@meteora-ag/cp-amm-sdk 1.0.0 → 1.0.1-1.rc-0

package/node_modules/{@solana/web3.js/node_modules/@noble → @noble}/curves/src/abstract/curve.ts

@@ -4,8 +4,8 @@
  * @module
  */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-import { type IField, nLength, validateField } from './modular.js';
-import { bitLen, validateObject } from './utils.js';
+import { type IField, nLength, validateField } from './modular.ts';
+import { bitLen, bitMask, validateObject } from './utils.ts';
 
 const _0n = BigInt(0);
 const _1n = BigInt(1);
@@ -40,11 +40,48 @@ function validateW(W: number, bits: number) {
     throw new Error('invalid window size, expected [1..' + bits + '], got W=' + W);
 }
 
-function calcWOpts(W: number, bits: number) {
-  validateW(W, bits);
-  const windows = Math.ceil(bits / W) + 1; // +1, because
-  const windowSize = 2 ** (W - 1); // -1 because we skip zero
-  return { windows, windowSize };
+/** Internal wNAF opts for specific W and scalarBits */
+export type WOpts = {
+  windows: number;
+  windowSize: number;
+  mask: bigint;
+  maxNumber: number;
+  shiftBy: bigint;
+};
+
+function calcWOpts(W: number, scalarBits: number): WOpts {
+  validateW(W, scalarBits);
+  const windows = Math.ceil(scalarBits / W) + 1; // W=8 33. Not 32, because we skip zero
+  const windowSize = 2 ** (W - 1); // W=8 128. Not 256, because we skip zero
+  const maxNumber = 2 ** W; // W=8 256
+  const mask = bitMask(W); // W=8 255 == mask 0b11111111
+  const shiftBy = BigInt(W); // W=8 8
+  return { windows, windowSize, mask, maxNumber, shiftBy };
+}
+
+function calcOffsets(n: bigint, window: number, wOpts: WOpts) {
+  const { windowSize, mask, maxNumber, shiftBy } = wOpts;
+  let wbits = Number(n & mask); // extract W bits.
+  let nextN = n >> shiftBy; // shift number by W bits.
+
+  // What actually happens here:
+  // const highestBit = Number(mask ^ (mask >> 1n));
+  // let wbits2 = wbits - 1; // skip zero
+  // if (wbits2 & highestBit) { wbits2 ^= Number(mask); // (~);
+
+  // split if bits > max: +224 => 256-32
+  if (wbits > windowSize) {
+    // we skip zero, which means instead of `>= size-1`, we do `> size`
+    wbits -= maxNumber; // -32, can be maxNumber - wbits, but then we need to set isNeg here.
+    nextN += _1n; // +256 (carry)
+  }
+  const offsetStart = window * windowSize;
+  const offset = offsetStart + Math.abs(wbits) - 1; // -1 because we skip zero
+  const isZero = wbits === 0; // is current window slice a 0?
+  const isNeg = wbits < 0; // is current window slice negative?
+  const isNegF = window % 2 !== 0; // fake random statement for noise
+  const offsetF = offsetStart; // fake offset for noise
+  return { nextN, offset, isZero, isNeg, isNegF, offsetF };
 }
 
 function validateMSMPoints(points: any[], c: any) {
@@ -61,9 +98,10 @@ function validateMSMScalars(scalars: any[], field: any) {
 }
 
 // Since points in different groups cannot be equal (different object constructor),
-// we can have single place to store precomputes
+// we can have single place to store precomputes.
+// Allows to make points frozen / immutable.
 const pointPrecomputes = new WeakMap<any, any[]>();
-const pointWindowSizes = new WeakMap<any, number>(); // This allows use make points immutable (nothing changes inside)
+const pointWindowSizes = new WeakMap<any, number>();
 
 function getW(P: any): number {
   return pointWindowSizes.get(P) || 1;
@@ -74,9 +112,9 @@ export type IWNAF<T extends Group<T>> = {
   hasPrecomputes(elm: T): boolean;
   unsafeLadder(elm: T, n: bigint, p?: T): T;
   precomputeWindow(elm: T, W: number): Group<T>[];
+  getPrecomputes(W: number, P: T, transform: Mapper<T>): T[];
   wNAF(W: number, precomputes: T[], n: bigint): { p: T; f: T };
   wNAFUnsafe(W: number, precomputes: T[], n: bigint, acc?: T): T;
-  getPrecomputes(W: number, P: T, transform: Mapper<T>): T[];
   wNAFCached(P: T, n: bigint, transform: Mapper<T>): { p: T; f: T };
   wNAFCachedUnsafe(P: T, n: bigint, transform: Mapper<T>, prev?: T): T;
   setWindowSize(P: T, W: number): void;
@@ -135,7 +173,7 @@ export function wNAF<T extends Group<T>>(c: GroupConstructor<T>, bits: number):
       for (let window = 0; window < windows; window++) {
         base = p;
         points.push(base);
-        // =1, because we skip zero
+        // i=1, bc we skip 0
         for (let i = 1; i < windowSize; i++) {
           base = base.add(p);
           points.push(base);
@@ -153,54 +191,34 @@ export function wNAF<T extends Group<T>>(c: GroupConstructor<T>, bits: number):
      * @returns real and fake (for const-time) points
      */
     wNAF(W: number, precomputes: T[], n: bigint): { p: T; f: T } {
-      // TODO: maybe check that scalar is less than group order? wNAF behavious is undefined otherwise
-      // But need to carefully remove other checks before wNAF. ORDER == bits here
-      const { windows, windowSize } = calcWOpts(W, bits);
-
+      // Smaller version:
+      // https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
+      // TODO: check the scalar is less than group order?
+      // wNAF behavior is undefined otherwise. But have to carefully remove
+      // other checks before wNAF. ORDER == bits here.
+      // Accumulators
       let p = c.ZERO;
       let f = c.BASE;
-
-      const mask = BigInt(2 ** W - 1); // Create mask with W ones: 0b1111 for W=4 etc.
-      const maxNumber = 2 ** W;
-      const shiftBy = BigInt(W);
-
-      for (let window = 0; window < windows; window++) {
-        const offset = window * windowSize;
-        // Extract W bits.
-        let wbits = Number(n & mask);
-
-        // Shift number by W bits.
-        n >>= shiftBy;
-
-        // If the bits are bigger than max size, we'll split those.
-        // +224 => 256 - 32
-        if (wbits > windowSize) {
-          wbits -= maxNumber;
-          n += _1n;
-        }
-
-        // This code was first written with assumption that 'f' and 'p' will never be infinity point:
-        // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,
-        // there is negate now: it is possible that negated element from low value
-        // would be the same as high element, which will create carry into next window.
-        // It's not obvious how this can fail, but still worth investigating later.
-
-        // Check if we're onto Zero point.
-        // Add random point inside current window to f.
-        const offset1 = offset;
-        const offset2 = offset + Math.abs(wbits) - 1; // -1 because we skip zero
-        const cond1 = window % 2 !== 0;
-        const cond2 = wbits < 0;
-        if (wbits === 0) {
-          // The most important part for const-time getPublicKey
-          f = f.add(constTimeNegate(cond1, precomputes[offset1]));
+      // This code was first written with assumption that 'f' and 'p' will never be infinity point:
+      // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,
+      // there is negate now: it is possible that negated element from low value
+      // would be the same as high element, which will create carry into next window.
+      // It's not obvious how this can fail, but still worth investigating later.
+      const wo = calcWOpts(W, bits);
+      for (let window = 0; window < wo.windows; window++) {
+        // (n === _0n) is handled and not early-exited. isEven and offsetF are used for noise
+        const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);
+        n = nextN;
+        if (isZero) {
+          // bits are 0: add garbage to fake point
+          // Important part for const-time getPublicKey: add random "noise" point to f.
+          f = f.add(constTimeNegate(isNegF, precomputes[offsetF]));
         } else {
-          p = p.add(constTimeNegate(cond2, precomputes[offset2]));
+          // bits are 1: add to result point
+          p = p.add(constTimeNegate(isNeg, precomputes[offset]));
         }
       }
-      // JIT-compiler should not eliminate f here, since it will later be used in normalizeZ()
-      // Even if the variable is still unused, there are some checks which will
-      // throw an exception, so compiler needs to prove they won't happen, which is hard.
+      // Return both real and fake points: JIT won't eliminate f.
       // At this point there is a way to F be infinity-point even if p is not,
       // which makes it less const-time: around 1 bigint multiply.
       return { p, f };
@@ -215,28 +233,19 @@ export function wNAF<T extends Group<T>>(c: GroupConstructor<T>, bits: number):
      * @returns point
      */
     wNAFUnsafe(W: number, precomputes: T[], n: bigint, acc: T = c.ZERO): T {
-      const { windows, windowSize } = calcWOpts(W, bits);
-      const mask = BigInt(2 ** W - 1); // Create mask with W ones: 0b1111 for W=4 etc.
-      const maxNumber = 2 ** W;
-      const shiftBy = BigInt(W);
-      for (let window = 0; window < windows; window++) {
-        const offset = window * windowSize;
-        if (n === _0n) break; // No need to go over empty scalar
-        // Extract W bits.
-        let wbits = Number(n & mask);
-        // Shift number by W bits.
-        n >>= shiftBy;
-        // If the bits are bigger than max size, we'll split those.
-        // +224 => 256 - 32
-        if (wbits > windowSize) {
-          wbits -= maxNumber;
-          n += _1n;
+      const wo = calcWOpts(W, bits);
+      for (let window = 0; window < wo.windows; window++) {
+        if (n === _0n) break; // Early-exit, skip 0 value
+        const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);
+        n = nextN;
+        if (isZero) {
+          // Window bits are 0: skip processing.
+          // Move to next window.
+          continue;
+        } else {
+          const item = precomputes[offset];
+          acc = acc.add(isNeg ? item.negate() : item); // Re-using acc allows to save adds in MSM
         }
-        if (wbits === 0) continue;
-        let curr = precomputes[offset + Math.abs(wbits) - 1]; // -1 because we skip zero
-        if (wbits < 0) curr = curr.negate();
-        // NOTE: by re-using acc, we can save a lot of additions in case of MSM
-        acc = acc.add(curr);
       }
       return acc;
     },
@@ -276,7 +285,7 @@ export function wNAF<T extends Group<T>>(c: GroupConstructor<T>, bits: number):
 
 /**
  * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).
- * 30x faster vs naive addition on L=4096, 10x faster with precomputes.
+ * 30x faster vs naive addition on L=4096, 10x faster than precomputes.
  * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.
  * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.
  * @param c Curve Point constructor
@@ -298,20 +307,25 @@ export function pippenger<T extends Group<T>>(
   // 0 is accepted in scalars
   validateMSMPoints(points, c);
   validateMSMScalars(scalars, fieldN);
-  if (points.length !== scalars.length)
-    throw new Error('arrays of points and scalars must have equal length');
+  const plength = points.length;
+  const slength = scalars.length;
+  if (plength !== slength) throw new Error('arrays of points and scalars must have equal length');
+  // if (plength === 0) throw new Error('array must be of length >= 2');
   const zero = c.ZERO;
-  const wbits = bitLen(BigInt(points.length));
-  const windowSize = wbits > 12 ? wbits - 3 : wbits > 4 ? wbits - 2 : wbits ? 2 : 1; // in bits
-  const MASK = (1 << windowSize) - 1;
-  const buckets = new Array(MASK + 1).fill(zero); // +1 for zero array
+  const wbits = bitLen(BigInt(plength));
+  let windowSize = 1; // bits
+  if (wbits > 12) windowSize = wbits - 3;
+  else if (wbits > 4) windowSize = wbits - 2;
+  else if (wbits > 0) windowSize = 2;
+  const MASK = bitMask(windowSize);
+  const buckets = new Array(Number(MASK) + 1).fill(zero); // +1 for zero array
   const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;
   let sum = zero;
   for (let i = lastBits; i >= 0; i -= windowSize) {
     buckets.fill(zero);
-    for (let j = 0; j < scalars.length; j++) {
+    for (let j = 0; j < slength; j++) {
       const scalar = scalars[j];
-      const wbits = Number((scalar >> BigInt(i)) & BigInt(MASK));
+      const wbits = Number((scalar >> BigInt(i)) & MASK);
       buckets[wbits] = buckets[wbits].add(points[j]);
     }
     let resI = zero; // not using this will do small speed-up, but will lose ct
@@ -378,7 +392,7 @@ export function precomputeMSMUnsafe<T extends Group<T>>(
   const zero = c.ZERO;
   const tableSize = 2 ** windowSize - 1; // table size (without zero)
   const chunks = Math.ceil(fieldN.BITS / windowSize); // chunks of item
-  const MASK = BigInt((1 << windowSize) - 1);
+  const MASK = bitMask(windowSize);
   const tables = points.map((p: T) => {
     const res = [];
     for (let i = 0, acc = p; i < tableSize; i++) {

package/node_modules/{@solana/web3.js/node_modules/@noble → @noble}/curves/src/abstract/edwards.ts

@@ -4,18 +4,18 @@
  * @module
  */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+// prettier-ignore
+import {
+  pippenger, validateBasic, wNAF,
+  type AffinePoint, type BasicCurve, type Group, type GroupConstructor
+} from './curve.ts';
+import { Field, FpInvertBatch, mod } from './modular.ts';
+// prettier-ignore
 import {
-  type AffinePoint,
-  type BasicCurve,
-  type Group,
-  type GroupConstructor,
-  pippenger,
-  validateBasic,
-  wNAF,
-} from './curve.js';
-import { Field, mod } from './modular.js';
-import * as ut from './utils.js';
-import { abool, ensureBytes, type FHash, type Hex, memoized } from './utils.js';
+  abool, aInRange, bytesToHex, bytesToNumberLE, concatBytes,
+  ensureBytes, memoized, numberToBytesLE, validateObject,
+  type FHash, type Hex
+} from './utils.ts';
 
 // Be friendly to bad ECMAScript parsers by not using bigint literals
 // prettier-ignore
@@ -41,7 +41,7 @@ const VERIFY_DEFAULT = { zip215: true };
 
 function validateOpts(curve: CurveType): CurveTypeWithLength {
   const opts = validateBasic(curve);
-  ut.validateObject(
+  validateObject(
     curve,
     {
       hash: 'function',
@@ -142,6 +142,18 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
   const modP = Fp.create; // Function overrides
   const Fn = Field(CURVE.n, CURVE.nBitLength);
 
+  function isEdValidXY(x: bigint, y: bigint): boolean {
+    const x2 = Fp.sqr(x);
+    const y2 = Fp.sqr(y);
+    const left = Fp.add(Fp.mul(CURVE.a, x2), y2);
+    const right = Fp.add(Fp.ONE, Fp.mul(CURVE.d, Fp.mul(x2, y2)));
+    return Fp.eql(left, right);
+  }
+
+  // Validate whether the passed curve params are valid.
+  // equation ax² + y² = 1 + dx²y² should work for generator point.
+  if (!isEdValidXY(CURVE.Gx, CURVE.Gy)) throw new Error('bad curve params: generator point');
+
   // sqrt(u/v)
   const uvRatio =
     CURVE.uvRatio ||
@@ -162,11 +174,12 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
     }); // NOOP
   // 0 <= n < MASK
   // Coordinates larger than Fp.ORDER are allowed for zip215
-  function aCoordinate(title: string, n: bigint) {
-    ut.aInRange('coordinate ' + title, n, _0n, MASK);
+  function aCoordinate(title: string, n: bigint, banZero = false) {
+    const min = banZero ? _1n : _0n;
+    aInRange('coordinate ' + title, n, min, MASK);
   }
 
-  function assertPoint(other: unknown) {
+  function aextpoint(other: unknown) {
     if (!(other instanceof Point)) throw new Error('ExtendedPoint expected');
   }
   // Converts Extended point to default (x, y) coordinates.
@@ -203,22 +216,27 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
     return true;
   });
 
-  // Extended Point works in extended coordinates: (x, y, z, t) ∋ (x=x/z, y=y/z, t=xy).
+  // Extended Point works in extended coordinates: (X, Y, Z, T) ∋ (x=X/Z, y=Y/Z, T=xy).
   // https://en.wikipedia.org/wiki/Twisted_Edwards_curve#Extended_coordinates
   class Point implements ExtPointType {
+    // base / generator point
     static readonly BASE = new Point(CURVE.Gx, CURVE.Gy, _1n, modP(CURVE.Gx * CURVE.Gy));
+    // zero / infinity / identity point
     static readonly ZERO = new Point(_0n, _1n, _1n, _0n); // 0, 1, 1, 0
+    readonly ex: bigint;
+    readonly ey: bigint;
+    readonly ez: bigint;
+    readonly et: bigint;
 
-    constructor(
-      readonly ex: bigint,
-      readonly ey: bigint,
-      readonly ez: bigint,
-      readonly et: bigint
-    ) {
+    constructor(ex: bigint, ey: bigint, ez: bigint, et: bigint) {
       aCoordinate('x', ex);
       aCoordinate('y', ey);
-      aCoordinate('z', ez);
+      aCoordinate('z', ez, true);
       aCoordinate('t', et);
+      this.ex = ex;
+      this.ey = ey;
+      this.ez = ez;
+      this.et = et;
       Object.freeze(this);
     }
 
@@ -237,7 +255,10 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
       return new Point(x, y, _1n, modP(x * y));
     }
     static normalizeZ(points: Point[]): Point[] {
-      const toInv = Fp.invertBatch(points.map((p) => p.ez));
+      const toInv = FpInvertBatch(
+        Fp,
+        points.map((p) => p.ez)
+      );
       return points.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);
     }
     // Multiscalar Multiplication
@@ -257,7 +278,7 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
 
     // Compare one point to another.
     equals(other: Point): boolean {
-      assertPoint(other);
+      aextpoint(other);
       const { ex: X1, ey: Y1, ez: Z1 } = this;
       const { ex: X2, ey: Y2, ez: Z2 } = other;
       const X1Z2 = modP(X1 * Z2);
@@ -302,30 +323,10 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
     // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
     // Cost: 9M + 1*a + 1*d + 7add.
     add(other: Point) {
-      assertPoint(other);
+      aextpoint(other);
       const { a, d } = CURVE;
       const { ex: X1, ey: Y1, ez: Z1, et: T1 } = this;
       const { ex: X2, ey: Y2, ez: Z2, et: T2 } = other;
-      // Faster algo for adding 2 Extended Points when curve's a=-1.
-      // http://hyperelliptic.org/EFD/g1p/auto-twisted-extended-1.html#addition-add-2008-hwcd-4
-      // Cost: 8M + 8add + 2*2.
-      // Note: It does not check whether the `other` point is valid.
-      if (a === BigInt(-1)) {
-        const A = modP((Y1 - X1) * (Y2 + X2));
-        const B = modP((Y1 + X1) * (Y2 - X2));
-        const F = modP(B - A);
-        if (F === _0n) return this.double(); // Same point. Tests say it doesn't affect timing
-        const C = modP(Z1 * _2n * T2);
-        const D = modP(T1 * _2n * Z2);
-        const E = D + C;
-        const G = B + A;
-        const H = D - C;
-        const X3 = modP(E * F);
-        const Y3 = modP(G * H);
-        const T3 = modP(E * H);
-        const Z3 = modP(F * G);
-        return new Point(X3, Y3, Z3, T3);
-      }
       const A = modP(X1 * X2); // A = X1*X2
       const B = modP(Y1 * Y2); // B = Y1*Y2
       const C = modP(T1 * d * T2); // C = T1*d*T2
@@ -338,7 +339,6 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
       const Y3 = modP(G * H); // Y3 = G*H
       const T3 = modP(E * H); // T3 = E*H
       const Z3 = modP(F * G); // Z3 = F*G
-
       return new Point(X3, Y3, Z3, T3);
     }
 
@@ -353,7 +353,7 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
     // Constant-time multiplication.
     multiply(scalar: bigint): Point {
       const n = scalar;
-      ut.aInRange('scalar', n, _1n, CURVE_ORDER); // 1 <= scalar < L
+      aInRange('scalar', n, _1n, CURVE_ORDER); // 1 <= scalar < L
       const { p, f } = this.wNAF(n);
       return Point.normalizeZ([p, f])[0];
     }
@@ -365,7 +365,7 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
     // Accepts optional accumulator to merge with multiply (important for sparse scalars)
     multiplyUnsafe(scalar: bigint, acc = Point.ZERO): Point {
       const n = scalar;
-      ut.aInRange('scalar', n, _0n, CURVE_ORDER); // 0 <= scalar < L
+      aInRange('scalar', n, _0n, CURVE_ORDER); // 0 <= scalar < L
       if (n === _0n) return I;
       if (this.is0() || n === _1n) return this;
       return wnaf.wNAFCachedUnsafe(this, n, Point.normalizeZ, acc);
@@ -407,14 +407,14 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
       const normed = hex.slice(); // copy again, we'll manipulate it
       const lastByte = hex[len - 1]; // select last byte
       normed[len - 1] = lastByte & ~0x80; // clear last bit
-      const y = ut.bytesToNumberLE(normed);
+      const y = bytesToNumberLE(normed);
 
       // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.
       // RFC8032 prohibits >= p, but ZIP215 doesn't
       // zip215=true:  0 <= y < MASK (2^256 for ed25519)
       // zip215=false: 0 <= y < P (2^255-19 for ed25519)
       const max = zip215 ? MASK : Fp.ORDER;
-      ut.aInRange('pointHex.y', y, _0n, max);
+      aInRange('pointHex.y', y, _0n, max);
 
       // Ed25519: x² = (y²-1)/(dy²+1) mod p. Ed448: x² = (y²-1)/(dy²-1) mod p. Generic case:
       // ax²+y²=1+dx²y² => y²-1=dx²y²-ax² => y²-1=x²(dy²-a) => x²=(y²-1)/(dy²-a)
@@ -431,17 +431,18 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
       if (isLastByteOdd !== isXOdd) x = modP(-x); // if x_0 != x mod 2, set x = p-x
       return Point.fromAffine({ x, y });
     }
-    static fromPrivateKey(privKey: Hex) {
-      return getExtendedPublicKey(privKey).point;
+    static fromPrivateKey(privKey: Hex): Point {
+      const { scalar } = getPrivateScalar(privKey);
+      return G.multiply(scalar); // reduced one call of `toRawBytes`
     }
     toRawBytes(): Uint8Array {
       const { x, y } = this.toAffine();
-      const bytes = ut.numberToBytesLE(y, Fp.BYTES); // each y has 2 x values (x, -y)
+      const bytes = numberToBytesLE(y, Fp.BYTES); // each y has 2 x values (x, -y)
       bytes[bytes.length - 1] |= x & _1n ? 0x80 : 0; // when compressing, it's enough to store y
       return bytes; // and use the last byte to encode sign of x
     }
     toHex(): string {
-      return ut.bytesToHex(this.toRawBytes()); // Same as toRawBytes, but returns string.
+      return bytesToHex(this.toRawBytes()); // Same as toRawBytes, but returns string.
     }
   }
   const { BASE: G, ZERO: I } = Point;
@@ -452,11 +453,11 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
   }
   // Little-endian SHA512 with modulo n
   function modN_LE(hash: Uint8Array): bigint {
-    return modN(ut.bytesToNumberLE(hash));
+    return modN(bytesToNumberLE(hash));
   }
 
-  /** Convenience method that creates public key and other stuff. RFC8032 5.1.5 */
-  function getExtendedPublicKey(key: Hex) {
+  // Get the hashed private scalar per RFC8032 5.1.5
+  function getPrivateScalar(key: Hex) {
     const len = Fp.BYTES;
     key = ensureBytes('private key', key, len);
     // Hash private key with curve's hash function to produce uniformingly random input
@@ -465,6 +466,12 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
     const head = adjustScalarBytes(hashed.slice(0, len)); // clear first half bits, produce FE
     const prefix = hashed.slice(len, 2 * len); // second half is called key prefix (5.1.6)
     const scalar = modN_LE(head); // The actual private scalar
+    return { head, prefix, scalar };
+  }
+
+  // Convenience method that creates public key from scalar. RFC8032 5.1.5
+  function getExtendedPublicKey(key: Hex) {
+    const { head, prefix, scalar } = getPrivateScalar(key);
     const point = G.multiply(scalar); // Point on Edwards curve aka public key
     const pointBytes = point.toRawBytes(); // Uint8Array representation
     return { head, prefix, scalar, point, pointBytes };
@@ -476,8 +483,8 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
   }
 
   // int('LE', SHA512(dom2(F, C) || msgs)) mod N
-  function hashDomainToScalar(context: Hex = new Uint8Array(), ...msgs: Uint8Array[]) {
-    const msg = ut.concatBytes(...msgs);
+  function hashDomainToScalar(context: Hex = Uint8Array.of(), ...msgs: Uint8Array[]) {
+    const msg = concatBytes(...msgs);
     return modN_LE(cHash(domain(msg, ensureBytes('context', context), !!prehash)));
   }
 
@@ -490,8 +497,8 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
     const R = G.multiply(r).toRawBytes(); // R = rG
     const k = hashDomainToScalar(options.context, R, pointBytes, msg); // R || A || PH(M)
     const s = modN(r + k * scalar); // S = (r + k * s) mod L
-    ut.aInRange('signature.s', s, _0n, CURVE_ORDER); // 0 <= s < l
-    const res = ut.concatBytes(R, ut.numberToBytesLE(s, Fp.BYTES));
+    aInRange('signature.s', s, _0n, CURVE_ORDER); // 0 <= s < l
+    const res = concatBytes(R, numberToBytesLE(s, Fp.BYTES));
     return ensureBytes('result', res, Fp.BYTES * 2); // 64-byte signature
   }
 
@@ -510,7 +517,7 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
     if (zip215 !== undefined) abool('zip215', zip215);
     if (prehash) msg = prehash(msg); // for ed25519ph, etc
 
-    const s = ut.bytesToNumberLE(sig.slice(len, 2 * len));
+    const s = bytesToNumberLE(sig.slice(len, 2 * len));
     let A, R, SB;
     try {
       // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.
@@ -535,7 +542,7 @@ export function twistedEdwards(curveDef: CurveType): CurveFn {
 
   const utils = {
     getExtendedPublicKey,
-    // ed25519 private keys are uniform 32b. No need to check for modulo bias, like in secp256k1.
+    /** ed25519 priv keys are uniform 32b. No need to check for modulo bias, like in secp256k1. */
     randomPrivateKey: (): Uint8Array => randomBytes(Fp.BYTES),
 
     /**