@leofcoin/chain 1.10.15 → 1.10.17

package/exports/browser/beacon.js

@@ -1,20 +1,20 @@
-import { v as validateObject, m as mod, u as utf8ToBytes, a as concatBytes, d as bytesToNumberBE, f as bitLen, g as weierstrassPoints, i as getMinHashLength, j as mapHashToField, k as bitGet, l as ensureBytes, F as Field, s as sha256, n as FpInvertBatch, o as FpPow, q as bitMask, x as mapToCurveSimpleSWU, y as bitSet, r as randomBytes, z as bytesToHex, A as numberToBytesBE } from './weierstrass-Q0QND1ZT.js';
-import { s as sha256$1 } from './sha2-piimb6xL.js';
+import { s as sha256 } from './sha2-BKcEJzgd.js';
+import { v as validateObject, i as isBytes, c as copyBytes, a as asafenumber, b as abytes, m as mod, d as concatBytes, f as asciiToBytes, g as bytesToNumberBE, j as validateField, k as aarray, l as FpInvertBatch, n as FpIsSquare, o as notImplemented, q as getMinHashLength, r as mapHashToField, s as randomBytes, F as Field, t as bitLen, u as FpPow, x as FpLegendre, y as aInRange, z as bitGet, A as validatePointCons, w as weierstrass, B as bytesToHex, C as hexToBytes, D as numberToBytesBE } from './weierstrass-BVfhtHbl.js';
 
-function validateDST(dst) {
-    if (dst instanceof Uint8Array)
-        return dst;
-    if (typeof dst === 'string')
-        return utf8ToBytes(dst);
-    throw new Error('DST must be Uint8Array or string');
-}
+// prettier-ignore
+const _0n$3 = /* @__PURE__ */ BigInt(0), _1n$3 = /* @__PURE__ */ BigInt(1), _2n$3 = /* @__PURE__ */ BigInt(2), _3n$3 = /* @__PURE__ */ BigInt(3), _4n$1 = /* @__PURE__ */ BigInt(4);
 // Octet Stream to Integer. "spec" implementation of os2ip is 2.5x slower vs bytesToNumberBE.
 const os2ip = bytesToNumberBE;
-// Integer to Octet Stream (numberToBytesBE)
+// Integer to Octet Stream (numberToBytesBE).
 function i2osp(value, length) {
-    if (value < 0 || value >= 1 << (8 * length)) {
-        throw new Error(`bad I2OSP call: value=${value} length=${length}`);
-    }
+    asafenumber(value);
+    asafenumber(length);
+    // This helper stays on the JS bitwise/u32 fast-path. Callers that need wider encodings should
+    // use bigint + numberToBytesBE instead of routing large widths through this small helper.
+    if (length < 0 || length > 4)
+        throw new Error('invalid I2OSP length: ' + length);
+    if (value < 0 || value > 2 ** (8 * length) - 1)
+        throw new Error('invalid I2OSP input: ' + value);
     const res = Array.from({ length }).fill(0);
     for (let i = length - 1; i >= 0; i--) {
         res[i] = value & 0xff;
@@ -22,6 +22,7 @@ function i2osp(value, length) {
     }
     return new Uint8Array(res);
 }
+// RFC 9380 only applies strxor() to equal-length strings; callers must preserve that invariant.
 function strxor(a, b) {
     const arr = new Uint8Array(a.length);
     for (let i = 0; i < a.length; i++) {
@@ -29,57 +30,120 @@ function strxor(a, b) {
     }
     return arr;
 }
-function isBytes(item) {
-    if (!(item instanceof Uint8Array))
-        throw new Error('Uint8Array expected');
+// User can always use utf8 if they want, by passing Uint8Array.
+// If string is passed, we treat it as ASCII: other formats are likely a mistake.
+function normDST(DST) {
+    if (!isBytes(DST) && typeof DST !== 'string')
+        throw new Error('DST must be Uint8Array or ascii string');
+    const dst = typeof DST === 'string' ? asciiToBytes(DST) : DST;
+    // RFC 9380 §3.1 requirement 2: tags "MUST have nonzero length".
+    if (dst.length === 0)
+        throw new Error('DST must be non-empty');
+    return dst;
 }
-function isNum(item) {
-    if (!Number.isSafeInteger(item))
-        throw new Error('number expected');
-}
-// Produces a uniformly random byte string using a cryptographic hash function H that outputs b bits
-// https://www.rfc-editor.org/rfc/rfc9380#section-5.3.1
+/**
+ * Produces a uniformly random byte string using a cryptographic hash
+ * function H that outputs b bits.
+ * See {@link https://www.rfc-editor.org/rfc/rfc9380#section-5.3.1 | RFC 9380 section 5.3.1}.
+ * @param msg - Input message.
+ * @param DST - Domain separation tag. This helper normalizes DST, rejects empty DSTs, and
+ *   oversize-hashes DST when needed.
+ * @param lenInBytes - Output length.
+ * @param H - Hash function.
+ * @returns Uniform byte string.
+ * @throws If the message, DST, hash, or output length is invalid. {@link Error}
+ * @example
+ * Expand one message into uniform bytes with the XMD construction.
+ *
+ * ```ts
+ * import { expand_message_xmd } from '@noble/curves/abstract/hash-to-curve.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const uniform = expand_message_xmd(new TextEncoder().encode('hello noble'), 'DST', 32, sha256);
+ * ```
+ */
 function expand_message_xmd(msg, DST, lenInBytes, H) {
-    isBytes(msg);
-    isBytes(DST);
-    isNum(lenInBytes);
+    abytes(msg);
+    asafenumber(lenInBytes);
+    if (typeof H !== 'function')
+        throw new Error('expand_message_xmd: expected hash function');
+    asafenumber(H.outputLen, 'hash.outputLen');
+    asafenumber(H.blockLen, 'hash.blockLen');
+    DST = normDST(DST);
     // https://www.rfc-editor.org/rfc/rfc9380#section-5.3.3
     if (DST.length > 255)
-        DST = H(concatBytes(utf8ToBytes('H2C-OVERSIZE-DST-'), DST));
+        DST = H(concatBytes(asciiToBytes('H2C-OVERSIZE-DST-'), DST));
     const { outputLen: b_in_bytes, blockLen: r_in_bytes } = H;
     const ell = Math.ceil(lenInBytes / b_in_bytes);
-    if (ell > 255)
-        throw new Error('Invalid xmd length');
+    if (lenInBytes > 65535 || ell > 255)
+        throw new Error('expand_message_xmd: invalid lenInBytes');
     const DST_prime = concatBytes(DST, i2osp(DST.length, 1));
-    const Z_pad = i2osp(0, r_in_bytes);
+    const Z_pad = new Uint8Array(r_in_bytes); // RFC 9380: Z_pad = I2OSP(0, s_in_bytes)
     const l_i_b_str = i2osp(lenInBytes, 2); // len_in_bytes_str
     const b = new Array(ell);
     const b_0 = H(concatBytes(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));
     b[0] = H(concatBytes(b_0, i2osp(1, 1), DST_prime));
-    for (let i = 1; i <= ell; i++) {
+    // `b[0]` already stores RFC `b_1`, so only derive `b_2..b_ell` here. The old `<= ell`
+    // loop computed one extra tail block, which was usually sliced away but broke at max `ell=255`
+    // by reaching `I2OSP(256, 1)`.
+    for (let i = 1; i < ell; i++) {
         const args = [strxor(b_0, b[i - 1]), i2osp(i + 1, 1), DST_prime];
         b[i] = H(concatBytes(...args));
     }
     const pseudo_random_bytes = concatBytes(...b);
     return pseudo_random_bytes.slice(0, lenInBytes);
 }
-// Produces a uniformly random byte string using an extendable-output function (XOF) H.
-// 1. The collision resistance of H MUST be at least k bits.
-// 2. H MUST be an XOF that has been proved indifferentiable from
-//    a random oracle under a reasonable cryptographic assumption.
-// https://www.rfc-editor.org/rfc/rfc9380#section-5.3.2
+/**
+ * Produces a uniformly random byte string using an extendable-output function (XOF) H.
+ * 1. The collision resistance of H MUST be at least k bits.
+ * 2. H MUST be an XOF that has been proved indifferentiable from
+ *    a random oracle under a reasonable cryptographic assumption.
+ * See {@link https://www.rfc-editor.org/rfc/rfc9380#section-5.3.2 | RFC 9380 section 5.3.2}.
+ * @param msg - Input message.
+ * @param DST - Domain separation tag. This helper normalizes DST, rejects empty DSTs, and
+ *   oversize-hashes DST when needed.
+ * @param lenInBytes - Output length.
+ * @param k - Target security level.
+ * @param H - XOF hash function.
+ * @returns Uniform byte string.
+ * @throws If the message, DST, XOF, or output length is invalid. {@link Error}
+ * @example
+ * Expand one message into uniform bytes with the XOF construction.
+ *
+ * ```ts
+ * import { expand_message_xof } from '@noble/curves/abstract/hash-to-curve.js';
+ * import { shake256 } from '@noble/hashes/sha3.js';
+ * const uniform = expand_message_xof(
+ *   new TextEncoder().encode('hello noble'),
+ *   'DST',
+ *   32,
+ *   128,
+ *   shake256
+ * );
+ * ```
+ */
 function expand_message_xof(msg, DST, lenInBytes, k, H) {
-    isBytes(msg);
-    isBytes(DST);
-    isNum(lenInBytes);
+    abytes(msg);
+    asafenumber(lenInBytes);
+    asafenumber(k, 'k');
+    if (k < 0)
+        throw new Error('expand_message_xof: invalid k');
+    if (typeof H !== 'function')
+        throw new Error('expand_message_xof: expected XOF function');
+    if (typeof H.create !== 'function')
+        throw new Error('expand_message_xof: expected XOF create');
+    DST = normDST(DST);
+    if (lenInBytes < 0 || lenInBytes > 65535)
+        throw new Error('expand_message_xof: invalid lenInBytes');
     // https://www.rfc-editor.org/rfc/rfc9380#section-5.3.3
-    // DST = H('H2C-OVERSIZE-DST-' || a_very_long_DST, Math.ceil((lenInBytes * k) / 8));
+    // RFC 9380 §5.3.3: DST = H("H2C-OVERSIZE-DST-" || a_very_long_DST, ceil(2 * k / 8)).
     if (DST.length > 255) {
         const dkLen = Math.ceil((2 * k) / 8);
-        DST = H.create({ dkLen }).update(utf8ToBytes('H2C-OVERSIZE-DST-')).update(DST).digest();
+        DST = H.create({ dkLen }).update(asciiToBytes('H2C-OVERSIZE-DST-')).update(DST).digest();
     }
-    if (lenInBytes > 65535 || DST.length > 255)
-        throw new Error('expand_message_xof: invalid lenInBytes');
+    // Oversize DSTs are compressed above; fail closed if a custom XOF still returns one
+    // (possible when k > 1020 makes the compression dkLen itself exceed 255 bytes).
+    if (DST.length > 255)
+        throw new Error('expand_message_xof: invalid DST');
     return (H.create({ dkLen: lenInBytes })
         .update(msg)
         .update(i2osp(lenInBytes, 2))
@@ -89,25 +153,53 @@ function expand_message_xof(msg, DST, lenInBytes, k, H) {
         .digest());
 }
 /**
- * Hashes arbitrary-length byte strings to a list of one or more elements of a finite field F
- * https://www.rfc-editor.org/rfc/rfc9380#section-5.2
- * @param msg a byte string containing the message to hash
- * @param count the number of elements of F to output
- * @param options `{DST: string, p: bigint, m: number, k: number, expand: 'xmd' | 'xof', hash: H}`, see above
- * @returns [u_0, ..., u_(count - 1)], a list of field elements.
+ * Hashes arbitrary-length byte strings to a list of one or more elements of a finite field F.
+ * See {@link https://www.rfc-editor.org/rfc/rfc9380#section-5.2 | RFC 9380 section 5.2}.
+ * @param msg - Input message bytes.
+ * @param count - Number of field elements to derive. Must be `>= 1`.
+ * @param options - RFC 9380 options. See {@link H2COpts}. `m` must be `>= 1`.
+ * @returns `[u_0, ..., u_(count - 1)]`, a list of field elements.
+ * @throws If the expander choice or RFC 9380 options are invalid. {@link Error}
+ * @example
+ * Hash one message into field elements before mapping it onto a curve.
+ *
+ * ```ts
+ * import { hash_to_field } from '@noble/curves/abstract/hash-to-curve.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const scalars = hash_to_field(new TextEncoder().encode('hello noble'), 2, {
+ *   DST: 'DST',
+ *   p: 17n,
+ *   m: 1,
+ *   k: 128,
+ *   expand: 'xmd',
+ *   hash: sha256,
+ * });
+ * ```
  */
 function hash_to_field(msg, count, options) {
     validateObject(options, {
-        DST: 'stringOrUint8Array',
         p: 'bigint',
-        m: 'isSafeInteger',
-        k: 'isSafeInteger',
-        hash: 'hash',
+        m: 'number',
+        k: 'number',
+        hash: 'function',
     });
-    const { p, k, m, hash, expand, DST: _DST } = options;
-    isBytes(msg);
-    isNum(count);
-    const DST = validateDST(_DST);
+    const { p, k, m, hash, expand, DST } = options;
+    asafenumber(hash.outputLen, 'valid hash');
+    abytes(msg);
+    asafenumber(count);
+    asafenumber(m, 'm');
+    asafenumber(k, 'k');
+    // RFC 9380 §5.2 defines hash_to_field over a list of one or more field elements and an integer
+    // extension degree `m >= 1`; rejecting here avoids degenerate `[]` / `[[]]` helper outputs.
+    // The RFC also treats `p` as a finite-field characteristic; bad values degenerate log2/mod.
+    if (p <= BigInt(1))
+        throw new Error('hash_to_field: expected valid field characteristic');
+    if (count < 1)
+        throw new Error('hash_to_field: expected count >= 1');
+    if (m < 1)
+        throw new Error('hash_to_field: expected m >= 1');
+    if (k < 0)
+        throw new Error('hash_to_field: invalid k');
     const log2p = p.toString(2).length;
     const L = Math.ceil((log2p + k) / 8); // section 5.1 of ietf draft link above
     const len_in_bytes = count * m * L;
@@ -119,7 +211,8 @@ function hash_to_field(msg, count, options) {
         prb = expand_message_xof(msg, DST, len_in_bytes, k, hash);
     }
     else if (expand === '_internal_pass') {
-        // for internal tests only
+        // for internal tests only: msg is used as the uniform bytes directly. Short msg is allowed
+        // on purpose (subarray() slices are short): zkcrypto map_scalar vectors feed empty okm.
         prb = msg;
     }
     else {
@@ -137,371 +230,1179 @@ function hash_to_field(msg, count, options) {
     }
     return u;
 }
+/**
+ * @param field - Field implementation.
+ * @param map - Isogeny coefficients.
+ * @returns Isogeny mapping helper.
+ * @example
+ * Build one rational isogeny map, then apply it to affine x/y coordinates.
+ *
+ * ```ts
+ * import { isogenyMap } from '@noble/curves/abstract/hash-to-curve.js';
+ * import { Field } from '@noble/curves/abstract/modular.js';
+ * const Fp = Field(17n);
+ * const iso = isogenyMap(Fp, [[0n, 1n], [1n], [1n], [1n]]);
+ * const point = iso(3n, 5n);
+ * ```
+ */
 function isogenyMap(field, map) {
+    validateField(field);
     // Make same order as in spec
-    const COEFF = map.map((i) => Array.from(i).reverse());
+    aarray(map, 'map');
+    const coeff = map.map((i, row) => {
+        aarray(i, 'map[' + row + ']');
+        if (i.length < 1)
+            throw new Error('isogenyMap: expected non-empty coefficients');
+        return Array.from(i).reverse();
+    });
     return (x, y) => {
-        const [xNum, xDen, yNum, yDen] = COEFF.map((val) => val.reduce((acc, i) => field.add(field.mul(acc, x), i)));
-        x = field.div(xNum, xDen); // xNum / xDen
-        y = field.mul(y, field.div(yNum, yDen)); // y * (yNum / yDev)
-        return { x, y };
+        const [xn, xd, yn, yd] = coeff.map((val) => val.reduce((acc, i) => field.add(field.mul(acc, x), i)));
+        const isZero = field.is0(xd) || field.is0(yd);
+        // Shipped Weierstrass consumers encode that affine identity as all-zero
+        // coordinates, so `passZero=true` intentionally collapses zero
+        // denominators to `{ x: 0, y: 0 }`.
+        const [xd_inv, yd_inv] = FpInvertBatch(field, [xd, yd], true);
+        x = field.mul(xn, xd_inv); // xNum / xDen
+        y = field.mul(y, field.mul(yn, yd_inv)); // y * (yNum / yDev)
+        // RFC 9380 §6.6.3: if the denominator of either isogeny rational function is
+        // zero, the exceptional case must return the identity point on E.
+        return isZero ? { x: field.ZERO, y: field.ZERO } : { x, y };
     };
 }
-function createHasher(Point, mapToCurve, def) {
+// Keep the shared DST removable when the selected bundle never hashes to scalar.
+// Callers that need protocol-specific scalar domain separation must override this generic default.
+// RFC 9497 §§4.1-4.5 use this ASCII prefix before appending the ciphersuite context string.
+// Export a string instead of mutable bytes so callers cannot poison default hash-to-scalar behavior
+// by mutating a shared Uint8Array in place.
+const _DST_scalar = 'HashToScalar-';
+/**
+ * Creates hash-to-curve methods from EC Point and mapToCurve function. See {@link H2CHasher}.
+ * @param Point - Point constructor.
+ * @param mapToCurve - Map-to-curve function.
+ * @param defaults - Default hash-to-curve options. A frozen detached snapshot is reused as the
+ *   shared defaults bundle for the returned helpers.
+ * @returns Hash-to-curve helper namespace.
+ * @throws If the map-to-curve callback or default hash-to-curve options are invalid. {@link Error}
+ * @example
+ * Bundle hash-to-curve, hash-to-scalar, and encode-to-curve helpers for one curve.
+ *
+ * ```ts
+ * import { createHasher } from '@noble/curves/abstract/hash-to-curve.js';
+ * import { p256 } from '@noble/curves/nist.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const hasher = createHasher(p256.Point, () => p256.Point.BASE.toAffine(), {
+ *   DST: 'P256_XMD:SHA-256_SSWU_RO_',
+ *   encodeDST: 'P256_XMD:SHA-256_SSWU_NU_',
+ *   p: p256.Point.Fp.ORDER,
+ *   m: 1,
+ *   k: 128,
+ *   expand: 'xmd',
+ *   hash: sha256,
+ * });
+ * const point = hasher.encodeToCurve(new TextEncoder().encode('hello noble'));
+ * ```
+ */
+function createHasher(Point, mapToCurve, defaults) {
     if (typeof mapToCurve !== 'function')
         throw new Error('mapToCurve() must be defined');
-    return {
-        // Encodes byte string to elliptic curve.
-        // hash_to_curve from https://www.rfc-editor.org/rfc/rfc9380#section-3
+    validateObject(defaults);
+    // `Point` is intentionally not shape-validated eagerly here: point constructors vary across
+    // curve families, so this helper only checks the hooks it can validate cheaply. Misconfigured
+    // suites fail later when hashing first touches Point.fromAffine / Point.ZERO / clearCofactor().
+    const snapshot = (src) => Object.freeze({
+        ...src,
+        DST: isBytes(src.DST) ? copyBytes(src.DST) : src.DST,
+        ...(src.encodeDST === undefined
+            ? {}
+            : { encodeDST: isBytes(src.encodeDST) ? copyBytes(src.encodeDST) : src.encodeDST }),
+    });
+    // Keep one private defaults snapshot for actual hashing and expose fresh
+    // detached snapshots via the public getter.
+    // Otherwise a caller could mutate `hasher.defaults.DST` in place and poison
+    // the singleton hasher for every other consumer in the same process.
+    const safeDefaults = snapshot(defaults);
+    // Per-call options are H2CDSTOpts: only DST may be overridden. Copying just that key keeps
+    // off-type option objects from silently replacing suite parameters (p/m/k/hash/expand) at
+    // runtime — same pinning hashToScalar always did for p/m.
+    const dstOverride = (options) => options && options.DST !== undefined ? { DST: options.DST } : undefined;
+    function map(num) {
+        return Point.fromAffine(mapToCurve(num));
+    }
+    function clear(initial) {
+        const P = initial.clearCofactor();
+        // Keep ZERO as the algebraic cofactor-clearing result here; strict public point-validity
+        // surfaces may still reject it later, but createHasher.clear() itself is not that boundary.
+        if (P.equals(Point.ZERO))
+            return Point.ZERO;
+        P.assertValidity();
+        return P;
+    }
+    return Object.freeze({
+        get defaults() {
+            return snapshot(safeDefaults);
+        },
+        Point,
         hashToCurve(msg, options) {
-            const u = hash_to_field(msg, 2, { ...def, DST: def.DST, ...options });
-            const u0 = Point.fromAffine(mapToCurve(u[0]));
-            const u1 = Point.fromAffine(mapToCurve(u[1]));
-            const P = u0.add(u1).clearCofactor();
-            P.assertValidity();
-            return P;
+            const opts = Object.assign({}, safeDefaults, dstOverride(options));
+            const u = hash_to_field(msg, 2, opts);
+            const u0 = map(u[0]);
+            const u1 = map(u[1]);
+            return clear(u0.add(u1));
         },
-        // Encodes byte string to elliptic curve.
-        // encode_to_curve from https://www.rfc-editor.org/rfc/rfc9380#section-3
         encodeToCurve(msg, options) {
-            const u = hash_to_field(msg, 1, { ...def, DST: def.encodeDST, ...options });
-            const P = Point.fromAffine(mapToCurve(u[0])).clearCofactor();
-            P.assertValidity();
-            return P;
+            const optsDst = safeDefaults.encodeDST === undefined ? {} : { DST: safeDefaults.encodeDST };
+            const opts = Object.assign({}, safeDefaults, optsDst, dstOverride(options));
+            const u = hash_to_field(msg, 1, opts);
+            const u0 = map(u[0]);
+            return clear(u0);
         },
+        /** See {@link H2CHasher} */
+        mapToCurve(scalars) {
+            // Curves with m=1 accept only single scalar
+            if (safeDefaults.m === 1) {
+                if (typeof scalars !== 'bigint')
+                    throw new Error('expected bigint (m=1)');
+                return clear(map([scalars]));
+            }
+            if (!Array.isArray(scalars))
+                throw new Error('expected array of bigints');
+            // RFC 9380 represents one GF(p^m) element as exactly m base-field scalars.
+            if (scalars.length !== safeDefaults.m)
+                throw new Error(`expected array of ${safeDefaults.m} bigints`);
+            for (const i of scalars)
+                if (typeof i !== 'bigint')
+                    throw new Error('expected array of bigints');
+            return clear(map(scalars));
+        },
+        // hash_to_scalar can produce 0: https://www.rfc-editor.org/errata/eid8393
+        // RFC 9380, draft-irtf-cfrg-bbs-signatures-08. Default scalar DST is the shared generic
+        // `HashToScalar-` prefix above unless the caller overrides it per invocation.
+        hashToScalar(msg, options) {
+            // @ts-ignore
+            const N = Point.Fn.ORDER;
+            const opts = Object.assign({}, safeDefaults, { DST: _DST_scalar }, dstOverride(options), {
+                p: N,
+                m: 1,
+            });
+            return hash_to_field(msg, 1, opts)[0][0];
+        },
+    });
+}
+/**
+ * Implementation of the Shallue and van de Woestijne method for any weierstrass curve.
+ * TODO: check if there is a way to merge this with uvRatio in Edwards; move to modular.
+ * b = True and y = sqrt(u / v) if (u / v) is square in F, and
+ * b = False and y = sqrt(Z * (u / v)) otherwise.
+ * RFC 9380 expects callers to provide `v != 0`; this helper does not enforce it.
+ * @param Fp - Field implementation.
+ * @param Z - Simplified SWU map parameter.
+ * @returns Square-root ratio helper.
+ * @example
+ * Build the square-root ratio helper used by SWU map implementations.
+ *
+ * ```ts
+ * import { SWUFpSqrtRatio } from '@noble/curves/abstract/hash-to-curve.js';
+ * import { Field } from '@noble/curves/abstract/modular.js';
+ * const Fp = Field(17n);
+ * const sqrtRatio = SWUFpSqrtRatio(Fp, 3n);
+ * const out = sqrtRatio(4n, 1n);
+ * ```
+ */
+function SWUFpSqrtRatio(Fp, Z) {
+    // Fail with the usual field-shape error before touching pow/cmov on malformed field shims.
+    const F = validateField(Fp);
+    // Generic implementation
+    const q = F.ORDER;
+    let l = _0n$3;
+    for (let o = q - _1n$3; o % _2n$3 === _0n$3; o /= _2n$3)
+        l += _1n$3;
+    const c1 = l; // 1. c1, the largest integer such that 2^c1 divides q - 1.
+    // We need 2n ** c1 and 2n ** (c1-1). We can't use **; but we can use <<.
+    // 2n ** c1 == 2n << (c1-1)
+    const _2n_pow_c1_1 = _2n$3 << (c1 - _1n$3 - _1n$3);
+    const _2n_pow_c1 = _2n_pow_c1_1 * _2n$3;
+    const c2 = (q - _1n$3) / _2n_pow_c1; // 2. c2 = (q - 1) / (2^c1)  # Integer arithmetic
+    const c3 = (c2 - _1n$3) / _2n$3; // 3. c3 = (c2 - 1) / 2            # Integer arithmetic
+    const c4 = _2n_pow_c1 - _1n$3; // 4. c4 = 2^c1 - 1                # Integer arithmetic
+    const c5 = _2n_pow_c1_1; // 5. c5 = 2^(c1 - 1)                  # Integer arithmetic
+    const c6 = F.pow(Z, c2); // 6. c6 = Z^c2
+    const c7 = F.pow(Z, (c2 + _1n$3) / _2n$3); // 7. c7 = Z^((c2 + 1) / 2)
+    // RFC 9380 Appendix F.2.1.1 defines sqrt_ratio(u, v) only for v != 0.
+    // We keep v=0 on the regular result path with isValid=false instead of
+    // throwing so the helper stays closer to the RFC's fixed control flow.
+    let sqrtRatio = (u, v) => {
+        let tv1 = c6; // 1. tv1 = c6
+        let tv2 = F.pow(v, c4); // 2. tv2 = v^c4
+        let tv3 = F.sqr(tv2); // 3. tv3 = tv2^2
+        tv3 = F.mul(tv3, v); // 4. tv3 = tv3 * v
+        let tv5 = F.mul(u, tv3); // 5. tv5 = u * tv3
+        tv5 = F.pow(tv5, c3); // 6. tv5 = tv5^c3
+        tv5 = F.mul(tv5, tv2); // 7. tv5 = tv5 * tv2
+        tv2 = F.mul(tv5, v); // 8. tv2 = tv5 * v
+        tv3 = F.mul(tv5, u); // 9. tv3 = tv5 * u
+        let tv4 = F.mul(tv3, tv2); // 10. tv4 = tv3 * tv2
+        tv5 = F.pow(tv4, c5); // 11. tv5 = tv4^c5
+        let isQR = F.eql(tv5, F.ONE); // 12. isQR = tv5 == 1
+        tv2 = F.mul(tv3, c7); // 13. tv2 = tv3 * c7
+        tv5 = F.mul(tv4, tv1); // 14. tv5 = tv4 * tv1
+        tv3 = F.cmov(tv2, tv3, isQR); // 15. tv3 = CMOV(tv2, tv3, isQR)
+        tv4 = F.cmov(tv5, tv4, isQR); // 16. tv4 = CMOV(tv5, tv4, isQR)
+        // 17. for i in (c1, c1 - 1, ..., 2):
+        for (let i = c1; i > _1n$3; i--) {
+            let tv5 = i - _2n$3; // 18.    tv5 = i - 2
+            tv5 = _2n$3 << (tv5 - _1n$3); // 19.    tv5 = 2^tv5
+            let tvv5 = F.pow(tv4, tv5); // 20.    tv5 = tv4^tv5
+            const e1 = F.eql(tvv5, F.ONE); // 21.    e1 = tv5 == 1
+            tv2 = F.mul(tv3, tv1); // 22.    tv2 = tv3 * tv1
+            tv1 = F.mul(tv1, tv1); // 23.    tv1 = tv1 * tv1
+            tvv5 = F.mul(tv4, tv1); // 24.    tv5 = tv4 * tv1
+            tv3 = F.cmov(tv2, tv3, e1); // 25.    tv3 = CMOV(tv2, tv3, e1)
+            tv4 = F.cmov(tvv5, tv4, e1); // 26.    tv4 = CMOV(tv5, tv4, e1)
+        }
+        // RFC 9380 Appendix F.2.1.1 defines sqrt_ratio(u, v) for v != 0.
+        // When u = 0 and v != 0, u / v = 0 is square and the computed root is
+        // still 0, so widen only the final flag and keep the full control flow.
+        return { isValid: !F.is0(v) && (isQR || F.is0(u)), value: tv3 };
+    };
+    if (F.ORDER % _4n$1 === _3n$3) {
+        // sqrt_ratio_3mod4(u, v)
+        const c1 = (F.ORDER - _3n$3) / _4n$1; // 1. c1 = (q - 3) / 4     # Integer arithmetic
+        const c2 = F.sqrt(F.neg(Z)); // 2. c2 = sqrt(-Z)
+        sqrtRatio = (u, v) => {
+            let tv1 = F.sqr(v); // 1. tv1 = v^2
+            const tv2 = F.mul(u, v); // 2. tv2 = u * v
+            tv1 = F.mul(tv1, tv2); // 3. tv1 = tv1 * tv2
+            let y1 = F.pow(tv1, c1); // 4. y1 = tv1^c1
+            y1 = F.mul(y1, tv2); // 5. y1 = y1 * tv2
+            const y2 = F.mul(y1, c2); // 6. y2 = y1 * c2
+            const tv3 = F.mul(F.sqr(y1), v); // 7. tv3 = y1^2; 8. tv3 = tv3 * v
+            const isQR = F.eql(tv3, u); // 9. isQR = tv3 == u
+            let y = F.cmov(y2, y1, isQR); // 10. y = CMOV(y2, y1, isQR)
+            return { isValid: !F.is0(v) && isQR, value: y }; // 11. return (isQR, y) isQR ? y : y*c2
+        };
+    }
+    // No curves uses that
+    // if (Fp.ORDER % _8n === _5n) // sqrt_ratio_5mod8
+    return sqrtRatio;
+}
+/**
+ * Simplified Shallue-van de Woestijne-Ulas Method
+ * See {@link https://www.rfc-editor.org/rfc/rfc9380#section-6.6.2 | RFC 9380 section 6.6.2}.
+ * @param Fp - Field implementation.
+ * @param opts - SWU parameters:
+ *   - `A`: Curve parameter `A`.
+ *   - `B`: Curve parameter `B`.
+ *   - `Z`: Simplified SWU map parameter.
+ * @returns Deterministic map-to-curve function.
+ * @throws If the SWU parameters are invalid or the field lacks the required helpers. {@link Error}
+ * @example
+ * Map one field element to a Weierstrass curve point with the SWU recipe.
+ *
+ * ```ts
+ * import { mapToCurveSimpleSWU } from '@noble/curves/abstract/hash-to-curve.js';
+ * import { Field } from '@noble/curves/abstract/modular.js';
+ * const Fp = Field(17n);
+ * const map = mapToCurveSimpleSWU(Fp, { A: 1n, B: 2n, Z: 3n });
+ * const point = map(5n);
+ * ```
+ */
+function mapToCurveSimpleSWU(Fp, opts) {
+    const F = validateField(Fp);
+    validateObject(opts, {}, {}, 'opts');
+    const { A, B, Z } = opts;
+    if (!F.isValidNot0(A) || !F.isValidNot0(B) || !F.isValid(Z))
+        throw new Error('mapToCurveSimpleSWU: invalid opts');
+    // RFC 9380 §6.6.2 and Appendix H.2 require:
+    // 1. Z is non-square in F
+    // 2. Z != -1 in F
+    // 3. g(x) - Z is irreducible over F
+    // 4. g(B / (Z * A)) is square in F
+    // We can enforce 1, 2, and 4 with the current field API.
+    // Criterion 3 is not checked here because generic `IField<T>` does not expose
+    // polynomial-ring / irreducibility operations, and this helper is used for
+    // both prime and extension fields.
+    if (F.eql(Z, F.neg(F.ONE)) || FpIsSquare(F, Z))
+        throw new Error('mapToCurveSimpleSWU: invalid opts');
+    // RFC 9380 Appendix H.2 criterion 4: g(B / (Z * A)) is square in F.
+    // x = B / (Z * A)
+    const x = F.mul(B, F.inv(F.mul(Z, A)));
+    // g(x) = x^3 + A*x + B
+    const gx = F.add(F.add(F.mul(F.sqr(x), x), F.mul(A, x)), B);
+    if (!FpIsSquare(F, gx))
+        throw new Error('mapToCurveSimpleSWU: invalid opts');
+    const sqrtRatio = SWUFpSqrtRatio(F, Z);
+    if (!F.isOdd)
+        throw new Error('Field does not have .isOdd()');
+    // Input: u, an element of F.
+    // Output: (x, y), a point on E.
+    return (u) => {
+        // prettier-ignore
+        let tv1, tv2, tv3, tv4, tv5, tv6, x, y;
+        tv1 = F.sqr(u); // 1.  tv1 = u^2
+        tv1 = F.mul(tv1, Z); // 2.  tv1 = Z * tv1
+        tv2 = F.sqr(tv1); // 3.  tv2 = tv1^2
+        tv2 = F.add(tv2, tv1); // 4.  tv2 = tv2 + tv1
+        tv3 = F.add(tv2, F.ONE); // 5.  tv3 = tv2 + 1
+        tv3 = F.mul(tv3, B); // 6.  tv3 = B * tv3
+        tv4 = F.cmov(Z, F.neg(tv2), !F.eql(tv2, F.ZERO)); // 7.  tv4 = CMOV(Z, -tv2, tv2 != 0)
+        tv4 = F.mul(tv4, A); // 8.  tv4 = A * tv4
+        tv2 = F.sqr(tv3); // 9.  tv2 = tv3^2
+        tv6 = F.sqr(tv4); // 10. tv6 = tv4^2
+        tv5 = F.mul(tv6, A); // 11. tv5 = A * tv6
+        tv2 = F.add(tv2, tv5); // 12. tv2 = tv2 + tv5
+        tv2 = F.mul(tv2, tv3); // 13. tv2 = tv2 * tv3
+        tv6 = F.mul(tv6, tv4); // 14. tv6 = tv6 * tv4
+        tv5 = F.mul(tv6, B); // 15. tv5 = B * tv6
+        tv2 = F.add(tv2, tv5); // 16. tv2 = tv2 + tv5
+        x = F.mul(tv1, tv3); // 17.   x = tv1 * tv3
+        const { isValid, value } = sqrtRatio(tv2, tv6); // 18. (is_gx1_square, y1) = sqrt_ratio(tv2, tv6)
+        y = F.mul(tv1, u); // 19.   y = tv1 * u  -> Z * u^3 * y1
+        y = F.mul(y, value); // 20.   y = y * y1
+        x = F.cmov(x, tv3, isValid); // 21.   x = CMOV(x, tv3, is_gx1_square)
+        y = F.cmov(y, value, isValid); // 22.   y = CMOV(y, y1, is_gx1_square)
+        const e1 = F.isOdd(u) === F.isOdd(y); // 23.  e1 = sgn0(u) == sgn0(y)
+        y = F.cmov(F.neg(y), y, e1); // 24.   y = CMOV(-y, y, e1)
+        const tv4_inv = FpInvertBatch(F, [tv4], true)[0];
+        x = F.mul(x, tv4_inv); // 25.   x = x / tv4
+        return { x, y };
     };
 }
 
+/**
+ * BLS != BLS.
+ * The file implements BLS (Boneh-Lynn-Shacham) signatures.
+ * Used in both BLS (Barreto-Lynn-Scott) and BN (Barreto-Naehrig)
+ * families of pairing-friendly curves.
+ * Consists of two curves: G1 and G2:
+ * - G1 is a subgroup of (x, y) E(Fq) over y² = x³ + 4.
+ * - G2 is a subgroup of ((x₁, x₂+i), (y₁, y₂+i)) E(Fq²) over y² = x³ + 4(1 + i) where i is √-1
+ * - Gt, created by bilinear (ate) pairing e(G1, G2), consists of p-th roots of unity in
+ *   Fq^k where k is embedding degree. Only degree 12 is currently supported, 24 is not.
+ * Pairing is used to aggregate and verify signatures.
+ * There are two modes of operation:
+ * - Long signatures:  X-byte keys + 2X-byte sigs (G1 keys + G2 sigs).
+ * - Short signatures: 2X-byte keys + X-byte sigs (G2 keys + G1 sigs).
+ * @module
+ **/
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 // prettier-ignore
-const _2n$1 = BigInt(2), _3n$1 = BigInt(3);
-function bls(CURVE) {
-    // Fields are specific for curve, so for now we'll need to pass them with opts
-    const { Fp, Fr, Fp2, Fp6, Fp12 } = CURVE.fields;
-    const BLS_X_LEN = bitLen(CURVE.params.x);
+const _0n$2 = BigInt(0), _1n$2 = BigInt(1), _2n$2 = BigInt(2), _3n$2 = BigInt(3);
+// Signed non-adjacent decomposition of the spec-defined Miller-loop parameter.
+// BN254 benefits most because `6x+2` has multiple adjacent `11` runs, but BLS12-381's
+// stored `|x|` still starts with `11`, so the Miller loop must also handle one `-1` digit there.
+function NAfDecomposition(a) {
+    const res = [];
+    // a>1 because of marker bit
+    for (; a > _1n$2; a >>= _1n$2) {
+        if ((a & _1n$2) === _0n$2)
+            res.unshift(0);
+        else if ((a & _3n$2) === _3n$2) {
+            res.unshift(-1);
+            a += _1n$2;
+        }
+        else
+            res.unshift(1);
+    }
+    return res;
+}
+function aNonEmpty(arr) {
+    // Aggregate helpers use this to reject empty variable-length inputs consistently.
+    // Without the guard, each caller would fall through into a different empty-input / identity
+    // case and hide missing inputs behind outputs that still look structurally valid.
+    if (!Array.isArray(arr) || arr.length === 0)
+        throw new Error('expected non-empty array');
+}
+// This should be enough for bn254, no need to export full stuff?
+function createBlsPairing(fields, G1, G2, params) {
+    validateObject(fields, { Fp: 'object', Fr: 'object', Fp2: 'object', Fp12: 'object' }, { Fp6: 'object' }, 'fields');
+    if (typeof G1 !== 'function')
+        throw new TypeError('"G1_Point" expected point constructor, got type=' + typeof G1);
+    if (typeof G2 !== 'function')
+        throw new TypeError('"G2_Point" expected point constructor, got type=' + typeof G2);
+    validateObject(params, { ateLoopSize: 'bigint', xNegative: 'boolean', twistType: 'string' }, { randomBytes: 'function', postPrecompute: 'function' }, 'params');
+    const { Fp, Fr, Fp2, Fp12 } = fields;
+    const { twistType, ateLoopSize, xNegative, postPrecompute } = params;
+    const fp2 = (c0, c1) => ({ c0, c1 });
+    const fp2f = ({ c0, c1 }) => Object.freeze({ c0, c1 });
+    const add2 = (a, b) => fp2(Fp.add(a.c0, b.c0), Fp.add(a.c1, b.c1));
+    const sub2 = (a, b) => fp2(Fp.sub(a.c0, b.c0), Fp.sub(a.c1, b.c1));
+    const mul2 = (a, b) => {
+        const t0 = Fp.mul(a.c0, b.c0);
+        const t1 = Fp.mul(a.c1, b.c1);
+        return fp2(Fp.sub(t0, t1), Fp.sub(Fp.mul(Fp.add(a.c0, a.c1), Fp.add(b.c0, b.c1)), Fp.add(t0, t1)));
+    };
+    const mul2ByFp = (a, rhs) => fp2(Fp.mul(a.c0, rhs), Fp.mul(a.c1, rhs));
+    // Delegates to the tower's mulByNonresidue: it has fast paths for ξ = u+1 / ξ = a+u
+    // (adds/scalar-muls instead of a full Karatsuba Fp2 multiplication).
+    const mul2ByNonresidue = (a) => Fp2.mulByNonresidue(a);
+    const mul014ByLine = ({ c0: f0, c1: f1 }, o0, l1, l4, Px, Py) => {
+        const o1 = mul2ByFp(l1, Px);
+        const o4 = mul2ByFp(l4, Py);
+        const { c0: a0, c1: a1, c2: a2 } = f0;
+        const { c0: b0, c1: b1, c2: b2 } = f1;
+        // t0 = Fp6.mul01(f0, o0, o1)
+        const t0_0 = mul2(a0, o0);
+        const t0_1 = mul2(a1, o1);
+        const t0_c0 = add2(mul2ByNonresidue(sub2(mul2(add2(a1, a2), o1), t0_1)), t0_0);
+        const t0_c1 = sub2(sub2(mul2(add2(o0, o1), add2(a0, a1)), t0_0), t0_1);
+        const t0_c2 = add2(sub2(mul2(add2(a0, a2), o0), t0_0), t0_1);
+        // t1 = Fp6.mul1(f1, o4)
+        const t1_c0 = mul2ByNonresidue(mul2(b2, o4));
+        const t1_c1 = mul2(b0, o4);
+        const t1_c2 = mul2(b1, o4);
+        // t2 = Fp6.mul01(Fp6.add(f0, f1), o0, Fp2.add(o1, o4))
+        const s0 = add2(a0, b0);
+        const s1 = add2(a1, b1);
+        const s2 = add2(a2, b2);
+        const o14 = add2(o1, o4);
+        const t2_0 = mul2(s0, o0);
+        const t2_1 = mul2(s1, o14);
+        const t2_c0 = add2(mul2ByNonresidue(sub2(mul2(add2(s1, s2), o14), t2_1)), t2_0);
+        const t2_c1 = sub2(sub2(mul2(add2(o0, o14), add2(s0, s1)), t2_0), t2_1);
+        const t2_c2 = add2(sub2(mul2(add2(s0, s2), o0), t2_0), t2_1);
+        return Object.freeze({
+            c0: Object.freeze({
+                c0: fp2f(add2(mul2ByNonresidue(t1_c2), t0_c0)),
+                c1: fp2f(add2(t1_c0, t0_c1)),
+                c2: fp2f(add2(t1_c1, t0_c2)),
+            }),
+            c1: Object.freeze({
+                c0: fp2f(sub2(sub2(t2_c0, t0_c0), t1_c0)),
+                c1: fp2f(sub2(sub2(t2_c1, t0_c1), t1_c1)),
+                c2: fp2f(sub2(sub2(t2_c2, t0_c2), t1_c2)),
+            }),
+        });
+    };
+    // Like mul014ByLine, params are named after the sparse slot they end up in: l0 is scaled by
+    // Py into o0, l3 is scaled by Px into o3, o4 is used as-is.
+    const mul034ByLine = ({ c0: f0, c1: f1 }, l0, l3, o4, Px, Py) => {
+        const o0 = mul2ByFp(l0, Py);
+        const o3 = mul2ByFp(l3, Px);
+        const { c0: a0, c1: a1, c2: a2 } = f0;
+        const { c0: b0, c1: b1, c2: b2 } = f1;
+        // a = f0 * o0
+        const a_c0 = mul2(a0, o0);
+        const a_c1 = mul2(a1, o0);
+        const a_c2 = mul2(a2, o0);
+        // b = Fp6.mul01(f1, o3, o4)
+        const b0m = mul2(b0, o3);
+        const b1m = mul2(b1, o4);
+        const b_c0 = add2(mul2ByNonresidue(sub2(mul2(add2(b1, b2), o4), b1m)), b0m);
+        const b_c1 = sub2(sub2(mul2(add2(o3, o4), add2(b0, b1)), b0m), b1m);
+        const b_c2 = add2(sub2(mul2(add2(b0, b2), o3), b0m), b1m);
+        // e = Fp6.mul01(Fp6.add(f0, f1), Fp2.add(o0, o3), o4)
+        const s0 = add2(a0, b0);
+        const s1 = add2(a1, b1);
+        const s2 = add2(a2, b2);
+        const o03 = add2(o0, o3);
+        const e0m = mul2(s0, o03);
+        const e1m = mul2(s1, o4);
+        const e_c0 = add2(mul2ByNonresidue(sub2(mul2(add2(s1, s2), o4), e1m)), e0m);
+        const e_c1 = sub2(sub2(mul2(add2(o03, o4), add2(s0, s1)), e0m), e1m);
+        const e_c2 = add2(sub2(mul2(add2(s0, s2), o03), e0m), e1m);
+        return Object.freeze({
+            c0: Object.freeze({
+                c0: fp2f(add2(mul2ByNonresidue(b_c2), a_c0)),
+                c1: fp2f(add2(b_c0, a_c1)),
+                c2: fp2f(add2(b_c1, a_c2)),
+            }),
+            c1: Object.freeze({
+                c0: fp2f(sub2(sub2(e_c0, a_c0), b_c0)),
+                c1: fp2f(sub2(sub2(e_c1, a_c1), b_c1)),
+                c2: fp2f(sub2(sub2(e_c2, a_c2), b_c2)),
+            }),
+        });
+    };
+    // Applies sparse multiplication as line function
+    let lineFunction;
+    if (twistType === 'multiplicative') {
+        lineFunction = (c0, c1, c2, f, Px, Py) => mul014ByLine(f, c0, c1, c2, Px, Py);
+    }
+    else if (twistType === 'divisive') {
+        // NOTE: it should be [c0, c1, c2], but we use different order here to reduce complexity of
+        // precompute calculations.
+        lineFunction = (c0, c1, c2, f, Px, Py) => mul034ByLine(f, c2, c1, c0, Px, Py);
+    }
+    else
+        throw new Error('bls: unknown twist type');
+    const Fp2div2 = Fp2.div(Fp2.ONE, Fp2.mul(Fp2.ONE, _2n$2));
+    function pointDouble(ell, Rx, Ry, Rz) {
+        const t0 = Fp2.sqr(Ry); // Ry²
+        const t1 = Fp2.sqr(Rz); // Rz²
+        const t2 = Fp2.mulByB(Fp2.mul(t1, _3n$2)); // 3 * T1 * B
+        const t3 = Fp2.mul(t2, _3n$2); // 3 * T2
+        const t4 = Fp2.sub(Fp2.sub(Fp2.sqr(Fp2.add(Ry, Rz)), t1), t0); // (Ry + Rz)² - T1 - T0
+        const c0 = Fp2.sub(t2, t0); // T2 - T0 (i)
+        const c1 = Fp2.mul(Fp2.sqr(Rx), _3n$2); // 3 * Rx²
+        const c2 = Fp2.neg(t4); // -T4 (-h)
+        ell.push([c0, c1, c2]);
+        Rx = Fp2.mul(Fp2.mul(Fp2.mul(Fp2.sub(t0, t3), Rx), Ry), Fp2div2); // ((T0 - T3) * Rx * Ry) / 2
+        // ((T0 + T3) / 2)² - 3 * T2²
+        Ry = Fp2.sub(Fp2.sqr(Fp2.mul(Fp2.add(t0, t3), Fp2div2)), Fp2.mul(Fp2.sqr(t2), _3n$2));
+        Rz = Fp2.mul(t0, t4); // T0 * T4
+        return { Rx, Ry, Rz };
+    }
+    function pointAdd(ell, Rx, Ry, Rz, Qx, Qy) {
+        // Addition
+        const t0 = Fp2.sub(Ry, Fp2.mul(Qy, Rz)); // Ry - Qy * Rz
+        const t1 = Fp2.sub(Rx, Fp2.mul(Qx, Rz)); // Rx - Qx * Rz
+        const c0 = Fp2.sub(Fp2.mul(t0, Qx), Fp2.mul(t1, Qy)); // T0 * Qx - T1 * Qy == Ry * Qx  - Rx * Qy
+        const c1 = Fp2.neg(t0); // -T0 == Qy * Rz - Ry
+        const c2 = t1; // == Rx - Qx * Rz
+        ell.push([c0, c1, c2]);
+        const t2 = Fp2.sqr(t1); // T1²
+        const t3 = Fp2.mul(t2, t1); // T2 * T1
+        const t4 = Fp2.mul(t2, Rx); // T2 * Rx
+        // T3 - 2 * T4 + T0² * Rz
+        const t5 = Fp2.add(Fp2.sub(t3, Fp2.mul(t4, _2n$2)), Fp2.mul(Fp2.sqr(t0), Rz));
+        Rx = Fp2.mul(t1, t5); // T1 * T5
+        Ry = Fp2.sub(Fp2.mul(Fp2.sub(t4, t5), t0), Fp2.mul(t3, Ry)); // (T4 - T5) * T0 - T3 * Ry
+        Rz = Fp2.mul(Rz, t3); // Rz * T3
+        return { Rx, Ry, Rz };
+    }
     // Pre-compute coefficients for sparse multiplication
     // Point addition and point double calculations is reused for coefficients
-    function calcPairingPrecomputes(p) {
-        const { x, y } = p;
+    // pointAdd happens only if bit set, so wNAF is reasonable. Unfortunately we cannot combine
+    // add + double in windowed precomputes here, otherwise it would be single op (since X is static)
+    const ATE_NAF = NAfDecomposition(ateLoopSize);
+    const calcPairingPrecomputes = (point) => {
+        if (!(point instanceof G2))
+            throw new TypeError('"point" expected G2 point, got type=' + typeof point);
+        const p = point;
+        const { x, y } = p.toAffine();
         // prettier-ignore
-        const Qx = x, Qy = y, Qz = Fp2.ONE;
+        const Qx = x, Qy = y, negQy = Fp2.neg(y);
         // prettier-ignore
-        let Rx = Qx, Ry = Qy, Rz = Qz;
-        let ell_coeff = [];
-        for (let i = BLS_X_LEN - 2; i >= 0; i--) {
-            // Double
-            let t0 = Fp2.sqr(Ry); // Ry²
-            let t1 = Fp2.sqr(Rz); // Rz²
-            let t2 = Fp2.multiplyByB(Fp2.mul(t1, _3n$1)); // 3 * T1 * B
-            let t3 = Fp2.mul(t2, _3n$1); // 3 * T2
-            let t4 = Fp2.sub(Fp2.sub(Fp2.sqr(Fp2.add(Ry, Rz)), t1), t0); // (Ry + Rz)² - T1 - T0
-            ell_coeff.push([
-                Fp2.sub(t2, t0),
-                Fp2.mul(Fp2.sqr(Rx), _3n$1),
-                Fp2.neg(t4), // -T4
-            ]);
-            Rx = Fp2.div(Fp2.mul(Fp2.mul(Fp2.sub(t0, t3), Rx), Ry), _2n$1); // ((T0 - T3) * Rx * Ry) / 2
-            Ry = Fp2.sub(Fp2.sqr(Fp2.div(Fp2.add(t0, t3), _2n$1)), Fp2.mul(Fp2.sqr(t2), _3n$1)); // ((T0 + T3) / 2)² - 3 * T2²
-            Rz = Fp2.mul(t0, t4); // T0 * T4
-            if (bitGet(CURVE.params.x, i)) {
-                // Addition
-                let t0 = Fp2.sub(Ry, Fp2.mul(Qy, Rz)); // Ry - Qy * Rz
-                let t1 = Fp2.sub(Rx, Fp2.mul(Qx, Rz)); // Rx - Qx * Rz
-                ell_coeff.push([
-                    Fp2.sub(Fp2.mul(t0, Qx), Fp2.mul(t1, Qy)),
-                    Fp2.neg(t0),
-                    t1, // T1
-                ]);
-                let t2 = Fp2.sqr(t1); // T1²
-                let t3 = Fp2.mul(t2, t1); // T2 * T1
-                let t4 = Fp2.mul(t2, Rx); // T2 * Rx
-                let t5 = Fp2.add(Fp2.sub(t3, Fp2.mul(t4, _2n$1)), Fp2.mul(Fp2.sqr(t0), Rz)); // T3 - 2 * T4 + T0² * Rz
-                Rx = Fp2.mul(t1, t5); // T1 * T5
-                Ry = Fp2.sub(Fp2.mul(Fp2.sub(t4, t5), t0), Fp2.mul(t3, Ry)); // (T4 - T5) * T0 - T3 * Ry
-                Rz = Fp2.mul(Rz, t3); // Rz * T3
-            }
+        let Rx = Qx, Ry = Qy, Rz = Fp2.ONE;
+        const ell = [];
+        for (const bit of ATE_NAF) {
+            const cur = [];
+            ({ Rx, Ry, Rz } = pointDouble(cur, Rx, Ry, Rz));
+            if (bit)
+                ({ Rx, Ry, Rz } = pointAdd(cur, Rx, Ry, Rz, Qx, bit === -1 ? negQy : Qy));
+            ell.push(cur);
         }
-        return ell_coeff;
-    }
-    function millerLoop(ell, g1) {
-        const { x } = CURVE.params;
-        const Px = g1[0];
-        const Py = g1[1];
+        if (postPrecompute) {
+            const last = ell[ell.length - 1];
+            postPrecompute(Rx, Ry, Rz, Qx, Qy, pointAdd.bind(null, last));
+        }
+        return ell;
+    };
+    function millerLoopBatch(pairs, withFinalExponent = false) {
+        aarray(pairs, 'pairs', (pair, title) => {
+            aarray(pair, title);
+            if (pair.length !== 3)
+                throw new TypeError(`"${title}" expected precompute tuple`);
+            aarray(pair[0], title + '[0]');
+        });
         let f12 = Fp12.ONE;
-        for (let j = 0, i = BLS_X_LEN - 2; i >= 0; i--, j++) {
-            const E = ell[j];
-            f12 = Fp12.multiplyBy014(f12, E[0], Fp2.mul(E[1], Px), Fp2.mul(E[2], Py));
-            if (bitGet(x, i)) {
-                j += 1;
-                const F = ell[j];
-                f12 = Fp12.multiplyBy014(f12, F[0], Fp2.mul(F[1], Px), Fp2.mul(F[2], Py));
+        if (pairs.length) {
+            const ellLen = pairs[0][0].length;
+            for (let i = 0; i < ellLen; i++) {
+                // sqr only one time for all pairings; skip sqr(ONE) at i=0
+                if (i !== 0)
+                    f12 = Fp12.sqr(f12);
+                // NOTE: we apply multiple pairings in parallel here
+                for (const [ell, Px, Py] of pairs) {
+                    for (const [c0, c1, c2] of ell[i])
+                        f12 = lineFunction(c0, c1, c2, f12, Px, Py);
+                }
             }
-            if (i !== 0)
-                f12 = Fp12.sqr(f12);
         }
-        return Fp12.conjugate(f12);
+        if (xNegative)
+            f12 = Fp12.conjugate(f12);
+        return withFinalExponent ? Fp12.finalExponentiate(f12) : f12;
+    }
+    // Calculates product of multiple pairings
+    // This up to x2 faster than just `map(({g1, g2})=>pairing({g1,g2}))`
+    function pairingBatch(pairs, withFinalExponent = true) {
+        aarray(pairs, 'pairs');
+        const res = [];
+        for (let i = 0; i < pairs.length; i++) {
+            const pair = pairs[i];
+            validateObject(pair, { g1: 'object', g2: 'object' }, {}, 'pairs[' + i + ']');
+            const { g1, g2 } = pair;
+            if (!(g1 instanceof G1))
+                throw new TypeError('"pairs[' + i + '].g1" expected G1 point, got type=' + typeof g1);
+            if (!(g2 instanceof G2))
+                throw new TypeError('"pairs[' + i + '].g2" expected G2 point, got type=' + typeof g2);
+            // Mathematically, a zero pairing term contributes GT.ONE. We still reject it here because
+            // this API mainly backs BLS verification, where ZERO inputs usually mean broken hash /
+            // wiring. Silently skipping them would turn those failures into a neutral pairing product.
+            // Callers that want the algebraic neutral-element behavior can filter ZERO terms first.
+            if (g1.is0() || g2.is0())
+                throw new Error('pairing is not available for ZERO point');
+            // This uses toAffine inside
+            g1.assertValidity();
+            g2.assertValidity();
+            const Qa = g1.toAffine();
+            res.push([calcPairingPrecomputes(g2), Qa.x, Qa.y]);
+        }
+        return millerLoopBatch(res, withFinalExponent);
     }
-    const utils = {
-        randomPrivateKey: () => {
-            const length = getMinHashLength(Fr.ORDER);
-            return mapHashToField(CURVE.randomBytes(length), Fr.ORDER);
-        },
-        calcPairingPrecomputes,
-    };
-    // Point on G1 curve: (x, y)
-    const G1_ = weierstrassPoints({ n: Fr.ORDER, ...CURVE.G1 });
-    const G1 = Object.assign(G1_, createHasher(G1_.ProjectivePoint, CURVE.G1.mapToCurve, {
-        ...CURVE.htfDefaults,
-        ...CURVE.G1.htfDefaults,
-    }));
-    function pairingPrecomputes(point) {
-        const p = point;
-        if (p._PPRECOMPUTES)
-            return p._PPRECOMPUTES;
-        p._PPRECOMPUTES = calcPairingPrecomputes(point.toAffine());
-        return p._PPRECOMPUTES;
-    }
-    // TODO: export
-    // function clearPairingPrecomputes(point: G2) {
-    //   const p = point as G2 & withPairingPrecomputes;
-    //   p._PPRECOMPUTES = undefined;
-    // }
-    // Point on G2 curve (complex numbers): (x₁, x₂+i), (y₁, y₂+i)
-    const G2_ = weierstrassPoints({ n: Fr.ORDER, ...CURVE.G2 });
-    const G2 = Object.assign(G2_, createHasher(G2_.ProjectivePoint, CURVE.G2.mapToCurve, {
-        ...CURVE.htfDefaults,
-        ...CURVE.G2.htfDefaults,
-    }));
-    const { Signature } = CURVE.G2;
     // Calculates bilinear pairing
     function pairing(Q, P, withFinalExponent = true) {
-        if (Q.equals(G1.ProjectivePoint.ZERO) || P.equals(G2.ProjectivePoint.ZERO))
-            throw new Error('pairing is not available for ZERO point');
-        Q.assertValidity();
-        P.assertValidity();
-        // Performance: 9ms for millerLoop and ~14ms for exp.
-        const Qa = Q.toAffine();
-        const looped = millerLoop(pairingPrecomputes(P), [Qa.x, Qa.y]);
-        return withFinalExponent ? Fp12.finalExponentiate(looped) : looped;
-    }
-    function normP1(point) {
-        return point instanceof G1.ProjectivePoint ? point : G1.ProjectivePoint.fromHex(point);
-    }
-    function normP2(point) {
-        return point instanceof G2.ProjectivePoint ? point : Signature.fromHex(point);
-    }
-    function normP2Hash(point, htfOpts) {
-        return point instanceof G2.ProjectivePoint
-            ? point
-            : G2.hashToCurve(ensureBytes('point', point), htfOpts);
-    }
-    // Multiplies generator by private key.
-    // P = pk x G
-    function getPublicKey(privateKey) {
-        return G1.ProjectivePoint.fromPrivateKey(privateKey).toRawBytes(true);
-    }
-    function sign(message, privateKey, htfOpts) {
-        const msgPoint = normP2Hash(message, htfOpts);
-        msgPoint.assertValidity();
-        const sigPoint = msgPoint.multiply(G1.normPrivateKeyToScalar(privateKey));
-        if (message instanceof G2.ProjectivePoint)
-            return sigPoint;
-        return Signature.toRawBytes(sigPoint);
-    }
-    // Checks if pairing of public key & hash is equal to pairing of generator & signature.
-    // e(P, H(m)) == e(G, S)
-    function verify(signature, message, publicKey, htfOpts) {
-        const P = normP1(publicKey);
-        const Hm = normP2Hash(message, htfOpts);
-        const G = G1.ProjectivePoint.BASE;
-        const S = normP2(signature);
-        // Instead of doing 2 exponentiations, we use property of billinear maps
-        // and do one exp after multiplying 2 points.
-        const ePHm = pairing(P.negate(), Hm, false);
-        const eGS = pairing(G, S, false);
-        const exp = Fp12.finalExponentiate(Fp12.mul(eGS, ePHm));
-        return Fp12.eql(exp, Fp12.ONE);
-    }
-    function aggregatePublicKeys(publicKeys) {
-        if (!publicKeys.length)
-            throw new Error('Expected non-empty array');
-        const agg = publicKeys.map(normP1).reduce((sum, p) => sum.add(p), G1.ProjectivePoint.ZERO);
-        const aggAffine = agg; //.toAffine();
-        if (publicKeys[0] instanceof G1.ProjectivePoint) {
-            aggAffine.assertValidity();
-            return aggAffine;
-        }
-        // toRawBytes ensures point validity
-        return aggAffine.toRawBytes(true);
-    }
-    function aggregateSignatures(signatures) {
-        if (!signatures.length)
-            throw new Error('Expected non-empty array');
-        const agg = signatures.map(normP2).reduce((sum, s) => sum.add(s), G2.ProjectivePoint.ZERO);
-        const aggAffine = agg; //.toAffine();
-        if (signatures[0] instanceof G2.ProjectivePoint) {
-            aggAffine.assertValidity();
-            return aggAffine;
-        }
-        return Signature.toRawBytes(aggAffine);
+        if (!(Q instanceof G1))
+            throw new TypeError('"Q" expected G1 point, got type=' + typeof Q);
+        if (!(P instanceof G2))
+            throw new TypeError('"P" expected G2 point, got type=' + typeof P);
+        return pairingBatch([{ g1: Q, g2: P }], withFinalExponent);
     }
-    // https://ethresear.ch/t/fast-verification-of-multiple-bls-signatures/5407
-    // e(G, S) = e(G, SUM(n)(Si)) = MUL(n)(e(G, Si))
-    function verifyBatch(signature, messages, publicKeys, htfOpts) {
-        // @ts-ignore
-        // console.log('verifyBatch', bytesToHex(signature as any), messages, publicKeys.map(bytesToHex));
-        if (!messages.length)
-            throw new Error('Expected non-empty messages array');
-        if (publicKeys.length !== messages.length)
-            throw new Error('Pubkey count should equal msg count');
-        const sig = normP2(signature);
-        const nMessages = messages.map((i) => normP2Hash(i, htfOpts));
-        const nPublicKeys = publicKeys.map(normP1);
-        try {
+    const lengths = {
+        seed: getMinHashLength(Fr.ORDER),
+    };
+    const rand = params.randomBytes === undefined ? randomBytes : params.randomBytes;
+    // Seeded calls deterministically reduce exactly `lengths.seed` bytes into `1..Fr.ORDER-1`;
+    // omitting `seed` just fills that input buffer from the configured RNG first.
+    const randomSecretKey = (seed) => {
+        seed = seed === undefined ? rand(lengths.seed) : seed;
+        abytes(seed, lengths.seed, 'seed');
+        return mapHashToField(seed, Fr.ORDER);
+    };
+    Object.freeze(lengths);
+    return {
+        lengths,
+        Fr,
+        Fp12, // NOTE: we re-export Fp12 here because pairing results are Fp12!
+        millerLoopBatch,
+        pairing,
+        pairingBatch,
+        calcPairingPrecomputes,
+        randomSecretKey,
+    };
+}
+function createBlsSig(blsPairing, PubPoint, SigPoint, isSigG1, hashToSigCurve, SignatureCoder) {
+    const { Fr, Fp12, pairingBatch, randomSecretKey, lengths } = blsPairing;
+    if (!SignatureCoder) {
+        SignatureCoder = {
+            fromBytes: notImplemented,
+            fromHex: notImplemented,
+            toBytes: notImplemented,
+            toHex: notImplemented,
+        };
+    }
+    // Internal decoding must use the same owned callback snapshot exposed on `.Signature`.
+    // Retaining the caller's coder object would allow verification policy to change later.
+    const sigCoder = Object.freeze({ ...SignatureCoder });
+    function normPub(point) {
+        return point instanceof PubPoint ? point : PubPoint.fromBytes(point);
+    }
+    function normSig(point) {
+        return point instanceof SigPoint ? point : sigCoder.fromBytes(point);
+    }
+    // Sign/verify here take points already hashed onto the signature subgroup.
+    // Raw bytes and points from the other subgroup must fail this constructor-brand
+    // check before later validity checks run.
+    function amsg(m) {
+        if (!(m instanceof SigPoint))
+            throw new Error(`expected valid message hashed to ${!isSigG1 ? 'G2' : 'G1'} curve`);
+        return m;
+    }
+    // What matters here is what point pairing API accepts as G1 or G2, not actual size or names
+    const pair = !isSigG1
+        ? (a, b) => ({ g1: a, g2: b })
+        : (a, b) => ({ g1: b, g2: a });
+    return Object.freeze({
+        lengths: Object.freeze({ ...lengths, secretKey: Fr.BYTES }),
+        keygen(seed) {
+            const secretKey = randomSecretKey(seed);
+            const publicKey = this.getPublicKey(secretKey);
+            return { secretKey, publicKey };
+        },
+        // P = pk x G
+        getPublicKey(secretKey) {
+            let sec;
+            try {
+                sec = PubPoint.Fn.fromBytes(secretKey);
+            }
+            catch (error) {
+                // @ts-ignore
+                throw new Error('invalid private key: ' + typeof secretKey, { cause: error });
+            }
+            return PubPoint.BASE.multiply(sec);
+        },
+        // S = pk x H(m)
+        sign(message, secretKey, unusedArg) {
+            if (unusedArg != null)
+                throw new Error('sign() expects 2 arguments');
+            const sec = PubPoint.Fn.fromBytes(secretKey);
+            // BLS/BN point APIs allow infinity for compatibility; raw message bytes still fail amsg().
+            amsg(message).assertValidity();
+            return message.multiply(sec);
+        },
+        // Checks if pairing of public key & hash is equal to pairing of generator & signature.
+        // e(P, H(m)) == e(G, S)
+        // e(S, G) == e(H(m), P)
+        verify(signature, message, publicKey, unusedArg) {
+            if (unusedArg != null)
+                throw new Error('verify() expects 3 arguments');
+            signature = normSig(signature);
+            publicKey = normPub(publicKey);
+            const P = publicKey.negate();
+            const G = PubPoint.BASE;
+            const Hm = amsg(message);
+            const S = signature;
+            // This code was changed in 1.9.x:
+            // Before it was G.negate() in G2, now it's always pubKey.negate
+            // e(P, -Q)===e(-P, Q)==e(P, Q)^-1. Negate can be done anywhere (as long it is done once per pair).
+            // We just moving sign, but since pairing is multiplicative, we doing X * X^-1 = 1
+            try {
+                const exp = pairingBatch([pair(P, Hm), pair(G, S)]);
+                return Fp12.eql(exp, Fp12.ONE);
+            }
+            catch {
+                return false;
+            }
+        },
+        // https://ethresear.ch/t/fast-verification-of-multiple-bls-signatures/5407
+        // e(G, S) = e(G, SUM(n)(Si)) = MUL(n)(e(G, Si))
+        // TODO: maybe `{message: G2Hex, publicKey: G1Hex}[]` instead?
+        verifyBatch(signature, items) {
+            aNonEmpty(items);
+            const sig = normSig(signature);
+            const nMessages = items.map((i) => amsg(i.message));
+            const nPublicKeys = items.map((i) => normPub(i.publicKey));
+            // NOTE: this works only for exact same object
+            const messagePubKeyMap = new Map();
+            for (let i = 0; i < nPublicKeys.length; i++) {
+                const pub = nPublicKeys[i];
+                const msg = nMessages[i];
+                let keys = messagePubKeyMap.get(msg);
+                if (keys === undefined) {
+                    keys = [];
+                    messagePubKeyMap.set(msg, keys);
+                }
+                keys.push(pub);
+            }
             const paired = [];
-            for (const message of new Set(nMessages)) {
-                const groupPublicKey = nMessages.reduce((groupPublicKey, subMessage, i) => subMessage === message ? groupPublicKey.add(nPublicKeys[i]) : groupPublicKey, G1.ProjectivePoint.ZERO);
-                // const msg = message instanceof PointG2 ? message : await PointG2.hashToCurve(message);
-                // Possible to batch pairing for same msg with different groupPublicKey here
-                paired.push(pairing(groupPublicKey, message, false));
+            const G = PubPoint.BASE;
+            try {
+                for (const [msg, keys] of messagePubKeyMap) {
+                    const groupPublicKey = keys.reduce((acc, msg) => acc.add(msg));
+                    paired.push(pair(groupPublicKey, msg));
+                }
+                paired.push(pair(G.negate(), sig));
+                return Fp12.eql(pairingBatch(paired), Fp12.ONE);
             }
-            paired.push(pairing(G1.ProjectivePoint.BASE.negate(), sig, false));
-            const product = paired.reduce((a, b) => Fp12.mul(a, b), Fp12.ONE);
-            const exp = Fp12.finalExponentiate(product);
-            return Fp12.eql(exp, Fp12.ONE);
-        }
-        catch {
-            return false;
-        }
-    }
-    G1.ProjectivePoint.BASE._setWindowSize(4);
-    return {
-        getPublicKey,
-        sign,
-        verify,
-        verifyBatch,
-        aggregatePublicKeys,
-        aggregateSignatures,
-        millerLoop,
+            catch {
+                return false;
+            }
+        },
+        // Adds a bunch of public key points together.
+        // pk1 + pk2 + pk3 = pkA
+        aggregatePublicKeys(publicKeys) {
+            aNonEmpty(publicKeys);
+            publicKeys = publicKeys.map((pub) => normPub(pub));
+            const agg = publicKeys.reduce((sum, p) => sum.add(p), PubPoint.ZERO);
+            agg.assertValidity();
+            return agg;
+        },
+        // Adds a bunch of signature points together.
+        // pk1 + pk2 + pk3 = pkA
+        aggregateSignatures(signatures) {
+            aNonEmpty(signatures);
+            signatures = signatures.map((sig) => normSig(sig));
+            const agg = signatures.reduce((sum, s) => sum.add(s), SigPoint.ZERO);
+            agg.assertValidity();
+            return agg;
+        },
+        hash(messageBytes, DST) {
+            abytes(messageBytes);
+            // Only omitted DST uses the default; explicit empty DST must reach normDST validation.
+            const opts = DST === undefined ? undefined : { DST };
+            return hashToSigCurve(messageBytes, opts);
+        },
+        Signature: Object.freeze({ ...sigCoder }),
+    }); /*satisfies Signer */
+}
+// NOTE: separate function instead of function override, so we don't depend on hasher in bn254.
+/**
+ * @param fields - Tower field implementations.
+ * @param G1_Point - G1 point constructor.
+ * @param G2_Point - G2 point constructor.
+ * @param params - Pairing parameters. See {@link BlsPairingParams}.
+ * @returns Pairing-only BLS helpers. The returned pairing surface rejects infinity inputs, while
+ *   empty `pairingBatch(...)` calls return the multiplicative identity in GT. This keeps the
+ *   low-level pairing API fail-closed for BLS-style callers, where identity points usually signal
+ *   broken hash / wiring instead of an intentionally neutral pairing term. This also eagerly
+ *   precomputes the G1 base-point table as a performance side effect.
+ * @throws If the pairing parameters or underlying curve helpers are inconsistent. {@link Error}
+ * @example
+ * ```ts
+ * import { blsBasic } from '@noble/curves/abstract/bls.js';
+ * import { bn254 } from '@noble/curves/bn254.js';
+ * // Rebuild the pairing-only helper from a concrete curve's public pieces.
+ * const pair = blsBasic(bn254.fields, bn254.G1.Point, bn254.G2.Point, bn254.params);
+ * const gt = pair.pairing(pair.G1.Point.BASE, pair.G2.Point.BASE);
+ * ```
+ */
+function blsBasic(fields, G1_Point, G2_Point, params) {
+    // Fields are specific for curve, so for now we'll need to pass them with opts
+    const { Fp, Fr, Fp2, Fp6, Fp12 } = fields;
+    // Point on G1 curve: (x, y)
+    // const G1_Point = weierstrass(CURVE.G1, { Fn: Fr });
+    const G1 = { Point: G1_Point };
+    // Point on G2 curve (complex numbers): (x₁, x₂+i), (y₁, y₂+i)
+    const G2 = { Point: G2_Point };
+    const pairingRes = createBlsPairing(fields, G1_Point, G2_Point, params);
+    const { millerLoopBatch, pairing, pairingBatch, calcPairingPrecomputes, randomSecretKey, lengths, } = pairingRes;
+    G1.Point.BASE.precompute(4);
+    Object.freeze(G1);
+    Object.freeze(G2);
+    return Object.freeze({
+        lengths: Object.freeze(lengths),
+        millerLoopBatch,
         pairing,
+        pairingBatch,
         G1,
         G2,
-        Signature,
-        fields: {
-            Fr,
-            Fp,
-            Fp2,
-            Fp6,
-            Fp12,
-        },
-        params: {
-            x: CURVE.params.x,
-            r: CURVE.params.r,
-            G1b: CURVE.G1.b,
-            G2b: CURVE.G2.b,
-        },
-        utils,
+        fields: Object.freeze({ Fr, Fp, Fp2, Fp6, Fp12 }),
+        params: Object.freeze({
+            ateLoopSize: params.ateLoopSize,
+            xNegative: params.xNegative,
+            twistType: params.twistType,
+            postPrecompute: params.postPrecompute,
+        }),
+        utils: Object.freeze({
+            randomSecretKey,
+            calcPairingPrecomputes,
+        }),
+    });
+}
+// We can export this too, but seems there is not much reasons for now? If user wants hasher, they can just create hasher.
+function blsHashers(fields, G1_Point, G2_Point, params, hasherParams) {
+    const base = blsBasic(fields, G1_Point, G2_Point, params);
+    validateObject(hasherParams, { hasherOpts: 'object', hasherOptsG1: 'object', hasherOptsG2: 'object' }, { mapToG1: 'function', mapToG2: 'function' }, 'hasherParams');
+    // Missing map hooks intentionally fail closed via notImplemented on first hash use.
+    const G1Hasher = createHasher(G1_Point, hasherParams.mapToG1 === undefined ? notImplemented : hasherParams.mapToG1, {
+        ...hasherParams.hasherOpts,
+        ...hasherParams.hasherOptsG1,
+    });
+    const G2Hasher = createHasher(G2_Point, hasherParams.mapToG2 === undefined ? notImplemented : hasherParams.mapToG2, {
+        ...hasherParams.hasherOpts,
+        ...hasherParams.hasherOptsG2,
+    });
+    return Object.freeze({ ...base, G1: G1Hasher, G2: G2Hasher });
+}
+// G1_Point: ProjConstructor<bigint>, G2_Point: ProjConstructor<Fp2>,
+// Rename to blsSignatures?
+/**
+ * @param fields - Tower field implementations.
+ * @param G1_Point - G1 point constructor.
+ * @param G2_Point - G2 point constructor.
+ * @param params - Pairing parameters. See {@link BlsPairingParams}.
+ * @param hasherParams - Hash-to-curve configuration. See {@link BlsHasherParams}.
+ * @param signatureCoders - Signature codecs.
+ * @returns BLS helpers with signers. The inherited pairing surface still rejects infinity inputs,
+ *   and empty `pairingBatch(...)` calls still return the multiplicative identity in GT. Aggregate
+ *   verification still requires proof of possession or another rogue-key defense from the caller.
+ * @throws If the pairing, hashing, or signature helpers are configured inconsistently. {@link Error}
+ * @example
+ * ```ts
+ * import { bls } from '@noble/curves/abstract/bls.js';
+ * import { bls12_381 } from '@noble/curves/bls12-381.js';
+ * // Rebuild a signer namespace from a concrete curve.
+ * // Applications usually import bls12_381 directly.
+ * const rebuilt = bls(
+ *   bls12_381.fields,
+ *   bls12_381.G1.Point,
+ *   bls12_381.G2.Point,
+ *   bls12_381.params,
+ *   {
+ *     hasherOpts: bls12_381.G2.defaults,
+ *     hasherOptsG1: bls12_381.G1.defaults,
+ *     hasherOptsG2: bls12_381.G2.defaults,
+ *   },
+ *   {}
+ * );
+ * const { secretKey, publicKey } = rebuilt.longSignatures.keygen();
+ * ```
+ */
+function bls(fields, G1_Point, G2_Point, params, hasherParams, signatureCoders) {
+    const base = blsHashers(fields, G1_Point, G2_Point, params, hasherParams);
+    const pairingRes = {
+        ...base,
+        Fr: base.fields.Fr,
+        Fp12: base.fields.Fp12,
+        calcPairingPrecomputes: base.utils.calcPairingPrecomputes,
+        randomSecretKey: base.utils.randomSecretKey,
     };
+    const longSignatures = createBlsSig(pairingRes, G1_Point, G2_Point, false, base.G2.hashToCurve, signatureCoders?.LongSignature);
+    const shortSignatures = createBlsSig(pairingRes, G2_Point, G1_Point, true, base.G1.hashToCurve, signatureCoders?.ShortSignature);
+    return Object.freeze({ ...base, longSignatures, shortSignatures });
 }
 
+/**
+ * Towered extension fields.
+ * Rather than implementing a massive 12th-degree extension directly, it is more efficient
+ * to build it up from smaller extensions: a tower of extensions.
+ *
+ * For BLS12-381, the Fp12 field is implemented as a quadratic (degree two) extension,
+ * on top of a cubic (degree three) extension, on top of a quadratic extension of Fp.
+ *
+ * For more info: "Pairings for beginners" by Costello, section 7.3.
+ * @module
+ */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-// bls12-381 pairing-friendly Barreto-Lynn-Scott elliptic curve construction allows to:
-// - Construct zk-SNARKs at the 128-bit security
-// - Use threshold signatures, which allows a user to sign lots of messages with one signature and
-//   verify them swiftly in a batch, using Boneh-Lynn-Shacham signature scheme.
-//
-// The library uses G1 for public keys and G2 for signatures. Support for G1 signatures is planned.
-// Compatible with Algorand, Chia, Dfinity, Ethereum, FIL, Zcash. Matches specs
-// [pairing-curves-11](https://tools.ietf.org/html/draft-irtf-cfrg-pairing-friendly-curves-11),
-// [bls-sigs-04](https:/cfrg-hash-to/tools.ietf.org/html/draft-irtf-cfrg-bls-signature-04),
-// [hash-to-curve-12](https://tools.ietf.org/html/draft-irtf--curve-12).
-//
-// ### Summary
-// 1. BLS Relies on Bilinear Pairing (expensive)
-// 2. Private Keys: 32 bytes
-// 3. Public Keys: 48 bytes: 381 bit affine x coordinate, encoded into 48 big-endian bytes.
-// 4. Signatures: 96 bytes: two 381 bit integers (affine x coordinate), encoded into two 48 big-endian byte arrays.
-//     - The signature is a point on the G2 subgroup, which is defined over a finite field
-//     with elements twice as big as the G1 curve (G2 is over Fp2 rather than Fp. Fp2 is analogous to the complex numbers).
-// 5. The 12 stands for the Embedding degree.
-//
-// ### Formulas
-// - `P = pk x G` - public keys
-// - `S = pk x H(m)` - signing
-// - `e(P, H(m)) == e(G, S)` - verification using pairings
-// - `e(G, S) = e(G, SUM(n)(Si)) = MUL(n)(e(G, Si))` - signature aggregation
-// Filecoin uses little endian byte arrays for private keys -
-// so ensure to reverse byte order if you'll use it with FIL.
 // Be friendly to bad ECMAScript parsers by not using bigint literals
 // prettier-ignore
-const _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);
-// prettier-ignore
-const _8n = BigInt(8), _16n = BigInt(16);
-// CURVE FIELDS
-// Finite field over p.
-const Fp_raw = BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab');
-const Fp = Field(Fp_raw);
-// Finite field over r.
-// This particular field is not used anywhere in bls12-381, but it is still useful.
-const Fr$1 = Field(BigInt('0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001'));
-const Fp2Add = ({ c0, c1 }, { c0: r0, c1: r1 }) => ({
-    c0: Fp.add(c0, r0),
-    c1: Fp.add(c1, r1),
-});
-const Fp2Subtract = ({ c0, c1 }, { c0: r0, c1: r1 }) => ({
-    c0: Fp.sub(c0, r0),
-    c1: Fp.sub(c1, r1),
-});
-const Fp2Multiply = ({ c0, c1 }, rhs) => {
-    if (typeof rhs === 'bigint')
-        return { c0: Fp.mul(c0, rhs), c1: Fp.mul(c1, rhs) };
-    // (a+bi)(c+di) = (ac−bd) + (ad+bc)i
-    const { c0: r0, c1: r1 } = rhs;
-    let t1 = Fp.mul(c0, r0); // c0 * o0
-    let t2 = Fp.mul(c1, r1); // c1 * o1
-    // (T1 - T2) + ((c0 + c1) * (r0 + r1) - (T1 + T2))*i
-    const o0 = Fp.sub(t1, t2);
-    const o1 = Fp.sub(Fp.mul(Fp.add(c0, c1), Fp.add(r0, r1)), Fp.add(t1, t2));
-    return { c0: o0, c1: o1 };
-};
-const Fp2Square = ({ c0, c1 }) => {
-    const a = Fp.add(c0, c1);
-    const b = Fp.sub(c0, c1);
-    const c = Fp.add(c0, c0);
-    return { c0: Fp.mul(a, b), c1: Fp.mul(c, c1) };
-};
-// G2 is the order-q subgroup of E2(Fp²) : y² = x³+4(1+√−1),
-// where Fp2 is Fp[√−1]/(x2+1). #E2(Fp2 ) = h2q, where
-// G² - 1
-// h2q
-// NOTE: ORDER was wrong!
-const FP2_ORDER = Fp_raw * Fp_raw;
-const Fp2 = {
-    ORDER: FP2_ORDER,
-    BITS: bitLen(FP2_ORDER),
-    BYTES: Math.ceil(bitLen(FP2_ORDER) / 8),
-    MASK: bitMask(bitLen(FP2_ORDER)),
-    ZERO: { c0: Fp.ZERO, c1: Fp.ZERO },
-    ONE: { c0: Fp.ONE, c1: Fp.ZERO },
-    create: (num) => num,
-    isValid: ({ c0, c1 }) => typeof c0 === 'bigint' && typeof c1 === 'bigint',
-    is0: ({ c0, c1 }) => Fp.is0(c0) && Fp.is0(c1),
-    eql: ({ c0, c1 }, { c0: r0, c1: r1 }) => Fp.eql(c0, r0) && Fp.eql(c1, r1),
-    neg: ({ c0, c1 }) => ({ c0: Fp.neg(c0), c1: Fp.neg(c1) }),
-    pow: (num, power) => FpPow(Fp2, num, power),
-    invertBatch: (nums) => FpInvertBatch(Fp2, nums),
+const _0n$1 = /* @__PURE__ */ BigInt(0), _1n$1 = /* @__PURE__ */ BigInt(1), _2n$1 = /* @__PURE__ */ BigInt(2), _3n$1 = /* @__PURE__ */ BigInt(3), _6n = /* @__PURE__ */ BigInt(6), _12n = /* @__PURE__ */ BigInt(12);
+const isObj = (value) => !!value && typeof value === 'object';
+function calcFrobeniusCoefficients(Fp, nonResidue, modulus, degree, num = 1, divisor) {
+    asafenumber(num, 'num');
+    asafenumber(degree, 'degree');
+    const divisorN = divisor === undefined ? degree : divisor;
+    asafenumber(divisorN, 'divisor');
+    const F = Fp;
+    // Generic callers reach this through `__TEST`; validate before bigint operators can throw raw
+    // native RangeError/TypeError diagnostics for malformed tower parameters.
+    if (typeof modulus !== 'bigint' || modulus <= _1n$1)
+        throw new Error('calcFrobeniusCoefficients: expected valid modulus, got ' + modulus);
+    if (degree <= 0)
+        throw new Error('calcFrobeniusCoefficients: expected positive degree, got ' + degree);
+    if (num <= 0)
+        throw new Error('calcFrobeniusCoefficients: expected positive row count, got ' + num);
+    if (divisorN <= 0)
+        throw new Error('calcFrobeniusCoefficients: expected positive divisor, got ' + divisorN);
+    const _divisor = BigInt(divisorN);
+    const towerModulus = modulus ** BigInt(degree);
+    const res = [];
+    // Derive tower-basis multipliers for the `p^k` Frobenius action. The
+    // divisions below are expected to be exact for the chosen tower parameters.
+    for (let i = 0; i < num; i++) {
+        const a = BigInt(i + 1);
+        const powers = [];
+        for (let j = 0, qPower = _1n$1; j < degree; j++) {
+            const numer = a * qPower - a;
+            // Shipped towers divide cleanly here, but generic callers can pick bad
+            // params. Bigint division would floor and derive the wrong Frobenius table.
+            if (numer % _divisor)
+                throw new Error('calcFrobeniusCoefficients: inexact tower exponent');
+            const power = (numer / _divisor) % towerModulus;
+            powers.push(F.pow(nonResidue, power));
+            qPower *= modulus;
+        }
+        res.push(powers);
+    }
+    return res;
+}
+// This works same at least for bls12-381, bn254 and bls12-377
+/**
+ * @param Fp - Base field implementation.
+ * @param Fp2 - Quadratic extension field.
+ * @param base - Twist-specific Frobenius base whose powers yield the `c1` / `c2` constants.
+ * BLS12-381 uses `1 / NONRESIDUE`; BN254 uses `NONRESIDUE`.
+ * @returns Frobenius endomorphism helpers.
+ * @throws If the derived Frobenius constants are inconsistent for the tower. {@link Error}
+ * @example
+ * Build Frobenius endomorphism helpers for a BLS extension tower.
+ *
+ * ```ts
+ * import { psiFrobenius } from '@noble/curves/abstract/tower.js';
+ * import { bls12_381 } from '@noble/curves/bls12-381.js';
+ * const Fp = bls12_381.fields.Fp;
+ * const Fp2 = bls12_381.fields.Fp2;
+ * const frob = psiFrobenius(Fp, Fp2, Fp2.div(Fp2.ONE, Fp2.NONRESIDUE));
+ * const point = frob.G2psi(bls12_381.G2.Point, bls12_381.G2.Point.BASE);
+ * ```
+ */
+function psiFrobenius(Fp, Fp2, base) {
+    validateField(Fp);
+    validateField(Fp2);
+    validateObject(Fp2, {
+        Fp: 'object',
+        frobeniusMap: 'function',
+        fromBigTuple: 'function',
+        mulByB: 'function',
+        mulByNonresidue: 'function',
+        reim: 'function',
+        Fp4Square: 'function',
+        NONRESIDUE: 'object',
+    }, {});
+    if (!isObj(base) || Array.isArray(base))
+        throw new TypeError('"base" expected Fp2 element, got type=' + typeof base);
+    if (!Fp2.isValid(base))
+        throw new RangeError('"base" expected valid Fp2 element');
+    // GLV endomorphism Ψ(P)
+    const PSI_X = Fp2.pow(base, (Fp.ORDER - _1n$1) / _3n$1); // u^((p-1)/3)
+    const PSI_Y = Fp2.pow(base, (Fp.ORDER - _1n$1) / _2n$1); // u^((p-1)/2)
+    function psi(x, y) {
+        // This x10 faster than previous version in bls12-381
+        const x2 = Fp2.mul(Fp2.frobeniusMap(x, 1), PSI_X);
+        const y2 = Fp2.mul(Fp2.frobeniusMap(y, 1), PSI_Y);
+        return [x2, y2];
+    }
+    // Ψ²(P) endomorphism (psi2(x) = psi(psi(x)))
+    const PSI2_X = Fp2.pow(base, (Fp.ORDER ** _2n$1 - _1n$1) / _3n$1); // u^((p^2 - 1)/3)
+    // Current towers rely on this landing on `-1`, which lets psi2 map `y` with
+    // one negation instead of carrying a separate Frobenius multiplier.
+    const PSI2_Y = Fp2.pow(base, (Fp.ORDER ** _2n$1 - _1n$1) / _2n$1); // u^((p^2 - 1)/2)
+    if (!Fp2.eql(PSI2_Y, Fp2.neg(Fp2.ONE)))
+        throw new Error('psiFrobenius: PSI2_Y!==-1');
+    function psi2(x, y) {
+        return [Fp2.mul(x, PSI2_X), Fp2.neg(y)];
+    }
+    // Map points
+    const mapAffine = (fn) => (c, P) => {
+        if (typeof c !== 'function')
+            throw new TypeError('"c" expected point constructor, got type=' + typeof c);
+        validatePointCons(c);
+        if (!(P instanceof c))
+            throw new TypeError('"P" expected Point instance, got type=' + typeof P);
+        const affine = P.toAffine();
+        const p = fn(affine.x, affine.y);
+        return c.fromAffine({ x: p[0], y: p[1] });
+    };
+    const G2psi = mapAffine(psi);
+    const G2psi2 = mapAffine(psi2);
+    return { psi, psi2, G2psi, G2psi2, PSI_X, PSI_Y, PSI2_X, PSI2_Y };
+}
+class _Field2 {
+    ORDER;
+    BITS;
+    BYTES;
+    isLE;
+    ZERO;
+    ONE;
+    Fp;
+    NONRESIDUE;
+    mulByB;
+    Fp_NONRESIDUE;
+    Fp_div2;
+    constructor(Fp, opts = {}) {
+        const { NONRESIDUE = BigInt(-1), FP2_NONRESIDUE, Fp2mulByB } = opts;
+        const ORDER = Fp.ORDER;
+        const FP2_ORDER = ORDER * ORDER;
+        this.Fp = Fp;
+        this.ORDER = FP2_ORDER;
+        this.BITS = bitLen(FP2_ORDER);
+        this.BYTES = Math.ceil(bitLen(FP2_ORDER) / 8);
+        this.isLE = Fp.isLE;
+        this.ZERO = this.create({ c0: Fp.ZERO, c1: Fp.ZERO });
+        this.ONE = this.create({ c0: Fp.ONE, c1: Fp.ZERO });
+        // These knobs only swap constants for the shipped quadratic tower shape:
+        // arithmetic below assumes `u^2 = -1`, and bytes are handled as two adjacent
+        // `Fp` limbs (`fromBytes` / `toBytes` expect the shipped `2 * Fp.BYTES` layout).
+        this.Fp_NONRESIDUE = Fp.create(NONRESIDUE);
+        this.Fp_div2 = Fp.div(Fp.ONE, _2n$1); // 1/2
+        this.NONRESIDUE = this.create({ c0: FP2_NONRESIDUE[0], c1: FP2_NONRESIDUE[1] });
+        // NOTE: no Fp2 FROBENIUS_COEFFICIENTS table: for the shipped `u² = -1` tower the coefficients
+        // are always [1, -1] (x²+1 irreducible forces p ≡ 3 mod 4), so frobeniusMap conjugates
+        // directly and the eager table computation was pure import-time waste.
+        this.mulByB = (num) => {
+            // This config hook is trusted to return a canonical Fp2 value already.
+            // Copy+freeze it to keep the tower immutability invariant without mutating caller objects.
+            const { c0, c1 } = Fp2mulByB(num);
+            return Object.freeze({ c0, c1 });
+        };
+        Object.freeze(this);
+    }
+    fromBigTuple(tuple) {
+        if (!Array.isArray(tuple) || tuple.length !== 2)
+            throw new Error('invalid Fp2.fromBigTuple');
+        const [c0, c1] = tuple;
+        if (typeof c0 !== 'bigint' || typeof c1 !== 'bigint')
+            throw new Error('invalid Fp2.fromBigTuple');
+        return this.create({ c0, c1 });
+    }
+    create(num) {
+        const { Fp } = this;
+        const c0 = Fp.create(num.c0);
+        const c1 = Fp.create(num.c1);
+        // Bigint field elements are immutable values, and higher-level code relies on
+        // that invariant. Copy+freeze tower values too without mutating caller-owned objects.
+        return Object.freeze({ c0, c1 });
+    }
+    isValid(num) {
+        if (!isObj(num))
+            throw new TypeError('invalid field element: expected object, got ' + typeof num);
+        const { c0, c1 } = num;
+        const { Fp } = this;
+        // Match base-field `isValid(...)`: malformed coordinate types are errors, not a `false`
+        // predicate result.
+        return Fp.isValid(c0) && Fp.isValid(c1);
+    }
+    is0(num) {
+        if (!isObj(num))
+            return false;
+        const { c0, c1 } = num;
+        const { Fp } = this;
+        return Fp.is0(c0) && Fp.is0(c1);
+    }
+    isValidNot0(num) {
+        return !this.is0(num) && this.isValid(num);
+    }
+    eql({ c0, c1 }, { c0: r0, c1: r1 }) {
+        const { Fp } = this;
+        return Fp.eql(c0, r0) && Fp.eql(c1, r1);
+    }
+    neg({ c0, c1 }) {
+        const { Fp } = this;
+        return Object.freeze({ c0: Fp.neg(c0), c1: Fp.neg(c1) });
+    }
+    pow(num, power) {
+        return FpPow(this, num, power);
+    }
+    invertBatch(nums) {
+        return FpInvertBatch(this, nums, true);
+    }
     // Normalized
-    add: Fp2Add,
-    sub: Fp2Subtract,
-    mul: Fp2Multiply,
-    sqr: Fp2Square,
+    add(f1, f2) {
+        const { Fp } = this;
+        const { c0, c1 } = f1;
+        const { c0: r0, c1: r1 } = f2;
+        return Object.freeze({
+            c0: Fp.add(c0, r0),
+            c1: Fp.add(c1, r1),
+        });
+    }
+    sub({ c0, c1 }, { c0: r0, c1: r1 }) {
+        const { Fp } = this;
+        return Object.freeze({
+            c0: Fp.sub(c0, r0),
+            c1: Fp.sub(c1, r1),
+        });
+    }
+    mul({ c0, c1 }, rhs) {
+        const { Fp } = this;
+        if (typeof rhs === 'bigint')
+            return Object.freeze({ c0: Fp.mul(c0, rhs), c1: Fp.mul(c1, rhs) });
+        // (a+bi)(c+di) = (ac−bd) + (ad+bc)i
+        const { c0: r0, c1: r1 } = rhs;
+        let t1 = Fp.mul(c0, r0); // c0 * o0
+        let t2 = Fp.mul(c1, r1); // c1 * o1
+        // (T1 - T2) + ((c0 + c1) * (r0 + r1) - (T1 + T2))*i
+        const o0 = Fp.sub(t1, t2);
+        const o1 = Fp.sub(Fp.mul(Fp.add(c0, c1), Fp.add(r0, r1)), Fp.add(t1, t2));
+        return Object.freeze({ c0: o0, c1: o1 });
+    }
+    sqr({ c0, c1 }) {
+        const { Fp } = this;
+        const a = Fp.add(c0, c1);
+        const b = Fp.sub(c0, c1);
+        const c = Fp.add(c0, c0);
+        return Object.freeze({ c0: Fp.mul(a, b), c1: Fp.mul(c, c1) });
+    }
     // NonNormalized stuff
-    addN: Fp2Add,
-    subN: Fp2Subtract,
-    mulN: Fp2Multiply,
-    sqrN: Fp2Square,
+    addN(a, b) {
+        return this.add(a, b);
+    }
+    subN(a, b) {
+        return this.sub(a, b);
+    }
+    mulN(a, b) {
+        return this.mul(a, b);
+    }
+    sqrN(a) {
+        return this.sqr(a);
+    }
     // Why inversion for bigint inside Fp instead of Fp2? it is even used in that context?
-    div: (lhs, rhs) => Fp2.mul(lhs, typeof rhs === 'bigint' ? Fp.inv(Fp.create(rhs)) : Fp2.inv(rhs)),
-    inv: ({ c0: a, c1: b }) => {
+    div(lhs, rhs) {
+        const { Fp } = this;
+        // @ts-ignore
+        return this.mul(lhs, typeof rhs === 'bigint' ? Fp.inv(Fp.create(rhs)) : this.inv(rhs));
+    }
+    inv({ c0: a, c1: b }) {
         // We wish to find the multiplicative inverse of a nonzero
         // element a + bu in Fp2. We leverage an identity
         //
@@ -515,466 +1416,886 @@ const Fp2 = {
         // This gives that (a - bu)/(a² + b²) is the inverse
         // of (a + bu). Importantly, this can be computing using
         // only a single inversion in Fp.
+        const { Fp } = this;
         const factor = Fp.inv(Fp.create(a * a + b * b));
-        return { c0: Fp.mul(factor, Fp.create(a)), c1: Fp.mul(factor, Fp.create(-b)) };
-    },
-    sqrt: (num) => {
-        if (Fp2.eql(num, Fp2.ZERO))
-            return Fp2.ZERO; // Algo doesn't handles this case
-        // TODO: Optimize this line. It's extremely slow.
-        // Speeding this up would boost aggregateSignatures.
-        // https://eprint.iacr.org/2012/685.pdf applicable?
-        // https://github.com/zkcrypto/bls12_381/blob/080eaa74ec0e394377caa1ba302c8c121df08b07/src/fp2.rs#L250
-        // https://github.com/supranational/blst/blob/aae0c7d70b799ac269ff5edf29d8191dbd357876/src/exp2.c#L1
-        // Inspired by https://github.com/dalek-cryptography/curve25519-dalek/blob/17698df9d4c834204f83a3574143abacb4fc81a5/src/field.rs#L99
-        const candidateSqrt = Fp2.pow(num, (Fp2.ORDER + _8n) / _16n);
-        const check = Fp2.div(Fp2.sqr(candidateSqrt), num); // candidateSqrt.square().div(this);
-        const R = FP2_ROOTS_OF_UNITY;
-        const divisor = [R[0], R[2], R[4], R[6]].find((r) => Fp2.eql(r, check));
-        if (!divisor)
-            throw new Error('No root');
-        const index = R.indexOf(divisor);
-        const root = R[index / 2];
-        if (!root)
-            throw new Error('Invalid root');
-        const x1 = Fp2.div(candidateSqrt, root);
+        return Object.freeze({ c0: Fp.mul(factor, Fp.create(a)), c1: Fp.mul(factor, Fp.create(-b)) });
+    }
+    sqrt(num) {
+        // This is generic for all quadratic extensions (Fp2)
+        const { Fp } = this;
+        const Fp2 = this;
+        const { c0, c1 } = num;
+        if (Fp.is0(c1)) {
+            // if c0 is quadratic residue
+            if (FpLegendre(Fp, c0) === 1)
+                return Fp2.create({ c0: Fp.sqrt(c0), c1: Fp.ZERO });
+            else
+                return Fp2.create({ c0: Fp.ZERO, c1: Fp.sqrt(Fp.div(c0, this.Fp_NONRESIDUE)) });
+        }
+        const a = Fp.sqrt(Fp.sub(Fp.sqr(c0), Fp.mul(Fp.sqr(c1), this.Fp_NONRESIDUE)));
+        let d = Fp.mul(Fp.add(a, c0), this.Fp_div2);
+        const legendre = FpLegendre(Fp, d);
+        // -1, Quadratic non residue
+        if (legendre === -1)
+            d = Fp.sub(d, a);
+        const a0 = Fp.sqrt(d);
+        const candidateSqrt = Fp2.create({ c0: a0, c1: Fp.div(Fp.mul(c1, this.Fp_div2), a0) });
+        if (!Fp2.eql(Fp2.sqr(candidateSqrt), num))
+            throw new Error('Cannot find square root');
+        // Normalize root: at this point candidateSqrt ** 2 = num, but also -candidateSqrt ** 2 = num
+        const x1 = candidateSqrt;
         const x2 = Fp2.neg(x1);
         const { re: re1, im: im1 } = Fp2.reim(x1);
         const { re: re2, im: im2 } = Fp2.reim(x2);
         if (im1 > im2 || (im1 === im2 && re1 > re2))
             return x1;
         return x2;
-    },
+    }
     // Same as sgn0_m_eq_2 in RFC 9380
-    isOdd: (x) => {
-        const { re: x0, im: x1 } = Fp2.reim(x);
-        const sign_0 = x0 % _2n;
-        const zero_0 = x0 === _0n;
-        const sign_1 = x1 % _2n;
-        return BigInt(sign_0 || (zero_0 && sign_1)) == _1n;
-    },
+    isOdd(x) {
+        const { re: x0, im: x1 } = this.reim(x);
+        const sign_0 = x0 % _2n$1;
+        const zero_0 = x0 === _0n$1;
+        const sign_1 = x1 % _2n$1;
+        return BigInt(sign_0 || (zero_0 && sign_1)) == _1n$1;
+    }
     // Bytes util
     fromBytes(b) {
-        if (b.length !== Fp2.BYTES)
-            throw new Error(`fromBytes wrong length=${b.length}`);
-        return { c0: Fp.fromBytes(b.subarray(0, Fp.BYTES)), c1: Fp.fromBytes(b.subarray(Fp.BYTES)) };
-    },
-    toBytes: ({ c0, c1 }) => concatBytes(Fp.toBytes(c0), Fp.toBytes(c1)),
-    cmov: ({ c0, c1 }, { c0: r0, c1: r1 }, c) => ({
-        c0: Fp.cmov(c0, r0, c),
-        c1: Fp.cmov(c1, r1, c),
-    }),
-    // Specific utils
-    // toString() {
-    //   return `Fp2(${this.c0} + ${this.c1}×i)`;
-    // }
-    reim: ({ c0, c1 }) => ({ re: c0, im: c1 }),
-    // multiply by u + 1
-    mulByNonresidue: ({ c0, c1 }) => ({ c0: Fp.sub(c0, c1), c1: Fp.add(c0, c1) }),
-    multiplyByB: ({ c0, c1 }) => {
-        let t0 = Fp.mul(c0, _4n); // 4 * c0
-        let t1 = Fp.mul(c1, _4n); // 4 * c1
-        // (T0-T1) + (T0+T1)*i
-        return { c0: Fp.sub(t0, t1), c1: Fp.add(t0, t1) };
-    },
-    fromBigTuple: (tuple) => {
-        if (tuple.length !== 2)
-            throw new Error('Invalid tuple');
-        const fps = tuple.map((n) => Fp.create(n));
-        return { c0: fps[0], c1: fps[1] };
-    },
-    frobeniusMap: ({ c0, c1 }, power) => ({
-        c0,
-        c1: Fp.mul(c1, FP2_FROBENIUS_COEFFICIENTS[power % 2]),
-    }),
-};
-// Finite extension field over irreducible polynominal.
-// Fp(u) / (u² - β) where β = -1
-const FP2_FROBENIUS_COEFFICIENTS = [
-    BigInt('0x1'),
-    BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaaa'),
-].map((item) => Fp.create(item));
-// For Fp2 roots of unity.
-const rv1 = BigInt('0x6af0e0437ff400b6831e36d6bd17ffe48395dabc2d3435e77f76e17009241c5ee67992f72ec05f4c81084fbede3cc09');
-// const ev1 =
-//   BigInt('0x699be3b8c6870965e5bf892ad5d2cc7b0e85a117402dfd83b7f4a947e02d978498255a2aaec0ac627b5afbdf1bf1c90');
-// const ev2 =
-//   BigInt('0x8157cd83046453f5dd0972b6e3949e4288020b5b8a9cc99ca07e27089a2ce2436d965026adad3ef7baba37f2183e9b5');
-// const ev3 =
-//   BigInt('0xab1c2ffdd6c253ca155231eb3e71ba044fd562f6f72bc5bad5ec46a0b7a3b0247cf08ce6c6317f40edbc653a72dee17');
-// const ev4 =
-//   BigInt('0xaa404866706722864480885d68ad0ccac1967c7544b447873cc37e0181271e006df72162a3d3e0287bf597fbf7f8fc1');
-// Eighth roots of unity, used for computing square roots in Fp2.
-// To verify or re-calculate:
-// Array(8).fill(new Fp2([1n, 1n])).map((fp2, k) => fp2.pow(Fp2.ORDER * BigInt(k) / 8n))
-const FP2_ROOTS_OF_UNITY = [
-    [_1n, _0n],
-    [rv1, -rv1],
-    [_0n, _1n],
-    [rv1, rv1],
-    [-_1n, _0n],
-    [-rv1, rv1],
-    [_0n, -_1n],
-    [-rv1, -rv1],
-].map((pair) => Fp2.fromBigTuple(pair));
-const Fp6Add = ({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) => ({
-    c0: Fp2.add(c0, r0),
-    c1: Fp2.add(c1, r1),
-    c2: Fp2.add(c2, r2),
-});
-const Fp6Subtract = ({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) => ({
-    c0: Fp2.sub(c0, r0),
-    c1: Fp2.sub(c1, r1),
-    c2: Fp2.sub(c2, r2),
-});
-const Fp6Multiply = ({ c0, c1, c2 }, rhs) => {
-    if (typeof rhs === 'bigint') {
+        const { Fp } = this;
+        abytes(b);
+        if (b.length !== this.BYTES)
+            throw new Error('fromBytes invalid length=' + b.length);
+        return this.create({
+            c0: Fp.fromBytes(b.subarray(0, Fp.BYTES)),
+            c1: Fp.fromBytes(b.subarray(Fp.BYTES)),
+        });
+    }
+    toBytes({ c0, c1 }) {
+        return concatBytes(this.Fp.toBytes(c0), this.Fp.toBytes(c1));
+    }
+    cmov({ c0, c1 }, { c0: r0, c1: r1 }, c) {
+        const { Fp } = this;
+        return this.create({
+            c0: Fp.cmov(c0, r0, c),
+            c1: Fp.cmov(c1, r1, c),
+        });
+    }
+    reim({ c0, c1 }) {
+        return { re: c0, im: c1 };
+    }
+    Fp4Square(a, b) {
+        const Fp2 = this;
+        const a2 = Fp2.sqr(a);
+        const b2 = Fp2.sqr(b);
         return {
-            c0: Fp2.mul(c0, rhs),
-            c1: Fp2.mul(c1, rhs),
-            c2: Fp2.mul(c2, rhs),
+            first: Fp2.add(Fp2.mulByNonresidue(b2), a2), // b² * Nonresidue + a²
+            second: Fp2.sub(Fp2.sub(Fp2.sqr(Fp2.add(a, b)), a2), b2), // (a + b)² - a² - b²
         };
     }
-    const { c0: r0, c1: r1, c2: r2 } = rhs;
-    const t0 = Fp2.mul(c0, r0); // c0 * o0
-    const t1 = Fp2.mul(c1, r1); // c1 * o1
-    const t2 = Fp2.mul(c2, r2); // c2 * o2
-    return {
-        // t0 + (c1 + c2) * (r1 * r2) - (T1 + T2) * (u + 1)
-        c0: Fp2.add(t0, Fp2.mulByNonresidue(Fp2.sub(Fp2.mul(Fp2.add(c1, c2), Fp2.add(r1, r2)), Fp2.add(t1, t2)))),
-        // (c0 + c1) * (r0 + r1) - (T0 + T1) + T2 * (u + 1)
-        c1: Fp2.add(Fp2.sub(Fp2.mul(Fp2.add(c0, c1), Fp2.add(r0, r1)), Fp2.add(t0, t1)), Fp2.mulByNonresidue(t2)),
-        // T1 + (c0 + c2) * (r0 + r2) - T0 + T2
-        c2: Fp2.sub(Fp2.add(t1, Fp2.mul(Fp2.add(c0, c2), Fp2.add(r0, r2))), Fp2.add(t0, t2)),
-    };
-};
-const Fp6Square = ({ c0, c1, c2 }) => {
-    let t0 = Fp2.sqr(c0); // c0²
-    let t1 = Fp2.mul(Fp2.mul(c0, c1), _2n); // 2 * c0 * c1
-    let t3 = Fp2.mul(Fp2.mul(c1, c2), _2n); // 2 * c1 * c2
-    let t4 = Fp2.sqr(c2); // c2²
-    return {
-        c0: Fp2.add(Fp2.mulByNonresidue(t3), t0),
-        c1: Fp2.add(Fp2.mulByNonresidue(t4), t1),
-        // T1 + (c0 - c1 + c2)² + T3 - T0 - T4
-        c2: Fp2.sub(Fp2.sub(Fp2.add(Fp2.add(t1, Fp2.sqr(Fp2.add(Fp2.sub(c0, c1), c2))), t3), t0), t4),
-    };
-};
-const Fp6 = {
-    ORDER: Fp2.ORDER,
-    BITS: 3 * Fp2.BITS,
-    BYTES: 3 * Fp2.BYTES,
-    MASK: bitMask(3 * Fp2.BITS),
-    ZERO: { c0: Fp2.ZERO, c1: Fp2.ZERO, c2: Fp2.ZERO },
-    ONE: { c0: Fp2.ONE, c1: Fp2.ZERO, c2: Fp2.ZERO },
-    create: (num) => num,
-    isValid: ({ c0, c1, c2 }) => Fp2.isValid(c0) && Fp2.isValid(c1) && Fp2.isValid(c2),
-    is0: ({ c0, c1, c2 }) => Fp2.is0(c0) && Fp2.is0(c1) && Fp2.is0(c2),
-    neg: ({ c0, c1, c2 }) => ({ c0: Fp2.neg(c0), c1: Fp2.neg(c1), c2: Fp2.neg(c2) }),
-    eql: ({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) => Fp2.eql(c0, r0) && Fp2.eql(c1, r1) && Fp2.eql(c2, r2),
-    sqrt: () => {
-        throw new Error('Not implemented');
-    },
+    // multiply by u + 1
+    mulByNonresidue({ c0, c1 }) {
+        const { Fp, NONRESIDUE: nr } = this;
+        if (nr.c0 === Fp.ONE && nr.c1 === Fp.ONE) {
+            return Object.freeze({ c0: Fp.sub(c0, c1), c1: Fp.add(c0, c1) });
+        }
+        if (nr.c1 === Fp.ONE) {
+            return Object.freeze({
+                c0: Fp.sub(Fp.mul(c0, nr.c0), c1),
+                c1: Fp.add(c0, Fp.mul(c1, nr.c0)),
+            });
+        }
+        return this.mul({ c0, c1 }, nr);
+    }
+    frobeniusMap(num, power) {
+        const { c0, c1 } = num;
+        const { Fp } = this;
+        return Object.freeze({ c0, c1: power % 2 === 0 ? c1 : Fp.neg(c1) });
+    }
+}
+class _Field6 {
+    ORDER;
+    BITS;
+    BYTES;
+    isLE;
+    ZERO;
+    ONE;
+    Fp2;
+    constructor(Fp2) {
+        this.Fp2 = Fp2;
+        // `IField.ORDER` is the field cardinality `q`; for sextic extensions that is `p^6`.
+        // Generic helpers like Frobenius-style `x^q = x` checks rely on the literal field size here.
+        this.ORDER = Fp2.Fp.ORDER ** _6n;
+        this.BITS = 3 * Fp2.BITS;
+        this.BYTES = 3 * Fp2.BYTES;
+        this.isLE = Fp2.isLE;
+        this.ZERO = this.create({ c0: Fp2.ZERO, c1: Fp2.ZERO, c2: Fp2.ZERO });
+        this.ONE = this.create({ c0: Fp2.ONE, c1: Fp2.ZERO, c2: Fp2.ZERO });
+        Object.freeze(this);
+    }
+    // Most callers never touch Frobenius maps, so keep the sextic tables lazy:
+    // eagerly deriving them dominates `bls12-381.js` / `bn254.js` import time.
+    get FROBENIUS_COEFFICIENTS_1() {
+        const frob = _FROBENIUS_COEFFICIENTS_6.get(this);
+        if (frob)
+            return frob[0];
+        const { Fp2 } = this;
+        const { Fp } = Fp2;
+        const rows = calcFrobeniusCoefficients(Fp2, Fp2.NONRESIDUE, Fp.ORDER, 6, 2, 3);
+        const cache = [Object.freeze(rows[0]), Object.freeze(rows[1])];
+        _FROBENIUS_COEFFICIENTS_6.set(this, cache);
+        return cache[0];
+    }
+    get FROBENIUS_COEFFICIENTS_2() {
+        const frob = _FROBENIUS_COEFFICIENTS_6.get(this);
+        if (frob)
+            return frob[1];
+        void this.FROBENIUS_COEFFICIENTS_1;
+        return _FROBENIUS_COEFFICIENTS_6.get(this)[1];
+    }
+    add({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) {
+        const { Fp2 } = this;
+        return Object.freeze({
+            c0: Fp2.add(c0, r0),
+            c1: Fp2.add(c1, r1),
+            c2: Fp2.add(c2, r2),
+        });
+    }
+    sub({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) {
+        const { Fp2 } = this;
+        return Object.freeze({
+            c0: Fp2.sub(c0, r0),
+            c1: Fp2.sub(c1, r1),
+            c2: Fp2.sub(c2, r2),
+        });
+    }
+    mul({ c0, c1, c2 }, rhs) {
+        const { Fp2 } = this;
+        if (typeof rhs === 'bigint') {
+            return Object.freeze({
+                c0: Fp2.mul(c0, rhs),
+                c1: Fp2.mul(c1, rhs),
+                c2: Fp2.mul(c2, rhs),
+            });
+        }
+        const { c0: r0, c1: r1, c2: r2 } = rhs;
+        const t0 = Fp2.mul(c0, r0); // c0 * o0
+        const t1 = Fp2.mul(c1, r1); // c1 * o1
+        const t2 = Fp2.mul(c2, r2); // c2 * o2
+        return Object.freeze({
+            // t0 + (c1 + c2) * (r1 * r2) - (T1 + T2) * (u + 1)
+            c0: Fp2.add(t0, Fp2.mulByNonresidue(Fp2.sub(Fp2.mul(Fp2.add(c1, c2), Fp2.add(r1, r2)), Fp2.add(t1, t2)))),
+            // (c0 + c1) * (r0 + r1) - (T0 + T1) + T2 * (u + 1)
+            c1: Fp2.add(Fp2.sub(Fp2.mul(Fp2.add(c0, c1), Fp2.add(r0, r1)), Fp2.add(t0, t1)), Fp2.mulByNonresidue(t2)),
+            // T1 + (c0 + c2) * (r0 + r2) - T0 + T2
+            c2: Fp2.sub(Fp2.add(t1, Fp2.mul(Fp2.add(c0, c2), Fp2.add(r0, r2))), Fp2.add(t0, t2)),
+        });
+    }
+    sqr({ c0, c1, c2 }) {
+        const { Fp2 } = this;
+        let t0 = Fp2.sqr(c0); // c0²
+        let t1 = Fp2.mul(Fp2.mul(c0, c1), _2n$1); // 2 * c0 * c1
+        let t3 = Fp2.mul(Fp2.mul(c1, c2), _2n$1); // 2 * c1 * c2
+        let t4 = Fp2.sqr(c2); // c2²
+        return Object.freeze({
+            c0: Fp2.add(Fp2.mulByNonresidue(t3), t0), // T3 * (u + 1) + T0
+            c1: Fp2.add(Fp2.mulByNonresidue(t4), t1), // T4 * (u + 1) + T1
+            // T1 + (c0 - c1 + c2)² + T3 - T0 - T4
+            c2: Fp2.sub(Fp2.sub(Fp2.add(Fp2.add(t1, Fp2.sqr(Fp2.add(Fp2.sub(c0, c1), c2))), t3), t0), t4),
+        });
+    }
+    addN(a, b) {
+        return this.add(a, b);
+    }
+    subN(a, b) {
+        return this.sub(a, b);
+    }
+    mulN(a, b) {
+        return this.mul(a, b);
+    }
+    sqrN(a) {
+        return this.sqr(a);
+    }
+    create(num) {
+        const { Fp2 } = this;
+        const c0 = Fp2.create(num.c0);
+        const c1 = Fp2.create(num.c1);
+        const c2 = Fp2.create(num.c2);
+        return Object.freeze({ c0, c1, c2 });
+    }
+    isValid(num) {
+        if (!isObj(num))
+            throw new TypeError('invalid field element: expected object, got ' + typeof num);
+        const { c0, c1, c2 } = num;
+        const { Fp2 } = this;
+        return Fp2.isValid(c0) && Fp2.isValid(c1) && Fp2.isValid(c2);
+    }
+    is0(num) {
+        if (!isObj(num))
+            return false;
+        const { c0, c1, c2 } = num;
+        const { Fp2 } = this;
+        return Fp2.is0(c0) && Fp2.is0(c1) && Fp2.is0(c2);
+    }
+    isValidNot0(num) {
+        return !this.is0(num) && this.isValid(num);
+    }
+    neg({ c0, c1, c2 }) {
+        const { Fp2 } = this;
+        return Object.freeze({ c0: Fp2.neg(c0), c1: Fp2.neg(c1), c2: Fp2.neg(c2) });
+    }
+    eql({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }) {
+        const { Fp2 } = this;
+        return Fp2.eql(c0, r0) && Fp2.eql(c1, r1) && Fp2.eql(c2, r2);
+    }
+    sqrt(_) {
+        // Sextic extensions can use generic odd-field Tonelli-Shanks, but the helper must work
+        // over `IField<T>` with a quadratic non-residue from Fp6 itself. The current
+        // `mod.tonelliShanks(P)` precomputation only searches integer residues in the base field.
+        return notImplemented();
+    }
     // Do we need division by bigint at all? Should be done via order:
-    div: (lhs, rhs) => Fp6.mul(lhs, typeof rhs === 'bigint' ? Fp.inv(Fp.create(rhs)) : Fp6.inv(rhs)),
-    pow: (num, power) => FpPow(Fp6, num, power),
-    invertBatch: (nums) => FpInvertBatch(Fp6, nums),
-    // Normalized
-    add: Fp6Add,
-    sub: Fp6Subtract,
-    mul: Fp6Multiply,
-    sqr: Fp6Square,
-    // NonNormalized stuff
-    addN: Fp6Add,
-    subN: Fp6Subtract,
-    mulN: Fp6Multiply,
-    sqrN: Fp6Square,
-    inv: ({ c0, c1, c2 }) => {
+    div(lhs, rhs) {
+        const { Fp2 } = this;
+        const { Fp } = Fp2;
+        return this.mul(lhs, typeof rhs === 'bigint' ? Fp.inv(Fp.create(rhs)) : this.inv(rhs));
+    }
+    pow(num, power) {
+        return FpPow(this, num, power);
+    }
+    invertBatch(nums) {
+        return FpInvertBatch(this, nums, true);
+    }
+    inv({ c0, c1, c2 }) {
+        const { Fp2 } = this;
         let t0 = Fp2.sub(Fp2.sqr(c0), Fp2.mulByNonresidue(Fp2.mul(c2, c1))); // c0² - c2 * c1 * (u + 1)
         let t1 = Fp2.sub(Fp2.mulByNonresidue(Fp2.sqr(c2)), Fp2.mul(c0, c1)); // c2² * (u + 1) - c0 * c1
         let t2 = Fp2.sub(Fp2.sqr(c1), Fp2.mul(c0, c2)); // c1² - c0 * c2
         // 1/(((c2 * T1 + c1 * T2) * v) + c0 * T0)
         let t4 = Fp2.inv(Fp2.add(Fp2.mulByNonresidue(Fp2.add(Fp2.mul(c2, t1), Fp2.mul(c1, t2))), Fp2.mul(c0, t0)));
-        return { c0: Fp2.mul(t4, t0), c1: Fp2.mul(t4, t1), c2: Fp2.mul(t4, t2) };
-    },
+        return Object.freeze({ c0: Fp2.mul(t4, t0), c1: Fp2.mul(t4, t1), c2: Fp2.mul(t4, t2) });
+    }
     // Bytes utils
-    fromBytes: (b) => {
-        if (b.length !== Fp6.BYTES)
-            throw new Error(`fromBytes wrong length=${b.length}`);
-        return {
-            c0: Fp2.fromBytes(b.subarray(0, Fp2.BYTES)),
-            c1: Fp2.fromBytes(b.subarray(Fp2.BYTES, 2 * Fp2.BYTES)),
-            c2: Fp2.fromBytes(b.subarray(2 * Fp2.BYTES)),
-        };
-    },
-    toBytes: ({ c0, c1, c2 }) => concatBytes(Fp2.toBytes(c0), Fp2.toBytes(c1), Fp2.toBytes(c2)),
-    cmov: ({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }, c) => ({
-        c0: Fp2.cmov(c0, r0, c),
-        c1: Fp2.cmov(c1, r1, c),
-        c2: Fp2.cmov(c2, r2, c),
-    }),
-    // Utils
-    //   fromTriple(triple: [Fp2, Fp2, Fp2]) {
-    //     return new Fp6(...triple);
-    //   }
-    //   toString() {
-    //     return `Fp6(${this.c0} + ${this.c1} * v, ${this.c2} * v^2)`;
-    //   }
-    fromBigSix: (t) => {
-        if (!Array.isArray(t) || t.length !== 6)
-            throw new Error('Invalid Fp6 usage');
-        return {
+    fromBytes(b) {
+        const { Fp2 } = this;
+        abytes(b);
+        if (b.length !== this.BYTES)
+            throw new Error('fromBytes invalid length=' + b.length);
+        const B2 = Fp2.BYTES;
+        return this.create({
+            c0: Fp2.fromBytes(b.subarray(0, B2)),
+            c1: Fp2.fromBytes(b.subarray(B2, B2 * 2)),
+            c2: Fp2.fromBytes(b.subarray(2 * B2)),
+        });
+    }
+    toBytes({ c0, c1, c2 }) {
+        const { Fp2 } = this;
+        return concatBytes(Fp2.toBytes(c0), Fp2.toBytes(c1), Fp2.toBytes(c2));
+    }
+    cmov({ c0, c1, c2 }, { c0: r0, c1: r1, c2: r2 }, c) {
+        const { Fp2 } = this;
+        return this.create({
+            c0: Fp2.cmov(c0, r0, c),
+            c1: Fp2.cmov(c1, r1, c),
+            c2: Fp2.cmov(c2, r2, c),
+        });
+    }
+    fromBigSix(tuple) {
+        const { Fp2 } = this;
+        if (!Array.isArray(tuple) || tuple.length !== 6)
+            throw new Error('invalid Fp6.fromBigSix');
+        for (let i = 0; i < 6; i++)
+            if (typeof tuple[i] !== 'bigint')
+                throw new Error('invalid Fp6.fromBigSix');
+        const t = tuple;
+        return this.create({
             c0: Fp2.fromBigTuple(t.slice(0, 2)),
             c1: Fp2.fromBigTuple(t.slice(2, 4)),
             c2: Fp2.fromBigTuple(t.slice(4, 6)),
-        };
-    },
-    frobeniusMap: ({ c0, c1, c2 }, power) => ({
-        c0: Fp2.frobeniusMap(c0, power),
-        c1: Fp2.mul(Fp2.frobeniusMap(c1, power), FP6_FROBENIUS_COEFFICIENTS_1[power % 6]),
-        c2: Fp2.mul(Fp2.frobeniusMap(c2, power), FP6_FROBENIUS_COEFFICIENTS_2[power % 6]),
-    }),
-    mulByNonresidue: ({ c0, c1, c2 }) => ({ c0: Fp2.mulByNonresidue(c2), c1: c0, c2: c1 }),
+        });
+    }
+    frobeniusMap(num, power) {
+        const { c0, c1, c2 } = num;
+        if (power % 6 === 0)
+            return Object.freeze({ c0, c1, c2 });
+        const { Fp2 } = this;
+        return Object.freeze({
+            c0: Fp2.frobeniusMap(c0, power),
+            c1: Fp2.mul(Fp2.frobeniusMap(c1, power), this.FROBENIUS_COEFFICIENTS_1[power % 6]),
+            c2: Fp2.mul(Fp2.frobeniusMap(c2, power), this.FROBENIUS_COEFFICIENTS_2[power % 6]),
+        });
+    }
+    mulByFp2({ c0, c1, c2 }, rhs) {
+        const { Fp2 } = this;
+        return Object.freeze({
+            c0: Fp2.mul(c0, rhs),
+            c1: Fp2.mul(c1, rhs),
+            c2: Fp2.mul(c2, rhs),
+        });
+    }
+    mulByNonresidue({ c0, c1, c2 }) {
+        const { Fp2 } = this;
+        return Object.freeze({ c0: Fp2.mulByNonresidue(c2), c1: c0, c2: c1 });
+    }
     // Sparse multiplication
-    multiplyBy1: ({ c0, c1, c2 }, b1) => ({
-        c0: Fp2.mulByNonresidue(Fp2.mul(c2, b1)),
-        c1: Fp2.mul(c0, b1),
-        c2: Fp2.mul(c1, b1),
-    }),
+    mul1({ c0, c1, c2 }, b1) {
+        const { Fp2 } = this;
+        return Object.freeze({
+            c0: Fp2.mulByNonresidue(Fp2.mul(c2, b1)),
+            c1: Fp2.mul(c0, b1),
+            c2: Fp2.mul(c1, b1),
+        });
+    }
     // Sparse multiplication
-    multiplyBy01({ c0, c1, c2 }, b0, b1) {
+    mul01({ c0, c1, c2 }, b0, b1) {
+        const { Fp2 } = this;
         let t0 = Fp2.mul(c0, b0); // c0 * b0
         let t1 = Fp2.mul(c1, b1); // c1 * b1
-        return {
+        return Object.freeze({
             // ((c1 + c2) * b1 - T1) * (u + 1) + T0
             c0: Fp2.add(Fp2.mulByNonresidue(Fp2.sub(Fp2.mul(Fp2.add(c1, c2), b1), t1)), t0),
             // (b0 + b1) * (c0 + c1) - T0 - T1
             c1: Fp2.sub(Fp2.sub(Fp2.mul(Fp2.add(b0, b1), Fp2.add(c0, c1)), t0), t1),
             // (c0 + c2) * b0 - T0 + T1
             c2: Fp2.add(Fp2.sub(Fp2.mul(Fp2.add(c0, c2), b0), t0), t1),
-        };
-    },
-    multiplyByFp2: ({ c0, c1, c2 }, rhs) => ({
-        c0: Fp2.mul(c0, rhs),
-        c1: Fp2.mul(c1, rhs),
-        c2: Fp2.mul(c2, rhs),
-    }),
-};
-const FP6_FROBENIUS_COEFFICIENTS_1 = [
-    [BigInt('0x1'), BigInt('0x0')],
-    [
-        BigInt('0x0'),
-        BigInt('0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac'),
-    ],
-    [
-        BigInt('0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe'),
-        BigInt('0x0'),
-    ],
-    [BigInt('0x0'), BigInt('0x1')],
-    [
-        BigInt('0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac'),
-        BigInt('0x0'),
-    ],
-    [
-        BigInt('0x0'),
-        BigInt('0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe'),
-    ],
-].map((pair) => Fp2.fromBigTuple(pair));
-const FP6_FROBENIUS_COEFFICIENTS_2 = [
-    [BigInt('0x1'), BigInt('0x0')],
-    [
-        BigInt('0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaad'),
-        BigInt('0x0'),
-    ],
-    [
-        BigInt('0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac'),
-        BigInt('0x0'),
-    ],
-    [
-        BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaaa'),
-        BigInt('0x0'),
-    ],
-    [
-        BigInt('0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe'),
-        BigInt('0x0'),
-    ],
-    [
-        BigInt('0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffeffff'),
-        BigInt('0x0'),
-    ],
-].map((pair) => Fp2.fromBigTuple(pair));
-// The BLS parameter x for BLS12-381
-const BLS_X = BigInt('0xd201000000010000');
-const BLS_X_LEN = bitLen(BLS_X);
-const Fp12Add = ({ c0, c1 }, { c0: r0, c1: r1 }) => ({
-    c0: Fp6.add(c0, r0),
-    c1: Fp6.add(c1, r1),
-});
-const Fp12Subtract = ({ c0, c1 }, { c0: r0, c1: r1 }) => ({
-    c0: Fp6.sub(c0, r0),
-    c1: Fp6.sub(c1, r1),
-});
-const Fp12Multiply = ({ c0, c1 }, rhs) => {
-    if (typeof rhs === 'bigint')
-        return { c0: Fp6.mul(c0, rhs), c1: Fp6.mul(c1, rhs) };
-    let { c0: r0, c1: r1 } = rhs;
-    let t1 = Fp6.mul(c0, r0); // c0 * r0
-    let t2 = Fp6.mul(c1, r1); // c1 * r1
-    return {
-        c0: Fp6.add(t1, Fp6.mulByNonresidue(t2)),
-        // (c0 + c1) * (r0 + r1) - (T1 + T2)
-        c1: Fp6.sub(Fp6.mul(Fp6.add(c0, c1), Fp6.add(r0, r1)), Fp6.add(t1, t2)),
-    };
-};
-const Fp12Square = ({ c0, c1 }) => {
-    let ab = Fp6.mul(c0, c1); // c0 * c1
-    return {
-        // (c1 * v + c0) * (c0 + c1) - AB - AB * v
-        c0: Fp6.sub(Fp6.sub(Fp6.mul(Fp6.add(Fp6.mulByNonresidue(c1), c0), Fp6.add(c0, c1)), ab), Fp6.mulByNonresidue(ab)),
-        c1: Fp6.add(ab, ab),
-    }; // AB + AB
-};
-function Fp4Square(a, b) {
-    const a2 = Fp2.sqr(a);
-    const b2 = Fp2.sqr(b);
-    return {
-        first: Fp2.add(Fp2.mulByNonresidue(b2), a2),
-        second: Fp2.sub(Fp2.sub(Fp2.sqr(Fp2.add(a, b)), a2), b2), // (a + b)² - a² - b²
-    };
+        });
+    }
 }
-const Fp12 = {
-    ORDER: Fp2.ORDER,
-    BITS: 2 * Fp2.BITS,
-    BYTES: 2 * Fp2.BYTES,
-    MASK: bitMask(2 * Fp2.BITS),
-    ZERO: { c0: Fp6.ZERO, c1: Fp6.ZERO },
-    ONE: { c0: Fp6.ONE, c1: Fp6.ZERO },
-    create: (num) => num,
-    isValid: ({ c0, c1 }) => Fp6.isValid(c0) && Fp6.isValid(c1),
-    is0: ({ c0, c1 }) => Fp6.is0(c0) && Fp6.is0(c1),
-    neg: ({ c0, c1 }) => ({ c0: Fp6.neg(c0), c1: Fp6.neg(c1) }),
-    eql: ({ c0, c1 }, { c0: r0, c1: r1 }) => Fp6.eql(c0, r0) && Fp6.eql(c1, r1),
-    sqrt: () => {
-        throw new Error('Not implemented');
-    },
-    inv: ({ c0, c1 }) => {
+// Keep lazy tower caches off-object: field instances stay frozen, and debugger output
+// stays readable without JS private slots while second/subsequent lookups still hit cache.
+const _FROBENIUS_COEFFICIENTS_6 = new WeakMap();
+class _Field12 {
+    ORDER;
+    BITS;
+    BYTES;
+    isLE;
+    ZERO;
+    ONE;
+    Fp6;
+    X_LEN;
+    finalExponentiate;
+    constructor(Fp6, opts) {
+        const { X_LEN, Fp12finalExponentiate } = opts;
+        const { Fp2 } = Fp6;
+        const { Fp } = Fp2;
+        this.Fp6 = Fp6;
+        // `IField.ORDER` is the field cardinality `q`; for degree-12 extensions that is `p^12`.
+        // Keeping `p^2` here breaks generic field identities like `x^q = x` on Fp12.
+        this.ORDER = Fp.ORDER ** _12n;
+        this.BITS = 2 * Fp6.BITS;
+        this.BYTES = 2 * Fp6.BYTES;
+        this.isLE = Fp6.isLE;
+        // Returned tower values are frozen, so larger constants can safely reuse
+        // already-frozen child coefficients instead of cloning them.
+        this.ZERO = this.create({ c0: Fp6.ZERO, c1: Fp6.ZERO });
+        this.ONE = this.create({ c0: Fp6.ONE, c1: Fp6.ZERO });
+        this.X_LEN = X_LEN;
+        this.finalExponentiate = (num) => {
+            const copy2 = ({ c0, c1 }) => Object.freeze({ c0, c1 });
+            const copy6 = ({ c0, c1, c2 }) => Object.freeze({ c0: copy2(c0), c1: copy2(c1), c2: copy2(c2) });
+            // This config hook is trusted to return a canonical Fp12 value already.
+            // Copy+freeze it to keep the tower immutability invariant without mutating caller objects.
+            const res = Fp12finalExponentiate(num);
+            return Object.freeze({ c0: copy6(res.c0), c1: copy6(res.c1) });
+        };
+        Object.freeze(this);
+    }
+    // Keep the degree-12 Frobenius row lazy too; after the first lookup the cached
+    // array is reused exactly like the old eager table.
+    get FROBENIUS_COEFFICIENTS() {
+        const frob = _FROBENIUS_COEFFICIENTS_12.get(this);
+        if (frob)
+            return frob;
+        const { Fp2 } = this.Fp6;
+        const { Fp } = Fp2;
+        const cache = Object.freeze(calcFrobeniusCoefficients(Fp2, Fp2.NONRESIDUE, Fp.ORDER, 12, 1, 6)[0]);
+        _FROBENIUS_COEFFICIENTS_12.set(this, cache);
+        return cache;
+    }
+    create(num) {
+        const { Fp6 } = this;
+        const c0 = Fp6.create(num.c0);
+        const c1 = Fp6.create(num.c1);
+        return Object.freeze({ c0, c1 });
+    }
+    isValid(num) {
+        if (!isObj(num))
+            throw new TypeError('invalid field element: expected object, got ' + typeof num);
+        const { c0, c1 } = num;
+        const { Fp6 } = this;
+        return Fp6.isValid(c0) && Fp6.isValid(c1);
+    }
+    is0(num) {
+        if (!isObj(num))
+            return false;
+        const { c0, c1 } = num;
+        const { Fp6 } = this;
+        return Fp6.is0(c0) && Fp6.is0(c1);
+    }
+    isValidNot0(num) {
+        return !this.is0(num) && this.isValid(num);
+    }
+    neg({ c0, c1 }) {
+        const { Fp6 } = this;
+        return Object.freeze({ c0: Fp6.neg(c0), c1: Fp6.neg(c1) });
+    }
+    eql({ c0, c1 }, { c0: r0, c1: r1 }) {
+        const { Fp6 } = this;
+        return Fp6.eql(c0, r0) && Fp6.eql(c1, r1);
+    }
+    sqrt(_) {
+        // Fp12 is quadratic over Fp6, so a dedicated quadratic-extension sqrt is possible here
+        // once Fp6.sqrt() exists. Without that lower-level sqrt, only a field-generic
+        // Tonelli-Shanks path over Fp12 itself would work.
+        return notImplemented();
+    }
+    inv({ c0, c1 }) {
+        const { Fp6 } = this;
         let t = Fp6.inv(Fp6.sub(Fp6.sqr(c0), Fp6.mulByNonresidue(Fp6.sqr(c1)))); // 1 / (c0² - c1² * v)
-        return { c0: Fp6.mul(c0, t), c1: Fp6.neg(Fp6.mul(c1, t)) }; // ((C0 * T) * T) + (-C1 * T) * w
-    },
-    div: (lhs, rhs) => Fp12.mul(lhs, typeof rhs === 'bigint' ? Fp.inv(Fp.create(rhs)) : Fp12.inv(rhs)),
-    pow: (num, power) => FpPow(Fp12, num, power),
-    invertBatch: (nums) => FpInvertBatch(Fp12, nums),
+        // ((C0 * T) * T) + (-C1 * T) * w
+        return Object.freeze({ c0: Fp6.mul(c0, t), c1: Fp6.neg(Fp6.mul(c1, t)) });
+    }
+    div(lhs, rhs) {
+        const { Fp6 } = this;
+        const { Fp2 } = Fp6;
+        const { Fp } = Fp2;
+        return this.mul(lhs, typeof rhs === 'bigint' ? Fp.inv(Fp.create(rhs)) : this.inv(rhs));
+    }
+    pow(num, power) {
+        return FpPow(this, num, power);
+    }
+    invertBatch(nums) {
+        return FpInvertBatch(this, nums, true);
+    }
     // Normalized
-    add: Fp12Add,
-    sub: Fp12Subtract,
-    mul: Fp12Multiply,
-    sqr: Fp12Square,
+    add({ c0, c1 }, { c0: r0, c1: r1 }) {
+        const { Fp6 } = this;
+        return Object.freeze({
+            c0: Fp6.add(c0, r0),
+            c1: Fp6.add(c1, r1),
+        });
+    }
+    sub({ c0, c1 }, { c0: r0, c1: r1 }) {
+        const { Fp6 } = this;
+        return Object.freeze({
+            c0: Fp6.sub(c0, r0),
+            c1: Fp6.sub(c1, r1),
+        });
+    }
+    mul({ c0, c1 }, rhs) {
+        const { Fp6 } = this;
+        if (typeof rhs === 'bigint')
+            return Object.freeze({ c0: Fp6.mul(c0, rhs), c1: Fp6.mul(c1, rhs) });
+        let { c0: r0, c1: r1 } = rhs;
+        let t1 = Fp6.mul(c0, r0); // c0 * r0
+        let t2 = Fp6.mul(c1, r1); // c1 * r1
+        return Object.freeze({
+            c0: Fp6.add(t1, Fp6.mulByNonresidue(t2)), // T1 + T2 * v
+            // (c0 + c1) * (r0 + r1) - (T1 + T2)
+            c1: Fp6.sub(Fp6.mul(Fp6.add(c0, c1), Fp6.add(r0, r1)), Fp6.add(t1, t2)),
+        });
+    }
+    sqr({ c0, c1 }) {
+        const { Fp6 } = this;
+        let ab = Fp6.mul(c0, c1); // c0 * c1
+        return Object.freeze({
+            // (c1 * v + c0) * (c0 + c1) - AB - AB * v
+            c0: Fp6.sub(Fp6.sub(Fp6.mul(Fp6.add(Fp6.mulByNonresidue(c1), c0), Fp6.add(c0, c1)), ab), Fp6.mulByNonresidue(ab)),
+            c1: Fp6.add(ab, ab),
+        }); // AB + AB
+    }
     // NonNormalized stuff
-    addN: Fp12Add,
-    subN: Fp12Subtract,
-    mulN: Fp12Multiply,
-    sqrN: Fp12Square,
+    addN(a, b) {
+        return this.add(a, b);
+    }
+    subN(a, b) {
+        return this.sub(a, b);
+    }
+    mulN(a, b) {
+        return this.mul(a, b);
+    }
+    sqrN(a) {
+        return this.sqr(a);
+    }
     // Bytes utils
-    fromBytes: (b) => {
-        if (b.length !== Fp12.BYTES)
-            throw new Error(`fromBytes wrong length=${b.length}`);
-        return {
+    fromBytes(b) {
+        const { Fp6 } = this;
+        abytes(b);
+        if (b.length !== this.BYTES)
+            throw new Error('fromBytes invalid length=' + b.length);
+        return this.create({
             c0: Fp6.fromBytes(b.subarray(0, Fp6.BYTES)),
             c1: Fp6.fromBytes(b.subarray(Fp6.BYTES)),
-        };
-    },
-    toBytes: ({ c0, c1 }) => concatBytes(Fp6.toBytes(c0), Fp6.toBytes(c1)),
-    cmov: ({ c0, c1 }, { c0: r0, c1: r1 }, c) => ({
-        c0: Fp6.cmov(c0, r0, c),
-        c1: Fp6.cmov(c1, r1, c),
-    }),
+        });
+    }
+    toBytes({ c0, c1 }) {
+        const { Fp6 } = this;
+        return concatBytes(Fp6.toBytes(c0), Fp6.toBytes(c1));
+    }
+    cmov({ c0, c1 }, { c0: r0, c1: r1 }, c) {
+        const { Fp6 } = this;
+        return this.create({
+            c0: Fp6.cmov(c0, r0, c),
+            c1: Fp6.cmov(c1, r1, c),
+        });
+    }
     // Utils
     // toString() {
-    //   return `Fp12(${this.c0} + ${this.c1} * w)`;
+    //   return '' + 'Fp12(' + this.c0 + this.c1 + '* w');
     // },
     // fromTuple(c: [Fp6, Fp6]) {
     //   return new Fp12(...c);
     // }
-    fromBigTwelve: (t) => ({
-        c0: Fp6.fromBigSix(t.slice(0, 6)),
-        c1: Fp6.fromBigSix(t.slice(6, 12)),
-    }),
+    fromBigTwelve(tuple) {
+        const { Fp6 } = this;
+        if (!Array.isArray(tuple) || tuple.length !== 12)
+            throw new Error('invalid Fp12.fromBigTwelve');
+        for (let i = 0; i < 12; i++)
+            if (typeof tuple[i] !== 'bigint')
+                throw new Error('invalid Fp12.fromBigTwelve');
+        const t = tuple;
+        return this.create({
+            c0: Fp6.fromBigSix(t.slice(0, 6)),
+            c1: Fp6.fromBigSix(t.slice(6, 12)),
+        });
+    }
     // Raises to q**i -th power
     frobeniusMap(lhs, power) {
-        const r0 = Fp6.frobeniusMap(lhs.c0, power);
+        const p = power % 12;
+        if (p === 0)
+            return Object.freeze({ c0: lhs.c0, c1: lhs.c1 });
+        if (p === 6)
+            return this.conjugate(lhs);
+        const { Fp6 } = this;
+        const { Fp2 } = Fp6;
         const { c0, c1, c2 } = Fp6.frobeniusMap(lhs.c1, power);
-        const coeff = FP12_FROBENIUS_COEFFICIENTS[power % 12];
-        return {
-            c0: r0,
-            c1: Fp6.create({
+        const coeff = this.FROBENIUS_COEFFICIENTS[p];
+        return Object.freeze({
+            c0: Fp6.frobeniusMap(lhs.c0, power),
+            c1: Object.freeze({
                 c0: Fp2.mul(c0, coeff),
                 c1: Fp2.mul(c1, coeff),
                 c2: Fp2.mul(c2, coeff),
             }),
-        };
-    },
-    // Sparse multiplication
-    multiplyBy014: ({ c0, c1 }, o0, o1, o4) => {
-        let t0 = Fp6.multiplyBy01(c0, o0, o1);
-        let t1 = Fp6.multiplyBy1(c1, o4);
-        return {
-            c0: Fp6.add(Fp6.mulByNonresidue(t1), t0),
-            // (c1 + c0) * [o0, o1+o4] - T0 - T1
-            c1: Fp6.sub(Fp6.sub(Fp6.multiplyBy01(Fp6.add(c1, c0), o0, Fp2.add(o1, o4)), t0), t1),
-        };
-    },
-    multiplyByFp2: ({ c0, c1 }, rhs) => ({
-        c0: Fp6.multiplyByFp2(c0, rhs),
-        c1: Fp6.multiplyByFp2(c1, rhs),
-    }),
-    conjugate: ({ c0, c1 }) => ({ c0, c1: Fp6.neg(c1) }),
+        });
+    }
+    mulByFp2({ c0, c1 }, rhs) {
+        const { Fp6 } = this;
+        return Object.freeze({
+            c0: Fp6.mulByFp2(c0, rhs),
+            c1: Fp6.mulByFp2(c1, rhs),
+        });
+    }
+    conjugate({ c0, c1 }) {
+        // Reuse `c0` by reference and only negate the `w` coefficient.
+        return Object.freeze({ c0, c1: this.Fp6.neg(c1) });
+    }
     // A cyclotomic group is a subgroup of Fp^n defined by
     //   GΦₙ(p) = {α ∈ Fpⁿ : α^Φₙ(p) = 1}
     // The result of any pairing is in a cyclotomic subgroup
     // https://eprint.iacr.org/2009/565.pdf
-    _cyclotomicSquare: ({ c0, c1 }) => {
+    // https://eprint.iacr.org/2010/354.pdf
+    _cyclotomicSquare({ c0, c1 }) {
+        const { Fp6 } = this;
+        const { Fp2 } = Fp6;
         const { c0: c0c0, c1: c0c1, c2: c0c2 } = c0;
         const { c0: c1c0, c1: c1c1, c2: c1c2 } = c1;
-        const { first: t3, second: t4 } = Fp4Square(c0c0, c1c1);
-        const { first: t5, second: t6 } = Fp4Square(c1c0, c0c2);
-        const { first: t7, second: t8 } = Fp4Square(c0c1, c1c2);
-        let t9 = Fp2.mulByNonresidue(t8); // T8 * (u + 1)
-        return {
-            c0: Fp6.create({
-                c0: Fp2.add(Fp2.mul(Fp2.sub(t3, c0c0), _2n), t3),
-                c1: Fp2.add(Fp2.mul(Fp2.sub(t5, c0c1), _2n), t5),
-                c2: Fp2.add(Fp2.mul(Fp2.sub(t7, c0c2), _2n), t7),
+        const { first: t3, second: t4 } = Fp2.Fp4Square(c0c0, c1c1);
+        const { first: t5, second: t6 } = Fp2.Fp4Square(c1c0, c0c2);
+        const { first: t7, second: t8 } = Fp2.Fp4Square(c0c1, c1c2);
+        const t9 = Fp2.mulByNonresidue(t8); // T8 * (u + 1)
+        return Object.freeze({
+            c0: Object.freeze({
+                c0: Fp2.add(Fp2.mul(Fp2.sub(t3, c0c0), _2n$1), t3), // 2 * (T3 - c0c0)  + T3
+                c1: Fp2.add(Fp2.mul(Fp2.sub(t5, c0c1), _2n$1), t5), // 2 * (T5 - c0c1)  + T5
+                c2: Fp2.add(Fp2.mul(Fp2.sub(t7, c0c2), _2n$1), t7),
+            }), // 2 * (T7 - c0c2)  + T7
+            c1: Object.freeze({
+                c0: Fp2.add(Fp2.mul(Fp2.add(t9, c1c0), _2n$1), t9), // 2 * (T9 + c1c0) + T9
+                c1: Fp2.add(Fp2.mul(Fp2.add(t4, c1c1), _2n$1), t4), // 2 * (T4 + c1c1) + T4
+                c2: Fp2.add(Fp2.mul(Fp2.add(t6, c1c2), _2n$1), t6),
             }),
-            c1: Fp6.create({
-                c0: Fp2.add(Fp2.mul(Fp2.add(t9, c1c0), _2n), t9),
-                c1: Fp2.add(Fp2.mul(Fp2.add(t4, c1c1), _2n), t4),
-                c2: Fp2.add(Fp2.mul(Fp2.add(t6, c1c2), _2n), t6),
-            }),
-        }; // 2 * (T6 + c1c2) + T6
-    },
+        }); // 2 * (T6 + c1c2) + T6
+    }
+    // https://eprint.iacr.org/2009/565.pdf
     _cyclotomicExp(num, n) {
-        let z = Fp12.ONE;
-        for (let i = BLS_X_LEN - 1; i >= 0; i--) {
-            z = Fp12._cyclotomicSquare(z);
+        // The loop only consumes `X_LEN` bits, so out-of-range exponents would otherwise get silently
+        // truncated (or sign-extended for negatives) instead of matching the caller's requested power.
+        aInRange('cyclotomic exponent', n, _0n$1, _1n$1 << BigInt(this.X_LEN));
+        if (n === _0n$1)
+            return this.ONE;
+        let z = num;
+        for (let i = bitLen(n) - 2; i >= 0; i--) {
+            z = this._cyclotomicSquare(z);
             if (bitGet(n, i))
-                z = Fp12.mul(z, num);
+                z = this.mul(z, num);
         }
         return z;
+    }
+}
+const _FROBENIUS_COEFFICIENTS_12 = new WeakMap();
+/**
+ * @param opts - Tower construction options. See {@link Tower12Opts}.
+ * @returns BLS tower fields.
+ * @throws If the tower options or derived Frobenius helpers are invalid. {@link Error}
+ * @example
+ * Construct the Fp2/Fp6/Fp12 tower used by a pairing-friendly curve.
+ *
+ * ```ts
+ * import { tower12, type Fp2, type Fp12 } from '@noble/curves/abstract/tower.js';
+ * const fields = tower12({
+ *   ORDER: 17n,
+ *   X_LEN: 4,
+ *   FP2_NONRESIDUE: [1n, 1n],
+ *   Fp2mulByB: (num: Fp2) => num,
+ *   Fp12finalExponentiate: (num: Fp12) => num,
+ * });
+ * const fp12 = fields.Fp12.ONE;
+ * ```
+ */
+function tower12(opts) {
+    validateObject(opts, {
+        ORDER: 'bigint',
+        X_LEN: 'number',
+        FP2_NONRESIDUE: 'object',
+        Fp2mulByB: 'function',
+        Fp12finalExponentiate: 'function',
+    }, { NONRESIDUE: 'bigint' });
+    asafenumber(opts.X_LEN, 'X_LEN');
+    if (opts.X_LEN < 1)
+        throw new Error('invalid X_LEN');
+    const nonresidue = opts.FP2_NONRESIDUE;
+    if (!Array.isArray(nonresidue) || nonresidue.length !== 2)
+        throw new Error('invalid FP2_NONRESIDUE');
+    if (typeof nonresidue[0] !== 'bigint' || typeof nonresidue[1] !== 'bigint')
+        throw new Error('invalid FP2_NONRESIDUE');
+    const Fp = Field(opts.ORDER);
+    const Fp2 = new _Field2(Fp, opts);
+    const Fp6 = new _Field6(Fp2);
+    const Fp12 = new _Field12(Fp6, opts);
+    return { Fp, Fp2, Fp6, Fp12 };
+}
+
+/**
+ * bls12-381 is pairing-friendly Barreto-Lynn-Scott elliptic curve construction allowing to:
+
+* Construct zk-SNARKs at the ~120-bit security, as per [Barbulescu-Duquesne 2017](https://hal.science/hal-01534101/file/main.pdf)
+* Efficiently verify N aggregate signatures with 1 pairing and N ec additions:
+the Boneh-Lynn-Shacham signature scheme is orders of magnitude more efficient than Schnorr
+
+BLS can mean 2 different things:
+
+* Barreto-Lynn-Scott: BLS12, a Pairing Friendly Elliptic Curve
+* Boneh-Lynn-Shacham: A Signature Scheme.
+
+### Summary
+
+1. BLS Relies on expensive bilinear pairing
+2. Secret Keys: 32 bytes
+3. Public Keys: 48 OR 96 bytes - big-endian x coordinate of point on G1 OR G2 curve
+4. Signatures: 96 OR 48 bytes - big-endian x coordinate of point on G2 OR G1 curve
+5. The 12 stands for the Embedding degree.
+
+Modes of operation:
+
+* Long signatures:  48-byte keys + 96-byte sigs (G1 keys + G2 sigs).
+* Short signatures: 96-byte keys + 48-byte sigs (G2 keys + G1 sigs).
+
+### Formulas
+
+- `P = pk x G` - public keys
+- `S = pk x H(m)` - signing, uses hash-to-curve on m
+- `e(P, H(m)) == e(G, S)` - verification using pairings
+- `e(G, S) = e(G, SUM(n)(Si)) = MUL(n)(e(G, Si))` - signature aggregation
+
+### Curves
+
+G1 is ordinary elliptic curve. G2 is extension field curve, think "over complex numbers".
+
+- G1: y² = x³ + 4
+- G2: y² = x³ + 4(u + 1) where u = √−1; r-order subgroup of E'(Fp²), M-type twist
+
+### Towers
+
+Pairing G1 + G2 produces element in Fp₁₂, 12-degree polynomial.
+Fp₁₂ is usually implemented using tower of lower-degree polynomials for speed.
+
+- Fp₁₂ = Fp₆² => Fp₂³
+- Fp(u) / (u² - β) where β = -1
+- Fp₂(v) / (v³ - ξ) where ξ = u + 1
+- Fp₆(w) / (w² - γ) where γ = v
+- Fp²[u] = Fp/u²+1
+- Fp⁶[v] = Fp²/v³-1-u
+- Fp¹²[w] = Fp⁶/w²-v
+
+### Params
+
+* Embedding degree (k): 12
+* Seed is sometimes named x or t
+* t = -15132376222941642752
+* p = (t-1)² * (t⁴-t²+1)/3 + t
+* r = t⁴-t²+1
+* Ate loop size: X
+
+To verify curve parameters, see
+[pairing-friendly-curves spec](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-pairing-friendly-curves-11).
+Basic math is done over finite fields over p.
+More complicated math is done over polynominal extension fields.
+
+### Compatibility and notes
+1. It is compatible with Algorand, Chia, Dfinity, Ethereum, Filecoin, ZEC.
+Filecoin uses little endian byte arrays for secret keys - make sure to reverse byte order.
+2. Make sure to correctly select mode: "long signature" or "short signature".
+3. Compatible with specs:
+   RFC 9380,
+   [cfrg-pairing-friendly-curves-11](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-pairing-friendly-curves-11),
+   [cfrg-bls-signature-05](https://datatracker.ietf.org/doc/draft-irtf-cfrg-bls-signature/).
+
+ *
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+// Be friendly to bad ECMAScript parsers by not using bigint literals
+// prettier-ignore
+const _0n = BigInt(0), _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);
+// To verify math:
+// https://tools.ietf.org/html/draft-irtf-cfrg-pairing-friendly-curves-11
+// The BLS parameter x (seed) for BLS12-381. The stored constant is `|x|`; call
+// sites that need the signed parameter apply the minus sign themselves.
+// x = -2^63 - 2^62 - 2^60 - 2^57 - 2^48 - 2^16
+const BLS_X = BigInt('0xd201000000010000');
+// t = x (called differently in different places)
+// const t = -BLS_X;
+const BLS_X_LEN = bitLen(BLS_X);
+// a=0, b=4
+// P is characteristic of field Fp, in which curve calculations are done.
+// p = (t-1)² * (t⁴-t²+1)/3 + t
+// bls12_381_Fp = (t-1n)**2n * (t**4n - t**2n + 1n) / 3n + t
+// r*h is curve order, amount of points on curve,
+// where r is order of prime subgroup and h is cofactor.
+// r = t⁴-t²+1
+// r = (t**4n - t**2n + 1n)
+// cofactor h of G1: (t - 1)²/3, with the signed convention `t = -x`
+// cofactorG1 = (t-1n)**2n/3n
+// x = 3685416753713387016781088315183077757961620795782546409894578378688607592378376318836054947676345821548104185464507
+// y = 1339506544944476473020471379941921221584933875938349620426543736416511423956333506472724655353366534992391756441569
+const bls12_381_CURVE_G1 = {
+    p: BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'),
+    n: BigInt('0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001'),
+    h: BigInt('0x396c8c005555e1568c00aaab0000aaab'),
+    a: _0n,
+    b: _4n,
+    Gx: BigInt('0x17f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac586c55e83ff97a1aeffb3af00adb22c6bb'),
+    Gy: BigInt('0x08b3f481e3aaa0f1a09e30ed741d8ae4fcf5e095d5d00af600db18cb2c04b3edd03cc744a2888ae40caa232946c5e7e1'),
+};
+// CURVE FIELDS
+// r = z⁴ − z² + 1; CURVE.n from other curves
+/**
+ * bls12-381 Fr (Fn) field.
+ * `fromBytes()` reduces modulo `q` instead of rejecting non-canonical encodings.
+ */
+const bls12_381_Fr = Field(bls12_381_CURVE_G1.n, {
+    modFromBytes: true,
+});
+// Karabina's G2345 compression for the cyclotomic subgroup. Noble stores Fp12 as
+// (c0 + c1*w), so (g0, g1, g2, g3, g4, g5) map to (c0.c0, c1.c1, c1.c0, c0.c2, c0.c1, c1.c2).
+function bls12FromCompressed(g0, g1, { g2, g3, g4, g5 }) {
+    return { c0: { c0: g0, c1: g4, c2: g3 }, c1: { c0: g2, c1: g1, c2: g5 } };
+}
+function bls12Compress({ c0, c1 }) {
+    return { g2: c1.c0, g3: c0.c2, g4: c0.c1, g5: c1.c2 };
+}
+function bls12CyclotomicSquareCompressed({ g2, g3, g4, g5 }) {
+    const { first: h23c0, second: h23c1 } = Fp2.Fp4Square(g4, g5);
+    const { first: h45c0, second: h45c1 } = Fp2.Fp4Square(g2, g3);
+    const d2 = Fp2.add(g2, g2);
+    const d3 = Fp2.add(g3, g3);
+    const d4 = Fp2.add(g4, g4);
+    const d5 = Fp2.add(g5, g5);
+    return {
+        g2: Fp2.add(Fp2.mul(Fp2.mulByNonresidue(h23c1), _3n), d2),
+        g3: Fp2.sub(Fp2.mul(h23c0, _3n), d3),
+        g4: Fp2.sub(Fp2.mul(h45c0, _3n), d4),
+        g5: Fp2.add(Fp2.mul(h45c1, _3n), d5),
+    };
+}
+function bls12RecoverG1Ratio({ g2, g3, g4, g5 }) {
+    if (Fp2.is0(g2))
+        return { num: Fp2.mul(Fp2.mul(g4, g5), _2n), den: g3 };
+    return {
+        num: Fp2.add(Fp2.sub(Fp2.mul(Fp2.sqr(g4), _3n), Fp2.mul(g3, _2n)), Fp2.mulByNonresidue(Fp2.sqr(g5))),
+        den: Fp2.mul(g2, _4n),
+    };
+}
+function bls12RecoverG0(g1, { g2, g3, g4, g5 }) {
+    const g3g4 = Fp2.mul(g3, g4);
+    const t = Fp2.add(Fp2.sub(Fp2.mul(Fp2.sub(Fp2.sqr(g1), g3g4), _2n), g3g4), Fp2.mul(g2, g5));
+    return Fp2.add(Fp2.mulByNonresidue(t), Fp2.ONE);
+}
+function bls12CyclotomicExpCompressed(num, squarings) {
+    const gs = [];
+    let g = bls12Compress(num);
+    for (const count of squarings) {
+        for (let i = 0; i < count; i++)
+            g = bls12CyclotomicSquareCompressed(g);
+        gs.push(g);
+    }
+    // Karabina decompression is undefined at g2 = g3 = 0. Every element decompressed here lies in
+    // the cyclotomic subgroup GΦ₁₂, where the only such element is the identity: unitarity
+    // (z⋅z^(p⁶) = 1) forces g4² = ξ⋅g5², so g4 = g5 = 0 because ξ is a non-square in Fp2, leaving
+    // z ∈ Fp4* ∩ GΦ₁₂ — trivial since gcd(p⁴−p²+1, p⁴−1) = gcd(3, p²−2) = 1 for p ≡ 1 mod 3.
+    // Handle the identity explicitly instead of relying on invertBatch's passZero mapping the zero
+    // denominator to 0 (which happens to reconstruct ONE, but only by coincidence of formulas).
+    const isOne = gs.map(({ g2, g3 }) => Fp2.is0(g2) && Fp2.is0(g3));
+    const ratios = gs.map(bls12RecoverG1Ratio);
+    const invDens = Fp2.invertBatch(ratios.map(({ den }) => den));
+    const elems = gs.map((compressed, i) => {
+        if (isOne[i])
+            return Fp12.ONE;
+        const g1 = Fp2.mul(ratios[i].num, invDens[i]);
+        return bls12FromCompressed(bls12RecoverG0(g1, compressed), g1, compressed);
+    });
+    return { result: Fp12.mul(Fp12.mul(elems[0], elems[1]), elems[2]), last: elems[2] };
+}
+function bls12CyclotomicExpX(num) {
+    // BLS_X = 2^63 + 2^62 + 2^60 + 2^57 + 2^48 + 2^16.
+    const { result, last } = bls12CyclotomicExpCompressed(num, [16, 32, 9]);
+    let r = result;
+    let s = last;
+    for (let i = 0; i < 3; i++)
+        s = Fp12._cyclotomicSquare(s);
+    r = Fp12.mul(r, s);
+    for (let i = 0; i < 2; i++)
+        s = Fp12._cyclotomicSquare(s);
+    r = Fp12.mul(r, s);
+    s = Fp12._cyclotomicSquare(s);
+    return Fp12.mul(r, s);
+}
+const { Fp, Fp2, Fp6, Fp12 } = tower12({
+    ORDER: bls12_381_CURVE_G1.p,
+    X_LEN: BLS_X_LEN,
+    // Finite extension field over irreducible polynominal.
+    // Fp(u) / (u² - β) where β = -1
+    // Public `Fp2.NONRESIDUE` below is the sextic-tower value `(1, 1) = u + 1`;
+    // the quadratic non-residue for the base Fp2 construction is still `-1`.
+    FP2_NONRESIDUE: [_1n, _1n],
+    Fp2mulByB: ({ c0, c1 }) => {
+        const t0 = Fp.mul(c0, _4n);
+        const t1 = Fp.mul(c1, _4n);
+        // (T0-T1) + (T0+T1)*i
+        return { c0: Fp.sub(t0, t1), c1: Fp.add(t0, t1) };
     },
-    // https://eprint.iacr.org/2010/354.pdf
-    // https://eprint.iacr.org/2009/565.pdf
-    finalExponentiate: (num) => {
-        const x = BLS_X;
+    Fp12finalExponentiate: (num) => {
+        const powMinusX = (num) => Fp12.conjugate(bls12CyclotomicExpX(num));
         // this^(q⁶) / this
         const t0 = Fp12.div(Fp12.frobeniusMap(num, 6), num);
         // t0^(q²) * t0
         const t1 = Fp12.mul(Fp12.frobeniusMap(t0, 2), t0);
-        const t2 = Fp12.conjugate(Fp12._cyclotomicExp(t1, x));
+        const t2 = powMinusX(t1);
         const t3 = Fp12.mul(Fp12.conjugate(Fp12._cyclotomicSquare(t1)), t2);
-        const t4 = Fp12.conjugate(Fp12._cyclotomicExp(t3, x));
-        const t5 = Fp12.conjugate(Fp12._cyclotomicExp(t4, x));
-        const t6 = Fp12.mul(Fp12.conjugate(Fp12._cyclotomicExp(t5, x)), Fp12._cyclotomicSquare(t2));
-        const t7 = Fp12.conjugate(Fp12._cyclotomicExp(t6, x));
+        const t4 = powMinusX(t3);
+        const t5 = powMinusX(t4);
+        const t6 = Fp12.mul(powMinusX(t5), Fp12._cyclotomicSquare(t2));
+        const t7 = powMinusX(t6);
         const t2_t5_pow_q2 = Fp12.frobeniusMap(Fp12.mul(t2, t5), 2);
         const t4_t1_pow_q3 = Fp12.frobeniusMap(Fp12.mul(t4, t1), 3);
         const t6_t1c_pow_q1 = Fp12.frobeniusMap(Fp12.mul(t6, Fp12.conjugate(t1)), 1);
@@ -982,57 +2303,353 @@ const Fp12 = {
         // (t2 * t5)^(q²) * (t4 * t1)^(q³) * (t6 * t1.conj)^(q^1) * t7 * t3.conj * t1
         return Fp12.mul(Fp12.mul(Fp12.mul(t2_t5_pow_q2, t4_t1_pow_q3), t6_t1c_pow_q1), t7_t3c_t1);
     },
+});
+// GLV endomorphism Ψ(P), for fast cofactor clearing. `Fp2.NONRESIDUE` here is
+// the tower value `u + 1`, so the Frobenius base passed to psiFrobenius is
+// `1 / (u + 1)`, and psi2 derives the published `1 / 2^((p - 1) / 3)` constant internally.
+let frob;
+const getFrob = () => frob || (frob = psiFrobenius(Fp, Fp2, Fp2.div(Fp2.ONE, Fp2.NONRESIDUE)));
+// Eager psiFrobenius setup now dominates `bls12-381.js` import, so defer it to
+// first use. After that these locals are rewritten to the direct helper refs.
+let G2psi = (c, P) => {
+    const fn = getFrob().G2psi;
+    G2psi = fn;
+    return fn(c, P);
 };
-const FP12_FROBENIUS_COEFFICIENTS = [
-    [BigInt('0x1'), BigInt('0x0')],
-    [
-        BigInt('0x1904d3bf02bb0667c231beb4202c0d1f0fd603fd3cbd5f4f7b2443d784bab9c4f67ea53d63e7813d8d0775ed92235fb8'),
-        BigInt('0x00fc3e2b36c4e03288e9e902231f9fb854a14787b6c7b36fec0c8ec971f63c5f282d5ac14d6c7ec22cf78a126ddc4af3'),
-    ],
-    [
-        BigInt('0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffeffff'),
-        BigInt('0x0'),
-    ],
-    [
-        BigInt('0x135203e60180a68ee2e9c448d77a2cd91c3dedd930b1cf60ef396489f61eb45e304466cf3e67fa0af1ee7b04121bdea2'),
-        BigInt('0x06af0e0437ff400b6831e36d6bd17ffe48395dabc2d3435e77f76e17009241c5ee67992f72ec05f4c81084fbede3cc09'),
-    ],
-    [
-        BigInt('0x00000000000000005f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe'),
-        BigInt('0x0'),
-    ],
-    [
-        BigInt('0x144e4211384586c16bd3ad4afa99cc9170df3560e77982d0db45f3536814f0bd5871c1908bd478cd1ee605167ff82995'),
-        BigInt('0x05b2cfd9013a5fd8df47fa6b48b1e045f39816240c0b8fee8beadf4d8e9c0566c63a3e6e257f87329b18fae980078116'),
-    ],
-    [
-        BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaaa'),
-        BigInt('0x0'),
-    ],
-    [
-        BigInt('0x00fc3e2b36c4e03288e9e902231f9fb854a14787b6c7b36fec0c8ec971f63c5f282d5ac14d6c7ec22cf78a126ddc4af3'),
-        BigInt('0x1904d3bf02bb0667c231beb4202c0d1f0fd603fd3cbd5f4f7b2443d784bab9c4f67ea53d63e7813d8d0775ed92235fb8'),
-    ],
-    [
-        BigInt('0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac'),
-        BigInt('0x0'),
-    ],
-    [
-        BigInt('0x06af0e0437ff400b6831e36d6bd17ffe48395dabc2d3435e77f76e17009241c5ee67992f72ec05f4c81084fbede3cc09'),
-        BigInt('0x135203e60180a68ee2e9c448d77a2cd91c3dedd930b1cf60ef396489f61eb45e304466cf3e67fa0af1ee7b04121bdea2'),
-    ],
-    [
-        BigInt('0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaad'),
-        BigInt('0x0'),
-    ],
-    [
-        BigInt('0x05b2cfd9013a5fd8df47fa6b48b1e045f39816240c0b8fee8beadf4d8e9c0566c63a3e6e257f87329b18fae980078116'),
-        BigInt('0x144e4211384586c16bd3ad4afa99cc9170df3560e77982d0db45f3536814f0bd5871c1908bd478cd1ee605167ff82995'),
-    ],
-].map((n) => Fp2.fromBigTuple(n));
-// END OF CURVE FIELDS
-// HashToCurve
+let G2psi2 = (c, P) => {
+    const fn = getFrob().G2psi2;
+    G2psi2 = fn;
+    return fn(c, P);
+};
+/**
+ * Default hash_to_field / hash-to-curve for BLS.
+ * m: 1 for G1, 2 for G2
+ * k: target security level in bits
+ * hash: any function, e.g. BBS+ uses BLAKE2: see [github](https://github.com/hyperledger/aries-framework-go/issues/2247).
+ * Field/hash parameters come from [section 8.8.2 of RFC 9380](https://www.rfc-editor.org/rfc/rfc9380#section-8.8.2),
+ * but the `DST` / `encodeDST` strings below are the BLS-signature-suite override.
+ */
+const hasher_opts = Object.freeze({
+    DST: 'BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_',
+    encodeDST: 'BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_',
+    p: Fp.ORDER,
+    m: 2,
+    k: 128,
+    expand: 'xmd',
+    hash: sha256,
+});
+// a=0, b=4
+// cofactor h of G2, derived with the signed convention `t = -x`
+// (t^8 - 4t^7 + 5t^6 - 4t^4 + 6t^3 - 4t^2 - 4t + 13)/9
+// cofactorG2 = (t**8n - 4n*t**7n + 5n*t**6n - 4n*t**4n + 6n*t**3n - 4n*t**2n - 4n*t+13n)/9n
+// x = 3059144344244213709971259814753781636986470325476647558659373206291635324768958432433509563104347017837885763365758*u + 352701069587466618187139116011060144890029952792775240219908644239793785735715026873347600343865175952761926303160
+// y = 927553665492332455747201965776037880757740193453592970025027978793976877002675564980949289727957565575433344219582*u + 1985150602287291935568054521177171638300868978215655730859378665066344726373823718423869104263333984641494340347905
+const bls12_381_CURVE_G2 = {
+    p: Fp2.ORDER,
+    n: bls12_381_CURVE_G1.n,
+    h: BigInt('0x5d543a95414e7f1091d50792876a202cd91de4547085abaa68a205b2e5a7ddfa628f1cb4d9e82ef21537e293a6691ae1616ec6e786f0c70cf1c38e31c7238e5'),
+    a: Fp2.ZERO,
+    b: Fp2.fromBigTuple([_4n, _4n]),
+    Gx: Fp2.fromBigTuple([
+        BigInt('0x024aa2b2f08f0a91260805272dc51051c6e47ad4fa403b02b4510b647ae3d1770bac0326a805bbefd48056c8c121bdb8'),
+        BigInt('0x13e02b6052719f607dacd3a088274f65596bd0d09920b61ab5da61bbdc7f5049334cf11213945d57e5ac7d055d042b7e'),
+    ]),
+    Gy: Fp2.fromBigTuple([
+        BigInt('0x0ce5d527727d6e118cc9cdc6da2e351aadfd9baa8cbdd3a76d429a695160d12c923ac9cc3baca289e193548608b82801'),
+        BigInt('0x0606c4a02ea734cc32acd2b02bc28b99cb3e287e85a763af267492ab572e99ab3f370d275cec1da1aaa9075ff05f79be'),
+    ]),
+};
+// Encoding utils
+const sortBit = (parts, p) => {
+    for (const part of parts) {
+        if (part !== _0n)
+            return Boolean((part * _2n) / p);
+    }
+    return false;
+};
+const fp2 = {
+    // Generic tower bytes use `c0 || c1`, but the BLS12-381 G2 point/signature wire encoding uses
+    // `c1 || c0`, so keep this local wrapper instead of changing generic field serialization.
+    encode({ c0, c1 }) {
+        const { BYTES: L } = Fp;
+        return concatBytes(numberToBytesBE(c1, L), numberToBytesBE(c0, L));
+    },
+    decode(bytes) {
+        const { BYTES: L } = Fp;
+        return Fp2.create({
+            c0: decodeFp(bytes.subarray(L)),
+            c1: decodeFp(bytes.subarray(0, L)),
+        });
+    },
+};
+const BaseFp = Fp;
+function decodeFp(bytes) {
+    return Fp.fromBytes(bytes);
+}
+// Keep BLS12-381 point/signature codecs on one control-flow skeleton: the G1/G2
+// and point/signature variants differ only in field packing, subgroup bytes, and
+// whether uncompressed form is allowed. Copy-paste decoders were diverging.
+const coder = (name, Fp, b, encode, decode, yparts) => {
+    const F = Fp;
+    const enc = encode;
+    const dec = decode;
+    const W = F.BYTES;
+    return (allowUncompressed) => ({
+        encode(point, compressed = true) {
+            if (!compressed && !allowUncompressed)
+                throw new Error('invalid signature: expected compressed encoding');
+            const infinity = point.is0();
+            const { x, y } = point.toAffine();
+            const bytes = compressed ? enc(x) : concatBytes(enc(x), enc(y));
+            let sort;
+            if (compressed && !infinity)
+                sort = sortBit(yparts(y), BaseFp.ORDER);
+            return setMask(bytes, { compressed, infinity, sort });
+        },
+        decode(bytes) {
+            const raw = allowUncompressed
+                ? abytes(bytes, undefined, 'point')
+                : abytes(bytes, W, 'signature');
+            const { compressed, infinity, sort, value } = parseMask(raw);
+            if (!allowUncompressed && !compressed)
+                throw new Error('invalid signature: expected compressed encoding');
+            const len = compressed ? W : 2 * W;
+            if (value.length !== len)
+                throw new Error(`invalid ${name} point: expected ${len} bytes`);
+            if (infinity) {
+                // Infinity has a dedicated encoding: after the flag bits are cleared, every
+                // remaining payload byte must be zero.
+                for (const b of value) {
+                    if (b)
+                        throw new Error(`invalid ${name} point: non-canonical zero`);
+                }
+                return { x: F.ZERO, y: F.ZERO };
+            }
+            const x = dec(compressed ? value : value.subarray(0, W));
+            let y;
+            if (compressed) {
+                y = F.sqrt(F.add(F.pow(x, _3n), b));
+                if (!y)
+                    throw new Error(`invalid ${name} point: compressed`);
+                if (sortBit(yparts(y), BaseFp.ORDER) !== sort)
+                    y = F.neg(y);
+            }
+            else {
+                y = dec(value.subarray(W));
+            }
+            // The all-zero uncompressed payload must use the infinity flag instead of
+            // decoding as an ordinary affine point.
+            if (!compressed && F.is0(x) && F.is0(y))
+                throw new Error(`invalid ${name} point: uncompressed`);
+            return { x, y };
+        },
+    });
+};
+// Internal helper only: it copies before clearing the top flag bits. The
+// pairing-friendly-curves draft C.2 step 1 rejects 0x20 / 0x60 / 0xe0 because
+// S_bit must be zero for infinity and for all uncompressed encodings.
+function validateMask({ compressed, infinity, sort }) {
+    if ((!compressed && !infinity && sort) || // 0010_0000 = 0x20
+        (!compressed && infinity && sort) || // 0110_0000 = 0x60
+        (compressed && infinity && sort) // 1110_0000 = 0xe0
+    )
+        throw new Error('invalid encoding flag');
+}
+function parseMask(bytes) {
+    // Copy, so we can remove mask data.
+    bytes = copyBytes(bytes);
+    const mask = bytes[0] & 0b1110_0000;
+    const compressed = !!((mask >> 7) & 1); // compression bit (0b1000_0000)
+    const infinity = !!((mask >> 6) & 1); // point at infinity bit (0b0100_0000)
+    const sort = !!((mask >> 5) & 1); // sort bit (0b0010_0000)
+    validateMask({ compressed, infinity, sort });
+    bytes[0] &= 0b0001_1111; // clear mask (zero first 3 bits)
+    return { compressed, infinity, sort, value: bytes };
+}
+// Internal helper only: mutates a non-empty fresh buffer in place and just
+// sets bits. Keep the same invalid-flag guard as parseMask() so encoders cannot
+// manufacture states that decoders already reject.
+function setMask(bytes, mask) {
+    if (bytes[0] & 0b1110_0000)
+        throw new Error('setMask: non-empty mask');
+    validateMask({ compressed: !!mask.compressed, infinity: !!mask.infinity, sort: !!mask.sort });
+    if (mask.compressed)
+        bytes[0] |= 0b1000_0000;
+    if (mask.infinity)
+        bytes[0] |= 0b0100_0000;
+    if (mask.sort)
+        bytes[0] |= 0b0010_0000;
+    return bytes;
+}
+const g1coder = coder('G1', Fp, Fp.create(bls12_381_CURVE_G1.b), (x) => numberToBytesBE(x, Fp.BYTES), decodeFp, (y) => [y]);
+const g1 = { point: g1coder(true), sig: g1coder(false) };
+const signatureG1ToBytes = (point) => {
+    point.assertValidity();
+    return g1.sig.encode(point);
+};
+function signatureG1FromBytes(bytes) {
+    const Point = bls12_381.G1.Point;
+    const point = Point.fromAffine(g1.sig.decode(bytes));
+    point.assertValidity();
+    return point;
+}
+const g2coder = coder('G2', Fp2, bls12_381_CURVE_G2.b, fp2.encode, fp2.decode, (y) => [
+    y.c1,
+    y.c0,
+]);
+const g2 = { point: g2coder(true), sig: g2coder(false) };
+const signatureG2ToBytes = (point) => {
+    point.assertValidity();
+    return g2.sig.encode(point);
+};
+function signatureG2FromBytes(bytes) {
+    const Point = bls12_381.G2.Point;
+    const point = Point.fromAffine(g2.sig.decode(bytes));
+    point.assertValidity();
+    return point;
+}
+const signatureCoders = {
+    ShortSignature: {
+        fromBytes(bytes) {
+            return signatureG1FromBytes(abytes(bytes));
+        },
+        fromHex(hex) {
+            return signatureG1FromBytes(hexToBytes(hex));
+        },
+        toBytes(point) {
+            return signatureG1ToBytes(point);
+        },
+        // Historical alias: BLS signatures have a single compressed byte format here.
+        toRawBytes(point) {
+            return signatureG1ToBytes(point);
+        },
+        toHex(point) {
+            return bytesToHex(signatureG1ToBytes(point));
+        },
+    },
+    LongSignature: {
+        fromBytes(bytes) {
+            return signatureG2FromBytes(abytes(bytes));
+        },
+        fromHex(hex) {
+            return signatureG2FromBytes(hexToBytes(hex));
+        },
+        toBytes(point) {
+            return signatureG2ToBytes(point);
+        },
+        // Historical alias: BLS signatures have a single compressed byte format here.
+        toRawBytes(point) {
+            return signatureG2ToBytes(point);
+        },
+        toHex(point) {
+            return bytesToHex(signatureG2ToBytes(point));
+        },
+    },
+};
+const fields = {
+    Fp,
+    Fp2,
+    Fp6,
+    Fp12,
+    Fr: bls12_381_Fr,
+};
+const G1_Point = weierstrass(bls12_381_CURVE_G1, {
+    // Public point APIs still accept infinity, even though the Zcash proof
+    // encoding rules cited above only define nonzero point encodings.
+    allowInfinityPoint: true,
+    Fn: bls12_381_Fr,
+    fromBytes: g1.point.decode,
+    toBytes: (_c, point, isComp) => g1.point.encode(point, isComp),
+    // Checks is the point resides in prime-order subgroup.
+    // point.isTorsionFree() should return true for valid points
+    // It returns false for shitty points.
+    // https://eprint.iacr.org/2021/1130.pdf
+    isTorsionFree: (c, point) => {
+        // GLV endomorphism ψ(P)
+        const beta = BigInt('0x5f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe');
+        const phi = new c(Fp.mul(point.X, beta), point.Y, point.Z);
+        // TODO: unroll
+        const xP = point.multiplyUnsafe(BLS_X).negate(); // [x]P
+        const u2P = xP.multiplyUnsafe(BLS_X); // [u2]P
+        return u2P.equals(phi);
+    },
+    // Clear cofactor of G1
+    // https://eprint.iacr.org/2019/403
+    clearCofactor: (_c, point) => {
+        // return this.multiplyUnsafe(CURVE.h);
+        return point.multiplyUnsafe(BLS_X).add(point); // x*P + P
+    },
+});
+const G2_Point = weierstrass(bls12_381_CURVE_G2, {
+    Fp: Fp2,
+    // Public point APIs still accept infinity, even though the Zcash proof
+    // encoding rules cited above only define nonzero point encodings.
+    allowInfinityPoint: true,
+    Fn: bls12_381_Fr,
+    fromBytes: g2.point.decode,
+    toBytes: (_c, point, isComp) => g2.point.encode(point, isComp),
+    // https://eprint.iacr.org/2021/1130.pdf
+    // Older version: https://eprint.iacr.org/2019/814.pdf
+    isTorsionFree: (c, P) => {
+        return P.multiplyUnsafe(BLS_X).negate().equals(G2psi(c, P)); // ψ(P) == [u](P)
+    },
+    // clear_cofactor_bls12381_g2 from RFC 9380.
+    // https://eprint.iacr.org/2017/419.pdf
+    // prettier-ignore
+    clearCofactor: (c, P) => {
+        const x = BLS_X;
+        let t1 = P.multiplyUnsafe(x).negate(); // [-x]P
+        let t2 = G2psi(c, P); // Ψ(P)
+        let t3 = P.double(); // 2P
+        t3 = G2psi2(c, t3); // Ψ²(2P)
+        t3 = t3.subtract(t2); // Ψ²(2P) - Ψ(P)
+        t2 = t1.add(t2); // [-x]P + Ψ(P)
+        t2 = t2.multiplyUnsafe(x).negate(); // [x²]P - [x]Ψ(P)
+        t3 = t3.add(t2); // Ψ²(2P) - Ψ(P) + [x²]P - [x]Ψ(P)
+        t3 = t3.subtract(t1); // Ψ²(2P) - Ψ(P) + [x²]P - [x]Ψ(P) + [x]P
+        const Q = t3.subtract(P); // Ψ²(2P) - Ψ(P) + [x²]P - [x]Ψ(P) + [x]P - 1P
+        return Q; // [x²-x-1]P + [x-1]Ψ(P) + Ψ²(2P)
+    },
+});
+const bls12_hasher_opts = {
+    mapToG1: mapToG1,
+    mapToG2: mapToG2,
+    hasherOpts: hasher_opts,
+    // RFC 9380 Appendix J defines distinct G1/G2 RO and NU suite IDs, and
+    // draft-irtf-cfrg-bls-signature-06 §4.2.1 gives separate G1/G2 `_NUL_` DSTs.
+    // Keep G1 encode-to-curve on the G1 domain instead of inheriting G2's `encodeDST`.
+    hasherOptsG1: {
+        ...hasher_opts,
+        m: 1,
+        DST: 'BLS_SIG_BLS12381G1_XMD:SHA-256_SSWU_RO_NUL_',
+        encodeDST: 'BLS_SIG_BLS12381G1_XMD:SHA-256_SSWU_RO_NUL_',
+    },
+    hasherOptsG2: { ...hasher_opts },
+};
+const bls12_params = {
+    ateLoopSize: BLS_X, // The BLS parameter x for BLS12-381
+    xNegative: true,
+    twistType: 'multiplicative',
+    randomBytes: randomBytes,
+};
+/**
+ * bls12-381 pairing-friendly curve construction.
+ * Provides both longSignatures and shortSignatures.
+ * @example
+ * bls12-381 pairing-friendly curve construction.
+ *
+ * ```ts
+ * const bls = bls12_381.longSignatures;
+ * const { secretKey, publicKey } = bls.keygen();
+ * const msg = bls.hash(new TextEncoder().encode('hello noble'));
+ * const sig = bls.sign(msg, secretKey);
+ * const isValid = bls.verify(sig, msg, publicKey);
+ * ```
+ */
+const bls12_381 = bls(fields, G1_Point, G2_Point, bls12_params, bls12_hasher_opts, signatureCoders);
 // 3-isogeny map from E' to E https://www.rfc-editor.org/rfc/rfc9380#appendix-E.3
+// Coefficients stay in ascending `k_(?,0)`..`k_(?,d)` order; isogenyMap()
+// reverses them internally for Horner evaluation.
 const isogenyMapG2 = isogenyMap(Fp2, [
     // xNum
     [
@@ -1101,7 +2718,8 @@ const isogenyMapG2 = isogenyMap(Fp2, [
         ['0x1', '0x0'], // LAST 1
     ],
 ].map((i) => i.map((pair) => Fp2.fromBigTuple(pair.map(BigInt)))));
-// 11-isogeny map from E' to E
+// 11-isogeny map from E' to E. Coefficients stay in ascending
+// `k_(?,0)`..`k_(?,d)` order; isogenyMap() reverses them for Horner evaluation.
 const isogenyMapG1 = isogenyMap(Fp, [
     // xNum
     [
@@ -1171,406 +2789,43 @@ const isogenyMapG1 = isogenyMap(Fp, [
         '0x000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001', // LAST 1
     ],
 ].map((i) => i.map((j) => BigInt(j))));
-// SWU Map - Fp2 to G2': y² = x³ + 240i * x + 1012 + 1012i
-const G2_SWU = mapToCurveSimpleSWU(Fp2, {
-    A: Fp2.create({ c0: Fp.create(_0n), c1: Fp.create(BigInt(240)) }),
-    B: Fp2.create({ c0: Fp.create(BigInt(1012)), c1: Fp.create(BigInt(1012)) }),
-    Z: Fp2.create({ c0: Fp.create(BigInt(-2)), c1: Fp.create(BigInt(-1)) }), // Z: -(2 + I)
-});
-// Optimized SWU Map - Fp to G1
-const G1_SWU = mapToCurveSimpleSWU(Fp, {
-    A: Fp.create(BigInt('0x144698a3b8e9433d693a02c96d4982b0ea985383ee66a8d8e8981aefd881ac98936f8da0e0f97f5cf428082d584c1d')),
-    B: Fp.create(BigInt('0x12e2908d11688030018b12e8753eee3b2016c1f0f24f4070a0b9c14fcef35ef55a23215a316ceaa5d1cc48e98e172be0')),
-    Z: Fp.create(BigInt(11)),
-});
-// Endomorphisms (for fast cofactor clearing)
-// Ψ(P) endomorphism
-const ut_root = Fp6.create({ c0: Fp2.ZERO, c1: Fp2.ONE, c2: Fp2.ZERO });
-const wsq = Fp12.create({ c0: ut_root, c1: Fp6.ZERO });
-const wcu = Fp12.create({ c0: Fp6.ZERO, c1: ut_root });
-const [wsq_inv, wcu_inv] = Fp12.invertBatch([wsq, wcu]);
-function psi(x, y) {
-    // Untwist Fp2->Fp12 && frobenius(1) && twist back
-    const x2 = Fp12.mul(Fp12.frobeniusMap(Fp12.multiplyByFp2(wsq_inv, x), 1), wsq).c0.c0;
-    const y2 = Fp12.mul(Fp12.frobeniusMap(Fp12.multiplyByFp2(wcu_inv, y), 1), wcu).c0.c0;
-    return [x2, y2];
-}
-// Ψ endomorphism
-function G2psi(c, P) {
-    const affine = P.toAffine();
-    const p = psi(affine.x, affine.y);
-    return new c(p[0], p[1], Fp2.ONE);
-}
-// Ψ²(P) endomorphism
-// 1 / F2(2)^((p-1)/3) in GF(p²)
-const PSI2_C1 = BigInt('0x1a0111ea397fe699ec02408663d4de85aa0d857d89759ad4897d29650fb85f9b409427eb4f49fffd8bfd00000000aaac');
-function psi2(x, y) {
-    return [Fp2.mul(x, PSI2_C1), Fp2.neg(y)];
-}
-function G2psi2(c, P) {
-    const affine = P.toAffine();
-    const p = psi2(affine.x, affine.y);
-    return new c(p[0], p[1], Fp2.ONE);
+let G1_SWU;
+let G2_SWU;
+// SWU setup validates the pre-isogeny curve parameters and builds sqrt-ratio helpers.
+// Doing that eagerly adds about 10ms to `bls12-381.js` import here, so keep it lazy; after the
+// first map call the cached mapper is reused directly.
+const getG1_SWU = () => G1_SWU ||
+    (G1_SWU = mapToCurveSimpleSWU(Fp, {
+        A: Fp.create(BigInt('0x144698a3b8e9433d693a02c96d4982b0ea985383ee66a8d8e8981aefd881ac98936f8da0e0f97f5cf428082d584c1d')),
+        B: Fp.create(BigInt('0x12e2908d11688030018b12e8753eee3b2016c1f0f24f4070a0b9c14fcef35ef55a23215a316ceaa5d1cc48e98e172be0')),
+        Z: Fp.create(BigInt(11)),
+    }));
+const getG2_SWU = () => G2_SWU ||
+    (G2_SWU = mapToCurveSimpleSWU(Fp2, {
+        // SWU map for the RFC 9380 §8.8.2 pre-isogeny G2 curve E':
+        // y² = x³ + 240i * x + 1012 + 1012i
+        A: Fp2.create({ c0: Fp.create(_0n), c1: Fp.create(BigInt(240)) }), // A' = 240 * I
+        B: Fp2.create({ c0: Fp.create(BigInt(1012)), c1: Fp.create(BigInt(1012)) }), // B' = 1012 * (1 + I)
+        Z: Fp2.create({ c0: Fp.create(BigInt(-2)), c1: Fp.create(BigInt(-1)) }), // Z: -(2 + I)
+    }));
+// Internal hash-to-curve step: G1 uses `m = 1`, so only `scalars[0]` is read,
+// and the result is the isogeny image on E before the subgroup clear.
+function mapToG1(scalars) {
+    const { x, y } = getG1_SWU()(Fp.create(scalars[0]));
+    return isogenyMapG1(x, y);
 }
-// Default hash_to_field options are for hash to G2.
-//
-// Parameter definitions are in section 5.3 of the spec unless otherwise noted.
-// Parameter values come from section 8.8.2 of the spec.
-// https://www.rfc-editor.org/rfc/rfc9380#section-8.8.2
-//
-// Base field F is GF(p^m)
-// p = 0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab
-// m = 2 (or 1 for G1 see section 8.8.1)
-// k = 128
-const htfDefaults = Object.freeze({
-    // DST: a domain separation tag
-    // defined in section 2.2.5
-    // Use utils.getDSTLabel(), utils.setDSTLabel(value)
-    DST: 'BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_',
-    encodeDST: 'BLS_SIG_BLS12381G2_XMD:SHA-256_SSWU_RO_NUL_',
-    // p: the characteristic of F
-    //    where F is a finite field of characteristic p and order q = p^m
-    p: Fp.ORDER,
-    // m: the extension degree of F, m >= 1
-    //     where F is a finite field of characteristic p and order q = p^m
-    m: 2,
-    // k: the target security level for the suite in bits
-    // defined in section 5.1
-    k: 128,
-    // option to use a message that has already been processed by
-    // expand_message_xmd
-    expand: 'xmd',
-    // Hash functions for: expand_message_xmd is appropriate for use with a
-    // wide range of hash functions, including SHA-2, SHA-3, BLAKE2, and others.
-    // BBS+ uses blake2: https://github.com/hyperledger/aries-framework-go/issues/2247
-    hash: sha256,
-});
-// Encoding utils
-// Point on G1 curve: (x, y)
-const C_BIT_POS = Fp.BITS; // C_bit, compression bit for serialization flag
-const I_BIT_POS = Fp.BITS + 1; // I_bit, point-at-infinity bit for serialization flag
-const S_BIT_POS = Fp.BITS + 2; // S_bit, sign bit for serialization flag
-// Compressed point of infinity
-const COMPRESSED_ZERO = Fp.toBytes(bitSet(bitSet(_0n, I_BIT_POS, true), S_BIT_POS, true)); // set compressed & point-at-infinity bits
-function signatureG2ToRawBytes(point) {
-    // NOTE: by some reasons it was missed in bls12-381, looks like bug
-    point.assertValidity();
-    const len = Fp.BYTES;
-    if (point.equals(bls12_381.G2.ProjectivePoint.ZERO))
-        return concatBytes(COMPRESSED_ZERO, numberToBytesBE(_0n, len));
-    const { x, y } = point.toAffine();
-    const { re: x0, im: x1 } = Fp2.reim(x);
-    const { re: y0, im: y1 } = Fp2.reim(y);
-    const tmp = y1 > _0n ? y1 * _2n : y0 * _2n;
-    const aflag1 = Boolean((tmp / Fp.ORDER) & _1n);
-    const z1 = bitSet(bitSet(x1, 381, aflag1), S_BIT_POS, true);
-    const z2 = x0;
-    return concatBytes(numberToBytesBE(z1, len), numberToBytesBE(z2, len));
+// Internal hash-to-curve step: G2 expects the RFC `m = 2` pair, and the result
+// is the isogeny image on E before the subgroup clear.
+function mapToG2(scalars) {
+    const { x, y } = getG2_SWU()(Fp2.fromBigTuple(scalars));
+    return isogenyMapG2(x, y);
 }
-// To verify curve parameters, see pairing-friendly-curves spec:
-// https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-pairing-friendly-curves-11
-// Basic math is done over finite fields over p.
-// More complicated math is done over polynominal extension fields.
-// To simplify calculations in Fp12, we construct extension tower:
-// Fp₁₂ = Fp₆² => Fp₂³
-// Fp(u) / (u² - β) where β = -1
-// Fp₂(v) / (v³ - ξ) where ξ = u + 1
-// Fp₆(w) / (w² - γ) where γ = v
-// Here goes constants && point encoding format
-const bls12_381 = bls({
-    // Fields
-    fields: {
-        Fp,
-        Fp2,
-        Fp6,
-        Fp12,
-        Fr: Fr$1,
-    },
-    // G1 is the order-q subgroup of E1(Fp) : y² = x³ + 4, #E1(Fp) = h1q, where
-    // characteristic; z + (z⁴ - z² + 1)(z - 1)²/3
-    G1: {
-        Fp,
-        // cofactor; (z - 1)²/3
-        h: BigInt('0x396c8c005555e1568c00aaab0000aaab'),
-        // generator's coordinates
-        // x = 3685416753713387016781088315183077757961620795782546409894578378688607592378376318836054947676345821548104185464507
-        // y = 1339506544944476473020471379941921221584933875938349620426543736416511423956333506472724655353366534992391756441569
-        Gx: BigInt('0x17f1d3a73197d7942695638c4fa9ac0fc3688c4f9774b905a14e3a3f171bac586c55e83ff97a1aeffb3af00adb22c6bb'),
-        Gy: BigInt('0x08b3f481e3aaa0f1a09e30ed741d8ae4fcf5e095d5d00af600db18cb2c04b3edd03cc744a2888ae40caa232946c5e7e1'),
-        a: Fp.ZERO,
-        b: _4n,
-        htfDefaults: { ...htfDefaults, m: 1 },
-        wrapPrivateKey: true,
-        allowInfinityPoint: true,
-        // Checks is the point resides in prime-order subgroup.
-        // point.isTorsionFree() should return true for valid points
-        // It returns false for shitty points.
-        // https://eprint.iacr.org/2021/1130.pdf
-        isTorsionFree: (c, point) => {
-            // φ endomorphism
-            const cubicRootOfUnityModP = BigInt('0x5f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe');
-            const phi = new c(Fp.mul(point.px, cubicRootOfUnityModP), point.py, point.pz);
-            // todo: unroll
-            const xP = point.multiplyUnsafe(bls12_381.params.x).negate(); // [x]P
-            const u2P = xP.multiplyUnsafe(bls12_381.params.x); // [u2]P
-            return u2P.equals(phi);
-            // https://eprint.iacr.org/2019/814.pdf
-            // (z² − 1)/3
-            // const c1 = BigInt('0x396c8c005555e1560000000055555555');
-            // const P = this;
-            // const S = P.sigma();
-            // const Q = S.double();
-            // const S2 = S.sigma();
-            // // [(z² − 1)/3](2σ(P) − P − σ²(P)) − σ²(P) = O
-            // const left = Q.subtract(P).subtract(S2).multiplyUnsafe(c1);
-            // const C = left.subtract(S2);
-            // return C.isZero();
-        },
-        // Clear cofactor of G1
-        // https://eprint.iacr.org/2019/403
-        clearCofactor: (_c, point) => {
-            // return this.multiplyUnsafe(CURVE.h);
-            return point.multiplyUnsafe(bls12_381.params.x).add(point); // x*P + P
-        },
-        mapToCurve: (scalars) => {
-            const { x, y } = G1_SWU(Fp.create(scalars[0]));
-            return isogenyMapG1(x, y);
-        },
-        fromBytes: (bytes) => {
-            bytes = bytes.slice();
-            if (bytes.length === 48) {
-                // TODO: Fp.bytes
-                const P = Fp.ORDER;
-                const compressedValue = bytesToNumberBE(bytes);
-                const bflag = bitGet(compressedValue, I_BIT_POS);
-                // Zero
-                if (bflag === _1n)
-                    return { x: _0n, y: _0n };
-                const x = Fp.create(compressedValue & Fp.MASK);
-                const right = Fp.add(Fp.pow(x, _3n), Fp.create(bls12_381.params.G1b)); // y² = x³ + b
-                let y = Fp.sqrt(right);
-                if (!y)
-                    throw new Error('Invalid compressed G1 point');
-                const aflag = bitGet(compressedValue, C_BIT_POS);
-                if ((y * _2n) / P !== aflag)
-                    y = Fp.neg(y);
-                return { x: Fp.create(x), y: Fp.create(y) };
-            }
-            else if (bytes.length === 96) {
-                // Check if the infinity flag is set
-                if ((bytes[0] & (1 << 6)) !== 0)
-                    return bls12_381.G1.ProjectivePoint.ZERO.toAffine();
-                const x = bytesToNumberBE(bytes.subarray(0, Fp.BYTES));
-                const y = bytesToNumberBE(bytes.subarray(Fp.BYTES));
-                return { x: Fp.create(x), y: Fp.create(y) };
-            }
-            else {
-                throw new Error('Invalid point G1, expected 48/96 bytes');
-            }
-        },
-        toBytes: (c, point, isCompressed) => {
-            const isZero = point.equals(c.ZERO);
-            const { x, y } = point.toAffine();
-            if (isCompressed) {
-                if (isZero)
-                    return COMPRESSED_ZERO.slice();
-                const P = Fp.ORDER;
-                let num;
-                num = bitSet(x, C_BIT_POS, Boolean((y * _2n) / P)); // set aflag
-                num = bitSet(num, S_BIT_POS, true);
-                return numberToBytesBE(num, Fp.BYTES);
-            }
-            else {
-                if (isZero) {
-                    // 2x PUBLIC_KEY_LENGTH
-                    const x = concatBytes(new Uint8Array([0x40]), new Uint8Array(2 * Fp.BYTES - 1));
-                    return x;
-                }
-                else {
-                    return concatBytes(numberToBytesBE(x, Fp.BYTES), numberToBytesBE(y, Fp.BYTES));
-                }
-            }
-        },
-    },
-    // G2 is the order-q subgroup of E2(Fp²) : y² = x³+4(1+√−1),
-    // where Fp2 is Fp[√−1]/(x2+1). #E2(Fp2 ) = h2q, where
-    // G² - 1
-    // h2q
-    G2: {
-        Fp: Fp2,
-        // cofactor
-        h: BigInt('0x5d543a95414e7f1091d50792876a202cd91de4547085abaa68a205b2e5a7ddfa628f1cb4d9e82ef21537e293a6691ae1616ec6e786f0c70cf1c38e31c7238e5'),
-        Gx: Fp2.fromBigTuple([
-            BigInt('0x024aa2b2f08f0a91260805272dc51051c6e47ad4fa403b02b4510b647ae3d1770bac0326a805bbefd48056c8c121bdb8'),
-            BigInt('0x13e02b6052719f607dacd3a088274f65596bd0d09920b61ab5da61bbdc7f5049334cf11213945d57e5ac7d055d042b7e'),
-        ]),
-        // y =
-        // 927553665492332455747201965776037880757740193453592970025027978793976877002675564980949289727957565575433344219582,
-        // 1985150602287291935568054521177171638300868978215655730859378665066344726373823718423869104263333984641494340347905
-        Gy: Fp2.fromBigTuple([
-            BigInt('0x0ce5d527727d6e118cc9cdc6da2e351aadfd9baa8cbdd3a76d429a695160d12c923ac9cc3baca289e193548608b82801'),
-            BigInt('0x0606c4a02ea734cc32acd2b02bc28b99cb3e287e85a763af267492ab572e99ab3f370d275cec1da1aaa9075ff05f79be'),
-        ]),
-        a: Fp2.ZERO,
-        b: Fp2.fromBigTuple([_4n, _4n]),
-        hEff: BigInt('0xbc69f08f2ee75b3584c6a0ea91b352888e2a8e9145ad7689986ff031508ffe1329c2f178731db956d82bf015d1212b02ec0ec69d7477c1ae954cbc06689f6a359894c0adebbf6b4e8020005aaa95551'),
-        htfDefaults: { ...htfDefaults },
-        wrapPrivateKey: true,
-        allowInfinityPoint: true,
-        mapToCurve: (scalars) => {
-            const { x, y } = G2_SWU(Fp2.fromBigTuple(scalars));
-            return isogenyMapG2(x, y);
-        },
-        // Checks is the point resides in prime-order subgroup.
-        // point.isTorsionFree() should return true for valid points
-        // It returns false for shitty points.
-        // https://eprint.iacr.org/2021/1130.pdf
-        isTorsionFree: (c, P) => {
-            return P.multiplyUnsafe(bls12_381.params.x).negate().equals(G2psi(c, P)); // ψ(P) == [u](P)
-            // Older version: https://eprint.iacr.org/2019/814.pdf
-            // Ψ²(P) => Ψ³(P) => [z]Ψ³(P) where z = -x => [z]Ψ³(P) - Ψ²(P) + P == O
-            // return P.psi2().psi().mulNegX().subtract(psi2).add(P).isZero();
-        },
-        // Maps the point into the prime-order subgroup G2.
-        // clear_cofactor_bls12381_g2 from cfrg-hash-to-curve-11
-        // https://eprint.iacr.org/2017/419.pdf
-        // prettier-ignore
-        clearCofactor: (c, P) => {
-            const x = bls12_381.params.x;
-            let t1 = P.multiplyUnsafe(x).negate(); // [-x]P
-            let t2 = G2psi(c, P); // Ψ(P)
-            let t3 = P.double(); // 2P
-            t3 = G2psi2(c, t3); // Ψ²(2P)
-            t3 = t3.subtract(t2); // Ψ²(2P) - Ψ(P)
-            t2 = t1.add(t2); // [-x]P + Ψ(P)
-            t2 = t2.multiplyUnsafe(x).negate(); // [x²]P - [x]Ψ(P)
-            t3 = t3.add(t2); // Ψ²(2P) - Ψ(P) + [x²]P - [x]Ψ(P)
-            t3 = t3.subtract(t1); // Ψ²(2P) - Ψ(P) + [x²]P - [x]Ψ(P) + [x]P
-            const Q = t3.subtract(P); // Ψ²(2P) - Ψ(P) + [x²]P - [x]Ψ(P) + [x]P - 1P
-            return Q; // [x²-x-1]P + [x-1]Ψ(P) + Ψ²(2P)
-        },
-        fromBytes: (bytes) => {
-            bytes = bytes.slice();
-            const m_byte = bytes[0] & 0xe0;
-            if (m_byte === 0x20 || m_byte === 0x60 || m_byte === 0xe0) {
-                throw new Error('Invalid encoding flag: ' + m_byte);
-            }
-            const bitC = m_byte & 0x80; // compression bit
-            const bitI = m_byte & 0x40; // point at infinity bit
-            const bitS = m_byte & 0x20; // sign bit
-            const L = Fp.BYTES;
-            const slc = (b, from, to) => bytesToNumberBE(b.slice(from, to));
-            if (bytes.length === 96 && bitC) {
-                const b = bls12_381.params.G2b;
-                const P = Fp.ORDER;
-                bytes[0] = bytes[0] & 0x1f; // clear flags
-                if (bitI) {
-                    // check that all bytes are 0
-                    if (bytes.reduce((p, c) => (p !== 0 ? c + 1 : c), 0) > 0) {
-                        throw new Error('Invalid compressed G2 point');
-                    }
-                    return { x: Fp2.ZERO, y: Fp2.ZERO };
-                }
-                const x_1 = slc(bytes, 0, L);
-                const x_0 = slc(bytes, L, 2 * L);
-                const x = Fp2.create({ c0: Fp.create(x_0), c1: Fp.create(x_1) });
-                const right = Fp2.add(Fp2.pow(x, _3n), b); // y² = x³ + 4 * (u+1) = x³ + b
-                let y = Fp2.sqrt(right);
-                const Y_bit = y.c1 === _0n ? (y.c0 * _2n) / P : (y.c1 * _2n) / P ? _1n : _0n;
-                y = bitS > 0 && Y_bit > 0 ? y : Fp2.neg(y);
-                return { x, y };
-            }
-            else if (bytes.length === 192 && !bitC) {
-                // Check if the infinity flag is set
-                if ((bytes[0] & (1 << 6)) !== 0) {
-                    return { x: Fp2.ZERO, y: Fp2.ZERO };
-                }
-                const x1 = slc(bytes, 0, L);
-                const x0 = slc(bytes, L, 2 * L);
-                const y1 = slc(bytes, 2 * L, 3 * L);
-                const y0 = slc(bytes, 3 * L, 4 * L);
-                return { x: Fp2.fromBigTuple([x0, x1]), y: Fp2.fromBigTuple([y0, y1]) };
-            }
-            else {
-                throw new Error('Invalid point G2, expected 96/192 bytes');
-            }
-        },
-        toBytes: (c, point, isCompressed) => {
-            const { BYTES: len, ORDER: P } = Fp;
-            const isZero = point.equals(c.ZERO);
-            const { x, y } = point.toAffine();
-            if (isCompressed) {
-                if (isZero)
-                    return concatBytes(COMPRESSED_ZERO, numberToBytesBE(_0n, len));
-                const flag = Boolean(y.c1 === _0n ? (y.c0 * _2n) / P : (y.c1 * _2n) / P);
-                // set compressed & sign bits (looks like different offsets than for G1/Fp?)
-                let x_1 = bitSet(x.c1, C_BIT_POS, flag);
-                x_1 = bitSet(x_1, S_BIT_POS, true);
-                return concatBytes(numberToBytesBE(x_1, len), numberToBytesBE(x.c0, len));
-            }
-            else {
-                if (isZero)
-                    return concatBytes(new Uint8Array([0x40]), new Uint8Array(4 * len - 1)); // bytes[0] |= 1 << 6;
-                const { re: x0, im: x1 } = Fp2.reim(x);
-                const { re: y0, im: y1 } = Fp2.reim(y);
-                return concatBytes(numberToBytesBE(x1, len), numberToBytesBE(x0, len), numberToBytesBE(y1, len), numberToBytesBE(y0, len));
-            }
-        },
-        Signature: {
-            // TODO: Optimize, it's very slow because of sqrt.
-            fromHex(hex) {
-                hex = ensureBytes('signatureHex', hex);
-                const P = Fp.ORDER;
-                const half = hex.length / 2;
-                if (half !== 48 && half !== 96)
-                    throw new Error('Invalid compressed signature length, must be 96 or 192');
-                const z1 = bytesToNumberBE(hex.slice(0, half));
-                const z2 = bytesToNumberBE(hex.slice(half));
-                // Indicates the infinity point
-                const bflag1 = bitGet(z1, I_BIT_POS);
-                if (bflag1 === _1n)
-                    return bls12_381.G2.ProjectivePoint.ZERO;
-                const x1 = Fp.create(z1 & Fp.MASK);
-                const x2 = Fp.create(z2);
-                const x = Fp2.create({ c0: x2, c1: x1 });
-                const y2 = Fp2.add(Fp2.pow(x, _3n), bls12_381.params.G2b); // y² = x³ + 4
-                // The slow part
-                let y = Fp2.sqrt(y2);
-                if (!y)
-                    throw new Error('Failed to find a square root');
-                // Choose the y whose leftmost bit of the imaginary part is equal to the a_flag1
-                // If y1 happens to be zero, then use the bit of y0
-                const { re: y0, im: y1 } = Fp2.reim(y);
-                const aflag1 = bitGet(z1, 381);
-                const isGreater = y1 > _0n && (y1 * _2n) / P !== aflag1;
-                const isZero = y1 === _0n && (y0 * _2n) / P !== aflag1;
-                if (isGreater || isZero)
-                    y = Fp2.neg(y);
-                const point = bls12_381.G2.ProjectivePoint.fromAffine({ x, y });
-                point.assertValidity();
-                return point;
-            },
-            toRawBytes(point) {
-                return signatureG2ToRawBytes(point);
-            },
-            toHex(point) {
-                return bytesToHex(signatureG2ToRawBytes(point));
-            },
-        },
-    },
-    params: {
-        x: BLS_X,
-        r: Fr$1.ORDER, // order; z⁴ − z² + 1; CURVE.n from other curves
-    },
-    htfDefaults,
-    hash: sha256,
-    randomBytes,
-});
 
 const encoder = new TextEncoder();
 const Fr = bls12_381.fields.Fr;
-const G1 = bls12_381.G1.ProjectivePoint;
-const G2 = bls12_381.G2.ProjectivePoint;
+const G1 = bls12_381.G1.Point;
+const G2 = bls12_381.G2.Point;
+const signatures = bls12_381.longSignatures;
 const assertParticipant = (participant) => {
   if (typeof participant !== "bigint" || participant <= 0n || participant >= Fr.ORDER) {
     throw new TypeError("beacon participant identifiers must be non-zero field elements");
@@ -1596,7 +2851,7 @@ const evaluateCommitments = (commitments, x) => {
   let result = G1.ZERO;
   let power = 1n;
   for (const encoded of commitments) {
-    const commitment = G1.fromHex(encoded);
+    const commitment = G1.fromBytes(encoded);
     commitment.assertValidity();
     result = result.add(commitment.multiply(power));
     power = Fr.mul(power, x);
@@ -1606,7 +2861,7 @@ const evaluateCommitments = (commitments, x) => {
 const sumPoints = (points) => {
   let result = G1.ZERO;
   for (const encoded of points) {
-    const point = G1.fromHex(encoded);
+    const point = G1.fromBytes(encoded);
     point.assertValidity();
     result = result.add(point);
   }
@@ -1631,7 +2886,7 @@ const createBeaconContribution = (participants, threshold, randomScalar) => {
     return scalar;
   });
   return {
-    commitments: coefficients.map((coefficient) => G1.BASE.multiply(coefficient).toRawBytes(true)),
+    commitments: coefficients.map((coefficient) => G1.BASE.multiply(coefficient).toBytes(true)),
     shares: new Map(participants.map((participant) => [participant, evaluatePolynomial(coefficients, participant)]))
   };
 };
@@ -1652,14 +2907,14 @@ const deriveBeaconPublicShare = (participant, dealerCommitments) => {
   assertParticipant(participant);
   if (dealerCommitments.length < 2) throw new Error("at least two dealer commitments are required");
   return sumPoints(
-    dealerCommitments.map((commitments) => evaluateCommitments(commitments, participant).toRawBytes(true))
-  ).toRawBytes(true);
+    dealerCommitments.map((commitments) => evaluateCommitments(commitments, participant).toBytes(true))
+  ).toBytes(true);
 };
 const deriveBeaconGroupPublicKey = (dealerCommitments) => {
   if (dealerCommitments.length < 2 || dealerCommitments.some((commitments) => commitments.length < 2)) {
     throw new Error("invalid beacon dealer commitments");
   }
-  return sumPoints(dealerCommitments.map((commitments) => commitments[0])).toRawBytes(true);
+  return sumPoints(dealerCommitments.map((commitments) => commitments[0])).toBytes(true);
 };
 const beaconMessage = (network, epoch, round, previousProof) => {
   if (!network || epoch < 0n || round < 0n) throw new TypeError("invalid beacon round");
@@ -1669,10 +2924,10 @@ const beaconMessage = (network, epoch, round, previousProof) => {
   message.set(previousProof, prefix.length);
   return message;
 };
-const signBeaconRound = (secretShare, message) => bls12_381.sign(message, Fr.create(secretShare));
+const signBeaconRound = (secretShare, message) => signatures.Signature.toBytes(signatures.sign(signatures.hash(message), Fr.toBytes(Fr.create(secretShare))));
 const verifyBeaconSignatureShare = (signature, message, publicShare) => {
   try {
-    return bls12_381.verify(signature, message, publicShare);
+    return signatures.verify(signature, signatures.hash(message), publicShare);
   } catch {
     return false;
   }
@@ -1686,22 +2941,22 @@ const reconstructBeaconSignature = (rawShares, threshold) => {
   assertUniqueParticipants(participants);
   let signature = G2.ZERO;
   for (const share of selected) {
-    const point = bls12_381.Signature.fromHex(share.signature);
+    const point = signatures.Signature.fromBytes(share.signature);
     point.assertValidity();
     signature = signature.add(point.multiply(lagrangeAtZero(share.participant, participants)));
   }
-  return bls12_381.Signature.toRawBytes(signature);
+  return signatures.Signature.toBytes(signature);
 };
 const verifyBeaconProof = (proof, message, groupPublicKey) => {
   try {
-    return bls12_381.verify(proof, message, groupPublicKey);
+    return signatures.verify(proof, signatures.hash(message), groupPublicKey);
   } catch {
     return false;
   }
 };
 const beaconRandomness = (proof) => {
   if (proof.length !== 96) throw new Error("invalid BLS beacon proof length");
-  return sha256$1(proof);
+  return sha256(proof);
 };
 
 export { beaconMessage, beaconRandomness, combineBeaconShares, createBeaconContribution, deriveBeaconGroupPublicKey, deriveBeaconPublicShare, reconstructBeaconSignature, signBeaconRound, verifyBeaconProof, verifyBeaconShare, verifyBeaconSignatureShare };