@leofcoin/peernet 1.2.30 → 3.0.0

package/exports/browser/{identity-CYVPDmkf.js → identity-Cf8KKnho.js}

@@ -344,13 +344,13 @@ const ALPHABET$1 = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
 const ALPHABET_HEX$1 = "0123456789ABCDEFGHJKLMNPQRSTUVabcdefghijklmnopqrstuv";
 const base58 = base(ALPHABET$1);
 const base58Hex = base(ALPHABET_HEX$1);
-const encode$4 = base58.encode;
-const decode$5 = base58.decode;
+const encode$3 = base58.encode;
+const decode$4 = base58.decode;
 const encodeHex$2 = base58Hex.encode;
 const decodeHex$2 = base58Hex.decode;
 const isBase58 = (string) => {
     try {
-        decode$5(string);
+        decode$4(string);
         return true;
     }
     catch (e) {
@@ -368,7 +368,7 @@ const isBase58Hex = (string) => {
 };
 const whatType = (string) => {
     try {
-        decode$5(string);
+        decode$4(string);
         return "base58";
     }
     catch (e) {
@@ -382,8 +382,8 @@ const whatType = (string) => {
     }
 };
 var base58$1 = {
-    encode: encode$4,
-    decode: decode$5,
+    encode: encode$3,
+    decode: decode$4,
     isBase58,
     isBase58Hex,
     encodeHex: encodeHex$2,
@@ -470,7 +470,7 @@ const concatAndDoubleHash = async (input) => {
     return new Uint8Array(await createDoubleHash(typedArrayConcat(input), 'SHA-256'));
 };
 
-const encode$3 = async (source, prefix = new TextEncoder().encode('00'), hex) => {
+const encode$2 = async (source, prefix = new TextEncoder().encode('00'), hex) => {
     if (!(source instanceof Uint8Array) || !(prefix instanceof Uint8Array)) {
         throw new TypeError('Expected Uint8Array');
     }
@@ -487,7 +487,7 @@ const encode$3 = async (source, prefix = new TextEncoder().encode('00'), hex) =>
         return base58$1.encodeHex(uint8Array);
     return base58$1.encode(uint8Array);
 };
-const decode$4 = async (string, hex) => {
+const decode$3 = async (string, hex) => {
     let uint8Array = hex ? base58$1.decodeHex(string) : base58$1.decode(string);
     const prefix = uint8Array.subarray(0, 2);
     const source = uint8Array.subarray(2, -4);
@@ -507,129 +507,242 @@ const decode$4 = async (string, hex) => {
 };
 const isBase58check = (string, hex) => {
     try {
-        hex ? decode$4(string, true) : decode$4(string);
+        hex ? decode$3(string, true) : decode$3(string);
         return true;
     }
     catch (e) {
         return false;
     }
 };
-const encodeHex$1 = (uint8Array, prefix = new TextEncoder().encode('00')) => encode$3(uint8Array, prefix, true);
-const decodeHex$1 = (string) => decode$4(string, true);
+const encodeHex$1 = (uint8Array, prefix = new TextEncoder().encode('00')) => encode$2(uint8Array, prefix, true);
+const decodeHex$1 = (string) => decode$3(string, true);
 const isBase58checkHex = (string) => isBase58check(string, true);
-var base58check = { encode: encode$3, decode: decode$4, encodeHex: encodeHex$1, decodeHex: decodeHex$1, isBase58check, isBase58checkHex };
-
-const MSB$1 = 0x80;
-const MSBALL = -128;
-const INT = Math.pow(2, 31);
-const encode$2 = (num, out, offset) => {
-    if (Number.MAX_SAFE_INTEGER && num > Number.MAX_SAFE_INTEGER) {
-        encode$2.bytes = 0;
-        throw new RangeError('Could not encode varint');
-    }
-    out = out || [];
-    offset = offset || 0;
-    const oldOffset = offset;
-    while (num >= INT) {
-        out[offset++] = (num & 0xFF) | MSB$1;
-        num /= 128;
-    }
-    while (num & MSBALL) {
-        out[offset++] = (num & 0xFF) | MSB$1;
-        num >>>= 7;
-    }
-    out[offset] = num | 0;
-    encode$2.bytes = offset - oldOffset + 1;
-    return out;
-};
+var base58check = { encode: encode$2, decode: decode$3, encodeHex: encodeHex$1, decodeHex: decodeHex$1, isBase58check, isBase58checkHex };
 
-const MSB = 0x80;
-const REST = 0x7F;
-const decode$3 = (buf, offset) => {
-    offset = offset || 0;
-    const l = buf.length;
-    let counter = offset;
-    let result = 0;
-    let shift = 0;
-    let b;
-    do {
-        if (counter >= l || shift > 49) {
-            decode$3.bytes = 0;
-            throw new RangeError('Could not decode varint');
+/** @leofcoin/binary: dependency-free unsigned framing, with no global byte counters. */
+const MAX_BIGINT = (1n << 256n) - 1n;
+function size(value) {
+    if (!Number.isSafeInteger(value) || value < 0)
+        throw new RangeError('Expected an unsigned safe integer');
+}
+function bytes(value) {
+    if (!(value instanceof Uint8Array))
+        throw new TypeError('Expected Uint8Array');
+}
+function varUintLength(value) {
+    size(value);
+    let length = 1;
+    while (value >= 128) {
+        value = Math.floor(value / 128);
+        length++;
+    }
+    return length;
+}
+function varBigIntLength(value) {
+    if (typeof value !== 'bigint')
+        throw new TypeError('Expected BigInt');
+    if (value < 0n || value > MAX_BIGINT)
+        throw new RangeError('Expected an unsigned 256-bit integer');
+    let length = 1;
+    while (value >= 128n) {
+        value >>= 7n;
+        length++;
+    }
+    return length;
+}
+/** Fixed-capacity writer. finish() is a view; copy it before reusing/resetting the writer. */
+class BinaryWriter {
+    #buffer;
+    #position = 0;
+    constructor(capacity = 64) {
+        if (typeof capacity === 'number') {
+            size(capacity);
+            this.#buffer = new Uint8Array(capacity);
         }
-        b = buf[counter++];
-        result += shift < 28
-            ? (b & REST) << shift
-            : (b & REST) * Math.pow(2, shift);
-        shift += 7;
-    } while (b >= MSB);
-    decode$3.bytes = counter - offset;
-    return result;
-};
-
-const N1 = Math.pow(2, 7);
-const N2 = Math.pow(2, 14);
-const N3 = Math.pow(2, 21);
-const N4 = Math.pow(2, 28);
-const N5 = Math.pow(2, 35);
-const N6 = Math.pow(2, 42);
-const N7 = Math.pow(2, 49);
-const N8 = Math.pow(2, 56);
-const N9 = Math.pow(2, 63);
-var encodingLength = (value) => (value < N1 ? 1
-    : value < N2 ? 2
-        : value < N3 ? 3
-            : value < N4 ? 4
-                : value < N5 ? 5
-                    : value < N6 ? 6
-                        : value < N7 ? 7
-                            : value < N8 ? 8
-                                : value < N9 ? 9
-                                    : 10);
-
-var index$4 = {
-    encode: encode$2,
-    decode: decode$3,
-    encodingLength
-};
+        else {
+            bytes(capacity);
+            this.#buffer = capacity;
+        }
+    }
+    get position() {
+        return this.#position;
+    }
+    get remaining() {
+        return this.#buffer.length - this.#position;
+    }
+    #require(length) {
+        size(length);
+        if (length > this.remaining)
+            throw new RangeError('Binary output buffer is too small');
+    }
+    writeVarUint(value) {
+        this.#require(varUintLength(value));
+        this.#writeVarUint(value);
+        return this;
+    }
+    #writeVarUint(value) {
+        while (value >= 128) {
+            this.#buffer[this.#position++] = value % 128 | 128;
+            value = Math.floor(value / 128);
+        }
+        this.#buffer[this.#position++] = value;
+    }
+    writeVarBigInt(value) {
+        this.#require(varBigIntLength(value));
+        do {
+            const byte = Number(value & 127n);
+            value >>= 7n;
+            this.#buffer[this.#position++] = byte | (value ? 128 : 0);
+        } while (value);
+        return this;
+    }
+    writeBytes(value) {
+        bytes(value);
+        this.#require(value.length);
+        this.#buffer.set(value, this.#position);
+        this.#position += value.length;
+        return this;
+    }
+    writeFrame(value) {
+        bytes(value);
+        // Check the complete operation before writing its length prefix.
+        const prefixLength = varUintLength(value.length);
+        this.#require(prefixLength + value.length);
+        const prefixStart = this.#buffer.byteOffset + this.#position;
+        if (value.buffer === this.#buffer.buffer &&
+            value.byteOffset < prefixStart + prefixLength &&
+            value.byteOffset + value.length > prefixStart)
+            throw new RangeError('Frame source overlaps its length prefix');
+        this.#writeVarUint(value.length);
+        this.#buffer.set(value, this.#position);
+        this.#position += value.length;
+        return this;
+    }
+    reset() {
+        this.#position = 0;
+        return this;
+    }
+    finish(copy = false) {
+        const result = this.#buffer.subarray(0, this.#position);
+        // Buffer.slice() aliases memory; this constructor copies every Uint8Array subtype.
+        return copy ? new Uint8Array(result) : result;
+    }
+}
+/** Reads views of the original buffer. Failed operations leave the cursor unchanged. */
+class BinaryReader {
+    #buffer;
+    #position = 0;
+    constructor(buffer) {
+        bytes(buffer);
+        this.#buffer = buffer;
+    }
+    get position() {
+        return this.#position;
+    }
+    get remaining() {
+        return this.#buffer.length - this.#position;
+    }
+    readVarUint(canonical = true) {
+        let result = 0;
+        let multiplier = 1;
+        for (let index = 0; index < 8; index++) {
+            const cursor = this.#position + index;
+            if (cursor >= this.#buffer.length)
+                throw new RangeError('Truncated varint');
+            const byte = this.#buffer[cursor];
+            const payload = byte & 127;
+            if (index === 7 && payload > Math.floor((Number.MAX_SAFE_INTEGER - result) / multiplier))
+                throw new RangeError('Varint exceeds safe integer range');
+            result += payload * multiplier;
+            if (byte < 128) {
+                if (canonical && index > 0 && payload === 0)
+                    throw new RangeError('Non-canonical varint');
+                this.#position = cursor + 1;
+                return result;
+            }
+            multiplier *= 128;
+        }
+        throw new RangeError('Varint exceeds safe integer range');
+    }
+    readVarBigInt(canonical = true) {
+        let result = 0n;
+        for (let index = 0; index < 37; index++) {
+            const cursor = this.#position + index;
+            if (cursor >= this.#buffer.length)
+                throw new RangeError('Truncated varint');
+            const byte = this.#buffer[cursor];
+            result |= BigInt(byte & 127) << BigInt(index * 7);
+            if (result > MAX_BIGINT)
+                throw new RangeError('Varint exceeds 256 bits');
+            if (byte < 128) {
+                if (canonical && index > 0 && byte === 0)
+                    throw new RangeError('Non-canonical varint');
+                this.#position = cursor + 1;
+                return result;
+            }
+        }
+        throw new RangeError('Varint exceeds 256 bits');
+    }
+    readBytes(length) {
+        size(length);
+        if (length > this.remaining)
+            throw new RangeError('Truncated binary field');
+        const start = this.#position;
+        this.#position += length;
+        return this.#buffer.subarray(start, this.#position);
+    }
+    readFrame(canonical = true) {
+        const start = this.#position;
+        try {
+            return this.readBytes(this.readVarUint(canonical));
+        }
+        catch (error) {
+            this.#position = start;
+            throw error;
+        }
+    }
+}
+/** Existing smart-concat bytes, with exactly one output allocation and no prefix arrays. */
+function encodeFrames(frames, prefix) {
+    if (!Array.isArray(frames))
+        throw new TypeError('Expected an array of byte frames');
+    let length = 0;
+    for (const frame of frames) {
+        bytes(frame);
+        length += varUintLength(frame.length) + frame.length;
+        size(length);
+    }
+    const writer = new BinaryWriter(length);
+    for (const frame of frames)
+        writer.writeFrame(frame);
+    return writer.finish();
+}
+/** Iterative framing: bounded by the input length, not recursive stack depth. */
+function decodeFrames(buffer, prefixLength = 0, options = {}) {
+    const reader = new BinaryReader(buffer);
+    reader.readBytes(prefixLength);
+    const maxFrames = options.maxFrames ?? buffer.length;
+    size(maxFrames);
+    const frames = [];
+    while (reader.remaining) {
+        if (frames.length >= maxFrames)
+            throw new RangeError('Too many binary frames');
+        frames.push(reader.readFrame(options.canonical ?? true));
+    }
+    return frames;
+}
 
-var index$3 = (input, prefix) => {
-    const encodedArray = [];
-    const length = input.reduce((total, current) => {
-        const encoded = index$4.encode(current.length);
-        encodedArray.push(encoded);
-        total += current.length + encoded.length;
-        return total;
-    }, 0);
-    const typedArray = new Uint8Array(length);
-    let currentIndex = 0;
-    let index = 0;
-    for (const source of input) {
-        typedArray.set(encodedArray[index], currentIndex);
-        currentIndex += encodedArray[index].length;
-        typedArray.set(source, currentIndex);
-        currentIndex += source.length;
-        index += 1;
-    }
-    return typedArray;
+const asBytes = (source) => {
+    if (source instanceof Uint8Array)
+        return source;
+    // Keep legacy ArrayLike coercion. Typed-array callers take the zero-copy path.
+    const bytes = new Uint8Array(source.length);
+    bytes.set(source);
+    return bytes;
 };
+var index$3 = (input, prefix) => encodeFrames(input.map(asBytes));
 
-var index$2 = (typedArray, prefix) => {
-    const set = [];
-    const varintAndSub = (typedArray) => {
-        const length = index$4.decode(typedArray);
-        // remove length
-        typedArray = typedArray.subarray(index$4.decode.bytes);
-        // push value
-        set.push(typedArray.subarray(0, length));
-        // remove value
-        typedArray = typedArray.subarray(length);
-        if (typedArray.length !== 0)
-            return varintAndSub(typedArray);
-        return set;
-    };
-    return varintAndSub(typedArray);
-};
+var index$2 = (typedArray, prefix) => decodeFrames(typedArray, 0, { canonical: false });
 
 const decode$2 = (multiWif, expectedVersion, expectedCodec) => {
     const decoded = base58$1.decode(multiWif);
@@ -687,176 +800,190 @@ var index$1 = {
  * * b = `7n` // equation param
  * * Gx, Gy are coordinates of Generator / base point
  */
+const freeze = Object.freeze;
+const P = 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2fn;
+const N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;
+const Gx = 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798n;
+const Gy = 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8n;
 // Mirror noble-curves: Point.CURVE() returns shared params, but those params must stay frozen so
 // callers cannot mutate them out from under the arithmetic constants captured below.
-const secp256k1_CURVE = Object.freeze({
-    p: 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2fn,
-    n: 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n,
+const secp256k1_CURVE = freeze({
+    p: P,
+    n: N,
     h: 1n,
     a: 0n,
     b: 7n,
-    Gx: 0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798n,
-    Gy: 0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8n,
+    Gx,
+    Gy,
 });
-const { p: P, n: N, Gx, Gy, b: _b } = secp256k1_CURVE;
 // 32-byte field / scalar width, and the SHA-256 / HMAC-DRBG output width used
 // by the RFC6979 paths here.
 const L = 32;
-const L2 = 64; // 64-byte compact signatures, and 64 hex chars for zero-padded 32-byte scalars
-const lengths = {
-    publicKey: L + 1,
-    publicKeyUncompressed: L2 + 1,
-    // 48-byte keygen seed floor: 384 bits exceeds FIPS 186-5 Table A.2's
-    // 352-bit recommendation for 256-bit prime curves.
-    seed: L + L / 2,
-};
 // Helpers and Precomputes sections are reused between libraries
 // ## Helpers
 // ----------
-const err = (message = '', E = Error) => {
-    const e = new E(message);
-    const { captureStackTrace } = Error;
-    if (typeof captureStackTrace === 'function')
-        captureStackTrace(e, err);
-    throw e;
+/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */
+const isBytes = (a) => {
+    // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases.
+    // The fallback still requires a real ArrayBuffer view, so plain
+    // JSON-deserialized `{ constructor: ... }` spoofing is rejected, and
+    // `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.
+    return (a instanceof Uint8Array ||
+        (ArrayBuffer.isView(a) &&
+            a.constructor.name === 'Uint8Array' &&
+            a.BYTES_PER_ELEMENT === 1));
 };
-// Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases. The
-// fallback still requires a real ArrayBuffer view so plain JSON-deserialized `{ constructor: ... }`
-// spoofing is rejected, and `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.
-const isBytes = (a) => a instanceof Uint8Array ||
-    (ArrayBuffer.isView(a) &&
-        a.constructor.name === 'Uint8Array' &&
-        a.BYTES_PER_ELEMENT === 1);
-/** Asserts something is Bytes. */
+/** Asserts something is Uint8Array. */
 const abytes = (value, length, title = '') => {
+    // Success path first: this runs at the start of every update() / digestInto(), and the
+    // common `abytes(data)` form must not pay for length handling it does not use.
+    if (isBytes(value) && (length === undefined || value.length === length))
+        return value;
+    // Error path: recompute freely to build the exact message.
     const bytes = isBytes(value);
-    const len = value?.length;
-    const needsLen = length !== undefined;
-    if (!bytes || (needsLen && len !== length)) {
-        const prefix = title && `"${title}" `;
-        const ofLen = needsLen ? ` of length ${length}` : '';
-        const got = bytes ? `length=${len}` : `type=${typeof value}`;
-        const msg = prefix + 'expected Uint8Array' + ofLen + ', got ' + got;
-        return bytes ? err(msg, RangeError) : err(msg, TypeError);
-    }
-    return value;
+    const ofLen = length !== undefined ? ` of length ${length}` : '';
+    const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+    const message = (title ? `"${title}" ` : '') + 'expected Uint8Array' + ofLen + ', got ' + got;
+    if (!bytes)
+        throw new TypeError(message);
+    throw new RangeError(message);
 };
-/** create Uint8Array */
-const u8n = (len) => new Uint8Array(len);
+// Signing can retain the message across hash callbacks / awaits, and Schnorr hashes it more than
+// once. Take one owned snapshot so caller mutation cannot change the signing transcript.
+// cloneBytes expects an already-validated view; snapshotBytes validates, then copies.
+const cloneBytes = (value) => Uint8Array.from(value);
+const snapshotBytes = (value, title, length) => cloneBytes(abytes(value, length, title));
 // Callers keep values non-negative and within the requested width; padStart() won't truncate over-wide inputs.
 const padh = (n, pad) => n.toString(16).padStart(pad, '0');
-/** Render bytes as lowercase hex. */
-const bytesToHex = (b) => {
+/** Convert byte array to hex string. */
+const bytesToHex = (bytes) => {
     let hex = '';
-    for (const e of abytes(b))
-        hex += padh(e, 2);
+    for (const byte of abytes(bytes))
+        hex += padh(byte, 2);
     return hex;
 };
-const C = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 }; // ASCII characters
-// Strict ASCII nibble parser: non-ASCII hex lookalikes are rejected as undefined.
-// prettier-ignore
-const _ch = (ch) => ch >= C._0 && ch <= C._9 ? ch - C._0 // '2' => 50-48
-    : ch >= C.A && ch <= C.F ? ch - (C.A - 10) // 'B' => 66-(65-10)
-        : ch >= C.a && ch <= C.f ? ch - (C.a - 10) // 'b' => 98-(97-10)
-            : undefined;
+/** Convert hex string to byte array. */
 const hexToBytes = (hex) => {
-    const e = 'hex invalid'; // Strict ASCII hex only, with one generic error for type and parse failures.
+    const e = 'hex invalid'; // Strict ASCII hex only, with one generic error for parse failures.
     if (typeof hex !== 'string')
-        return err(e);
-    const hl = hex.length;
-    const al = hl / 2;
-    if (hl % 2)
-        return err(e);
-    const array = u8n(al);
-    for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
-        // treat each char as ASCII
-        const n1 = _ch(hex.charCodeAt(hi)); // parse first char, multiply it by 16
-        const n2 = _ch(hex.charCodeAt(hi + 1)); // parse second char
-        if (n1 === undefined || n2 === undefined)
-            return err(e);
-        array[ai] = n1 * 16 + n2; // example: 'A9' => 10*16 + 9
+        throw new TypeError(e);
+    if (hex.length % 2 || !/^[\da-f]*$/i.test(hex))
+        throw new RangeError(e);
+    const array = new Uint8Array(hex.length / 2);
+    for (let ai = 0, hi = 0; ai < array.length; ai++, hi += 2) {
+        const n1 = hex.charCodeAt(hi);
+        const n2 = hex.charCodeAt(hi + 1);
+        // Regex guarantees ASCII. For 0..9/A..F/a..f, this maps char codes to 0..15.
+        array[ai] = ((n1 & 15) + (n1 >> 6) * 9) * 16 + (n2 & 15) + (n2 >> 6) * 9;
     }
     return array;
 };
 // WebCrypto is available in all modern environments
-const subtle = () => globalThis?.crypto?.subtle ?? err('crypto.subtle must be defined, consider polyfill');
-// prettier-ignore
-const concatBytes = (...arrs) => {
-    let len = 0;
-    for (const a of arrs)
-        len += abytes(a).length; // validate every input and sum lengths before copying
-    const r = u8n(len);
-    let pad = 0; // walk through each array,
-    for (const a of arrs)
-        r.set(a, pad), pad += a.length; // ensure they have proper type
-    return r;
+const subtle = () => {
+    const s = globalThis?.crypto?.subtle;
+    if (s)
+        return s;
+    throw new Error('crypto.subtle must be defined, consider polyfill');
+};
+/** Copies several Uint8Arrays into one. */
+const concatBytes = (...arrays) => {
+    let sum = 0;
+    for (const a of arrays)
+        sum += abytes(a).length;
+    const res = new Uint8Array(sum);
+    let pad = 0;
+    for (const a of arrays) {
+        res.set(a, pad);
+        pad += a.length;
+    }
+    return res;
 };
 /**
  * WebCrypto OS-level CSPRNG (random number generator).
  * Will throw when not available; large-request ceilings are delegated to getRandomValues().
  */
-const randomBytes = (len = L) => (globalThis?.crypto).getRandomValues(u8n(len));
+const randomBytes = (len = L) => {
+    const c = globalThis?.crypto;
+    if (typeof c?.getRandomValues !== 'function')
+        throw new Error('crypto.getRandomValues must be defined, consider polyfill');
+    return c.getRandomValues(new Uint8Array(len));
+};
 const big = BigInt;
 const arange = (n, min, max, msg = 'bad number: out of range') => {
     if (typeof n !== 'bigint')
-        return err(msg, TypeError);
+        throw new TypeError(msg);
     if (min <= n && n < max)
         return n;
-    return err(msg, RangeError);
+    throw new RangeError(msg);
 };
 /** Canonical modular reduction. Callers must provide a positive modulus. */
-const M = (a, b = P) => {
-    const r = a % b;
-    return r >= 0n ? r : b + r;
-};
+const M = (a, b = P) => ((a %= b) >= 0n ? a : b + a);
 const modN = (a) => M(a, N);
-/** Modular inversion using eucledian GCD (non-CT). No negative exponent for now. */
-// prettier-ignore
-const invert = (num, md) => {
-    if (num === 0n || md <= 0n)
-        err('no inverse n=' + num + ' mod=' + md);
-    let a = M(num, md), b = md, x = 0n, u = 1n;
+/** Modular inversion using extended euclidean GCD. Variable-time (non-CT). */
+const invert = (number, modulo) => {
+    if (number === 0n)
+        throw new Error('invert: expected non-zero number');
+    // modulo = 1 is the zero ring: gcd(x, 1) = 1 makes the loop below "succeed" and return the
+    // useless inverse 0. Reject it.
+    if (modulo <= 1n)
+        throw new Error('invert: expected modulus > 1, got ' + modulo);
+    // This is variable-time: the loop count depends on `number`.
+    let a = M(number, modulo);
+    let b = modulo;
+    // Only the Bézout coefficient of `number` (x/u chain) is tracked; the coefficient of `modulo`
+    // never affects the output, so it is not computed.
+    // prettier-ignore
+    let x = 0n, u = 1n;
     while (a !== 0n) {
-        const q = b / a, r = b % a;
+        const q = b / a;
+        const r = b - a * q;
         const m = x - u * q;
+        // prettier-ignore
         b = a, a = r, x = u, u = m;
     }
-    return b === 1n ? M(x, md) : err('no inverse'); // b is gcd at this point
+    const gcd = b;
+    if (gcd !== 1n)
+        throw new Error('invert: does not exist');
+    return M(x, modulo);
 };
-const callHash = (name) => {
+const _hash = (name) => {
     // @ts-ignore
     const fn = hashes[name];
     if (typeof fn !== 'function')
-        err('hashes.' + name + ' not set');
+        throw new Error('hashes.' + name + ' not set');
     return fn;
 };
 // All exported provider slots are caller-configurable and may be unset or return arbitrary values,
 // so wrapper helpers must enforce the exact 32-byte digest contract instead of trusting providers.
-const gh = (name, a, b) => abytes(callHash(name)(a, b), L, 'digest');
-const gha = (name, a, b) => Promise.resolve(callHash(name)(a, b)).then((r) => abytes(r, L, 'digest'));
+const callHash = (name, a, b) => abytes(_hash(name)(a, b), L, 'digest');
+const callHashAsync = async (name, a, b) => abytes(await _hash(name)(a, b), L, 'digest');
 // also rejects structurally similar Point values from other realms / bundled copies
-const apoint = (p) => (p instanceof Point ? p : err('Point expected'));
+const apoint = (p) => {
+    if (p instanceof Point)
+        return p;
+    throw new TypeError('Point expected');
+};
 // ## End of Helpers
 // -----------------
+const E_BADPOINT = 'bad point: not on curve';
 /**
  * secp256k1 formula. Koblitz curves are subclass of weierstrass curves with a=0,
  * making it x³+b; callers validate x first.
  */
-const koblitz = (x) => M(M(x * x) * x + _b);
+const koblitz = (x) => M(M(x * x) * x + 7n);
 /** assert is element of field mod P (incl. 0 for projective infinity coordinates) */
 const FpIsValid = (n) => arange(n, 0n, P);
 /** assert is element of field mod P (excl. 0 where current callers need a non-zero coordinate) */
 const FpIsValidNot0 = (n) => arange(n, 1n, P);
-/** assert is element of field mod N (excl. 0), matching the shared BIP340 scalar-failure rule used here */
+/** assert is element of field mod N (excl. 0), matching the shared BIP340 scalar-failure rule used here.
+ * There is deliberately no FnIsValid: no caller accepts the scalar 0. */
 const FnIsValidNot0 = (n) => arange(n, 1n, N);
 // Shared parity primitive for BIP340 even-y checks and SEC 1 compressed prefixes.
 const isEven = (y) => !(y & 1n);
-/** create Uint8Array of byte n */
-const u8of = (n) => Uint8Array.of(n);
 /** SEC 1 compressed-prefix helper. Parity only: callers validate y before asking for the prefix byte. */
-const getPrefix = (y) => u8of(isEven(y) ? 0x02 : 0x03);
-/** lift_x from BIP340 returns the unique even square root for x³+7.
- * SEC 1 callers still flip it for the odd-prefix branch. */
+const getPrefix = (y) => Uint8Array.of(isEven(y) ? 0x02 : 0x03);
+/** lift_x from BIP340 returns the unique point with x and an even square root of x³+7.
+ * SEC 1 callers still negate it for the odd-prefix branch. */
 const lift_x = (x) => {
     // Let c = x³ + 7 mod p. Fail if x ≥ p. (also fail if x < 1)
     const c = koblitz(FpIsValidNot0(x));
@@ -872,8 +999,8 @@ const lift_x = (x) => {
         num = (num * num) % P; // Not constant-time.
     }
     if (M(r * r) !== c)
-        err('sqrt invalid'); // check if result is valid
-    return isEven(r) ? r : M(-r);
+        throw new Error('sqrt invalid'); // check if result is valid
+    return new Point(x, isEven(r) ? r : M(-r), 1n);
 };
 /**
  * Point in 3d xyz projective coordinates. 3d takes less inversions than 2d.
@@ -897,7 +1024,7 @@ class Point {
         this.X = FpIsValid(X);
         this.Y = FpIsValidNot0(Y); // Y can't be 0 in Projective
         this.Z = FpIsValid(Z);
-        Object.freeze(this);
+        freeze(this);
     }
     /** Returns the shared curve metadata object by reference.
      * It is readonly only at type level, and mutating it won't retarget arithmetic,
@@ -913,30 +1040,31 @@ class Point {
     /** Convert Uint8Array or hex string to Point. */
     static fromBytes(bytes) {
         abytes(bytes);
-        const { publicKey: comp, publicKeyUncompressed: uncomp } = lengths; // e.g. for 32-byte: 33, 65
-        let p = undefined;
         const length = bytes.length;
         const head = bytes[0];
-        const tail = bytes.subarray(1);
-        const x = sliceBytesNumBE(tail, 0, L);
+        const x = sliceBytesNumBE(bytes, 1, 33);
         // SEC 1 defines the rare infinity encoding 0x00, but SEC 1 public-key validation rejects
         // infinity. We keep 0x00 rejected here because this parser is reused by verify(), ECDH,
         // and public-key validation helpers, so strict handling applies to all callers by default.
         // Local secp256k1 crosstests show OpenSSL raw point codecs accept 0x00 too.
-        // Parse SEC 1 compressed/uncompressed encodings, then finish with assertValidity() before returning.
-        if (length === comp && (head === 0x02 || head === 0x03)) {
-            // Equation is y² == x³ + ax + b. We calculate y from x.
-            // lift_x() returns the even root; SEC 1 0x03 still needs the odd root.
-            let y = lift_x(x);
-            if (head === 0x03)
-                y = M(-y);
-            p = new Point(x, y, 1n);
+        // Parse and validate SEC 1 compressed/uncompressed encodings before returning.
+        try {
+            if (length === 33 && (head === 0x02 || head === 0x03)) {
+                // Equation is y² == x³ + ax + b. We calculate y from x.
+                // lift_x() returns the even point; SEC 1 0x03 still needs the odd point.
+                const p = lift_x(x);
+                return head === 0x03 ? p.negate() : p;
+            }
+            // Uncompressed 65-byte point, 0x04 prefix
+            if (length === 65 && head === 0x04)
+                return new Point(x, sliceBytesNumBE(bytes, 33, 65), 1n).assertValidity();
         }
-        // Uncompressed 65-byte point, 0x04 prefix
-        if (length === uncomp && head === 0x04)
-            p = new Point(x, sliceBytesNumBE(tail, L, L2), 1n);
-        // Validate point
-        return p ? p.assertValidity() : err('bad point: not on curve');
+        catch (error) {
+            // Out-of-range coordinates and non-residue x report the same error as wrong
+            // prefixes / off-curve points, instead of generic range-check messages.
+            throw new Error(E_BADPOINT);
+        }
+        throw new Error(E_BADPOINT);
     }
     static fromHex(hex) {
         return Point.fromBytes(hexToBytes(hex));
@@ -951,14 +1079,10 @@ class Point {
     equals(other) {
         const { X: X1, Y: Y1, Z: Z1 } = this;
         const { X: X2, Y: Y2, Z: Z2 } = apoint(other); // checks class equality
-        const X1Z2 = M(X1 * Z2);
-        const X2Z1 = M(X2 * Z1);
-        const Y1Z2 = M(Y1 * Z2);
-        const Y2Z1 = M(Y2 * Z1);
-        return X1Z2 === X2Z1 && Y1Z2 === Y2Z1;
+        return M(X1 * Z2) === M(X2 * Z1) && M(Y1 * Z2) === M(Y2 * Z1);
     }
     is0() {
-        return this.equals(I);
+        return this.Z === 0n;
     }
     /** Flip point over y coordinate. */
     negate() {
@@ -978,7 +1102,7 @@ class Point {
         const { X: X1, Y: Y1, Z: Z1 } = this;
         const { X: X2, Y: Y2, Z: Z2 } = apoint(other);
         const a = 0n;
-        const b = _b;
+        const b = 7n;
         let X3 = 0n, Y3 = 0n, Z3 = 0n;
         const b3 = M(b * 3n);
         let t0 = M(X1 * X2), t1 = M(Y1 * Y2), t2 = M(Z1 * Z2), t3 = M(X1 + Y1); // step 1
@@ -1042,13 +1166,18 @@ class Point {
         // init result point & fake point
         let p = I;
         let f = G;
-        for (let d = this; n > 0n; d = d.double(), n >>= 1n) {
+        let d = this;
+        // Safe mode always runs 256 iterations so ladder length can't leak the scalar's
+        // leading zero bits; unsafe mode stops at the top set bit for speed.
+        for (let i = 0; safe ? i < 256 : n > 0n; i++) {
             // if bit is present, add to point
             // if not present, add to fake, for timing safety
             if (n & 1n)
                 p = p.add(d);
             else if (safe)
                 f = f.add(d);
+            d = d.double();
+            n >>= 1n;
         }
         return p;
     }
@@ -1059,14 +1188,14 @@ class Point {
     toAffine() {
         const { X: x, Y: y, Z: z } = this;
         // fast-paths for ZERO point OR Z=1
-        if (this.equals(I))
+        if (z === 0n)
             return { x: 0n, y: 0n };
         if (z === 1n)
             return { x, y };
         const iz = invert(z, P);
         // (Z * Z^-1) must be 1, otherwise bad math
         if (M(z * iz) !== 1n)
-            err('inverse invalid');
+            throw new Error('inverse invalid');
         // x = X*Z^-1; y = Y*Z^-1
         return { x: M(x * iz), y: M(y * iz) };
     }
@@ -1076,7 +1205,9 @@ class Point {
         FpIsValidNot0(x); // must be in range 1 <= x,y < P
         FpIsValidNot0(y);
         // y² == x³ + ax + b, equation sides must be equal
-        return M(y * y) === koblitz(x) ? this : err('bad point: not on curve');
+        if (M(y * y) !== koblitz(x))
+            throw new Error(E_BADPOINT);
+        return this;
     }
     /** Converts point to 33/65-byte Uint8Array. */
     toBytes(isCompressed = true) {
@@ -1086,7 +1217,7 @@ class Point {
         const x32b = numTo32b(x);
         if (isCompressed)
             return concatBytes(getPrefix(y), x32b);
-        return concatBytes(u8of(0x04), x32b, numTo32b(y));
+        return concatBytes(Uint8Array.of(0x04), x32b, numTo32b(y));
     }
     toHex(isCompressed) {
         return bytesToHex(this.toBytes(isCompressed));
@@ -1101,17 +1232,14 @@ Point.BASE = G;
 Point.ZERO = I;
 /** `Q = u1⋅G + u2⋅R`. Verifies Q is not ZERO. Unsafe: non-CT. */
 const doubleScalarMulUns = (R, u1, u2) => {
-    return G.multiply(u1, false)
-        .add(R.multiply(u2, false))
-        .assertValidity();
+    return G.multiply(u1, false).add(R.multiply(u2, false)).assertValidity();
 };
 // Inherits byte validation from bytesToHex(); the || '0' fallback keeps empty input mapped to 0n.
 const bytesToNumBE = (b) => big('0x' + (bytesToHex(b) || '0'));
 // Callers provide monotone slice bounds; subarray() would otherwise clamp or reinterpret them silently.
 const sliceBytesNumBE = (b, from, to) => bytesToNumBE(b.subarray(from, to));
-const B256 = 2n ** 256n; // secp256k1 is weierstrass curve. Equation is x³ + ax + b.
-/** Generic 32-byte big-endian encoder. Must be 0 <= num < B256; call sites need not be field/scalar elements. */
-const numTo32b = (num) => hexToBytes(padh(arange(num, 0n, B256), L2));
+/** Generic 32-byte big-endian encoder. Must be 0 <= num < 2²⁵⁶; call sites need not be field/scalar elements. */
+const numTo32b = (num) => hexToBytes(padh(arange(num, 0n, 2n ** 256n), L * 2)); // L*2 = 64 hex chars for a zero-padded 32-byte value
 /** Normalize private key to scalar (bigint). Verifies scalar is in range 1 <= d < N. */
 const secretKeyToScalar = (secretKey) => {
     const num = bytesToNumBE(abytes(secretKey, L, 'secret key'));
@@ -1142,12 +1270,11 @@ const isValidSecretKey = (secretKey) => {
     }
 };
 const isValidPublicKey = (publicKey, isCompressed) => {
-    const { publicKey: comp, publicKeyUncompressed } = lengths;
     try {
         const l = publicKey.length;
-        if (isCompressed === true && l !== comp)
+        if (isCompressed === true && l !== 33)
             return false;
-        if (isCompressed === false && l !== publicKeyUncompressed)
+        if (isCompressed === false && l !== 65)
             return false;
         return !!Point.fromBytes(publicKey);
     }
@@ -1175,12 +1302,11 @@ const _sha = 'SHA-256';
 const hashes = {
     hmacSha256Async: async (key, message) => {
         const s = subtle();
-        const name = 'HMAC';
-        const k = await s.importKey('raw', key, { name, hash: { name: _sha } }, false, ['sign']);
-        return u8n(await s.sign(name, k, message));
+        const k = await s.importKey('raw', key, { name: 'HMAC', hash: _sha }, false, ['sign']);
+        return new Uint8Array(await s.sign('HMAC', k, message));
     },
     hmacSha256: undefined,
-    sha256Async: async (msg) => u8n(await subtle().digest(_sha, msg)),
+    sha256Async: async (msg) => new Uint8Array(await subtle().digest(_sha, msg)),
     sha256: undefined,
 };
 /**
@@ -1207,20 +1333,17 @@ const getSharedSecret = (secretKeyA, publicKeyB, isCompressed = true) => {
 // FIPS 186-5 Appendix A.4.1 style key generation reduces a wide random integer mod (n - 1) and adds 1.
 // The 48-byte minimum keeps the secp256k1 bias bound below the appendix's epsilon <= 2^-64 target.
 const randomSecretKey = (seed) => {
-    seed = seed === undefined ? randomBytes(lengths.seed) : seed;
+    seed = seed === undefined ? randomBytes(48) : seed;
     abytes(seed);
     // Keep the public range text aligned with the enforced 48-byte FIPS floor.
-    if (seed.length < lengths.seed || seed.length > 1024)
-        return err('expected 48-1024b', RangeError);
+    if (seed.length < 48 || seed.length > 1024)
+        throw new RangeError('expected 48-1024b');
     const num = M(bytesToNumBE(seed), N - 1n);
     return numTo32b(num + 1n);
 };
 const createKeygen = (getPublicKey) => (seed) => {
     const secretKey = randomSecretKey(seed);
-    return {
-        secretKey,
-        publicKey: getPublicKey(secretKey),
-    };
+    return { secretKey, publicKey: getPublicKey(secretKey) };
 };
 /**
  * Math, hex, byte helpers. Not in `utils` because utils share API with noble-curves.
@@ -1231,17 +1354,17 @@ const createKeygen = (getPublicKey) => (seed) => {
  * const hex = etc.bytesToHex(new Uint8Array([1, 2, 3]));
  * ```
  */
-const etc = /* @__PURE__ */ Object.freeze({
+const etc = /* @__PURE__ */ freeze({
     hexToBytes,
     bytesToHex,
     concatBytes,
     bytesToNumberBE: bytesToNumBE,
     numberToBytesBE: numTo32b,
     mod: M,
-    invert: invert, // math utilities; keep public alias type aligned with runtime
+    invert,
     randomBytes,
-    secretKeyToScalar: secretKeyToScalar,
-    abytes: abytes,
+    secretKeyToScalar,
+    abytes,
 });
 /**
  * Curve-specific key utilities.
@@ -1253,26 +1376,23 @@ const etc = /* @__PURE__ */ Object.freeze({
  * const publicKey = secp.getPublicKey(secretKey);
  * ```
  */
-const utils$2 = /* @__PURE__ */ Object.freeze({
-    isValidSecretKey: isValidSecretKey,
-    isValidPublicKey: isValidPublicKey,
-    randomSecretKey: randomSecretKey, // preserve the optional seeded call
+const utils$2 = /* @__PURE__ */ freeze({
+    isValidSecretKey,
+    isValidPublicKey,
+    randomSecretKey,
 });
 // Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.
 // https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki
 // Internal BIP340 tag names are ASCII-only here, so charCodeAt() is enough; this is not a general UTF-8 encoder.
 const getTag = (tag) => Uint8Array.from('BIP0340/' + tag, (c) => c.charCodeAt(0));
-const T_AUX = 'aux';
-const T_NONCE = 'nonce';
-const T_CHALLENGE = 'challenge';
 // Both SHA-256 provider slots are configurable, so tag hashing still goes through the checked
 // wrappers even though the built-in defaults are deterministic and the tag bytes are ASCII-only.
 const taggedHash = (tag, ...messages) => {
-    const tagH = gh('sha256', getTag(tag));
-    return gh('sha256', concatBytes(tagH, tagH, ...messages));
+    const tagH = callHash('sha256', getTag(tag));
+    return callHash('sha256', concatBytes(tagH, tagH, ...messages));
 };
 // Async twin of taggedHash with the same checked provider boundary.
-const taggedHashAsync = (tag, ...messages) => gha('sha256Async', getTag(tag)).then((tagH) => gha('sha256Async', concatBytes(tagH, tagH, ...messages)));
+const taggedHashAsync = (tag, ...messages) => callHashAsync('sha256Async', getTag(tag)).then((tagH) => callHashAsync('sha256Async', concatBytes(tagH, tagH, ...messages)));
 // BIP340 PubKey(sk) = bytes(d'⋅G), where bytes(P) is bytes(x(P)); signing also normalizes
 // d to the equivalent scalar whose point has even y so the x-only public key stays canonical.
 const extpubSchnorr = (priv) => {
@@ -1284,8 +1404,8 @@ const extpubSchnorr = (priv) => {
     return { d, px };
 };
 const bytesModN = (bytes) => modN(bytesToNumBE(bytes));
-const challenge = (...args) => bytesModN(taggedHash(T_CHALLENGE, ...args));
-const challengeAsync = async (...args) => bytesModN(await taggedHashAsync(T_CHALLENGE, ...args));
+const challenge = (...args) => bytesModN(taggedHash('challenge', ...args));
+const challengeAsync = async (...args) => bytesModN(await taggedHashAsync('challenge', ...args));
 /** Schnorr public key is just `x` coordinate of Point as per BIP340. */
 const pubSchnorr = (secretKey) => {
     return extpubSchnorr(secretKey).px; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)
@@ -1293,13 +1413,14 @@ const pubSchnorr = (secretKey) => {
 const keygenSchnorr = /* @__PURE__ */ createKeygen(pubSchnorr);
 // Common preparation fn for both sync and async signing
 const prepSigSchnorr = (message, secretKey, auxRand) => {
+    const m = snapshotBytes(message, 'message');
     const { px, d } = extpubSchnorr(secretKey);
-    return { m: abytes(message), px, d, a: abytes(auxRand, L) };
+    return { m, px, d, a: abytes(auxRand, L) };
 };
 const extractK = (rand) => {
     const k_ = bytesModN(rand); // Let k' = int(rand) mod n
     if (k_ === 0n)
-        err('sign failed: k is zero'); // Fail if k' = 0.
+        throw new Error('sign failed: k is zero'); // Fail if k' = 0.
     const { px, d } = extpubSchnorr(numTo32b(k_)); // Let R = k'⋅G.
     return { rx: px, k: d };
 };
@@ -1315,73 +1436,78 @@ const E_INVSIG = 'invalid signature produced';
  */
 const signSchnorr = (message, secretKey, auxRand = randomBytes(L)) => {
     const { m, px, d, a } = prepSigSchnorr(message, secretKey, auxRand);
-    const aux = taggedHash(T_AUX, a);
     // Let t be the byte-wise xor of bytes(d) and hash/aux(a)
-    const t = numTo32b(d ^ bytesToNumBE(aux));
+    const t = numTo32b(d ^ bytesToNumBE(taggedHash('aux', a)));
     // Let rand = hash/nonce(t || bytes(P) || m)
-    const rand = taggedHash(T_NONCE, t, px, m);
-    const { rx, k } = extractK(rand);
+    const { rx, k } = extractK(taggedHash('nonce', t, px, m));
     // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.
-    const e = challenge(rx, px, m);
-    const sig = createSigSchnorr(k, rx, e, d);
+    const sig = createSigSchnorr(k, rx, challenge(rx, px, m), d);
     // If Verify(bytes(P), m, sig) (see below) returns failure, abort
     if (!verifySchnorr(sig, m, px))
-        err(E_INVSIG);
+        throw new Error(E_INVSIG);
     return sig;
 };
 const signSchnorrAsync = async (message, secretKey, auxRand = randomBytes(L)) => {
     const { m, px, d, a } = prepSigSchnorr(message, secretKey, auxRand);
-    const aux = await taggedHashAsync(T_AUX, a);
     // Let t be the byte-wise xor of bytes(d) and hash/aux(a)
-    const t = numTo32b(d ^ bytesToNumBE(aux));
+    const t = numTo32b(d ^ bytesToNumBE(await taggedHashAsync('aux', a)));
     // Let rand = hash/nonce(t || bytes(P) || m)
-    const rand = await taggedHashAsync(T_NONCE, t, px, m);
-    const { rx, k } = extractK(rand);
+    const { rx, k } = extractK(await taggedHashAsync('nonce', t, px, m));
     // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.
-    const e = await challengeAsync(rx, px, m);
-    const sig = createSigSchnorr(k, rx, e, d);
+    const sig = createSigSchnorr(k, rx, await challengeAsync(rx, px, m), d);
     // If Verify(bytes(P), m, sig) (see below) returns failure, abort
     if (!(await verifySchnorrAsync(sig, m, px)))
-        err(E_INVSIG);
+        throw new Error(E_INVSIG);
     return sig;
 };
 const callSyncAsyncFn = (res, later) => {
     return res instanceof Promise ? res.then(later) : later(res);
 };
 const _verifSchnorr = (signature, message, publicKey, challengeFn) => {
-    const sig = abytes(signature, L2, 'signature');
+    const sig = abytes(signature, 64, 'signature');
     const msg = abytes(message, undefined, 'message');
     const pub = abytes(publicKey, L, 'publicKey');
+    let P_;
+    let r;
+    let s;
+    let chalInput; // challenge preimage bytes(r) || bytes(P) || m
     try {
         // lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.
         // Fail if x ≥ p. Let c = x³ + 7 mod p.
         const x = bytesToNumBE(pub);
-        const y = lift_x(x); // lift_x already returns the unique even root required by BIP340.
-        const P_ = new Point(x, y, 1n).assertValidity();
-        const px = numTo32b(P_.toAffine().x);
+        P_ = lift_x(x); // lift_x returns the validated even-y point required by BIP340.
         // P = lift_x(int(pk)); fail if that fails
-        const r = sliceBytesNumBE(sig, 0, L); // Let r = int(sig[0:32]); fail if r ≥ p.
-        arange(r, 1n, P);
-        const s = sliceBytesNumBE(sig, L, L2); // Let s = int(sig[32:64]); fail if s ≥ n.
+        r = FpIsValidNot0(sliceBytesNumBE(sig, 0, L)); // Let r = int(sig[0:32]); fail if r ≥ p.
+        // Let s = int(sig[32:64]); fail if s ≥ n.
         // Stricter than BIP-340/libsecp256k1, which only reject s >= n. Honest signing reaches
         // s = 0 only with negligible probability (k + e*d ≡ 0 mod n), so treat zero-s inputs as
         // crafted edge cases and fail closed instead of carrying that extra verification surface.
-        arange(s, 1n, N);
-        const i = concatBytes(numTo32b(r), px, msg);
-        // int(challenge(bytes(r)||bytes(P)||m))%n
-        return callSyncAsyncFn(challengeFn(i), (e) => {
-            const { x, y } = doubleScalarMulUns(P_, s, modN(-e)).toAffine(); // R = s⋅G - e⋅P
-            if (!isEven(y) || x !== r)
-                return false; // -eP == (n-e)P
-            return true; // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.
-        });
+        s = FnIsValidNot0(sliceBytesNumBE(sig, L, 64));
+        // lift_x validated x < P, so the 32-byte input encoding equals bytes(P.x) exactly.
+        chalInput = concatBytes(numTo32b(r), pub, msg);
     }
     catch (error) {
         return false;
     }
+    // Hash-provider errors (unset hashes.sha256, missing crypto.subtle, bad provider digests)
+    // stay outside the catch above: backend misconfiguration is not an "invalid signature"
+    // result, so it throws / rejects instead of becoming false.
+    // int(challenge(bytes(r)||bytes(P)||m))%n
+    return callSyncAsyncFn(challengeFn(chalInput), (e) => {
+        try {
+            const { x, y } = doubleScalarMulUns(P_, s, modN(-e)).toAffine(); // R = s⋅G - e⋅P
+            if (!isEven(y) || x !== r)
+                return false; // -eP == (n-e)P
+            return true; // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.
+        }
+        catch (error) {
+            return false; // is_infinite(R) throws inside doubleScalarMulUns
+        }
+    });
 };
-/** Verifies Schnorr signature. Sync wrapper returns false for post-validation failures
- * after the initial byte checks. */
+/** Verifies Schnorr signature. Invalid points, scalars and failed curve checks return false;
+ * hash-backend misconfiguration (e.g. unset hashes.sha256) throws instead, since it is a
+ * runtime/backend error, not an "invalid signature" result. */
 const verifySchnorr = (s, m, p) => _verifSchnorr(s, m, p, challenge);
 /** Async Schnorr verification. Curve/encoding failures after the initial byte checks still
  * become false, but async backend failures reject the promise. Missing crypto.subtle is a
@@ -1403,7 +1529,7 @@ const verifySchnorrAsync = async (s, m, p) => _verifSchnorr(s, m, p, challengeAs
  * const isValid = secp.schnorr.verify(sig, message, publicKey);
  * ```
  */
-const schnorr = /* @__PURE__ */ Object.freeze({
+const schnorr = /* @__PURE__ */ freeze({
     keygen: keygenSchnorr,
     getPublicKey: pubSchnorr,
     sign: signSchnorr,
@@ -1413,18 +1539,14 @@ const schnorr = /* @__PURE__ */ Object.freeze({
 });
 // ## Precomputes
 // --------------
-const W = 8; // W is window size
-const scalarBits = 256;
-const pwindows = Math.ceil(scalarBits / W) + 1; // 33 for W=8, NOT 32 - see wNAF loop
-const pwindowSize = 2 ** (W - 1); // 128 for W=8
 const precompute = () => {
     const points = [];
     let p = G;
     let b = p;
-    for (let w = 0; w < pwindows; w++) {
+    for (let w = 0; w < 33; w++) {
         b = p;
         points.push(b);
-        for (let i = 1; i < pwindowSize; i++) {
+        for (let i = 1; i < 128; i++) {
             b = b.add(p);
             points.push(b);
         } // i=1, bc we skip 0
@@ -1453,37 +1575,32 @@ const wNAF = (n) => {
     const comp = Gpows || (Gpows = precompute());
     let p = I;
     let f = G; // f must be G, or could become I in the end
-    const pow_2_w = 2 ** W; // 256 for W=8
-    const maxNum = pow_2_w; // 256 for W=8
-    const mask = big(pow_2_w - 1); // 255 for W=8 == mask 0b11111111
-    const shiftBy = big(W); // 8 for W=8
-    for (let w = 0; w < pwindows; w++) {
-        let wbits = Number(n & mask); // extract W bits.
-        n >>= shiftBy; // shift number by W bits.
+    for (let w = 0; w < 33; w++) {
+        let wbits = Number(n & 255n); // extract W=8 bits.
+        n >>= 8n; // shift number by W=8 bits.
         // We use negative indexes to reduce size of precomputed table by 2x.
         // Instead of needing precomputes 0..256, we only calculate them for 0..128.
         // If an index > 128 is found, we do (256-index) - where 256 is next window.
         // Naive: index +127 => 127, +224 => 224
         // Optimized: index +127 => 127, +224 => 256-32
-        if (wbits > pwindowSize) {
-            wbits -= maxNum;
+        if (wbits > 128) {
+            wbits -= 256;
             n += 1n;
         }
-        const off = w * pwindowSize;
-        const offF = off; // offsets, evaluate both
+        const off = w * 128;
         const offP = off + Math.abs(wbits) - 1;
-        const isEven = w % 2 !== 0; // conditions, evaluate both
+        const isOddW = w % 2 !== 0; // conditions, evaluate both; alternates fake-add sign per window
         const isNeg = wbits < 0;
         if (wbits === 0) {
-            // off == I: can't add it. Adding random offF instead.
-            f = f.add(ctneg(isEven, comp[offF])); // bits are 0: add garbage to fake point
+            // off == I: can't add it. Add the first point in this window to the fake accumulator.
+            f = f.add(ctneg(isOddW, comp[off])); // bits are 0: add garbage to fake point
         }
         else {
             p = p.add(ctneg(isNeg, comp[offP])); // bits are 1: add to result point
         }
     }
     if (n !== 0n)
-        err('invalid wnaf');
+        throw new Error('invalid wnaf');
     return { p, f }; // return both real and fake points for JIT/leakage-shape symmetry
 };
 
@@ -2403,10 +2520,10 @@ class HdNode {
         return (async () => (await this.identifier).subarray(0, 4))();
     }
     async hash160(data) {
-        const hash = await createHash(data, 'SHA-256');
+        const hash = await createHash(data, "SHA-256");
         return (await createRIPEMD160())
             .update(new Uint8Array(hash))
-            .digest('binary');
+            .digest("binary");
     }
     get isNeutered() {
         return this.#privateKey === undefined;
@@ -2416,24 +2533,24 @@ class HdNode {
     }
     fromPrivateKey(privateKey, chainCode, network) {
         if (!privateKeyVerify(privateKey))
-            throw new TypeError('Private key not in range [1, n)');
+            throw new TypeError("Private key not in range [1, n)");
         const publicKey = publicKeyCreate(privateKey, true);
         return new HdNode(privateKey, publicKey, publicKey.slice(1), network);
     }
     fromPublicKey(publicKey, chainCode, network) {
         // verify the X coordinate is a point on the curve
         if (!publicKeyVerify(publicKey))
-            throw new TypeError('Point is not on the curve');
+            throw new TypeError("Point is not on the curve");
         return new HdNode(undefined, publicKey, chainCode, network);
     }
     async fromSeed(seed, network) {
         if (seed.length < 16)
-            throw new TypeError('Seed should be at least 128 bits');
+            throw new TypeError("Seed should be at least 128 bits");
         if (seed.length > 64)
-            throw new TypeError('Seed should be at most 512 bits');
-        let hash = (await createHMAC(createSHA512(), new TextEncoder().encode('Bitcoin seed')))
+            throw new TypeError("Seed should be at most 512 bits");
+        let hash = (await createHMAC(createSHA512(), new TextEncoder().encode("Bitcoin seed")))
             .update(seed)
-            .digest('binary');
+            .digest("binary");
         const privateKey = hash.subarray(0, 32);
         const chainCode = hash.subarray(32);
         return this.fromPrivateKey(privateKey, chainCode, network);
@@ -2451,7 +2568,7 @@ class HdNode {
             this.#chainCode,
         ];
         if (!this.isNeutered) {
-            set.push(new TextEncoder().encode('0'));
+            set.push(new TextEncoder().encode("0"));
             set.push(new Uint8Array(this.privateKey));
         }
         else {
@@ -2461,7 +2578,7 @@ class HdNode {
     }
     toWIF() {
         if (!this.#privateKey)
-            throw new TypeError('Missing private key');
+            throw new TypeError("Missing private key");
         return wif.encode(this.#network.wif, this.#privateKey, true);
     }
     // https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#child-key-derivation-ckd-functions
@@ -2471,10 +2588,10 @@ class HdNode {
         // Hardened child
         if (isHardened) {
             if (this.isNeutered)
-                throw new TypeError('Missing private key for hardened child key');
+                throw new TypeError("Missing private key for hardened child key");
             // data = 0x00 || ser256(kpar) || ser32(index)
             data = index$3([
-                new TextEncoder().encode('0'),
+                new TextEncoder().encode("0"),
                 this.privateKey,
                 new TextEncoder().encode(index.toString()),
             ]);
@@ -2487,7 +2604,7 @@ class HdNode {
         }
         const hash = (await createHMAC(createSHA512(), this.#chainCode))
             .update(data)
-            .digest('binary');
+            .digest("binary");
         const privateKey = hash.subarray(0, 32);
         const chainCode = hash.subarray(32);
         // if parse256(privateKey) >= n, proceed with the next value for i
@@ -2514,10 +2631,10 @@ class HdNode {
         return this.derive(index + HIGHEST_BIT);
     }
     async derivePath(path) {
-        let splitPath = path.split('/');
-        if (splitPath[0] === 'm') {
+        let splitPath = path.split("/");
+        if (splitPath[0] === "m") {
             if (this.#parentFingerprint)
-                throw new TypeError('Expected master, got child');
+                throw new TypeError("Expected master, got child");
             splitPath = splitPath.slice(1);
         }
         let prevHd = this;
@@ -2549,16 +2666,16 @@ class HdNode {
         const k = privateKey ? 0 : result[5];
         const chainCode = result[4];
         if (version !== network.bip32.private && version !== network.bip32.public)
-            throw new TypeError('Invalid network version');
+            throw new TypeError("Invalid network version");
         if (depth === 0) {
             if (parentFingerprint !== 0)
-                throw new TypeError('Invalid parent fingerprint');
+                throw new TypeError("Invalid parent fingerprint");
         }
         if (depth === 0 && index !== 0)
-            throw new TypeError('Invalid index');
+            throw new TypeError("Invalid index");
         if (version === network.bip32.private) {
             if (k !== 0x00)
-                throw new TypeError('Invalid private key');
+                throw new TypeError("Invalid private key");
             return new HdNode(privateKey, undefined, chainCode, network, depth, index, parentFingerprint);
         }
         return new HdNode(undefined, 
@@ -4910,11 +5027,8 @@ class MultiSignature {
         signature = signature || this.signature;
         if (!signature)
             throw ReferenceError("signature undefined");
-        this.#multiSignature = typedArrayConcat([
-            index$4.encode(this.version),
-            index$4.encode(this.multiCodec),
-            signature,
-        ]);
+        const writer = new BinaryWriter(varUintLength(this.version) + varUintLength(this.multiCodec) + signature.length);
+        this.#multiSignature = writer.writeVarUint(this.version).writeVarUint(this.multiCodec).writeBytes(signature).finish();
         return this.multiSignature;
     }
     /**
@@ -4927,12 +5041,11 @@ class MultiSignature {
             this.#multiSignature = multiSignature;
         if (!this.multiSignature)
             throw ReferenceError("multiSignature undefined");
-        let buffer = this.multiSignature;
-        const version = index$4.decode(buffer);
-        buffer = buffer.subarray(index$4.decode.bytes);
-        const codec = index$4.decode(buffer);
-        buffer = buffer.subarray(index$4.decode.bytes);
-        const signature = buffer.subarray(0, buffer.length);
+        const reader = new BinaryReader(this.multiSignature);
+        // Keep legacy padded-header acceptance; do not change signature wire rules.
+        const version = reader.readVarUint(false);
+        const codec = reader.readVarUint(false);
+        const signature = reader.readBytes(reader.remaining);
         console.log("[decode] extracted signature length:", signature.length);
         console.log("[decode] extracted signature (hex):", Buffer.from(signature).toString("hex"));
         if (version !== this.version)
@@ -4950,7 +5063,7 @@ class MultiSignature {
         return this.multiSignature.toString();
     }
     fromString(string) {
-        return this.decode(new Uint8Array(string.split(",")));
+        return this.decode(new Uint8Array(string.split(",").map(Number)));
     }
     toBs58() {
         return base58$1.encode(this.multiSignature);
@@ -5025,17 +5138,26 @@ class MultiHDNode extends HDWallet {
     get id() {
         return base58check.encode(index$3([
             new TextEncoder().encode(this.version.toString()),
-            this.account(0).hdnode.neutered.publicKey
+            this.account(0).hdnode.neutered.publicKey,
         ]));
     }
     get multiWIF() {
         return this.toMultiWif();
     }
     async fromId(id) {
-        let buffer = (await base58check.decode(id)).data;
-        index$4.decode(buffer);
-        buffer = buffer.slice(index$4.decode.bytes);
-        this.fromPublicKey(buffer, null, this.networkName);
+        const buffer = (await base58check.decode(id)).data;
+        const reader = new BinaryReader(buffer);
+        // IDs contain two framed fields: textual version and compressed public key.
+        // Keep legacy padded length prefixes readable without changing generated IDs.
+        const version = reader.readFrame(false);
+        const publicKey = reader.readFrame(false);
+        const expectedVersion = new TextEncoder().encode(this.version.toString());
+        if (reader.remaining !== 0 ||
+            version.length !== expectedVersion.length ||
+            !version.every((byte, index) => byte === expectedVersion[index]) ||
+            publicKey.length !== 33)
+            throw new Error("invalid wallet ID");
+        await this.fromPublicKey(publicKey, null, this.networkName);
     }
     async import(password, encrypted) {
         const { prefix, data } = await base58check.decode(encrypted);
@@ -5064,22 +5186,20 @@ class MultiHDNode extends HDWallet {
                 return c.testnet;
             else
                 return p;
-        }, networks['leofcoin']);
+        }, networks["leofcoin"]);
         if (version !== this.network.version)
-            throw new Error('invalid version');
+            throw new Error("invalid version");
         return this.fromPrivateKey(privateKey, undefined, this.network);
     }
     toMultiWif() {
         return index$1.encode(this.network.version, this.network.multiCodec, this.privateKey);
     }
     sign(hash) {
-        return new MultiSignature(this.version, this.network.multiCodec)
-            .sign(hash, this.privateKey);
+        return new MultiSignature(this.version, this.network.multiCodec).sign(hash, this.privateKey);
     }
     verify(multiSignature, hash) {
         const publicKey = this.publicKey?.length === 33 ? this.publicKey.slice(1) : this.publicKey;
-        return new MultiSignature(this.version, this.network.multiCodec)
-            .verify(multiSignature, hash, publicKey);
+        return new MultiSignature(this.version, this.network.multiCodec).verify(multiSignature, hash, publicKey);
     }
 }
 
@@ -8336,7 +8456,7 @@ class Identity {
             this.selectedAccount = new TextDecoder().decode(selected);
         }
         else {
-            const importee = await import(/* webpackChunkName: "generate-account" */ './index-Bxr5Iztg.js');
+            const importee = await import(/* webpackChunkName: "generate-account" */ './index-dTQVgkpf.js');
             const { identity, accounts } = await importee.default(password, this.network);
             if (fresh) {
                 await globalThis.accountStore.clear();
@@ -8399,4 +8519,4 @@ class Identity {
     }
 }
 
-export { Identity as I, MultiWallet as M, base58$1 as a, base as b, index as c, index$2 as d, index$4 as e, createSHA512 as f, createSHA384 as g, createSHA256 as h, index$3 as i, createSHA224 as j, createSHA1 as k, encrypt as l, getDefaultExportFromCjs as m, resolveAccountWallets as r };
+export { BinaryReader as B, Identity as I, MultiWallet as M, base58$1 as a, base as b, index as c, index$2 as d, BinaryWriter as e, createSHA512 as f, createSHA384 as g, createSHA256 as h, index$3 as i, createSHA224 as j, createSHA1 as k, encrypt as l, getDefaultExportFromCjs as m, resolveAccountWallets as r, varUintLength as v };