     const t = mapHashToField(rng(getMinHashLength(Fn2.ORDER)), Fn2.ORDER, Fn2.isLE);
     return Fn2.isLE ? bytesToNumberLE(t) : bytesToNumberBE(t);
   };
-  const msm = (points, scalars) => pippenger(Point, points, scalars);
+  const msm = (points, scalars) => mulAddUnsafe(Point, points, scalars);
   const getCtx = (mode) => concatBytes2(asciiToBytes("OPRFV1-"), new Uint8Array([mode]), asciiToBytes("-" + name));
   const ctxOPRF = getCtx(0);
   const ctxVOPRF = getCtx(1);
@@ -2210,8 +2533,8 @@ function createOPRF(opts) {
     abytes2(proof, 2 * Fn2.BYTES);
     const { M, Z } = computeComposites(B, C, D, ctx);
     const [c, s] = [proof.subarray(0, Fn2.BYTES), proof.subarray(Fn2.BYTES)].map((f) => Fn2.fromBytes(f));
-    const t2 = Point.BASE.multiply(s).add(B.multiply(c));
-    const t3 = M.multiply(s).add(Z.multiply(c));
+    const t2 = msm([Point.BASE, B], [s, c]);
+    const t3 = msm([M, Z], [s, c]);
     const expectedC = challengeTranscript(B, M, Z, t2, t3, ctx);
     if (!Fn2.eql(c, expectedC))
       throw new Error("proof verification failed");
@@ -2305,7 +2628,12 @@ function createOPRF(opts) {
       const blindedPoints = items.map((i) => wirePoint("blinded", i.blinded));
       const evalPoints = items.map((i) => wirePoint("evaluated", i.evaluated));
       verifyProof(ctxVOPRF, pkS, blindedPoints, evalPoints, proof);
-      return items.map((i) => oprf.finalize(i.input, i.blind, i.evaluated));
+      return items.map((i, j) => {
+        const input = inputBytes("input", i.input);
+        const blind2 = Fn2.fromBytes(i.blind);
+        const unblinded = evalPoints[j].multiply(Fn2.inv(blind2)).toBytes();
+        return hashInput(input, unblinded);
+      });
     },
     finalize(input, blind2, evaluated, blinded, publicKey, proof) {
       return this.finalizeBatch([{ input, blind: blind2, evaluated, blinded }], publicKey, proof)[0];
@@ -2313,7 +2641,7 @@ function createOPRF(opts) {
     evaluate: (secretKey, input) => evaluate(ctxVOPRF, secretKey, input)
   });
   const poprf = (info) => {
-    info = inputBytes("info", info);
+    info = copyBytes(inputBytes("info", info));
     const m = hashToScalarPrefixed(encode("Info", info), ctxPOPRF);
     const T = Point.BASE.multiply(m);
     return Object.freeze({
@@ -2385,9 +2713,8 @@ function createOPRF(opts) {
 }
 
 // node_modules/@noble/curves/ed25519.js
-var _0n5 = /* @__PURE__ */ BigInt(0);
-var _1n5 = /* @__PURE__ */ BigInt(1);
-var _2n3 = /* @__PURE__ */ BigInt(2);
+var _1n6 = /* @__PURE__ */ BigInt(1);
+var _2n4 = /* @__PURE__ */ BigInt(2);
 var _5n2 = /* @__PURE__ */ BigInt(5);
 var _8n3 = /* @__PURE__ */ BigInt(8);
 var ed25519_CURVE_p = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffed");
@@ -2405,8 +2732,8 @@ function ed25519_pow_2_252_3(x) {
   const P = ed25519_CURVE_p;
   const x2 = x * x % P;
   const b2 = x2 * x % P;
-  const b4 = pow2(b2, _2n3, P) * b2 % P;
-  const b5 = pow2(b4, _1n5, P) * x % P;
+  const b4 = pow2(b2, _2n4, P) * b2 % P;
+  const b5 = pow2(b4, _1n6, P) * x % P;
   const b10 = pow2(b5, _5n2, P) * b5 % P;
   const b20 = pow2(b10, _10n, P) * b10 % P;
   const b40 = pow2(b20, _20n, P) * b20 % P;
@@ -2414,7 +2741,7 @@ function ed25519_pow_2_252_3(x) {
   const b160 = pow2(b80, _80n, P) * b80 % P;
   const b240 = pow2(b160, _80n, P) * b80 % P;
   const b250 = pow2(b240, _10n, P) * b10 % P;
-  const pow_p_5_8 = pow2(b250, _2n3, P) * x % P;
+  const pow_p_5_8 = pow2(b250, _2n4, P) * x % P;
   return { pow_p_5_8, b2 };
 }
 var ED25519_SQRT_M1 = /* @__PURE__ */ BigInt("19681161376707505956807079304988542015446066515923890162744021073123829784752");
@@ -2422,8 +2749,8 @@ function uvRatio(u, v) {
   const P = ed25519_CURVE_p;
   const v3 = mod(v * v * v, P);
   const v7 = mod(v3 * v3 * v, P);
-  const pow = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
-  let x = mod(u * v3 * pow, P);
+  const pow3 = ed25519_pow_2_252_3(u * v7).pow_p_5_8;
+  let x = mod(u * v3 * pow3, P);
   const vx2 = mod(v * x * x, P);
   const root1 = x;
   const root2 = mod(x * ED25519_SQRT_M1, P);
@@ -2446,32 +2773,30 @@ var SQRT_AD_MINUS_ONE = /* @__PURE__ */ BigInt("25063068953384623474111414158702
 var INVSQRT_A_MINUS_D = /* @__PURE__ */ BigInt("54469307008909316920995813868745141605393597292927456921205312896311721017578");
 var ONE_MINUS_D_SQ = /* @__PURE__ */ BigInt("1159843021668779879193775521855586647937357759715417654439879720876111806838");
 var D_MINUS_ONE_SQ = /* @__PURE__ */ BigInt("40440834346308536858101042469323190826248399146238708352240133220865137265952");
-var invertSqrt = (number) => uvRatio(_1n5, number);
+var invertSqrt = (number) => uvRatio(_1n6, number);
 var MAX_255B = /* @__PURE__ */ BigInt("0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff");
 var bytes255ToNumberLE = (bytes) => Fp.create(bytesToNumberLE(bytes) & MAX_255B);
 function calcElligatorRistrettoMap(r0) {
   const { d } = ed25519_CURVE;
-  const P = ed25519_CURVE_p;
-  const mod2 = (n) => Fp.create(n);
-  const r = mod2(SQRT_M1 * r0 * r0);
-  const Ns = mod2((r + _1n5) * ONE_MINUS_D_SQ);
+  const r = Fp.mul(Fp.mulN(SQRT_M1, r0), r0);
+  const Ns = Fp.mul(Fp.addN(r, _1n6), ONE_MINUS_D_SQ);
   let c = BigInt(-1);
-  const D = mod2((c - d * r) * mod2(r + d));
+  const D = Fp.mul(Fp.subN(c, Fp.mulN(d, r)), Fp.add(r, d));
   let { isValid: Ns_D_is_sq, value: s } = uvRatio(Ns, D);
-  let s_ = mod2(s * r0);
-  if (!isNegativeLE(s_, P))
-    s_ = mod2(-s_);
+  let s_ = Fp.mul(s, r0);
+  if (!Fp.isOdd(s_))
+    s_ = Fp.neg(s_);
   if (!Ns_D_is_sq)
     s = s_;
   if (!Ns_D_is_sq)
     c = r;
-  const Nt = mod2(c * (r - _1n5) * D_MINUS_ONE_SQ - D);
-  const s2 = s * s;
-  const W0 = mod2((s + s) * D);
-  const W1 = mod2(Nt * SQRT_AD_MINUS_ONE);
-  const W2 = mod2(_1n5 - s2);
-  const W3 = mod2(_1n5 + s2);
-  return new ed25519_Point(mod2(W0 * W3), mod2(W2 * W1), mod2(W1 * W3), mod2(W0 * W2));
+  const Nt = Fp.sub(Fp.mulN(Fp.mulN(c, Fp.subN(r, _1n6)), D_MINUS_ONE_SQ), D);
+  const s2 = Fp.sqrN(s);
+  const W0 = Fp.mul(Fp.addN(s, s), D);
+  const W1 = Fp.mul(Nt, SQRT_AD_MINUS_ONE);
+  const W2 = Fp.sub(_1n6, s2);
+  const W3 = Fp.add(_1n6, s2);
+  return new ed25519_Point(Fp.mul(W0, W3), Fp.mul(W2, W1), Fp.mul(W1, W3), Fp.mul(W0, W2));
 }
 var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint {
   // Do NOT change syntax: the following gymnastics is done,
@@ -2506,28 +2831,26 @@ var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint {
   static fromBytes(bytes) {
     abytes(bytes, 32);
     const { a, d } = ed25519_CURVE;
-    const P = ed25519_CURVE_p;
-    const mod2 = (n) => Fp.create(n);
     const s = bytes255ToNumberLE(bytes);
-    if (!equalBytes(Fp.toBytes(s), bytes) || isNegativeLE(s, P))
+    if (!equalBytes(Fp.toBytes(s), bytes) || Fp.isOdd(s))
       throw new Error("invalid ristretto255 encoding 1");
-    const s2 = mod2(s * s);
-    const u1 = mod2(_1n5 + a * s2);
-    const u2 = mod2(_1n5 - a * s2);
-    const u1_2 = mod2(u1 * u1);
-    const u2_2 = mod2(u2 * u2);
-    const v = mod2(a * d * u1_2 - u2_2);
-    const { isValid, value: I } = invertSqrt(mod2(v * u2_2));
-    const Dx = mod2(I * u2);
-    const Dy = mod2(I * Dx * v);
-    let x = mod2((s + s) * Dx);
-    if (isNegativeLE(x, P))
-      x = mod2(-x);
-    const y = mod2(u1 * Dy);
-    const t = mod2(x * y);
-    if (!isValid || isNegativeLE(t, P) || y === _0n5)
+    const s2 = Fp.sqr(s);
+    const u1 = Fp.add(_1n6, Fp.mulN(a, s2));
+    const u2 = Fp.sub(_1n6, Fp.mulN(a, s2));
+    const u1_2 = Fp.sqr(u1);
+    const u2_2 = Fp.sqr(u2);
+    const v = Fp.sub(Fp.mulN(Fp.mulN(a, d), u1_2), u2_2);
+    const { isValid, value: I } = invertSqrt(Fp.mul(v, u2_2));
+    const Dx = Fp.mul(I, u2);
+    const Dy = Fp.mul(Fp.mulN(I, Dx), v);
+    let x = Fp.mul(Fp.addN(s, s), Dx);
+    if (Fp.isOdd(x))
+      x = Fp.neg(x);
+    const y = Fp.mul(u1, Dy);
+    const t = Fp.mul(x, y);
+    if (!isValid || Fp.isOdd(t) || Fp.is0(y))
       throw new Error("invalid ristretto255 encoding 2");
-    return new __RistrettoPoint(new ed25519_Point(x, y, _1n5, t));
+    return new __RistrettoPoint(new ed25519_Point(x, y, Fp.ONE, t));
   }
   /**
    * Converts ristretto-encoded string to ristretto point.
@@ -2543,30 +2866,28 @@ var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint {
    */
   toBytes() {
     let { X, Y, Z, T } = this.ep;
-    const P = ed25519_CURVE_p;
-    const mod2 = (n) => Fp.create(n);
-    const u1 = mod2(mod2(Z + Y) * mod2(Z - Y));
-    const u2 = mod2(X * Y);
-    const u2sq = mod2(u2 * u2);
-    const { value: invsqrt } = invertSqrt(mod2(u1 * u2sq));
-    const D1 = mod2(invsqrt * u1);
-    const D2 = mod2(invsqrt * u2);
-    const zInv = mod2(D1 * D2 * T);
+    const u1 = Fp.mul(Fp.add(Z, Y), Fp.sub(Z, Y));
+    const u2 = Fp.mul(X, Y);
+    const u2sq = Fp.sqr(u2);
+    const { value: invsqrt } = invertSqrt(Fp.mul(u1, u2sq));
+    const D1 = Fp.mul(invsqrt, u1);
+    const D2 = Fp.mul(invsqrt, u2);
+    const zInv = Fp.mul(Fp.mulN(D1, D2), T);
     let D;
-    if (isNegativeLE(T * zInv, P)) {
-      let _x = mod2(Y * SQRT_M1);
-      let _y = mod2(X * SQRT_M1);
+    if (Fp.isOdd(Fp.mul(T, zInv))) {
+      let _x = Fp.mul(Y, SQRT_M1);
+      let _y = Fp.mul(X, SQRT_M1);
       X = _x;
       Y = _y;
-      D = mod2(D1 * INVSQRT_A_MINUS_D);
+      D = Fp.mul(D1, INVSQRT_A_MINUS_D);
     } else {
       D = D2;
     }
-    if (isNegativeLE(X * zInv, P))
-      Y = mod2(-Y);
-    let s = mod2((Z - Y) * D);
-    if (isNegativeLE(s, P))
-      s = mod2(-s);
+    if (Fp.isOdd(Fp.mul(X, zInv)))
+      Y = Fp.neg(Y);
+    let s = Fp.mul(Fp.subN(Z, Y), D);
+    if (Fp.isOdd(s))
+      s = Fp.neg(s);
     return Fp.toBytes(s);
   }
   /**
@@ -2577,20 +2898,15 @@ var _RistrettoPoint = class __RistrettoPoint extends PrimeEdwardsPoint {
     this.assertSame(other);
     const { X: X1, Y: Y1 } = this.ep;
     const { X: X2, Y: Y2 } = other.ep;
-    const mod2 = (n) => Fp.create(n);
-    const one = mod2(X1 * Y2) === mod2(Y1 * X2);
-    const two = mod2(Y1 * Y2) === mod2(X1 * X2);
+    const one = Fp.eql(Fp.mul(X1, Y2), Fp.mul(Y1, X2));
+    const two = Fp.eql(Fp.mul(Y1, Y2), Fp.mul(X1, X2));
     return one || two;
   }
   is0() {
     return this.equals(__RistrettoPoint.ZERO);
   }
 };
-Object.freeze(_RistrettoPoint.BASE);
-Object.freeze(_RistrettoPoint.ZERO);
-Object.freeze(_RistrettoPoint.prototype);
-Object.freeze(_RistrettoPoint);
-var ristretto255_hasher = Object.freeze({
+var ristretto255_hasher = /* @__PURE__ */ Object.freeze({
   Point: _RistrettoPoint,
   /**
   * Spec: https://www.rfc-editor.org/rfc/rfc9380.html#name-hashing-to-ristretto255. Caveats:
@@ -2611,8 +2927,9 @@ var ristretto255_hasher = Object.freeze({
     const xmd = expand_message_xmd(msg, DST, 64, sha512);
     return ristretto255_hasher.deriveToCurve(xmd);
   },
-  hashToScalar(msg, options = { DST: _DST_scalar }) {
-    const xmd = expand_message_xmd(msg, options.DST, 64, sha512);
+  hashToScalar(msg, options) {
+    const DST = options?.DST === void 0 ? _DST_scalar : options.DST;
+    const xmd = expand_message_xmd(msg, DST, 64, sha512);
     return Fn.create(bytesToNumberLE(xmd));
   },
   /**
@@ -2642,7 +2959,7 @@ var ristretto255_oprf = /* @__PURE__ */ (() => createOPRF({
 }))();
 
 // node_modules/@noble/curves/abstract/weierstrass.js
-var divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n4) / den;
+var divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n5) / den;
 function _splitEndoScalar(k, basis, n) {
   aInRange("scalar", k, _0n6, n);
   const [[a1, b1], [a2, b2]] = basis;
@@ -2656,132 +2973,17 @@ function _splitEndoScalar(k, basis, n) {
     k1 = -k1;
   if (k2neg)
     k2 = -k2;
-  const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n6;
+  const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n7;
   if (k1 < _0n6 || k1 >= MAX_NUM || k2 < _0n6 || k2 >= MAX_NUM) {
     throw new Error("splitScalar (endomorphism): failed for k");
   }
   return { k1neg, k1, k2neg, k2 };
 }
-var DERErr = class extends Error {
-  constructor(m = "") {
-    super(m);
-  }
-};
-var DER = {
-  // asn.1 DER encoding utils
-  Err: DERErr,
-  // Basic building block is TLV (Tag-Length-Value)
-  _tlv: {
-    encode: (tag, data) => {
-      const { Err: E } = DER;
-      asafenumber(tag, "tag");
-      if (tag < 0 || tag > 255)
-        throw new E("tlv.encode: wrong tag");
-      if (typeof data !== "string")
-        throw new TypeError('"data" expected string, got type=' + typeof data);
-      if (data.length & 1)
-        throw new E("tlv.encode: unpadded data");
-      const dataLen = data.length / 2;
-      const len = numberToHexUnpadded(dataLen);
-      if (len.length / 2 & 128)
-        throw new E("tlv.encode: long form length too big");
-      const lenLen = dataLen > 127 ? numberToHexUnpadded(len.length / 2 | 128) : "";
-      const t = numberToHexUnpadded(tag);
-      return t + lenLen + len + data;
-    },
-    // v - value, l - left bytes (unparsed)
-    decode(tag, data) {
-      const { Err: E } = DER;
-      data = abytes2(data, void 0, "DER data");
-      let pos = 0;
-      if (tag < 0 || tag > 255)
-        throw new E("tlv.encode: wrong tag");
-      if (data.length < 2 || data[pos++] !== tag)
-        throw new E("tlv.decode: wrong tlv");
-      const first = data[pos++];
-      const isLong = !!(first & 128);
-      let length = 0;
-      if (!isLong)
-        length = first;
-      else {
-        const lenLen = first & 127;
-        if (!lenLen)
-          throw new E("tlv.decode(long): indefinite length not supported");
-        if (lenLen > 4)
-          throw new E("tlv.decode(long): byte length is too big");
-        const lengthBytes = data.subarray(pos, pos + lenLen);
-        if (lengthBytes.length !== lenLen)
-          throw new E("tlv.decode: length bytes not complete");
-        if (lengthBytes[0] === 0)
-          throw new E("tlv.decode(long): zero leftmost byte");
-        for (const b of lengthBytes)
-          length = length << 8 | b;
-        pos += lenLen;
-        if (length < 128)
-          throw new E("tlv.decode(long): not minimal encoding");
-      }
-      const v = data.subarray(pos, pos + length);
-      if (v.length !== length)
-        throw new E("tlv.decode: wrong value length");
-      return { v, l: data.subarray(pos + length) };
-    }
-  },
-  // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,
-  // since we always use positive integers here. It must always be empty:
-  // - add zero byte if exists
-  // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
-  _int: {
-    encode(num) {
-      const { Err: E } = DER;
-      abignumber(num);
-      if (num < _0n6)
-        throw new E("integer: negative integers are not allowed");
-      let hex = numberToHexUnpadded(num);
-      if (Number.parseInt(hex[0], 16) & 8)
-        hex = "00" + hex;
-      if (hex.length & 1)
-        throw new E("unexpected DER parsing assertion: unpadded hex");
-      return hex;
-    },
-    decode(data) {
-      const { Err: E } = DER;
-      if (data.length < 1)
-        throw new E("invalid signature integer: empty");
-      if (data[0] & 128)
-        throw new E("invalid signature integer: negative");
-      if (data.length > 1 && data[0] === 0 && !(data[1] & 128))
-        throw new E("invalid signature integer: unnecessary leading zero");
-      return bytesToNumberBE(data);
-    }
-  },
-  toSig(bytes) {
-    const { Err: E, _int: int, _tlv: tlv } = DER;
-    const data = abytes2(bytes, void 0, "signature");
-    const { v: seqBytes, l: seqLeftBytes } = tlv.decode(48, data);
-    if (seqLeftBytes.length)
-      throw new E("invalid signature: left bytes after parsing");
-    const { v: rBytes, l: rLeftBytes } = tlv.decode(2, seqBytes);
-    const { v: sBytes, l: sLeftBytes } = tlv.decode(2, rLeftBytes);
-    if (sLeftBytes.length)
-      throw new E("invalid signature: left bytes after parsing");
-    return { r: int.decode(rBytes), s: int.decode(sBytes) };
-  },
-  hexFromSig(sig) {
-    const { _tlv: tlv, _int: int } = DER;
-    const rs = tlv.encode(2, int.encode(sig.r));
-    const ss = tlv.encode(2, int.encode(sig.s));
-    const seq = rs + ss;
-    return tlv.encode(48, seq);
-  }
-};
-Object.freeze(DER._tlv);
-Object.freeze(DER._int);
-Object.freeze(DER);
 var _0n6 = /* @__PURE__ */ BigInt(0);
-var _1n6 = /* @__PURE__ */ BigInt(1);
-var _2n4 = /* @__PURE__ */ BigInt(2);
-var _3n2 = /* @__PURE__ */ BigInt(3);
-var _4n2 = /* @__PURE__ */ BigInt(4);
+var _1n7 = /* @__PURE__ */ BigInt(1);
+var _2n5 = /* @__PURE__ */ BigInt(2);
+var _3n3 = /* @__PURE__ */ BigInt(3);
+var _4n5 = /* @__PURE__ */ BigInt(4);
 function weierstrass(params, extraOpts = {}) {
   const validated = createCurveFields("weierstrass", params, extraOpts);
   const Fp2 = validated.Fp;
@@ -2794,9 +2996,11 @@ function weierstrass(params, extraOpts = {}) {
     isTorsionFree: "function",
     fromBytes: "function",
     toBytes: "function",
-    endo: "object"
+    endo: "object",
+    randomBytes: "function"
   });
   const { endo, allowInfinityPoint } = extraOpts;
+  const randomBytes3 = extraOpts.randomBytes === void 0 ? randomBytes2 : extraOpts.randomBytes;
   if (endo) {
     if (!Fp2.is0(CURVE.a) || typeof endo.beta !== "bigint" || !Array.isArray(endo.basises)) {
       throw new Error('invalid endo: expected "beta": bigint and "basises": array');
@@ -2860,6 +3064,8 @@ function weierstrass(params, extraOpts = {}) {
   }
   const encodePoint = extraOpts.toBytes === void 0 ? pointToBytes : extraOpts.toBytes;
   const decodePoint = extraOpts.fromBytes === void 0 ? pointFromBytes : extraOpts.fromBytes;
+  const b3 = Fp2.mul(CURVE.b, _3n3);
+  const mulA = Fp2.is0(CURVE.a) ? (_) => Fp2.ZERO : (x) => Fp2.mul(CURVE.a, x);
   function weierstrassEquation(x) {
     const x2 = Fp2.sqr(x);
     const x3 = Fp2.mul(x2, x);
@@ -2872,7 +3078,7 @@ function weierstrass(params, extraOpts = {}) {
   }
   if (!isValidXY(CURVE.Gx, CURVE.Gy))
     throw new Error("bad curve params: generator point");
-  const _4a3 = Fp2.mul(Fp2.pow(CURVE.a, _3n2), _4n2);
+  const _4a3 = Fp2.mul(Fp2.pow(CURVE.a, _3n3), _4n5);
   const _27b2 = Fp2.mul(Fp2.sqr(CURVE.b), BigInt(27));
   if (Fp2.is0(Fp2.add(_4a3, _27b2)))
     throw new Error("bad curve params: a or b");
@@ -2890,21 +3096,24 @@ function weierstrass(params, extraOpts = {}) {
       throw new Error("no endo");
     return _splitEndoScalar(k, endo.basises, Fn2.ORDER);
   }
-  function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {
-    k2p = new Point(Fp2.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);
-    k1p = negateCt(k1neg, k1p);
-    k2p = negateCt(k2neg, k2p);
-    return k1p.add(k2p);
+  function pushWnafPair(points, scalars, p, k) {
+    if (!Fn2.isValid(k))
+      throw new RangeError("invalid scalar: out of range");
+    if (endo) {
+      const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(k);
+      const psi = new Point(Fp2.mul(p.X, endo.beta), p.Y, p.Z);
+      points.push(k1neg ? p.negate() : p, k2neg ? psi.negate() : psi);
+      scalars.push(k1, k2);
+    } else {
+      points.push(p);
+      scalars.push(k);
+    }
   }
+  const validityCache = /* @__PURE__ */ new WeakSet();
   class Point {
-    // base / generator point
     static BASE = new Point(CURVE.Gx, CURVE.Gy, Fp2.ONE);
-    // zero / infinity / identity point
     static ZERO = new Point(Fp2.ZERO, Fp2.ONE, Fp2.ZERO);
-    // 0, 1, 0
-    // math field
     static Fp = Fp2;
-    // scalar field
     static Fn = Fn2;
     X;
     Y;
@@ -2945,15 +3154,12 @@ function weierstrass(params, extraOpts = {}) {
       return this.toAffine().y;
     }
     /**
-     *
-     * @param windowSize
      * @param isLazy - true will defer table computation until the first multiplication
-     * @returns
      */
-    precompute(windowSize = 8, isLazy = true) {
-      wnaf.createCache(this, windowSize);
+    precompute(windowSize = 6, isLazy = true) {
+      wnaf.setWindowSize(this, windowSize);
       if (!isLazy)
-        this.multiply(_3n2);
+        this.multiply(_3n3);
       return this;
     }
     // TODO: return `this`
@@ -2965,6 +3171,8 @@ function weierstrass(params, extraOpts = {}) {
           return;
         throw new Error("bad point: ZERO");
       }
+      if (validityCache.has(p))
+        return;
       const { x, y } = p.toAffine();
       if (!Fp2.isValid(x) || !Fp2.isValid(y))
         throw new Error("bad point: x or y not field elements");
@@ -2972,6 +3180,7 @@ function weierstrass(params, extraOpts = {}) {
         throw new Error("bad point: equation left != right");
       if (!p.isTorsionFree())
         throw new Error("bad point: not in prime-order subgroup");
+      validityCache.add(p);
     }
     hasEvenY() {
       const { y } = this.toAffine();
@@ -2997,8 +3206,6 @@ function weierstrass(params, extraOpts = {}) {
     // https://eprint.iacr.org/2015/1060, algorithm 3
     // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
     double() {
-      const { a, b } = CURVE;
-      const b3 = Fp2.mul(b, _3n2);
       const { X: X1, Y: Y1, Z: Z1 } = this;
       let X3 = Fp2.ZERO, Y3 = Fp2.ZERO, Z3 = Fp2.ZERO;
       let t0 = Fp2.mul(X1, X1);
@@ -3008,7 +3215,7 @@ function weierstrass(params, extraOpts = {}) {
       t3 = Fp2.add(t3, t3);
       Z3 = Fp2.mul(X1, Z1);
       Z3 = Fp2.add(Z3, Z3);
-      X3 = Fp2.mul(a, Z3);
+      X3 = mulA(Z3);
       Y3 = Fp2.mul(b3, t2);
       Y3 = Fp2.add(X3, Y3);
       X3 = Fp2.sub(t1, Y3);
@@ -3016,9 +3223,9 @@ function weierstrass(params, extraOpts = {}) {
       Y3 = Fp2.mul(X3, Y3);
       X3 = Fp2.mul(t3, X3);
       Z3 = Fp2.mul(b3, Z3);
-      t2 = Fp2.mul(a, t2);
+      t2 = mulA(t2);
       t3 = Fp2.sub(t0, t2);
-      t3 = Fp2.mul(a, t3);
+      t3 = mulA(t3);
       t3 = Fp2.add(t3, Z3);
       Z3 = Fp2.add(t0, t0);
       t0 = Fp2.add(Z3, t0);
@@ -3043,8 +3250,6 @@ function weierstrass(params, extraOpts = {}) {
       const { X: X1, Y: Y1, Z: Z1 } = this;
       const { X: X2, Y: Y2, Z: Z2 } = other;
       let X3 = Fp2.ZERO, Y3 = Fp2.ZERO, Z3 = Fp2.ZERO;
-      const a = CURVE.a;
-      const b3 = Fp2.mul(CURVE.b, _3n2);
       let t0 = Fp2.mul(X1, X2);
       let t1 = Fp2.mul(Y1, Y2);
       let t2 = Fp2.mul(Z1, Z2);
@@ -3063,7 +3268,7 @@ function weierstrass(params, extraOpts = {}) {
       t5 = Fp2.mul(t5, X3);
       X3 = Fp2.add(t1, t2);
       t5 = Fp2.sub(t5, X3);
-      Z3 = Fp2.mul(a, t4);
+      Z3 = mulA(t4);
       X3 = Fp2.mul(b3, t2);
       Z3 = Fp2.add(X3, Z3);
       X3 = Fp2.sub(t1, Z3);
@@ -3071,11 +3276,11 @@ function weierstrass(params, extraOpts = {}) {
       Y3 = Fp2.mul(X3, Z3);
       t1 = Fp2.add(t0, t0);
       t1 = Fp2.add(t1, t0);
-      t2 = Fp2.mul(a, t2);
+      t2 = mulA(t2);
       t4 = Fp2.mul(b3, t4);
       t1 = Fp2.add(t1, t2);
       t2 = Fp2.sub(t0, t2);
-      t2 = Fp2.mul(a, t2);
+      t2 = mulA(t2);
       t4 = Fp2.add(t4, t2);
       t0 = Fp2.mul(t1, t4);
       Y3 = Fp2.add(Y3, t0);
@@ -3096,56 +3301,53 @@ function weierstrass(params, extraOpts = {}) {
     }
     /**
      * Constant time multiplication.
-     * Uses wNAF method. Windowed method may be 10% faster,
-     * but takes 2x longer to generate and consumes 2x memory.
-     * Uses precomputes when available.
-     * Uses endomorphism for Koblitz curves.
+     * Uses precomputed tables (signed fixed-window wNAF) when available.
+     * Uses scalar blinding and avoids endomorphism splitting in the secret-scalar path.
      * @param scalar - by which the point would be multiplied
      * @returns New point
      */
     multiply(scalar) {
-      const { endo: endo2 } = extraOpts;
       if (!Fn2.isValidNot0(scalar))
         throw new RangeError("invalid scalar: out of range");
-      let point, fake;
-      const mul = (n) => wnaf.cached(this, n, (p) => normalizeZ(Point, p));
-      if (endo2) {
-        const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(scalar);
-        const { p: k1p, f: k1f } = mul(k1);
-        const { p: k2p, f: k2f } = mul(k2);
-        fake = k1f.add(k2f);
-        point = finishEndo(endo2.beta, k1p, k2p, k1neg, k2neg);
-      } else {
-        const { p, f } = mul(scalar);
-        point = p;
-        fake = f;
-      }
-      return normalizeZ(Point, [point, fake])[0];
+      const { p, f } = wnaf.mulSecret(this, scalar, cofactor, normalize);
+      return normalize([p, f])[0];
     }
     /**
-     * Non-constant-time multiplication. Uses double-and-add algorithm.
+     * Non-constant-time multiplication. Uses width-4 wNAF with GLV endomorphism splitting
+     * when available (two half-width scalars sharing one halved doubling chain).
      * It's faster, but should only be used when you don't care about
      * an exposed secret key e.g. sig verification, which works over *public* keys.
      */
     multiplyUnsafe(scalar) {
-      const { endo: endo2 } = extraOpts;
       const p = this;
       const sc = scalar;
       if (!Fn2.isValid(sc))
         throw new RangeError("invalid scalar: out of range");
       if (sc === _0n6 || p.is0())
         return Point.ZERO;
-      if (sc === _1n6)
+      if (sc === _1n7)
         return p;
-      if (wnaf.hasCache(this))
-        return this.multiply(sc);
-      if (endo2) {
-        const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(sc);
-        const { p1, p2 } = mulEndoUnsafe(Point, p, k1, k2);
-        return finishEndo(endo2.beta, p1, p2, k1neg, k2neg);
-      } else {
-        return wnaf.unsafe(p, sc);
-      }
+      if (wnaf.hasWindowSize(this))
+        return wnaf.mulUnsafe(p, sc, normalize);
+      const points = [];
+      const scalars = [];
+      pushWnafPair(points, scalars, p, sc);
+      return mulAddUnsafe(Point, points, scalars);
+    }
+    /**
+     * Non-constant-time double-scalar multiplication `a⋅this + b⋅other` (Strauss–Shamir).
+     * Both walks share one doubling chain via {@link mulAddUnsafe}, and GLV endomorphism
+     * (when available) halves the chain again by splitting each scalar into two half-width
+     * parts. Used by ECDSA verification and public-key recovery for `R = u1⋅G + u2⋅P`.
+     * Only for public scalars.
+     */
+    mulAddUnsafe(a, other, b) {
+      aprjpoint(other);
+      const points = [];
+      const scalars = [];
+      pushWnafPair(points, scalars, this, a);
+      pushWnafPair(points, scalars, other, b);
+      return mulAddUnsafe(Point, points, scalars);
     }
     /**
      * Converts Projective point to affine (x, y) coordinates.
@@ -3155,6 +3357,8 @@ function weierstrass(params, extraOpts = {}) {
     toAffine(invertedZ) {
       const p = this;
       let iz = invertedZ;
+      if (iz != null && !Fp2.isValid(iz))
+        throw new RangeError('"invertedZ" expected valid field element');
       const { X, Y, Z } = p;
       if (Fp2.eql(Z, Fp2.ONE))
         return { x: X, y: Y };
@@ -3176,22 +3380,22 @@ function weierstrass(params, extraOpts = {}) {
      */
     isTorsionFree() {
       const { isTorsionFree } = extraOpts;
-      if (cofactor === _1n6)
+      if (cofactor === _1n7)
         return true;
       if (isTorsionFree)
         return isTorsionFree(Point, this);
-      return wnaf.unsafe(this, CURVE_ORDER).is0();
+      return wnaf.mulUnsafe(this, CURVE_ORDER).is0();
     }
     clearCofactor() {
       const { clearCofactor } = extraOpts;
-      if (cofactor === _1n6)
+      if (cofactor === _1n7)
         return this;
       if (clearCofactor)
         return clearCofactor(Point, this);
       return this.multiplyUnsafe(cofactor);
     }
     isSmallOrder() {
-      if (cofactor === _1n6)
+      if (cofactor === _1n7)
         return this.is0();
       return this.clearCofactor().is0();
     }
@@ -3207,10 +3411,10 @@ function weierstrass(params, extraOpts = {}) {
       return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
     }
   }
-  const bits = Fn2.BITS;
-  const wnaf = new wNAF(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);
-  if (bits >= 8)
-    Point.BASE.precompute(8);
+  const normalize = (points) => normalizeZ(Point, points);
+  const wnaf = new ScalarMultiplier(Point, randomBytes3);
+  if (wnaf.bits >= 6)
+    Point.BASE.precompute(6);
   Object.freeze(Point.prototype);
   Object.freeze(Point);
   return Point;
@@ -3218,114 +3422,6 @@ function weierstrass(params, extraOpts = {}) {
 function pprefix(hasEvenY) {
   return Uint8Array.of(hasEvenY ? 2 : 3);
 }
-function SWUFpSqrtRatio(Fp2, Z) {
-  const F = validateField(Fp2);
-  const q = F.ORDER;
-  let l = _0n6;
-  for (let o = q - _1n6; o % _2n4 === _0n6; o /= _2n4)
-    l += _1n6;
-  const c1 = l;
-  const _2n_pow_c1_1 = _2n4 << c1 - _1n6 - _1n6;
-  const _2n_pow_c1 = _2n_pow_c1_1 * _2n4;
-  const c2 = (q - _1n6) / _2n_pow_c1;
-  const c3 = (c2 - _1n6) / _2n4;
-  const c4 = _2n_pow_c1 - _1n6;
-  const c5 = _2n_pow_c1_1;
-  const c6 = F.pow(Z, c2);
-  const c7 = F.pow(Z, (c2 + _1n6) / _2n4);
-  let sqrtRatio = (u, v) => {
-    let tv1 = c6;
-    let tv2 = F.pow(v, c4);
-    let tv3 = F.sqr(tv2);
-    tv3 = F.mul(tv3, v);
-    let tv5 = F.mul(u, tv3);
-    tv5 = F.pow(tv5, c3);
-    tv5 = F.mul(tv5, tv2);
-    tv2 = F.mul(tv5, v);
-    tv3 = F.mul(tv5, u);
-    let tv4 = F.mul(tv3, tv2);
-    tv5 = F.pow(tv4, c5);
-    let isQR = F.eql(tv5, F.ONE);
-    tv2 = F.mul(tv3, c7);
-    tv5 = F.mul(tv4, tv1);
-    tv3 = F.cmov(tv2, tv3, isQR);
-    tv4 = F.cmov(tv5, tv4, isQR);
-    for (let i = c1; i > _1n6; i--) {
-      let tv52 = i - _2n4;
-      tv52 = _2n4 << tv52 - _1n6;
-      let tvv5 = F.pow(tv4, tv52);
-      const e1 = F.eql(tvv5, F.ONE);
-      tv2 = F.mul(tv3, tv1);
-      tv1 = F.mul(tv1, tv1);
-      tvv5 = F.mul(tv4, tv1);
-      tv3 = F.cmov(tv2, tv3, e1);
-      tv4 = F.cmov(tvv5, tv4, e1);
-    }
-    return { isValid: !F.is0(v) && (isQR || F.is0(u)), value: tv3 };
-  };
-  if (F.ORDER % _4n2 === _3n2) {
-    const c12 = (F.ORDER - _3n2) / _4n2;
-    const c22 = F.sqrt(F.neg(Z));
-    sqrtRatio = (u, v) => {
-      let tv1 = F.sqr(v);
-      const tv2 = F.mul(u, v);
-      tv1 = F.mul(tv1, tv2);
-      let y1 = F.pow(tv1, c12);
-      y1 = F.mul(y1, tv2);
-      const y2 = F.mul(y1, c22);
-      const tv3 = F.mul(F.sqr(y1), v);
-      const isQR = F.eql(tv3, u);
-      let y = F.cmov(y2, y1, isQR);
-      return { isValid: !F.is0(v) && isQR, value: y };
-    };
-  }
-  return sqrtRatio;
-}
-function mapToCurveSimpleSWU(Fp2, opts) {
-  const F = validateField(Fp2);
-  const { A, B, Z } = opts;
-  if (!F.isValidNot0(A) || !F.isValidNot0(B) || !F.isValid(Z))
-    throw new Error("mapToCurveSimpleSWU: invalid opts");
-  if (F.eql(Z, F.neg(F.ONE)) || FpIsSquare(F, Z))
-    throw new Error("mapToCurveSimpleSWU: invalid opts");
-  const x = F.mul(B, F.inv(F.mul(Z, A)));
-  const gx = F.add(F.add(F.mul(F.sqr(x), x), F.mul(A, x)), B);
-  if (!FpIsSquare(F, gx))
-    throw new Error("mapToCurveSimpleSWU: invalid opts");
-  const sqrtRatio = SWUFpSqrtRatio(F, Z);
-  if (!F.isOdd)
-    throw new Error("Field does not have .isOdd()");
-  return (u) => {
-    let tv1, tv2, tv3, tv4, tv5, tv6, x2, y;
-    tv1 = F.sqr(u);
-    tv1 = F.mul(tv1, Z);
-    tv2 = F.sqr(tv1);
-    tv2 = F.add(tv2, tv1);
-    tv3 = F.add(tv2, F.ONE);
-    tv3 = F.mul(tv3, B);
-    tv4 = F.cmov(Z, F.neg(tv2), !F.eql(tv2, F.ZERO));
-    tv4 = F.mul(tv4, A);
-    tv2 = F.sqr(tv3);
-    tv6 = F.sqr(tv4);
-    tv5 = F.mul(tv6, A);
-    tv2 = F.add(tv2, tv5);
-    tv2 = F.mul(tv2, tv3);
-    tv6 = F.mul(tv6, tv4);
-    tv5 = F.mul(tv6, B);
-    tv2 = F.add(tv2, tv5);
-    x2 = F.mul(tv1, tv3);
-    const { isValid, value } = sqrtRatio(tv2, tv6);
-    y = F.mul(tv1, u);
-    y = F.mul(y, value);
-    x2 = F.cmov(x2, tv3, isValid);
-    y = F.cmov(y, value, isValid);
-    const e1 = F.isOdd(u) === F.isOdd(y);
-    y = F.cmov(F.neg(y), y, e1);
-    const tv4_inv = FpInvertBatch(F, [tv4], true)[0];
-    x2 = F.mul(x2, tv4_inv);
-    return { x: x2, y };
-  };
-}
 function getWLengths(Fp2, Fn2) {
   return {
     secretKey: Fn2.BYTES,
@@ -3375,7 +3471,7 @@ var p256_hasher = /* @__PURE__ */ (() => {
   return createHasher2(p256_Point, createSWU(p256_Point, {
     A: p256_CURVE.a,
     B: p256_CURVE.b,
-    Z: p256_Point.Fp.create(BigInt("-10"))
+    Z: p256_Point.Fp.neg(BigInt(10))
   }), {
     DST: "P256_XMD:SHA-256_SSWU_RO_",
     encodeDST: "P256_XMD:SHA-256_SSWU_NU_",
@@ -3398,7 +3494,7 @@ var p384_hasher = /* @__PURE__ */ (() => {
   return createHasher2(p384_Point, createSWU(p384_Point, {
     A: p384_CURVE.a,
     B: p384_CURVE.b,
-    Z: p384_Point.Fp.create(BigInt("-12"))
+    Z: p384_Point.Fp.neg(BigInt(12))
   }), {
     DST: "P384_XMD:SHA-384_SSWU_RO_",
     encodeDST: "P384_XMD:SHA-384_SSWU_NU_",
@@ -3421,7 +3517,7 @@ var p521_hasher = /* @__PURE__ */ (() => {
   return createHasher2(p521_Point, createSWU(p521_Point, {
     A: p521_CURVE.a,
     B: p521_CURVE.b,
-    Z: p521_Point.Fp.create(BigInt("-4"))
+    Z: p521_Point.Fp.neg(BigInt(4))
   }), {
     DST: "P521_XMD:SHA-512_SSWU_RO_",
     encodeDST: "P521_XMD:SHA-512_SSWU_NU_",