@gardenfi/utils 2.3.2 → 2.3.3

package/dist/index301.js

@@ -1,701 +1,204 @@
-import { hmac as dt } from "./index295.js";
-import { _validateObject as at, bitMask as ft, abool as Q, ensureBytes as z, memoized as nt, createHmacDrbg as ht, bytesToNumberBE as ct, numberToHexUnpadded as M, aInRange as mt } from "./index294.js";
-import { _createCurveFields as wt, wNAF as yt, normalizeZ as pt, pippenger as gt, mulEndoUnsafe as Et, negateCt as ot } from "./index302.js";
-import { Field as bt, mapHashToField as vt, getMinHashLength as Bt } from "./index282.js";
-import { concatBytes as I, abytes as it, bytesToHex as rt, hexToBytes as xt, randomBytes as St, isBytes as Rt } from "./index287.js";
+import { bitLen as B, bitMask as z } from "./index296.js";
+import { validateField as Z, Field as O, FpInvertBatch as R } from "./index263.js";
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-function st(e) {
-  e.lowS !== void 0 && Q("lowS", e.lowS), e.prehash !== void 0 && Q("prehash", e.prehash);
+const g = BigInt(0), h = BigInt(1);
+function b(t, r) {
+  const e = r.negate();
+  return t ? e : r;
 }
-class Ot extends Error {
-  constructor(i = "") {
-    super(i);
-  }
+function L(t, r, e) {
+  const n = (s) => s.pz, i = R(t.Fp, e.map(n));
+  return e.map((s, f) => s.toAffine(i[f])).map(t.fromAffine);
 }
-const F = {
-  // asn.1 DER encoding utils
-  Err: Ot,
-  // Basic building block is TLV (Tag-Length-Value)
-  _tlv: {
-    encode: (e, i) => {
-      const { Err: t } = F;
-      if (e < 0 || e > 256)
-        throw new t("tlv.encode: wrong tag");
-      if (i.length & 1)
-        throw new t("tlv.encode: unpadded data");
-      const w = i.length / 2, p = M(w);
-      if (p.length / 2 & 128)
-        throw new t("tlv.encode: long form length too big");
-      const b = w > 127 ? M(p.length / 2 | 128) : "";
-      return M(e) + b + p + i;
-    },
-    // v - value, l - left bytes (unparsed)
-    decode(e, i) {
-      const { Err: t } = F;
-      let w = 0;
-      if (e < 0 || e > 256)
-        throw new t("tlv.encode: wrong tag");
-      if (i.length < 2 || i[w++] !== e)
-        throw new t("tlv.decode: wrong tlv");
-      const p = i[w++], b = !!(p & 128);
-      let u = 0;
-      if (!b)
-        u = p;
-      else {
-        const S = p & 127;
-        if (!S)
-          throw new t("tlv.decode(long): indefinite length not supported");
-        if (S > 4)
-          throw new t("tlv.decode(long): byte length is too big");
-        const N = i.subarray(w, w + S);
-        if (N.length !== S)
-          throw new t("tlv.decode: length bytes not complete");
-        if (N[0] === 0)
-          throw new t("tlv.decode(long): zero leftmost byte");
-        for (const q of N)
-          u = u << 8 | q;
-        if (w += S, u < 128)
-          throw new t("tlv.decode(long): not minimal encoding");
-      }
-      const x = i.subarray(w, w + u);
-      if (x.length !== u)
-        throw new t("tlv.decode: wrong value length");
-      return { v: x, l: i.subarray(w + u) };
-    }
-  },
-  // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,
-  // since we always use positive integers here. It must always be empty:
-  // - add zero byte if exists
-  // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
-  _int: {
-    encode(e) {
-      const { Err: i } = F;
-      if (e < U)
-        throw new i("integer: negative integers are not allowed");
-      let t = M(e);
-      if (Number.parseInt(t[0], 16) & 8 && (t = "00" + t), t.length & 1)
-        throw new i("unexpected DER parsing assertion: unpadded hex");
-      return t;
-    },
-    decode(e) {
-      const { Err: i } = F;
-      if (e[0] & 128)
-        throw new i("invalid signature integer: negative");
-      if (e[0] === 0 && !(e[1] & 128))
-        throw new i("invalid signature integer: unnecessary leading zero");
-      return ct(e);
-    }
-  },
-  toSig(e) {
-    const { Err: i, _int: t, _tlv: w } = F, p = z("signature", e), { v: b, l: u } = w.decode(48, p);
-    if (u.length)
-      throw new i("invalid signature: left bytes after parsing");
-    const { v: x, l: S } = w.decode(2, b), { v: N, l: q } = w.decode(2, S);
-    if (q.length)
-      throw new i("invalid signature: left bytes after parsing");
-    return { r: t.decode(x), s: t.decode(N) };
-  },
-  hexFromSig(e) {
-    const { _tlv: i, _int: t } = F, w = i.encode(2, t.encode(e.r)), p = i.encode(2, t.encode(e.s)), b = w + p;
-    return i.encode(48, b);
-  }
-}, U = BigInt(0), k = BigInt(1), At = BigInt(2), W = BigInt(3), Zt = BigInt(4);
-function Tt(e, i, t) {
-  function w(p) {
-    const b = e.sqr(p), u = e.mul(b, p);
-    return e.add(e.add(u, e.mul(p, i)), t);
-  }
-  return w;
+function I(t, r) {
+  if (!Number.isSafeInteger(t) || t <= 0 || t > r)
+    throw new Error("invalid window size, expected [1.." + r + "], got W=" + t);
 }
-function lt(e, i, t) {
-  const { BYTES: w } = e;
-  function p(b) {
-    let u;
-    if (typeof b == "bigint")
-      u = b;
-    else {
-      let x = z("private key", b);
-      if (i) {
-        if (!i.includes(x.length * 2))
-          throw new Error("invalid private key");
-        const S = new Uint8Array(w);
-        S.set(x, S.length - x.length), x = S;
-      }
-      try {
-        u = e.fromBytes(x);
-      } catch {
-        throw new Error(`invalid private key: expected ui8a of size ${w}, got ${typeof b}`);
-      }
-    }
-    if (t && (u = e.create(u)), !e.isValidNot0(u))
-      throw new Error("invalid private key: out of range [1..N-1]");
-    return u;
-  }
-  return p;
+function E(t, r) {
+  I(t, r);
+  const e = Math.ceil(r / t) + 1, n = 2 ** (t - 1), i = 2 ** t, o = z(t), s = BigInt(t);
+  return { windows: e, windowSize: n, mask: o, maxNumber: i, shiftBy: s };
+}
+function v(t, r, e) {
+  const { windowSize: n, mask: i, maxNumber: o, shiftBy: s } = e;
+  let f = Number(t & i), a = t >> s;
+  f > n && (f -= o, a += h);
+  const d = r * n, c = d + Math.abs(f) - 1, p = f === 0, l = f < 0, u = r % 2 !== 0;
+  return { nextN: a, offset: c, isZero: p, isNeg: l, isNegF: u, offsetF: d };
 }
-function zt(e, i = {}) {
-  const { Fp: t, Fn: w } = wt("weierstrass", e, i), { h: p, n: b } = e;
-  at(i, {}, {
-    allowInfinityPoint: "boolean",
-    clearCofactor: "function",
-    isTorsionFree: "function",
-    fromBytes: "function",
-    toBytes: "function",
-    endo: "object",
-    wrapPrivateKey: "boolean"
+function j(t, r) {
+  if (!Array.isArray(t))
+    throw new Error("array expected");
+  t.forEach((e, n) => {
+    if (!(e instanceof r))
+      throw new Error("invalid point at index " + n);
   });
-  const { endo: u } = i;
-  if (u && (!t.is0(e.a) || typeof u.beta != "bigint" || typeof u.splitScalar != "function"))
-    throw new Error('invalid endo: expected "beta": bigint and "splitScalar": function');
-  function x() {
-    if (!t.isOdd)
-      throw new Error("compression is not supported: Field does not have .isOdd()");
-  }
-  function S(v, r, s) {
-    const { x: n, y: o } = r.toAffine(), a = t.toBytes(n);
-    if (Q("isCompressed", s), s) {
-      x();
-      const d = !t.isOdd(o);
-      return I(ut(d), a);
-    } else
-      return I(Uint8Array.of(4), a, t.toBytes(o));
-  }
-  function N(v) {
-    it(v);
-    const r = t.BYTES, s = r + 1, n = 2 * r + 1, o = v.length, a = v[0], d = v.subarray(1);
-    if (o === s && (a === 2 || a === 3)) {
-      const c = t.fromBytes(d);
-      if (!t.isValid(c))
-        throw new Error("bad point: is not on curve, wrong x");
-      const l = T(c);
-      let h;
-      try {
-        h = t.sqrt(l);
-      } catch (g) {
-        const m = g instanceof Error ? ": " + g.message : "";
-        throw new Error("bad point: is not on curve, sqrt error" + m);
-      }
-      x();
-      const f = t.isOdd(h);
-      return (a & 1) === 1 !== f && (h = t.neg(h)), { x: c, y: h };
-    } else if (o === n && a === 4) {
-      const c = t.fromBytes(d.subarray(r * 0, r * 1)), l = t.fromBytes(d.subarray(r * 1, r * 2));
-      if (!L(c, l))
-        throw new Error("bad point: is not on curve");
-      return { x: c, y: l };
-    } else
-      throw new Error(`bad point: got length ${o}, expected compressed=${s} or uncompressed=${n}`);
-  }
-  const q = i.toBytes || S, C = i.fromBytes || N, T = Tt(t, e.a, e.b);
-  function L(v, r) {
-    const s = t.sqr(r), n = T(v);
-    return t.eql(s, n);
-  }
-  if (!L(e.Gx, e.Gy))
-    throw new Error("bad curve params: generator point");
-  const J = t.mul(t.pow(e.a, W), Zt), tt = t.mul(t.sqr(e.b), BigInt(27));
-  if (t.is0(t.add(J, tt)))
-    throw new Error("bad curve params: a or b");
-  function K(v, r, s = !1) {
-    if (!t.isValid(r) || s && t.is0(r))
-      throw new Error(`bad point coordinate ${v}`);
-    return r;
-  }
-  function G(v) {
-    if (!(v instanceof y))
-      throw new Error("ProjectivePoint expected");
-  }
-  const X = nt((v, r) => {
-    const { px: s, py: n, pz: o } = v;
-    if (t.eql(o, t.ONE))
-      return { x: s, y: n };
-    const a = v.is0();
-    r == null && (r = a ? t.ONE : t.inv(o));
-    const d = t.mul(s, r), c = t.mul(n, r), l = t.mul(o, r);
-    if (a)
-      return { x: t.ZERO, y: t.ZERO };
-    if (!t.eql(l, t.ONE))
-      throw new Error("invZ was invalid");
-    return { x: d, y: c };
-  }), V = nt((v) => {
-    if (v.is0()) {
-      if (i.allowInfinityPoint && !t.is0(v.py))
-        return;
-      throw new Error("bad point: ZERO");
-    }
-    const { x: r, y: s } = v.toAffine();
-    if (!t.isValid(r) || !t.isValid(s))
-      throw new Error("bad point: x or y not field elements");
-    if (!L(r, s))
-      throw new Error("bad point: equation left != right");
-    if (!v.isTorsionFree())
-      throw new Error("bad point: not in prime-order subgroup");
-    return !0;
+}
+function _(t, r) {
+  if (!Array.isArray(t))
+    throw new Error("array of scalars expected");
+  t.forEach((e, n) => {
+    if (!r.isValid(e))
+      throw new Error("invalid scalar at index " + n);
   });
-  function $(v, r, s, n, o) {
-    return s = new y(t.mul(s.px, v), s.py, s.pz), r = ot(n, r), s = ot(o, s), r.add(s);
-  }
-  class y {
-    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
-    constructor(r, s, n) {
-      this.px = K("x", r), this.py = K("y", s, !0), this.pz = K("z", n), Object.freeze(this);
-    }
-    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
-    static fromAffine(r) {
-      const { x: s, y: n } = r || {};
-      if (!r || !t.isValid(s) || !t.isValid(n))
-        throw new Error("invalid affine point");
-      if (r instanceof y)
-        throw new Error("projective point not allowed");
-      return t.is0(s) && t.is0(n) ? y.ZERO : new y(s, n, t.ONE);
-    }
-    get x() {
-      return this.toAffine().x;
-    }
-    get y() {
-      return this.toAffine().y;
-    }
-    static normalizeZ(r) {
-      return pt(y, "pz", r);
-    }
-    static fromBytes(r) {
-      return it(r), y.fromHex(r);
-    }
-    /** Converts hash string or Uint8Array to Point. */
-    static fromHex(r) {
-      const s = y.fromAffine(C(z("pointHex", r)));
-      return s.assertValidity(), s;
-    }
-    /** Multiplies generator point by privateKey. */
-    static fromPrivateKey(r) {
-      const s = lt(w, i.allowedPrivateKeyLengths, i.wrapPrivateKey);
-      return y.BASE.multiply(s(r));
-    }
-    /** Multiscalar Multiplication */
-    static msm(r, s) {
-      return gt(y, w, r, s);
-    }
-    /**
-     *
-     * @param windowSize
-     * @param isLazy true will defer table computation until the first multiplication
-     * @returns
-     */
-    precompute(r = 8, s = !0) {
-      return _.setWindowSize(this, r), s || this.multiply(W), this;
-    }
-    /** "Private method", don't use it directly */
-    _setWindowSize(r) {
-      this.precompute(r);
-    }
-    // TODO: return `this`
-    /** A point on curve is valid if it conforms to equation. */
-    assertValidity() {
-      V(this);
-    }
-    hasEvenY() {
-      const { y: r } = this.toAffine();
-      if (!t.isOdd)
-        throw new Error("Field doesn't support isOdd");
-      return !t.isOdd(r);
-    }
-    /** Compare one point to another. */
-    equals(r) {
-      G(r);
-      const { px: s, py: n, pz: o } = this, { px: a, py: d, pz: c } = r, l = t.eql(t.mul(s, c), t.mul(a, o)), h = t.eql(t.mul(n, c), t.mul(d, o));
-      return l && h;
-    }
-    /** Flips point to one corresponding to (x, -y) in Affine coordinates. */
-    negate() {
-      return new y(this.px, t.neg(this.py), this.pz);
-    }
-    // Renes-Costello-Batina exception-free doubling formula.
-    // There is 30% faster Jacobian formula, but it is not complete.
-    // https://eprint.iacr.org/2015/1060, algorithm 3
-    // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
-    double() {
-      const { a: r, b: s } = e, n = t.mul(s, W), { px: o, py: a, pz: d } = this;
-      let c = t.ZERO, l = t.ZERO, h = t.ZERO, f = t.mul(o, o), B = t.mul(a, a), g = t.mul(d, d), m = t.mul(o, a);
-      return m = t.add(m, m), h = t.mul(o, d), h = t.add(h, h), c = t.mul(r, h), l = t.mul(n, g), l = t.add(c, l), c = t.sub(B, l), l = t.add(B, l), l = t.mul(c, l), c = t.mul(m, c), h = t.mul(n, h), g = t.mul(r, g), m = t.sub(f, g), m = t.mul(r, m), m = t.add(m, h), h = t.add(f, f), f = t.add(h, f), f = t.add(f, g), f = t.mul(f, m), l = t.add(l, f), g = t.mul(a, d), g = t.add(g, g), f = t.mul(g, m), c = t.sub(c, f), h = t.mul(g, B), h = t.add(h, h), h = t.add(h, h), new y(c, l, h);
-    }
-    // Renes-Costello-Batina exception-free addition formula.
-    // There is 30% faster Jacobian formula, but it is not complete.
-    // https://eprint.iacr.org/2015/1060, algorithm 1
-    // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
-    add(r) {
-      G(r);
-      const { px: s, py: n, pz: o } = this, { px: a, py: d, pz: c } = r;
-      let l = t.ZERO, h = t.ZERO, f = t.ZERO;
-      const B = e.a, g = t.mul(e.b, W);
-      let m = t.mul(s, a), R = t.mul(n, d), O = t.mul(o, c), A = t.add(s, n), E = t.add(a, d);
-      A = t.mul(A, E), E = t.add(m, R), A = t.sub(A, E), E = t.add(s, o);
-      let Z = t.add(a, c);
-      return E = t.mul(E, Z), Z = t.add(m, O), E = t.sub(E, Z), Z = t.add(n, o), l = t.add(d, c), Z = t.mul(Z, l), l = t.add(R, O), Z = t.sub(Z, l), f = t.mul(B, E), l = t.mul(g, O), f = t.add(l, f), l = t.sub(R, f), f = t.add(R, f), h = t.mul(l, f), R = t.add(m, m), R = t.add(R, m), O = t.mul(B, O), E = t.mul(g, E), R = t.add(R, O), O = t.sub(m, O), O = t.mul(B, O), E = t.add(E, O), m = t.mul(R, E), h = t.add(h, m), m = t.mul(Z, E), l = t.mul(A, l), l = t.sub(l, m), m = t.mul(A, R), f = t.mul(Z, f), f = t.add(f, m), new y(l, h, f);
-    }
-    subtract(r) {
-      return this.add(r.negate());
-    }
-    is0() {
-      return this.equals(y.ZERO);
-    }
-    /**
-     * Constant time multiplication.
-     * Uses wNAF method. Windowed method may be 10% faster,
-     * but takes 2x longer to generate and consumes 2x memory.
-     * Uses precomputes when available.
-     * Uses endomorphism for Koblitz curves.
-     * @param scalar by which the point would be multiplied
-     * @returns New point
-     */
-    multiply(r) {
-      const { endo: s } = i;
-      if (!w.isValidNot0(r))
-        throw new Error("invalid scalar: out of range");
-      let n, o;
-      const a = (d) => _.wNAFCached(this, d, y.normalizeZ);
-      if (s) {
-        const { k1neg: d, k1: c, k2neg: l, k2: h } = s.splitScalar(r), { p: f, f: B } = a(c), { p: g, f: m } = a(h);
-        o = B.add(m), n = $(s.beta, f, g, d, l);
-      } else {
-        const { p: d, f: c } = a(r);
-        n = d, o = c;
-      }
-      return y.normalizeZ([n, o])[0];
-    }
-    /**
-     * Non-constant-time multiplication. Uses double-and-add algorithm.
-     * It's faster, but should only be used when you don't care about
-     * an exposed private key e.g. sig verification, which works over *public* keys.
-     */
-    multiplyUnsafe(r) {
-      const { endo: s } = i, n = this;
-      if (!w.isValid(r))
-        throw new Error("invalid scalar: out of range");
-      if (r === U || n.is0())
-        return y.ZERO;
-      if (r === k)
-        return n;
-      if (_.hasPrecomputes(this))
-        return this.multiply(r);
-      if (s) {
-        const { k1neg: o, k1: a, k2neg: d, k2: c } = s.splitScalar(r), { p1: l, p2: h } = Et(y, n, a, c);
-        return $(s.beta, l, h, o, d);
-      } else
-        return _.wNAFCachedUnsafe(n, r);
-    }
-    multiplyAndAddUnsafe(r, s, n) {
-      const o = this.multiplyUnsafe(s).add(r.multiplyUnsafe(n));
-      return o.is0() ? void 0 : o;
-    }
-    /**
-     * Converts Projective point to affine (x, y) coordinates.
-     * @param invertedZ Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch
-     */
-    toAffine(r) {
-      return X(this, r);
-    }
-    /**
-     * Checks whether Point is free of torsion elements (is in prime subgroup).
-     * Always torsion-free for cofactor=1 curves.
-     */
-    isTorsionFree() {
-      const { isTorsionFree: r } = i;
-      return p === k ? !0 : r ? r(y, this) : _.wNAFCachedUnsafe(this, b).is0();
-    }
-    clearCofactor() {
-      const { clearCofactor: r } = i;
-      return p === k ? this : r ? r(y, this) : this.multiplyUnsafe(p);
-    }
-    toBytes(r = !0) {
-      return Q("isCompressed", r), this.assertValidity(), q(y, this, r);
-    }
-    /** @deprecated use `toBytes` */
-    toRawBytes(r = !0) {
-      return this.toBytes(r);
-    }
-    toHex(r = !0) {
-      return rt(this.toBytes(r));
-    }
-    toString() {
-      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
-    }
-  }
-  y.BASE = new y(e.Gx, e.Gy, t.ONE), y.ZERO = new y(t.ZERO, t.ONE, t.ZERO), y.Fp = t, y.Fn = w;
-  const P = w.BITS, _ = yt(y, i.endo ? Math.ceil(P / 2) : P);
-  return y;
 }
-function ut(e) {
-  return Uint8Array.of(e ? 2 : 3);
+const N = /* @__PURE__ */ new WeakMap(), M = /* @__PURE__ */ new WeakMap();
+function A(t) {
+  return M.get(t) || 1;
 }
-function Nt(e, i, t = {}) {
-  at(i, { hash: "function" }, {
-    hmac: "function",
-    lowS: "boolean",
-    randomBytes: "function",
-    bits2int: "function",
-    bits2int_modN: "function"
-  });
-  const w = i.randomBytes || St, p = i.hmac || ((n, ...o) => dt(i.hash, n, I(...o))), { Fp: b, Fn: u } = e, { ORDER: x, BITS: S } = u;
-  function N(n) {
-    const o = x >> k;
-    return n > o;
-  }
-  function q(n) {
-    return N(n) ? u.neg(n) : n;
-  }
-  function C(n, o) {
-    if (!u.isValidNot0(o))
-      throw new Error(`invalid signature ${n}: out of range 1..CURVE.n`);
-  }
-  class T {
-    constructor(o, a, d) {
-      C("r", o), C("s", a), this.r = o, this.s = a, d != null && (this.recovery = d), Object.freeze(this);
-    }
-    // pair (bytes of r, bytes of s)
-    static fromCompact(o) {
-      const a = u.BYTES, d = z("compactSignature", o, a * 2);
-      return new T(u.fromBytes(d.subarray(0, a)), u.fromBytes(d.subarray(a, a * 2)));
-    }
-    // DER encoded ECDSA signature
-    // https://bitcoin.stackexchange.com/questions/57644/what-are-the-parts-of-a-bitcoin-transaction-input-script
-    static fromDER(o) {
-      const { r: a, s: d } = F.toSig(z("DER", o));
-      return new T(a, d);
-    }
+function S(t) {
+  if (t !== g)
+    throw new Error("invalid wNAF");
+}
+function U(t, r) {
+  return {
+    constTimeNegate: b,
+    hasPrecomputes(e) {
+      return A(e) !== 1;
+    },
+    // non-const time multiplication ladder
+    unsafeLadder(e, n, i = t.ZERO) {
+      let o = e;
+      for (; n > g; )
+        n & h && (i = i.add(o)), o = o.double(), n >>= h;
+      return i;
+    },
     /**
-     * @todo remove
-     * @deprecated
+     * Creates a wNAF precomputation window. Used for caching.
+     * Default window size is set by `utils.precompute()` and is equal to 8.
+     * Number of precomputed points depends on the curve size:
+     * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+     * - 𝑊 is the window size
+     * - 𝑛 is the bitlength of the curve order.
+     * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+     * @param elm Point instance
+     * @param W window size
+     * @returns precomputed point tables flattened to a single array
      */
-    assertValidity() {
-    }
-    addRecoveryBit(o) {
-      return new T(this.r, this.s, o);
-    }
-    // ProjPointType<bigint>
-    recoverPublicKey(o) {
-      const a = b.ORDER, { r: d, s: c, recovery: l } = this;
-      if (l == null || ![0, 1, 2, 3].includes(l))
-        throw new Error("recovery id invalid");
-      if (x * At < a && l > 1)
-        throw new Error("recovery id is ambiguous for h>1 curve");
-      const f = l === 2 || l === 3 ? d + x : d;
-      if (!b.isValid(f))
-        throw new Error("recovery id 2 or 3 invalid");
-      const B = b.toBytes(f), g = e.fromHex(I(ut((l & 1) === 0), B)), m = u.inv(f), R = V(z("msgHash", o)), O = u.create(-R * m), A = u.create(c * m), E = e.BASE.multiplyUnsafe(O).add(g.multiplyUnsafe(A));
-      if (E.is0())
-        throw new Error("point at infinify");
-      return E.assertValidity(), E;
-    }
-    // Signatures should be low-s, to prevent malleability.
-    hasHighS() {
-      return N(this.s);
-    }
-    normalizeS() {
-      return this.hasHighS() ? new T(this.r, u.neg(this.s), this.recovery) : this;
-    }
-    toBytes(o) {
-      if (o === "compact")
-        return I(u.toBytes(this.r), u.toBytes(this.s));
-      if (o === "der")
-        return xt(F.hexFromSig(this));
-      throw new Error("invalid format");
-    }
-    // DER-encoded
-    toDERRawBytes() {
-      return this.toBytes("der");
-    }
-    toDERHex() {
-      return rt(this.toBytes("der"));
-    }
-    // padded bytes of r, then padded bytes of s
-    toCompactRawBytes() {
-      return this.toBytes("compact");
-    }
-    toCompactHex() {
-      return rt(this.toBytes("compact"));
-    }
-  }
-  const L = lt(u, t.allowedPrivateKeyLengths, t.wrapPrivateKey), J = {
-    isValidPrivateKey(n) {
-      try {
-        return L(n), !0;
-      } catch {
-        return !1;
+    precomputeWindow(e, n) {
+      const { windows: i, windowSize: o } = E(n, r), s = [];
+      let f = e, a = f;
+      for (let d = 0; d < i; d++) {
+        a = f, s.push(a);
+        for (let c = 1; c < o; c++)
+          a = a.add(f), s.push(a);
+        f = a.double();
       }
+      return s;
     },
-    normPrivateKeyToScalar: L,
     /**
-     * Produces cryptographically secure private key from random of size
-     * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.
+     * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+     * @param W window size
+     * @param precomputes precomputed tables
+     * @param n scalar (we don't check here, but should be less than curve order)
+     * @returns real and fake (for const-time) points
      */
-    randomPrivateKey: () => {
-      const n = x;
-      return vt(w(Bt(n)), n);
+    wNAF(e, n, i) {
+      let o = t.ZERO, s = t.BASE;
+      const f = E(e, r);
+      for (let a = 0; a < f.windows; a++) {
+        const { nextN: d, offset: c, isZero: p, isNeg: l, isNegF: u, offsetF: m } = v(i, a, f);
+        i = d, p ? s = s.add(b(u, n[m])) : o = o.add(b(l, n[c]));
+      }
+      return S(i), { p: o, f: s };
     },
-    precompute(n = 8, o = e.BASE) {
-      return o.precompute(n, !1);
-    }
-  };
-  function tt(n, o = !0) {
-    return e.fromPrivateKey(n).toBytes(o);
-  }
-  function K(n) {
-    if (typeof n == "bigint")
-      return !1;
-    if (n instanceof e)
-      return !0;
-    const a = z("key", n).length, d = b.BYTES, c = d + 1, l = 2 * d + 1;
-    if (!(t.allowedPrivateKeyLengths || u.BYTES === c))
-      return a === c || a === l;
-  }
-  function G(n, o, a = !0) {
-    if (K(n) === !0)
-      throw new Error("first arg must be private key");
-    if (K(o) === !1)
-      throw new Error("second arg must be public key");
-    return e.fromHex(o).multiply(L(n)).toBytes(a);
-  }
-  const X = i.bits2int || function(n) {
-    if (n.length > 8192)
-      throw new Error("input is too large");
-    const o = ct(n), a = n.length * 8 - S;
-    return a > 0 ? o >> BigInt(a) : o;
-  }, V = i.bits2int_modN || function(n) {
-    return u.create(X(n));
-  }, $ = ft(S);
-  function y(n) {
-    return mt("num < 2^" + S, n, U, $), u.toBytes(n);
-  }
-  function P(n, o, a = _) {
-    if (["recovered", "canonical"].some((A) => A in a))
-      throw new Error("sign() legacy options not supported");
-    const { hash: d } = i;
-    let { lowS: c, prehash: l, extraEntropy: h } = a;
-    c == null && (c = !0), n = z("msgHash", n), st(a), l && (n = z("prehashed msgHash", d(n)));
-    const f = V(n), B = L(o), g = [y(B), y(f)];
-    if (h != null && h !== !1) {
-      const A = h === !0 ? w(b.BYTES) : h;
-      g.push(z("extraEntropy", A));
-    }
-    const m = I(...g), R = f;
-    function O(A) {
-      const E = X(A);
-      if (!u.isValidNot0(E))
-        return;
-      const Z = u.inv(E), j = e.BASE.multiply(E).toAffine(), Y = u.create(j.x);
-      if (Y === U)
-        return;
-      const H = u.create(Z * u.create(R + Y * B));
-      if (H === U)
-        return;
-      let et = (j.x === Y ? 0 : 2) | Number(j.y & k), D = H;
-      return c && N(H) && (D = q(H), et ^= 1), new T(Y, D, et);
-    }
-    return { seed: m, k2sig: O };
-  }
-  const _ = { lowS: i.lowS, prehash: !1 }, v = { lowS: i.lowS, prehash: !1 };
-  function r(n, o, a = _) {
-    const { seed: d, k2sig: c } = P(n, o, a);
-    return ht(i.hash.outputLen, u.BYTES, p)(d, c);
-  }
-  e.BASE.precompute(8);
-  function s(n, o, a, d = v) {
-    const c = n;
-    o = z("msgHash", o), a = z("publicKey", a), st(d);
-    const { lowS: l, prehash: h, format: f } = d;
-    if ("strict" in d)
-      throw new Error("options.strict was renamed to lowS");
-    if (f !== void 0 && !["compact", "der", "js"].includes(f))
-      throw new Error('format must be "compact", "der" or "js"');
-    const B = typeof c == "string" || Rt(c), g = !B && !f && typeof c == "object" && c !== null && typeof c.r == "bigint" && typeof c.s == "bigint";
-    if (!B && !g)
-      throw new Error("invalid signature, expected Uint8Array, hex string or Signature instance");
-    let m, R;
-    try {
-      if (g)
-        if (f === void 0 || f === "js")
-          m = new T(c.r, c.s);
-        else
-          throw new Error("invalid format");
-      if (B) {
-        try {
-          f !== "compact" && (m = T.fromDER(c));
-        } catch (D) {
-          if (!(D instanceof F.Err))
-            throw D;
+    /**
+     * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.
+     * @param W window size
+     * @param precomputes precomputed tables
+     * @param n scalar (we don't check here, but should be less than curve order)
+     * @param acc accumulator point to add result of multiplication
+     * @returns point
+     */
+    wNAFUnsafe(e, n, i, o = t.ZERO) {
+      const s = E(e, r);
+      for (let f = 0; f < s.windows && i !== g; f++) {
+        const { nextN: a, offset: d, isZero: c, isNeg: p } = v(i, f, s);
+        if (i = a, !c) {
+          const l = n[d];
+          o = o.add(p ? l.negate() : l);
         }
-        !m && f !== "der" && (m = T.fromCompact(c));
       }
-      R = e.fromHex(a);
-    } catch {
-      return !1;
+      return S(i), o;
+    },
+    getPrecomputes(e, n, i) {
+      let o = N.get(n);
+      return o || (o = this.precomputeWindow(n, e), e !== 1 && (typeof i == "function" && (o = i(o)), N.set(n, o))), o;
+    },
+    wNAFCached(e, n, i) {
+      const o = A(e);
+      return this.wNAF(o, this.getPrecomputes(o, e, i), n);
+    },
+    wNAFCachedUnsafe(e, n, i, o) {
+      const s = A(e);
+      return s === 1 ? this.unsafeLadder(e, n, o) : this.wNAFUnsafe(s, this.getPrecomputes(s, e, i), n, o);
+    },
+    // We calculate precomputes for elliptic curve point multiplication
+    // using windowed method. This specifies window size and
+    // stores precomputed values. Usually only base point would be precomputed.
+    setWindowSize(e, n) {
+      I(n, r), M.set(e, n), N.delete(e);
     }
-    if (!m || l && m.hasHighS())
-      return !1;
-    h && (o = i.hash(o));
-    const { r: O, s: A } = m, E = V(o), Z = u.inv(A), j = u.create(E * Z), Y = u.create(O * Z), H = e.BASE.multiplyUnsafe(j).add(R.multiplyUnsafe(Y));
-    return H.is0() ? !1 : u.create(H.x) === O;
-  }
-  return Object.freeze({
-    getPublicKey: tt,
-    getSharedSecret: G,
-    sign: r,
-    verify: s,
-    utils: J,
-    Point: e,
-    Signature: T
-  });
-}
-function Ft(e) {
-  const i = {
-    a: e.a,
-    b: e.b,
-    p: e.Fp.ORDER,
-    n: e.n,
-    h: e.h,
-    Gx: e.Gx,
-    Gy: e.Gy
-  }, t = e.Fp, w = bt(i.n, e.nBitLength), p = {
-    Fp: t,
-    Fn: w,
-    allowedPrivateKeyLengths: e.allowedPrivateKeyLengths,
-    allowInfinityPoint: e.allowInfinityPoint,
-    endo: e.endo,
-    wrapPrivateKey: e.wrapPrivateKey,
-    isTorsionFree: e.isTorsionFree,
-    clearCofactor: e.clearCofactor,
-    fromBytes: e.fromBytes,
-    toBytes: e.toBytes
   };
-  return { CURVE: i, curveOpts: p };
 }
-function Lt(e) {
-  const { CURVE: i, curveOpts: t } = Ft(e), w = {
-    hash: e.hash,
-    hmac: e.hmac,
-    randomBytes: e.randomBytes,
-    lowS: e.lowS,
-    bits2int: e.bits2int,
-    bits2int_modN: e.bits2int_modN
-  };
-  return { CURVE: i, curveOpts: t, ecdsaOpts: w };
+function $(t, r, e, n) {
+  let i = r, o = t.ZERO, s = t.ZERO;
+  for (; e > g || n > g; )
+    e & h && (o = o.add(i)), n & h && (s = s.add(i)), i = i.double(), e >>= h, n >>= h;
+  return { p1: o, p2: s };
 }
-function _t(e, i) {
-  return Object.assign({}, i, {
-    ProjectivePoint: i.Point,
-    CURVE: e
-  });
+function D(t, r, e, n) {
+  j(e, t), _(n, r);
+  const i = e.length, o = n.length;
+  if (i !== o)
+    throw new Error("arrays of points and scalars must have equal length");
+  const s = t.ZERO, f = B(BigInt(i));
+  let a = 1;
+  f > 12 ? a = f - 3 : f > 4 ? a = f - 2 : f > 0 && (a = 2);
+  const d = z(a), c = new Array(Number(d) + 1).fill(s), p = Math.floor((r.BITS - 1) / a) * a;
+  let l = s;
+  for (let u = p; u >= 0; u -= a) {
+    c.fill(s);
+    for (let w = 0; w < o; w++) {
+      const F = n[w], y = Number(F >> BigInt(u) & d);
+      c[y] = c[y].add(e[w]);
+    }
+    let m = s;
+    for (let w = c.length - 1, F = s; w > 0; w--)
+      F = F.add(c[w]), m = m.add(F);
+    if (l = l.add(m), u !== 0)
+      for (let w = 0; w < a; w++)
+        l = l.double();
+  }
+  return l;
+}
+function x(t, r) {
+  if (r) {
+    if (r.ORDER !== t)
+      throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
+    return Z(r), r;
+  } else
+    return O(t);
 }
-function It(e) {
-  const { CURVE: i, curveOpts: t, ecdsaOpts: w } = Lt(e), p = zt(i, t), b = Nt(p, w, t);
-  return _t(e, b);
+function G(t, r, e = {}) {
+  if (!r || typeof r != "object")
+    throw new Error(`expected valid ${t} CURVE object`);
+  for (const f of ["p", "n", "h"]) {
+    const a = r[f];
+    if (!(typeof a == "bigint" && a > g))
+      throw new Error(`CURVE.${f} must be positive bigint`);
+  }
+  const n = x(r.p, e.Fp), i = x(r.n, e.Fn), s = ["Gx", "Gy", "a", "b"];
+  for (const f of s)
+    if (!n.isValid(r[f]))
+      throw new Error(`CURVE.${f} must be valid field element of CURVE.Fp`);
+  return { Fp: n, Fn: i };
 }
 export {
-  F as DER,
-  Ot as DERErr,
-  Tt as _legacyHelperEquat,
-  lt as _legacyHelperNormPriv,
-  Nt as ecdsa,
-  It as weierstrass,
-  zt as weierstrassN
+  G as _createCurveFields,
+  $ as mulEndoUnsafe,
+  b as negateCt,
+  L as normalizeZ,
+  D as pippenger,
+  U as wNAF
 };