@leofcoin/chain 1.10.21 → 1.10.22

package/exports/browser/{index-DCbLvMKL.js → index-dxD17Fom.js}

@@ -1282,176 +1282,190 @@ var index = {
  * * b = `7n` // equation param
  * * Gx, Gy are coordinates of Generator / base point
  */
+const freeze = Object.freeze;
+const P = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2fn;
+const N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;
+const Gx = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798n;
+const Gy = 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8n;
 // Mirror noble-curves: Point.CURVE() returns shared params, but those params must stay frozen so
 // callers cannot mutate them out from under the arithmetic constants captured below.
-const secp256k1_CURVE = Object.freeze({
-    p: 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2fn,
-    n: 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n,
+const secp256k1_CURVE = freeze({
+    p: P,
+    n: N,
     h: 1n,
     a: 0n,
     b: 7n,
-    Gx: 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798n,
-    Gy: 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8n,
+    Gx,
+    Gy,
 });
-const { p: P, n: N, Gx, Gy, b: _b } = secp256k1_CURVE;
 // 32-byte field / scalar width, and the SHA-256 / HMAC-DRBG output width used
 // by the RFC6979 paths here.
 const L = 32;
-const L2 = 64; // 64-byte compact signatures, and 64 hex chars for zero-padded 32-byte scalars
-const lengths = {
-    publicKey: L + 1,
-    publicKeyUncompressed: L2 + 1,
-    // 48-byte keygen seed floor: 384 bits exceeds FIPS 186-5 Table A.2's
-    // 352-bit recommendation for 256-bit prime curves.
-    seed: L + L / 2,
-};
 // Helpers and Precomputes sections are reused between libraries
 // ## Helpers
 // ----------
-const err = (message = '', E = Error) => {
-    const e = new E(message);
-    const { captureStackTrace } = Error;
-    if (typeof captureStackTrace === 'function')
-        captureStackTrace(e, err);
-    throw e;
+/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */
+const isBytes = (a) => {
+    // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases.
+    // The fallback still requires a real ArrayBuffer view, so plain
+    // JSON-deserialized `{ constructor: ... }` spoofing is rejected, and
+    // `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.
+    return (a instanceof Uint8Array ||
+        (ArrayBuffer.isView(a) &&
+            a.constructor.name === 'Uint8Array' &&
+            a.BYTES_PER_ELEMENT === 1));
 };
-// Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases. The
-// fallback still requires a real ArrayBuffer view so plain JSON-deserialized `{ constructor: ... }`
-// spoofing is rejected, and `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.
-const isBytes = (a) => a instanceof Uint8Array ||
-    (ArrayBuffer.isView(a) &&
-        a.constructor.name === 'Uint8Array' &&
-        a.BYTES_PER_ELEMENT === 1);
-/** Asserts something is Bytes. */
+/** Asserts something is Uint8Array. */
 const abytes = (value, length, title = '') => {
+    // Success path first: this runs at the start of every update() / digestInto(), and the
+    // common `abytes(data)` form must not pay for length handling it does not use.
+    if (isBytes(value) && (length === undefined || value.length === length))
+        return value;
+    // Error path: recompute freely to build the exact message.
     const bytes = isBytes(value);
-    const len = value?.length;
-    const needsLen = length !== undefined;
-    if (!bytes || (needsLen && len !== length)) {
-        const prefix = title && `"${title}" `;
-        const ofLen = needsLen ? ` of length ${length}` : '';
-        const got = bytes ? `length=${len}` : `type=${typeof value}`;
-        const msg = prefix + 'expected Uint8Array' + ofLen + ', got ' + got;
-        return bytes ? err(msg, RangeError) : err(msg, TypeError);
-    }
-    return value;
+    const ofLen = length !== undefined ? ` of length ${length}` : '';
+    const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+    const message = (title ? `"${title}" ` : '') + 'expected Uint8Array' + ofLen + ', got ' + got;
+    if (!bytes)
+        throw new TypeError(message);
+    throw new RangeError(message);
 };
-/** create Uint8Array */
-const u8n = (len) => new Uint8Array(len);
+// Signing can retain the message across hash callbacks / awaits, and Schnorr hashes it more than
+// once. Take one owned snapshot so caller mutation cannot change the signing transcript.
+// cloneBytes expects an already-validated view; snapshotBytes validates, then copies.
+const cloneBytes = (value) => Uint8Array.from(value);
+const snapshotBytes = (value, title, length) => cloneBytes(abytes(value, length, title));
 // Callers keep values non-negative and within the requested width; padStart() won't truncate over-wide inputs.
 const padh = (n, pad) => n.toString(16).padStart(pad, '0');
-/** Render bytes as lowercase hex. */
-const bytesToHex = (b) => {
+/** Convert byte array to hex string. */
+const bytesToHex = (bytes) => {
     let hex = '';
-    for (const e of abytes(b))
-        hex += padh(e, 2);
+    for (const byte of abytes(bytes))
+        hex += padh(byte, 2);
     return hex;
 };
-const C = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 }; // ASCII characters
-// Strict ASCII nibble parser: non-ASCII hex lookalikes are rejected as undefined.
-// prettier-ignore
-const _ch = (ch) => ch >= C._0 && ch <= C._9 ? ch - C._0 // '2' => 50-48
-    : ch >= C.A && ch <= C.F ? ch - (C.A - 10) // 'B' => 66-(65-10)
-        : ch >= C.a && ch <= C.f ? ch - (C.a - 10) // 'b' => 98-(97-10)
-            : undefined;
+/** Convert hex string to byte array. */
 const hexToBytes = (hex) => {
-    const e = 'hex invalid'; // Strict ASCII hex only, with one generic error for type and parse failures.
+    const e = 'hex invalid'; // Strict ASCII hex only, with one generic error for parse failures.
     if (typeof hex !== 'string')
-        return err(e);
-    const hl = hex.length;
-    const al = hl / 2;
-    if (hl % 2)
-        return err(e);
-    const array = u8n(al);
-    for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
-        // treat each char as ASCII
-        const n1 = _ch(hex.charCodeAt(hi)); // parse first char, multiply it by 16
-        const n2 = _ch(hex.charCodeAt(hi + 1)); // parse second char
-        if (n1 === undefined || n2 === undefined)
-            return err(e);
-        array[ai] = n1 * 16 + n2; // example: 'A9' => 10*16 + 9
+        throw new TypeError(e);
+    if (hex.length % 2 || !/^[\da-f]*$/i.test(hex))
+        throw new RangeError(e);
+    const array = new Uint8Array(hex.length / 2);
+    for (let ai = 0, hi = 0; ai < array.length; ai++, hi += 2) {
+        const n1 = hex.charCodeAt(hi);
+        const n2 = hex.charCodeAt(hi + 1);
+        // Regex guarantees ASCII. For 0..9/A..F/a..f, this maps char codes to 0..15.
+        array[ai] = ((n1 & 15) + (n1 >> 6) * 9) * 16 + (n2 & 15) + (n2 >> 6) * 9;
     }
     return array;
 };
 // WebCrypto is available in all modern environments
-const subtle = () => globalThis?.crypto?.subtle ?? err('crypto.subtle must be defined, consider polyfill');
-// prettier-ignore
-const concatBytes = (...arrs) => {
-    let len = 0;
-    for (const a of arrs)
-        len += abytes(a).length; // validate every input and sum lengths before copying
-    const r = u8n(len);
-    let pad = 0; // walk through each array,
-    for (const a of arrs)
-        r.set(a, pad), pad += a.length; // ensure they have proper type
-    return r;
+const subtle = () => {
+    const s = globalThis?.crypto?.subtle;
+    if (s)
+        return s;
+    throw new Error('crypto.subtle must be defined, consider polyfill');
+};
+/** Copies several Uint8Arrays into one. */
+const concatBytes = (...arrays) => {
+    let sum = 0;
+    for (const a of arrays)
+        sum += abytes(a).length;
+    const res = new Uint8Array(sum);
+    let pad = 0;
+    for (const a of arrays) {
+        res.set(a, pad);
+        pad += a.length;
+    }
+    return res;
 };
 /**
  * WebCrypto OS-level CSPRNG (random number generator).
  * Will throw when not available; large-request ceilings are delegated to getRandomValues().
  */
-const randomBytes = (len = L) => (globalThis?.crypto).getRandomValues(u8n(len));
+const randomBytes = (len = L) => {
+    const c = globalThis?.crypto;
+    if (typeof c?.getRandomValues !== 'function')
+        throw new Error('crypto.getRandomValues must be defined, consider polyfill');
+    return c.getRandomValues(new Uint8Array(len));
+};
 const big = BigInt;
 const arange = (n, min, max, msg = 'bad number: out of range') => {
     if (typeof n !== 'bigint')
-        return err(msg, TypeError);
+        throw new TypeError(msg);
     if (min <= n && n < max)
         return n;
-    return err(msg, RangeError);
+    throw new RangeError(msg);
 };
 /** Canonical modular reduction. Callers must provide a positive modulus. */
-const M = (a, b = P) => {
-    const r = a % b;
-    return r >= 0n ? r : b + r;
-};
+const M = (a, b = P) => ((a %= b) >= 0n ? a : b + a);
 const modN = (a) => M(a, N);
-/** Modular inversion using eucledian GCD (non-CT). No negative exponent for now. */
-// prettier-ignore
-const invert = (num, md) => {
-    if (num === 0n || md <= 0n)
-        err('no inverse n=' + num + ' mod=' + md);
-    let a = M(num, md), b = md, x = 0n, u = 1n;
+/** Modular inversion using extended euclidean GCD. Variable-time (non-CT). */
+const invert = (number, modulo) => {
+    if (number === 0n)
+        throw new Error('invert: expected non-zero number');
+    // modulo = 1 is the zero ring: gcd(x, 1) = 1 makes the loop below "succeed" and return the
+    // useless inverse 0. Reject it.
+    if (modulo <= 1n)
+        throw new Error('invert: expected modulus > 1, got ' + modulo);
+    // This is variable-time: the loop count depends on `number`.
+    let a = M(number, modulo);
+    let b = modulo;
+    // Only the Bézout coefficient of `number` (x/u chain) is tracked; the coefficient of `modulo`
+    // never affects the output, so it is not computed.
+    // prettier-ignore
+    let x = 0n, u = 1n;
     while (a !== 0n) {
-        const q = b / a, r = b % a;
+        const q = b / a;
+        const r = b - a * q;
         const m = x - u * q;
+        // prettier-ignore
         b = a, a = r, x = u, u = m;
     }
-    return b === 1n ? M(x, md) : err('no inverse'); // b is gcd at this point
+    const gcd = b;
+    if (gcd !== 1n)
+        throw new Error('invert: does not exist');
+    return M(x, modulo);
 };
-const callHash = (name) => {
+const _hash = (name) => {
     // @ts-ignore
     const fn = hashes[name];
     if (typeof fn !== 'function')
-        err('hashes.' + name + ' not set');
+        throw new Error('hashes.' + name + ' not set');
     return fn;
 };
 // All exported provider slots are caller-configurable and may be unset or return arbitrary values,
 // so wrapper helpers must enforce the exact 32-byte digest contract instead of trusting providers.
-const gh = (name, a, b) => abytes(callHash(name)(a, b), L, 'digest');
-const gha = (name, a, b) => Promise.resolve(callHash(name)(a, b)).then((r) => abytes(r, L, 'digest'));
+const callHash = (name, a, b) => abytes(_hash(name)(a, b), L, 'digest');
+const callHashAsync = async (name, a, b) => abytes(await _hash(name)(a, b), L, 'digest');
 // also rejects structurally similar Point values from other realms / bundled copies
-const apoint = (p) => (p instanceof Point ? p : err('Point expected'));
+const apoint = (p) => {
+    if (p instanceof Point)
+        return p;
+    throw new TypeError('Point expected');
+};
 // ## End of Helpers
 // -----------------
+const E_BADPOINT = 'bad point: not on curve';
 /**
  * secp256k1 formula. Koblitz curves are subclass of weierstrass curves with a=0,
  * making it x³+b; callers validate x first.
  */
-const koblitz = (x) => M(M(x * x) * x + _b);
+const koblitz = (x) => M(M(x * x) * x + 7n);
 /** assert is element of field mod P (incl. 0 for projective infinity coordinates) */
 const FpIsValid = (n) => arange(n, 0n, P);
 /** assert is element of field mod P (excl. 0 where current callers need a non-zero coordinate) */
 const FpIsValidNot0 = (n) => arange(n, 1n, P);
-/** assert is element of field mod N (excl. 0), matching the shared BIP340 scalar-failure rule used here */
+/** assert is element of field mod N (excl. 0), matching the shared BIP340 scalar-failure rule used here.
+ * There is deliberately no FnIsValid: no caller accepts the scalar 0. */
 const FnIsValidNot0 = (n) => arange(n, 1n, N);
 // Shared parity primitive for BIP340 even-y checks and SEC 1 compressed prefixes.
 const isEven = (y) => !(y & 1n);
-/** create Uint8Array of byte n */
-const u8of = (n) => Uint8Array.of(n);
 /** SEC 1 compressed-prefix helper. Parity only: callers validate y before asking for the prefix byte. */
-const getPrefix = (y) => u8of(isEven(y) ? 0x02 : 0x03);
-/** lift_x from BIP340 returns the unique even square root for x³+7.
- * SEC 1 callers still flip it for the odd-prefix branch. */
+const getPrefix = (y) => Uint8Array.of(isEven(y) ? 0x02 : 0x03);
+/** lift_x from BIP340 returns the unique point with x and an even square root of x³+7.
+ * SEC 1 callers still negate it for the odd-prefix branch. */
 const lift_x = (x) => {
     // Let c = x³ + 7 mod p. Fail if x ≥ p. (also fail if x < 1)
     const c = koblitz(FpIsValidNot0(x));
@@ -1467,8 +1481,8 @@ const lift_x = (x) => {
         num = (num * num) % P; // Not constant-time.
     }
     if (M(r * r) !== c)
-        err('sqrt invalid'); // check if result is valid
-    return isEven(r) ? r : M(-r);
+        throw new Error('sqrt invalid'); // check if result is valid
+    return new Point(x, isEven(r) ? r : M(-r), 1n);
 };
 /**
  * Point in 3d xyz projective coordinates. 3d takes less inversions than 2d.
@@ -1492,7 +1506,7 @@ class Point {
         this.X = FpIsValid(X);
         this.Y = FpIsValidNot0(Y); // Y can't be 0 in Projective
         this.Z = FpIsValid(Z);
-        Object.freeze(this);
+        freeze(this);
     }
     /** Returns the shared curve metadata object by reference.
      * It is readonly only at type level, and mutating it won't retarget arithmetic,
@@ -1508,30 +1522,31 @@ class Point {
     /** Convert Uint8Array or hex string to Point. */
     static fromBytes(bytes) {
         abytes(bytes);
-        const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65
-        let p = undefined;
         const length = bytes.length;
         const head = bytes[0];
-        const tail = bytes.subarray(1);
-        const x = sliceBytesNumBE(tail, 0, L);
+        const x = sliceBytesNumBE(bytes, 1, 33);
         // SEC 1 defines the rare infinity encoding 0x00, but SEC 1 public-key validation rejects
         // infinity. We keep 0x00 rejected here because this parser is reused by verify(), ECDH,
         // and public-key validation helpers, so strict handling applies to all callers by default.
         // Local secp256k1 crosstests show OpenSSL raw point codecs accept 0x00 too.
-        // Parse SEC 1 compressed/uncompressed encodings, then finish with assertValidity() before returning.
-        if (length === comp && (head === 0x02 || head === 0x03)) {
-            // Equation is y² == x³ + ax + b. We calculate y from x.
-            // lift_x() returns the even root; SEC 1 0x03 still needs the odd root.
-            let y = lift_x(x);
-            if (head === 0x03)
-                y = M(-y);
-            p = new Point(x, y, 1n);
+        // Parse and validate SEC 1 compressed/uncompressed encodings before returning.
+        try {
+            if (length === 33 && (head === 0x02 || head === 0x03)) {
+                // Equation is y² == x³ + ax + b. We calculate y from x.
+                // lift_x() returns the even point; SEC 1 0x03 still needs the odd point.
+                const p = lift_x(x);
+                return head === 0x03 ? p.negate() : p;
+            }
+            // Uncompressed 65-byte point, 0x04 prefix
+            if (length === 65 && head === 0x04)
+                return new Point(x, sliceBytesNumBE(bytes, 33, 65), 1n).assertValidity();
+        }
+        catch (error) {
+            // Out-of-range coordinates and non-residue x report the same error as wrong
+            // prefixes / off-curve points, instead of generic range-check messages.
+            throw new Error(E_BADPOINT);
         }
-        // Uncompressed 65-byte point, 0x04 prefix
-        if (length === uncomp && head === 0x04)
-            p = new Point(x, sliceBytesNumBE(tail, L, L2), 1n);
-        // Validate point
-        return p ? p.assertValidity() : err('bad point: not on curve');
+        throw new Error(E_BADPOINT);
     }
     static fromHex(hex) {
         return Point.fromBytes(hexToBytes(hex));
@@ -1546,14 +1561,10 @@ class Point {
     equals(other) {
         const { X: X1, Y: Y1, Z: Z1 } = this;
         const { X: X2, Y: Y2, Z: Z2 } = apoint(other); // checks class equality
-        const X1Z2 = M(X1 * Z2);
-        const X2Z1 = M(X2 * Z1);
-        const Y1Z2 = M(Y1 * Z2);
-        const Y2Z1 = M(Y2 * Z1);
-        return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+        return M(X1 * Z2) === M(X2 * Z1) && M(Y1 * Z2) === M(Y2 * Z1);
     }
     is0() {
-        return this.equals(I);
+        return this.Z === 0n;
     }
     /** Flip point over y coordinate. */
     negate() {
@@ -1573,7 +1584,7 @@ class Point {
         const { X: X1, Y: Y1, Z: Z1 } = this;
         const { X: X2, Y: Y2, Z: Z2 } = apoint(other);
         const a = 0n;
-        const b = _b;
+        const b = 7n;
         let X3 = 0n, Y3 = 0n, Z3 = 0n;
         const b3 = M(b * 3n);
         let t0 = M(X1 * X2), t1 = M(Y1 * Y2), t2 = M(Z1 * Z2), t3 = M(X1 + Y1); // step 1
@@ -1637,13 +1648,18 @@ class Point {
         // init result point & fake point
         let p = I;
         let f = G;
-        for (let d = this; n > 0n; d = d.double(), n >>= 1n) {
+        let d = this;
+        // Safe mode always runs 256 iterations so ladder length can't leak the scalar's
+        // leading zero bits; unsafe mode stops at the top set bit for speed.
+        for (let i = 0; safe ? i < 256 : n > 0n; i++) {
             // if bit is present, add to point
             // if not present, add to fake, for timing safety
             if (n & 1n)
                 p = p.add(d);
             else if (safe)
                 f = f.add(d);
+            d = d.double();
+            n >>= 1n;
         }
         return p;
     }
@@ -1654,14 +1670,14 @@ class Point {
     toAffine() {
         const { X: x, Y: y, Z: z } = this;
         // fast-paths for ZERO point OR Z=1
-        if (this.equals(I))
+        if (z === 0n)
             return { x: 0n, y: 0n };
         if (z === 1n)
             return { x, y };
         const iz = invert(z, P);
         // (Z * Z^-1) must be 1, otherwise bad math
         if (M(z * iz) !== 1n)
-            err('inverse invalid');
+            throw new Error('inverse invalid');
         // x = X*Z^-1; y = Y*Z^-1
         return { x: M(x * iz), y: M(y * iz) };
     }
@@ -1671,7 +1687,9 @@ class Point {
         FpIsValidNot0(x); // must be in range 1 <= x,y < P
         FpIsValidNot0(y);
         // y² == x³ + ax + b, equation sides must be equal
-        return M(y * y) === koblitz(x) ? this : err('bad point: not on curve');
+        if (M(y * y) !== koblitz(x))
+            throw new Error(E_BADPOINT);
+        return this;
     }
     /** Converts point to 33/65-byte Uint8Array. */
     toBytes(isCompressed = true) {
@@ -1681,7 +1699,7 @@ class Point {
         const x32b = numTo32b(x);
         if (isCompressed)
             return concatBytes(getPrefix(y), x32b);
-        return concatBytes(u8of(0x04), x32b, numTo32b(y));
+        return concatBytes(Uint8Array.of(0x04), x32b, numTo32b(y));
     }
     toHex(isCompressed) {
         return bytesToHex(this.toBytes(isCompressed));
@@ -1696,17 +1714,14 @@ Point.BASE = G;
 Point.ZERO = I;
 /** `Q = u1⋅G + u2⋅R`. Verifies Q is not ZERO. Unsafe: non-CT. */
 const doubleScalarMulUns = (R, u1, u2) => {
-    return G.multiply(u1, false)
-        .add(R.multiply(u2, false))
-        .assertValidity();
+    return G.multiply(u1, false).add(R.multiply(u2, false)).assertValidity();
 };
 // Inherits byte validation from bytesToHex(); the || '0' fallback keeps empty input mapped to 0n.
 const bytesToNumBE = (b) => big('0x' + (bytesToHex(b) || '0'));
 // Callers provide monotone slice bounds; subarray() would otherwise clamp or reinterpret them silently.
 const sliceBytesNumBE = (b, from, to) => bytesToNumBE(b.subarray(from, to));
-const B256 = 2n ** 256n; // secp256k1 is weierstrass curve. Equation is x³ + ax + b.
-/** Generic 32-byte big-endian encoder. Must be 0 <= num < B256; call sites need not be field/scalar elements. */
-const numTo32b = (num) => hexToBytes(padh(arange(num, 0n, B256), L2));
+/** Generic 32-byte big-endian encoder. Must be 0 <= num < 2²⁵⁶; call sites need not be field/scalar elements. */
+const numTo32b = (num) => hexToBytes(padh(arange(num, 0n, 2n ** 256n), L * 2)); // L*2 = 64 hex chars for a zero-padded 32-byte value
 /** Normalize private key to scalar (bigint). Verifies scalar is in range 1 <= d < N. */
 const secretKeyToScalar = (secretKey) => {
     const num = bytesToNumBE(abytes(secretKey, L, 'secret key'));
@@ -1737,12 +1752,11 @@ const isValidSecretKey = (secretKey) => {
     }
 };
 const isValidPublicKey = (publicKey, isCompressed) => {
-    const { publicKey: comp, publicKeyUncompressed } = lengths;
     try {
         const l = publicKey.length;
-        if (isCompressed === true && l !== comp)
+        if (isCompressed === true && l !== 33)
             return false;
-        if (isCompressed === false && l !== publicKeyUncompressed)
+        if (isCompressed === false && l !== 65)
             return false;
         return !!Point.fromBytes(publicKey);
     }
@@ -1770,12 +1784,11 @@ const _sha = 'SHA-256';
 const hashes = {
     hmacSha256Async: async (key, message) => {
         const s = subtle();
-        const name = 'HMAC';
-        const k = await s.importKey('raw', key, { name, hash: { name: _sha } }, false, ['sign']);
-        return u8n(await s.sign(name, k, message));
+        const k = await s.importKey('raw', key, { name: 'HMAC', hash: _sha }, false, ['sign']);
+        return new Uint8Array(await s.sign('HMAC', k, message));
     },
     hmacSha256: undefined,
-    sha256Async: async (msg) => u8n(await subtle().digest(_sha, msg)),
+    sha256Async: async (msg) => new Uint8Array(await subtle().digest(_sha, msg)),
     sha256: undefined,
 };
 /**
@@ -1802,20 +1815,17 @@ const getSharedSecret = (secretKeyA, publicKeyB, isCompressed = true) => {
 // FIPS 186-5 Appendix A.4.1 style key generation reduces a wide random integer mod (n - 1) and adds 1.
 // The 48-byte minimum keeps the secp256k1 bias bound below the appendix's epsilon <= 2^-64 target.
 const randomSecretKey = (seed) => {
-    seed = seed === undefined ? randomBytes(lengths.seed) : seed;
+    seed = seed === undefined ? randomBytes(48) : seed;
     abytes(seed);
     // Keep the public range text aligned with the enforced 48-byte FIPS floor.
-    if (seed.length < lengths.seed || seed.length > 1024)
-        return err('expected 48-1024b', RangeError);
+    if (seed.length < 48 || seed.length > 1024)
+        throw new RangeError('expected 48-1024b');
     const num = M(bytesToNumBE(seed), N - 1n);
     return numTo32b(num + 1n);
 };
 const createKeygen = (getPublicKey) => (seed) => {
     const secretKey = randomSecretKey(seed);
-    return {
-        secretKey,
-        publicKey: getPublicKey(secretKey),
-    };
+    return { secretKey, publicKey: getPublicKey(secretKey) };
 };
 /**
  * Math, hex, byte helpers. Not in `utils` because utils share API with noble-curves.
@@ -1826,17 +1836,17 @@ const createKeygen = (getPublicKey) => (seed) => {
  * const hex = etc.bytesToHex(new Uint8Array([1, 2, 3]));
  * ```
  */
-const etc = /* @__PURE__ */ Object.freeze({
+const etc = /* @__PURE__ */ freeze({
     hexToBytes,
     bytesToHex,
     concatBytes,
     bytesToNumberBE: bytesToNumBE,
     numberToBytesBE: numTo32b,
     mod: M,
-    invert: invert, // math utilities; keep public alias type aligned with runtime
+    invert,
     randomBytes,
-    secretKeyToScalar: secretKeyToScalar,
-    abytes: abytes,
+    secretKeyToScalar,
+    abytes,
 });
 /**
  * Curve-specific key utilities.
@@ -1848,26 +1858,23 @@ const etc = /* @__PURE__ */ Object.freeze({
  * const publicKey = secp.getPublicKey(secretKey);
  * ```
  */
-const utils = /* @__PURE__ */ Object.freeze({
-    isValidSecretKey: isValidSecretKey,
-    isValidPublicKey: isValidPublicKey,
-    randomSecretKey: randomSecretKey, // preserve the optional seeded call
+const utils = /* @__PURE__ */ freeze({
+    isValidSecretKey,
+    isValidPublicKey,
+    randomSecretKey,
 });
 // Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.
 // https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki
 // Internal BIP340 tag names are ASCII-only here, so charCodeAt() is enough; this is not a general UTF-8 encoder.
 const getTag = (tag) => Uint8Array.from('BIP0340/' + tag, (c) => c.charCodeAt(0));
-const T_AUX = 'aux';
-const T_NONCE = 'nonce';
-const T_CHALLENGE = 'challenge';
 // Both SHA-256 provider slots are configurable, so tag hashing still goes through the checked
 // wrappers even though the built-in defaults are deterministic and the tag bytes are ASCII-only.
 const taggedHash = (tag, ...messages) => {
-    const tagH = gh('sha256', getTag(tag));
-    return gh('sha256', concatBytes(tagH, tagH, ...messages));
+    const tagH = callHash('sha256', getTag(tag));
+    return callHash('sha256', concatBytes(tagH, tagH, ...messages));
 };
 // Async twin of taggedHash with the same checked provider boundary.
-const taggedHashAsync = (tag, ...messages) => gha('sha256Async', getTag(tag)).then((tagH) => gha('sha256Async', concatBytes(tagH, tagH, ...messages)));
+const taggedHashAsync = (tag, ...messages) => callHashAsync('sha256Async', getTag(tag)).then((tagH) => callHashAsync('sha256Async', concatBytes(tagH, tagH, ...messages)));
 // BIP340 PubKey(sk) = bytes(d'⋅G), where bytes(P) is bytes(x(P)); signing also normalizes
 // d to the equivalent scalar whose point has even y so the x-only public key stays canonical.
 const extpubSchnorr = (priv) => {
@@ -1879,8 +1886,8 @@ const extpubSchnorr = (priv) => {
     return { d, px };
 };
 const bytesModN = (bytes) => modN(bytesToNumBE(bytes));
-const challenge = (...args) => bytesModN(taggedHash(T_CHALLENGE, ...args));
-const challengeAsync = async (...args) => bytesModN(await taggedHashAsync(T_CHALLENGE, ...args));
+const challenge = (...args) => bytesModN(taggedHash('challenge', ...args));
+const challengeAsync = async (...args) => bytesModN(await taggedHashAsync('challenge', ...args));
 /** Schnorr public key is just `x` coordinate of Point as per BIP340. */
 const pubSchnorr = (secretKey) => {
     return extpubSchnorr(secretKey).px; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)
@@ -1888,13 +1895,14 @@ const pubSchnorr = (secretKey) => {
 const keygenSchnorr = /* @__PURE__ */ createKeygen(pubSchnorr);
 // Common preparation fn for both sync and async signing
 const prepSigSchnorr = (message, secretKey, auxRand) => {
+    const m = snapshotBytes(message, 'message');
     const { px, d } = extpubSchnorr(secretKey);
-    return { m: abytes(message), px, d, a: abytes(auxRand, L) };
+    return { m, px, d, a: abytes(auxRand, L) };
 };
 const extractK = (rand) => {
     const k_ = bytesModN(rand); // Let k' = int(rand) mod n
     if (k_ === 0n)
-        err('sign failed: k is zero'); // Fail if k' = 0.
+        throw new Error('sign failed: k is zero'); // Fail if k' = 0.
     const { px, d } = extpubSchnorr(numTo32b(k_)); // Let R = k'⋅G.
     return { rx: px, k: d };
 };
@@ -1910,73 +1918,78 @@ const E_INVSIG = 'invalid signature produced';
  */
 const signSchnorr = (message, secretKey, auxRand = randomBytes(L)) => {
     const { m, px, d, a } = prepSigSchnorr(message, secretKey, auxRand);
-    const aux = taggedHash(T_AUX, a);
     // Let t be the byte-wise xor of bytes(d) and hash/aux(a)
-    const t = numTo32b(d ^ bytesToNumBE(aux));
+    const t = numTo32b(d ^ bytesToNumBE(taggedHash('aux', a)));
     // Let rand = hash/nonce(t || bytes(P) || m)
-    const rand = taggedHash(T_NONCE, t, px, m);
-    const { rx, k } = extractK(rand);
+    const { rx, k } = extractK(taggedHash('nonce', t, px, m));
     // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.
-    const e = challenge(rx, px, m);
-    const sig = createSigSchnorr(k, rx, e, d);
+    const sig = createSigSchnorr(k, rx, challenge(rx, px, m), d);
     // If Verify(bytes(P), m, sig) (see below) returns failure, abort
     if (!verifySchnorr(sig, m, px))
-        err(E_INVSIG);
+        throw new Error(E_INVSIG);
     return sig;
 };
 const signSchnorrAsync = async (message, secretKey, auxRand = randomBytes(L)) => {
     const { m, px, d, a } = prepSigSchnorr(message, secretKey, auxRand);
-    const aux = await taggedHashAsync(T_AUX, a);
     // Let t be the byte-wise xor of bytes(d) and hash/aux(a)
-    const t = numTo32b(d ^ bytesToNumBE(aux));
+    const t = numTo32b(d ^ bytesToNumBE(await taggedHashAsync('aux', a)));
     // Let rand = hash/nonce(t || bytes(P) || m)
-    const rand = await taggedHashAsync(T_NONCE, t, px, m);
-    const { rx, k } = extractK(rand);
+    const { rx, k } = extractK(await taggedHashAsync('nonce', t, px, m));
     // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.
-    const e = await challengeAsync(rx, px, m);
-    const sig = createSigSchnorr(k, rx, e, d);
+    const sig = createSigSchnorr(k, rx, await challengeAsync(rx, px, m), d);
     // If Verify(bytes(P), m, sig) (see below) returns failure, abort
     if (!(await verifySchnorrAsync(sig, m, px)))
-        err(E_INVSIG);
+        throw new Error(E_INVSIG);
     return sig;
 };
 const callSyncAsyncFn = (res, later) => {
     return res instanceof Promise ? res.then(later) : later(res);
 };
 const _verifSchnorr = (signature, message, publicKey, challengeFn) => {
-    const sig = abytes(signature, L2, 'signature');
+    const sig = abytes(signature, 64, 'signature');
     const msg = abytes(message, undefined, 'message');
     const pub = abytes(publicKey, L, 'publicKey');
+    let P_;
+    let r;
+    let s;
+    let chalInput; // challenge preimage bytes(r) || bytes(P) || m
     try {
         // lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.
         // Fail if x ≥ p. Let c = x³ + 7 mod p.
         const x = bytesToNumBE(pub);
-        const y = lift_x(x); // lift_x already returns the unique even root required by BIP340.
-        const P_ = new Point(x, y, 1n).assertValidity();
-        const px = numTo32b(P_.toAffine().x);
+        P_ = lift_x(x); // lift_x returns the validated even-y point required by BIP340.
         // P = lift_x(int(pk)); fail if that fails
-        const r = sliceBytesNumBE(sig, 0, L); // Let r = int(sig[0:32]); fail if r ≥ p.
-        arange(r, 1n, P);
-        const s = sliceBytesNumBE(sig, L, L2); // Let s = int(sig[32:64]); fail if s ≥ n.
+        r = FpIsValidNot0(sliceBytesNumBE(sig, 0, L)); // Let r = int(sig[0:32]); fail if r ≥ p.
+        // Let s = int(sig[32:64]); fail if s ≥ n.
         // Stricter than BIP-340/libsecp256k1, which only reject s >= n. Honest signing reaches
         // s = 0 only with negligible probability (k + e*d ≡ 0 mod n), so treat zero-s inputs as
         // crafted edge cases and fail closed instead of carrying that extra verification surface.
-        arange(s, 1n, N);
-        const i = concatBytes(numTo32b(r), px, msg);
-        // int(challenge(bytes(r)||bytes(P)||m))%n
-        return callSyncAsyncFn(challengeFn(i), (e) => {
-            const { x, y } = doubleScalarMulUns(P_, s, modN(-e)).toAffine(); // R = s⋅G - e⋅P
-            if (!isEven(y) || x !== r)
-                return false; // -eP == (n-e)P
-            return true; // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.
-        });
+        s = FnIsValidNot0(sliceBytesNumBE(sig, L, 64));
+        // lift_x validated x < P, so the 32-byte input encoding equals bytes(P.x) exactly.
+        chalInput = concatBytes(numTo32b(r), pub, msg);
     }
     catch (error) {
         return false;
     }
+    // Hash-provider errors (unset hashes.sha256, missing crypto.subtle, bad provider digests)
+    // stay outside the catch above: backend misconfiguration is not an "invalid signature"
+    // result, so it throws / rejects instead of becoming false.
+    // int(challenge(bytes(r)||bytes(P)||m))%n
+    return callSyncAsyncFn(challengeFn(chalInput), (e) => {
+        try {
+            const { x, y } = doubleScalarMulUns(P_, s, modN(-e)).toAffine(); // R = s⋅G - e⋅P
+            if (!isEven(y) || x !== r)
+                return false; // -eP == (n-e)P
+            return true; // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.
+        }
+        catch (error) {
+            return false; // is_infinite(R) throws inside doubleScalarMulUns
+        }
+    });
 };
-/** Verifies Schnorr signature. Sync wrapper returns false for post-validation failures
- * after the initial byte checks. */
+/** Verifies Schnorr signature. Invalid points, scalars and failed curve checks return false;
+ * hash-backend misconfiguration (e.g. unset hashes.sha256) throws instead, since it is a
+ * runtime/backend error, not an "invalid signature" result. */
 const verifySchnorr = (s, m, p) => _verifSchnorr(s, m, p, challenge);
 /** Async Schnorr verification. Curve/encoding failures after the initial byte checks still
  * become false, but async backend failures reject the promise. Missing crypto.subtle is a
@@ -1998,7 +2011,7 @@ const verifySchnorrAsync = async (s, m, p) => _verifSchnorr(s, m, p, challengeAs
  * const isValid = secp.schnorr.verify(sig, message, publicKey);
  * ```
  */
-const schnorr = /* @__PURE__ */ Object.freeze({
+const schnorr = /* @__PURE__ */ freeze({
     keygen: keygenSchnorr,
     getPublicKey: pubSchnorr,
     sign: signSchnorr,
@@ -2008,18 +2021,14 @@ const schnorr = /* @__PURE__ */ Object.freeze({
 });
 // ## Precomputes
 // --------------
-const W = 8; // W is window size
-const scalarBits = 256;
-const pwindows = Math.ceil(scalarBits / W) + 1; // 33 for W=8, NOT 32 - see wNAF loop
-const pwindowSize = 2 ** (W - 1); // 128 for W=8
 const precompute = () => {
     const points = [];
     let p = G;
     let b = p;
-    for (let w = 0; w < pwindows; w++) {
+    for (let w = 0; w < 33; w++) {
         b = p;
         points.push(b);
-        for (let i = 1; i < pwindowSize; i++) {
+        for (let i = 1; i < 128; i++) {
             b = b.add(p);
             points.push(b);
         } // i=1, bc we skip 0
@@ -2048,37 +2057,32 @@ const wNAF = (n) => {
     const comp = Gpows || (Gpows = precompute());
     let p = I;
     let f = G; // f must be G, or could become I in the end
-    const pow_2_w = 2 ** W; // 256 for W=8
-    const maxNum = pow_2_w; // 256 for W=8
-    const mask = big(pow_2_w - 1); // 255 for W=8 == mask 0b11111111
-    const shiftBy = big(W); // 8 for W=8
-    for (let w = 0; w < pwindows; w++) {
-        let wbits = Number(n & mask); // extract W bits.
-        n >>= shiftBy; // shift number by W bits.
+    for (let w = 0; w < 33; w++) {
+        let wbits = Number(n & 255n); // extract W=8 bits.
+        n >>= 8n; // shift number by W=8 bits.
         // We use negative indexes to reduce size of precomputed table by 2x.
         // Instead of needing precomputes 0..256, we only calculate them for 0..128.
         // If an index > 128 is found, we do (256-index) - where 256 is next window.
         // Naive: index +127 => 127, +224 => 224
         // Optimized: index +127 => 127, +224 => 256-32
-        if (wbits > pwindowSize) {
-            wbits -= maxNum;
+        if (wbits > 128) {
+            wbits -= 256;
             n += 1n;
         }
-        const off = w * pwindowSize;
-        const offF = off; // offsets, evaluate both
+        const off = w * 128;
         const offP = off + Math.abs(wbits) - 1;
-        const isEven = w % 2 !== 0; // conditions, evaluate both
+        const isOddW = w % 2 !== 0; // conditions, evaluate both; alternates fake-add sign per window
         const isNeg = wbits < 0;
         if (wbits === 0) {
-            // off == I: can't add it. Adding random offF instead.
-            f = f.add(ctneg(isEven, comp[offF])); // bits are 0: add garbage to fake point
+            // off == I: can't add it. Add the first point in this window to the fake accumulator.
+            f = f.add(ctneg(isOddW, comp[off])); // bits are 0: add garbage to fake point
         }
         else {
             p = p.add(ctneg(isNeg, comp[offP])); // bits are 1: add to result point
         }
     }
     if (n !== 0n)
-        err('invalid wnaf');
+        throw new Error('invalid wnaf');
     return { p, f }; // return both real and fake points for JIT/leakage-shape symmetry
 };