@flickfyi/flkr 0.0.0 → 0.0.106

package/node_modules/@flickfyi/identity/dist/nist-luaoKQ1s.js

@@ -1,1194 +0,0 @@
-import { A as isBytes, B as clean, C as bytesToHex, E as concatBytes, I as abytes, L as aexists, M as randomBytes, N as validateObject, O as createHmacDrbg, P as sha256, R as ahash, S as bitMask, _ as abool, a as normalizeZ, b as astring, f as mapHashToField, g as abignumber, h as aInRange, i as mulAddUnsafe, j as numberToHexUnpadded, k as hexToBytes, l as getMinHashLength, n as createCurveFields, o as probeRandomBytes, r as createKeygen, s as validatePointCons, t as ScalarMultiplier, u as invertCt, v as abytes$1, w as bytesToNumberBE, x as bitLen, y as asafenumber, z as aoutput } from "./curve-CpcHwjN8.js";
-//#region ../../../../../../.pnpm-store/v11/links/@noble/hashes/2.4.0/a02ec2573a7b07204dfaf0508ab31b11f6a9bd74c18f15e8ab2933e00265fdfc/node_modules/@noble/hashes/hmac.js
-/**
-* HMAC: RFC2104 message authentication code.
-* @module
-*/
-/**
-* Internal class for HMAC.
-* Accepts any byte key, although RFC 2104 §3 recommends keys at least
-* `HashLen` bytes long.
-*/
-var _HMAC = class {
-	oHash;
-	iHash;
-	blockLen;
-	outputLen;
-	canXOF = false;
-	finished = false;
-	destroyed = false;
-	constructor(hash, key) {
-		ahash(hash);
-		abytes(key, void 0, "key");
-		this.iHash = hash.create();
-		if (typeof this.iHash.update !== "function") throw new Error("expected Hash instance");
-		this.blockLen = this.iHash.blockLen;
-		this.outputLen = this.iHash.outputLen;
-		const blockLen = this.blockLen;
-		const pad = new Uint8Array(blockLen);
-		pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
-		for (let i = 0; i < pad.length; i++) pad[i] ^= 54;
-		this.iHash.update(pad);
-		this.oHash = hash.create();
-		for (let i = 0; i < pad.length; i++) pad[i] ^= 106;
-		this.oHash.update(pad);
-		clean(pad);
-	}
-	update(buf) {
-		aexists(this);
-		this.iHash.update(buf);
-		return this;
-	}
-	digestInto(out) {
-		aexists(this);
-		aoutput(out, this);
-		this.finished = true;
-		const buf = out.subarray(0, this.outputLen);
-		this.iHash.digestInto(buf);
-		this.oHash.update(buf);
-		this.oHash.digestInto(buf);
-		this.destroy();
-	}
-	digest() {
-		const out = new Uint8Array(this.oHash.outputLen);
-		this.digestInto(out);
-		return out;
-	}
-	_cloneInto(to) {
-		to ||= Object.create(Object.getPrototypeOf(this), {});
-		const { oHash, iHash, finished, destroyed, blockLen, outputLen, canXOF } = this;
-		to = to;
-		to.finished = finished;
-		to.destroyed = destroyed;
-		to.blockLen = blockLen;
-		to.outputLen = outputLen;
-		to.canXOF = canXOF;
-		to.oHash = oHash._cloneInto(to.oHash);
-		to.iHash = iHash._cloneInto(to.iHash);
-		return to;
-	}
-	clone() {
-		return this._cloneInto();
-	}
-	destroy() {
-		this.destroyed = true;
-		this.oHash.destroy();
-		this.iHash.destroy();
-	}
-};
-var hmac = /* @__PURE__ */ (() => {
-	const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());
-	hmac_.create = (hash, key) => new _HMAC(hash, key);
-	return hmac_;
-})();
-//#endregion
-//#region ../../../../../../.pnpm-store/v11/links/@noble/curves/2.4.0/766129a921e8dfd2ef1de557b88b41133e3334d958e354fac1f5d17f98661627/node_modules/@noble/curves/abstract/der.js
-/**
-* ASN.1 DER (Distinguished Encoding Rules) helpers for ECDSA signatures.
-* Only implements the tiny subset needed for `SEQUENCE(INTEGER r, INTEGER s)`.
-* @module
-*/
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-var _0n$1 = /* @__PURE__ */ BigInt(0);
-/**
-* @param m - Error message.
-* @example
-* Throw a DER-specific error when signature parsing encounters invalid bytes.
-*
-* ```ts
-* new DERErr('bad der');
-* ```
-*/
-var DERErr = class extends Error {
-	constructor(m = "") {
-		super(m);
-	}
-};
-var _DER = {
-	Err: DERErr,
-	_tlv: {
-		encode: (tag, data) => {
-			const { Err: E } = _DER;
-			asafenumber(tag, "tag");
-			if (tag < 0 || tag > 255) throw new E("tlv.encode: wrong tag");
-			astring(data, "data");
-			if (data.length & 1) throw new E("tlv.encode: unpadded data");
-			const dataLen = data.length / 2;
-			const len = numberToHexUnpadded(dataLen);
-			if (len.length / 2 & 128) throw new E("tlv.encode: long form length too big");
-			const lenLen = dataLen > 127 ? numberToHexUnpadded(len.length / 2 | 128) : "";
-			return numberToHexUnpadded(tag) + lenLen + len + data;
-		},
-		decode(tag, data) {
-			const { Err: E } = _DER;
-			data = abytes$1(data, void 0, "DER data");
-			let pos = 0;
-			if (tag < 0 || tag > 255) throw new E("tlv.decode: wrong tag");
-			if (data.length < 2 || data[pos++] !== tag) throw new E("tlv.decode: wrong tlv");
-			const first = data[pos++];
-			const isLong = !!(first & 128);
-			let length = 0;
-			if (!isLong) length = first;
-			else {
-				const lenLen = first & 127;
-				if (!lenLen) throw new E("tlv.decode(long): indefinite length not supported");
-				if (lenLen > 4) throw new E("tlv.decode(long): byte length is too big");
-				const lengthBytes = data.subarray(pos, pos + lenLen);
-				if (lengthBytes.length !== lenLen) throw new E("tlv.decode: length bytes not complete");
-				if (lengthBytes[0] === 0) throw new E("tlv.decode(long): zero leftmost byte");
-				for (const b of lengthBytes) length = length << 8 | b;
-				pos += lenLen;
-				if (length < 128) throw new E("tlv.decode(long): not minimal encoding");
-			}
-			const v = data.subarray(pos, pos + length);
-			if (v.length !== length) throw new E("tlv.decode: wrong value length");
-			return {
-				v,
-				l: data.subarray(pos + length)
-			};
-		}
-	},
-	_int: {
-		encode(num) {
-			const { Err: E } = _DER;
-			abignumber(num);
-			if (num < _0n$1) throw new E("integer: negative integers are not allowed");
-			let hex = numberToHexUnpadded(num);
-			if (Number.parseInt(hex[0], 16) & 8) hex = "00" + hex;
-			if (hex.length & 1) throw new E("unexpected DER parsing assertion: unpadded hex");
-			return hex;
-		},
-		decode(data) {
-			const { Err: E } = _DER;
-			if (data.length < 1) throw new E("invalid signature integer: empty");
-			if (data[0] & 128) throw new E("invalid signature integer: negative");
-			if (data.length > 1 && data[0] === 0 && !(data[1] & 128)) throw new E("invalid signature integer: unnecessary leading zero");
-			return bytesToNumberBE(data);
-		}
-	},
-	toSig(bytes, maxScalarBytes) {
-		const { Err: E, _int: int, _tlv: tlv } = _DER;
-		if (maxScalarBytes !== void 0) {
-			asafenumber(maxScalarBytes, "maxScalarBytes");
-			if (maxScalarBytes < 1) throw new E("invalid signature: maxScalarBytes must be positive");
-		}
-		const data = abytes$1(bytes, void 0, "signature");
-		const { v: seqBytes, l: seqLeftBytes } = tlv.decode(48, data);
-		if (seqLeftBytes.length) throw new E("invalid signature: left bytes after parsing");
-		const { v: rBytes, l: rLeftBytes } = tlv.decode(2, seqBytes);
-		const { v: sBytes, l: sLeftBytes } = tlv.decode(2, rLeftBytes);
-		if (sLeftBytes.length) throw new E("invalid signature: left bytes after parsing");
-		if (maxScalarBytes !== void 0 && (rBytes.length > maxScalarBytes || sBytes.length > maxScalarBytes)) throw new E("invalid signature: integer too large");
-		return {
-			r: int.decode(rBytes),
-			s: int.decode(sBytes)
-		};
-	},
-	hexFromSig(sig) {
-		const { _tlv: tlv, _int: int } = _DER;
-		validateObject(sig, {
-			r: "bigint",
-			s: "bigint"
-		}, {}, "sig");
-		const seq = tlv.encode(2, int.encode(sig.r)) + tlv.encode(2, int.encode(sig.s));
-		return tlv.encode(48, seq);
-	}
-};
-/**
-* ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:
-*
-*     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]
-*
-* Docs: {@link https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/ | Let's Encrypt ASN.1 guide} and
-* {@link https://luca.ntop.org/Teaching/Appunti/asn1.html | Luca Deri's ASN.1 notes}.
-* @example
-* ASN.1 DER encoding utilities.
-*
-* ```ts
-* const der = DER.hexFromSig({ r: 1n, s: 2n });
-* ```
-*/
-var DER = /* @__PURE__ */ (() => {
-	Object.freeze(_DER._tlv);
-	Object.freeze(_DER._int);
-	return Object.freeze(_DER);
-})();
-//#endregion
-//#region ../../../../../../.pnpm-store/v11/links/@noble/curves/2.4.0/766129a921e8dfd2ef1de557b88b41133e3334d958e354fac1f5d17f98661627/node_modules/@noble/curves/abstract/weierstrass.js
-/**
-* Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.
-*
-* ### Design rationale for types
-*
-* * Interaction between classes from different curves should fail:
-*   `k256.Point.BASE.add(p256.Point.BASE)`
-* * For this purpose we want to use `instanceof` operator, which is fast and works during runtime
-* * Different calls of `curve()` would return different classes -
-*   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,
-*   it won't affect others
-*
-* TypeScript can't infer types for classes created inside a function. Classes is one instance
-* of nominative types in TypeScript and interfaces only check for shape, so it's hard to create
-* unique type for every function call.
-*
-* We can use generic types via some param, like curve opts, but that would:
-*     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)
-*     which is hard to debug.
-*     2. Params can be generic and we can't enforce them to be constant value:
-*     if somebody creates curve from non-constant params,
-*     it would be allowed to interact with other curves with non-constant params
-*
-* @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol
-* @module
-*/
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-var divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n) / den;
-/** Splits scalar for GLV endomorphism. */
-function _splitEndoScalar(k, basis, n) {
-	aInRange("scalar", k, _0n, n);
-	const [[a1, b1], [a2, b2]] = basis;
-	const c1 = divNearest(b2 * k, n);
-	const c2 = divNearest(-b1 * k, n);
-	let k1 = k - c1 * a1 - c2 * a2;
-	let k2 = -c1 * b1 - c2 * b2;
-	const k1neg = k1 < _0n;
-	const k2neg = k2 < _0n;
-	if (k1neg) k1 = -k1;
-	if (k2neg) k2 = -k2;
-	const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n;
-	if (k1 < _0n || k1 >= MAX_NUM || k2 < _0n || k2 >= MAX_NUM) throw new Error("splitScalar (endomorphism): failed for k");
-	return {
-		k1neg,
-		k1,
-		k2neg,
-		k2
-	};
-}
-function validateSigFormat(format) {
-	if (![
-		"compact",
-		"recovered",
-		"der"
-	].includes(format)) throw new Error("Signature format must be \"compact\", \"recovered\", or \"der\"");
-	return format;
-}
-function validateSigOpts(opts, def) {
-	validateObject(opts);
-	const optsn = {};
-	for (let optName of Object.keys(def)) optsn[optName] = opts[optName] === void 0 ? def[optName] : opts[optName];
-	abool(optsn.lowS, "lowS");
-	abool(optsn.prehash, "prehash");
-	if (optsn.format !== void 0) validateSigFormat(optsn.format);
-	return optsn;
-}
-var _0n = /* @__PURE__ */ BigInt(0);
-var _1n = /* @__PURE__ */ BigInt(1);
-var _2n = /* @__PURE__ */ BigInt(2);
-var _3n = /* @__PURE__ */ BigInt(3);
-var _4n = /* @__PURE__ */ BigInt(4);
-/**
-* Creates weierstrass Point constructor, based on specified curve options.
-*
-* See {@link WeierstrassOpts}.
-* @param params - Curve parameters. See {@link WeierstrassOpts}.
-* @param extraOpts - Optional helpers and overrides. See {@link WeierstrassExtraOpts}.
-* @returns Weierstrass point constructor.
-* @throws If the curve parameters, overrides, or point codecs are invalid. {@link Error}
-*
-* @example
-* Construct a point type from explicit Weierstrass curve parameters.
-*
-* ```js
-* const opts = {
-*   p: 0xfffffffffffffffffffffffffffffffeffffac73n,
-*   n: 0x100000000000000000001b8fa16dfab9aca16b6b3n,
-*   h: 1n,
-*   a: 0n,
-*   b: 7n,
-*   Gx: 0x3b4c382ce37aa192a4019e763036f4f5dd4d7ebbn,
-*   Gy: 0x938cf935318fdced6bc28286531733c3f03c4feen,
-* };
-* const secp160k1_Point = weierstrass(opts);
-* ```
-*/
-function weierstrass(params, extraOpts = {}) {
-	const validated = createCurveFields("weierstrass", params, extraOpts);
-	const Fp = validated.Fp;
-	const Fn = validated.Fn;
-	let CURVE = validated.CURVE;
-	const { h: cofactor, n: CURVE_ORDER } = CURVE;
-	validateObject(extraOpts, {}, {
-		allowInfinityPoint: "boolean",
-		clearCofactor: "function",
-		isTorsionFree: "function",
-		fromBytes: "function",
-		toBytes: "function",
-		endo: "object",
-		randomBytes: "function"
-	});
-	const { endo: endoOpts, allowInfinityPoint, clearCofactor, isTorsionFree, fromBytes, toBytes } = extraOpts;
-	const randomBytes$1 = extraOpts.randomBytes === void 0 ? randomBytes : extraOpts.randomBytes;
-	if (endoOpts) {
-		if (!Fp.is0(CURVE.a) || typeof endoOpts.beta !== "bigint" || !Array.isArray(endoOpts.basises)) throw new Error("invalid endo: expected \"beta\": bigint and \"basises\": array");
-	}
-	const endo = endoOpts ? {
-		beta: endoOpts.beta,
-		basises: endoOpts.basises.map((basis) => [...basis])
-	} : void 0;
-	const lengths = getWLengths(Fp, Fn);
-	function assertCompressionIsSupported() {
-		if (!Fp.isOdd) throw new Error("compression is not supported: Field does not have .isOdd()");
-	}
-	function pointToBytes(_c, point, isCompressed) {
-		if (point.is0()) {
-			if (!allowInfinityPoint) throw new Error("bad point: ZERO");
-			return Uint8Array.of(0);
-		}
-		const { x, y } = point.toAffine();
-		const bx = Fp.toBytes(x);
-		abool(isCompressed, "isCompressed");
-		if (isCompressed) {
-			assertCompressionIsSupported();
-			const hasEvenY = !Fp.isOdd(y);
-			return concatBytes(pprefix(hasEvenY), bx);
-		} else return concatBytes(Uint8Array.of(4), bx, Fp.toBytes(y));
-	}
-	function pointFromBytes(bytes) {
-		abytes$1(bytes, void 0, "Point");
-		const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths;
-		const length = bytes.length;
-		const head = bytes[0];
-		const tail = bytes.subarray(1);
-		if (allowInfinityPoint && length === 1 && head === 0) return {
-			x: Fp.ZERO,
-			y: Fp.ZERO
-		};
-		if (length === comp && (head === 2 || head === 3)) {
-			const x = Fp.fromBytes(tail);
-			if (!Fp.isValid(x)) throw new Error("bad point: is not on curve, wrong x");
-			const y2 = weierstrassEquation(x);
-			let y;
-			try {
-				y = Fp.sqrt(y2);
-			} catch (sqrtError) {
-				const err = sqrtError instanceof Error ? ": " + sqrtError.message : "";
-				throw new Error("bad point: is not on curve, sqrt error" + err);
-			}
-			assertCompressionIsSupported();
-			const evenY = Fp.isOdd(y);
-			if ((head & 1) === 1 !== evenY) y = Fp.neg(y);
-			return {
-				x,
-				y
-			};
-		} else if (length === uncomp && head === 4) {
-			const L = Fp.BYTES;
-			const x = Fp.fromBytes(tail.subarray(0, L));
-			const y = Fp.fromBytes(tail.subarray(L, L * 2));
-			if (!isValidXY(x, y)) throw new Error("bad point: is not on curve");
-			return {
-				x,
-				y
-			};
-		} else throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);
-	}
-	const encodePoint = toBytes === void 0 ? pointToBytes : toBytes;
-	const decodePoint = fromBytes === void 0 ? pointFromBytes : fromBytes;
-	const b3 = Fp.mul(CURVE.b, _3n);
-	const mulA = Fp.is0(CURVE.a) ? (_) => Fp.ZERO : (x) => Fp.mul(CURVE.a, x);
-	function weierstrassEquation(x) {
-		const x2 = Fp.sqr(x);
-		const x3 = Fp.mul(x2, x);
-		return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b);
-	}
-	/** Checks whether equation holds for given x, y: y² == x³ + ax + b */
-	function isValidXY(x, y) {
-		const left = Fp.sqr(y);
-		const right = weierstrassEquation(x);
-		return Fp.eql(left, right);
-	}
-	if (!isValidXY(CURVE.Gx, CURVE.Gy)) throw new Error("bad curve params: generator point");
-	const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);
-	const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));
-	if (Fp.is0(Fp.add(_4a3, _27b2))) throw new Error("bad curve params: a or b");
-	/** Asserts coordinate is valid: 0 <= n < Fp.ORDER. */
-	function acoord(title, n, banZero = false) {
-		if (!Fp.isValid(n) || banZero && Fp.is0(n)) throw new Error(`bad point coordinate ${title}`);
-		return typeof n === "object" && n !== null ? Fp.create(n) : n;
-	}
-	function aprjpoint(other) {
-		if (!(other instanceof Point)) throw new Error("Weierstrass Point expected");
-	}
-	function splitEndoScalarN(k) {
-		if (!endo || !endo.basises) throw new Error("no endo");
-		return _splitEndoScalar(k, endo.basises, Fn.ORDER);
-	}
-	/**
-	* Appends a (point, scalar) pair to the inputs of a vartime wNAF walk
-	* ({@link mulAddUnsafe}). With GLV endomorphism the scalar is split into two half-width
-	* pairs against P and ψ(P) = (β⋅x, y), halving the walk's shared doubling chain;
-	* split signs fold into the points.
-	*/
-	function pushWnafPair(points, scalars, p, k) {
-		if (!Fn.isValid(k)) throw new RangeError("invalid scalar: out of range");
-		if (endo) {
-			const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(k);
-			const psi = new Point(Fp.mul(p.X, endo.beta), p.Y, p.Z);
-			points.push(k1neg ? p.negate() : p, k2neg ? psi.negate() : psi);
-			scalars.push(k1, k2);
-		} else {
-			points.push(p);
-			scalars.push(k);
-		}
-	}
-	const validityCache = /* @__PURE__ */ new WeakSet();
-	/**
-	* Projective Point works in 3d / projective (homogeneous) coordinates:(X, Y, Z) ∋ (x=X/Z, y=Y/Z).
-	* Default Point works in 2d / affine coordinates: (x, y).
-	* We're doing calculations in projective, because its operations don't require costly inversion.
-	*/
-	class Point {
-		static BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);
-		static ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO);
-		static Fp = Fp;
-		static Fn = Fn;
-		X;
-		Y;
-		Z;
-		/** Does NOT validate if the point is valid. Use `.assertValidity()`. */
-		constructor(X, Y, Z) {
-			this.X = acoord("x", X);
-			this.Y = acoord("y", Y, true);
-			this.Z = acoord("z", Z);
-			Object.freeze(this);
-		}
-		static CURVE() {
-			return CURVE;
-		}
-		/** Does NOT validate if the point is valid. Use `.assertValidity()`. */
-		static fromAffine(p) {
-			const { x, y } = p || {};
-			if (!p || !Fp.isValid(x) || !Fp.isValid(y)) throw new Error("invalid affine point");
-			if (p instanceof Point) throw new Error("projective point not allowed");
-			if (Fp.is0(x) && Fp.is0(y)) return Point.ZERO;
-			return new Point(x, y, Fp.ONE);
-		}
-		static fromBytes(bytes) {
-			const P = Point.fromAffine(decodePoint(abytes$1(bytes, void 0, "point")));
-			P.assertValidity();
-			return P;
-		}
-		static fromHex(hex) {
-			return Point.fromBytes(hexToBytes(hex));
-		}
-		get x() {
-			return this.toAffine().x;
-		}
-		get y() {
-			return this.toAffine().y;
-		}
-		/**
-		* @param isLazy - true will defer table computation until the first multiplication
-		*/
-		precompute(windowSize = 6, isLazy = true) {
-			wnaf.setWindowSize(this, windowSize);
-			if (!isLazy) this.multiply(_3n);
-			return this;
-		}
-		/** A point on curve is valid if it conforms to equation. */
-		assertValidity() {
-			const p = this;
-			if (p.is0()) {
-				if (allowInfinityPoint && Fp.is0(p.X) && Fp.eql(p.Y, Fp.ONE) && Fp.is0(p.Z)) return;
-				throw new Error("bad point: ZERO");
-			}
-			if (validityCache.has(p)) return;
-			const { x, y } = p.toAffine();
-			if (!Fp.isValid(x) || !Fp.isValid(y)) throw new Error("bad point: x or y not field elements");
-			if (!isValidXY(x, y)) throw new Error("bad point: equation left != right");
-			if (!p.isTorsionFree()) throw new Error("bad point: not in prime-order subgroup");
-			validityCache.add(p);
-		}
-		hasEvenY() {
-			const { y } = this.toAffine();
-			if (!Fp.isOdd) throw new Error("Field doesn't support isOdd");
-			return !Fp.isOdd(y);
-		}
-		/** Compare one point to another. */
-		equals(other) {
-			aprjpoint(other);
-			const { X: X1, Y: Y1, Z: Z1 } = this;
-			const { X: X2, Y: Y2, Z: Z2 } = other;
-			const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));
-			const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));
-			return U1 && U2;
-		}
-		/** Flips point to one corresponding to (x, -y) in Affine coordinates. */
-		negate() {
-			return new Point(this.X, Fp.neg(this.Y), this.Z);
-		}
-		double() {
-			const { X: X1, Y: Y1, Z: Z1 } = this;
-			let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO;
-			let t0 = Fp.mul(X1, X1);
-			let t1 = Fp.mul(Y1, Y1);
-			let t2 = Fp.mul(Z1, Z1);
-			let t3 = Fp.mul(X1, Y1);
-			t3 = Fp.add(t3, t3);
-			Z3 = Fp.mul(X1, Z1);
-			Z3 = Fp.add(Z3, Z3);
-			X3 = mulA(Z3);
-			Y3 = Fp.mul(b3, t2);
-			Y3 = Fp.add(X3, Y3);
-			X3 = Fp.sub(t1, Y3);
-			Y3 = Fp.add(t1, Y3);
-			Y3 = Fp.mul(X3, Y3);
-			X3 = Fp.mul(t3, X3);
-			Z3 = Fp.mul(b3, Z3);
-			t2 = mulA(t2);
-			t3 = Fp.sub(t0, t2);
-			t3 = mulA(t3);
-			t3 = Fp.add(t3, Z3);
-			Z3 = Fp.add(t0, t0);
-			t0 = Fp.add(Z3, t0);
-			t0 = Fp.add(t0, t2);
-			t0 = Fp.mul(t0, t3);
-			Y3 = Fp.add(Y3, t0);
-			t2 = Fp.mul(Y1, Z1);
-			t2 = Fp.add(t2, t2);
-			t0 = Fp.mul(t2, t3);
-			X3 = Fp.sub(X3, t0);
-			Z3 = Fp.mul(t2, t1);
-			Z3 = Fp.add(Z3, Z3);
-			Z3 = Fp.add(Z3, Z3);
-			return new Point(X3, Y3, Z3);
-		}
-		add(other) {
-			aprjpoint(other);
-			const { X: X1, Y: Y1, Z: Z1 } = this;
-			const { X: X2, Y: Y2, Z: Z2 } = other;
-			let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO;
-			let t0 = Fp.mul(X1, X2);
-			let t1 = Fp.mul(Y1, Y2);
-			let t2 = Fp.mul(Z1, Z2);
-			let t3 = Fp.add(X1, Y1);
-			let t4 = Fp.add(X2, Y2);
-			t3 = Fp.mul(t3, t4);
-			t4 = Fp.add(t0, t1);
-			t3 = Fp.sub(t3, t4);
-			t4 = Fp.add(X1, Z1);
-			let t5 = Fp.add(X2, Z2);
-			t4 = Fp.mul(t4, t5);
-			t5 = Fp.add(t0, t2);
-			t4 = Fp.sub(t4, t5);
-			t5 = Fp.add(Y1, Z1);
-			X3 = Fp.add(Y2, Z2);
-			t5 = Fp.mul(t5, X3);
-			X3 = Fp.add(t1, t2);
-			t5 = Fp.sub(t5, X3);
-			Z3 = mulA(t4);
-			X3 = Fp.mul(b3, t2);
-			Z3 = Fp.add(X3, Z3);
-			X3 = Fp.sub(t1, Z3);
-			Z3 = Fp.add(t1, Z3);
-			Y3 = Fp.mul(X3, Z3);
-			t1 = Fp.add(t0, t0);
-			t1 = Fp.add(t1, t0);
-			t2 = mulA(t2);
-			t4 = Fp.mul(b3, t4);
-			t1 = Fp.add(t1, t2);
-			t2 = Fp.sub(t0, t2);
-			t2 = mulA(t2);
-			t4 = Fp.add(t4, t2);
-			t0 = Fp.mul(t1, t4);
-			Y3 = Fp.add(Y3, t0);
-			t0 = Fp.mul(t5, t4);
-			X3 = Fp.mul(t3, X3);
-			X3 = Fp.sub(X3, t0);
-			t0 = Fp.mul(t3, t1);
-			Z3 = Fp.mul(t5, Z3);
-			Z3 = Fp.add(Z3, t0);
-			return new Point(X3, Y3, Z3);
-		}
-		subtract(other) {
-			aprjpoint(other);
-			return this.add(other.negate());
-		}
-		is0() {
-			return this.equals(Point.ZERO);
-		}
-		/**
-		* Constant time multiplication.
-		* Uses precomputed tables (signed fixed-window wNAF) when available.
-		* Uses scalar blinding and avoids endomorphism splitting in the secret-scalar path.
-		* @param scalar - by which the point would be multiplied
-		* @returns New point
-		*/
-		multiply(scalar) {
-			if (!Fn.isValidNot0(scalar)) throw new RangeError("invalid scalar: out of range");
-			const { p, f } = wnaf.mulSecret(this, scalar, cofactor, normalize);
-			return normalize([p, f])[0];
-		}
-		/**
-		* Non-constant-time multiplication. Uses width-4 wNAF with GLV endomorphism splitting
-		* when available (two half-width scalars sharing one halved doubling chain).
-		* It's faster, but should only be used when you don't care about
-		* an exposed secret key e.g. sig verification, which works over *public* keys.
-		*/
-		multiplyUnsafe(scalar) {
-			const p = this;
-			const sc = scalar;
-			if (!Fn.isValid(sc)) throw new RangeError("invalid scalar: out of range");
-			if (sc === _0n || p.is0()) return Point.ZERO;
-			if (sc === _1n) return p;
-			if (wnaf.hasWindowSize(this)) return wnaf.mulUnsafe(p, sc, normalize);
-			const points = [];
-			const scalars = [];
-			pushWnafPair(points, scalars, p, sc);
-			return mulAddUnsafe(Point, points, scalars);
-		}
-		/**
-		* Non-constant-time double-scalar multiplication `a⋅this + b⋅other` (Strauss–Shamir).
-		* Both walks share one doubling chain via {@link mulAddUnsafe}, and GLV endomorphism
-		* (when available) halves the chain again by splitting each scalar into two half-width
-		* parts. Used by ECDSA verification and public-key recovery for `R = u1⋅G + u2⋅P`.
-		* Only for public scalars.
-		*/
-		mulAddUnsafe(a, other, b) {
-			aprjpoint(other);
-			const points = [];
-			const scalars = [];
-			pushWnafPair(points, scalars, this, a);
-			pushWnafPair(points, scalars, other, b);
-			return mulAddUnsafe(Point, points, scalars);
-		}
-		/**
-		* Converts Projective point to affine (x, y) coordinates.
-		* (X, Y, Z) ∋ (x=X/Z, y=Y/Z).
-		* @param invertedZ - Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch
-		*/
-		toAffine(invertedZ) {
-			const p = this;
-			let iz = invertedZ;
-			if (iz != null && !Fp.isValid(iz)) throw new RangeError("\"invertedZ\" expected valid field element");
-			const { X, Y, Z } = p;
-			if (Fp.eql(Z, Fp.ONE)) return {
-				x: X,
-				y: Y
-			};
-			const is0 = p.is0();
-			if (iz == null) iz = is0 ? Fp.ONE : Fp.inv(Z);
-			const x = Fp.mul(X, iz);
-			const y = Fp.mul(Y, iz);
-			const zz = Fp.mul(Z, iz);
-			if (is0) return {
-				x: Fp.ZERO,
-				y: Fp.ZERO
-			};
-			if (!Fp.eql(zz, Fp.ONE)) throw new Error("invZ was invalid");
-			return {
-				x,
-				y
-			};
-		}
-		/**
-		* Checks whether Point is free of torsion elements (is in prime subgroup).
-		* Always torsion-free for cofactor=1 curves.
-		*/
-		isTorsionFree() {
-			if (cofactor === _1n) return true;
-			if (isTorsionFree) return isTorsionFree(Point, this);
-			return wnaf.mulUnsafe(this, CURVE_ORDER).is0();
-		}
-		clearCofactor() {
-			if (cofactor === _1n) return this;
-			if (clearCofactor) return clearCofactor(Point, this);
-			return this.multiplyUnsafe(cofactor);
-		}
-		isSmallOrder() {
-			if (cofactor === _1n) return this.is0();
-			return this.clearCofactor().is0();
-		}
-		toBytes(isCompressed = true) {
-			abool(isCompressed, "isCompressed");
-			this.assertValidity();
-			return encodePoint(Point, this, isCompressed);
-		}
-		toHex(isCompressed = true) {
-			return bytesToHex(this.toBytes(isCompressed));
-		}
-		toString() {
-			return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
-		}
-	}
-	const normalize = (points) => normalizeZ(Point, points);
-	const wnaf = new ScalarMultiplier(Point, randomBytes$1);
-	if (wnaf.bits >= 6) Point.BASE.precompute(6);
-	Object.freeze(Point.prototype);
-	Object.freeze(Point);
-	return Point;
-}
-function pprefix(hasEvenY) {
-	return Uint8Array.of(hasEvenY ? 2 : 3);
-}
-function getWLengths(Fp, Fn) {
-	return {
-		secretKey: Fn.BYTES,
-		publicKey: 1 + Fp.BYTES,
-		publicKeyUncompressed: 1 + 2 * Fp.BYTES,
-		publicKeyHasPrefix: true,
-		signature: 2 * Fn.BYTES
-	};
-}
-/**
-* Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.
-* This helper ensures no signature functionality is present. Less code, smaller bundle size.
-* @param Point - Weierstrass point constructor.
-* @param ecdhOpts - Optional randomness helpers:
-*   - `randomBytes` (optional): Optional RNG override.
-* @returns ECDH helper namespace.
-* @example
-* Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.
-*
-* ```ts
-* import { ecdh } from '@noble/curves/abstract/weierstrass.js';
-* import { p256 } from '@noble/curves/nist.js';
-* const dh = ecdh(p256.Point);
-* const alice = dh.keygen();
-* const shared = dh.getSharedSecret(alice.secretKey, alice.publicKey);
-* ```
-*/
-function ecdh(Point, ecdhOpts = {}) {
-	validatePointCons(Point);
-	const { Fn } = Point;
-	const randomBytes_ = ecdhOpts.randomBytes === void 0 ? randomBytes : ecdhOpts.randomBytes;
-	const lengths = Object.assign(getWLengths(Point.Fp, Fn), { seed: Math.max(getMinHashLength(Fn.ORDER), 16) });
-	function isValidSecretKey(secretKey) {
-		try {
-			const num = Fn.fromBytes(secretKey);
-			return Fn.isValidNot0(num);
-		} catch (error) {
-			return false;
-		}
-	}
-	function isValidPublicKey(publicKey, isCompressed) {
-		const { publicKey: comp, publicKeyUncompressed } = lengths;
-		try {
-			const l = publicKey.length;
-			if (isCompressed === true && l !== comp) return false;
-			if (isCompressed === false && l !== publicKeyUncompressed) return false;
-			return !Point.fromBytes(publicKey).is0();
-		} catch (error) {
-			return false;
-		}
-	}
-	/**
-	* Produces cryptographically secure secret key from random of size
-	* (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.
-	*/
-	function randomSecretKey(seed) {
-		seed = seed === void 0 ? randomBytes_(lengths.seed) : seed;
-		return mapHashToField(abytes$1(seed, lengths.seed, "seed"), Fn.ORDER);
-	}
-	/**
-	* Computes public key for a secret key. Checks for validity of the secret key.
-	* @param isCompressed - whether to return compact (default), or full key
-	* @returns Public key, full when isCompressed=false; short when isCompressed=true
-	*/
-	function getPublicKey(secretKey, isCompressed = true) {
-		return Point.BASE.multiply(Fn.fromBytes(secretKey)).toBytes(isCompressed);
-	}
-	/**
-	* Quick and dirty check for item being public key. Does not validate hex, or being on-curve.
-	*/
-	function isProbPub(item) {
-		const { secretKey, publicKey, publicKeyUncompressed } = lengths;
-		const allowedLengths = Fn._lengths;
-		if (!isBytes(item)) return void 0;
-		const l = abytes$1(item, void 0, "key").length;
-		const isPub = l === publicKey || l === publicKeyUncompressed;
-		const isSec = l === secretKey || !!allowedLengths?.includes(l);
-		if (isPub && isSec) return void 0;
-		return isPub;
-	}
-	/**
-	* ECDH (Elliptic Curve Diffie Hellman).
-	* Computes encoded shared point from secret key A and public key B.
-	* Checks: 1) secret key validity 2) shared key is on-curve.
-	* Does NOT hash the result or expose the SEC 1 x-coordinate-only `z`.
-	* Returns the encoded shared point on purpose: callers that need `x_P`
-	* can derive it from the encoded point, but `x_P` alone cannot recover the
-	* point/parity back.
-	* This helper only exposes the fully validated public-key path, not cofactor DH.
-	* @param isCompressed - whether to return compact (default), or full key
-	* @returns shared point encoding
-	*/
-	function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {
-		if (isProbPub(secretKeyA) === true) throw new Error("first arg must be private key");
-		if (isProbPub(publicKeyB) === false) throw new Error("second arg must be public key");
-		const s = Fn.fromBytes(secretKeyA);
-		const b = Point.fromBytes(publicKeyB);
-		if (b.is0()) throw new Error("invalid public key: point at infinity");
-		return b.multiply(s).toBytes(isCompressed);
-	}
-	const utils = {
-		isValidSecretKey,
-		isValidPublicKey,
-		randomSecretKey
-	};
-	const keygen = createKeygen(randomSecretKey, getPublicKey);
-	Object.freeze(utils);
-	Object.freeze(lengths);
-	return Object.freeze({
-		getPublicKey,
-		getSharedSecret,
-		keygen,
-		Point,
-		utils,
-		lengths
-	});
-}
-/**
-* Creates ECDSA signing interface for given elliptic curve `Point` and `hash` function.
-*
-* @param Point - created using {@link weierstrass} function
-* @param hash - used for 1) message prehash-ing 2) k generation in `sign`, using hmac_drbg(hash)
-* @param ecdsaOpts - rarely needed, see {@link ECDSAOpts}:
-*   - `lowS`: Default low-S policy.
-*   - `hmac`: HMAC implementation used by RFC6979 DRBG.
-*   - `randomBytes`: Optional RNG override.
-*   - `bits2int`: Optional hash-to-int conversion override.
-*   - `bits2int_modN`: Optional hash-to-int-mod-n conversion override.
-*
-* @returns ECDSA helper namespace.
-* @example
-* Create an ECDSA signer/verifier bundle for one curve implementation.
-*
-* ```ts
-* import { ecdsa } from '@noble/curves/abstract/weierstrass.js';
-* import { p256 } from '@noble/curves/nist.js';
-* import { sha256 } from '@noble/hashes/sha2.js';
-* const p256ecdsa = ecdsa(p256.Point, sha256);
-* const { secretKey, publicKey } = p256ecdsa.keygen();
-* const msg = new TextEncoder().encode('hello noble');
-* const sig = p256ecdsa.sign(msg, secretKey);
-* const isValid = p256ecdsa.verify(sig, msg, publicKey);
-* ```
-*/
-function ecdsa(Point, hash, ecdsaOpts = {}) {
-	validatePointCons(Point);
-	const hash_ = hash;
-	ahash(hash_);
-	validateObject(ecdsaOpts, {}, {
-		hmac: "function",
-		lowS: "boolean",
-		randomBytes: "function",
-		bits2int: "function",
-		bits2int_modN: "function"
-	});
-	const opts = Object.assign({}, ecdsaOpts);
-	const randomBytes$2 = opts.randomBytes === void 0 ? randomBytes : opts.randomBytes;
-	const hmac$1 = opts.hmac === void 0 ? (key, msg) => hmac(hash_, key, msg) : opts.hmac;
-	const { Fp, Fn } = Point;
-	const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
-	const blindLength = getMinHashLength(CURVE_ORDER);
-	const csprng = probeRandomBytes(randomBytes$2, blindLength);
-	const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, opts);
-	const defaultSigOpts = {
-		prehash: true,
-		lowS: typeof opts.lowS === "boolean" ? opts.lowS : true,
-		format: "compact",
-		extraEntropy: false
-	};
-	const hasLargeRecoveryLifts = CURVE_ORDER * _2n + _1n < Fp.ORDER;
-	function isBiggerThanHalfOrder(number) {
-		return number > CURVE_ORDER >> _1n;
-	}
-	function validateRS(title, num) {
-		if (!Fn.isValidNot0(num)) throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);
-		return num;
-	}
-	function assertFieldSignIsSupported() {
-		if (!Fp.isOdd) throw new Error("Field doesn't support isOdd");
-	}
-	function getRecoveryBit(x, y, r) {
-		assertFieldSignIsSupported();
-		return (x === r ? 0 : 2) | Number(Fp.isOdd(y));
-	}
-	function assertRecoverableCurve() {
-		if (hasLargeRecoveryLifts) throw new Error("\"recovered\" sig type is not supported for cofactor >2 curves");
-	}
-	function validateSigLength(bytes, format) {
-		validateSigFormat(format);
-		const size = lengths.signature;
-		const sizer = format === "compact" ? size : format === "recovered" ? size + 1 : void 0;
-		return abytes$1(bytes, sizer);
-	}
-	/**
-	* ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.
-	*/
-	class Signature {
-		r;
-		s;
-		recovery;
-		constructor(r, s, recovery) {
-			this.r = validateRS("r", r);
-			this.s = validateRS("s", s);
-			if (recovery != null) {
-				assertRecoverableCurve();
-				if (![
-					0,
-					1,
-					2,
-					3
-				].includes(recovery)) throw new Error("invalid recovery id");
-				this.recovery = recovery;
-			}
-			Object.freeze(this);
-		}
-		static fromBytes(bytes, format = defaultSigOpts.format) {
-			validateSigLength(bytes, format);
-			let recid;
-			if (format === "der") {
-				if (bytes.length > 2 * Fn.BYTES + 16) throw new DER.Err("invalid signature: DER signature too long");
-				const { r, s } = DER.toSig(abytes$1(bytes), Fn.BYTES + 1);
-				return new Signature(r, s);
-			}
-			if (format === "recovered") {
-				recid = bytes[0];
-				format = "compact";
-				bytes = bytes.subarray(1);
-			}
-			const L = lengths.signature / 2;
-			const r = bytes.subarray(0, L);
-			const s = bytes.subarray(L, L * 2);
-			return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);
-		}
-		static fromHex(hex, format) {
-			return this.fromBytes(hexToBytes(hex), format);
-		}
-		assertRecovery() {
-			const { recovery } = this;
-			if (recovery == null) throw new Error("invalid recovery id: must be present");
-			return recovery;
-		}
-		addRecoveryBit(recovery) {
-			return new Signature(this.r, this.s, recovery);
-		}
-		recoverPublicKey(messageHash) {
-			const { r, s } = this;
-			const recovery = this.assertRecovery();
-			const radj = recovery === 2 || recovery === 3 ? r + CURVE_ORDER : r;
-			if (!Fp.isValid(radj)) throw new Error("invalid recovery id: sig.r+curve.n != R.x");
-			const x = Fp.toBytes(radj);
-			const R = Point.fromBytes(concatBytes(pprefix((recovery & 1) === 0), x));
-			const ir = Fn.inv(radj);
-			const h = bits2int_modN(abytes$1(messageHash, void 0, "msgHash"));
-			const u1 = Fn.create(-h * ir);
-			const u2 = Fn.create(s * ir);
-			const Q = Point.BASE.mulAddUnsafe(u1, R, u2);
-			if (Q.is0()) throw new Error("invalid recovery: point at infinify");
-			Q.assertValidity();
-			return Q;
-		}
-		hasHighS() {
-			return isBiggerThanHalfOrder(this.s);
-		}
-		toBytes(format = defaultSigOpts.format) {
-			validateSigFormat(format);
-			if (format === "der") return hexToBytes(DER.hexFromSig(this));
-			const { r, s } = this;
-			const rb = Fn.toBytes(r);
-			const sb = Fn.toBytes(s);
-			if (format === "recovered") {
-				assertRecoverableCurve();
-				return concatBytes(Uint8Array.of(this.assertRecovery()), rb, sb);
-			}
-			return concatBytes(rb, sb);
-		}
-		toHex(format) {
-			return bytesToHex(this.toBytes(format));
-		}
-	}
-	Object.freeze(Signature.prototype);
-	Object.freeze(Signature);
-	const bits2int = opts.bits2int === void 0 ? function bits2int_def(bytes) {
-		if (bytes.length > 8192) throw new Error("input is too large");
-		const num = bytesToNumberBE(bytes);
-		const delta = bytes.length * 8 - fnBits;
-		return delta > 0 ? num >> BigInt(delta) : num;
-	} : opts.bits2int;
-	const bits2int_modN = opts.bits2int_modN === void 0 ? function bits2int_modN_def(bytes) {
-		return Fn.create(bits2int(bytes));
-	} : opts.bits2int_modN;
-	const ORDER_MASK = bitMask(fnBits);
-	/** Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`. */
-	function int2octets(num) {
-		aInRange("num < 2^" + fnBits, num, _0n, ORDER_MASK);
-		return Fn.toBytes(num);
-	}
-	function validateMsgAndHash(message, prehash) {
-		abytes$1(message, void 0, "message");
-		return prehash ? abytes$1(hash_(message), void 0, "prehashed message") : message;
-	}
-	/**
-	* Steps A, D of RFC6979 3.2.
-	* Creates RFC6979 seed; converts msg/privKey to numbers.
-	* Used only in sign, not in verify.
-	*
-	* Warning: we cannot assume here that message has same amount of bytes as curve order,
-	* this will be invalid at least for P521. Also it can be bigger for P224 + SHA256.
-	*/
-	function prepSig(message, secretKey, opts) {
-		const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);
-		message = validateMsgAndHash(message, prehash);
-		const h1int = bits2int_modN(message);
-		const d = Fn.fromBytes(secretKey);
-		if (!Fn.isValidNot0(d)) throw new Error("invalid private key");
-		const seedArgs = [int2octets(d), int2octets(h1int)];
-		if (extraEntropy != null && extraEntropy !== false) {
-			const e = extraEntropy === true ? randomBytes$2(lengths.secretKey) : extraEntropy;
-			seedArgs.push(abytes$1(e, void 0, "extraEntropy"));
-		}
-		const seed = concatBytes(...seedArgs);
-		const m = h1int;
-		function k2sig(kBytes) {
-			const k = bits2int(kBytes);
-			if (!Fn.isValidNot0(k)) return;
-			const q = Point.BASE.multiply(k).toAffine();
-			const r = Fn.create(q.x);
-			if (r === _0n) return;
-			let s;
-			if (csprng !== void 0) {
-				const b = bytesToNumberBE(mapHashToField(csprng(blindLength), CURVE_ORDER));
-				const ibk = Fn.inv(Fn.mul(b, k));
-				const bm = Fn.mul(b, m);
-				const bd = Fn.mul(b, d);
-				s = Fn.create(ibk * Fn.create(bm + bd * r));
-			} else {
-				const ik = invertCt(k, CURVE_ORDER);
-				s = Fn.create(ik * Fn.create(m + r * d));
-			}
-			if (s === _0n) return;
-			let recovery = getRecoveryBit(q.x, q.y, r);
-			let normS = s;
-			if (lowS && isBiggerThanHalfOrder(s)) {
-				normS = Fn.neg(s);
-				recovery ^= 1;
-			}
-			return new Signature(r, normS, hasLargeRecoveryLifts ? void 0 : recovery);
-		}
-		return {
-			seed,
-			k2sig
-		};
-	}
-	/**
-	* Signs a message or message hash with a secret key.
-	* With the default `prehash: true`, raw message bytes are hashed internally;
-	* only `{ prehash: false }` expects a caller-supplied digest.
-	*
-	* ```
-	* sign(m, d) where
-	*   k = rfc6979_hmac_drbg(m, d)
-	*   (x, y) = G × k
-	*   r = x mod n
-	*   s = (m + dr) / k mod n
-	* ```
-	*/
-	function sign(message, secretKey, opts = {}) {
-		const { seed, k2sig } = prepSig(message, secretKey, opts);
-		return createHmacDrbg(hash_.outputLen, Fn.BYTES, hmac$1)(seed, k2sig).toBytes(opts.format);
-	}
-	/**
-	* Verifies a signature against message and public key.
-	* Rejects lowS signatures by default: see {@link ECDSAVerifyOpts}.
-	* Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:
-	*
-	* ```
-	* verify(r, s, h, P) where
-	*   u1 = hs^-1 mod n
-	*   u2 = rs^-1 mod n
-	*   R = u1⋅G + u2⋅P
-	*   mod(R.x, n) == r
-	* ```
-	*/
-	function verify(signature, message, publicKey, opts = {}) {
-		const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);
-		publicKey = abytes$1(publicKey, void 0, "publicKey");
-		message = validateMsgAndHash(message, prehash);
-		if (!isBytes(signature)) {
-			const end = signature instanceof Signature ? ", use sig.toBytes()" : "";
-			throw new Error("verify expects Uint8Array signature" + end);
-		}
-		validateSigLength(signature, format);
-		try {
-			const sig = Signature.fromBytes(signature, format);
-			const P = Point.fromBytes(publicKey);
-			if (P.is0()) return false;
-			if (lowS && sig.hasHighS()) return false;
-			const { r, s } = sig;
-			const h = bits2int_modN(message);
-			const is = Fn.inv(s);
-			const u1 = Fn.create(h * is);
-			const u2 = Fn.create(r * is);
-			const R = Point.BASE.mulAddUnsafe(u1, P, u2);
-			if (R.is0()) return false;
-			const q = R.toAffine();
-			if (Fn.create(q.x) !== r) return false;
-			if (format === "recovered" && sig.recovery !== getRecoveryBit(q.x, q.y, r)) return false;
-			return true;
-		} catch (e) {
-			return false;
-		}
-	}
-	function recoverPublicKey(signature, message, opts = {}) {
-		const { prehash } = validateSigOpts(opts, defaultSigOpts);
-		message = validateMsgAndHash(message, prehash);
-		return Signature.fromBytes(signature, "recovered").recoverPublicKey(message).toBytes();
-	}
-	return Object.freeze({
-		keygen,
-		getPublicKey,
-		getSharedSecret,
-		utils,
-		lengths,
-		Point,
-		sign,
-		verify,
-		recoverPublicKey,
-		Signature,
-		hash: hash_
-	});
-}
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-/**
-* NIST P256 (aka secp256r1, prime256v1) curve, ECDSA and ECDH methods.
-* Hashes inputs with sha256 by default.
-*
-* @example
-* Generate one P-256 keypair, sign a message, and verify it.
-*
-* ```js
-* import { p256 } from '@noble/curves/nist.js';
-* const { secretKey, publicKey } = p256.keygen();
-* const recovered = p256.getPublicKey(secretKey);
-* const peer = p256.keygen();
-* const shared = p256.getSharedSecret(secretKey, peer.publicKey);
-* const msg = new TextEncoder().encode('hello noble');
-* const sig = p256.sign(msg, secretKey, { lowS: true, prehash: true });
-* const isValid = p256.verify(sig, msg, publicKey);
-* // const sigKeccak = p256.sign(keccak256(msg), secretKey, { prehash: false });
-* ```
-*/
-var p256 = /* @__PURE__ */ ecdsa(/* @__PURE__ */ weierstrass(/* @__PURE__ */ (() => ({
-	p: BigInt("0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff"),
-	n: BigInt("0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551"),
-	h: BigInt(1),
-	a: BigInt("0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc"),
-	b: BigInt("0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b"),
-	Gx: BigInt("0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296"),
-	Gy: BigInt("0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5")
-}))()), sha256);
-//#endregion
-export { p256 as t };