@gardenfi/utils 2.5.3-beta.0 → 2.5.3-beta.2

package/dist/index300.js

@@ -1,791 +0,0 @@
-import { hmac as vt } from "./index294.js";
-import { ahash as Bt, randomBytes as yt, concatBytes as I, bytesToHex as et, hexToBytes as lt, isBytes as Rt } from "./index287.js";
-import { _validateObject as mt, bytesToNumberBE as wt, bitMask as pt, _abool2 as rt, _abytes2 as k, ensureBytes as N, memoized as dt, createHmacDrbg as St, numberToHexUnpadded as J, bitLen as xt, aInRange as Ot } from "./index301.js";
-import { _createCurveFields as Zt, wNAF as At, normalizeZ as st, mulEndoUnsafe as Ut, pippenger as Ft, negateCt as ft } from "./index302.js";
-import { nLength as Vt, Field as Yt, getMinHashLength as Kt, mapHashToField as Nt } from "./index282.js";
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-const ht = (r, s) => (r + (r >= 0 ? s : -s) / gt) / s;
-function Tt(r, s, c) {
-  const [[t, m], [w, l]] = s, V = ht(l * r, c), B = ht(-m * r, c);
-  let A = r - V * t - B * w, U = -V * m - B * l;
-  const D = A < L, X = U < L;
-  D && (A = -A), X && (U = -U);
-  const E = pt(Math.ceil(xt(c) / 2)) + $;
-  if (A < L || A >= E || U < L || U >= E)
-    throw new Error("splitScalar (endomorphism): failed, k=" + r);
-  return { k1neg: D, k1: A, k2neg: X, k2: U };
-}
-function ct(r) {
-  if (!["compact", "recovered", "der"].includes(r))
-    throw new Error('Signature format must be "compact", "recovered", or "der"');
-  return r;
-}
-function it(r, s) {
-  const c = {};
-  for (let t of Object.keys(s))
-    c[t] = r[t] === void 0 ? s[t] : r[t];
-  return rt(c.lowS, "lowS"), rt(c.prehash, "prehash"), c.format !== void 0 && ct(c.format), c;
-}
-class Ht extends Error {
-  constructor(s = "") {
-    super(s);
-  }
-}
-const C = {
-  // asn.1 DER encoding utils
-  Err: Ht,
-  // Basic building block is TLV (Tag-Length-Value)
-  _tlv: {
-    encode: (r, s) => {
-      const { Err: c } = C;
-      if (r < 0 || r > 256)
-        throw new c("tlv.encode: wrong tag");
-      if (s.length & 1)
-        throw new c("tlv.encode: unpadded data");
-      const t = s.length / 2, m = J(t);
-      if (m.length / 2 & 128)
-        throw new c("tlv.encode: long form length too big");
-      const w = t > 127 ? J(m.length / 2 | 128) : "";
-      return J(r) + w + m + s;
-    },
-    // v - value, l - left bytes (unparsed)
-    decode(r, s) {
-      const { Err: c } = C;
-      let t = 0;
-      if (r < 0 || r > 256)
-        throw new c("tlv.encode: wrong tag");
-      if (s.length < 2 || s[t++] !== r)
-        throw new c("tlv.decode: wrong tlv");
-      const m = s[t++], w = !!(m & 128);
-      let l = 0;
-      if (!w)
-        l = m;
-      else {
-        const B = m & 127;
-        if (!B)
-          throw new c("tlv.decode(long): indefinite length not supported");
-        if (B > 4)
-          throw new c("tlv.decode(long): byte length is too big");
-        const A = s.subarray(t, t + B);
-        if (A.length !== B)
-          throw new c("tlv.decode: length bytes not complete");
-        if (A[0] === 0)
-          throw new c("tlv.decode(long): zero leftmost byte");
-        for (const U of A)
-          l = l << 8 | U;
-        if (t += B, l < 128)
-          throw new c("tlv.decode(long): not minimal encoding");
-      }
-      const V = s.subarray(t, t + l);
-      if (V.length !== l)
-        throw new c("tlv.decode: wrong value length");
-      return { v: V, l: s.subarray(t + l) };
-    }
-  },
-  // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,
-  // since we always use positive integers here. It must always be empty:
-  // - add zero byte if exists
-  // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
-  _int: {
-    encode(r) {
-      const { Err: s } = C;
-      if (r < L)
-        throw new s("integer: negative integers are not allowed");
-      let c = J(r);
-      if (Number.parseInt(c[0], 16) & 8 && (c = "00" + c), c.length & 1)
-        throw new s("unexpected DER parsing assertion: unpadded hex");
-      return c;
-    },
-    decode(r) {
-      const { Err: s } = C;
-      if (r[0] & 128)
-        throw new s("invalid signature integer: negative");
-      if (r[0] === 0 && !(r[1] & 128))
-        throw new s("invalid signature integer: unnecessary leading zero");
-      return wt(r);
-    }
-  },
-  toSig(r) {
-    const { Err: s, _int: c, _tlv: t } = C, m = N("signature", r), { v: w, l } = t.decode(48, m);
-    if (l.length)
-      throw new s("invalid signature: left bytes after parsing");
-    const { v: V, l: B } = t.decode(2, w), { v: A, l: U } = t.decode(2, B);
-    if (U.length)
-      throw new s("invalid signature: left bytes after parsing");
-    return { r: c.decode(V), s: c.decode(A) };
-  },
-  hexFromSig(r) {
-    const { _tlv: s, _int: c } = C, t = s.encode(2, c.encode(r.r)), m = s.encode(2, c.encode(r.s)), w = t + m;
-    return s.encode(48, w);
-  }
-}, L = BigInt(0), $ = BigInt(1), gt = BigInt(2), tt = BigInt(3), _t = BigInt(4);
-function M(r, s) {
-  const { BYTES: c } = r;
-  let t;
-  if (typeof s == "bigint")
-    t = s;
-  else {
-    let m = N("private key", s);
-    try {
-      t = r.fromBytes(m);
-    } catch {
-      throw new Error(`invalid private key: expected ui8a of size ${c}, got ${typeof s}`);
-    }
-  }
-  if (!r.isValidNot0(t))
-    throw new Error("invalid private key: out of range [1..N-1]");
-  return t;
-}
-function Ct(r, s = {}) {
-  const c = Zt("weierstrass", r, s), { Fp: t, Fn: m } = c;
-  let w = c.CURVE;
-  const { h: l, n: V } = w;
-  mt(s, {}, {
-    allowInfinityPoint: "boolean",
-    clearCofactor: "function",
-    isTorsionFree: "function",
-    fromBytes: "function",
-    toBytes: "function",
-    endo: "object",
-    wrapPrivateKey: "boolean"
-  });
-  const { endo: B } = s;
-  if (B && (!t.is0(w.a) || typeof B.beta != "bigint" || !Array.isArray(B.basises)))
-    throw new Error('invalid endo: expected "beta": bigint and "basises": array');
-  const A = bt(t, m);
-  function U() {
-    if (!t.isOdd)
-      throw new Error("compression is not supported: Field does not have .isOdd()");
-  }
-  function D(b, o, n) {
-    const { x: e, y: i } = o.toAffine(), a = t.toBytes(e);
-    if (rt(n, "isCompressed"), n) {
-      U();
-      const f = !t.isOdd(i);
-      return I(Et(f), a);
-    } else
-      return I(Uint8Array.of(4), a, t.toBytes(i));
-  }
-  function X(b) {
-    k(b, void 0, "Point");
-    const { publicKey: o, publicKeyUncompressed: n } = A, e = b.length, i = b[0], a = b.subarray(1);
-    if (e === o && (i === 2 || i === 3)) {
-      const f = t.fromBytes(a);
-      if (!t.isValid(f))
-        throw new Error("bad point: is not on curve, wrong x");
-      const d = T(f);
-      let u;
-      try {
-        u = t.sqrt(d);
-      } catch (O) {
-        const v = O instanceof Error ? ": " + O.message : "";
-        throw new Error("bad point: is not on curve, sqrt error" + v);
-      }
-      U();
-      const h = t.isOdd(u);
-      return (i & 1) === 1 !== h && (u = t.neg(u)), { x: f, y: u };
-    } else if (e === n && i === 4) {
-      const f = t.BYTES, d = t.fromBytes(a.subarray(0, f)), u = t.fromBytes(a.subarray(f, f * 2));
-      if (!H(d, u))
-        throw new Error("bad point: is not on curve");
-      return { x: d, y: u };
-    } else
-      throw new Error(`bad point: got length ${e}, expected compressed=${o} or uncompressed=${n}`);
-  }
-  const E = s.toBytes || D, x = s.fromBytes || X;
-  function T(b) {
-    const o = t.sqr(b), n = t.mul(o, b);
-    return t.add(t.add(n, t.mul(b, w.a)), w.b);
-  }
-  function H(b, o) {
-    const n = t.sqr(o), e = T(b);
-    return t.eql(n, e);
-  }
-  if (!H(w.Gx, w.Gy))
-    throw new Error("bad curve params: generator point");
-  const _ = t.mul(t.pow(w.a, tt), _t), nt = t.mul(t.sqr(w.b), BigInt(27));
-  if (t.is0(t.add(_, nt)))
-    throw new Error("bad curve params: a or b");
-  function F(b, o, n = !1) {
-    if (!t.isValid(o) || n && t.is0(o))
-      throw new Error(`bad point coordinate ${b}`);
-    return o;
-  }
-  function G(b) {
-    if (!(b instanceof p))
-      throw new Error("ProjectivePoint expected");
-  }
-  function j(b) {
-    if (!B || !B.basises)
-      throw new Error("no endo");
-    return Tt(b, B.basises, m.ORDER);
-  }
-  const ot = dt((b, o) => {
-    const { X: n, Y: e, Z: i } = b;
-    if (t.eql(i, t.ONE))
-      return { x: n, y: e };
-    const a = b.is0();
-    o == null && (o = a ? t.ONE : t.inv(i));
-    const f = t.mul(n, o), d = t.mul(e, o), u = t.mul(i, o);
-    if (a)
-      return { x: t.ZERO, y: t.ZERO };
-    if (!t.eql(u, t.ONE))
-      throw new Error("invZ was invalid");
-    return { x: f, y: d };
-  }), P = dt((b) => {
-    if (b.is0()) {
-      if (s.allowInfinityPoint && !t.is0(b.Y))
-        return;
-      throw new Error("bad point: ZERO");
-    }
-    const { x: o, y: n } = b.toAffine();
-    if (!t.isValid(o) || !t.isValid(n))
-      throw new Error("bad point: x or y not field elements");
-    if (!H(o, n))
-      throw new Error("bad point: equation left != right");
-    if (!b.isTorsionFree())
-      throw new Error("bad point: not in prime-order subgroup");
-    return !0;
-  });
-  function z(b, o, n, e, i) {
-    return n = new p(t.mul(n.X, b), n.Y, n.Z), o = ft(e, o), n = ft(i, n), o.add(n);
-  }
-  class p {
-    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
-    constructor(o, n, e) {
-      this.X = F("x", o), this.Y = F("y", n, !0), this.Z = F("z", e), Object.freeze(this);
-    }
-    static CURVE() {
-      return w;
-    }
-    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
-    static fromAffine(o) {
-      const { x: n, y: e } = o || {};
-      if (!o || !t.isValid(n) || !t.isValid(e))
-        throw new Error("invalid affine point");
-      if (o instanceof p)
-        throw new Error("projective point not allowed");
-      return t.is0(n) && t.is0(e) ? p.ZERO : new p(n, e, t.ONE);
-    }
-    static fromBytes(o) {
-      const n = p.fromAffine(x(k(o, void 0, "point")));
-      return n.assertValidity(), n;
-    }
-    static fromHex(o) {
-      return p.fromBytes(N("pointHex", o));
-    }
-    get x() {
-      return this.toAffine().x;
-    }
-    get y() {
-      return this.toAffine().y;
-    }
-    /**
-     *
-     * @param windowSize
-     * @param isLazy true will defer table computation until the first multiplication
-     * @returns
-     */
-    precompute(o = 8, n = !0) {
-      return q.createCache(this, o), n || this.multiply(tt), this;
-    }
-    // TODO: return `this`
-    /** A point on curve is valid if it conforms to equation. */
-    assertValidity() {
-      P(this);
-    }
-    hasEvenY() {
-      const { y: o } = this.toAffine();
-      if (!t.isOdd)
-        throw new Error("Field doesn't support isOdd");
-      return !t.isOdd(o);
-    }
-    /** Compare one point to another. */
-    equals(o) {
-      G(o);
-      const { X: n, Y: e, Z: i } = this, { X: a, Y: f, Z: d } = o, u = t.eql(t.mul(n, d), t.mul(a, i)), h = t.eql(t.mul(e, d), t.mul(f, i));
-      return u && h;
-    }
-    /** Flips point to one corresponding to (x, -y) in Affine coordinates. */
-    negate() {
-      return new p(this.X, t.neg(this.Y), this.Z);
-    }
-    // Renes-Costello-Batina exception-free doubling formula.
-    // There is 30% faster Jacobian formula, but it is not complete.
-    // https://eprint.iacr.org/2015/1060, algorithm 3
-    // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
-    double() {
-      const { a: o, b: n } = w, e = t.mul(n, tt), { X: i, Y: a, Z: f } = this;
-      let d = t.ZERO, u = t.ZERO, h = t.ZERO, y = t.mul(i, i), O = t.mul(a, a), v = t.mul(f, f), g = t.mul(i, a);
-      return g = t.add(g, g), h = t.mul(i, f), h = t.add(h, h), d = t.mul(o, h), u = t.mul(e, v), u = t.add(d, u), d = t.sub(O, u), u = t.add(O, u), u = t.mul(d, u), d = t.mul(g, d), h = t.mul(e, h), v = t.mul(o, v), g = t.sub(y, v), g = t.mul(o, g), g = t.add(g, h), h = t.add(y, y), y = t.add(h, y), y = t.add(y, v), y = t.mul(y, g), u = t.add(u, y), v = t.mul(a, f), v = t.add(v, v), y = t.mul(v, g), d = t.sub(d, y), h = t.mul(v, O), h = t.add(h, h), h = t.add(h, h), new p(d, u, h);
-    }
-    // Renes-Costello-Batina exception-free addition formula.
-    // There is 30% faster Jacobian formula, but it is not complete.
-    // https://eprint.iacr.org/2015/1060, algorithm 1
-    // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
-    add(o) {
-      G(o);
-      const { X: n, Y: e, Z: i } = this, { X: a, Y: f, Z: d } = o;
-      let u = t.ZERO, h = t.ZERO, y = t.ZERO;
-      const O = w.a, v = t.mul(w.b, tt);
-      let g = t.mul(n, a), R = t.mul(e, f), Z = t.mul(i, d), K = t.add(n, e), S = t.add(a, f);
-      K = t.mul(K, S), S = t.add(g, R), K = t.sub(K, S), S = t.add(n, i);
-      let Y = t.add(a, d);
-      return S = t.mul(S, Y), Y = t.add(g, Z), S = t.sub(S, Y), Y = t.add(e, i), u = t.add(f, d), Y = t.mul(Y, u), u = t.add(R, Z), Y = t.sub(Y, u), y = t.mul(O, S), u = t.mul(v, Z), y = t.add(u, y), u = t.sub(R, y), y = t.add(R, y), h = t.mul(u, y), R = t.add(g, g), R = t.add(R, g), Z = t.mul(O, Z), S = t.mul(v, S), R = t.add(R, Z), Z = t.sub(g, Z), Z = t.mul(O, Z), S = t.add(S, Z), g = t.mul(R, S), h = t.add(h, g), g = t.mul(Y, S), u = t.mul(K, u), u = t.sub(u, g), g = t.mul(K, R), y = t.mul(Y, y), y = t.add(y, g), new p(u, h, y);
-    }
-    subtract(o) {
-      return this.add(o.negate());
-    }
-    is0() {
-      return this.equals(p.ZERO);
-    }
-    /**
-     * Constant time multiplication.
-     * Uses wNAF method. Windowed method may be 10% faster,
-     * but takes 2x longer to generate and consumes 2x memory.
-     * Uses precomputes when available.
-     * Uses endomorphism for Koblitz curves.
-     * @param scalar by which the point would be multiplied
-     * @returns New point
-     */
-    multiply(o) {
-      const { endo: n } = s;
-      if (!m.isValidNot0(o))
-        throw new Error("invalid scalar: out of range");
-      let e, i;
-      const a = (f) => q.cached(this, f, (d) => st(p, d));
-      if (n) {
-        const { k1neg: f, k1: d, k2neg: u, k2: h } = j(o), { p: y, f: O } = a(d), { p: v, f: g } = a(h);
-        i = O.add(g), e = z(n.beta, y, v, f, u);
-      } else {
-        const { p: f, f: d } = a(o);
-        e = f, i = d;
-      }
-      return st(p, [e, i])[0];
-    }
-    /**
-     * Non-constant-time multiplication. Uses double-and-add algorithm.
-     * It's faster, but should only be used when you don't care about
-     * an exposed secret key e.g. sig verification, which works over *public* keys.
-     */
-    multiplyUnsafe(o) {
-      const { endo: n } = s, e = this;
-      if (!m.isValid(o))
-        throw new Error("invalid scalar: out of range");
-      if (o === L || e.is0())
-        return p.ZERO;
-      if (o === $)
-        return e;
-      if (q.hasCache(this))
-        return this.multiply(o);
-      if (n) {
-        const { k1neg: i, k1: a, k2neg: f, k2: d } = j(o), { p1: u, p2: h } = Ut(p, e, a, d);
-        return z(n.beta, u, h, i, f);
-      } else
-        return q.unsafe(e, o);
-    }
-    multiplyAndAddUnsafe(o, n, e) {
-      const i = this.multiplyUnsafe(n).add(o.multiplyUnsafe(e));
-      return i.is0() ? void 0 : i;
-    }
-    /**
-     * Converts Projective point to affine (x, y) coordinates.
-     * @param invertedZ Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch
-     */
-    toAffine(o) {
-      return ot(this, o);
-    }
-    /**
-     * Checks whether Point is free of torsion elements (is in prime subgroup).
-     * Always torsion-free for cofactor=1 curves.
-     */
-    isTorsionFree() {
-      const { isTorsionFree: o } = s;
-      return l === $ ? !0 : o ? o(p, this) : q.unsafe(this, V).is0();
-    }
-    clearCofactor() {
-      const { clearCofactor: o } = s;
-      return l === $ ? this : o ? o(p, this) : this.multiplyUnsafe(l);
-    }
-    isSmallOrder() {
-      return this.multiplyUnsafe(l).is0();
-    }
-    toBytes(o = !0) {
-      return rt(o, "isCompressed"), this.assertValidity(), E(p, this, o);
-    }
-    toHex(o = !0) {
-      return et(this.toBytes(o));
-    }
-    toString() {
-      return `<Point ${this.is0() ? "ZERO" : this.toHex()}>`;
-    }
-    // TODO: remove
-    get px() {
-      return this.X;
-    }
-    get py() {
-      return this.X;
-    }
-    get pz() {
-      return this.Z;
-    }
-    toRawBytes(o = !0) {
-      return this.toBytes(o);
-    }
-    _setWindowSize(o) {
-      this.precompute(o);
-    }
-    static normalizeZ(o) {
-      return st(p, o);
-    }
-    static msm(o, n) {
-      return Ft(p, m, o, n);
-    }
-    static fromPrivateKey(o) {
-      return p.BASE.multiply(M(m, o));
-    }
-  }
-  p.BASE = new p(w.Gx, w.Gy, t.ONE), p.ZERO = new p(t.ZERO, t.ONE, t.ZERO), p.Fp = t, p.Fn = m;
-  const W = m.BITS, q = new At(p, s.endo ? Math.ceil(W / 2) : W);
-  return p.BASE.precompute(8), p;
-}
-function Et(r) {
-  return Uint8Array.of(r ? 2 : 3);
-}
-function bt(r, s) {
-  return {
-    secretKey: s.BYTES,
-    publicKey: 1 + r.BYTES,
-    publicKeyUncompressed: 1 + 2 * r.BYTES,
-    publicKeyHasPrefix: !0,
-    signature: 2 * s.BYTES
-  };
-}
-function Lt(r, s = {}) {
-  const { Fn: c } = r, t = s.randomBytes || yt, m = Object.assign(bt(r.Fp, c), { seed: Kt(c.ORDER) });
-  function w(E) {
-    try {
-      return !!M(c, E);
-    } catch {
-      return !1;
-    }
-  }
-  function l(E, x) {
-    const { publicKey: T, publicKeyUncompressed: H } = m;
-    try {
-      const _ = E.length;
-      return x === !0 && _ !== T || x === !1 && _ !== H ? !1 : !!r.fromBytes(E);
-    } catch {
-      return !1;
-    }
-  }
-  function V(E = t(m.seed)) {
-    return Nt(k(E, m.seed, "seed"), c.ORDER);
-  }
-  function B(E, x = !0) {
-    return r.BASE.multiply(M(c, E)).toBytes(x);
-  }
-  function A(E) {
-    const x = V(E);
-    return { secretKey: x, publicKey: B(x) };
-  }
-  function U(E) {
-    if (typeof E == "bigint")
-      return !1;
-    if (E instanceof r)
-      return !0;
-    const { secretKey: x, publicKey: T, publicKeyUncompressed: H } = m;
-    if (c.allowedLengths || x === T)
-      return;
-    const _ = N("key", E).length;
-    return _ === T || _ === H;
-  }
-  function D(E, x, T = !0) {
-    if (U(E) === !0)
-      throw new Error("first arg must be private key");
-    if (U(x) === !1)
-      throw new Error("second arg must be public key");
-    const H = M(c, E);
-    return r.fromHex(x).multiply(H).toBytes(T);
-  }
-  return Object.freeze({ getPublicKey: B, getSharedSecret: D, keygen: A, Point: r, utils: {
-    isValidSecretKey: w,
-    isValidPublicKey: l,
-    randomSecretKey: V,
-    // TODO: remove
-    isValidPrivateKey: w,
-    randomPrivateKey: V,
-    normPrivateKeyToScalar: (E) => M(c, E),
-    precompute(E = 8, x = r.BASE) {
-      return x.precompute(E, !1);
-    }
-  }, lengths: m });
-}
-function Dt(r, s, c = {}) {
-  Bt(s), mt(c, {}, {
-    hmac: "function",
-    lowS: "boolean",
-    randomBytes: "function",
-    bits2int: "function",
-    bits2int_modN: "function"
-  });
-  const t = c.randomBytes || yt, m = c.hmac || ((n, ...e) => vt(s, n, I(...e))), { Fp: w, Fn: l } = r, { ORDER: V, BITS: B } = l, { keygen: A, getPublicKey: U, getSharedSecret: D, utils: X, lengths: E } = Lt(r, c), x = {
-    prehash: !1,
-    lowS: typeof c.lowS == "boolean" ? c.lowS : !1,
-    format: void 0,
-    //'compact' as ECDSASigFormat,
-    extraEntropy: !1
-  }, T = "compact";
-  function H(n) {
-    const e = V >> $;
-    return n > e;
-  }
-  function _(n, e) {
-    if (!l.isValidNot0(e))
-      throw new Error(`invalid signature ${n}: out of range 1..Point.Fn.ORDER`);
-    return e;
-  }
-  function nt(n, e) {
-    ct(e);
-    const i = E.signature, a = e === "compact" ? i : e === "recovered" ? i + 1 : void 0;
-    return k(n, a, `${e} signature`);
-  }
-  class F {
-    constructor(e, i, a) {
-      this.r = _("r", e), this.s = _("s", i), a != null && (this.recovery = a), Object.freeze(this);
-    }
-    static fromBytes(e, i = T) {
-      nt(e, i);
-      let a;
-      if (i === "der") {
-        const { r: h, s: y } = C.toSig(k(e));
-        return new F(h, y);
-      }
-      i === "recovered" && (a = e[0], i = "compact", e = e.subarray(1));
-      const f = l.BYTES, d = e.subarray(0, f), u = e.subarray(f, f * 2);
-      return new F(l.fromBytes(d), l.fromBytes(u), a);
-    }
-    static fromHex(e, i) {
-      return this.fromBytes(lt(e), i);
-    }
-    addRecoveryBit(e) {
-      return new F(this.r, this.s, e);
-    }
-    recoverPublicKey(e) {
-      const i = w.ORDER, { r: a, s: f, recovery: d } = this;
-      if (d == null || ![0, 1, 2, 3].includes(d))
-        throw new Error("recovery id invalid");
-      if (V * gt < i && d > 1)
-        throw new Error("recovery id is ambiguous for h>1 curve");
-      const h = d === 2 || d === 3 ? a + V : a;
-      if (!w.isValid(h))
-        throw new Error("recovery id 2 or 3 invalid");
-      const y = w.toBytes(h), O = r.fromBytes(I(Et((d & 1) === 0), y)), v = l.inv(h), g = j(N("msgHash", e)), R = l.create(-g * v), Z = l.create(f * v), K = r.BASE.multiplyUnsafe(R).add(O.multiplyUnsafe(Z));
-      if (K.is0())
-        throw new Error("point at infinify");
-      return K.assertValidity(), K;
-    }
-    // Signatures should be low-s, to prevent malleability.
-    hasHighS() {
-      return H(this.s);
-    }
-    toBytes(e = T) {
-      if (ct(e), e === "der")
-        return lt(C.hexFromSig(this));
-      const i = l.toBytes(this.r), a = l.toBytes(this.s);
-      if (e === "recovered") {
-        if (this.recovery == null)
-          throw new Error("recovery bit must be present");
-        return I(Uint8Array.of(this.recovery), i, a);
-      }
-      return I(i, a);
-    }
-    toHex(e) {
-      return et(this.toBytes(e));
-    }
-    // TODO: remove
-    assertValidity() {
-    }
-    static fromCompact(e) {
-      return F.fromBytes(N("sig", e), "compact");
-    }
-    static fromDER(e) {
-      return F.fromBytes(N("sig", e), "der");
-    }
-    normalizeS() {
-      return this.hasHighS() ? new F(this.r, l.neg(this.s), this.recovery) : this;
-    }
-    toDERRawBytes() {
-      return this.toBytes("der");
-    }
-    toDERHex() {
-      return et(this.toBytes("der"));
-    }
-    toCompactRawBytes() {
-      return this.toBytes("compact");
-    }
-    toCompactHex() {
-      return et(this.toBytes("compact"));
-    }
-  }
-  const G = c.bits2int || function(e) {
-    if (e.length > 8192)
-      throw new Error("input is too large");
-    const i = wt(e), a = e.length * 8 - B;
-    return a > 0 ? i >> BigInt(a) : i;
-  }, j = c.bits2int_modN || function(e) {
-    return l.create(G(e));
-  }, ot = pt(B);
-  function P(n) {
-    return Ot("num < 2^" + B, n, L, ot), l.toBytes(n);
-  }
-  function z(n, e) {
-    return k(n, void 0, "message"), e ? k(s(n), void 0, "prehashed message") : n;
-  }
-  function p(n, e, i) {
-    if (["recovered", "canonical"].some((R) => R in i))
-      throw new Error("sign() legacy options not supported");
-    const { lowS: a, prehash: f, extraEntropy: d } = it(i, x);
-    n = z(n, f);
-    const u = j(n), h = M(l, e), y = [P(h), P(u)];
-    if (d != null && d !== !1) {
-      const R = d === !0 ? t(E.secretKey) : d;
-      y.push(N("extraEntropy", R));
-    }
-    const O = I(...y), v = u;
-    function g(R) {
-      const Z = G(R);
-      if (!l.isValidNot0(Z))
-        return;
-      const K = l.inv(Z), S = r.BASE.multiply(Z).toAffine(), Y = l.create(S.x);
-      if (Y === L)
-        return;
-      const Q = l.create(K * l.create(v + Y * h));
-      if (Q === L)
-        return;
-      let at = (S.x === Y ? 0 : 2) | Number(S.y & $), ut = Q;
-      return a && H(Q) && (ut = l.neg(Q), at ^= 1), new F(Y, ut, at);
-    }
-    return { seed: O, k2sig: g };
-  }
-  function W(n, e, i = {}) {
-    n = N("message", n);
-    const { seed: a, k2sig: f } = p(n, e, i);
-    return St(s.outputLen, l.BYTES, m)(a, f);
-  }
-  function q(n) {
-    let e;
-    const i = typeof n == "string" || Rt(n), a = !i && n !== null && typeof n == "object" && typeof n.r == "bigint" && typeof n.s == "bigint";
-    if (!i && !a)
-      throw new Error("invalid signature, expected Uint8Array, hex string or Signature instance");
-    if (a)
-      e = new F(n.r, n.s);
-    else if (i) {
-      try {
-        e = F.fromBytes(N("sig", n), "der");
-      } catch (f) {
-        if (!(f instanceof C.Err))
-          throw f;
-      }
-      if (!e)
-        try {
-          e = F.fromBytes(N("sig", n), "compact");
-        } catch {
-          return !1;
-        }
-    }
-    return e || !1;
-  }
-  function b(n, e, i, a = {}) {
-    const { lowS: f, prehash: d, format: u } = it(a, x);
-    if (i = N("publicKey", i), e = z(N("message", e), d), "strict" in a)
-      throw new Error("options.strict was renamed to lowS");
-    const h = u === void 0 ? q(n) : F.fromBytes(N("sig", n), u);
-    if (h === !1)
-      return !1;
-    try {
-      const y = r.fromBytes(i);
-      if (f && h.hasHighS())
-        return !1;
-      const { r: O, s: v } = h, g = j(e), R = l.inv(v), Z = l.create(g * R), K = l.create(O * R), S = r.BASE.multiplyUnsafe(Z).add(y.multiplyUnsafe(K));
-      return S.is0() ? !1 : l.create(S.x) === O;
-    } catch {
-      return !1;
-    }
-  }
-  function o(n, e, i = {}) {
-    const { prehash: a } = it(i, x);
-    return e = z(e, a), F.fromBytes(n, "recovered").recoverPublicKey(e).toBytes();
-  }
-  return Object.freeze({
-    keygen: A,
-    getPublicKey: U,
-    getSharedSecret: D,
-    utils: X,
-    lengths: E,
-    Point: r,
-    sign: W,
-    verify: b,
-    recoverPublicKey: o,
-    Signature: F,
-    hash: s
-  });
-}
-function Xt(r) {
-  const s = {
-    a: r.a,
-    b: r.b,
-    p: r.Fp.ORDER,
-    n: r.n,
-    h: r.h,
-    Gx: r.Gx,
-    Gy: r.Gy
-  }, c = r.Fp;
-  let t = r.allowedPrivateKeyLengths ? Array.from(new Set(r.allowedPrivateKeyLengths.map((l) => Math.ceil(l / 2)))) : void 0;
-  const m = Yt(s.n, {
-    BITS: r.nBitLength,
-    allowedLengths: t,
-    modFromBytes: r.wrapPrivateKey
-  }), w = {
-    Fp: c,
-    Fn: m,
-    allowInfinityPoint: r.allowInfinityPoint,
-    endo: r.endo,
-    isTorsionFree: r.isTorsionFree,
-    clearCofactor: r.clearCofactor,
-    fromBytes: r.fromBytes,
-    toBytes: r.toBytes
-  };
-  return { CURVE: s, curveOpts: w };
-}
-function qt(r) {
-  const { CURVE: s, curveOpts: c } = Xt(r), t = {
-    hmac: r.hmac,
-    randomBytes: r.randomBytes,
-    lowS: r.lowS,
-    bits2int: r.bits2int,
-    bits2int_modN: r.bits2int_modN
-  };
-  return { CURVE: s, curveOpts: c, hash: r.hash, ecdsaOpts: t };
-}
-function It(r, s) {
-  const c = s.Point;
-  return Object.assign({}, s, {
-    ProjectivePoint: c,
-    CURVE: Object.assign({}, r, Vt(c.Fn.ORDER, c.Fn.BITS))
-  });
-}
-function Gt(r) {
-  const { CURVE: s, curveOpts: c, hash: t, ecdsaOpts: m } = qt(r), w = Ct(s, c), l = Dt(w, t, m);
-  return It(r, l);
-}
-export {
-  C as DER,
-  Ht as DERErr,
-  M as _normFnElement,
-  Tt as _splitEndoScalar,
-  Lt as ecdh,
-  Dt as ecdsa,
-  Gt as weierstrass,
-  Ct as weierstrassN
-};