@frequency-chain/ethereum-utils 1.17.2 → 1.17.3

package/browser/frequency-ethereum-utils.esm.min.js

@@ -3539,7 +3539,7 @@ const REGEX_HEX_NOPREFIX = /^[\da-fA-F]+$/;
 function isHex(value, bitLength = -1, ignoreLength) {
     return (typeof value === 'string' && (value === '0x' ||
         REGEX_HEX_PREFIXED.test(value))) && (bitLength === -1
-        ? ((value.length % 2 === 0))
+        ? (ignoreLength || (value.length % 2 === 0))
         : (value.length === (2 + Math.ceil(bitLength / 4))));
 }/**
  * @name isObject
@@ -7545,6 +7545,11 @@ var knownSubstrate = [
     composable: [
         '0xdaab8df776eb52ec604a5df5d388bb62a050a0aaec4556a64265b9d42755552d'
     ],
+    creditcoin3: [
+        '0x4436a7d64e363df85e065a894721002a86643283f9707338bf195d360ba2ee71', // cc3 mainnet
+        '0xfc4ec97a1c1f119c4353aecb4a17c7c0cf7b40d5d660143d8bad9117e9866572', // cc3 testnet/drynet
+        '0xfc9df99a665f964aed6649f275055e54df5e3420489538ed31d7788f53d11ef6' // cc3 devnet
+    ],
     darwinia: [
         '0xe71578b37a7c799b0ab4ee87ffa6f059a6b98f71f06fb8c84a8d88013a548ad6'
     ],
@@ -7713,6 +7718,7 @@ var knownSubstrate = [
     bittensor: 0x00000162,
     centrifuge: 0x000002eb,
     composable: 0x00000162,
+    creditcoin3: 0x00000162,
     darwinia: 0x00000162,
     'dock-mainnet': 0x00000252,
     edgeware: 0x0000020b,
@@ -8024,10 +8030,28 @@ hmac$1.create = (hash, key) => new HMAC$1(hash, key);/**
  */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 const _0n$9 = /* @__PURE__ */ BigInt(0);
-const _1n$b = /* @__PURE__ */ BigInt(1);
-function abool(title, value) {
-    if (typeof value !== 'boolean')
-        throw new Error(title + ' boolean expected, got ' + value);
+const _1n$a = /* @__PURE__ */ BigInt(1);
+// tmp name until v2
+function _abool2(value, title = '') {
+    if (typeof value !== 'boolean') {
+        const prefix = title && `"${title}"`;
+        throw new Error(prefix + 'expected boolean, got type=' + typeof value);
+    }
+    return value;
+}
+// tmp name until v2
+/** Asserts something is Uint8Array. */
+function _abytes2(value, length, title = '') {
+    const bytes = isBytes(value);
+    const len = value?.length;
+    const needsLen = length !== undefined;
+    if (!bytes || (needsLen && len !== length)) {
+        const prefix = title && `"${title}"`;
+        const ofLen = needsLen ? ` of length ${length}` : '';
+        const got = bytes ? `length=${len}` : `type=${typeof value}`;
+        throw new Error(prefix + 'expected Uint8Array' + ofLen + ', got ' + got);
+    }
+    return value;
 }
 // Used in weierstrass, der
 function numberToHexUnpadded$1(num) {
@@ -8057,7 +8081,7 @@ function numberToBytesLE$1(n, len) {
  * Takes hex string or Uint8Array, converts to Uint8Array.
  * Validates output length.
  * Will throw error for other types.
- * @param title descriptive title for an error e.g. 'private key'
+ * @param title descriptive title for an error e.g. 'secret key'
  * @param hex hex string or Uint8Array
  * @param expectedLength optional, will compare to result array's length
  * @returns
@@ -8080,9 +8104,7 @@ function ensureBytes$1(title, hex, expectedLength) {
     else {
         throw new Error(title + ' must be hex string or Uint8Array');
     }
-    const len = res.length;
-    if (typeof expectedLength === 'number' && len !== expectedLength)
-        throw new Error(title + ' of length ' + expectedLength + ' expected, got ' + len);
+    res.length;
     return res;
 }
 /**
@@ -8121,7 +8143,7 @@ function aInRange(title, n, min, max) {
  */
 function bitLen$1(n) {
     let len;
-    for (len = 0; n > _0n$9; n >>= _1n$b, len += 1)
+    for (len = 0; n > _0n$9; n >>= _1n$a, len += 1)
         ;
     return len;
 }
@@ -8129,7 +8151,7 @@ function bitLen$1(n) {
  * Calculate mask for N bits. Not using ** operator with bigints because of old engines.
  * Same as BigInt(`0b${Array(i).fill('1').join('')}`)
  */
-const bitMask$1 = (n) => (_1n$b << BigInt(n)) - _1n$b;
+const bitMask$1 = (n) => (_1n$a << BigInt(n)) - _1n$a;
 /**
  * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.
  * @returns function that will call DRBG until 2nd arg returns something meaningful
@@ -8226,10 +8248,11 @@ function memoized(fn) {
  */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 // prettier-ignore
-const _0n$8 = BigInt(0), _1n$a = BigInt(1), _2n$7 = /* @__PURE__ */ BigInt(2), _3n$3 = /* @__PURE__ */ BigInt(3);
+const _0n$8 = BigInt(0), _1n$9 = BigInt(1), _2n$7 = /* @__PURE__ */ BigInt(2), _3n$3 = /* @__PURE__ */ BigInt(3);
 // prettier-ignore
-const _4n$2 = /* @__PURE__ */ BigInt(4), _5n$1 = /* @__PURE__ */ BigInt(5);
-const _8n$1 = /* @__PURE__ */ BigInt(8);
+const _4n$2 = /* @__PURE__ */ BigInt(4), _5n$1 = /* @__PURE__ */ BigInt(5), _7n$2 = /* @__PURE__ */ BigInt(7);
+// prettier-ignore
+const _8n$1 = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9), _16n = /* @__PURE__ */ BigInt(16);
 // Calculates a modulo b
 function mod$1(a, b) {
     const result = a % b;
@@ -8257,7 +8280,7 @@ function invert$1(number, modulo) {
     let a = mod$1(number, modulo);
     let b = modulo;
     // prettier-ignore
-    let x = _0n$8, u = _1n$a;
+    let x = _0n$8, u = _1n$9;
     while (a !== _0n$8) {
         // JIT applies optimization if those two lines follow each other
         const q = b / a;
@@ -8267,20 +8290,22 @@ function invert$1(number, modulo) {
         b = a, a = r, x = u, u = m;
     }
     const gcd = b;
-    if (gcd !== _1n$a)
+    if (gcd !== _1n$9)
         throw new Error('invert: does not exist');
     return mod$1(x, modulo);
 }
+function assertIsSquare(Fp, root, n) {
+    if (!Fp.eql(Fp.sqr(root), n))
+        throw new Error('Cannot find square root');
+}
 // Not all roots are possible! Example which will throw:
 // const NUM =
 // n = 72057594037927816n;
 // Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));
 function sqrt3mod4(Fp, n) {
-    const p1div4 = (Fp.ORDER + _1n$a) / _4n$2;
+    const p1div4 = (Fp.ORDER + _1n$9) / _4n$2;
     const root = Fp.pow(n, p1div4);
-    // Throw if root^2 != n
-    if (!Fp.eql(Fp.sqr(root), n))
-        throw new Error('Cannot find square root');
+    assertIsSquare(Fp, root, n);
     return root;
 }
 function sqrt5mod8(Fp, n) {
@@ -8290,32 +8315,33 @@ function sqrt5mod8(Fp, n) {
     const nv = Fp.mul(n, v);
     const i = Fp.mul(Fp.mul(nv, _2n$7), v);
     const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));
-    if (!Fp.eql(Fp.sqr(root), n))
-        throw new Error('Cannot find square root');
+    assertIsSquare(Fp, root, n);
     return root;
 }
-// TODO: Commented-out for now. Provide test vectors.
-// Tonelli is too slow for extension fields Fp2.
-// That means we can't use sqrt (c1, c2...) even for initialization constants.
-// if (P % _16n === _9n) return sqrt9mod16;
-// // prettier-ignore
-// function sqrt9mod16<T>(Fp: IField<T>, n: T, p7div16?: bigint) {
-//   if (p7div16 === undefined) p7div16 = (Fp.ORDER + BigInt(7)) / _16n;
-//   const c1 = Fp.sqrt(Fp.neg(Fp.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F
-//   const c2 = Fp.sqrt(c1);             //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F
-//   const c3 = Fp.sqrt(Fp.neg(c1));     //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F
-//   const c4 = p7div16;                 //  4. c4 = (q + 7) / 16        # Integer arithmetic
-//   let tv1 = Fp.pow(n, c4);            //  1. tv1 = x^c4
-//   let tv2 = Fp.mul(c1, tv1);          //  2. tv2 = c1 * tv1
-//   const tv3 = Fp.mul(c2, tv1);        //  3. tv3 = c2 * tv1
-//   let tv4 = Fp.mul(c3, tv1);          //  4. tv4 = c3 * tv1
-//   const e1 = Fp.eql(Fp.sqr(tv2), n);  //  5.  e1 = (tv2^2) == x
-//   const e2 = Fp.eql(Fp.sqr(tv3), n);  //  6.  e2 = (tv3^2) == x
-//   tv1 = Fp.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x
-//   tv2 = Fp.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x
-//   const e3 = Fp.eql(Fp.sqr(tv2), n);  //  9.  e3 = (tv2^2) == x
-//   return Fp.cmov(tv1, tv2, e3); // 10.  z = CMOV(tv1, tv2, e3) # Select the sqrt from tv1 and tv2
-// }
+// Based on RFC9380, Kong algorithm
+// prettier-ignore
+function sqrt9mod16(P) {
+    const Fp_ = Field$1(P);
+    const tn = tonelliShanks$1(P);
+    const c1 = tn(Fp_, Fp_.neg(Fp_.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F
+    const c2 = tn(Fp_, c1); //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F
+    const c3 = tn(Fp_, Fp_.neg(c1)); //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F
+    const c4 = (P + _7n$2) / _16n; //  4. c4 = (q + 7) / 16        # Integer arithmetic
+    return (Fp, n) => {
+        let tv1 = Fp.pow(n, c4); //  1. tv1 = x^c4
+        let tv2 = Fp.mul(tv1, c1); //  2. tv2 = c1 * tv1
+        const tv3 = Fp.mul(tv1, c2); //  3. tv3 = c2 * tv1
+        const tv4 = Fp.mul(tv1, c3); //  4. tv4 = c3 * tv1
+        const e1 = Fp.eql(Fp.sqr(tv2), n); //  5.  e1 = (tv2^2) == x
+        const e2 = Fp.eql(Fp.sqr(tv3), n); //  6.  e2 = (tv3^2) == x
+        tv1 = Fp.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x
+        tv2 = Fp.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x
+        const e3 = Fp.eql(Fp.sqr(tv2), n); //  9.  e3 = (tv2^2) == x
+        const root = Fp.cmov(tv1, tv2, e3); // 10.  z = CMOV(tv1, tv2, e3)   # Select sqrt from tv1 & tv2
+        assertIsSquare(Fp, root, n);
+        return root;
+    };
+}
 /**
  * Tonelli-Shanks square root search algorithm.
  * 1. https://eprint.iacr.org/2012/685.pdf (page 12)
@@ -8326,10 +8352,10 @@ function sqrt5mod8(Fp, n) {
 function tonelliShanks$1(P) {
     // Initialization (precomputation).
     // Caching initialization could boost perf by 7%.
-    if (P < BigInt(3))
+    if (P < _3n$3)
         throw new Error('sqrt is not defined for small field');
     // Factor P - 1 = Q * 2^S, where Q is odd
-    let Q = P - _1n$a;
+    let Q = P - _1n$9;
     let S = 0;
     while (Q % _2n$7 === _0n$8) {
         Q /= _2n$7;
@@ -8350,7 +8376,7 @@ function tonelliShanks$1(P) {
     // Slow-path
     // TODO: test on Fp2 and others
     let cc = _Fp.pow(Z, Q); // c = z^Q
-    const Q1div2 = (Q + _1n$a) / _2n$7;
+    const Q1div2 = (Q + _1n$9) / _2n$7;
     return function tonelliSlow(Fp, n) {
         if (Fp.is0(n))
             return n;
@@ -8377,7 +8403,7 @@ function tonelliShanks$1(P) {
                     throw new Error('Cannot find square root');
             }
             // Calculate the exponent for b: 2^(M - i - 1)
-            const exponent = _1n$a << BigInt(M - i - 1); // bigint is important
+            const exponent = _1n$9 << BigInt(M - i - 1); // bigint is important
             const b = Fp.pow(c, exponent); // b = 2^(M - i - 1)
             // Update variables
             M = i;
@@ -8393,7 +8419,8 @@ function tonelliShanks$1(P) {
  *
  * 1. P ≡ 3 (mod 4)
  * 2. P ≡ 5 (mod 8)
- * 3. Tonelli-Shanks algorithm
+ * 3. P ≡ 9 (mod 16)
+ * 4. Tonelli-Shanks algorithm
  *
  * Different algorithms can give different roots, it is up to user to decide which one they want.
  * For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).
@@ -8405,7 +8432,9 @@ function FpSqrt$1(P) {
     // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf
     if (P % _8n$1 === _5n$1)
         return sqrt5mod8;
-    // P ≡ 9 (mod 16) not implemented, see above
+    // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4)
+    if (P % _16n === _9n)
+        return sqrt9mod16(P);
     // Tonelli-Shanks algorithm
     return tonelliShanks$1(P);
 }
@@ -8442,15 +8471,15 @@ function FpPow$1(Fp, num, power) {
         throw new Error('invalid exponent, negatives unsupported');
     if (power === _0n$8)
         return Fp.ONE;
-    if (power === _1n$a)
+    if (power === _1n$9)
         return num;
     let p = Fp.ONE;
     let d = num;
     while (power > _0n$8) {
-        if (power & _1n$a)
+        if (power & _1n$9)
             p = Fp.mul(p, d);
         d = Fp.sqr(d);
-        power >>= _1n$a;
+        power >>= _1n$9;
     }
     return p;
 }
@@ -8491,7 +8520,7 @@ function FpInvertBatch$1(Fp, nums, passZero = false) {
 function FpLegendre(Fp, n) {
     // We can use 3rd argument as optional cache of this value
     // but seems unneeded for now. The operation is very fast.
-    const p1mod2 = (Fp.ORDER - _1n$a) / _2n$7;
+    const p1mod2 = (Fp.ORDER - _1n$9) / _2n$7;
     const powered = Fp.pow(n, p1mod2);
     const yes = Fp.eql(powered, Fp.ONE);
     const zero = Fp.eql(powered, Fp.ZERO);
@@ -8528,11 +8557,14 @@ function nLength$1(n, nBitLength) {
  * @param isLE (default: false) if encoding / decoding should be in little-endian
  * @param redef optional faster redefinitions of sqrt and other methods
  */
-function Field$1(ORDER, bitLenOrOpts, isLE = false, opts = {}) {
+function Field$1(ORDER, bitLenOrOpts, // TODO: use opts only in v2?
+isLE = false, opts = {}) {
     if (ORDER <= _0n$8)
         throw new Error('invalid field: expected ORDER > 0, got ' + ORDER);
     let _nbitLength = undefined;
     let _sqrt = undefined;
+    let modFromBytes = false;
+    let allowedLengths = undefined;
     if (typeof bitLenOrOpts === 'object' && bitLenOrOpts != null) {
         if (opts.sqrt || isLE)
             throw new Error('cannot specify opts in two arguments');
@@ -8543,6 +8575,9 @@ function Field$1(ORDER, bitLenOrOpts, isLE = false, opts = {}) {
             _sqrt = _opts.sqrt;
         if (typeof _opts.isLE === 'boolean')
             isLE = _opts.isLE;
+        if (typeof _opts.modFromBytes === 'boolean')
+            modFromBytes = _opts.modFromBytes;
+        allowedLengths = _opts.allowedLengths;
     }
     else {
         if (typeof bitLenOrOpts === 'number')
@@ -8561,7 +8596,8 @@ function Field$1(ORDER, bitLenOrOpts, isLE = false, opts = {}) {
         BYTES,
         MASK: bitMask$1(BITS),
         ZERO: _0n$8,
-        ONE: _1n$a,
+        ONE: _1n$9,
+        allowedLengths: allowedLengths,
         create: (num) => mod$1(num, ORDER),
         isValid: (num) => {
             if (typeof num !== 'bigint')
@@ -8571,7 +8607,7 @@ function Field$1(ORDER, bitLenOrOpts, isLE = false, opts = {}) {
         is0: (num) => num === _0n$8,
         // is valid and invertible
         isValidNot0: (num) => !f.is0(num) && f.isValid(num),
-        isOdd: (num) => (num & _1n$a) === _1n$a,
+        isOdd: (num) => (num & _1n$9) === _1n$9,
         neg: (num) => mod$1(-num, ORDER),
         eql: (lhs, rhs) => lhs === rhs,
         sqr: (num) => mod$1(num * num, ORDER),
@@ -8593,10 +8629,27 @@ function Field$1(ORDER, bitLenOrOpts, isLE = false, opts = {}) {
                 return sqrtP(f, n);
             }),
         toBytes: (num) => (isLE ? numberToBytesLE$1(num, BYTES) : numberToBytesBE$1(num, BYTES)),
-        fromBytes: (bytes) => {
+        fromBytes: (bytes, skipValidation = true) => {
+            if (allowedLengths) {
+                if (!allowedLengths.includes(bytes.length) || bytes.length > BYTES) {
+                    throw new Error('Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length);
+                }
+                const padded = new Uint8Array(BYTES);
+                // isLE add 0 to right, !isLE to the left.
+                padded.set(bytes, isLE ? 0 : padded.length - bytes.length);
+                bytes = padded;
+            }
             if (bytes.length !== BYTES)
                 throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);
-            return isLE ? bytesToNumberLE$1(bytes) : bytesToNumberBE$1(bytes);
+            let scalar = isLE ? bytesToNumberLE$1(bytes) : bytesToNumberBE$1(bytes);
+            if (modFromBytes)
+                scalar = mod$1(scalar, ORDER);
+            if (!skipValidation)
+                if (!f.isValid(scalar))
+                    throw new Error('invalid field element: outside of range 0..ORDER');
+            // NOTE: we don't validate scalar here, please use isValid. This done such way because some
+            // protocol may allow non-reduced scalar that reduced later or changed some other way.
+            return scalar;
         },
         // TODO: we don't need it here, move out to separate fn
         invertBatch: (lst) => FpInvertBatch$1(f, lst),
@@ -8651,16 +8704,16 @@ function mapHashToField$1(key, fieldOrder, isLE = false) {
         throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);
     const num = isLE ? bytesToNumberLE$1(key) : bytesToNumberBE$1(key);
     // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0
-    const reduced = mod$1(num, fieldOrder - _1n$a) + _1n$a;
+    const reduced = mod$1(num, fieldOrder - _1n$9) + _1n$9;
     return isLE ? numberToBytesLE$1(reduced, fieldLen) : numberToBytesBE$1(reduced, fieldLen);
 }/**
  * Methods for elliptic curve multiplication by scalars.
- * Contains wNAF, pippenger
+ * Contains wNAF, pippenger.
  * @module
  */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 const _0n$7 = BigInt(0);
-const _1n$9 = BigInt(1);
+const _1n$8 = BigInt(1);
 function negateCt(condition, item) {
     const neg = item.negate();
     return condition ? neg : item;
@@ -8671,12 +8724,9 @@ function negateCt(condition, item) {
  * so this improves performance massively.
  * Optimization: converts a list of projective points to a list of identical points with Z=1.
  */
-function normalizeZ(c, property, points) {
-    const getz = (p) => p.pz ;
-    const toInv = FpInvertBatch$1(c.Fp, points.map(getz));
-    // @ts-ignore
-    const affined = points.map((p, i) => p.toAffine(toInv[i]));
-    return affined.map(c.fromAffine);
+function normalizeZ(c, points) {
+    const invertedZs = FpInvertBatch$1(c.Fp, points.map((p) => p.Z));
+    return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));
 }
 function validateW(W, bits) {
     if (!Number.isSafeInteger(W) || W <= 0 || W > bits)
@@ -8703,7 +8753,7 @@ function calcOffsets(n, window, wOpts) {
     if (wbits > windowSize) {
         // we skip zero, which means instead of `>= size-1`, we do `> size`
         wbits -= maxNumber; // -32, can be maxNumber - wbits, but then we need to set isNeg here.
-        nextN += _1n$9; // +256 (carry)
+        nextN += _1n$8; // +256 (carry)
     }
     const offsetStart = window * windowSize;
     const offset = offsetStart + Math.abs(wbits) - 1; // -1 because we skip zero
@@ -8735,6 +8785,8 @@ function validateMSMScalars(scalars, field) {
 const pointPrecomputes = new WeakMap();
 const pointWindowSizes = new WeakMap();
 function getW(P) {
+    // To disable precomputes:
+    // return 1;
     return pointWindowSizes.get(P) || 1;
 }
 function assert0(n) {
@@ -8743,6 +8795,10 @@ function assert0(n) {
 }
 /**
  * Elliptic curve multiplication of Point by scalar. Fragile.
+ * Table generation takes **30MB of ram and 10ms on high-end CPU**,
+ * but may take much longer on slow devices. Actual generation will happen on
+ * first call of `multiply()`. By default, `BASE` point is precomputed.
+ *
  * Scalars should always be less than curve order: this should be checked inside of a curve itself.
  * Creates precomputation tables for fast multiplication:
  * - private scalar is split by fixed size windows of W bits
@@ -8755,172 +8811,170 @@ function assert0(n) {
  * @todo Research returning 2d JS array of windows, instead of a single window.
  * This would allow windows to be in different memory locations
  */
-function wNAF$1(c, bits) {
-    return {
-        constTimeNegate: negateCt,
-        hasPrecomputes(elm) {
-            return getW(elm) !== 1;
-        },
-        // non-const time multiplication ladder
-        unsafeLadder(elm, n, p = c.ZERO) {
-            let d = elm;
-            while (n > _0n$7) {
-                if (n & _1n$9)
-                    p = p.add(d);
-                d = d.double();
-                n >>= _1n$9;
-            }
-            return p;
-        },
-        /**
-         * Creates a wNAF precomputation window. Used for caching.
-         * Default window size is set by `utils.precompute()` and is equal to 8.
-         * Number of precomputed points depends on the curve size:
-         * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
-         * - 𝑊 is the window size
-         * - 𝑛 is the bitlength of the curve order.
-         * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
-         * @param elm Point instance
-         * @param W window size
-         * @returns precomputed point tables flattened to a single array
-         */
-        precomputeWindow(elm, W) {
-            const { windows, windowSize } = calcWOpts(W, bits);
-            const points = [];
-            let p = elm;
-            let base = p;
-            for (let window = 0; window < windows; window++) {
-                base = p;
+let wNAF$1=class wNAF {
+    // Parametrized with a given Point class (not individual point)
+    constructor(Point, bits) {
+        this.BASE = Point.BASE;
+        this.ZERO = Point.ZERO;
+        this.Fn = Point.Fn;
+        this.bits = bits;
+    }
+    // non-const time multiplication ladder
+    _unsafeLadder(elm, n, p = this.ZERO) {
+        let d = elm;
+        while (n > _0n$7) {
+            if (n & _1n$8)
+                p = p.add(d);
+            d = d.double();
+            n >>= _1n$8;
+        }
+        return p;
+    }
+    /**
+     * Creates a wNAF precomputation window. Used for caching.
+     * Default window size is set by `utils.precompute()` and is equal to 8.
+     * Number of precomputed points depends on the curve size:
+     * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+     * - 𝑊 is the window size
+     * - 𝑛 is the bitlength of the curve order.
+     * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+     * @param point Point instance
+     * @param W window size
+     * @returns precomputed point tables flattened to a single array
+     */
+    precomputeWindow(point, W) {
+        const { windows, windowSize } = calcWOpts(W, this.bits);
+        const points = [];
+        let p = point;
+        let base = p;
+        for (let window = 0; window < windows; window++) {
+            base = p;
+            points.push(base);
+            // i=1, bc we skip 0
+            for (let i = 1; i < windowSize; i++) {
+                base = base.add(p);
                 points.push(base);
-                // i=1, bc we skip 0
-                for (let i = 1; i < windowSize; i++) {
-                    base = base.add(p);
-                    points.push(base);
-                }
-                p = base.double();
             }
-            return points;
-        },
-        /**
-         * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
-         * @param W window size
-         * @param precomputes precomputed tables
-         * @param n scalar (we don't check here, but should be less than curve order)
-         * @returns real and fake (for const-time) points
-         */
-        wNAF(W, precomputes, n) {
-            // Smaller version:
-            // https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
-            // TODO: check the scalar is less than group order?
-            // wNAF behavior is undefined otherwise. But have to carefully remove
-            // other checks before wNAF. ORDER == bits here.
-            // Accumulators
-            let p = c.ZERO;
-            let f = c.BASE;
-            // This code was first written with assumption that 'f' and 'p' will never be infinity point:
-            // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,
-            // there is negate now: it is possible that negated element from low value
-            // would be the same as high element, which will create carry into next window.
-            // It's not obvious how this can fail, but still worth investigating later.
-            const wo = calcWOpts(W, bits);
-            for (let window = 0; window < wo.windows; window++) {
-                // (n === _0n) is handled and not early-exited. isEven and offsetF are used for noise
-                const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);
-                n = nextN;
-                if (isZero) {
-                    // bits are 0: add garbage to fake point
-                    // Important part for const-time getPublicKey: add random "noise" point to f.
-                    f = f.add(negateCt(isNegF, precomputes[offsetF]));
-                }
-                else {
-                    // bits are 1: add to result point
-                    p = p.add(negateCt(isNeg, precomputes[offset]));
-                }
+            p = base.double();
+        }
+        return points;
+    }
+    /**
+     * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+     * More compact implementation:
+     * https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
+     * @returns real and fake (for const-time) points
+     */
+    wNAF(W, precomputes, n) {
+        // Scalar should be smaller than field order
+        if (!this.Fn.isValid(n))
+            throw new Error('invalid scalar');
+        // Accumulators
+        let p = this.ZERO;
+        let f = this.BASE;
+        // This code was first written with assumption that 'f' and 'p' will never be infinity point:
+        // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,
+        // there is negate now: it is possible that negated element from low value
+        // would be the same as high element, which will create carry into next window.
+        // It's not obvious how this can fail, but still worth investigating later.
+        const wo = calcWOpts(W, this.bits);
+        for (let window = 0; window < wo.windows; window++) {
+            // (n === _0n) is handled and not early-exited. isEven and offsetF are used for noise
+            const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);
+            n = nextN;
+            if (isZero) {
+                // bits are 0: add garbage to fake point
+                // Important part for const-time getPublicKey: add random "noise" point to f.
+                f = f.add(negateCt(isNegF, precomputes[offsetF]));
             }
-            assert0(n);
-            // Return both real and fake points: JIT won't eliminate f.
-            // At this point there is a way to F be infinity-point even if p is not,
-            // which makes it less const-time: around 1 bigint multiply.
-            return { p, f };
-        },
-        /**
-         * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.
-         * @param W window size
-         * @param precomputes precomputed tables
-         * @param n scalar (we don't check here, but should be less than curve order)
-         * @param acc accumulator point to add result of multiplication
-         * @returns point
-         */
-        wNAFUnsafe(W, precomputes, n, acc = c.ZERO) {
-            const wo = calcWOpts(W, bits);
-            for (let window = 0; window < wo.windows; window++) {
-                if (n === _0n$7)
-                    break; // Early-exit, skip 0 value
-                const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);
-                n = nextN;
-                if (isZero) {
-                    // Window bits are 0: skip processing.
-                    // Move to next window.
-                    continue;
-                }
-                else {
-                    const item = precomputes[offset];
-                    acc = acc.add(isNeg ? item.negate() : item); // Re-using acc allows to save adds in MSM
-                }
+            else {
+                // bits are 1: add to result point
+                p = p.add(negateCt(isNeg, precomputes[offset]));
             }
-            assert0(n);
-            return acc;
-        },
-        getPrecomputes(W, P, transform) {
-            // Calculate precomputes on a first run, reuse them after
-            let comp = pointPrecomputes.get(P);
-            if (!comp) {
-                comp = this.precomputeWindow(P, W);
-                if (W !== 1) {
-                    // Doing transform outside of if brings 15% perf hit
-                    if (typeof transform === 'function')
-                        comp = transform(comp);
-                    pointPrecomputes.set(P, comp);
-                }
+        }
+        assert0(n);
+        // Return both real and fake points: JIT won't eliminate f.
+        // At this point there is a way to F be infinity-point even if p is not,
+        // which makes it less const-time: around 1 bigint multiply.
+        return { p, f };
+    }
+    /**
+     * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.
+     * @param acc accumulator point to add result of multiplication
+     * @returns point
+     */
+    wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {
+        const wo = calcWOpts(W, this.bits);
+        for (let window = 0; window < wo.windows; window++) {
+            if (n === _0n$7)
+                break; // Early-exit, skip 0 value
+            const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);
+            n = nextN;
+            if (isZero) {
+                // Window bits are 0: skip processing.
+                // Move to next window.
+                continue;
             }
-            return comp;
-        },
-        wNAFCached(P, n, transform) {
-            const W = getW(P);
-            return this.wNAF(W, this.getPrecomputes(W, P, transform), n);
-        },
-        wNAFCachedUnsafe(P, n, transform, prev) {
-            const W = getW(P);
-            if (W === 1)
-                return this.unsafeLadder(P, n, prev); // For W=1 ladder is ~x2 faster
-            return this.wNAFUnsafe(W, this.getPrecomputes(W, P, transform), n, prev);
-        },
-        // We calculate precomputes for elliptic curve point multiplication
-        // using windowed method. This specifies window size and
-        // stores precomputed values. Usually only base point would be precomputed.
-        setWindowSize(P, W) {
-            validateW(W, bits);
-            pointWindowSizes.set(P, W);
-            pointPrecomputes.delete(P);
-        },
-    };
-}
+            else {
+                const item = precomputes[offset];
+                acc = acc.add(isNeg ? item.negate() : item); // Re-using acc allows to save adds in MSM
+            }
+        }
+        assert0(n);
+        return acc;
+    }
+    getPrecomputes(W, point, transform) {
+        // Calculate precomputes on a first run, reuse them after
+        let comp = pointPrecomputes.get(point);
+        if (!comp) {
+            comp = this.precomputeWindow(point, W);
+            if (W !== 1) {
+                // Doing transform outside of if brings 15% perf hit
+                if (typeof transform === 'function')
+                    comp = transform(comp);
+                pointPrecomputes.set(point, comp);
+            }
+        }
+        return comp;
+    }
+    cached(point, scalar, transform) {
+        const W = getW(point);
+        return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);
+    }
+    unsafe(point, scalar, transform, prev) {
+        const W = getW(point);
+        if (W === 1)
+            return this._unsafeLadder(point, scalar, prev); // For W=1 ladder is ~x2 faster
+        return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);
+    }
+    // We calculate precomputes for elliptic curve point multiplication
+    // using windowed method. This specifies window size and
+    // stores precomputed values. Usually only base point would be precomputed.
+    createCache(P, W) {
+        validateW(W, this.bits);
+        pointWindowSizes.set(P, W);
+        pointPrecomputes.delete(P);
+    }
+    hasCache(elm) {
+        return getW(elm) !== 1;
+    }
+};
 /**
  * Endomorphism-specific multiplication for Koblitz curves.
  * Cost: 128 dbl, 0-256 adds.
  */
-function mulEndoUnsafe(c, point, k1, k2) {
+function mulEndoUnsafe(Point, point, k1, k2) {
     let acc = point;
-    let p1 = c.ZERO;
-    let p2 = c.ZERO;
+    let p1 = Point.ZERO;
+    let p2 = Point.ZERO;
     while (k1 > _0n$7 || k2 > _0n$7) {
-        if (k1 & _1n$9)
+        if (k1 & _1n$8)
             p1 = p1.add(acc);
-        if (k2 & _1n$9)
+        if (k2 & _1n$8)
             p2 = p2.add(acc);
         acc = acc.double();
-        k1 >>= _1n$9;
-        k2 >>= _1n$9;
+        k1 >>= _1n$8;
+        k2 >>= _1n$8;
     }
     return { p1, p2 };
 }
@@ -8932,7 +8986,7 @@ function mulEndoUnsafe(c, point, k1, k2) {
  * @param c Curve Point constructor
  * @param fieldN field over CURVE.N - important that it's not over CURVE.P
  * @param points array of L curve points
- * @param scalars array of L scalars (aka private keys / bigints)
+ * @param scalars array of L scalars (aka secret keys / bigints)
  */
 function pippenger(c, fieldN, points, scalars) {
     // If we split scalars by some window (let's say 8 bits), every chunk will only
@@ -8981,7 +9035,7 @@ function pippenger(c, fieldN, points, scalars) {
     }
     return sum;
 }
-function createField(order, field) {
+function createField(order, field, isLE) {
     if (field) {
         if (field.ORDER !== order)
             throw new Error('Field.ORDER must match order: Fp == p, Fn == n');
@@ -8989,11 +9043,13 @@ function createField(order, field) {
         return field;
     }
     else {
-        return Field$1(order);
+        return Field$1(order, { isLE });
     }
 }
 /** Validates CURVE opts and creates fields */
-function _createCurveFields(type, CURVE, curveOpts = {}) {
+function _createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
+    if (FpFnLE === undefined)
+        FpFnLE = type === 'edwards';
     if (!CURVE || typeof CURVE !== 'object')
         throw new Error(`expected valid ${type} CURVE object`);
     for (const p of ['p', 'n', 'h']) {
@@ -9001,8 +9057,8 @@ function _createCurveFields(type, CURVE, curveOpts = {}) {
         if (!(typeof val === 'bigint' && val > _0n$7))
             throw new Error(`CURVE.${p} must be positive bigint`);
     }
-    const Fp = createField(CURVE.p, curveOpts.Fp);
-    const Fn = createField(CURVE.n, curveOpts.Fn);
+    const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);
+    const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);
     const _b = 'b' ;
     const params = ['Gx', 'Gy', 'a', _b];
     for (const p of params) {
@@ -9010,7 +9066,8 @@ function _createCurveFields(type, CURVE, curveOpts = {}) {
         if (!Fp.isValid(CURVE[p]))
             throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
     }
-    return { Fp, Fn };
+    CURVE = Object.freeze(Object.assign({}, CURVE));
+    return { CURVE, Fp, Fn };
 }/**
  * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.
  *
@@ -9038,11 +9095,52 @@ function _createCurveFields(type, CURVE, curveOpts = {}) {
  * @module
  */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-function validateSigVerOpts(opts) {
-    if (opts.lowS !== undefined)
-        abool('lowS', opts.lowS);
-    if (opts.prehash !== undefined)
-        abool('prehash', opts.prehash);
+// We construct basis in such way that den is always positive and equals n, but num sign depends on basis (not on secret value)
+const divNearest$1 = (num, den) => (num + (num >= 0 ? den : -den) / _2n$6) / den;
+/**
+ * Splits scalar for GLV endomorphism.
+ */
+function _splitEndoScalar(k, basis, n) {
+    // Split scalar into two such that part is ~half bits: `abs(part) < sqrt(N)`
+    // Since part can be negative, we need to do this on point.
+    // TODO: verifyScalar function which consumes lambda
+    const [[a1, b1], [a2, b2]] = basis;
+    const c1 = divNearest$1(b2 * k, n);
+    const c2 = divNearest$1(-b1 * k, n);
+    // |k1|/|k2| is < sqrt(N), but can be negative.
+    // If we do `k1 mod N`, we'll get big scalar (`> sqrt(N)`): so, we do cheaper negation instead.
+    let k1 = k - c1 * a1 - c2 * a2;
+    let k2 = -c1 * b1 - c2 * b2;
+    const k1neg = k1 < _0n$6;
+    const k2neg = k2 < _0n$6;
+    if (k1neg)
+        k1 = -k1;
+    if (k2neg)
+        k2 = -k2;
+    // Double check that resulting scalar less than half bits of N: otherwise wNAF will fail.
+    // This should only happen on wrong basises. Also, math inside is too complex and I don't trust it.
+    const MAX_NUM = bitMask$1(Math.ceil(bitLen$1(n) / 2)) + _1n$7; // Half bits of N
+    if (k1 < _0n$6 || k1 >= MAX_NUM || k2 < _0n$6 || k2 >= MAX_NUM) {
+        throw new Error('splitScalar (endomorphism): failed, k=' + k);
+    }
+    return { k1neg, k1, k2neg, k2 };
+}
+function validateSigFormat(format) {
+    if (!['compact', 'recovered', 'der'].includes(format))
+        throw new Error('Signature format must be "compact", "recovered", or "der"');
+    return format;
+}
+function validateSigOpts(opts, def) {
+    const optsn = {};
+    for (let optName of Object.keys(def)) {
+        // @ts-ignore
+        optsn[optName] = opts[optName] === undefined ? def[optName] : opts[optName];
+    }
+    _abool2(optsn.lowS, 'lowS');
+    _abool2(optsn.prehash, 'prehash');
+    if (optsn.format !== undefined)
+        validateSigFormat(optsn.format);
+    return optsn;
 }
 class DERErr extends Error {
     constructor(m = '') {
@@ -9162,56 +9260,49 @@ const DER$1 = {
 };
 // Be friendly to bad ECMAScript parsers by not using bigint literals
 // prettier-ignore
-const _0n$6 = BigInt(0), _1n$8 = BigInt(1), _2n$6 = BigInt(2), _3n$2 = BigInt(3), _4n$1 = BigInt(4);
-// TODO: remove
-function _legacyHelperEquat(Fp, a, b) {
-    /**
-     * y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².
-     * @returns y²
-     */
-    function weierstrassEquation(x) {
-        const x2 = Fp.sqr(x); // x * x
-        const x3 = Fp.mul(x2, x); // x² * x
-        return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x³ + a * x + b
-    }
-    return weierstrassEquation;
-}
-function _legacyHelperNormPriv(Fn, allowedPrivateKeyLengths, wrapPrivateKey) {
+const _0n$6 = BigInt(0), _1n$7 = BigInt(1), _2n$6 = BigInt(2), _3n$2 = BigInt(3), _4n$1 = BigInt(4);
+function _normFnElement(Fn, key) {
     const { BYTES: expected } = Fn;
-    // Validates if priv key is valid and converts it to bigint.
-    function normPrivateKeyToScalar(key) {
-        let num;
-        if (typeof key === 'bigint') {
-            num = key;
+    let num;
+    if (typeof key === 'bigint') {
+        num = key;
+    }
+    else {
+        let bytes = ensureBytes$1('private key', key);
+        try {
+            num = Fn.fromBytes(bytes);
         }
-        else {
-            let bytes = ensureBytes$1('private key', key);
-            if (allowedPrivateKeyLengths) {
-                if (!allowedPrivateKeyLengths.includes(bytes.length * 2))
-                    throw new Error('invalid private key');
-                const padded = new Uint8Array(expected);
-                padded.set(bytes, padded.length - bytes.length);
-                bytes = padded;
-            }
-            try {
-                num = Fn.fromBytes(bytes);
-            }
-            catch (error) {
-                throw new Error(`invalid private key: expected ui8a of size ${expected}, got ${typeof key}`);
-            }
+        catch (error) {
+            throw new Error(`invalid private key: expected ui8a of size ${expected}, got ${typeof key}`);
         }
-        if (wrapPrivateKey)
-            num = Fn.create(num); // disabled by default, enabled for BLS
-        if (!Fn.isValidNot0(num))
-            throw new Error('invalid private key: out of range [1..N-1]');
-        return num;
     }
-    return normPrivateKeyToScalar;
+    if (!Fn.isValidNot0(num))
+        throw new Error('invalid private key: out of range [1..N-1]');
+    return num;
 }
-function weierstrassN(CURVE, curveOpts = {}) {
-    const { Fp, Fn } = _createCurveFields('weierstrass', CURVE, curveOpts);
+/**
+ * Creates weierstrass Point constructor, based on specified curve options.
+ *
+ * @example
+```js
+const opts = {
+  p: BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'),
+  n: BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),
+  h: BigInt(1),
+  a: BigInt('0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc'),
+  b: BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b'),
+  Gx: BigInt('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),
+  Gy: BigInt('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),
+};
+const p256_Point = weierstrass(opts);
+```
+ */
+function weierstrassN(params, extraOpts = {}) {
+    const validated = _createCurveFields('weierstrass', params, extraOpts);
+    const { Fp, Fn } = validated;
+    let CURVE = validated.CURVE;
     const { h: cofactor, n: CURVE_ORDER } = CURVE;
-    _validateObject(curveOpts, {}, {
+    _validateObject(extraOpts, {}, {
         allowInfinityPoint: 'boolean',
         clearCofactor: 'function',
         isTorsionFree: 'function',
@@ -9220,15 +9311,14 @@ function weierstrassN(CURVE, curveOpts = {}) {
         endo: 'object',
         wrapPrivateKey: 'boolean',
     });
-    const { endo } = curveOpts;
+    const { endo } = extraOpts;
     if (endo) {
         // validateObject(endo, { beta: 'bigint', splitScalar: 'function' });
-        if (!Fp.is0(CURVE.a) ||
-            typeof endo.beta !== 'bigint' ||
-            typeof endo.splitScalar !== 'function') {
-            throw new Error('invalid endo: expected "beta": bigint and "splitScalar": function');
+        if (!Fp.is0(CURVE.a) || typeof endo.beta !== 'bigint' || !Array.isArray(endo.basises)) {
+            throw new Error('invalid endo: expected "beta": bigint and "basises": array');
         }
     }
+    const lengths = getWLengths(Fp, Fn);
     function assertCompressionIsSupported() {
         if (!Fp.isOdd)
             throw new Error('compression is not supported: Field does not have .isOdd()');
@@ -9237,7 +9327,7 @@ function weierstrassN(CURVE, curveOpts = {}) {
     function pointToBytes(_c, point, isCompressed) {
         const { x, y } = point.toAffine();
         const bx = Fp.toBytes(x);
-        abool('isCompressed', isCompressed);
+        _abool2(isCompressed, 'isCompressed');
         if (isCompressed) {
             assertCompressionIsSupported();
             const hasEvenY = !Fp.isOdd(y);
@@ -9248,15 +9338,13 @@ function weierstrassN(CURVE, curveOpts = {}) {
         }
     }
     function pointFromBytes(bytes) {
-        abytes(bytes);
-        const L = Fp.BYTES;
-        const LC = L + 1; // length compressed, e.g. 33 for 32-byte field
-        const LU = 2 * L + 1; // length uncompressed, e.g. 65 for 32-byte field
+        _abytes2(bytes, undefined, 'Point');
+        const { public: comp, publicUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65
         const length = bytes.length;
         const head = bytes[0];
         const tail = bytes.subarray(1);
         // No actual validation is done here: use .assertValidity()
-        if (length === LC && (head === 0x02 || head === 0x03)) {
+        if (length === comp && (head === 0x02 || head === 0x03)) {
             const x = Fp.fromBytes(tail);
             if (!Fp.isValid(x))
                 throw new Error('bad point: is not on curve, wrong x');
@@ -9276,21 +9364,26 @@ function weierstrassN(CURVE, curveOpts = {}) {
                 y = Fp.neg(y);
             return { x, y };
         }
-        else if (length === LU && head === 0x04) {
+        else if (length === uncomp && head === 0x04) {
             // TODO: more checks
-            const x = Fp.fromBytes(tail.subarray(L * 0, L * 1));
-            const y = Fp.fromBytes(tail.subarray(L * 1, L * 2));
+            const L = Fp.BYTES;
+            const x = Fp.fromBytes(tail.subarray(0, L));
+            const y = Fp.fromBytes(tail.subarray(L, L * 2));
             if (!isValidXY(x, y))
                 throw new Error('bad point: is not on curve');
             return { x, y };
         }
         else {
-            throw new Error(`bad point: got length ${length}, expected compressed=${LC} or uncompressed=${LU}`);
+            throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);
         }
     }
-    const toBytes = curveOpts.toBytes || pointToBytes;
-    const fromBytes = curveOpts.fromBytes || pointFromBytes;
-    const weierstrassEquation = _legacyHelperEquat(Fp, CURVE.a, CURVE.b);
+    const encodePoint = extraOpts.toBytes || pointToBytes;
+    const decodePoint = extraOpts.fromBytes || pointFromBytes;
+    function weierstrassEquation(x) {
+        const x2 = Fp.sqr(x); // x * x
+        const x3 = Fp.mul(x2, x); // x² * x
+        return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b); // x³ + a * x + b
+    }
     // TODO: move top-level
     /** Checks whether equation holds for given x, y: y² == x³ + ax + b */
     function isValidXY(x, y) {
@@ -9318,28 +9411,33 @@ function weierstrassN(CURVE, curveOpts = {}) {
         if (!(other instanceof Point))
             throw new Error('ProjectivePoint expected');
     }
+    function splitEndoScalarN(k) {
+        if (!endo || !endo.basises)
+            throw new Error('no endo');
+        return _splitEndoScalar(k, endo.basises, Fn.ORDER);
+    }
     // Memoized toAffine / validity check. They are heavy. Points are immutable.
     // Converts Projective point to affine (x, y) coordinates.
     // Can accept precomputed Z^-1 - for example, from invertBatch.
     // (X, Y, Z) ∋ (x=X/Z, y=Y/Z)
     const toAffineMemo = memoized((p, iz) => {
-        const { px: x, py: y, pz: z } = p;
+        const { X, Y, Z } = p;
         // Fast-path for normalized points
-        if (Fp.eql(z, Fp.ONE))
-            return { x, y };
+        if (Fp.eql(Z, Fp.ONE))
+            return { x: X, y: Y };
         const is0 = p.is0();
         // If invZ was 0, we return zero point. However we still want to execute
         // all operations, so we replace invZ with a random number, 1.
         if (iz == null)
-            iz = is0 ? Fp.ONE : Fp.inv(z);
-        const ax = Fp.mul(x, iz);
-        const ay = Fp.mul(y, iz);
-        const zz = Fp.mul(z, iz);
+            iz = is0 ? Fp.ONE : Fp.inv(Z);
+        const x = Fp.mul(X, iz);
+        const y = Fp.mul(Y, iz);
+        const zz = Fp.mul(Z, iz);
         if (is0)
             return { x: Fp.ZERO, y: Fp.ZERO };
         if (!Fp.eql(zz, Fp.ONE))
             throw new Error('invZ was invalid');
-        return { x: ax, y: ay };
+        return { x, y };
     });
     // NOTE: on exception this will crash 'cached' and no value will be set.
     // Otherwise true will be return
@@ -9348,7 +9446,7 @@ function weierstrassN(CURVE, curveOpts = {}) {
             // (0, 1, 0) aka ZERO is invalid in most contexts.
             // In BLS, ZERO can be serialized, so we allow it.
             // (0, 0, 0) is invalid representation of ZERO.
-            if (curveOpts.allowInfinityPoint && !Fp.is0(p.py))
+            if (extraOpts.allowInfinityPoint && !Fp.is0(p.Y))
                 return;
             throw new Error('bad point: ZERO');
         }
@@ -9363,7 +9461,7 @@ function weierstrassN(CURVE, curveOpts = {}) {
         return true;
     });
     function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {
-        k2p = new Point(Fp.mul(k2p.px, endoBeta), k2p.py, k2p.pz);
+        k2p = new Point(Fp.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);
         k1p = negateCt(k1neg, k1p);
         k2p = negateCt(k2neg, k2p);
         return k1p.add(k2p);
@@ -9375,12 +9473,15 @@ function weierstrassN(CURVE, curveOpts = {}) {
      */
     class Point {
         /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
-        constructor(px, py, pz) {
-            this.px = acoord('x', px);
-            this.py = acoord('y', py, true);
-            this.pz = acoord('z', pz);
+        constructor(X, Y, Z) {
+            this.X = acoord('x', X);
+            this.Y = acoord('y', Y, true);
+            this.Z = acoord('z', Z);
             Object.freeze(this);
         }
+        static CURVE() {
+            return CURVE;
+        }
         /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
         static fromAffine(p) {
             const { x, y } = p || {};
@@ -9393,33 +9494,19 @@ function weierstrassN(CURVE, curveOpts = {}) {
                 return Point.ZERO;
             return new Point(x, y, Fp.ONE);
         }
-        get x() {
-            return this.toAffine().x;
-        }
-        get y() {
-            return this.toAffine().y;
-        }
-        static normalizeZ(points) {
-            return normalizeZ(Point, 'pz', points);
-        }
         static fromBytes(bytes) {
-            abytes(bytes);
-            return Point.fromHex(bytes);
-        }
-        /** Converts hash string or Uint8Array to Point. */
-        static fromHex(hex) {
-            const P = Point.fromAffine(fromBytes(ensureBytes$1('pointHex', hex)));
+            const P = Point.fromAffine(decodePoint(_abytes2(bytes, undefined, 'point')));
             P.assertValidity();
             return P;
         }
-        /** Multiplies generator point by privateKey. */
-        static fromPrivateKey(privateKey) {
-            const normPrivateKeyToScalar = _legacyHelperNormPriv(Fn, curveOpts.allowedPrivateKeyLengths, curveOpts.wrapPrivateKey);
-            return Point.BASE.multiply(normPrivateKeyToScalar(privateKey));
+        static fromHex(hex) {
+            return Point.fromBytes(ensureBytes$1('pointHex', hex));
         }
-        /** Multiscalar Multiplication */
-        static msm(points, scalars) {
-            return pippenger(Point, Fn, points, scalars);
+        get x() {
+            return this.toAffine().x;
+        }
+        get y() {
+            return this.toAffine().y;
         }
         /**
          *
@@ -9428,15 +9515,11 @@ function weierstrassN(CURVE, curveOpts = {}) {
          * @returns
          */
         precompute(windowSize = 8, isLazy = true) {
-            wnaf.setWindowSize(this, windowSize);
+            wnaf.createCache(this, windowSize);
             if (!isLazy)
                 this.multiply(_3n$2); // random number
             return this;
         }
-        /** "Private method", don't use it directly */
-        _setWindowSize(windowSize) {
-            this.precompute(windowSize);
-        }
         // TODO: return `this`
         /** A point on curve is valid if it conforms to equation. */
         assertValidity() {
@@ -9451,15 +9534,15 @@ function weierstrassN(CURVE, curveOpts = {}) {
         /** Compare one point to another. */
         equals(other) {
             aprjpoint(other);
-            const { px: X1, py: Y1, pz: Z1 } = this;
-            const { px: X2, py: Y2, pz: Z2 } = other;
+            const { X: X1, Y: Y1, Z: Z1 } = this;
+            const { X: X2, Y: Y2, Z: Z2 } = other;
             const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));
             const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));
             return U1 && U2;
         }
         /** Flips point to one corresponding to (x, -y) in Affine coordinates. */
         negate() {
-            return new Point(this.px, Fp.neg(this.py), this.pz);
+            return new Point(this.X, Fp.neg(this.Y), this.Z);
         }
         // Renes-Costello-Batina exception-free doubling formula.
         // There is 30% faster Jacobian formula, but it is not complete.
@@ -9468,7 +9551,7 @@ function weierstrassN(CURVE, curveOpts = {}) {
         double() {
             const { a, b } = CURVE;
             const b3 = Fp.mul(b, _3n$2);
-            const { px: X1, py: Y1, pz: Z1 } = this;
+            const { X: X1, Y: Y1, Z: Z1 } = this;
             let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore
             let t0 = Fp.mul(X1, X1); // step 1
             let t1 = Fp.mul(Y1, Y1);
@@ -9509,8 +9592,8 @@ function weierstrassN(CURVE, curveOpts = {}) {
         // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
         add(other) {
             aprjpoint(other);
-            const { px: X1, py: Y1, pz: Z1 } = this;
-            const { px: X2, py: Y2, pz: Z2 } = other;
+            const { X: X1, Y: Y1, Z: Z1 } = this;
+            const { X: X2, Y: Y2, Z: Z2 } = other;
             let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore
             const a = CURVE.a;
             const b3 = Fp.mul(CURVE.b, _3n$2);
@@ -9572,14 +9655,14 @@ function weierstrassN(CURVE, curveOpts = {}) {
          * @returns New point
          */
         multiply(scalar) {
-            const { endo } = curveOpts;
+            const { endo } = extraOpts;
             if (!Fn.isValidNot0(scalar))
                 throw new Error('invalid scalar: out of range'); // 0 is invalid
             let point, fake; // Fake point is used to const-time mult
-            const mul = (n) => wnaf.wNAFCached(this, n, Point.normalizeZ);
+            const mul = (n) => wnaf.cached(this, n, (p) => normalizeZ(Point, p));
             /** See docs for {@link EndomorphismOpts} */
             if (endo) {
-                const { k1neg, k1, k2neg, k2 } = endo.splitScalar(scalar);
+                const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(scalar);
                 const { p: k1p, f: k1f } = mul(k1);
                 const { p: k2p, f: k2f } = mul(k2);
                 fake = k1f.add(k2f);
@@ -9591,32 +9674,31 @@ function weierstrassN(CURVE, curveOpts = {}) {
                 fake = f;
             }
             // Normalize `z` for both points, but return only real one
-            return Point.normalizeZ([point, fake])[0];
+            return normalizeZ(Point, [point, fake])[0];
         }
         /**
          * Non-constant-time multiplication. Uses double-and-add algorithm.
          * It's faster, but should only be used when you don't care about
-         * an exposed private key e.g. sig verification, which works over *public* keys.
+         * an exposed secret key e.g. sig verification, which works over *public* keys.
          */
         multiplyUnsafe(sc) {
-            const { endo } = curveOpts;
+            const { endo } = extraOpts;
             const p = this;
             if (!Fn.isValid(sc))
                 throw new Error('invalid scalar: out of range'); // 0 is valid
             if (sc === _0n$6 || p.is0())
                 return Point.ZERO;
-            if (sc === _1n$8)
+            if (sc === _1n$7)
                 return p; // fast-path
-            if (wnaf.hasPrecomputes(this))
+            if (wnaf.hasCache(this))
                 return this.multiply(sc);
             if (endo) {
-                const { k1neg, k1, k2neg, k2 } = endo.splitScalar(sc);
-                // `wNAFCachedUnsafe` is 30% slower
-                const { p1, p2 } = mulEndoUnsafe(Point, p, k1, k2);
+                const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(sc);
+                const { p1, p2 } = mulEndoUnsafe(Point, p, k1, k2); // 30% faster vs wnaf.unsafe
                 return finishEndo(endo.beta, p1, p2, k1neg, k2neg);
             }
             else {
-                return wnaf.wNAFCachedUnsafe(p, sc);
+                return wnaf.unsafe(p, sc);
             }
         }
         multiplyAndAddUnsafe(Q, a, b) {
@@ -9635,29 +9717,29 @@ function weierstrassN(CURVE, curveOpts = {}) {
          * Always torsion-free for cofactor=1 curves.
          */
         isTorsionFree() {
-            const { isTorsionFree } = curveOpts;
-            if (cofactor === _1n$8)
+            const { isTorsionFree } = extraOpts;
+            if (cofactor === _1n$7)
                 return true;
             if (isTorsionFree)
                 return isTorsionFree(Point, this);
-            return wnaf.wNAFCachedUnsafe(this, CURVE_ORDER).is0();
+            return wnaf.unsafe(this, CURVE_ORDER).is0();
         }
         clearCofactor() {
-            const { clearCofactor } = curveOpts;
-            if (cofactor === _1n$8)
+            const { clearCofactor } = extraOpts;
+            if (cofactor === _1n$7)
                 return this; // Fast-path
             if (clearCofactor)
                 return clearCofactor(Point, this);
             return this.multiplyUnsafe(cofactor);
         }
+        isSmallOrder() {
+            // can we use this.clearCofactor()?
+            return this.multiplyUnsafe(cofactor).is0();
+        }
         toBytes(isCompressed = true) {
-            abool('isCompressed', isCompressed);
+            _abool2(isCompressed, 'isCompressed');
             this.assertValidity();
-            return toBytes(Point, this, isCompressed);
-        }
-        /** @deprecated use `toBytes` */
-        toRawBytes(isCompressed = true) {
-            return this.toBytes(isCompressed);
+            return encodePoint(Point, this, isCompressed);
         }
         toHex(isCompressed = true) {
             return bytesToHex$1(this.toBytes(isCompressed));
@@ -9665,24 +9747,168 @@ function weierstrassN(CURVE, curveOpts = {}) {
         toString() {
             return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;
         }
+        // TODO: remove
+        get px() {
+            return this.X;
+        }
+        get py() {
+            return this.X;
+        }
+        get pz() {
+            return this.Z;
+        }
+        toRawBytes(isCompressed = true) {
+            return this.toBytes(isCompressed);
+        }
+        _setWindowSize(windowSize) {
+            this.precompute(windowSize);
+        }
+        static normalizeZ(points) {
+            return normalizeZ(Point, points);
+        }
+        static msm(points, scalars) {
+            return pippenger(Point, Fn, points, scalars);
+        }
+        static fromPrivateKey(privateKey) {
+            return Point.BASE.multiply(_normFnElement(Fn, privateKey));
+        }
     }
     // base / generator point
     Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);
     // zero / infinity / identity point
     Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0
-    // fields
+    // math field
     Point.Fp = Fp;
+    // scalar field
     Point.Fn = Fn;
     const bits = Fn.BITS;
-    const wnaf = wNAF$1(Point, curveOpts.endo ? Math.ceil(bits / 2) : bits);
+    const wnaf = new wNAF$1(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);
     return Point;
 }
 // Points start with byte 0x02 when y is even; otherwise 0x03
 function pprefix(hasEvenY) {
     return Uint8Array.of(hasEvenY ? 0x02 : 0x03);
 }
-function ecdsa(Point, ecdsaOpts, curveOpts = {}) {
-    _validateObject(ecdsaOpts, { hash: 'function' }, {
+function getWLengths(Fp, Fn) {
+    return {
+        secret: Fn.BYTES,
+        public: 1 + Fp.BYTES,
+        publicUncompressed: 1 + 2 * Fp.BYTES,
+        publicKeyHasPrefix: true,
+        signature: 2 * Fn.BYTES,
+    };
+}
+/**
+ * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.
+ * This helper ensures no signature functionality is present. Less code, smaller bundle size.
+ */
+function ecdh(Point, ecdhOpts = {}) {
+    const { Fn } = Point;
+    const randomBytes_ = ecdhOpts.randomBytes || randomBytes$3;
+    const lengths = Object.assign(getWLengths(Point.Fp, Fn), { seed: getMinHashLength$1(Fn.ORDER) });
+    function isValidSecretKey(secretKey) {
+        try {
+            return !!_normFnElement(Fn, secretKey);
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    function isValidPublicKey(publicKey, isCompressed) {
+        const { public: comp, publicUncompressed } = lengths;
+        try {
+            const l = publicKey.length;
+            if (isCompressed === true && l !== comp)
+                return false;
+            if (isCompressed === false && l !== publicUncompressed)
+                return false;
+            return !!Point.fromBytes(publicKey);
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    /**
+     * Produces cryptographically secure secret key from random of size
+     * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.
+     */
+    function randomSecretKey(seed = randomBytes_(lengths.seed)) {
+        return mapHashToField$1(_abytes2(seed, lengths.seed, 'seed'), Fn.ORDER);
+    }
+    /**
+     * Computes public key for a secret key. Checks for validity of the secret key.
+     * @param isCompressed whether to return compact (default), or full key
+     * @returns Public key, full when isCompressed=false; short when isCompressed=true
+     */
+    function getPublicKey(secretKey, isCompressed = true) {
+        return Point.BASE.multiply(_normFnElement(Fn, secretKey)).toBytes(isCompressed);
+    }
+    function keygen(seed) {
+        const secretKey = randomSecretKey(seed);
+        return { secretKey, publicKey: getPublicKey(secretKey) };
+    }
+    /**
+     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.
+     */
+    function isProbPub(item) {
+        if (typeof item === 'bigint')
+            return false;
+        if (item instanceof Point)
+            return true;
+        if (Fn.allowedLengths || lengths.secret === lengths.public)
+            return undefined;
+        const l = ensureBytes$1('key', item).length;
+        return l === lengths.public || l === lengths.publicUncompressed;
+    }
+    /**
+     * ECDH (Elliptic Curve Diffie Hellman).
+     * Computes shared public key from secret key A and public key B.
+     * Checks: 1) secret key validity 2) shared key is on-curve.
+     * Does NOT hash the result.
+     * @param isCompressed whether to return compact (default), or full key
+     * @returns shared public key
+     */
+    function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {
+        if (isProbPub(secretKeyA) === true)
+            throw new Error('first arg must be private key');
+        if (isProbPub(publicKeyB) === false)
+            throw new Error('second arg must be public key');
+        const s = _normFnElement(Fn, secretKeyA);
+        const b = Point.fromHex(publicKeyB); // checks for being on-curve
+        return b.multiply(s).toBytes(isCompressed);
+    }
+    const utils = {
+        isValidSecretKey,
+        isValidPublicKey,
+        randomSecretKey,
+        // TODO: remove
+        isValidPrivateKey: isValidSecretKey,
+        randomPrivateKey: randomSecretKey,
+        normPrivateKeyToScalar: (key) => _normFnElement(Fn, key),
+        precompute(windowSize = 8, point = Point.BASE) {
+            return point.precompute(windowSize, false);
+        },
+    };
+    return Object.freeze({ getPublicKey, getSharedSecret, keygen, Point, utils, lengths });
+}
+/**
+ * Creates ECDSA signing interface for given elliptic curve `Point` and `hash` function.
+ * We need `hash` for 2 features:
+ * 1. Message prehash-ing. NOT used if `sign` / `verify` are called with `prehash: false`
+ * 2. k generation in `sign`, using HMAC-drbg(hash)
+ *
+ * ECDSAOpts are only rarely needed.
+ *
+ * @example
+ * ```js
+ * const p256_Point = weierstrass(...);
+ * const p256_sha256 = ecdsa(p256_Point, sha256);
+ * const p256_sha224 = ecdsa(p256_Point, sha224);
+ * ```
+ */
+function ecdsa(Point, hash, ecdsaOpts = {}) {
+    ahash(hash);
+    _validateObject(ecdsaOpts, {}, {
         hmac: 'function',
         lowS: 'boolean',
         randomBytes: 'function',
@@ -9691,54 +9917,66 @@ function ecdsa(Point, ecdsaOpts, curveOpts = {}) {
     });
     const randomBytes_ = ecdsaOpts.randomBytes || randomBytes$3;
     const hmac_ = ecdsaOpts.hmac ||
-        ((key, ...msgs) => hmac$1(ecdsaOpts.hash, key, concatBytes$2(...msgs)));
+        ((key, ...msgs) => hmac$1(hash, key, concatBytes$2(...msgs)));
     const { Fp, Fn } = Point;
     const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
+    const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, ecdsaOpts);
+    const defaultSigOpts = {
+        prehash: false,
+        lowS: typeof ecdsaOpts.lowS === 'boolean' ? ecdsaOpts.lowS : false,
+        format: undefined, //'compact' as ECDSASigFormat,
+        extraEntropy: false,
+    };
+    const defaultSigOpts_format = 'compact';
     function isBiggerThanHalfOrder(number) {
-        const HALF = CURVE_ORDER >> _1n$8;
+        const HALF = CURVE_ORDER >> _1n$7;
         return number > HALF;
     }
     function normalizeS(s) {
         return isBiggerThanHalfOrder(s) ? Fn.neg(s) : s;
     }
-    function aValidRS(title, num) {
+    function validateRS(title, num) {
         if (!Fn.isValidNot0(num))
-            throw new Error(`invalid signature ${title}: out of range 1..CURVE.n`);
+            throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);
+        return num;
     }
     /**
-     * ECDSA signature with its (r, s) properties. Supports DER & compact representations.
+     * ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.
      */
     class Signature {
         constructor(r, s, recovery) {
-            aValidRS('r', r); // r in [1..N-1]
-            aValidRS('s', s); // s in [1..N-1]
-            this.r = r;
-            this.s = s;
+            this.r = validateRS('r', r); // r in [1..N-1];
+            this.s = validateRS('s', s); // s in [1..N-1];
             if (recovery != null)
                 this.recovery = recovery;
             Object.freeze(this);
         }
-        // pair (bytes of r, bytes of s)
-        static fromCompact(hex) {
-            const L = Fn.BYTES;
-            const b = ensureBytes$1('compactSignature', hex, L * 2);
-            return new Signature(Fn.fromBytes(b.subarray(0, L)), Fn.fromBytes(b.subarray(L, L * 2)));
+        static fromBytes(bytes, format = defaultSigOpts_format) {
+            validateSigFormat(format);
+            const size = lengths.signature;
+            let recid;
+            if (format === 'der') {
+                const { r, s } = DER$1.toSig(_abytes2(bytes));
+                return new Signature(r, s);
+            }
+            if (format === 'recovered') {
+                _abytes2(bytes, size + 1);
+                recid = bytes[0];
+                format = 'compact';
+                bytes = bytes.subarray(1);
+            }
+            _abytes2(bytes, size);
+            const L = size / 2;
+            const r = bytes.subarray(0, L);
+            const s = bytes.subarray(L, L * 2);
+            return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);
         }
-        // DER encoded ECDSA signature
-        // https://bitcoin.stackexchange.com/questions/57644/what-are-the-parts-of-a-bitcoin-transaction-input-script
-        static fromDER(hex) {
-            const { r, s } = DER$1.toSig(ensureBytes$1('DER', hex));
-            return new Signature(r, s);
+        static fromHex(hex, format) {
+            return this.fromBytes(hexToBytes$1(hex), format);
         }
-        /**
-         * @todo remove
-         * @deprecated
-         */
-        assertValidity() { }
         addRecoveryBit(recovery) {
             return new Signature(this.r, this.s, recovery);
         }
-        // ProjPointType<bigint>
         recoverPublicKey(msgHash) {
             const FIELD_ORDER = Fp.ORDER;
             const { r, s, recovery: rec } = this;
@@ -9759,7 +9997,7 @@ function ecdsa(Point, ecdsaOpts, curveOpts = {}) {
             if (!Fp.isValid(radj))
                 throw new Error('recovery id 2 or 3 invalid');
             const x = Fp.toBytes(radj);
-            const R = Point.fromHex(concatBytes$2(pprefix((rec & 1) === 0), x));
+            const R = Point.fromBytes(concatBytes$2(pprefix((rec & 1) === 0), x));
             const ir = Fn.inv(radj); // r^-1
             const h = bits2int_modN(ensureBytes$1('msgHash', msgHash)); // Truncate hash
             const u1 = Fn.create(-h * ir); // -hr^-1
@@ -9775,24 +10013,39 @@ function ecdsa(Point, ecdsaOpts, curveOpts = {}) {
         hasHighS() {
             return isBiggerThanHalfOrder(this.s);
         }
-        normalizeS() {
-            return this.hasHighS() ? new Signature(this.r, Fn.neg(this.s), this.recovery) : this;
-        }
-        toBytes(format) {
-            if (format === 'compact')
-                return concatBytes$2(Fn.toBytes(this.r), Fn.toBytes(this.s));
+        toBytes(format = defaultSigOpts_format) {
+            validateSigFormat(format);
             if (format === 'der')
                 return hexToBytes$1(DER$1.hexFromSig(this));
-            throw new Error('invalid format');
+            const r = Fn.toBytes(this.r);
+            const s = Fn.toBytes(this.s);
+            if (format === 'recovered') {
+                if (this.recovery == null)
+                    throw new Error('recovery bit must be present');
+                return concatBytes$2(Uint8Array.of(this.recovery), r, s);
+            }
+            return concatBytes$2(r, s);
+        }
+        toHex(format) {
+            return bytesToHex$1(this.toBytes(format));
+        }
+        // TODO: remove
+        assertValidity() { }
+        static fromCompact(hex) {
+            return Signature.fromBytes(ensureBytes$1('sig', hex), 'compact');
+        }
+        static fromDER(hex) {
+            return Signature.fromBytes(ensureBytes$1('sig', hex), 'der');
+        }
+        normalizeS() {
+            return this.hasHighS() ? new Signature(this.r, Fn.neg(this.s), this.recovery) : this;
         }
-        // DER-encoded
         toDERRawBytes() {
             return this.toBytes('der');
         }
         toDERHex() {
             return bytesToHex$1(this.toBytes('der'));
         }
-        // padded bytes of r, then padded bytes of s
         toCompactRawBytes() {
             return this.toBytes('compact');
         }
@@ -9800,77 +10053,6 @@ function ecdsa(Point, ecdsaOpts, curveOpts = {}) {
             return bytesToHex$1(this.toBytes('compact'));
         }
     }
-    const normPrivateKeyToScalar = _legacyHelperNormPriv(Fn, curveOpts.allowedPrivateKeyLengths, curveOpts.wrapPrivateKey);
-    const utils = {
-        isValidPrivateKey(privateKey) {
-            try {
-                normPrivateKeyToScalar(privateKey);
-                return true;
-            }
-            catch (error) {
-                return false;
-            }
-        },
-        normPrivateKeyToScalar: normPrivateKeyToScalar,
-        /**
-         * Produces cryptographically secure private key from random of size
-         * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.
-         */
-        randomPrivateKey: () => {
-            const n = CURVE_ORDER;
-            return mapHashToField$1(randomBytes_(getMinHashLength$1(n)), n);
-        },
-        precompute(windowSize = 8, point = Point.BASE) {
-            return point.precompute(windowSize, false);
-        },
-    };
-    /**
-     * Computes public key for a private key. Checks for validity of the private key.
-     * @param privateKey private key
-     * @param isCompressed whether to return compact (default), or full key
-     * @returns Public key, full when isCompressed=false; short when isCompressed=true
-     */
-    function getPublicKey(privateKey, isCompressed = true) {
-        return Point.fromPrivateKey(privateKey).toBytes(isCompressed);
-    }
-    /**
-     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.
-     */
-    function isProbPub(item) {
-        if (typeof item === 'bigint')
-            return false;
-        if (item instanceof Point)
-            return true;
-        const arr = ensureBytes$1('key', item);
-        const length = arr.length;
-        const L = Fp.BYTES;
-        const LC = L + 1; // e.g. 33 for 32
-        const LU = 2 * L + 1; // e.g. 65 for 32
-        if (curveOpts.allowedPrivateKeyLengths || Fn.BYTES === LC) {
-            return undefined;
-        }
-        else {
-            return length === LC || length === LU;
-        }
-    }
-    /**
-     * ECDH (Elliptic Curve Diffie Hellman).
-     * Computes shared public key from private key and public key.
-     * Checks: 1) private key validity 2) shared key is on-curve.
-     * Does NOT hash the result.
-     * @param privateA private key
-     * @param publicB different public key
-     * @param isCompressed whether to return compact (default), or full key
-     * @returns shared public key
-     */
-    function getSharedSecret(privateA, publicB, isCompressed = true) {
-        if (isProbPub(privateA) === true)
-            throw new Error('first arg must be private key');
-        if (isProbPub(publicB) === false)
-            throw new Error('second arg must be public key');
-        const b = Point.fromHex(publicB); // check for being on-curve
-        return b.multiply(normPrivateKeyToScalar(privateA)).toBytes(isCompressed);
-    }
     // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.
     // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.
     // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.
@@ -9900,55 +10082,60 @@ function ecdsa(Point, ecdsaOpts, curveOpts = {}) {
         aInRange('num < 2^' + fnBits, num, _0n$6, ORDER_MASK);
         return Fn.toBytes(num);
     }
-    // Steps A, D of RFC6979 3.2
-    // Creates RFC6979 seed; converts msg/privKey to numbers.
-    // Used only in sign, not in verify.
-    // NOTE: we cannot assume here that msgHash has same amount of bytes as curve order,
-    // this will be invalid at least for P521. Also it can be bigger for P224 + SHA256
-    function prepSig(msgHash, privateKey, opts = defaultSigOpts) {
+    /**
+     * Steps A, D of RFC6979 3.2.
+     * Creates RFC6979 seed; converts msg/privKey to numbers.
+     * Used only in sign, not in verify.
+     *
+     * Warning: we cannot assume here that message has same amount of bytes as curve order,
+     * this will be invalid at least for P521. Also it can be bigger for P224 + SHA256.
+     */
+    function prepSig(message, privateKey, opts) {
         if (['recovered', 'canonical'].some((k) => k in opts))
             throw new Error('sign() legacy options not supported');
-        const { hash } = ecdsaOpts;
-        let { lowS, prehash, extraEntropy: ent } = opts; // generates low-s sigs by default
-        if (lowS == null)
-            lowS = true; // RFC6979 3.2: we skip step A, because we already provide hash
-        msgHash = ensureBytes$1('msgHash', msgHash);
-        validateSigVerOpts(opts);
+        const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);
+        // RFC6979 3.2: we skip step A, because we already provide hash
+        message = _abytes2(message, undefined, 'message');
         if (prehash)
-            msgHash = ensureBytes$1('prehashed msgHash', hash(msgHash));
+            message = _abytes2(hash(message), undefined, 'prehashed message');
         // We can't later call bits2octets, since nested bits2int is broken for curves
         // with fnBits % 8 !== 0. Because of that, we unwrap it here as int2octets call.
         // const bits2octets = (bits) => int2octets(bits2int_modN(bits))
-        const h1int = bits2int_modN(msgHash);
-        const d = normPrivateKeyToScalar(privateKey); // validate private key, convert to bigint
+        const h1int = bits2int_modN(message);
+        const d = _normFnElement(Fn, privateKey); // validate secret key, convert to bigint
         const seedArgs = [int2octets(d), int2octets(h1int)];
         // extraEntropy. RFC6979 3.6: additional k' (optional).
-        if (ent != null && ent !== false) {
+        if (extraEntropy != null && extraEntropy !== false) {
             // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')
-            const e = ent === true ? randomBytes_(Fp.BYTES) : ent; // generate random bytes OR pass as-is
+            // gen random bytes OR pass as-is
+            const e = extraEntropy === true ? randomBytes_(lengths.secret) : extraEntropy;
             seedArgs.push(ensureBytes$1('extraEntropy', e)); // check for being bytes
         }
         const seed = concatBytes$2(...seedArgs); // Step D of RFC6979 3.2
         const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!
         // Converts signature params into point w r/s, checks result for validity.
+        // To transform k => Signature:
+        // q = k⋅G
+        // r = q.x mod n
+        // s = k^-1(m + rd) mod n
         // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to
         // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:
         // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT
         function k2sig(kBytes) {
             // RFC 6979 Section 3.2, step 3: k = bits2int(T)
             // Important: all mod() calls here must be done over N
-            const k = bits2int(kBytes); // Cannot use fields methods, since it is group element
+            const k = bits2int(kBytes); // mod n, not mod p
             if (!Fn.isValidNot0(k))
                 return; // Valid scalars (including k) must be in 1..N-1
             const ik = Fn.inv(k); // k^-1 mod n
-            const q = Point.BASE.multiply(k).toAffine(); // q = Gk
+            const q = Point.BASE.multiply(k).toAffine(); // q = k⋅G
             const r = Fn.create(q.x); // r = q.x mod n
             if (r === _0n$6)
                 return;
             const s = Fn.create(ik * Fn.create(m + r * d)); // Not using blinding here, see comment above
             if (s === _0n$6)
                 return;
-            let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n$8); // recovery bit (2 or 3, when q.x > n)
+            let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n$7); // recovery bit (2 or 3, when q.x > n)
             let normS = s;
             if (lowS && isBiggerThanHalfOrder(s)) {
                 normS = normalizeS(s); // if lowS was passed, ensure s is always
@@ -9958,131 +10145,136 @@ function ecdsa(Point, ecdsaOpts, curveOpts = {}) {
         }
         return { seed, k2sig };
     }
-    const defaultSigOpts = { lowS: ecdsaOpts.lowS, prehash: false };
-    const defaultVerOpts = { lowS: ecdsaOpts.lowS, prehash: false };
     /**
-     * Signs message hash with a private key.
+     * Signs message hash with a secret key.
+     *
      * ```
-     * sign(m, d, k) where
+     * sign(m, d) where
+     *   k = rfc6979_hmac_drbg(m, d)
      *   (x, y) = G × k
      *   r = x mod n
-     *   s = (m + dr)/k mod n
+     *   s = (m + dr) / k mod n
      * ```
-     * @param msgHash NOT message. msg needs to be hashed to `msgHash`, or use `prehash`.
-     * @param privKey private key
-     * @param opts lowS for non-malleable sigs. extraEntropy for mixing randomness into k. prehash will hash first arg.
-     * @returns signature with recovery param
      */
-    function sign(msgHash, privKey, opts = defaultSigOpts) {
-        const { seed, k2sig } = prepSig(msgHash, privKey, opts); // Steps A, D of RFC6979 3.2.
-        const drbg = createHmacDrbg$1(ecdsaOpts.hash.outputLen, Fn.BYTES, hmac_);
-        return drbg(seed, k2sig); // Steps B, C, D, E, F, G
+    function sign(message, secretKey, opts = {}) {
+        message = ensureBytes$1('message', message);
+        const { seed, k2sig } = prepSig(message, secretKey, opts); // Steps A, D of RFC6979 3.2.
+        const drbg = createHmacDrbg$1(hash.outputLen, Fn.BYTES, hmac_);
+        const sig = drbg(seed, k2sig); // Steps B, C, D, E, F, G
+        return sig;
     }
     // Enable precomputes. Slows down first publicKey computation by 20ms.
     Point.BASE.precompute(8);
     /**
-     * Verifies a signature against message hash and public key.
-     * Rejects lowS signatures by default: to override,
-     * specify option `{lowS: false}`. Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:
+     * Verifies a signature against message and public key.
+     * Rejects lowS signatures by default: see {@link ECDSAVerifyOpts}.
+     * Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:
      *
      * ```
      * verify(r, s, h, P) where
-     *   U1 = hs^-1 mod n
-     *   U2 = rs^-1 mod n
-     *   R = U1⋅G - U2⋅P
+     *   u1 = hs^-1 mod n
+     *   u2 = rs^-1 mod n
+     *   R = u1⋅G + u2⋅P
      *   mod(R.x, n) == r
      * ```
      */
-    function verify(signature, msgHash, publicKey, opts = defaultVerOpts) {
+    function verify(signature, message, publicKey, opts = {}) {
         const sg = signature;
-        msgHash = ensureBytes$1('msgHash', msgHash);
+        message = ensureBytes$1('msgHash', message);
         publicKey = ensureBytes$1('publicKey', publicKey);
-        // Verify opts
-        validateSigVerOpts(opts);
-        const { lowS, prehash, format } = opts;
-        // TODO: remove
-        if ('strict' in opts)
-            throw new Error('options.strict was renamed to lowS');
-        if (format !== undefined && !['compact', 'der', 'js'].includes(format))
-            throw new Error('format must be "compact", "der" or "js"');
-        const isHex = typeof sg === 'string' || isBytes(sg);
-        const isObj = !isHex &&
-            !format &&
-            typeof sg === 'object' &&
-            sg !== null &&
-            typeof sg.r === 'bigint' &&
-            typeof sg.s === 'bigint';
-        if (!isHex && !isObj)
-            throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');
+        const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);
         let _sig = undefined;
         let P;
-        // deduce signature format
-        try {
-            // if (format === 'js') {
-            //   if (sg != null && !isBytes(sg)) _sig = new Signature(sg.r, sg.s);
-            // } else if (format === 'compact') {
-            //   _sig = Signature.fromCompact(sg);
-            // } else if (format === 'der') {
-            //   _sig = Signature.fromDER(sg);
-            // } else {
-            //   throw new Error('invalid format');
-            // }
+        if ('strict' in opts)
+            throw new Error('options.strict was renamed to lowS');
+        if (format === undefined) {
+            // Try to deduce format
+            const isHex = typeof sg === 'string' || isBytes(sg);
+            const isObj = !isHex &&
+                sg !== null &&
+                typeof sg === 'object' &&
+                typeof sg.r === 'bigint' &&
+                typeof sg.s === 'bigint';
+            if (!isHex && !isObj)
+                throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');
             if (isObj) {
-                if (format === undefined || format === 'js') {
-                    _sig = new Signature(sg.r, sg.s);
-                }
-                else {
-                    throw new Error('invalid format');
-                }
+                _sig = new Signature(sg.r, sg.s);
             }
-            if (isHex) {
+            else if (isHex) {
                 // TODO: remove this malleable check
                 // Signature can be represented in 2 ways: compact (2*Fn.BYTES) & DER (variable-length).
                 // Since DER can also be 2*Fn.BYTES bytes, we check for it first.
                 try {
-                    if (format !== 'compact')
-                        _sig = Signature.fromDER(sg);
+                    _sig = Signature.fromDER(sg);
                 }
                 catch (derError) {
                     if (!(derError instanceof DER$1.Err))
                         throw derError;
                 }
-                if (!_sig && format !== 'der')
-                    _sig = Signature.fromCompact(sg);
+                if (!_sig) {
+                    try {
+                        _sig = Signature.fromCompact(sg);
+                    }
+                    catch (error) {
+                        return false;
+                    }
+                }
             }
-            P = Point.fromHex(publicKey);
         }
-        catch (error) {
-            return false;
+        else {
+            if (format === 'compact' || format === 'der') {
+                if (typeof sg !== 'string' && !isBytes(sg))
+                    throw new Error('"der" / "compact" format expects Uint8Array signature');
+                _sig = Signature.fromBytes(ensureBytes$1('sig', sg), format);
+            }
+            else {
+                throw new Error('format must be "compact", "der" or "js"');
+            }
         }
         if (!_sig)
             return false;
-        if (lowS && _sig.hasHighS())
+        try {
+            P = Point.fromHex(publicKey);
+            if (lowS && _sig.hasHighS())
+                return false;
+            // todo: optional.hash => hash
+            if (prehash)
+                message = hash(message);
+            const { r, s } = _sig;
+            const h = bits2int_modN(message); // mod n, not mod p
+            const is = Fn.inv(s); // s^-1 mod n
+            const u1 = Fn.create(h * is); // u1 = hs^-1 mod n
+            const u2 = Fn.create(r * is); // u2 = rs^-1 mod n
+            const R = Point.BASE.multiplyUnsafe(u1).add(P.multiplyUnsafe(u2)); // u1⋅G + u2⋅P
+            if (R.is0())
+                return false;
+            const v = Fn.create(R.x); // v = r.x mod n
+            return v === r;
+        }
+        catch (e) {
             return false;
-        // todo: optional.hash => hash
+        }
+    }
+    function recoverPublicKey(signature, message, opts = {}) {
+        const prehash = opts.prehash !== undefined ? opts.prehash : defaultSigOpts.prehash;
+        _abool2(prehash, 'prehash');
+        message = _abytes2(message, undefined, 'message');
         if (prehash)
-            msgHash = ecdsaOpts.hash(msgHash);
-        const { r, s } = _sig;
-        const h = bits2int_modN(msgHash); // Cannot use fields methods, since it is group element
-        const is = Fn.inv(s); // s^-1
-        const u1 = Fn.create(h * is); // u1 = hs^-1 mod n
-        const u2 = Fn.create(r * is); // u2 = rs^-1 mod n
-        const R = Point.BASE.multiplyUnsafe(u1).add(P.multiplyUnsafe(u2));
-        if (R.is0())
-            return false;
-        const v = Fn.create(R.x); // v = r.x mod n
-        return v === r;
+            message = _abytes2(hash(message), undefined, 'prehashed message');
+        return Signature.fromBytes(signature, 'recovered').recoverPublicKey(message).toBytes();
     }
-    // TODO: clarify API for cloning .clone({hash: sha512}) ? .createWith({hash: sha512})?
-    // const clone = (hash: CHash): ECDSA => ecdsa(Point, { ...ecdsaOpts, ...getHash(hash) }, curveOpts);
     return Object.freeze({
+        keygen,
         getPublicKey,
         getSharedSecret,
-        sign,
-        verify,
         utils,
+        lengths,
         Point,
+        sign,
+        verify,
+        recoverPublicKey,
         Signature,
+        hash,
     });
 }
 function _weierstrass_legacy_opts_to_new(c) {
@@ -10096,14 +10288,19 @@ function _weierstrass_legacy_opts_to_new(c) {
         Gy: c.Gy,
     };
     const Fp = c.Fp;
-    const Fn = Field$1(CURVE.n, c.nBitLength);
+    let allowedLengths = c.allowedPrivateKeyLengths
+        ? Array.from(new Set(c.allowedPrivateKeyLengths.map((l) => Math.ceil(l / 2))))
+        : undefined;
+    const Fn = Field$1(CURVE.n, {
+        BITS: c.nBitLength,
+        allowedLengths: allowedLengths,
+        modFromBytes: c.wrapPrivateKey,
+    });
     const curveOpts = {
         Fp,
         Fn,
-        allowedPrivateKeyLengths: c.allowedPrivateKeyLengths,
         allowInfinityPoint: c.allowInfinityPoint,
         endo: c.endo,
-        wrapPrivateKey: c.wrapPrivateKey,
         isTorsionFree: c.isTorsionFree,
         clearCofactor: c.clearCofactor,
         fromBytes: c.fromBytes,
@@ -10114,32 +10311,33 @@ function _weierstrass_legacy_opts_to_new(c) {
 function _ecdsa_legacy_opts_to_new(c) {
     const { CURVE, curveOpts } = _weierstrass_legacy_opts_to_new(c);
     const ecdsaOpts = {
-        hash: c.hash,
         hmac: c.hmac,
         randomBytes: c.randomBytes,
         lowS: c.lowS,
         bits2int: c.bits2int,
         bits2int_modN: c.bits2int_modN,
     };
-    return { CURVE, curveOpts, ecdsaOpts };
+    return { CURVE, curveOpts, hash: c.hash, ecdsaOpts };
 }
-function _ecdsa_new_output_to_legacy(c, ecdsa) {
-    return Object.assign({}, ecdsa, {
-        ProjectivePoint: ecdsa.Point,
-        CURVE: c,
+function _ecdsa_new_output_to_legacy(c, _ecdsa) {
+    const Point = _ecdsa.Point;
+    return Object.assign({}, _ecdsa, {
+        ProjectivePoint: Point,
+        CURVE: Object.assign({}, c, nLength$1(Point.Fn.ORDER, Point.Fn.BITS)),
     });
 }
 // _ecdsa_legacy
 function weierstrass$1(c) {
-    const { CURVE, curveOpts, ecdsaOpts } = _ecdsa_legacy_opts_to_new(c);
+    const { CURVE, curveOpts, hash, ecdsaOpts } = _ecdsa_legacy_opts_to_new(c);
     const Point = weierstrassN(CURVE, curveOpts);
-    const signs = ecdsa(Point, ecdsaOpts, curveOpts);
+    const signs = ecdsa(Point, hash, ecdsaOpts);
     return _ecdsa_new_output_to_legacy(c, signs);
 }/**
  * Utilities for short weierstrass curves, combined with noble-hashes.
  * @module
  */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+/** @deprecated use new `weierstrass()` and `ecdsa()` methods */
 function createCurve$1(curveDef, defHash) {
     const create = (hash) => weierstrass$1({ ...curveDef, hash: hash });
     return { ...create(defHash), create };
@@ -10163,10 +10361,14 @@ const secp256k1_CURVE = {
     Gx: BigInt('0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'),
     Gy: BigInt('0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8'),
 };
-BigInt(0);
-const _1n$7 = BigInt(1);
-const _2n$5 = BigInt(2);
-const divNearest$1 = (a, b) => (a + b / _2n$5) / b;
+const secp256k1_ENDO = {
+    beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),
+    basises: [
+        [BigInt('0x3086d221a7d46bcde86c90e49284eb15'), -BigInt('0xe4437ed6010e88286f547fa90abfe4c3')],
+        [BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8'), BigInt('0x3086d221a7d46bcde86c90e49284eb15')],
+    ],
+};
+const _2n$5 = /* @__PURE__ */ BigInt(2);
 /**
  * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.
  * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]
@@ -10195,7 +10397,7 @@ function sqrtMod$1(y) {
         throw new Error('Cannot find square root');
     return root;
 }
-const Fpk1 = Field$1(secp256k1_CURVE.p, undefined, undefined, { sqrt: sqrtMod$1 });
+const Fpk1 = Field$1(secp256k1_CURVE.p, { sqrt: sqrtMod$1 });
 /**
  * secp256k1 curve, ECDSA and ECDH methods.
  *
@@ -10204,44 +10406,13 @@ const Fpk1 = Field$1(secp256k1_CURVE.p, undefined, undefined, { sqrt: sqrtMod$1
  * @example
  * ```js
  * import { secp256k1 } from '@noble/curves/secp256k1';
- * const priv = secp256k1.utils.randomPrivateKey();
- * const pub = secp256k1.getPublicKey(priv);
- * const msg = new Uint8Array(32).fill(1); // message hash (not message) in ecdsa
- * const sig = secp256k1.sign(msg, priv); // `{prehash: true}` option is available
- * const isValid = secp256k1.verify(sig, msg, pub) === true;
+ * const { secretKey, publicKey } = secp256k1.keygen();
+ * const msg = new TextEncoder().encode('hello');
+ * const sig = secp256k1.sign(msg, secretKey);
+ * const isValid = secp256k1.verify(sig, msg, publicKey) === true;
  * ```
  */
-const secp256k1$1 = createCurve$1({
-    ...secp256k1_CURVE,
-    Fp: Fpk1,
-    lowS: true, // Allow only low-S signatures by default in sign() and verify()
-    endo: {
-        // Endomorphism, see above
-        beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),
-        splitScalar: (k) => {
-            const n = secp256k1_CURVE.n;
-            const a1 = BigInt('0x3086d221a7d46bcde86c90e49284eb15');
-            const b1 = -_1n$7 * BigInt('0xe4437ed6010e88286f547fa90abfe4c3');
-            const a2 = BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8');
-            const b2 = a1;
-            const POW_2_128 = BigInt('0x100000000000000000000000000000000'); // (2n**128n).toString(16)
-            const c1 = divNearest$1(b2 * k, n);
-            const c2 = divNearest$1(-b1 * k, n);
-            let k1 = mod$1(k - c1 * a1 - c2 * a2, n);
-            let k2 = mod$1(-c1 * b1 - c2 * b2, n);
-            const k1neg = k1 > POW_2_128;
-            const k2neg = k2 > POW_2_128;
-            if (k1neg)
-                k1 = n - k1;
-            if (k2neg)
-                k2 = n - k2;
-            if (k1 > POW_2_128 || k2 > POW_2_128) {
-                throw new Error('splitScalar: Endomorphism failed, k=' + k);
-            }
-            return { k1neg, k1, k2neg, k2 };
-        },
-    },
-}, sha256$2);function encodeAddress(key, ss58Format = defaults.prefix) {
+const secp256k1$1 = createCurve$1({ ...secp256k1_CURVE, Fp: Fpk1, lowS: true, endo: secp256k1_ENDO }, sha256$2);function encodeAddress(key, ss58Format = defaults.prefix) {
     // decode it, this means we can re-encode an address
     const u8a = decodeAddress(key);
     if ((ss58Format < 0) || (ss58Format > 16383) || [46, 47].includes(ss58Format)) {
@@ -19823,13 +19994,27 @@ function createPasskeyPublicKey(publicKey) {
         publicKey: parsedNewPublicKey,
     };
 }
+/**
+ * Build AddAction payload for Itemized storage.
+ *
+ * @param data The data to be persisted on the Frequency chain
+ */
 function createItemizedAddAction(data) {
     const parsedData = typeof data === 'object' ? u8aToHex(data) : data;
     assert(isHexString(parsedData), 'itemized data should be valid hex');
+    // since Metamask does not support union types, we have to include all fields and have to set the `index` value to zero
+    // even though it is not used for Add action
     return { actionType: 'Add', data, index: 0 };
 }
+/**
+ * Build DeleteAction payload for Itemized storage.
+ *
+ * @param index The index of the item that we want to remove from the Frequency chain
+ */
 function createItemizedDeleteAction(index) {
     assert(isValidUint16(index), 'itemized index should be a valid uint16');
+    // since Metamask does not support union types, we have to include all fields and have to set the `data` value to 0x
+    // even though it is not used for Delete action
     return { actionType: 'Delete', data: '0x', index };
 }
 /**