@leofcoin/chain 1.10.16 → 1.10.18

package/exports/browser/weierstrass-BVfhtHbl.js

@@ -0,0 +1,3596 @@
+import { c as abytes$1, i as isBytes$1, e as concatBytes$1, f as bytesToHex$1, r as randomBytes$1, b as anumber$1, h as hexToBytes$1, a as ahash, d as clean, g as aexists, j as aoutput } from './sha2-BKcEJzgd.js';
+
+/**
+ * Hex, bytes and number utilities.
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+/**
+ * Validates that a value is an array, optionally validating each element.
+ * @param item - Value to validate.
+ * @param title - Label included in thrown errors.
+ * @param inner - Optional per-element validator, called with the element and its label.
+ * @returns The validated array.
+ * @example
+ * Validate an array of points before batch processing.
+ *
+ * ```ts
+ * aarray([1n, 2n], 'scalars');
+ * ```
+ */
+function aarray(item, title, inner = () => { }) {
+    if (!Array.isArray(item))
+        throw new TypeError(`"${title}" expected array, got type=${typeof item}`);
+    for (let i = 0; i < item.length; i++)
+        inner(item[i], `${title}[${i}]`);
+    return item;
+}
+/**
+ * Validates that a value is a byte array.
+ * @param value - Value to validate.
+ * @param length - Optional exact byte length.
+ * @param title - Optional field name.
+ * @returns Original byte array.
+ * @example
+ * Reject non-byte input before passing data into curve code.
+ *
+ * ```ts
+ * abytes(new Uint8Array(1));
+ * ```
+ */
+const abytes = (value, length, title) => abytes$1(value, length, title);
+/**
+ * Validates that a value is a non-negative safe integer.
+ * @param n - Value to validate.
+ * @param title - Optional field name.
+ * @returns The validated number.
+ * @example
+ * Validate a numeric length before allocating buffers.
+ *
+ * ```ts
+ * anumber(1);
+ * ```
+ */
+const anumber = anumber$1;
+/**
+ * Asserts something is a string.
+ * @param value - Value to validate.
+ * @param title - Label included in thrown errors.
+ * @returns The validated string.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Validate a label string.
+ *
+ * ```ts
+ * astring('example', 'label');
+ * ```
+ */
+function astring(value, title = '') {
+    if (typeof value !== 'string') {
+        const prefix = title && `"${title}" `;
+        throw new TypeError(prefix + 'expected string, got type=' + typeof value);
+    }
+    return value;
+}
+/**
+ * Asserts something is a plain object-ish value, not null or array.
+ * @param value - Value to validate.
+ * @param title - Label included in thrown errors.
+ * @returns The validated object.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Validate an options object before checking fields.
+ *
+ * ```ts
+ * aobject({ flag: true });
+ * ```
+ */
+function aobject(value, title = 'object') {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new TypeError(title === 'object'
+            ? 'expected valid options object'
+            : `"${title}" expected object, got type=${typeof value}`);
+    return value;
+}
+/**
+ * Asserts something is a function.
+ * @param value - Value to validate.
+ * @param title - Label included in thrown errors.
+ * @returns The validated function.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Validate a required method before calling it.
+ *
+ * ```ts
+ * afunction(() => true, 'predicate');
+ * ```
+ */
+function afunction(value, title) {
+    if (typeof value !== 'function')
+        throw new TypeError(`"${title}" is invalid: expected function, got ${typeof value}`);
+    return value;
+}
+/**
+ * Encodes bytes as lowercase hex.
+ * @param bytes - Bytes to encode.
+ * @returns Lowercase hex string.
+ * @example
+ * Serialize bytes as hex for logging or fixtures.
+ *
+ * ```ts
+ * bytesToHex(Uint8Array.of(1, 2, 3));
+ * ```
+ */
+const bytesToHex = bytesToHex$1;
+/**
+ * Concatenates byte arrays.
+ * @param arrays - Byte arrays to join.
+ * @returns Concatenated bytes.
+ * @example
+ * Join domain-separated chunks into one buffer.
+ *
+ * ```ts
+ * concatBytes(Uint8Array.of(1), Uint8Array.of(2));
+ * ```
+ */
+const concatBytes = (...arrays) => concatBytes$1(...arrays);
+/**
+ * Decodes lowercase or uppercase hex into bytes.
+ * @param hex - Hex string to decode.
+ * @returns Decoded bytes.
+ * @example
+ * Parse fixture hex into bytes before hashing.
+ *
+ * ```ts
+ * hexToBytes('0102');
+ * ```
+ */
+const hexToBytes = (hex) => hexToBytes$1(hex);
+/**
+ * Checks whether a value is a Uint8Array.
+ * @param a - Value to inspect.
+ * @returns `true` when `a` is a Uint8Array.
+ * @example
+ * Branch on byte input before decoding it.
+ *
+ * ```ts
+ * isBytes(new Uint8Array(1));
+ * ```
+ */
+const isBytes = isBytes$1;
+/**
+ * Reads random bytes from the platform CSPRNG.
+ * @param bytesLength - Number of random bytes to read.
+ * @returns Fresh random bytes.
+ * @example
+ * Generate a random seed for a keypair.
+ *
+ * ```ts
+ * randomBytes(2);
+ * ```
+ */
+const randomBytes = (bytesLength) => randomBytes$1(bytesLength);
+const _0n$4 = /* @__PURE__ */ BigInt(0);
+const _1n$3 = /* @__PURE__ */ BigInt(1);
+// Shared error-message prefix builder. Only called on throw paths, so assert
+// success paths never pay for the string concatenation.
+const atitle = (title) => (title ? `"${title}" ` : '');
+/**
+ * Validates that a flag is boolean.
+ * @param value - Value to validate.
+ * @param title - Optional field name.
+ * @returns Original value.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Reject non-boolean option flags early.
+ *
+ * ```ts
+ * abool(true);
+ * ```
+ */
+function abool(value, title = '') {
+    if (typeof value !== 'boolean')
+        throw new TypeError(atitle(title) + 'expected boolean, got type=' + typeof value);
+    return value;
+}
+/**
+ * Validates that a value is a non-negative bigint or safe integer.
+ * @param n - Value to validate.
+ * @returns The same validated value.
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Validate one integer-like value before serializing it.
+ *
+ * ```ts
+ * abignumber(1n);
+ * ```
+ */
+function abignumber(n) {
+    if (typeof n === 'bigint') {
+        if (!isPosBig(n))
+            throw new RangeError('positive bigint expected, got ' + n);
+    }
+    else
+        anumber(n);
+    return n;
+}
+/**
+ * Validates that a value is a safe integer.
+ * @param value - Integer to validate.
+ * @param title - Optional field name.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Validate a window size before scalar arithmetic uses it.
+ *
+ * ```ts
+ * asafenumber(1);
+ * ```
+ */
+function asafenumber(value, title = '') {
+    if (typeof value !== 'number') {
+        const prefix = title && `"${title}" `;
+        throw new TypeError(prefix + 'expected number, got type=' + typeof value);
+    }
+    if (!Number.isSafeInteger(value)) {
+        const prefix = title && `"${title}" `;
+        throw new RangeError(prefix + 'expected safe integer, got ' + value);
+    }
+}
+/**
+ * Encodes a bigint into even-length big-endian hex.
+ * The historical "unpadded" name only means "no fixed-width field padding"; odd-length hex still
+ * gets one leading zero nibble so the result always represents whole bytes.
+ * @param num - Number to encode.
+ * @returns Big-endian hex string.
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Encode a scalar into hex without a `0x` prefix.
+ *
+ * ```ts
+ * numberToHexUnpadded(255n);
+ * ```
+ */
+function numberToHexUnpadded(num) {
+    const hex = abignumber(num).toString(16);
+    return hex.length & 1 ? '0' + hex : hex;
+}
+/**
+ * Parses a big-endian hex string into bigint.
+ * Accepts odd-length hex through the native `BigInt('0x' + hex)` parser and currently surfaces the
+ * same native `SyntaxError` for malformed hex instead of wrapping it in a library-specific error.
+ * @param hex - Hex string without `0x`.
+ * @returns Parsed bigint value.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Parse a scalar from fixture hex.
+ *
+ * ```ts
+ * hexToNumber('ff');
+ * ```
+ */
+function hexToNumber(hex) {
+    if (typeof hex !== 'string')
+        throw new TypeError('hex string expected, got ' + typeof hex);
+    return hex === '' ? _0n$4 : BigInt('0x' + hex); // Big Endian
+}
+// BE: Big Endian, LE: Little Endian
+/**
+ * Parses big-endian bytes into bigint.
+ * @param bytes - Bytes in big-endian order.
+ * @returns Parsed bigint value.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Read a scalar encoded in network byte order.
+ *
+ * ```ts
+ * bytesToNumberBE(Uint8Array.of(1, 0));
+ * ```
+ */
+function bytesToNumberBE(bytes) {
+    return hexToNumber(bytesToHex$1(bytes));
+}
+/**
+ * Parses little-endian bytes into bigint.
+ * @param bytes - Bytes in little-endian order.
+ * @returns Parsed bigint value.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Read a scalar encoded in little-endian form.
+ *
+ * ```ts
+ * bytesToNumberLE(Uint8Array.of(1, 0));
+ * ```
+ */
+function bytesToNumberLE(bytes) {
+    return hexToNumber(bytesToHex$1(copyBytes(abytes$1(bytes)).reverse()));
+}
+/**
+ * Encodes a bigint into fixed-length big-endian bytes.
+ * @param n - Number to encode.
+ * @param len - Output length in bytes. Must be greater than zero.
+ * @returns Big-endian byte array.
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @throws If a documented runtime validation or state check fails. {@link Error}
+ * @example
+ * Serialize a scalar into a 32-byte field element.
+ *
+ * ```ts
+ * numberToBytesBE(255n, 2);
+ * ```
+ */
+function numberToBytesBE(n, len) {
+    anumber$1(len);
+    if (len === 0)
+        throw new Error('zero output length is invalid');
+    n = abignumber(n);
+    const expectedLen = len * 2;
+    const hex = n.toString(16);
+    // Detect overflow before hex parsing so oversized values don't leak the shared odd-hex error.
+    if (hex.length > expectedLen)
+        throw new RangeError('number is too large');
+    return hexToBytes$1(hex.padStart(expectedLen, '0'));
+}
+/**
+ * Encodes a bigint into fixed-length little-endian bytes.
+ * @param n - Number to encode.
+ * @param len - Output length in bytes.
+ * @returns Little-endian byte array.
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @throws If a documented runtime validation or state check fails. {@link Error}
+ * @example
+ * Serialize a scalar for little-endian protocols.
+ *
+ * ```ts
+ * numberToBytesLE(255n, 2);
+ * ```
+ */
+function numberToBytesLE(n, len) {
+    return numberToBytesBE(n, len).reverse();
+}
+/**
+ * Copies Uint8Array. We can't use u8a.slice(), because u8a can be Buffer,
+ * and Buffer#slice creates mutable copy. Never use Buffers!
+ * @param bytes - Bytes to copy.
+ * @returns Detached copy.
+ * @example
+ * Make an isolated copy before mutating serialized bytes.
+ *
+ * ```ts
+ * copyBytes(Uint8Array.of(1, 2, 3));
+ * ```
+ */
+function copyBytes(bytes) {
+    // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict
+    // because callers use it at byte-validation boundaries before mutating the detached copy.
+    return Uint8Array.from(abytes(bytes));
+}
+/**
+ * Decodes 7-bit ASCII string to Uint8Array, throws on non-ascii symbols
+ * Should be safe to use for things expected to be ASCII.
+ * Returns exact same result as `TextEncoder` for ASCII or throws.
+ * @param ascii - ASCII input text.
+ * @returns Encoded bytes.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Encode an ASCII domain-separation tag.
+ *
+ * ```ts
+ * asciiToBytes('ABC');
+ * ```
+ */
+function asciiToBytes(ascii) {
+    if (typeof ascii !== 'string')
+        throw new TypeError('ascii string expected, got ' + typeof ascii);
+    return Uint8Array.from(ascii, (c, i) => {
+        const charCode = c.charCodeAt(0);
+        if (c.length !== 1 || charCode > 127) {
+            throw new RangeError(`string contains non-ASCII character "${ascii[i]}" with code ${charCode} at position ${i}`);
+        }
+        return charCode;
+    });
+}
+/**
+ * Checks whether n is non-negative bigint. Historical name.
+ * @param n - candidate value
+ * @returns `true` when the value is bigint and 0 or larger
+ * @example
+ * Check a candidate scalar before range validation.
+ *
+ * ```ts
+ * isPosBig(2n);
+ * ```
+ */
+function isPosBig(n) {
+    return typeof n === 'bigint' && _0n$4 <= n;
+}
+/**
+ * Checks whether a bigint lies inside a half-open range.
+ * @param n - Candidate value.
+ * @param min - Inclusive lower bound.
+ * @param max - Exclusive upper bound.
+ * @returns `true` when the value is inside the range.
+ * @example
+ * Check whether a candidate scalar fits the field order.
+ *
+ * ```ts
+ * inRange(2n, 1n, 3n);
+ * ```
+ */
+function inRange(n, min, max) {
+    return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;
+}
+/**
+ * Asserts `min <= n < max`. NOTE: upper bound is exclusive.
+ * @param title - Value label for error messages.
+ * @param n - Candidate value.
+ * @param min - Inclusive lower bound.
+ * @param max - Exclusive upper bound.
+ * Wrong-type inputs are not separated from out-of-range values here: they still flow through the
+ * shared `RangeError` path because this is only a throwing wrapper around `inRange(...)`.
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Assert that a bigint stays within one half-open range.
+ *
+ * ```ts
+ * aInRange('x', 2n, 1n, 256n);
+ * ```
+ */
+function aInRange(title, n, min, max) {
+    // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?
+    // consider P=256n, min=0n, max=P
+    // - a for min=0 would require -1:          `inRange('x', x, -1n, P)`
+    // - b would commonly require subtraction:  `inRange('x', x, 0n, P - 1n)`
+    // - our way is the cleanest:               `inRange('x', x, 0n, P)
+    if (!inRange(n, min, max))
+        throw new RangeError('expected valid ' + title + ': ' + min + ' <= n < ' + max + ', got ' + n);
+}
+// Bit operations
+/**
+ * Calculates amount of bits in a bigint.
+ * Same as `n.toString(2).length`
+ * TODO: merge with nLength in modular
+ * @param n - Value to inspect.
+ * @returns Bit length.
+ * @throws If the value is negative. {@link Error}
+ * @example
+ * Measure the bit length of a scalar before serialization.
+ *
+ * ```ts
+ * bitLen(8n);
+ * ```
+ */
+function bitLen(n) {
+    // Size callers in this repo only use non-negative orders / scalars, so negative inputs are a
+    // contract bug and must not silently collapse to zero bits.
+    if (n < _0n$4)
+        throw new Error('expected non-negative bigint, got ' + n);
+    // Native radix conversion beats a shift loop at every size, and the loop is quadratic in bits.
+    return n === _0n$4 ? 0 : n.toString(2).length;
+}
+/**
+ * Gets single bit at position.
+ * NOTE: first bit position is 0 (same as arrays)
+ * Same as `!!+Array.from(n.toString(2)).reverse()[pos]`
+ * @param n - Source value.
+ * @param pos - Bit position. Negative positions are passed through to raw
+ *   bigint shift semantics; because the mask is built as `1n << pos`,
+ *   they currently collapse to `0n` and make the helper a no-op.
+ * @returns Bit as bigint.
+ * @example
+ * Gets single bit at position.
+ *
+ * ```ts
+ * bitGet(5n, 0);
+ * ```
+ */
+function bitGet(n, pos) {
+    if (typeof n !== 'bigint')
+        throw new TypeError('"n" expected bigint, got type=' + typeof n);
+    asafenumber(pos, 'pos');
+    return (n >> BigInt(pos)) & _1n$3;
+}
+/**
+ * Calculate mask for N bits. Not using ** operator with bigints because of old engines.
+ * Same as BigInt(`0b${Array(i).fill('1').join('')}`)
+ * @param n - Number of bits. Negative widths are currently passed through to raw bigint shift
+ *   semantics and therefore produce `-1n`.
+ * @returns Bitmask value.
+ * @example
+ * Calculate mask for N bits.
+ *
+ * ```ts
+ * bitMask(4);
+ * ```
+ */
+const bitMask = (n) => {
+    asafenumber(n, 'n');
+    return (_1n$3 << BigInt(n)) - _1n$3;
+};
+/**
+ * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.
+ * @param hashLen - Hash output size in bytes. Callers are expected to pass a positive length; `0`
+ *   is not rejected here and would make the internal generate loop non-progressing.
+ * @param qByteLen - Requested output size in bytes. Callers are expected to pass a positive length.
+ * @param hmacFn - HMAC implementation.
+ * @returns Function that will call DRBG until the predicate returns anything
+ *   other than `undefined`.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Build a deterministic nonce generator for RFC6979-style signing.
+ *
+ * ```ts
+ * import { createHmacDrbg } from '@noble/curves/utils.js';
+ * import { hmac } from '@noble/hashes/hmac.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const hmacFn = (key: Uint8Array, msg: Uint8Array) => hmac(sha256, key, msg);
+ * const drbg = createHmacDrbg(32, 32, hmacFn);
+ * const seed = new Uint8Array(32);
+ * drbg(seed, (bytes) => bytes);
+ * ```
+ */
+function createHmacDrbg(hashLen, qByteLen, hmacFn) {
+    anumber$1(hashLen, 'hashLen');
+    anumber$1(qByteLen, 'qByteLen');
+    if (typeof hmacFn !== 'function')
+        throw new TypeError('hmacFn must be a function');
+    // creates Uint8Array
+    const u8n = (len) => new Uint8Array(len);
+    const NULL = Uint8Array.of();
+    const byte0 = Uint8Array.of(0x00);
+    const byte1 = Uint8Array.of(0x01);
+    const _maxDrbgIters = 1000;
+    // Step B, Step C: set hashLen to 8*ceil(hlen/8).
+    // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 signatures.
+    let v = u8n(hashLen);
+    // Steps B and C of RFC6979 3.2.
+    let k = u8n(hashLen);
+    let i = 0; // Iterations counter, will throw when over 1000
+    const reset = () => {
+        v.fill(1);
+        k.fill(0);
+        i = 0;
+    };
+    // hmac(k)(v, ...values)
+    const h = (...msgs) => hmacFn(k, concatBytes(v, ...msgs));
+    const reseed = (seed = NULL) => {
+        // HMAC-DRBG reseed() function. Steps D-G
+        k = h(byte0, seed); // k = hmac(k || v || 0x00 || seed)
+        v = h(); // v = hmac(k || v)
+        if (seed.length === 0)
+            return;
+        k = h(byte1, seed); // k = hmac(k || v || 0x01 || seed)
+        v = h(); // v = hmac(k || v)
+    };
+    const gen = () => {
+        // HMAC-DRBG generate() function
+        if (i++ >= _maxDrbgIters)
+            throw new Error('drbg: tried max amount of iterations');
+        let len = 0;
+        const out = [];
+        while (len < qByteLen) {
+            v = h();
+            const sl = v.slice();
+            out.push(sl);
+            len += v.length;
+        }
+        return concatBytes(...out);
+    };
+    const genUntil = (seed, pred) => {
+        reset();
+        reseed(seed); // Steps D-G
+        let res = undefined; // Step H: grind until the predicate accepts a candidate.
+        // Falsy values like 0 are valid outputs.
+        while ((res = pred(gen())) === undefined)
+            reseed();
+        reset();
+        return res;
+    };
+    return genUntil;
+}
+/**
+ * Validates declared required and optional field types on a plain object.
+ * Extra keys are intentionally ignored because many callers validate only the subset they use from
+ * richer option bags or runtime objects.
+ * This walks field schemas and formats detailed errors, so avoid it on hot paths; use direct
+ * one-line guards such as `aobject()`, `afunction()`, `abool()`, or `asafenumber()` instead.
+ * @param object - Object to validate.
+ * @param fields - Required field types.
+ * @param optFields - Optional field types.
+ * @param title - Object label included in thrown errors.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Check user options before building a curve helper.
+ *
+ * ```ts
+ * validateObject({ flag: true }, { flag: 'boolean' });
+ * ```
+ */
+function validateObject(object, fields = {}, optFields = {}, title = 'object') {
+    aobject(object, title);
+    aobject(fields, 'fields');
+    aobject(optFields, 'optFields');
+    function checkField(fieldName, expectedType, isOpt) {
+        const label = title === 'object' ? `param "${String(fieldName)}"` : `"${title}.${String(fieldName)}"`;
+        // Config fields must be explicit own properties. Optional inherited values are rejected too
+        // because callers keep reading the same options object after validation.
+        const val = object[fieldName];
+        // Runtime objects such as Field instances intentionally satisfy required method slots
+        // via their shared prototype.
+        if (!Object.hasOwn(object, fieldName) &&
+            (isOpt ? val !== undefined : expectedType !== 'function')) {
+            throw new TypeError(`${label} is invalid: expected own property`);
+        }
+        if (isOpt && val === undefined)
+            return;
+        const current = typeof val;
+        if (current !== expectedType || val === null)
+            throw new TypeError(`${label} is invalid: expected ${expectedType}, got ${current}`);
+    }
+    const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));
+    iter(fields, false);
+    iter(optFields, true);
+}
+/**
+ * Throws not implemented error.
+ * @returns Never returns.
+ * @throws If the unfinished code path is reached. {@link Error}
+ * @example
+ * Surface the placeholder error from an unfinished code path.
+ *
+ * ```ts
+ * try {
+ *   notImplemented();
+ * } catch {}
+ * ```
+ */
+const notImplemented = () => {
+    throw new Error('not implemented');
+};
+
+/**
+ * Utils for modular division and fields.
+ * Field over 11 is a finite (Galois) field is integer number operations `mod 11`.
+ * There is no division: it is replaced by modular multiplicative inverse.
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+// Numbers aren't used in x25519 / x448 builds
+// prettier-ignore
+const _0n$3 = /* @__PURE__ */ BigInt(0), _1n$2 = /* @__PURE__ */ BigInt(1), _2n$1 = /* @__PURE__ */ BigInt(2);
+// prettier-ignore
+const _3n$1 = /* @__PURE__ */ BigInt(3), _4n$2 = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5);
+// prettier-ignore
+const _7n = /* @__PURE__ */ BigInt(7), _8n = /* @__PURE__ */ BigInt(8), _9n = /* @__PURE__ */ BigInt(9);
+const _15n = /* @__PURE__ */ BigInt(15), _16n = /* @__PURE__ */ BigInt(16);
+// 2^64: exponents below this use plain square-and-multiply in pow()/FpPow(); the windowed path's
+// table build (14 multiplications) only pays off for longer exponents (break-even ~50 bits).
+const POW_WINDOWED_MIN = /* @__PURE__ */ BigInt('0x10000000000000000');
+/**
+ * @param a - Dividend value.
+ * @param b - Positive modulus.
+ * @returns Reduced value in `[0, b)` only when `b` is positive.
+ * @throws If the modulus is not positive. {@link Error}
+ * @example
+ * Normalize a bigint into one field residue.
+ *
+ * ```ts
+ * mod(-1n, 5n);
+ * ```
+ */
+function mod(a, b) {
+    if (b <= _0n$3)
+        throw new Error('mod: expected positive modulus, got ' + b);
+    const result = a % b;
+    return result >= _0n$3 ? result : b + result;
+}
+/**
+ * Efficiently raise num to a power with modular reduction.
+ * Unsafe in some contexts: uses ladder, so can expose bigint bits.
+ * Low-level helper: callers that need canonical residues must pass a valid `num` for the chosen
+ * modulus instead of relying on the `power===0/1` fast paths to normalize it.
+ * @param num - Base value.
+ * @param power - Exponent value.
+ * @param modulo - Reduction modulus.
+ * @returns Modular exponentiation result.
+ * @throws If the modulus or exponent is invalid. {@link Error}
+ * @example
+ * Raise one bigint to a modular power.
+ *
+ * ```ts
+ * pow(2n, 6n, 11n) // 64n % 11n == 9n
+ * ```
+ */
+function pow(num, power, modulo) {
+    if (modulo <= _1n$2)
+        throw new Error('pow: expected modulus > 1, got ' + modulo);
+    // Non-bigint exponents coerce every comparison below to false and would silently return 1.
+    if (typeof power !== 'bigint')
+        throw new TypeError('invalid exponent: expected bigint, got ' + typeof power);
+    if (power < _0n$3)
+        throw new Error('invalid exponent, negatives unsupported');
+    if (power === _0n$3)
+        return _1n$2;
+    if (power === _1n$2)
+        return num;
+    let d = num % modulo;
+    if (d < _0n$3)
+        d += modulo;
+    // Control flow in both branches below depends only on the exponent, never on `num` — invertCt()
+    // relies on that for its (public-exponent) secret-independence guarantee.
+    if (power < POW_WINDOWED_MIN) {
+        // Square-and-multiply: cheaper than the windowed path for short exponents.
+        let p = _1n$2;
+        while (power > _0n$3) {
+            if (power & _1n$2)
+                p = (p * d) % modulo;
+            d = (d * d) % modulo;
+            power >>= _1n$2;
+        }
+        return p;
+    }
+    // Fixed 4-bit windows, MSB-first: a 14-multiplication table drops per-window cost to <1
+    // multiplication (vs ~2 per window for square-and-multiply), ~25-30% faster for the dense
+    // 256-bit exponents of sqrt / Legendre / invertCt.
+    const digits = [];
+    while (power > _0n$3) {
+        digits.push(Number(power & _15n));
+        power >>= _4n$2;
+    }
+    const table = new Array(16);
+    table[0] = _1n$2;
+    table[1] = d;
+    for (let i = 2; i < 16; i++)
+        table[i] = (table[i - 1] * d) % modulo;
+    let p = table[digits[digits.length - 1]]; // top digit is nonzero: the loop above stops on 0
+    for (let w = digits.length - 2; w >= 0; w--) {
+        p = (p * p) % modulo;
+        p = (p * p) % modulo;
+        p = (p * p) % modulo;
+        p = (p * p) % modulo;
+        const digit = digits[w];
+        if (digit !== 0)
+            p = (p * table[digit]) % modulo;
+    }
+    return p;
+}
+/**
+ * Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)`.
+ * Low-level helper: callers that need canonical residues must pass a valid `x` for the chosen
+ * modulus; the `power===0` fast path intentionally returns the input unchanged.
+ * @param x - Base value.
+ * @param power - Number of squarings.
+ * @param modulo - Reduction modulus.
+ * @returns Repeated-squaring result.
+ * @throws If the exponent is negative. {@link Error}
+ * @example
+ * Apply repeated squaring inside one field.
+ *
+ * ```ts
+ * pow2(3n, 2n, 11n);
+ * ```
+ */
+function pow2(x, power, modulo) {
+    if (modulo <= _1n$2)
+        throw new Error('pow2: expected modulus > 1, got ' + modulo);
+    if (power < _0n$3)
+        throw new Error('pow2: expected non-negative exponent, got ' + power);
+    let res = x;
+    while (power-- > _0n$3) {
+        res *= res;
+        res %= modulo;
+    }
+    return res;
+}
+/**
+ * Inverses number over modulo.
+ * Implemented using the {@link https://brilliant.org/wiki/extended-euclidean-algorithm/ | extended Euclidean algorithm}.
+ * @param number - Value to invert.
+ * @param modulo - Modulus greater than 1.
+ * @returns Multiplicative inverse.
+ * @throws If the modulus is invalid or the inverse does not exist. {@link Error}
+ * @example
+ * Compute one modular inverse with the extended Euclidean algorithm.
+ *
+ * ```ts
+ * invert(3n, 11n);
+ * ```
+ */
+function invert(number, modulo) {
+    if (number === _0n$3)
+        throw new Error('invert: expected non-zero number');
+    // modulo = 1 is the zero ring: gcd(x, 1) = 1 makes the loop below "succeed" and return the
+    // useless inverse 0. Reject it like pow() and invertCt() do.
+    if (modulo <= _1n$2)
+        throw new Error('invert: expected modulus > 1, got ' + modulo);
+    // This is variable-time: the loop count depends on `number`. For a secret-independent
+    // (Fermat) alternative over a prime modulus, see {@link invertCt} (~4x slower).
+    let a = mod(number, modulo);
+    let b = modulo;
+    // Only the Bézout coefficient of `number` (x/u chain) is tracked; the coefficient of `modulo`
+    // never affects the output, so it is not computed.
+    // prettier-ignore
+    let x = _0n$3, u = _1n$2;
+    while (a !== _0n$3) {
+        const q = b / a;
+        const r = b - a * q;
+        const m = x - u * q;
+        // prettier-ignore
+        b = a, a = r, x = u, u = m;
+    }
+    const gcd = b;
+    if (gcd !== _1n$2)
+        throw new Error('invert: does not exist');
+    return mod(x, modulo);
+}
+/**
+ * Inverses number over modulo using Fermat's little theorem: `a^(p-2) ≡ a⁻¹ (mod p)`.
+ *
+ * Unlike {@link invert} (extended Euclidean), the exponent `p-2` is a public constant, so the
+ * underlying square-and-multiply has the same control flow for every secret `a`: there is no
+ * data-dependent branching or loop count that could leak `a` through timing (e.g. Minerva-style
+ * ECDSA nonce-inversion attacks). This is only "algorithmically" constant-time — JS bigint
+ * multiplication/reduction is still value-dependent — and it is roughly 4x slower than
+ * {@link invert}.
+ *
+ * REQUIRES a prime modulus; Fermat's theorem does not hold otherwise. The result is verified to be
+ * a real inverse, so a non-prime modulus (or a non-invertible input) fails closed with an error
+ * instead of returning a wrong value.
+ * @param a - Value to invert.
+ * @param prime - Prime modulus.
+ * @returns Multiplicative inverse in `[1, prime)`.
+ * @throws If the modulus is below 2, the input reduces to zero, or the inverse does not exist.
+ *   {@link Error}
+ * @example
+ * Compute one modular inverse without secret-dependent branching.
+ *
+ * ```ts
+ * invertCt(3n, 11n); // 4n, since 3 * 4 = 12 ≡ 1 (mod 11)
+ * ```
+ */
+function invertCt(a, prime) {
+    if (prime <= _1n$2)
+        throw new Error('invertCt: expected prime modulus > 1, got ' + prime);
+    const an = mod(a, prime);
+    if (an === _0n$3)
+        throw new Error('invertCt: expected non-zero number');
+    // Exponent (prime - 2) is public, so FpPow's square-and-multiply is secret-independent.
+    const inverse = pow(an, prime - _2n$1, prime);
+    // O(1) safety net: verifies the inverse and rejects composite moduli where a^(p-2) is not one.
+    if (mod(an * inverse, prime) !== _1n$2)
+        throw new Error('invertCt: does not exist');
+    return inverse;
+}
+function assertIsSquare(Fp, root, n) {
+    const F = Fp;
+    if (!F.eql(F.sqr(root), n))
+        throw new Error('Cannot find square root');
+}
+// The Legendre symbol and every sqrt variant here are only defined over an odd (prime) modulus.
+// An even ORDER makes their integer divisions — (p-1)/2, (p+1)/4, (p-5)/8, (p+7)/16 — truncate and
+// silently return a wrong result, so reject it explicitly at the entry points instead. This is a
+// cheap necessary-condition check, not a primality test (composite odd moduli are caught later by
+// the Legendre-result / assertIsSquare checks).
+function aoddModulus(order, fnName) {
+    if ((order & _1n$2) === _0n$3)
+        throw new Error(fnName + ': expected odd modulus, got ' + order);
+}
+// Not all roots are possible! Example which will throw:
+// const NUM =
+// n = 72057594037927816n;
+// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));
+function sqrt3mod4(Fp, n) {
+    const F = Fp;
+    const p1div4 = (F.ORDER + _1n$2) / _4n$2;
+    const root = F.pow(n, p1div4);
+    assertIsSquare(F, root, n);
+    return root;
+}
+// Equivalent `q = 5 (mod 8)` square-root formula (Atkin-style), not the RFC Appendix I.2 CMOV
+// pseudocode verbatim.
+function sqrt5mod8(Fp, n) {
+    const F = Fp;
+    const p5div8 = (F.ORDER - _5n) / _8n;
+    const n2 = F.mul(n, _2n$1);
+    const v = F.pow(n2, p5div8);
+    const nv = F.mul(n, v);
+    const i = F.mul(F.mul(nv, _2n$1), v);
+    const root = F.mul(nv, F.sub(i, F.ONE));
+    assertIsSquare(F, root, n);
+    return root;
+}
+// Based on RFC9380, Kong algorithm
+// prettier-ignore
+function sqrt9mod16(P) {
+    const Fp_ = Field(P);
+    const tn = tonelliShanks(P);
+    const c1 = tn(Fp_, Fp_.neg(Fp_.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F
+    const c2 = tn(Fp_, c1); //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F
+    const c3 = tn(Fp_, Fp_.neg(c1)); //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F
+    const c4 = (P + _7n) / _16n; //  4. c4 = (q + 7) / 16        # Integer arithmetic
+    return ((Fp, n) => {
+        const F = Fp;
+        let tv1 = F.pow(n, c4); //  1. tv1 = x^c4
+        let tv2 = F.mul(tv1, c1); //  2. tv2 = c1 * tv1
+        const tv3 = F.mul(tv1, c2); //  3. tv3 = c2 * tv1
+        const tv4 = F.mul(tv1, c3); //  4. tv4 = c3 * tv1
+        const e1 = F.eql(F.sqr(tv2), n); //  5.  e1 = (tv2^2) == x
+        const e2 = F.eql(F.sqr(tv3), n); //  6.  e2 = (tv3^2) == x
+        tv1 = F.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x
+        tv2 = F.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x
+        const e3 = F.eql(F.sqr(tv2), n); //  9.  e3 = (tv2^2) == x
+        const root = F.cmov(tv1, tv2, e3); // 10.  z = CMOV(tv1, tv2, e3)   # Select sqrt from tv1 & tv2
+        assertIsSquare(F, root, n);
+        return root;
+    });
+}
+/**
+ * Tonelli-Shanks square root search algorithm.
+ * This implementation is variable-time: it searches data-dependently for the first non-residue `Z`
+ * and for the smallest `i` in the main loop, unlike RFC 9380 Appendix I.4's constant-time shape.
+ * 1. {@link https://eprint.iacr.org/2012/685.pdf | eprint 2012/685}, page 12
+ * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks
+ * @param P - field order
+ * @returns function that takes field Fp (created from P) and number n
+ * @throws If the field is too small, non-prime, or the square root does not exist. {@link Error}
+ * @example
+ * Construct a square-root helper for primes that need Tonelli-Shanks.
+ *
+ * ```ts
+ * import { Field, tonelliShanks } from '@noble/curves/abstract/modular.js';
+ * const Fp = Field(17n);
+ * const sqrt = tonelliShanks(17n)(Fp, 4n);
+ * ```
+ */
+function tonelliShanks(P) {
+    // Initialization (precomputation).
+    // Caching initialization could boost perf by 7%.
+    if (P < _3n$1)
+        throw new Error('sqrt is not defined for small field');
+    aoddModulus(P, 'tonelliShanks');
+    // Factor P - 1 = Q * 2^S, where Q is odd
+    let Q = P - _1n$2;
+    let S = 0;
+    while (Q % _2n$1 === _0n$3) {
+        Q /= _2n$1;
+        S++;
+    }
+    // Find the first quadratic non-residue Z >= 2
+    let Z = _2n$1;
+    const _Fp = Field(P);
+    while (FpLegendre(_Fp, Z) === 1) {
+        // Basic primality test for P. After x iterations, chance of
+        // not finding quadratic non-residue is 2^x, so 2^1000.
+        if (Z++ > 1000)
+            throw new Error('Cannot find square root: probably non-prime P');
+    }
+    // Fast-path; usually done before Z, but we do "primality test".
+    if (S === 1)
+        return sqrt3mod4;
+    // Slow-path
+    // TODO: test on Fp2 and others
+    let cc = _Fp.pow(Z, Q); // c = z^Q
+    const Q1div2 = (Q + _1n$2) / _2n$1;
+    return function tonelliSlow(Fp, n) {
+        const F = Fp;
+        if (F.is0(n))
+            return n;
+        // Check if n is a quadratic residue using Legendre symbol
+        if (FpLegendre(F, n) !== 1)
+            throw new Error('Cannot find square root');
+        // Initialize variables for the main loop
+        let M = S;
+        let c = F.mul(F.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp
+        let t = F.pow(n, Q); // t = n^Q, first guess at the fudge factor
+        let R = F.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root
+        // Main loop
+        // while t != 1
+        while (!F.eql(t, F.ONE)) {
+            // Unreachable over a genuine field (no zero divisors; n=0 already returned above). A zero t
+            // means composite ORDER, where a fabricated root would be wrong: fail closed instead.
+            if (F.is0(t))
+                throw new Error('Cannot find square root: probably non-prime P');
+            let i = 1;
+            // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)
+            let t_tmp = F.sqr(t); // t^(2^1)
+            while (!F.eql(t_tmp, F.ONE)) {
+                i++;
+                t_tmp = F.sqr(t_tmp); // t^(2^2)...
+                if (i === M)
+                    throw new Error('Cannot find square root');
+            }
+            // Calculate the exponent for b: 2^(M - i - 1)
+            const exponent = _1n$2 << BigInt(M - i - 1); // bigint is important
+            const b = F.pow(c, exponent); // b = 2^(M - i - 1)
+            // Update variables
+            M = i;
+            c = F.sqr(b); // c = b^2
+            t = F.mul(t, c); // t = (t * b^2)
+            R = F.mul(R, b); // R = R*b
+        }
+        return R;
+    };
+}
+/**
+ * Square root for a finite field. Will try optimized versions first:
+ *
+ * 1. P ≡ 3 (mod 4)
+ * 2. P ≡ 5 (mod 8)
+ * 3. P ≡ 9 (mod 16)
+ * 4. Tonelli-Shanks algorithm
+ *
+ * Different algorithms can give different roots, it is up to user to decide which one they want.
+ * For example there is FpSqrtOdd/FpSqrtEven to choose a root by oddness
+ * (used for hash-to-curve).
+ * @param P - Field order.
+ * @returns Square-root helper. The generic fallback inherits Tonelli-Shanks' variable-time
+ *   behavior and this selector assumes prime-field-style integer moduli.
+ * @throws If the field is unsupported or the square root does not exist. {@link Error}
+ * @example
+ * Choose the square-root helper appropriate for one field modulus.
+ *
+ * ```ts
+ * import { Field, FpSqrt } from '@noble/curves/abstract/modular.js';
+ * const Fp = Field(17n);
+ * const sqrt = FpSqrt(17n)(Fp, 4n);
+ * ```
+ */
+function FpSqrt(P) {
+    aoddModulus(P, 'Fp.sqrt');
+    // P ≡ 3 (mod 4) => √n = n^((P+1)/4)
+    if (P % _4n$2 === _3n$1)
+        return sqrt3mod4;
+    // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf
+    if (P % _8n === _5n)
+        return sqrt5mod8;
+    // P ≡ 9 (mod 16) => Kong algorithm, page 11 of https://eprint.iacr.org/2012/685.pdf (algorithm 4)
+    if (P % _16n === _9n)
+        return sqrt9mod16(P);
+    // Tonelli-Shanks algorithm
+    return tonelliShanks(P);
+}
+// prettier-ignore
+// Arithmetic-only subset checked by validateField(). This is intentionally not the full runtime
+// IField contract: helpers like `isValidNot0`, `invertBatch`, `toBytes`, `fromBytes`, `cmov`, and
+// field-specific extras like `isOdd` are left to the callers that actually need them.
+const FIELD_FIELDS = [
+    'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',
+    'eql', 'add', 'sub', 'mul', 'pow', 'div',
+    'addN', 'subN', 'mulN', 'sqrN'
+];
+/**
+ * @param field - Field implementation.
+ * @returns Validated field. This only checks the arithmetic subset needed by generic helpers; it
+ *   does not guarantee full runtime-method coverage for serialization, batching, `cmov`, or
+ *   field-specific extras beyond positive `BYTES` / `BITS`.
+ * @throws If the field shape or numeric metadata are invalid. {@link Error}
+ * @example
+ * Check that a field implementation exposes the operations curve code expects.
+ *
+ * ```ts
+ * import { Field, validateField } from '@noble/curves/abstract/modular.js';
+ * const Fp = validateField(Field(17n));
+ * ```
+ */
+function validateField(field) {
+    aobject(field, 'field');
+    if (typeof field.ORDER !== 'bigint')
+        throw new TypeError('param "ORDER" is invalid: expected bigint, got ' + typeof field.ORDER);
+    // Runtime field implementations must expose real integer byte/bit sizes; fractional / NaN /
+    // infinite metadata breaks encoders and caches.
+    asafenumber(field.BYTES, 'BYTES');
+    asafenumber(field.BITS, 'BITS');
+    for (const name of FIELD_FIELDS)
+        afunction(field[name], 'field.' + name);
+    // Runtime field implementations must expose positive byte/bit sizes; zero leaks through the
+    // numeric shape checks above but still breaks encoding helpers and cached-length assumptions.
+    if (field.BYTES < 1 || field.BITS < 1)
+        throw new Error('invalid field: expected BYTES/BITS > 0');
+    if (field.ORDER <= _1n$2)
+        throw new Error('invalid field: expected ORDER > 1, got ' + field.ORDER);
+    return field;
+}
+// Generic field functions
+/**
+ * Same as `pow` but for Fp: non-constant-time.
+ * Unsafe in some contexts: uses ladder, so can expose bigint bits.
+ * @param Fp - Field implementation.
+ * @param num - Base value.
+ * @param power - Exponent value.
+ * @returns Powered field element.
+ * @throws If the exponent is negative. {@link Error}
+ * @example
+ * Raise one field element to a public exponent.
+ *
+ * ```ts
+ * import { Field, FpPow } from '@noble/curves/abstract/modular.js';
+ * const Fp = Field(17n);
+ * const x = FpPow(Fp, 3n, 5n);
+ * ```
+ */
+function FpPow(Fp, num, power) {
+    validateField(Fp);
+    const F = Fp;
+    // Non-bigint exponents (e.g. an accidental field element) coerce every comparison below to
+    // false and would silently return ONE.
+    if (typeof power !== 'bigint')
+        throw new TypeError('invalid exponent: expected bigint, got ' + typeof power);
+    if (power < _0n$3)
+        throw new Error('invalid exponent, negatives unsupported');
+    if (power === _0n$3)
+        return F.ONE;
+    if (power === _1n$2)
+        return num;
+    if (power < POW_WINDOWED_MIN) {
+        // Square-and-multiply: cheaper than the windowed path for short exponents (e.g. poseidon
+        // sbox x^5), which would waste the 14-multiplication table build.
+        let p = F.ONE;
+        let d = num;
+        while (power > _0n$3) {
+            if (power & _1n$2)
+                p = F.mul(p, d);
+            d = F.sqr(d);
+            power >>= _1n$2;
+        }
+        return p;
+    }
+    // Fixed 4-bit windows, MSB-first — same shape as pow() above, over generic field ops.
+    // Speeds up dense long exponents (extension-field sqrt / Legendre, e.g. Fp2 decompression).
+    const digits = [];
+    while (power > _0n$3) {
+        digits.push(Number(power & _15n));
+        power >>= _4n$2;
+    }
+    const table = new Array(16);
+    table[0] = F.ONE;
+    table[1] = num;
+    for (let i = 2; i < 16; i++)
+        table[i] = F.mul(table[i - 1], num);
+    let p = table[digits[digits.length - 1]]; // top digit is nonzero: the loop above stops on 0
+    for (let w = digits.length - 2; w >= 0; w--) {
+        p = F.sqr(F.sqr(F.sqr(F.sqr(p))));
+        const digit = digits[w];
+        if (digit !== 0)
+            p = F.mul(p, table[digit]);
+    }
+    return p;
+}
+function FpInvertBatch(Fp, nums, passZero = false) {
+    validateField(Fp);
+    aarray(nums, 'nums');
+    abool(passZero, 'passZero');
+    const F = Fp;
+    const inverted = new Array(nums.length).fill(passZero ? F.ZERO : undefined);
+    // Walk from first to last, multiply them by each other MOD p
+    const multipliedAcc = nums.reduce((acc, num, i) => {
+        if (F.is0(num))
+            return acc;
+        inverted[i] = acc;
+        return F.mul(acc, num);
+    }, F.ONE);
+    // Invert last element
+    const invertedAcc = F.inv(multipliedAcc);
+    // Walk from last to first, multiply them by inverted each other MOD p
+    nums.reduceRight((acc, num, i) => {
+        if (F.is0(num))
+            return acc;
+        // Non-zero `num` means the forward pass already stored a defined prefix product at index i.
+        inverted[i] = F.mul(acc, inverted[i]);
+        return F.mul(acc, num);
+    }, invertedAcc);
+    return inverted;
+}
+/**
+ * Legendre symbol.
+ * Legendre constant is used to calculate Legendre symbol (a | p)
+ * which denotes the value of a^((p-1)/2) (mod p).
+ *
+ * * (a | p) ≡ 1    if a is a square (mod p), quadratic residue
+ * * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue
+ * * (a | p) ≡ 0    if a ≡ 0 (mod p)
+ * @param Fp - Field implementation.
+ * @param n - Value to inspect.
+ * @returns Legendre symbol.
+ * @throws If the powered value does not match a valid Legendre symbol. {@link Error}
+ * @example
+ * Compute the Legendre symbol of one field element.
+ *
+ * ```ts
+ * import { Field, FpLegendre } from '@noble/curves/abstract/modular.js';
+ * const Fp = Field(17n);
+ * const symbol = FpLegendre(Fp, 4n);
+ * ```
+ */
+function FpLegendre(Fp, n) {
+    validateField(Fp);
+    const F = Fp;
+    aoddModulus(F.ORDER, 'FpLegendre');
+    // We can use 3rd argument as optional cache of this value
+    // but seems unneeded for now. The operation is very fast.
+    const p1mod2 = (F.ORDER - _1n$2) / _2n$1;
+    const powered = F.pow(n, p1mod2);
+    const yes = F.eql(powered, F.ONE);
+    const zero = F.eql(powered, F.ZERO);
+    const no = F.eql(powered, F.neg(F.ONE));
+    if (!yes && !zero && !no)
+        throw new Error('invalid Legendre symbol result');
+    return yes ? 1 : zero ? 0 : -1;
+}
+/**
+ * @param Fp - Field implementation.
+ * @param n - Value to inspect.
+ * @returns `true` when `Fp.sqrt(n)` exists. This includes `0`, even though strict "quadratic
+ *   residue" terminology often reserves that name for the non-zero square class.
+ * @throws If the field returns an invalid Legendre symbol value. {@link Error}
+ * @example
+ * Check whether one field element has a square root in the field.
+ *
+ * ```ts
+ * import { Field, FpIsSquare } from '@noble/curves/abstract/modular.js';
+ * const Fp = Field(17n);
+ * const isSquare = FpIsSquare(Fp, 4n);
+ * ```
+ */
+function FpIsSquare(Fp, n) {
+    const l = FpLegendre(Fp, n);
+    // Zero is a square too: 0 = 0^2, and Fp.sqrt(0) already returns 0.
+    return l !== -1;
+}
+/**
+ * @param n - Curve order. Callers are expected to pass a positive order.
+ * @param nBitLength - Optional cached bit length. Callers are expected to pass a positive cached
+ *   value when overriding the derived bit length.
+ * @returns Byte and bit lengths.
+ * @throws If the order or cached bit length is invalid. {@link Error}
+ * @example
+ * Measure the encoding sizes needed for one modulus.
+ *
+ * ```ts
+ * nLength(255n);
+ * ```
+ */
+function nLength(n, nBitLength) {
+    // Bit size, byte size of CURVE.n
+    if (nBitLength !== undefined)
+        anumber(nBitLength);
+    if (n <= _0n$3)
+        throw new Error('invalid n length: expected positive n, got ' + n);
+    if (nBitLength !== undefined && nBitLength < 1)
+        throw new Error('invalid n length: expected positive bit length, got ' + nBitLength);
+    const bits = bitLen(n);
+    // Cached bit lengths smaller than ORDER would truncate serialized scalars/elements and poison
+    // any math that relies on the derived field metadata.
+    if (nBitLength !== undefined && nBitLength < bits)
+        throw new Error(`invalid n length: expected nBitLength (${nBitLength}) >= bitLen(n) (${bits})`);
+    const _nBitLength = nBitLength !== undefined ? nBitLength : bits;
+    const nByteLength = Math.ceil(_nBitLength / 8);
+    return { nBitLength: _nBitLength, nByteLength };
+}
+// Keep the lazy sqrt cache off-instance so Field(...) can return a frozen object. Otherwise the
+// cached helper write would keep the field surface externally mutable.
+const FIELD_SQRT = new WeakMap();
+class _Field {
+    ORDER;
+    BITS;
+    BYTES;
+    isLE;
+    ZERO = _0n$3;
+    ONE = _1n$2;
+    _lengths;
+    _mod;
+    constructor(ORDER, opts = {}) {
+        // ORDER <= 1 is degenerate: ONE would not be a valid field element and helpers like pow/inv
+        // would stop modeling field arithmetic.
+        if (ORDER <= _1n$2)
+            throw new Error('invalid field: expected ORDER > 1, got ' + ORDER);
+        let _nbitLength = undefined;
+        this.isLE = false;
+        if (opts != null && typeof opts === 'object') {
+            // Cached bit lengths are trusted here and should already be positive / consistent with ORDER.
+            if (typeof opts.BITS === 'number')
+                _nbitLength = opts.BITS;
+            if (typeof opts.sqrt === 'function')
+                // `_Field.prototype` is frozen below, so custom sqrt hooks must become own properties
+                // explicitly instead of relying on writable prototype shadowing via assignment.
+                Object.defineProperty(this, 'sqrt', { value: opts.sqrt, enumerable: true });
+            if (typeof opts.isLE === 'boolean')
+                this.isLE = opts.isLE;
+            if (opts.allowedLengths)
+                this._lengths = Object.freeze(opts.allowedLengths.slice());
+            if (typeof opts.modFromBytes === 'boolean')
+                this._mod = opts.modFromBytes;
+        }
+        const { nBitLength, nByteLength } = nLength(ORDER, _nbitLength);
+        if (nByteLength > 2048)
+            throw new Error('invalid field: expected ORDER of <= 2048 bytes');
+        this.ORDER = ORDER;
+        this.BITS = nBitLength;
+        this.BYTES = nByteLength;
+        Object.freeze(this);
+    }
+    create(num) {
+        return mod(num, this.ORDER);
+    }
+    isValid(num) {
+        if (typeof num !== 'bigint')
+            throw new TypeError('invalid field element: expected bigint, got ' + typeof num);
+        return _0n$3 <= num && num < this.ORDER; // 0 is valid element, but it's not invertible
+    }
+    is0(num) {
+        return num === _0n$3;
+    }
+    // is valid and invertible
+    isValidNot0(num) {
+        return !this.is0(num) && this.isValid(num);
+    }
+    isOdd(num) {
+        return (num & _1n$2) === _1n$2;
+    }
+    neg(num) {
+        return mod(-num, this.ORDER);
+    }
+    eql(lhs, rhs) {
+        return lhs === rhs;
+    }
+    sqr(num) {
+        return mod(num * num, this.ORDER);
+    }
+    add(lhs, rhs) {
+        return mod(lhs + rhs, this.ORDER);
+    }
+    sub(lhs, rhs) {
+        return mod(lhs - rhs, this.ORDER);
+    }
+    mul(lhs, rhs) {
+        return mod(lhs * rhs, this.ORDER);
+    }
+    pow(num, power) {
+        return pow(num, power, this.ORDER);
+    }
+    div(lhs, rhs) {
+        return mod(lhs * invert(rhs, this.ORDER), this.ORDER);
+    }
+    // Same as above, but doesn't normalize
+    sqrN(num) {
+        return num * num;
+    }
+    addN(lhs, rhs) {
+        return lhs + rhs;
+    }
+    subN(lhs, rhs) {
+        return lhs - rhs;
+    }
+    mulN(lhs, rhs) {
+        return lhs * rhs;
+    }
+    inv(num) {
+        return invert(num, this.ORDER);
+    }
+    sqrt(num) {
+        // Caching sqrt helpers speeds up sqrt9mod16 by 5x and Tonelli-Shanks by about 10% without keeping
+        // the field instance itself mutable.
+        let sqrt = FIELD_SQRT.get(this);
+        if (!sqrt)
+            FIELD_SQRT.set(this, (sqrt = FpSqrt(this.ORDER)));
+        return sqrt(this, num);
+    }
+    toBytes(num) {
+        // Serialize fixed-width limbs without re-validating the field range. Callers that need a
+        // canonical encoding must pass a valid element; some protocols intentionally serialize raw
+        // residues here and reduce or validate them elsewhere.
+        return this.isLE ? numberToBytesLE(num, this.BYTES) : numberToBytesBE(num, this.BYTES);
+    }
+    fromBytes(bytes, skipValidation = false) {
+        abytes(bytes);
+        const { _lengths: allowedLengths, BYTES, isLE, ORDER, _mod: modFromBytes } = this;
+        if (allowedLengths) {
+            // `allowedLengths` must list real positive byte lengths; otherwise empty input would get
+            // padded into zero and silently decode as a field element.
+            if (bytes.length < 1 || !allowedLengths.includes(bytes.length) || bytes.length > BYTES) {
+                throw new Error('Field.fromBytes: expected ' + allowedLengths + ' bytes, got ' + bytes.length);
+            }
+            const padded = new Uint8Array(BYTES);
+            // isLE add 0 to right, !isLE to the left.
+            padded.set(bytes, isLE ? 0 : padded.length - bytes.length);
+            bytes = padded;
+        }
+        if (bytes.length !== BYTES)
+            throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);
+        let scalar = isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
+        if (modFromBytes)
+            scalar = mod(scalar, ORDER);
+        if (!skipValidation)
+            if (!this.isValid(scalar))
+                throw new Error('invalid field element: outside of range 0..ORDER');
+        // Range validation is optional here because some protocols intentionally decode raw residues
+        // and reduce or validate them elsewhere.
+        return scalar;
+    }
+    // TODO: we don't need it here, move out to separate fn
+    invertBatch(lst) {
+        // `passZero` keeps the `bigint[]` contract honest: zero inputs map to `0` instead of leaking
+        // `undefined` into a `bigint[]`. Callers that must distinguish non-invertible inputs should use
+        // `FpInvertBatch` directly, whose default omits `passZero` and returns `(bigint | undefined)[]`.
+        return FpInvertBatch(this, lst, true);
+    }
+    // We can't move this out because Fp6, Fp12 implement it
+    // and it's unclear what to return in there.
+    cmov(a, b, condition) {
+        // Field elements have `isValid(...)`; the CMOV branch bit is a direct runtime input, so reject
+        // non-boolean selectors here instead of letting JS truthiness silently change arithmetic.
+        abool(condition, 'condition');
+        return condition ? b : a;
+    }
+}
+/**
+ * Creates a finite field. Major performance optimizations:
+ * * 1. Denormalized operations like mulN instead of mul.
+ * * 2. Identical object shape: never add or remove keys.
+ * * 3. Frozen stable object shape; the lazy sqrt cache lives in a module-level `WeakMap`.
+ * Fragile: always run a benchmark on a change.
+ * Security note: operations and low-level serializers like `toBytes` don't check `isValid` for
+ * all elements for performance and protocol-flexibility reasons; callers are responsible for
+ * supplying valid elements when they need canonical field behavior.
+ * This is low-level code, please make sure you know what you're doing.
+ *
+ * Note about field properties:
+ * * CHARACTERISTIC p = prime number, number of elements in main subgroup.
+ * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.
+ *
+ * @param ORDER - field order, probably prime, or could be composite
+ * @param opts - Field options such as bit length or endianness. See {@link FieldOpts}.
+ * @returns Frozen field instance with a stable object shape. This wrapper forwards `opts` straight
+ *   into `_Field`, so it inherits `_Field`'s assumptions about cached sizes and `allowedLengths`.
+ * @example
+ * Construct one prime field with optional overrides.
+ *
+ * ```ts
+ * Field(11n);
+ * ```
+ */
+function Field(ORDER, opts = {}) {
+    // Freeze the shared method surface before any instance is reachable; otherwise callers can
+    // poison every Field instance by monkey-patching `_Field.prototype` even if each instance is
+    // frozen. Freezing here instead of module scope keeps `_Field` tree-shakeable for importers
+    // that never construct a field; the call is idempotent and cheap.
+    Object.freeze(_Field.prototype);
+    return new _Field(ORDER, opts);
+}
+/**
+ * Returns total number of bytes consumed by the field element.
+ * For example, 32 bytes for usual 256-bit weierstrass curve.
+ * @param fieldOrder - number of field elements, usually CURVE.n. Callers are expected to pass an
+ *   order greater than 1.
+ * @returns byte length of field
+ * @throws If the field order is not a bigint. {@link Error}
+ * @example
+ * Read the fixed-width byte length of one field.
+ *
+ * ```ts
+ * getFieldBytesLength(255n);
+ * ```
+ */
+function getFieldBytesLength(fieldOrder) {
+    if (typeof fieldOrder !== 'bigint')
+        throw new Error('field order must be bigint');
+    // Valid field elements are in 0..ORDER-1, so ORDER <= 1 would make the encoded range degenerate.
+    if (fieldOrder <= _1n$2)
+        throw new Error('field order must be greater than 1');
+    // Valid field elements are < ORDER, so the maximal encoded element is ORDER - 1.
+    const bitLength = bitLen(fieldOrder - _1n$2);
+    return Math.ceil(bitLength / 8);
+}
+/**
+ * Returns minimal amount of bytes that can be safely reduced
+ * by field order.
+ * Should be 2^-128 for 128-bit curve such as P256.
+ * This is the reduction / modulo-bias lower bound; higher-level helpers may still impose a larger
+ * absolute floor for policy reasons.
+ * @param fieldOrder - number of field elements greater than 1, usually CURVE.n.
+ * @returns byte length of target hash
+ * @throws If the field order is invalid. {@link Error}
+ * @example
+ * Compute the minimum hash length needed for field reduction.
+ *
+ * ```ts
+ * getMinHashLength(255n);
+ * ```
+ */
+function getMinHashLength(fieldOrder) {
+    const length = getFieldBytesLength(fieldOrder);
+    return length + Math.ceil(length / 2);
+}
+/**
+ * "Constant-time" private key generation utility.
+ * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF
+ * and convert them into private scalar, with the modulo bias being negligible.
+ * Needs at least 48 bytes of input for 32-byte private key. The implementation also keeps a hard
+ * 16-byte minimum even when `getMinHashLength(...)` is smaller, so toy-small inputs do not look
+ * accidentally acceptable for real scalar derivation.
+ * See {@link https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/ | Kudelski's modulo-bias guide},
+ * {@link https://csrc.nist.gov/publications/detail/fips/186/5/final | FIPS 186-5 appendix A.2}, and
+ * {@link https://www.rfc-editor.org/rfc/rfc9380#section-5 | RFC 9380 section 5}. Unlike RFC 9380
+ * `hash_to_field`, this helper intentionally maps into the non-zero private-scalar range `1..n-1`.
+ * @param key - Uniform input bytes.
+ * @param fieldOrder - Size of subgroup.
+ * @param isLE - interpret hash bytes as LE num
+ * @returns valid private scalar
+ * @throws If the hash length or field order is invalid for scalar reduction. {@link Error}
+ * @example
+ * Map hash output into a private scalar range.
+ *
+ * ```ts
+ * mapHashToField(new Uint8Array(48).fill(1), 255n);
+ * ```
+ */
+function mapHashToField(key, fieldOrder, isLE = false) {
+    abytes(key);
+    const len = key.length;
+    const fieldLen = getFieldBytesLength(fieldOrder);
+    const minLen = Math.max(getMinHashLength(fieldOrder), 16);
+    // No toy-small inputs: the helper is for real scalar derivation, not tiny test curves. No huge
+    // inputs: easier to reason about JS timing / allocation behavior.
+    if (len < minLen || len > 1024)
+        throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);
+    const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);
+    // Map into the non-zero scalar range [1, fieldOrder-1]: reduce mod (fieldOrder-1) to land in
+    // [0, fieldOrder-2], then add 1. This shifts the range off zero; it is NOT equal to
+    // `mod(num, fieldOrder)` (which spans [0, fieldOrder-1] and can be 0). A residual modulo bias
+    // remains but is negligible (~2^-(nBits/2), e.g. ~2^-128 for a 256-bit order) because `key` is
+    // required to be at least `getMinHashLength(fieldOrder)` (~1.5x field size) bytes of input.
+    const reduced = mod(num, fieldOrder - _1n$2) + _1n$2;
+    return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
+}
+
+/**
+ * Methods for elliptic curve multiplication by scalars.
+ * Contains wNAF-based ScalarMultiplier, pippenger.
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const _0n$2 = /* @__PURE__ */ BigInt(0);
+const _1n$1 = /* @__PURE__ */ BigInt(1);
+const _4n$1 = /* @__PURE__ */ BigInt(4);
+const BLIND_BYTES = 16;
+const BLIND_BITS = 128;
+// Fixed-window width for the constant-time multiply of un-precomputed points (W===1).
+// A flat 2^FW_WINDOW table has a small, scalar-independent build cost that amortizes over a single
+// multiply, unlike the larger per-point wNAF tables that only pay off when cached.
+const FW_WINDOW = 5;
+// Precompute tables are capped at ~2 GiB of estimated heap. Rejecting larger windows up front
+// turns a typo'd window size into an immediate error instead of a multi-GB allocation (or an
+// effective hang) when the lazy table is built on first multiply.
+const TABLE_BYTES_MAX = /* @__PURE__ */ (() => 2 ** 31)();
+/**
+ * Validates the static surface of a point constructor.
+ * This is only a cheap sanity check for the constructor hooks and fields consumed by generic
+ * factories; it does not certify `BASE`/`ZERO` semantics or prove the curve implementation itself.
+ * @param Point - Runtime point constructor.
+ * @throws On missing constructor hooks or malformed field metadata. {@link TypeError}
+ * @example
+ * Check that one point constructor exposes the static hooks generic helpers need.
+ *
+ * ```ts
+ * import { ed25519 } from '@noble/curves/ed25519.js';
+ * import { validatePointCons } from '@noble/curves/abstract/curve.js';
+ * validatePointCons(ed25519.Point);
+ * ```
+ */
+function validatePointCons(Point) {
+    const pc = Point;
+    if (typeof pc !== 'function')
+        throw new TypeError('"Point" expected constructor, got type=' + typeof Point);
+    afunction(pc.fromAffine, 'Point.fromAffine');
+    afunction(pc.fromBytes, 'Point.fromBytes');
+    afunction(pc.fromHex, 'Point.fromHex');
+    // Generic helpers (ScalarMultiplier, normalizeZ, MSM) dereference BASE / ZERO:
+    // fail here with a typed error instead of an `undefined` access later.
+    aobject(pc.BASE, 'Point.BASE');
+    aobject(pc.ZERO, 'Point.ZERO');
+    validateField(pc.Fp);
+    validateField(pc.Fn);
+}
+/**
+ * Takes a bunch of Projective Points but executes only one
+ * inversion on all of them. Inversion is very slow operation,
+ * so this improves performance massively.
+ * Optimization: converts a list of projective points to a list of identical points with Z=1.
+ * Input points are left unchanged; the normalized points are returned as fresh instances.
+ * @param c - Point constructor.
+ * @param points - Projective points.
+ * @returns Fresh projective points reconstructed from normalized affine coordinates.
+ * @example
+ * Batch-normalize projective points with a single shared inversion.
+ *
+ * ```ts
+ * import { normalizeZ } from '@noble/curves/abstract/curve.js';
+ * import { p256 } from '@noble/curves/nist.js';
+ * const points = normalizeZ(p256.Point, [p256.Point.BASE, p256.Point.BASE.double()]);
+ * ```
+ */
+function normalizeZ(c, points) {
+    // Match MSM helpers: reject malformed public inputs before reading projective internals.
+    validatePointCons(c);
+    validateMSMPoints(points, c);
+    // Identity points (Z=0) rely on an implicit contract: FpInvertBatch without `passZero`
+    // yields `undefined` for zero inputs, and `toAffine(undefined)` falls back to its internal
+    // is0 handling instead of using the batch inverse.
+    const invertedZs = FpInvertBatch(c.Fp, points.map((p) => p.Z));
+    return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));
+}
+function validateW(W, bits, min = 1) {
+    if (!Number.isSafeInteger(W) || W < min || W > bits)
+        throw new Error('invalid window size, expected [' + min + '..' + bits + '], got W=' + W);
+}
+// Rough per-point heap estimate for the {@link TABLE_BYTES_MAX} cap: up to 4 projective/extended
+// coordinates of Fp.BYTES each, plus bigint/object overhead. Callers pass the point count of the
+// largest table the checked parameters can produce.
+function validateTableBytes(numPoints, fpBytes) {
+    const bytes = numPoints * (4 * fpBytes + 128);
+    if (bytes > TABLE_BYTES_MAX)
+        throw new Error('invalid window size: table would need ~' +
+            Math.ceil(bytes / 2 ** 20) +
+            ' MiB, max ' +
+            TABLE_BYTES_MAX / 2 ** 20 +
+            ' MiB');
+}
+/**
+ * Probes an RNG once, at construction time: returns `undefined` when it is unavailable —
+ * throws or returns malformed bytes — so callers can downgrade to their unblinded /
+ * deterministic constant-time fallback. Blinding is defense-in-depth (DPA/template
+ * hardening), not a correctness or key-secrecy requirement, so availability-based
+ * downgrade is acceptable.
+ *
+ * The downgrade decision is deliberately static. After a successful probe the RNG becomes
+ * part of the trusted contract: later misbehavior must fail closed in per-call validation
+ * (throw), never downgrade — a dynamic fallback would let a tampered RNG silently strip
+ * blinding on demand. A probe can only ever classify broken environments, not adversarial
+ * RNGs: a stateful RNG can always behave while probed and misbehave later.
+ * @param randomBytes - RNG to probe, or `undefined` when the environment provides none.
+ * @param length - Byte length requested from the probe call.
+ * @returns The RNG when the probe produced `length` valid bytes; `undefined` otherwise.
+ * @example
+ * Probe an RNG once before enabling scalar blinding.
+ *
+ * ```ts
+ * import { probeRandomBytes } from '@noble/curves/abstract/curve.js';
+ * import { randomBytes } from '@noble/hashes/utils.js';
+ * const rng = probeRandomBytes(randomBytes, 16);
+ * ```
+ */
+function probeRandomBytes(randomBytes, length) {
+    if (randomBytes === undefined)
+        return undefined;
+    afunction(randomBytes, 'randomBytes');
+    try {
+        const probe = randomBytes(length);
+        if (!isBytes(probe) || probe.length !== length)
+            return undefined;
+    }
+    catch {
+        return undefined;
+    }
+    return randomBytes;
+}
+function validateMSMPoints(points, c) {
+    aarray(points, 'points');
+    points.forEach((p, i) => {
+        if (!(p instanceof c))
+            throw new Error('invalid point at index ' + i);
+    });
+}
+// Default bound is field membership (0 <= s < field.ORDER); a `maxScalar` override widens it
+// to 0 <= s < maxScalar for callers that accept oversized scalars.
+function validateMSMScalars(scalars, field, maxScalar) {
+    if (!Array.isArray(scalars))
+        throw new Error('array of scalars expected');
+    scalars.forEach((s, i) => {
+        const ok = maxScalar === undefined ? field.isValid(s) : isPosBig(s) && s < maxScalar;
+        if (!ok)
+            throw new Error('invalid scalar at index ' + i);
+    });
+}
+const pointWindowSizes = new WeakMap();
+function getWindowSize(P) {
+    // `1` is the uncached sentinel: use the non-precomputed (wNAF / fixed-window) path.
+    return pointWindowSizes.get(P) || 1;
+}
+/** Table of odd multiples [1P, 3P, ..., (2⋅size−1)P]; width-W wNAF uses size = 2^(W−2). */
+function oddMultiples(p, size) {
+    const dbl = p.double();
+    const t = [p];
+    for (let j = 1; j < size; j++)
+        t.push(t[j - 1].add(dbl));
+    return t;
+}
+/**
+ * Width-W wNAF signed-digit recoding (W >= 2), LSB-first: digits are 0 or odd with
+ * |digit| < 2^(W−1); nonzero density ~1/(W+1) (a nonzero digit is followed by W−1 zeros).
+ */
+function wnafDigits(n, W) {
+    const size = 2 ** W;
+    const half = size / 2;
+    const mask = BigInt(size - 1);
+    const d = [];
+    while (n > _0n$2) {
+        let w = 0;
+        if (n & _1n$1) {
+            w = Number(n & mask); // n mod 2^W, odd
+            if (w >= half)
+                w -= size; // signed residue
+            n -= BigInt(w); // n - w ≡ 0 mod 2^W: next W−1 digits are zero
+        }
+        d.push(w);
+        n >>= _1n$1;
+    }
+    return d;
+}
+/**
+ * Fixed-position signed-window recoding for precomputed wNAF: `n = Σ digits[w]⋅2^(w⋅W)` with
+ * digits in `[−2^(W−1)+1, 2^(W−1)]`. Digit count is fixed by `windows` (callers reserve one
+ * extra window for the final carry), so recoding length does not depend on the scalar.
+ */
+function signedWindowDigits(n, W, windows) {
+    const size = 2 ** W;
+    const half = size / 2;
+    const mask = BigInt(size - 1);
+    const shiftBy = BigInt(W);
+    const d = [];
+    for (let w = 0; w < windows; w++) {
+        let v = Number(n & mask);
+        n >>= shiftBy;
+        if (v > half) {
+            v -= size; // negative digit, carry into the next window
+            n += _1n$1;
+        }
+        d.push(v);
+    }
+    // Internal invariant: leftover bits mean the window count did not cover the scalar.
+    if (n !== _0n$2)
+        throw new Error('invalid wnaf');
+    return d;
+}
+/**
+ * Shared vartime walk over per-scalar wNAF digit streams: one doubling of a single shared
+ * accumulator per bit position of the longest recoding, one signed table addition per
+ * nonzero digit. `tables[i]` must hold the odd multiples of the i-th point.
+ */
+function wnafWalk(zero, tables, digits) {
+    let max = 0;
+    for (const d of digits)
+        max = Math.max(max, d.length);
+    let acc = zero;
+    for (let bit = max - 1; bit >= 0; bit--) {
+        if (bit !== max - 1)
+            acc = acc.double();
+        for (let i = 0; i < digits.length; i++) {
+            const w = digits[i][bit]; // reads past shorter recodings yield undefined, skipped below
+            if (w) {
+                const item = tables[i][(Math.abs(w) - 1) >> 1];
+                acc = acc.add(w < 0 ? item.negate() : item);
+            }
+        }
+    }
+    return acc;
+}
+/**
+ * Elliptic curve multiplication of Point by scalar.
+ * Routes between cached-table, fixed-window, and one-shot wNAF paths; entry points validate
+ * their own scalars (`mulCT`/`mulCTBlinded`: `1 <= s < Fn.ORDER`; `mulUnsafe`: up to the
+ * `Fn.ORDER^4` DoS cap via {@link mulAddUnsafe}).
+ * Table generation is expensive and happens on first call of `multiply()`
+ * (or eagerly via `precompute(W, false)`). By default, `BASE` point is precomputed.
+ *
+ * Cached algorithm is signed fixed-window wNAF:
+ * - table stores, for every window w, the multiples `[1..2^(W−1)]⋅2^(w⋅W)⋅P` — all doublings
+ *   are baked in, so a multiplication is exactly one table addition per window
+ * - window count is fixed (`ceil(bits/W) + 1`), so the point-operation count is scalar-independent
+ *   (basis of the constant-time path)
+ * - for a 256-bit curve and W=6: 44⋅32 = 1408 table points, 44 additions per multiply
+ * - secret scalars are additionally blinded (see {@link ScalarMultiplier.mulCTBlinded}), which
+ *   widens tables by 128 bits
+ * @param Point - Point constructor.
+ * @param randomBytes - RNG used for scalar blinding; required by the blinded secret path.
+ * @example
+ * Elliptic curve multiplication of Point by scalar.
+ *
+ * ```ts
+ * import { ScalarMultiplier } from '@noble/curves/abstract/curve.js';
+ * import { p256 } from '@noble/curves/nist.js';
+ * const mul = new ScalarMultiplier(p256.Point);
+ * ```
+ */
+class ScalarMultiplier {
+    Point;
+    BASE;
+    ZERO;
+    randomBytes;
+    wnafPrecomputes = new WeakMap();
+    baseCanBeBlinded;
+    bits;
+    // Parametrized with a given Point class (not individual point)
+    constructor(Point, randomBytes) {
+        validatePointCons(Point);
+        // Probe the RNG once (see {@link probeRandomBytes}): in environments without working
+        // randomness (e.g. no WebCrypto), shouldBlind() then routes secret multiplication to the
+        // unblinded constant-time path instead of throwing on every multiply(). The shape of
+        // returned bytes is still validated on every blinded call, where breakage fails closed.
+        this.randomBytes = probeRandomBytes(randomBytes, BLIND_BYTES);
+        this.Point = Point;
+        this.BASE = Point.BASE;
+        this.ZERO = Point.ZERO;
+        this.bits = Point.Fn.BITS;
+    }
+    /**
+     * Creates a signed fixed-window wNAF precomputation table: for every window w, the
+     * multiples `[1..2^(W−1)]⋅2^(w⋅W)⋅P`, flattened. All doublings are baked into the table,
+     * so cached multiplication is additions-only. `windows = ceil(bits/W) + 1`: the extra
+     * window absorbs the final carry of signed-digit recoding.
+     * For a 256-bit curve and W=6, the table is 44⋅32 = 1408 points.
+     * @param point - Point instance
+     * @param W - window size
+     * @param bits - scalar bitlength the table must cover
+     */
+    buildWnafTable(point, W, bits) {
+        // W needs no re-validation: its only source is setWindowSize(), which enforces
+        // 1 <= W <= Fn.BITS <= bits (the blinded path only ever widens bits) and caps the
+        // resulting table at ~2 GiB (sized against the wider blinded layout).
+        const windows = Math.ceil(bits / W) + 1;
+        const half = 2 ** (W - 1);
+        const comp = [];
+        let base = point;
+        for (let w = 0; w < windows; w++) {
+            let acc = base;
+            for (let i = 0; i < half; i++) {
+                comp.push(acc);
+                acc = acc.add(base);
+            }
+            base = comp[comp.length - 1].double(); // 2⋅(2^(W−1)⋅base) = next window's base
+        }
+        return { W, bits, windows, comp };
+    }
+    /**
+     * Implements ec multiplication using precomputed signed fixed-window wNAF tables.
+     * Constant-time: fixed window count with one table addition per window — zero digits feed
+     * the fake accumulator — and no doublings; the lookup scans the whole window slice.
+     * Scalar bounds are validated by the public entry points ({@link ScalarMultiplier.mulCT},
+     * {@link ScalarMultiplier.mulCTBlinded}, {@link ScalarMultiplier.mulUnsafe});
+     * signedWindowDigits throws if `n` exceeds the table.
+     * @returns real and fake (for const-time) points
+     */
+    wnafCachedCT(precomputes, n) {
+        const { W, windows, comp } = precomputes;
+        const half = 2 ** (W - 1);
+        const digits = signedWindowDigits(n, W, windows);
+        let p = this.ZERO;
+        let f = this.BASE;
+        for (let w = 0; w < windows; w++) {
+            const digit = digits[w];
+            const start = w * half;
+            // Data-oblivious select: touch every entry of the window before the digit branch.
+            const idx = Math.abs(digit) - 1; // -1 for zero digits: matches nothing, `sel` unused
+            let sel = comp[start];
+            for (let i = 1; i < half; i++)
+                sel = i === idx ? comp[start + i] : sel;
+            const neg = sel.negate(); // compute both signs; the digit only picks one
+            if (digit === 0)
+                f = f.add(comp[start]);
+            else
+                p = p.add(digit < 0 ? neg : sel);
+        }
+        return { p, f };
+    }
+    // Cache key is point identity plus (W, bits); at most two entries exist per point (public-width
+    // `Fn.BITS` and blinded `Fn.BITS + BLIND_BITS`). Callers must not reuse the same point with
+    // incompatible `transform(...)` layouts and expect a separate cache entry.
+    getWnafPrecomputes(W, point, bits, transform) {
+        let entries = this.wnafPrecomputes.get(point);
+        let comp = entries?.find((entry) => entry.W === W && entry.bits === bits);
+        if (!comp) {
+            comp = this.buildWnafTable(point, W, bits);
+            if (typeof transform === 'function')
+                comp = { ...comp, comp: transform(comp.comp) };
+            if (!entries) {
+                entries = [];
+                this.wnafPrecomputes.set(point, entries);
+            }
+            entries.push(comp);
+        }
+        return comp;
+    }
+    assertPoint(point) {
+        if (!(point instanceof this.Point))
+            throw new TypeError('"point" expected Point instance, got type=' + typeof point);
+    }
+    // Shared prologue of the constant-time entry points. Rejects scalar 0: in key/signature-style
+    // callers a zero scalar means broken upstream plumbing, and concrete Points already reject it.
+    // Uses inRange instead of Fn.isValidNot0: validateField() only certifies the arithmetic subset.
+    validateMulInput(point, scalar) {
+        this.assertPoint(point);
+        if (!inRange(scalar, _1n$1, this.Point.Fn.ORDER))
+            throw new Error('invalid scalar');
+    }
+    // Constant-time dispatch shared by mulCT / mulCTBlinded. Un-precomputed points (W===1, e.g.
+    // ECDH peer keys) skip building a throwaway cached table in favor of a small fixed-window
+    // multiply. `n` must be < 2^bits.
+    runCT(point, n, bits, transform) {
+        const W = getWindowSize(point);
+        if (W === 1)
+            return this.fixedWindowCT(point, n, bits);
+        return this.wnafCachedCT(this.getWnafPrecomputes(W, point, bits, transform), n);
+    }
+    mulCT(point, scalar, transform) {
+        this.validateMulInput(point, scalar);
+        return this.runCT(point, scalar, this.bits, transform);
+    }
+    mulCTBlinded(point, scalar, transform) {
+        this.validateMulInput(point, scalar);
+        // Blinding computes n = scalar + blind*Fn.ORDER, then n*P via a constant-time multiply. This
+        // equals scalar*P only when Fn.ORDER*P == O; callers guarantee that via shouldBlind() (always
+        // for cofactor-1 curves; for cofactored curves only BASE, and only after checking BASE*n == O).
+        // Fail before building the (large) precompute table if randomness is unavailable.
+        if (this.randomBytes === undefined)
+            throw new Error('randomBytes is required for scalar blinding');
+        const bits = this.Point.Fn.BITS + BLIND_BITS;
+        const blind = this.randomBytes(BLIND_BYTES);
+        if (!isBytes(blind) || blind.length !== BLIND_BYTES)
+            throw new Error('randomBytes returned invalid byte array');
+        // Force the top two bits of the 128-bit blind to 10xxxxxx, so blind is in [2^127, 1.5*2^127):
+        // * `| 0x80` (bit 127 = 1) is the load-bearing part: it guarantees blind >= 2^127, so the blind
+        //   is always a full-width, nonzero factor and the scalar is masked even with a degenerate RNG.
+        // * `& 0x3f` (bit 126 = 0) is a safety margin: it caps blind < 1.5*2^127, keeping
+        //   blind*Fn.ORDER + scalar < 0.75*2^(nBits+128), i.e. ~half a window below the 2^(nBits+128)
+        //   ceiling. Not strictly required for the bound (see below), but it reserves headroom so the
+        //   guarantee does not rest on the tight `Fn.ORDER < 2^Fn.BITS` fact and the final carry window
+        //   only ever holds a small carry, never a full digit.
+        blind[0] = (blind[0] & 0x3f) | 0x80;
+        // Even at the extreme (blind < 2^128, scalar < Fn.ORDER < 2^nBits): n <= 2^128*Fn.ORDER - 1 <
+        // 2^(nBits+128), so n stays below 2^bits and within the blinded table's
+        // window count. Both cached CT kernels run a fixed number of windows/rows with one point-add
+        // each, so the add count is independent of scalar (constant-time).
+        const n = scalar + bytesToNumberBE(blind) * this.Point.Fn.ORDER;
+        return this.runCT(point, n, bits, transform);
+    }
+    /**
+     * Constant-time multiplication `n*point` for an un-precomputed point, via a small fixed window.
+     * A cached wNAF table only pays off when reused; a flat 2^FW_WINDOW table (`size-1` adds) is
+     * far cheaper to build for a single use. The point-operation sequence is independent of `n`:
+     * build the table, then per window exactly FW_WINDOW doublings, a data-oblivious scan over
+     * every table entry, and one addition (adds the identity when the window digit is 0 — never
+     * skipped).
+     *
+     * `n` must be `< 2^bits`. Assumes complete addition (adding the identity costs the same as any
+     * add), which holds for the Weierstrass/Edwards point types used here. The table is left in
+     * projective form (no normalizeZ): normalizing this small a table costs more than the
+     * mixed-add savings it would buy for a single multiply.
+     * @returns real point `p`; `f` duplicates it only to match {@link wnafCachedCT}'s return shape
+     * (this path needs no fake accumulator — its op-count is already scalar-independent).
+     */
+    fixedWindowCT(point, n, bits) {
+        const W = FW_WINDOW;
+        const size = 1 << W;
+        const mask = bitMask(W);
+        // Flat table [O, point, 2*point, ..., (size-1)*point].
+        const table = new Array(size);
+        table[0] = this.ZERO;
+        for (let i = 1; i < size; i++)
+            table[i] = table[i - 1].add(point);
+        // Horner MSB->LSB. windows*W >= bits and n < 2^bits, so every bit of n is consumed.
+        const windows = Math.ceil(bits / W);
+        let acc = this.ZERO;
+        for (let window = windows - 1; window >= 0; window--) {
+            // W doublings per window; skipped for the first (topmost) window, where acc is still the
+            // identity. The skip is scalar-independent: it depends only on the loop index.
+            if (window !== windows - 1)
+                for (let d = 0; d < W; d++)
+                    acc = acc.double();
+            const digit = Number((n >> BigInt(window * W)) & mask);
+            // Data-oblivious select: touch every entry, same as wnafCachedCT.
+            let sel = table[0];
+            for (let i = 1; i < size; i++)
+                sel = i === digit ? table[i] : sel;
+            acc = acc.add(sel); // one add per window, even for digit 0
+        }
+        return { p: acc, f: acc };
+    }
+    shouldBlind(point, cofactor) {
+        // No usable RNG (probed in the constructor): blinding is impossible, use the plain CT path.
+        if (this.randomBytes === undefined)
+            return false;
+        if (cofactor === _1n$1)
+            return true;
+        if (point !== this.BASE)
+            return false;
+        if (this.baseCanBeBlinded === undefined)
+            this.baseCanBeBlinded = this.mulUnsafe(this.BASE, this.Point.Fn.ORDER).is0();
+        return this.baseCanBeBlinded;
+    }
+    mulSecret(point, scalar, cofactor, transform) {
+        return this.shouldBlind(point, cofactor)
+            ? this.mulCTBlinded(point, scalar, transform)
+            : this.mulCT(point, scalar, transform);
+    }
+    mulUnsafe(point, scalar, transform) {
+        this.assertPoint(point);
+        if (!isPosBig(scalar))
+            throw new Error('invalid scalar');
+        const W = getWindowSize(point);
+        // W === 1 (un-precomputed): one-shot width-4 wNAF via {@link mulAddUnsafe} with L=1 —
+        // a cached table would be thrown away after one use. `allowOversized` swaps the
+        // `s < Fn.ORDER` check for mulAddUnsafe's `Fn.ORDER^4` DoS cap.
+        //
+        // Oversized scalar could happen when:
+        // a) user passes large scalar on their own (rare)
+        // b) `assertValidity()` calls `isTorsionFree()`, which multiplies point by `Fn.ORDER`
+        if (W === 1 || scalar >= this.Point.Fn.ORDER)
+            return mulAddUnsafe(this.Point, [point], [scalar], true);
+        // Precomputed points reuse the CT kernel (fake accumulator discarded): with W=6 only
+        // ~1/64 of window-adds are skippable, so a dedicated vartime kernel saved just ~6% on
+        // this path while doubling the cached-table code surface.
+        const precomputes = this.getWnafPrecomputes(W, point, this.bits, transform);
+        return this.wnafCachedCT(precomputes, scalar).p;
+    }
+    // Remembers the window size used for precomputed wNAF multiplication of the given point
+    // and drops any previously built tables. Usually only the base point is precomputed.
+    // W=1 resets the point to the un-precomputed (table-less) paths.
+    // W is additionally capped so tables stay under ~2 GiB ({@link TABLE_BYTES_MAX}).
+    setWindowSize(point, W) {
+        this.assertPoint(point);
+        validateW(W, this.bits);
+        // Size against the widest table this W can produce: the blinded path adds BLIND_BITS.
+        const windows = Math.ceil((this.bits + BLIND_BITS) / W) + 1;
+        validateTableBytes(windows * 2 ** (W - 1), this.Point.Fp.BYTES);
+        pointWindowSizes.set(point, W);
+        this.wnafPrecomputes.delete(point);
+    }
+    // True when a window size is set: tables themselves are built lazily on first multiply.
+    hasWindowSize(point) {
+        return getWindowSize(point) !== 1;
+    }
+}
+/**
+ * Combined multi-scalar multiplication `Σ scalars[i]⋅points[i]` via interleaved width-4 wNAF
+ * (Strauss–Shamir). Every input gets its own table of odd multiples `[1P, 3P, 5P, 7P]` and
+ * signed-digit recoding, but all walks share one doubling chain, so total cost is
+ * `~bits` doublings + `L⋅bits/5` additions instead of `L⋅bits` doublings for separate
+ * multiplications. Intended for the 2-4 point shapes of signature verification
+ * (`R = u1⋅G + u2⋅P`); use {@link pippenger} for larger batches.
+ *
+ * Not constant-time: only for public inputs. Scalars must satisfy `0 <= s < Fn.ORDER`;
+ * fold negative signs into the points before calling.
+ * @param c - Point constructor.
+ * @param points - Array of curve points.
+ * @param scalars - Array of non-negative scalars, same length as points.
+ * @param allowOversized - Replace the `s < Fn.ORDER` scalar check with a `Fn.ORDER^4` DoS cap.
+ *   Off by default. For scalars that must NOT be reduced mod ORDER: torsion checks
+ *   (`Fn.ORDER⋅P ≟ O`) and cofactor-clearing multiples. Walk length grows with `bitLen(s)`.
+ * @returns Combined multiplication result; identity for empty input.
+ * @throws If the point set or scalar set is invalid. {@link Error}
+ * @example
+ * Combined multi-scalar multiplication via Strauss–Shamir.
+ *
+ * ```ts
+ * import { mulAddUnsafe } from '@noble/curves/abstract/curve.js';
+ * import { p256 } from '@noble/curves/nist.js';
+ * const G = p256.Point.BASE;
+ * const R = mulAddUnsafe(p256.Point, [G, G.double()], [2n, 3n]); // 2⋅G + 3⋅(2⋅G)
+ * ```
+ */
+function mulAddUnsafe(c, points, scalars, allowOversized = false) {
+    validatePointCons(c);
+    validateMSMPoints(points, c);
+    abool(allowOversized, 'allowOversized');
+    // Oversized cap is ORDER^4: hard bound to mitigate DoS, walk length grows with bitLen(s).
+    validateMSMScalars(scalars, c.Fn, allowOversized ? c.Fn.ORDER ** _4n$1 : undefined);
+    if (points.length !== scalars.length)
+        throw new Error('arrays of points and scalars must have equal length');
+    const tables = points.map((p) => oddMultiples(p, 4));
+    const digits = scalars.map((n) => wnafDigits(n, 4));
+    return wnafWalk(c.ZERO, tables, digits);
+}
+function createField(order, field, isLE) {
+    if (field) {
+        // Reuse supplied field overrides as-is; `isLE` only affects freshly constructed fallback
+        // fields, and validateField() below only checks the arithmetic subset, not full byte/cmov
+        // behavior.
+        if (field.ORDER !== order)
+            throw new Error('Field.ORDER must match order: Fp == p, Fn == n');
+        validateField(field);
+        return field;
+    }
+    else {
+        return Field(order, { isLE });
+    }
+}
+/**
+ * Validates basic CURVE shape and field membership, then creates fields.
+ * This does not prove that the generator is on-curve, that subgroup/order data are consistent, or
+ * that the curve equation itself is otherwise sane.
+ * @param type - Curve family.
+ * @param CURVE - Curve parameters.
+ * @param curveOpts - Optional field overrides. See {@link FpFn}:
+ *   - `Fp` (optional): Optional base-field override.
+ *   - `Fn` (optional): Optional scalar-field override.
+ * @param FpFnLE - Whether field encoding is little-endian.
+ * @returns Frozen curve parameters and fields.
+ * @throws If the curve parameters or field overrides are invalid. {@link Error}
+ * @example
+ * Build curve fields from raw constants before constructing a curve instance.
+ *
+ * ```ts
+ * const curve = createCurveFields('weierstrass', {
+ *   p: 17n,
+ *   n: 19n,
+ *   h: 1n,
+ *   a: 2n,
+ *   b: 2n,
+ *   Gx: 5n,
+ *   Gy: 1n,
+ * });
+ * ```
+ */
+function createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
+    if (FpFnLE === undefined)
+        FpFnLE = type === 'edwards';
+    if (!CURVE || typeof CURVE !== 'object')
+        throw new Error(`expected valid ${type} CURVE object`);
+    // Validate before reading Fp/Fn so explicit null fails with an options-object error.
+    validateObject(curveOpts);
+    for (const p of ['p', 'n', 'h']) {
+        const val = CURVE[p];
+        if (!(isPosBig(val) && val !== _0n$2))
+            throw new Error(`CURVE.${p} must be positive bigint`);
+    }
+    const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);
+    const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);
+    const _b = 'b' ;
+    const params = ['Gx', 'Gy', 'a', _b];
+    for (const p of params) {
+        // @ts-ignore
+        if (!Fp.isValid(CURVE[p]))
+            throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
+    }
+    CURVE = Object.freeze(Object.assign({}, CURVE));
+    return { CURVE, Fp, Fn };
+}
+/**
+ * @param randomSecretKey - Secret-key generator.
+ * @param getPublicKey - Public-key derivation helper.
+ * @returns Keypair generator.
+ * @example
+ * Build a `keygen()` helper from existing secret-key and public-key primitives.
+ *
+ * ```ts
+ * import { createKeygen } from '@noble/curves/abstract/curve.js';
+ * import { p256 } from '@noble/curves/nist.js';
+ * const keygen = createKeygen(p256.utils.randomSecretKey, p256.getPublicKey);
+ * const pair = keygen();
+ * ```
+ */
+function createKeygen(randomSecretKey, getPublicKey) {
+    return function keygen(seed) {
+        const secretKey = randomSecretKey(seed);
+        return { secretKey, publicKey: getPublicKey(secretKey) };
+    };
+}
+
+/**
+ * HMAC: RFC2104 message authentication code.
+ * @module
+ */
+/**
+ * Internal class for HMAC.
+ * Accepts any byte key, although RFC 2104 §3 recommends keys at least
+ * `HashLen` bytes long.
+ */
+class _HMAC {
+    oHash;
+    iHash;
+    blockLen;
+    outputLen;
+    canXOF = false;
+    finished = false;
+    destroyed = false;
+    constructor(hash, key) {
+        ahash(hash);
+        abytes$1(key, undefined, 'key');
+        this.iHash = hash.create();
+        if (typeof this.iHash.update !== 'function')
+            throw new Error('expected Hash instance');
+        this.blockLen = this.iHash.blockLen;
+        this.outputLen = this.iHash.outputLen;
+        const blockLen = this.blockLen;
+        const pad = new Uint8Array(blockLen);
+        // blockLen can be bigger than outputLen
+        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+        for (let i = 0; i < pad.length; i++)
+            pad[i] ^= 0x36;
+        this.iHash.update(pad);
+        // By doing update (processing of the first block) of the outer hash here,
+        // we can re-use it between multiple calls via clone.
+        this.oHash = hash.create();
+        // Undo internal XOR && apply outer XOR
+        for (let i = 0; i < pad.length; i++)
+            pad[i] ^= 0x36 ^ 0x5c;
+        this.oHash.update(pad);
+        clean(pad);
+    }
+    update(buf) {
+        aexists(this);
+        this.iHash.update(buf);
+        return this;
+    }
+    digestInto(out) {
+        aexists(this);
+        aoutput(out, this);
+        this.finished = true;
+        const buf = out.subarray(0, this.outputLen);
+        // Reuse the first outputLen bytes for the inner digest; the outer hash consumes them before
+        // overwriting that same prefix with the final tag, leaving any oversized tail untouched.
+        this.iHash.digestInto(buf);
+        this.oHash.update(buf);
+        this.oHash.digestInto(buf);
+        this.destroy();
+    }
+    digest() {
+        const out = new Uint8Array(this.oHash.outputLen);
+        this.digestInto(out);
+        return out;
+    }
+    _cloneInto(to) {
+        // Create new instance without calling constructor since the key
+        // is already in state and we don't know it.
+        to ||= Object.create(Object.getPrototypeOf(this), {});
+        const { oHash, iHash, finished, destroyed, blockLen, outputLen, canXOF } = this;
+        to = to;
+        to.finished = finished;
+        to.destroyed = destroyed;
+        to.blockLen = blockLen;
+        to.outputLen = outputLen;
+        to.canXOF = canXOF;
+        to.oHash = oHash._cloneInto(to.oHash);
+        to.iHash = iHash._cloneInto(to.iHash);
+        return to;
+    }
+    clone() {
+        return this._cloneInto();
+    }
+    destroy() {
+        this.destroyed = true;
+        this.oHash.destroy();
+        this.iHash.destroy();
+    }
+}
+const hmac = /* @__PURE__ */ (() => {
+    const hmac_ = ((hash, key, message) => new _HMAC(hash, key).update(message).digest());
+    hmac_.create = (hash, key) => new _HMAC(hash, key);
+    return hmac_;
+})();
+
+/**
+ * ASN.1 DER (Distinguished Encoding Rules) helpers for ECDSA signatures.
+ * Only implements the tiny subset needed for `SEQUENCE(INTEGER r, INTEGER s)`.
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const _0n$1 = /* @__PURE__ */ BigInt(0);
+/**
+ * @param m - Error message.
+ * @example
+ * Throw a DER-specific error when signature parsing encounters invalid bytes.
+ *
+ * ```ts
+ * new DERErr('bad der');
+ * ```
+ */
+class DERErr extends Error {
+    constructor(m = '') {
+        super(m);
+    }
+}
+// Plain const so the freezes can live inside the pure initializer of the `DER` export below:
+// bare top-level `Object.freeze(...)` calls would defeat tree-shaking for every importer.
+const _DER = {
+    // asn.1 DER encoding utils
+    Err: DERErr,
+    // Basic building block is TLV (Tag-Length-Value)
+    _tlv: {
+        encode: (tag, data) => {
+            const { Err: E } = _DER;
+            asafenumber(tag, 'tag');
+            if (tag < 0 || tag > 255)
+                throw new E('tlv.encode: wrong tag');
+            astring(data, 'data');
+            // Internal helper: callers hand this already-validated hex payload, so we only enforce
+            // byte alignment here instead of re-validating every nibble.
+            if (data.length & 1)
+                throw new E('tlv.encode: unpadded data');
+            const dataLen = data.length / 2;
+            const len = numberToHexUnpadded(dataLen);
+            if ((len.length / 2) & 0b1000_0000)
+                throw new E('tlv.encode: long form length too big');
+            // length of length with long form flag
+            const lenLen = dataLen > 127 ? numberToHexUnpadded((len.length / 2) | 0b1000_0000) : '';
+            const t = numberToHexUnpadded(tag);
+            return t + lenLen + len + data;
+        },
+        // v - value, l - left bytes (unparsed)
+        decode(tag, data) {
+            const { Err: E } = _DER;
+            data = abytes(data, undefined, 'DER data');
+            let pos = 0;
+            if (tag < 0 || tag > 255)
+                throw new E('tlv.decode: wrong tag');
+            if (data.length < 2 || data[pos++] !== tag)
+                throw new E('tlv.decode: wrong tlv');
+            const first = data[pos++];
+            // First bit of first length byte is the short/long form flag.
+            const isLong = !!(first & 0b1000_0000);
+            let length = 0;
+            if (!isLong)
+                length = first;
+            else {
+                // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]
+                const lenLen = first & 0b0111_1111;
+                if (!lenLen)
+                    throw new E('tlv.decode(long): indefinite length not supported');
+                // This would overflow u32 in JS.
+                if (lenLen > 4)
+                    throw new E('tlv.decode(long): byte length is too big');
+                const lengthBytes = data.subarray(pos, pos + lenLen);
+                if (lengthBytes.length !== lenLen)
+                    throw new E('tlv.decode: length bytes not complete');
+                if (lengthBytes[0] === 0)
+                    throw new E('tlv.decode(long): zero leftmost byte');
+                for (const b of lengthBytes)
+                    length = (length << 8) | b;
+                pos += lenLen;
+                if (length < 128)
+                    throw new E('tlv.decode(long): not minimal encoding');
+            }
+            const v = data.subarray(pos, pos + length);
+            if (v.length !== length)
+                throw new E('tlv.decode: wrong value length');
+            return { v, l: data.subarray(pos + length) };
+        },
+    },
+    // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,
+    // since we always use positive integers here. It must always be empty:
+    // - add zero byte if exists
+    // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
+    _int: {
+        encode(num) {
+            const { Err: E } = _DER;
+            abignumber(num);
+            if (num < _0n$1)
+                throw new E('integer: negative integers are not allowed');
+            let hex = numberToHexUnpadded(num);
+            // Pad with zero byte if negative flag is present
+            if (Number.parseInt(hex[0], 16) & 0b1000)
+                hex = '00' + hex;
+            if (hex.length & 1)
+                throw new E('unexpected DER parsing assertion: unpadded hex');
+            return hex;
+        },
+        decode(data) {
+            const { Err: E } = _DER;
+            if (data.length < 1)
+                throw new E('invalid signature integer: empty');
+            if (data[0] & 0b1000_0000)
+                throw new E('invalid signature integer: negative');
+            // Single-byte zero `00` is the canonical DER INTEGER encoding for zero.
+            if (data.length > 1 && data[0] === 0x00 && !(data[1] & 0b1000_0000))
+                throw new E('invalid signature integer: unnecessary leading zero');
+            return bytesToNumberBE(data);
+        },
+    },
+    toSig(bytes, maxScalarBytes) {
+        // parse DER signature
+        const { Err: E, _int: int, _tlv: tlv } = _DER;
+        if (maxScalarBytes !== undefined) {
+            asafenumber(maxScalarBytes, 'maxScalarBytes');
+            if (maxScalarBytes < 1)
+                throw new E('invalid signature: maxScalarBytes must be positive');
+        }
+        const data = abytes(bytes, undefined, 'signature');
+        const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);
+        if (seqLeftBytes.length)
+            throw new E('invalid signature: left bytes after parsing');
+        const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);
+        const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);
+        if (sLeftBytes.length)
+            throw new E('invalid signature: left bytes after parsing');
+        // Enforce curve-provided bounds before bytes-to-hex-to-BigInt conversion can amplify memory.
+        if (maxScalarBytes !== undefined &&
+            (rBytes.length > maxScalarBytes || sBytes.length > maxScalarBytes))
+            throw new E('invalid signature: integer too large');
+        return { r: int.decode(rBytes), s: int.decode(sBytes) };
+    },
+    hexFromSig(sig) {
+        const { _tlv: tlv, _int: int } = _DER;
+        validateObject(sig, { r: 'bigint', s: 'bigint' }, {}, 'sig');
+        const rs = tlv.encode(0x02, int.encode(sig.r));
+        const ss = tlv.encode(0x02, int.encode(sig.s));
+        const seq = rs + ss;
+        return tlv.encode(0x30, seq);
+    },
+};
+/**
+ * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:
+ *
+ *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]
+ *
+ * Docs: {@link https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/ | Let's Encrypt ASN.1 guide} and
+ * {@link https://luca.ntop.org/Teaching/Appunti/asn1.html | Luca Deri's ASN.1 notes}.
+ * @example
+ * ASN.1 DER encoding utilities.
+ *
+ * ```ts
+ * const der = DER.hexFromSig({ r: 1n, s: 2n });
+ * ```
+ */
+const DER = /* @__PURE__ */ (() => {
+    Object.freeze(_DER._tlv);
+    Object.freeze(_DER._int);
+    return Object.freeze(_DER);
+})();
+
+/**
+ * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.
+ *
+ * ### Design rationale for types
+ *
+ * * Interaction between classes from different curves should fail:
+ *   `k256.Point.BASE.add(p256.Point.BASE)`
+ * * For this purpose we want to use `instanceof` operator, which is fast and works during runtime
+ * * Different calls of `curve()` would return different classes -
+ *   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,
+ *   it won't affect others
+ *
+ * TypeScript can't infer types for classes created inside a function. Classes is one instance
+ * of nominative types in TypeScript and interfaces only check for shape, so it's hard to create
+ * unique type for every function call.
+ *
+ * We can use generic types via some param, like curve opts, but that would:
+ *     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)
+ *     which is hard to debug.
+ *     2. Params can be generic and we can't enforce them to be constant value:
+ *     if somebody creates curve from non-constant params,
+ *     it would be allowed to interact with other curves with non-constant params
+ *
+ * @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+// We construct the basis so `den` is always positive and equals `n`,
+// but the `num` sign depends on the basis, not on the secret value.
+// Exact half-way cases round away from zero, which keeps the split symmetric
+// around the reduced-basis boundaries used by endomorphism decomposition.
+const divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n) / den;
+/** Splits scalar for GLV endomorphism. */
+function _splitEndoScalar(k, basis, n) {
+    // Split scalar into two such that part is ~half bits: `abs(part) < sqrt(N)`
+    // Since part can be negative, we need to do this on point.
+    // Callers must provide a reduced GLV basis whose vectors satisfy
+    // `a + b * lambda ≡ 0 (mod n)`; this helper only sees the basis and `n`.
+    // Reject unreduced scalars instead of silently treating them mod n.
+    aInRange('scalar', k, _0n, n);
+    // TODO: verifyScalar function which consumes lambda
+    const [[a1, b1], [a2, b2]] = basis;
+    const c1 = divNearest(b2 * k, n);
+    const c2 = divNearest(-b1 * k, n);
+    // |k1|/|k2| is < sqrt(N), but can be negative.
+    // If we do `k1 mod N`, we'll get big scalar (`> sqrt(N)`): so, we do cheaper negation instead.
+    let k1 = k - c1 * a1 - c2 * a2;
+    let k2 = -c1 * b1 - c2 * b2;
+    const k1neg = k1 < _0n;
+    const k2neg = k2 < _0n;
+    if (k1neg)
+        k1 = -k1;
+    if (k2neg)
+        k2 = -k2;
+    // Double check that resulting scalar is less than half bits of N: the wNAF pair walk
+    // relies on the halves being short. This should only happen on wrong bases.
+    // Also, the math inside is complex enough that this guard is worth keeping.
+    const MAX_NUM = bitMask(Math.ceil(bitLen(n) / 2)) + _1n; // Half bits of N
+    if (k1 < _0n || k1 >= MAX_NUM || k2 < _0n || k2 >= MAX_NUM) {
+        throw new Error('splitScalar (endomorphism): failed for k');
+    }
+    return { k1neg, k1, k2neg, k2 };
+}
+function validateSigFormat(format) {
+    if (!['compact', 'recovered', 'der'].includes(format))
+        throw new Error('Signature format must be "compact", "recovered", or "der"');
+    return format;
+}
+function validateSigOpts(opts, def) {
+    validateObject(opts);
+    const optsn = {};
+    // Normalize only the declared option subset from `def`; unknown keys are
+    // intentionally ignored so shared / superset option bags stay valid here too.
+    // `extraEntropy` stays an opaque payload until the signing path consumes it.
+    for (let optName of Object.keys(def)) {
+        // @ts-ignore
+        optsn[optName] = opts[optName] === undefined ? def[optName] : opts[optName];
+    }
+    abool(optsn.lowS, 'lowS');
+    abool(optsn.prehash, 'prehash');
+    if (optsn.format !== undefined)
+        validateSigFormat(optsn.format);
+    return optsn;
+}
+// Be friendly to bad ECMAScript parsers by not using bigint literals
+// prettier-ignore
+const _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _3n = /* @__PURE__ */ BigInt(3), _4n = /* @__PURE__ */ BigInt(4);
+/**
+ * Creates weierstrass Point constructor, based on specified curve options.
+ *
+ * See {@link WeierstrassOpts}.
+ * @param params - Curve parameters. See {@link WeierstrassOpts}.
+ * @param extraOpts - Optional helpers and overrides. See {@link WeierstrassExtraOpts}.
+ * @returns Weierstrass point constructor.
+ * @throws If the curve parameters, overrides, or point codecs are invalid. {@link Error}
+ *
+ * @example
+ * Construct a point type from explicit Weierstrass curve parameters.
+ *
+ * ```js
+ * const opts = {
+ *   p: 0xfffffffffffffffffffffffffffffffeffffac73n,
+ *   n: 0x100000000000000000001b8fa16dfab9aca16b6b3n,
+ *   h: 1n,
+ *   a: 0n,
+ *   b: 7n,
+ *   Gx: 0x3b4c382ce37aa192a4019e763036f4f5dd4d7ebbn,
+ *   Gy: 0x938cf935318fdced6bc28286531733c3f03c4feen,
+ * };
+ * const secp160k1_Point = weierstrass(opts);
+ * ```
+ */
+function weierstrass(params, extraOpts = {}) {
+    const validated = createCurveFields('weierstrass', params, extraOpts);
+    const Fp = validated.Fp;
+    const Fn = validated.Fn;
+    let CURVE = validated.CURVE;
+    const { h: cofactor, n: CURVE_ORDER } = CURVE;
+    validateObject(extraOpts, {}, {
+        allowInfinityPoint: 'boolean',
+        clearCofactor: 'function',
+        isTorsionFree: 'function',
+        fromBytes: 'function',
+        toBytes: 'function',
+        endo: 'object',
+        randomBytes: 'function',
+    });
+    // Snapshot every hook and take an owned copy of nested GLV configuration. Later mutations of
+    // the caller's options must not change arithmetic, subgroup, or codec policy.
+    const { endo: endoOpts, allowInfinityPoint, clearCofactor, isTorsionFree, fromBytes, toBytes, } = extraOpts;
+    const randomBytes$1 = extraOpts.randomBytes === undefined ? randomBytes : extraOpts.randomBytes;
+    if (endoOpts) {
+        if (!Fp.is0(CURVE.a) || typeof endoOpts.beta !== 'bigint' || !Array.isArray(endoOpts.basises)) {
+            throw new Error('invalid endo: expected "beta": bigint and "basises": array');
+        }
+    }
+    const endo = endoOpts
+        ? {
+            beta: endoOpts.beta,
+            basises: endoOpts.basises.map((basis) => [...basis]),
+        }
+        : undefined;
+    const lengths = getWLengths(Fp, Fn);
+    function assertCompressionIsSupported() {
+        if (!Fp.isOdd)
+            throw new Error('compression is not supported: Field does not have .isOdd()');
+    }
+    // Implements IEEE P1363 point encoding
+    function pointToBytes(_c, point, isCompressed) {
+        // Handle infinity before toAffine(), which maps ZERO to (0, 0) silently: without this the
+        // encoder would emit an all-zero byte string that decodes back as a different point. Only
+        // curves that opt into infinity as a public point value get the SEC 1 byte form.
+        if (point.is0()) {
+            if (!allowInfinityPoint)
+                throw new Error('bad point: ZERO');
+            return Uint8Array.of(0); // SEC 1 v2.0 §2.3.3
+        }
+        const { x, y } = point.toAffine();
+        const bx = Fp.toBytes(x);
+        abool(isCompressed, 'isCompressed');
+        if (isCompressed) {
+            assertCompressionIsSupported();
+            const hasEvenY = !Fp.isOdd(y);
+            return concatBytes(pprefix(hasEvenY), bx);
+        }
+        else {
+            return concatBytes(Uint8Array.of(0x04), bx, Fp.toBytes(y));
+        }
+    }
+    function pointFromBytes(bytes) {
+        abytes(bytes, undefined, 'Point');
+        const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65
+        const length = bytes.length;
+        const head = bytes[0];
+        const tail = bytes.subarray(1);
+        // SEC 1 v2.0 §2.3.4 decodes 0x00 as infinity, but §3.2.2 rejects infinity as a public key.
+        // Leaving 0x00 undecodable by default makes that rejection structural rather than a check:
+        // callers reuse this parser as the strict key boundary, and infinity is simply not
+        // expressible. Curves where infinity is a real wire value opt into the codec instead.
+        // secp256k1 crosstests show OpenSSL raw point codecs accept 0x00 too.
+        if (allowInfinityPoint && length === 1 && head === 0x00)
+            return { x: Fp.ZERO, y: Fp.ZERO };
+        // No actual validation is done here: use .assertValidity()
+        if (length === comp && (head === 0x02 || head === 0x03)) {
+            const x = Fp.fromBytes(tail);
+            if (!Fp.isValid(x))
+                throw new Error('bad point: is not on curve, wrong x');
+            const y2 = weierstrassEquation(x); // y² = x³ + ax + b
+            let y;
+            try {
+                y = Fp.sqrt(y2); // y = y² ^ (p+1)/4
+            }
+            catch (sqrtError) {
+                const err = sqrtError instanceof Error ? ': ' + sqrtError.message : '';
+                throw new Error('bad point: is not on curve, sqrt error' + err);
+            }
+            assertCompressionIsSupported();
+            const evenY = Fp.isOdd(y);
+            const evenH = (head & 1) === 1; // ECDSA-specific
+            if (evenH !== evenY)
+                y = Fp.neg(y);
+            return { x, y };
+        }
+        else if (length === uncomp && head === 0x04) {
+            // TODO: more checks
+            const L = Fp.BYTES;
+            const x = Fp.fromBytes(tail.subarray(0, L));
+            const y = Fp.fromBytes(tail.subarray(L, L * 2));
+            if (!isValidXY(x, y))
+                throw new Error('bad point: is not on curve');
+            return { x, y };
+        }
+        else {
+            throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);
+        }
+    }
+    const encodePoint = toBytes === undefined ? pointToBytes : toBytes;
+    const decodePoint = fromBytes === undefined ? pointFromBytes : fromBytes;
+    // Hoisted from double() / add(): curve params never change after construction.
+    // Koblitz curves (a=0, e.g. secp256k1) skip the three a-multiplications per operation;
+    // the selection depends only on public curve constants.
+    const b3 = Fp.mul(CURVE.b, _3n);
+    const mulA = Fp.is0(CURVE.a) ? (_) => Fp.ZERO : (x) => Fp.mul(CURVE.a, x);
+    function weierstrassEquation(x) {
+        const x2 = Fp.sqr(x);
+        const x3 = Fp.mul(x2, x);
+        return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b); // x³ + a * x + b
+    }
+    // TODO: move top-level
+    /** Checks whether equation holds for given x, y: y² == x³ + ax + b */
+    function isValidXY(x, y) {
+        const left = Fp.sqr(y);
+        const right = weierstrassEquation(x); // x³ + ax + b
+        return Fp.eql(left, right);
+    }
+    // Keep constructor-time generator validation cheap: callers are responsible for supplying the
+    // correct prime-order base point, while eager subgroup checks here would slow heavy module imports.
+    // Test 1: equation y² = x³ + ax + b should work for generator point.
+    if (!isValidXY(CURVE.Gx, CURVE.Gy))
+        throw new Error('bad curve params: generator point');
+    // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.
+    // Guarantees curve is genus-1, smooth (non-singular).
+    const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);
+    const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));
+    if (Fp.is0(Fp.add(_4a3, _27b2)))
+        throw new Error('bad curve params: a or b');
+    /** Asserts coordinate is valid: 0 <= n < Fp.ORDER. */
+    function acoord(title, n, banZero = false) {
+        if (!Fp.isValid(n) || (banZero && Fp.is0(n)))
+            throw new Error(`bad point coordinate ${title}`);
+        // Extension-field elements are objects. Keep point coordinates detached from caller-owned
+        // objects so their mutation cannot invalidate cached on-curve / subgroup checks. Primitive
+        // field elements (bigints in shipped prime fields) are already immutable values.
+        return typeof n === 'object' && n !== null ? Fp.create(n) : n;
+    }
+    function aprjpoint(other) {
+        if (!(other instanceof Point))
+            throw new Error('Weierstrass Point expected');
+    }
+    function splitEndoScalarN(k) {
+        if (!endo || !endo.basises)
+            throw new Error('no endo');
+        return _splitEndoScalar(k, endo.basises, Fn.ORDER);
+    }
+    /**
+     * Appends a (point, scalar) pair to the inputs of a vartime wNAF walk
+     * ({@link mulAddUnsafe}). With GLV endomorphism the scalar is split into two half-width
+     * pairs against P and ψ(P) = (β⋅x, y), halving the walk's shared doubling chain;
+     * split signs fold into the points.
+     */
+    function pushWnafPair(points, scalars, p, k) {
+        if (!Fn.isValid(k))
+            throw new RangeError('invalid scalar: out of range'); // 0 is valid
+        if (endo) {
+            const { k1neg, k1, k2neg, k2 } = splitEndoScalarN(k);
+            const psi = new Point(Fp.mul(p.X, endo.beta), p.Y, p.Z);
+            points.push(k1neg ? p.negate() : p, k2neg ? psi.negate() : psi);
+            scalars.push(k1, k2);
+        }
+        else {
+            points.push(p);
+            scalars.push(k);
+        }
+    }
+    // Successful assertValidity() results are cached: Point instances are frozen at construction,
+    // so on-curve + subgroup facts cannot change afterwards. Only success is cached — invalid
+    // points re-throw on every call. This matters most for pairing curves, where subgroup checks
+    // cost a scalar multiplication and the same instance is re-validated across layers
+    // (signature fromBytes, pairingBatch) or across repeated verifies with a cached public key.
+    const validityCache = new WeakSet();
+    /**
+     * Projective Point works in 3d / projective (homogeneous) coordinates:(X, Y, Z) ∋ (x=X/Z, y=Y/Z).
+     * Default Point works in 2d / affine coordinates: (x, y).
+     * We're doing calculations in projective, because its operations don't require costly inversion.
+     */
+    class Point {
+        static BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);
+        static ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO);
+        static Fp = Fp;
+        static Fn = Fn;
+        X;
+        Y;
+        Z;
+        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
+        constructor(X, Y, Z) {
+            this.X = acoord('x', X);
+            // This is not just about ZERO / infinity: ambient curves can have real
+            // finite points with y=0. Those points are 2-torsion, so they cannot lie
+            // in the odd prime-order subgroups this point type is meant to represent.
+            this.Y = acoord('y', Y, true);
+            this.Z = acoord('z', Z);
+            Object.freeze(this);
+        }
+        static CURVE() {
+            return CURVE;
+        }
+        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
+        static fromAffine(p) {
+            const { x, y } = p || {};
+            if (!p || !Fp.isValid(x) || !Fp.isValid(y))
+                throw new Error('invalid affine point');
+            if (p instanceof Point)
+                throw new Error('projective point not allowed');
+            // (0, 0) would've produced (0, 0, 1) - instead, we need (0, 1, 0)
+            if (Fp.is0(x) && Fp.is0(y))
+                return Point.ZERO;
+            return new Point(x, y, Fp.ONE);
+        }
+        static fromBytes(bytes) {
+            const P = Point.fromAffine(decodePoint(abytes(bytes, undefined, 'point')));
+            P.assertValidity();
+            return P;
+        }
+        static fromHex(hex) {
+            return Point.fromBytes(hexToBytes(hex));
+        }
+        get x() {
+            return this.toAffine().x;
+        }
+        get y() {
+            return this.toAffine().y;
+        }
+        /**
+         * @param isLazy - true will defer table computation until the first multiplication
+         */
+        precompute(windowSize = 6, isLazy = true) {
+            wnaf.setWindowSize(this, windowSize);
+            if (!isLazy)
+                this.multiply(_3n); // random number
+            return this;
+        }
+        // TODO: return `this`
+        /** A point on curve is valid if it conforms to equation. */
+        assertValidity() {
+            const p = this;
+            if (p.is0()) {
+                // (0, 1, 0) aka ZERO is invalid in most contexts.
+                // In BLS, ZERO can be serialized, so we allow it.
+                // Keep the accepted infinity encoding canonical: projective-equivalent (X, Y, 0) points
+                // like (1, 1, 0) compare equal to ZERO, but only (0, 1, 0) should pass this guard.
+                if (allowInfinityPoint && Fp.is0(p.X) && Fp.eql(p.Y, Fp.ONE) && Fp.is0(p.Z))
+                    return;
+                throw new Error('bad point: ZERO');
+            }
+            if (validityCache.has(p))
+                return;
+            // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`
+            const { x, y } = p.toAffine();
+            if (!Fp.isValid(x) || !Fp.isValid(y))
+                throw new Error('bad point: x or y not field elements');
+            if (!isValidXY(x, y))
+                throw new Error('bad point: equation left != right');
+            if (!p.isTorsionFree())
+                throw new Error('bad point: not in prime-order subgroup');
+            validityCache.add(p);
+        }
+        hasEvenY() {
+            const { y } = this.toAffine();
+            if (!Fp.isOdd)
+                throw new Error("Field doesn't support isOdd");
+            return !Fp.isOdd(y);
+        }
+        /** Compare one point to another. */
+        equals(other) {
+            aprjpoint(other);
+            const { X: X1, Y: Y1, Z: Z1 } = this;
+            const { X: X2, Y: Y2, Z: Z2 } = other;
+            const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));
+            const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));
+            return U1 && U2;
+        }
+        /** Flips point to one corresponding to (x, -y) in Affine coordinates. */
+        negate() {
+            return new Point(this.X, Fp.neg(this.Y), this.Z);
+        }
+        // Renes-Costello-Batina exception-free doubling formula.
+        // There is 30% faster Jacobian formula, but it is not complete.
+        // https://eprint.iacr.org/2015/1060, algorithm 3
+        // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
+        double() {
+            const { X: X1, Y: Y1, Z: Z1 } = this;
+            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore
+            let t0 = Fp.mul(X1, X1); // step 1
+            let t1 = Fp.mul(Y1, Y1);
+            let t2 = Fp.mul(Z1, Z1);
+            let t3 = Fp.mul(X1, Y1);
+            t3 = Fp.add(t3, t3); // step 5
+            Z3 = Fp.mul(X1, Z1);
+            Z3 = Fp.add(Z3, Z3);
+            X3 = mulA(Z3);
+            Y3 = Fp.mul(b3, t2);
+            Y3 = Fp.add(X3, Y3); // step 10
+            X3 = Fp.sub(t1, Y3);
+            Y3 = Fp.add(t1, Y3);
+            Y3 = Fp.mul(X3, Y3);
+            X3 = Fp.mul(t3, X3);
+            Z3 = Fp.mul(b3, Z3); // step 15
+            t2 = mulA(t2);
+            t3 = Fp.sub(t0, t2);
+            t3 = mulA(t3);
+            t3 = Fp.add(t3, Z3);
+            Z3 = Fp.add(t0, t0); // step 20
+            t0 = Fp.add(Z3, t0);
+            t0 = Fp.add(t0, t2);
+            t0 = Fp.mul(t0, t3);
+            Y3 = Fp.add(Y3, t0);
+            t2 = Fp.mul(Y1, Z1); // step 25
+            t2 = Fp.add(t2, t2);
+            t0 = Fp.mul(t2, t3);
+            X3 = Fp.sub(X3, t0);
+            Z3 = Fp.mul(t2, t1);
+            Z3 = Fp.add(Z3, Z3); // step 30
+            Z3 = Fp.add(Z3, Z3);
+            return new Point(X3, Y3, Z3);
+        }
+        // Renes-Costello-Batina exception-free addition formula.
+        // There is 30% faster Jacobian formula, but it is not complete.
+        // https://eprint.iacr.org/2015/1060, algorithm 1
+        // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
+        add(other) {
+            aprjpoint(other);
+            const { X: X1, Y: Y1, Z: Z1 } = this;
+            const { X: X2, Y: Y2, Z: Z2 } = other;
+            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore
+            let t0 = Fp.mul(X1, X2); // step 1
+            let t1 = Fp.mul(Y1, Y2);
+            let t2 = Fp.mul(Z1, Z2);
+            let t3 = Fp.add(X1, Y1);
+            let t4 = Fp.add(X2, Y2); // step 5
+            t3 = Fp.mul(t3, t4);
+            t4 = Fp.add(t0, t1);
+            t3 = Fp.sub(t3, t4);
+            t4 = Fp.add(X1, Z1);
+            let t5 = Fp.add(X2, Z2); // step 10
+            t4 = Fp.mul(t4, t5);
+            t5 = Fp.add(t0, t2);
+            t4 = Fp.sub(t4, t5);
+            t5 = Fp.add(Y1, Z1);
+            X3 = Fp.add(Y2, Z2); // step 15
+            t5 = Fp.mul(t5, X3);
+            X3 = Fp.add(t1, t2);
+            t5 = Fp.sub(t5, X3);
+            Z3 = mulA(t4);
+            X3 = Fp.mul(b3, t2); // step 20
+            Z3 = Fp.add(X3, Z3);
+            X3 = Fp.sub(t1, Z3);
+            Z3 = Fp.add(t1, Z3);
+            Y3 = Fp.mul(X3, Z3);
+            t1 = Fp.add(t0, t0); // step 25
+            t1 = Fp.add(t1, t0);
+            t2 = mulA(t2);
+            t4 = Fp.mul(b3, t4);
+            t1 = Fp.add(t1, t2);
+            t2 = Fp.sub(t0, t2); // step 30
+            t2 = mulA(t2);
+            t4 = Fp.add(t4, t2);
+            t0 = Fp.mul(t1, t4);
+            Y3 = Fp.add(Y3, t0);
+            t0 = Fp.mul(t5, t4); // step 35
+            X3 = Fp.mul(t3, X3);
+            X3 = Fp.sub(X3, t0);
+            t0 = Fp.mul(t3, t1);
+            Z3 = Fp.mul(t5, Z3);
+            Z3 = Fp.add(Z3, t0); // step 40
+            return new Point(X3, Y3, Z3);
+        }
+        subtract(other) {
+            // Validate before calling `negate()` so wrong inputs fail with the point guard
+            // instead of leaking a foreign `negate()` error.
+            aprjpoint(other);
+            return this.add(other.negate());
+        }
+        is0() {
+            return this.equals(Point.ZERO);
+        }
+        /**
+         * Constant time multiplication.
+         * Uses precomputed tables (signed fixed-window wNAF) when available.
+         * Uses scalar blinding and avoids endomorphism splitting in the secret-scalar path.
+         * @param scalar - by which the point would be multiplied
+         * @returns New point
+         */
+        multiply(scalar) {
+            // Keep the subgroup-scalar contract strict instead of reducing 0 / n to ZERO.
+            // In key/signature-style callers, those values usually mean broken hash/scalar plumbing,
+            // and failing closed is safer than silently producing the identity point.
+            if (!Fn.isValidNot0(scalar))
+                throw new RangeError('invalid scalar: out of range'); // 0 is invalid
+            const { p, f } = wnaf.mulSecret(this, scalar, cofactor, normalize);
+            return normalize([p, f])[0];
+        }
+        /**
+         * Non-constant-time multiplication. Uses width-4 wNAF with GLV endomorphism splitting
+         * when available (two half-width scalars sharing one halved doubling chain).
+         * It's faster, but should only be used when you don't care about
+         * an exposed secret key e.g. sig verification, which works over *public* keys.
+         */
+        multiplyUnsafe(scalar) {
+            const p = this;
+            const sc = scalar;
+            // Public-scalar callers may need 0, but n and larger values stay rejected here too.
+            // Reducing them mod n would turn bad caller input into an accidental identity point.
+            if (!Fn.isValid(sc))
+                throw new RangeError('invalid scalar: out of range'); // 0 is valid
+            if (sc === _0n || p.is0())
+                return Point.ZERO;
+            if (sc === _1n)
+                return p;
+            if (wnaf.hasWindowSize(this))
+                return wnaf.mulUnsafe(p, sc, normalize); // precomputes
+            const points = [];
+            const scalars = [];
+            pushWnafPair(points, scalars, p, sc);
+            return mulAddUnsafe(Point, points, scalars);
+        }
+        /**
+         * Non-constant-time double-scalar multiplication `a⋅this + b⋅other` (Strauss–Shamir).
+         * Both walks share one doubling chain via {@link mulAddUnsafe}, and GLV endomorphism
+         * (when available) halves the chain again by splitting each scalar into two half-width
+         * parts. Used by ECDSA verification and public-key recovery for `R = u1⋅G + u2⋅P`.
+         * Only for public scalars.
+         */
+        mulAddUnsafe(a, other, b) {
+            aprjpoint(other);
+            const points = [];
+            const scalars = [];
+            pushWnafPair(points, scalars, this, a);
+            pushWnafPair(points, scalars, other, b);
+            return mulAddUnsafe(Point, points, scalars);
+        }
+        /**
+         * Converts Projective point to affine (x, y) coordinates.
+         * (X, Y, Z) ∋ (x=X/Z, y=Y/Z).
+         * @param invertedZ - Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch
+         */
+        toAffine(invertedZ) {
+            const p = this;
+            let iz = invertedZ;
+            if (iz != null && !Fp.isValid(iz))
+                throw new RangeError('"invertedZ" expected valid field element');
+            const { X, Y, Z } = p;
+            // Fast-path for normalized points
+            if (Fp.eql(Z, Fp.ONE))
+                return { x: X, y: Y };
+            const is0 = p.is0();
+            // If invZ was 0, we return zero point. However we still want to execute
+            // all operations, so we replace invZ with a random number, 1.
+            if (iz == null)
+                iz = is0 ? Fp.ONE : Fp.inv(Z);
+            const x = Fp.mul(X, iz);
+            const y = Fp.mul(Y, iz);
+            const zz = Fp.mul(Z, iz);
+            if (is0)
+                return { x: Fp.ZERO, y: Fp.ZERO };
+            if (!Fp.eql(zz, Fp.ONE))
+                throw new Error('invZ was invalid');
+            return { x, y };
+        }
+        /**
+         * Checks whether Point is free of torsion elements (is in prime subgroup).
+         * Always torsion-free for cofactor=1 curves.
+         */
+        isTorsionFree() {
+            if (cofactor === _1n)
+                return true;
+            if (isTorsionFree)
+                return isTorsionFree(Point, this);
+            // unsafe() will use the uncached wNAF path internally, since CURVE_ORDER >= Fn.ORDER
+            return wnaf.mulUnsafe(this, CURVE_ORDER).is0();
+        }
+        clearCofactor() {
+            if (cofactor === _1n)
+                return this; // Fast-path
+            if (clearCofactor)
+                return clearCofactor(Point, this);
+            // Default fallback assumes the cofactor fits the usual subgroup-scalar
+            // multiplyUnsafe() contract. Curves with larger / structured cofactors
+            // should define a clearCofactor override anyway (e.g. psi/Frobenius maps).
+            return this.multiplyUnsafe(cofactor);
+        }
+        isSmallOrder() {
+            if (cofactor === _1n)
+                return this.is0(); // Fast-path
+            return this.clearCofactor().is0();
+        }
+        toBytes(isCompressed = true) {
+            abool(isCompressed, 'isCompressed');
+            // assertValidity() covers on-curve and subgroup membership. The encoder below repeats the
+            // infinity check rather than relying on this call, so it stays correct for any caller.
+            this.assertValidity();
+            return encodePoint(Point, this, isCompressed);
+        }
+        toHex(isCompressed = true) {
+            return bytesToHex(this.toBytes(isCompressed));
+        }
+        toString() {
+            return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;
+        }
+    }
+    const normalize = (points) => normalizeZ(Point, points);
+    const wnaf = new ScalarMultiplier(Point, randomBytes$1);
+    // Enable W=6 wNAF precomputes. Slows down first publicKey computation.
+    // Disable for tiny toy curves, with scalar fields < 6 bits.
+    if (wnaf.bits >= 6)
+        Point.BASE.precompute(6);
+    Object.freeze(Point.prototype);
+    Object.freeze(Point);
+    return Point;
+}
+// Points start with byte 0x02 when y is even; otherwise 0x03
+function pprefix(hasEvenY) {
+    return Uint8Array.of(hasEvenY ? 0x02 : 0x03);
+}
+function getWLengths(Fp, Fn) {
+    return {
+        secretKey: Fn.BYTES,
+        publicKey: 1 + Fp.BYTES,
+        publicKeyUncompressed: 1 + 2 * Fp.BYTES,
+        publicKeyHasPrefix: true,
+        // Raw compact `(r || s)` signature width; DER and recovered signatures use
+        // different lengths outside this helper.
+        signature: 2 * Fn.BYTES,
+    };
+}
+/**
+ * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.
+ * This helper ensures no signature functionality is present. Less code, smaller bundle size.
+ * @param Point - Weierstrass point constructor.
+ * @param ecdhOpts - Optional randomness helpers:
+ *   - `randomBytes` (optional): Optional RNG override.
+ * @returns ECDH helper namespace.
+ * @example
+ * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.
+ *
+ * ```ts
+ * import { ecdh } from '@noble/curves/abstract/weierstrass.js';
+ * import { p256 } from '@noble/curves/nist.js';
+ * const dh = ecdh(p256.Point);
+ * const alice = dh.keygen();
+ * const shared = dh.getSharedSecret(alice.secretKey, alice.publicKey);
+ * ```
+ */
+function ecdh(Point, ecdhOpts = {}) {
+    validatePointCons(Point);
+    const { Fn } = Point;
+    const randomBytes_ = ecdhOpts.randomBytes === undefined ? randomBytes : ecdhOpts.randomBytes;
+    // Keep the advertised seed length aligned with mapHashToField(), which keeps a hard 16-byte
+    // minimum even on toy curves.
+    const lengths = Object.assign(getWLengths(Point.Fp, Fn), {
+        seed: Math.max(getMinHashLength(Fn.ORDER), 16),
+    });
+    function isValidSecretKey(secretKey) {
+        try {
+            const num = Fn.fromBytes(secretKey);
+            return Fn.isValidNot0(num);
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    function isValidPublicKey(publicKey, isCompressed) {
+        const { publicKey: comp, publicKeyUncompressed } = lengths;
+        try {
+            const l = publicKey.length;
+            if (isCompressed === true && l !== comp)
+                return false;
+            if (isCompressed === false && l !== publicKeyUncompressed)
+                return false;
+            // SEC 1 §3.2.2: the identity is never a valid public key, even on curves whose codec
+            // can decode it.
+            return !Point.fromBytes(publicKey).is0();
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    /**
+     * Produces cryptographically secure secret key from random of size
+     * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.
+     */
+    function randomSecretKey(seed) {
+        seed = seed === undefined ? randomBytes_(lengths.seed) : seed;
+        return mapHashToField(abytes(seed, lengths.seed, 'seed'), Fn.ORDER);
+    }
+    /**
+     * Computes public key for a secret key. Checks for validity of the secret key.
+     * @param isCompressed - whether to return compact (default), or full key
+     * @returns Public key, full when isCompressed=false; short when isCompressed=true
+     */
+    function getPublicKey(secretKey, isCompressed = true) {
+        return Point.BASE.multiply(Fn.fromBytes(secretKey)).toBytes(isCompressed);
+    }
+    /**
+     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.
+     */
+    function isProbPub(item) {
+        const { secretKey, publicKey, publicKeyUncompressed } = lengths;
+        const allowedLengths = Fn._lengths;
+        if (!isBytes(item))
+            return undefined;
+        const l = abytes(item, undefined, 'key').length;
+        const isPub = l === publicKey || l === publicKeyUncompressed;
+        const isSec = l === secretKey || !!allowedLengths?.includes(l);
+        // P-521 accepts both 65- and 66-byte secret keys, so overlapping lengths stay ambiguous.
+        if (isPub && isSec)
+            return undefined;
+        return isPub;
+    }
+    /**
+     * ECDH (Elliptic Curve Diffie Hellman).
+     * Computes encoded shared point from secret key A and public key B.
+     * Checks: 1) secret key validity 2) shared key is on-curve.
+     * Does NOT hash the result or expose the SEC 1 x-coordinate-only `z`.
+     * Returns the encoded shared point on purpose: callers that need `x_P`
+     * can derive it from the encoded point, but `x_P` alone cannot recover the
+     * point/parity back.
+     * This helper only exposes the fully validated public-key path, not cofactor DH.
+     * @param isCompressed - whether to return compact (default), or full key
+     * @returns shared point encoding
+     */
+    function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {
+        if (isProbPub(secretKeyA) === true)
+            throw new Error('first arg must be private key');
+        if (isProbPub(publicKeyB) === false)
+            throw new Error('second arg must be public key');
+        const s = Fn.fromBytes(secretKeyA);
+        const b = Point.fromBytes(publicKeyB); // checks for being on-curve
+        if (b.is0())
+            throw new Error('invalid public key: point at infinity');
+        return b.multiply(s).toBytes(isCompressed);
+    }
+    const utils = {
+        isValidSecretKey,
+        isValidPublicKey,
+        randomSecretKey,
+    };
+    const keygen = createKeygen(randomSecretKey, getPublicKey);
+    Object.freeze(utils);
+    Object.freeze(lengths);
+    return Object.freeze({ getPublicKey, getSharedSecret, keygen, Point, utils, lengths });
+}
+/**
+ * Creates ECDSA signing interface for given elliptic curve `Point` and `hash` function.
+ *
+ * @param Point - created using {@link weierstrass} function
+ * @param hash - used for 1) message prehash-ing 2) k generation in `sign`, using hmac_drbg(hash)
+ * @param ecdsaOpts - rarely needed, see {@link ECDSAOpts}:
+ *   - `lowS`: Default low-S policy.
+ *   - `hmac`: HMAC implementation used by RFC6979 DRBG.
+ *   - `randomBytes`: Optional RNG override.
+ *   - `bits2int`: Optional hash-to-int conversion override.
+ *   - `bits2int_modN`: Optional hash-to-int-mod-n conversion override.
+ *
+ * @returns ECDSA helper namespace.
+ * @example
+ * Create an ECDSA signer/verifier bundle for one curve implementation.
+ *
+ * ```ts
+ * import { ecdsa } from '@noble/curves/abstract/weierstrass.js';
+ * import { p256 } from '@noble/curves/nist.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const p256ecdsa = ecdsa(p256.Point, sha256);
+ * const { secretKey, publicKey } = p256ecdsa.keygen();
+ * const msg = new TextEncoder().encode('hello noble');
+ * const sig = p256ecdsa.sign(msg, secretKey);
+ * const isValid = p256ecdsa.verify(sig, msg, publicKey);
+ * ```
+ */
+function ecdsa(Point, hash, ecdsaOpts = {}) {
+    validatePointCons(Point);
+    // Custom hash / bits2int hooks are treated as pure functions over validated caller-owned bytes.
+    const hash_ = hash;
+    ahash(hash_);
+    validateObject(ecdsaOpts, {}, {
+        hmac: 'function',
+        lowS: 'boolean',
+        randomBytes: 'function',
+        bits2int: 'function',
+        bits2int_modN: 'function',
+    });
+    const opts = Object.assign({}, ecdsaOpts);
+    const randomBytes$1 = opts.randomBytes === undefined ? randomBytes : opts.randomBytes;
+    const hmac$1 = opts.hmac === undefined
+        ? (key, msg) => hmac(hash_, key, msg)
+        : opts.hmac;
+    const { Fp, Fn } = Point;
+    const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
+    // Nonce-inversion blinding in k2sig draws `getMinHashLength(n)` bytes per sign. Probe the RNG
+    // once (see {@link probeRandomBytes}, shared with ScalarMultiplier): in environments without
+    // working randomness, signing downgrades to Fermat inversion (invertCt) instead of throwing on
+    // every sign(). The shape of returned bytes is still validated (by mapHashToField) on every
+    // blinded call, where breakage fails closed.
+    const blindLength = getMinHashLength(CURVE_ORDER);
+    const csprng = probeRandomBytes(randomBytes$1, blindLength);
+    const { keygen, getPublicKey, getSharedSecret, utils, lengths } = ecdh(Point, opts);
+    const defaultSigOpts = {
+        prehash: true,
+        lowS: typeof opts.lowS === 'boolean' ? opts.lowS : true,
+        format: 'compact',
+        extraEntropy: false,
+    };
+    // SEC 1 4.1.6 public-key recovery tries x = r + jn for j = 0..h. Our recovered-signature
+    // format only stores one overflow bit, so it can only distinguish q.x = r from q.x = r + n.
+    // A third lift would have the form q.x = r + 2n. Since valid ECDSA r is in 1..n-1, the
+    // smallest such lift is 1 + 2n, not 2n.
+    const hasLargeRecoveryLifts = CURVE_ORDER * _2n + _1n < Fp.ORDER;
+    function isBiggerThanHalfOrder(number) {
+        const HALF = CURVE_ORDER >> _1n;
+        return number > HALF;
+    }
+    function validateRS(title, num) {
+        if (!Fn.isValidNot0(num))
+            throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);
+        return num;
+    }
+    function assertFieldSignIsSupported() {
+        if (!Fp.isOdd)
+            throw new Error("Field doesn't support isOdd");
+    }
+    // Recovery id of an affine point (x, y) whose x reduces to signature `r` mod n:
+    // bit 0 = y parity, bit 1 = x overflowed the group order (x = r + n).
+    function getRecoveryBit(x, y, r) {
+        assertFieldSignIsSupported();
+        return (x === r ? 0 : 2) | Number(Fp.isOdd(y));
+    }
+    function assertRecoverableCurve() {
+        // ECDSA recovery only supports curves where the current recovery id can distinguish
+        // q.x = r and q.x = r + n; larger lifts may need additional `r + n*i` branches.
+        // SEC 1 4.1.6 recovers candidates via x = r + jn, but this format only encodes j = 0 or 1.
+        // The next possible candidate is q.x = r + 2n, and its smallest valid value is 1 + 2n.
+        // To easily get i, we either need to:
+        // a. increase amount of valid recid values (4, 5...); OR
+        // b. prohibit recovered signatures for those curves.
+        if (hasLargeRecoveryLifts)
+            throw new Error('"recovered" sig type is not supported for cofactor >2 curves');
+    }
+    function validateSigLength(bytes, format) {
+        validateSigFormat(format);
+        const size = lengths.signature;
+        const sizer = format === 'compact' ? size : format === 'recovered' ? size + 1 : undefined;
+        return abytes(bytes, sizer);
+    }
+    /**
+     * ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.
+     */
+    class Signature {
+        r;
+        s;
+        recovery;
+        constructor(r, s, recovery) {
+            this.r = validateRS('r', r); // r in [1..N-1];
+            this.s = validateRS('s', s); // s in [1..N-1];
+            if (recovery != null) {
+                assertRecoverableCurve();
+                if (![0, 1, 2, 3].includes(recovery))
+                    throw new Error('invalid recovery id');
+                this.recovery = recovery;
+            }
+            Object.freeze(this);
+        }
+        static fromBytes(bytes, format = defaultSigOpts.format) {
+            validateSigLength(bytes, format);
+            let recid;
+            if (format === 'der') {
+                // Valid scalar INTEGERs use at most Fn.BYTES plus one DER sign-padding byte. Keep the
+                // total bound conservative so malformed inputs are rejected before parsing any INTEGER.
+                if (bytes.length > 2 * Fn.BYTES + 16)
+                    throw new DER.Err('invalid signature: DER signature too long');
+                const { r, s } = DER.toSig(abytes(bytes), Fn.BYTES + 1);
+                return new Signature(r, s);
+            }
+            if (format === 'recovered') {
+                recid = bytes[0];
+                format = 'compact';
+                bytes = bytes.subarray(1);
+            }
+            const L = lengths.signature / 2;
+            const r = bytes.subarray(0, L);
+            const s = bytes.subarray(L, L * 2);
+            return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);
+        }
+        static fromHex(hex, format) {
+            return this.fromBytes(hexToBytes(hex), format);
+        }
+        assertRecovery() {
+            const { recovery } = this;
+            if (recovery == null)
+                throw new Error('invalid recovery id: must be present');
+            return recovery;
+        }
+        addRecoveryBit(recovery) {
+            return new Signature(this.r, this.s, recovery);
+        }
+        // Unlike the top-level helper below, this method expects a digest that has
+        // already been hashed to the curve's message representative.
+        recoverPublicKey(messageHash) {
+            const { r, s } = this;
+            const recovery = this.assertRecovery();
+            const radj = recovery === 2 || recovery === 3 ? r + CURVE_ORDER : r;
+            if (!Fp.isValid(radj))
+                throw new Error('invalid recovery id: sig.r+curve.n != R.x');
+            const x = Fp.toBytes(radj);
+            const R = Point.fromBytes(concatBytes(pprefix((recovery & 1) === 0), x));
+            const ir = Fn.inv(radj); // r^-1
+            const h = bits2int_modN(abytes(messageHash, undefined, 'msgHash')); // Truncate hash
+            const u1 = Fn.create(-h * ir); // -hr^-1
+            const u2 = Fn.create(s * ir); // sr^-1
+            // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1). unsafe is fine: there is no private data.
+            const Q = Point.BASE.mulAddUnsafe(u1, R, u2);
+            if (Q.is0())
+                throw new Error('invalid recovery: point at infinify');
+            Q.assertValidity();
+            return Q;
+        }
+        // Signatures should be low-s, to prevent malleability.
+        hasHighS() {
+            return isBiggerThanHalfOrder(this.s);
+        }
+        toBytes(format = defaultSigOpts.format) {
+            validateSigFormat(format);
+            if (format === 'der')
+                return hexToBytes(DER.hexFromSig(this));
+            const { r, s } = this;
+            const rb = Fn.toBytes(r);
+            const sb = Fn.toBytes(s);
+            if (format === 'recovered') {
+                assertRecoverableCurve();
+                return concatBytes(Uint8Array.of(this.assertRecovery()), rb, sb);
+            }
+            return concatBytes(rb, sb);
+        }
+        toHex(format) {
+            return bytesToHex(this.toBytes(format));
+        }
+    }
+    Object.freeze(Signature.prototype);
+    Object.freeze(Signature);
+    // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.
+    // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.
+    // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.
+    // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors
+    const bits2int = opts.bits2int === undefined
+        ? function bits2int_def(bytes) {
+            // Our custom check "just in case", for protection against DoS
+            if (bytes.length > 8192)
+                throw new Error('input is too large');
+            // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)
+            // for some cases, since bytes.length * 8 is not actual bitLength.
+            const num = bytesToNumberBE(bytes); // check for == u8 done here
+            const delta = bytes.length * 8 - fnBits; // truncate to nBitLength leftmost bits
+            return delta > 0 ? num >> BigInt(delta) : num;
+        }
+        : opts.bits2int;
+    const bits2int_modN = opts.bits2int_modN === undefined
+        ? function bits2int_modN_def(bytes) {
+            return Fn.create(bits2int(bytes)); // can't use bytesToNumberBE here
+        }
+        : opts.bits2int_modN;
+    const ORDER_MASK = bitMask(fnBits);
+    // Pads output with zero as per spec.
+    /** Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`. */
+    function int2octets(num) {
+        aInRange('num < 2^' + fnBits, num, _0n, ORDER_MASK);
+        return Fn.toBytes(num);
+    }
+    function validateMsgAndHash(message, prehash) {
+        abytes(message, undefined, 'message');
+        return (prehash ? abytes(hash_(message), undefined, 'prehashed message') : message);
+    }
+    /**
+     * Steps A, D of RFC6979 3.2.
+     * Creates RFC6979 seed; converts msg/privKey to numbers.
+     * Used only in sign, not in verify.
+     *
+     * Warning: we cannot assume here that message has same amount of bytes as curve order,
+     * this will be invalid at least for P521. Also it can be bigger for P224 + SHA256.
+     */
+    function prepSig(message, secretKey, opts) {
+        const { lowS, prehash, extraEntropy } = validateSigOpts(opts, defaultSigOpts);
+        message = validateMsgAndHash(message, prehash); // RFC6979 3.2 A: h1 = H(m)
+        // We can't later call bits2octets, since nested bits2int is broken for curves
+        // with fnBits % 8 !== 0. Because of that, we unwrap it here as int2octets call.
+        // const bits2octets = (bits) => int2octets(bits2int_modN(bits))
+        const h1int = bits2int_modN(message);
+        const d = Fn.fromBytes(secretKey); // validate secret key, convert to bigint
+        if (!Fn.isValidNot0(d))
+            throw new Error('invalid private key');
+        const seedArgs = [int2octets(d), int2octets(h1int)];
+        // extraEntropy. RFC6979 3.6: additional k' (optional).
+        if (extraEntropy != null && extraEntropy !== false) {
+            // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')
+            // gen random bytes OR pass as-is
+            const e = extraEntropy === true ? randomBytes$1(lengths.secretKey) : extraEntropy;
+            seedArgs.push(abytes(e, undefined, 'extraEntropy')); // check for being bytes
+        }
+        const seed = concatBytes(...seedArgs); // Step D of RFC6979 3.2
+        const m = h1int; // no need to call bits2int second time here, it is inside truncateHash!
+        // Converts signature params into point w r/s, checks result for validity.
+        // To transform k => Signature:
+        // q = k⋅G
+        // r = q.x mod n
+        // s = k^-1(m + rd) mod n
+        // The nonce inversion is blinded: with random b ∈ [1,n−1], s = (bk)^-1(bm + bdr) per
+        // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. Fn.inv()'s extended-Euclidean
+        // loop count depends on its input (cf. Minerva), but here it only ever sees b·k — uniformly
+        // random, independent of k — so its timing reveals nothing about the nonce; b also masks d in
+        // the products. Without a CSPRNG (probed in ecdsa()) we fall back to Fermat inversion
+        // (invertCt), whose control flow is data-independent, at ~4x the inversion cost.
+        function k2sig(kBytes) {
+            // RFC 6979 Section 3.2, step 3: k = bits2int(T)
+            // Important: all mod() calls here must be done over N
+            const k = bits2int(kBytes); // Cannot use fields methods, since it is group element
+            if (!Fn.isValidNot0(k))
+                return; // Valid scalars (including k) must be in 1..N-1
+            const q = Point.BASE.multiply(k).toAffine(); // q = k⋅G
+            const r = Fn.create(q.x); // r = q.x mod n
+            if (r === _0n)
+                return;
+            let s;
+            if (csprng !== undefined) {
+                // mapHashToField maps 1.5x-order-length uniform bytes into [1, n-1], negligible bias.
+                const b = bytesToNumberBE(mapHashToField(csprng(blindLength), CURVE_ORDER));
+                const ibk = Fn.inv(Fn.mul(b, k)); // (bk)^-1: inversion input is decorrelated from k
+                const bm = Fn.mul(b, m);
+                const bd = Fn.mul(b, d);
+                s = Fn.create(ibk * Fn.create(bm + bd * r)); // s = (bk)^-1(bm + bdr) = k^-1(m + rd) mod n
+            }
+            else {
+                const ik = invertCt(k, CURVE_ORDER); // k^-1 mod n with data-independent control flow
+                s = Fn.create(ik * Fn.create(m + r * d)); // s = k^-1(m + rd) mod n
+            }
+            if (s === _0n)
+                return;
+            let recovery = getRecoveryBit(q.x, q.y, r); // recovery bit (2 or 3 when q.x>n)
+            let normS = s;
+            if (lowS && isBiggerThanHalfOrder(s)) {
+                normS = Fn.neg(s); // if lowS was passed, ensure s is always in the bottom half of N
+                recovery ^= 1;
+            }
+            return new Signature(r, normS, hasLargeRecoveryLifts ? undefined : recovery);
+        }
+        return { seed, k2sig };
+    }
+    /**
+     * Signs a message or message hash with a secret key.
+     * With the default `prehash: true`, raw message bytes are hashed internally;
+     * only `{ prehash: false }` expects a caller-supplied digest.
+     *
+     * ```
+     * sign(m, d) where
+     *   k = rfc6979_hmac_drbg(m, d)
+     *   (x, y) = G × k
+     *   r = x mod n
+     *   s = (m + dr) / k mod n
+     * ```
+     */
+    function sign(message, secretKey, opts = {}) {
+        const { seed, k2sig } = prepSig(message, secretKey, opts); // Steps A, D of RFC6979 3.2.
+        const drbg = createHmacDrbg(hash_.outputLen, Fn.BYTES, hmac$1);
+        const sig = drbg(seed, k2sig); // Steps B, C, D, E, F, G
+        return sig.toBytes(opts.format);
+    }
+    /**
+     * Verifies a signature against message and public key.
+     * Rejects lowS signatures by default: see {@link ECDSAVerifyOpts}.
+     * Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:
+     *
+     * ```
+     * verify(r, s, h, P) where
+     *   u1 = hs^-1 mod n
+     *   u2 = rs^-1 mod n
+     *   R = u1⋅G + u2⋅P
+     *   mod(R.x, n) == r
+     * ```
+     */
+    function verify(signature, message, publicKey, opts = {}) {
+        const { lowS, prehash, format } = validateSigOpts(opts, defaultSigOpts);
+        publicKey = abytes(publicKey, undefined, 'publicKey');
+        message = validateMsgAndHash(message, prehash);
+        if (!isBytes(signature)) {
+            const end = signature instanceof Signature ? ', use sig.toBytes()' : '';
+            throw new Error('verify expects Uint8Array signature' + end);
+        }
+        validateSigLength(signature, format); // execute this twice because we want loud error
+        try {
+            const sig = Signature.fromBytes(signature, format);
+            const P = Point.fromBytes(publicKey);
+            // SEC 1 verification keys must not be the identity, even when the generic point decoder
+            // permits infinity for another protocol (for example, a pairing curve).
+            if (P.is0())
+                return false;
+            if (lowS && sig.hasHighS())
+                return false;
+            const { r, s } = sig;
+            const h = bits2int_modN(message); // mod n, not mod p
+            const is = Fn.inv(s); // s^-1 mod n
+            const u1 = Fn.create(h * is); // u1 = hs^-1 mod n
+            const u2 = Fn.create(r * is); // u2 = rs^-1 mod n
+            const R = Point.BASE.mulAddUnsafe(u1, P, u2); // u1⋅G + u2⋅P, joint Strauss–Shamir
+            if (R.is0())
+                return false;
+            const q = R.toAffine();
+            const v = Fn.create(q.x); // v = R.x mod n
+            if (v !== r)
+                return false;
+            // R is the exact point `recoverPublicKey(r, recid)` reconstructs (sR = hG + rP),
+            // so binding the signature to its recovery id only needs R's parity/overflow bits.
+            if (format === 'recovered' && sig.recovery !== getRecoveryBit(q.x, q.y, r))
+                return false;
+            return true;
+        }
+        catch (e) {
+            return false;
+        }
+    }
+    function recoverPublicKey(signature, message, opts = {}) {
+        // Top-level recovery mirrors `sign()` / `verify()`: it hashes raw message
+        // bytes first unless the caller passes `{ prehash: false }`.
+        const { prehash } = validateSigOpts(opts, defaultSigOpts);
+        message = validateMsgAndHash(message, prehash);
+        return Signature.fromBytes(signature, 'recovered').recoverPublicKey(message).toBytes();
+    }
+    // utils.isValidPublicKey() already rejects the identity, so ECDSA needs no shadow copy.
+    return Object.freeze({
+        keygen,
+        getPublicKey,
+        getSharedSecret,
+        utils,
+        lengths,
+        Point,
+        sign,
+        verify,
+        recoverPublicKey,
+        Signature,
+        hash: hash_,
+    });
+}
+
+export { validatePointCons as A, bytesToHex as B, hexToBytes as C, numberToBytesBE as D, Field as F, asafenumber as a, abytes as b, copyBytes as c, concatBytes as d, ecdsa as e, asciiToBytes as f, bytesToNumberBE as g, hmac as h, isBytes as i, validateField as j, aarray as k, FpInvertBatch as l, mod as m, FpIsSquare as n, notImplemented as o, pow2 as p, getMinHashLength as q, mapHashToField as r, randomBytes as s, bitLen as t, FpPow as u, validateObject as v, weierstrass as w, FpLegendre as x, aInRange as y, bitGet as z };