@mnemom/mnemom 0.17.36 → 0.17.38-next.0

package/node_modules/@noble/ed25519/index.js

@@ -1,933 +0,0 @@
-/*! noble-ed25519 - MIT License (c) 2019 Paul Miller (paulmillr.com) */
-/**
- * 5KB JS implementation of ed25519 EdDSA signatures.
- * Targets RFC8032, FIPS 186-5, and ZIP215 behavior.
- * @module
- * @example
- * ```js
-import * as ed from '@noble/ed25519';
-(async () => {
-  const secretKey = ed.utils.randomSecretKey();
-  const message = Uint8Array.from([0xab, 0xbc, 0xcd, 0xde]);
-  const pubKey = await ed.getPublicKeyAsync(secretKey); // Sync methods are also present
-  const signature = await ed.signAsync(message, secretKey);
-  const isValid = await ed.verifyAsync(signature, message, pubKey);
-})();
-```
- */
-/**
- * Curve params. edwards25519 uses the RFC equation `-x² + y² = 1 + dx²y²`.
- * The stored `a` literal below is `p - 1`, i.e. the field-element encoding of RFC `a = -1`.
- * * P = `2n**255n - 19n` // field over which calculations are done
- * * N = `2n**252n + 27742317777372353535851937790883648493n` // prime-order subgroup order
- * * h = 8 // cofactor
- * * a = `Fp.create(BigInt(-1))` // equation param, stored here as `p - 1`
- * * d = -121665/121666 a.k.a. `Fp.neg(121665 * Fp.inv(121666))` // equation param
- * * Gx, Gy are coordinates of Generator / base point
- *
- * Mirror noble-curves: Point.CURVE() exposes shared params, but callers must not be able to mutate
- * that shared view and desynchronize it from the arithmetic constants captured below.
- */
-const freeze = Object.freeze;
-const P = 0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffedn;
-const N = 0x1000000000000000000000000000000014def9dea2f79cd65812631a5cf5d3edn;
-const _d = 0x52036cee2b6ffe738cc740797779e89800700a4d4141d8ab75eb4dca135978a3n;
-const Gx = 0x216936d3cd6e53fec0a4e231fdd6dc5c692cc7609525a7b2c9562d608f25d51an;
-const Gy = 0x6666666666666666666666666666666666666666666666666666666666666658n;
-const _a = P - 1n; // field-element encoding of RFC `a = -1`
-const ed25519_CURVE = freeze({
-    p: P,
-    n: N,
-    h: 8n,
-    a: _a,
-    d: _d,
-    Gx,
-    Gy,
-});
-// Shared 32-byte encoded width for Ed25519 points, scalars, signatures/2, and keys. Named LEN
-// rather than RFC 8032's `L`, which names the group order (stored here as `N`).
-const LEN = 32;
-// Helpers and Precomputes sections are reused between libraries
-// ## Helpers
-// ----------
-/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */
-const isBytes = (a) => {
-    // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases.
-    // The fallback still requires a real ArrayBuffer view, so plain
-    // JSON-deserialized `{ constructor: ... }` spoofing is rejected, and
-    // `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.
-    return (a instanceof Uint8Array ||
-        (ArrayBuffer.isView(a) &&
-            a.constructor.name === 'Uint8Array' &&
-            a.BYTES_PER_ELEMENT === 1));
-};
-/** Asserts something is Bytes. */
-const abytes = (value, length, title = '') => {
-    // Success path first: this runs at the start of every update() / digestInto(), and the
-    // common `abytes(data)` form must not pay for length handling it does not use.
-    if (isBytes(value) && (length === undefined || value.length === length))
-        return value;
-    // Error path: recompute freely to build the exact message.
-    const bytes = isBytes(value);
-    const ofLen = length !== undefined ? ` of length ${length}` : '';
-    const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
-    const message = (title ? `"${title}" ` : '') + 'expected Uint8Array' + ofLen + ', got ' + got;
-    if (!bytes)
-        throw new TypeError(message);
-    throw new RangeError(message);
-};
-// Validate, then take one owned copy, so later caller mutation cannot be observed — e.g. cannot
-// make sign()'s nonce derivation and challenge derivation see different messages.
-const snapshotBytes = (value, title = '', length) => Uint8Array.from(abytes(value, length, title));
-// Callers keep values non-negative and within the requested width; padStart() won't truncate over-wide inputs.
-const padh = (n, pad) => n.toString(16).padStart(pad, '0');
-/** Convert byte array to hex string. */
-const bytesToHex = (bytes) => {
-    let hex = '';
-    for (const byte of abytes(bytes))
-        hex += padh(byte, 2);
-    return hex;
-};
-/** Convert hex string to byte array. */
-const hexToBytes = (hex) => {
-    const e = 'hex invalid'; // Strict ASCII hex only, with one generic error for parse failures.
-    if (typeof hex !== 'string')
-        throw new TypeError(e);
-    if (hex.length % 2 || !/^[\da-f]*$/i.test(hex))
-        throw new RangeError(e);
-    const array = new Uint8Array(hex.length / 2);
-    for (let ai = 0, hi = 0; ai < array.length; ai++, hi += 2) {
-        const n1 = hex.charCodeAt(hi);
-        const n2 = hex.charCodeAt(hi + 1);
-        // Regex guarantees ASCII. For 0..9/A..F/a..f, this maps char codes to 0..15.
-        array[ai] = ((n1 & 15) + (n1 >> 6) * 9) * 16 + (n2 & 15) + (n2 >> 6) * 9;
-    }
-    return array;
-};
-// WebCrypto is available in all modern environments
-/** Copies several Uint8Arrays into one. */
-const concatBytes = (...arrays) => {
-    let sum = 0;
-    for (const a of arrays)
-        sum += abytes(a).length;
-    const res = new Uint8Array(sum);
-    let pad = 0;
-    for (const a of arrays) {
-        res.set(a, pad);
-        pad += a.length;
-    }
-    return res;
-};
-/**
- * WebCrypto OS-level CSPRNG (random number generator).
- * Will throw when not available; large-request ceilings are delegated to getRandomValues().
- */
-const randomBytes = (len = LEN) => {
-    const c = globalThis?.crypto;
-    if (typeof c?.getRandomValues !== 'function')
-        throw new Error('crypto.getRandomValues must be defined, consider polyfill');
-    return c.getRandomValues(new Uint8Array(len));
-};
-/** Inclusive-lower, exclusive-upper bigint range assertion. */
-const arange = (n, min, max, msg = 'bad number: out of range') => {
-    if (typeof n !== 'bigint')
-        throw new TypeError(msg);
-    if (min <= n && n < max)
-        return n;
-    throw new RangeError(msg);
-};
-/** Canonical modular reduction. Callers must provide a positive modulus. */
-const mod = (a, b = P) => ((a %= b) >= 0n ? a : b + a);
-// Low-255-bit mask used by the `2^255 - 19` fast reduction in `modP(...)`.
-const P_MASK = (1n << 255n) - 1n;
-// Fast reduction for the special prime `2^255 - 19`. This path assumes nonnegative inputs; the
-// generic fallback would simply be `mod(num, P)`.
-const modP = (num) => {
-    if (num < 0n)
-        throw new RangeError('negative coordinate');
-    let r = (num >> 255n) * 19n + (num & P_MASK);
-    r = (r >> 255n) * 19n + (r & P_MASK);
-    return r % P;
-};
-// Reduce modulo the subgroup order stored in implementation constant `N` (RFC 8032's `L`).
-const modN = (a) => mod(a, N);
-/** Modular inversion using extended euclidean GCD. Variable-time (non-CT). */
-const invert = (number, modulo) => {
-    if (number === 0n)
-        throw new Error('invert: expected non-zero number');
-    // modulo = 1 is the zero ring: gcd(x, 1) = 1 makes the loop below "succeed" and return the
-    // useless inverse 0. Reject it like pow() and invertCt() do.
-    if (modulo <= 1n)
-        throw new Error('invert: expected modulus > 1, got ' + modulo);
-    // This is variable-time: the loop count depends on `number`.
-    let a = mod(number, modulo);
-    let b = modulo;
-    // Only the Bézout coefficient of `number` (x/u chain) is tracked; the coefficient of `modulo`
-    // never affects the output, so it is not computed.
-    // prettier-ignore
-    let x = 0n, u = 1n;
-    while (a !== 0n) {
-        const q = b / a;
-        const r = b - a * q;
-        const m = x - u * q;
-        // prettier-ignore
-        b = a, a = r, x = u, u = m;
-    }
-    const gcd = b;
-    if (gcd !== 1n)
-        throw new Error('invert: does not exist');
-    return mod(x, modulo);
-};
-// Dynamic lookup keeps sync/async hash providers configurable at runtime. Both exported slots are
-// caller-owned and may be unset; wrapper helpers use this lookup first and then enforce the digest
-// contract instead of trusting provider output.
-const _hash = (name) => {
-    // @ts-ignore
-    const fn = hashes[name];
-    if (typeof fn !== 'function')
-        throw new Error('hashes.' + name + ' not set');
-    return fn;
-};
-// All exported provider slots are caller-configurable and may be unset or return arbitrary values,
-// so wrapper helpers must enforce the exact 64-byte SHA-512 digest contract instead of trusting providers.
-const callHash = (name, ...m) => abytes(_hash(name)(concatBytes(...m)), 64, 'digest');
-const callHashAsync = async (name, ...m) => abytes(await _hash(name)(concatBytes(...m)), 64, 'digest');
-/**
- * SHA-512 helper used by the synchronous API.
- * @param msg - Message bytes to hash.
- * @returns 64-byte SHA-512 digest.
- * @example
- * Hash message bytes after wiring the synchronous SHA-512 implementation.
- *
- * ```ts
- * import * as ed from '@noble/ed25519';
- * import { sha512 } from '@noble/hashes/sha2.js';
- *
- * ed.hashes.sha512 = sha512;
- * const digest = ed.hash(new Uint8Array([1, 2, 3]));
- * ```
- */
-// Public helper validates the message boundary explicitly; the configured provider is still looked
-// up dynamically and its output is checked with `callHash(...)`.
-const hash = (msg) => callHash('sha512', abytes(msg, undefined, 'message'));
-// Runtime class guard: this is `instanceof Point`, so cross-realm / duplicate-bundle Point objects
-// are rejected even if they are structurally identical.
-const apoint = (p) => {
-    if (p instanceof Point)
-        return p;
-    throw new TypeError('Point expected');
-};
-// ## End of Helpers
-// -----------------
-// Exclusive upper bound `2^256` used by 32-byte decode/serialization range checks.
-const B256 = 2n ** 256n;
-/**
- * Point in XYZT extended coordinates.
- * @param X - X coordinate.
- * @param Y - Y coordinate.
- * @param Z - Projective Z coordinate.
- * @param T - Cached cross-product term.
- * @example
- * Do point arithmetic with the built-in base point and encode the result as hex.
- *
- * ```ts
- * const hex = Point.BASE.double().toHex();
- * ```
- */
-class Point {
-    static BASE;
-    static ZERO;
-    X;
-    Y;
-    Z;
-    T;
-    // Constructor only bounds-checks and freezes XYZT coordinates; it does not prove the point is
-    // on-curve or that T matches X*Y/Z.
-    constructor(X, Y, Z, T) {
-        const max = B256;
-        this.X = arange(X, 0n, max);
-        this.Y = arange(Y, 0n, max);
-        this.Z = arange(Z, 1n, max);
-        this.T = arange(T, 0n, max);
-        freeze(this);
-    }
-    static CURVE() {
-        return ed25519_CURVE;
-    }
-    static fromAffine(p) {
-        return new Point(p.x, p.y, 1n, modP(p.x * p.y));
-    }
-    /** RFC8032 5.1.3: Uint8Array to Point. */
-    static fromBytes(bytes, zip215 = false) {
-        const normed = snapshotBytes(bytes, 'point', LEN); // owned copy: sign-bit mask below mutates it
-        // adjust first LE byte = last BE byte
-        const lastByte = normed[31];
-        normed[31] = lastByte & ~0x80;
-        const y = bytesToNumberLE(normed);
-        // After clearing the sign bit, parsed `y` is always < 2^255. ZIP-215 still accepts the full
-        // post-mask range here, while strict RFC8032 decoding further requires `y < p`.
-        if (!zip215)
-            arange(y, 0n, P);
-        const y2 = modP(y * y); // y²
-        const u = mod(y2 - 1n); // u=y²-1
-        const v = modP(_d * y2 + 1n); // v=dy²+1
-        let { isValid, value: x } = uvRatio(u, v); // (uv³)(uv⁷)^(p-5)/8; square root
-        if (!isValid)
-            throw new Error('bad point: y not sqrt'); // not square root: bad point
-        const isLastByteOdd = !!(lastByte & 0x80); // x_0, last bit
-        // ZIP-215-compatible decoding keeps the x=0 / sign-bit=1 encoding accepted; strict RFC 8032
-        // rejects it, but the vendored ZIP-215 compliance vectors include this form in A/R bytes.
-        if (!zip215 && x === 0n && isLastByteOdd)
-            throw new Error('bad point: x==0, isLastByteOdd'); // x=0, x_0=1
-        if (isLastByteOdd !== !!(x & 1n))
-            x = mod(-x); // adjust sign of x coordinate
-        return new Point(x, y, 1n, modP(x * y)); // Z=1, T=xy
-    }
-    static fromHex(hex, zip215) {
-        return Point.fromBytes(hexToBytes(hex), zip215);
-    }
-    get x() {
-        return this.toAffine().x;
-    }
-    get y() {
-        return this.toAffine().y;
-    }
-    /** Checks if the point is valid and on-curve. */
-    assertValidity() {
-        const a = _a;
-        const d = _d;
-        const p = this;
-        // Intentional stricter-than-on-curve policy: reject ZERO by default because many protocols
-        // require a non-zero point, and silently accepting identity points is a common caller mistake.
-        if (p.is0())
-            throw new Error('bad point: ZERO');
-        // Equation in affine coordinates: ax² + y² = 1 + dx²y²
-        // Equation in projective coordinates (X/Z, Y/Z, Z):  (aX² + Y²)Z² = Z⁴ + dX²Y²
-        const { X, Y, Z, T } = p;
-        const X2 = modP(X * X); // X²
-        const Y2 = modP(Y * Y); // Y²
-        const Z2 = modP(Z * Z); // Z²
-        const Z4 = modP(Z2 * Z2); // Z⁴
-        const aX2 = modP(X2 * a); // aX²
-        const left = modP(Z2 * (aX2 + Y2)); // (aX² + Y²)Z²
-        const right = mod(Z4 + modP(d * modP(X2 * Y2))); // Z⁴ + dX²Y²
-        if (left !== right)
-            throw new Error('bad point: equation left != right (1)');
-        // In Extended coordinates we also have T, which is x*y=T/Z: check X*Y == Z*T
-        const XY = modP(X * Y);
-        const ZT = modP(Z * T);
-        if (XY !== ZT)
-            throw new Error('bad point: equation left != right (2)');
-        return this;
-    }
-    /** Equality check: compare points P&Q. */
-    equals(other) {
-        const { X: X1, Y: Y1, Z: Z1 } = this;
-        const { X: X2, Y: Y2, Z: Z2 } = apoint(other); // checks class equality
-        return modP(X1 * Z2) === modP(X2 * Z1) && modP(Y1 * Z2) === modP(Y2 * Z1);
-    }
-    is0() {
-        return this.equals(I);
-    }
-    /** Flip point over y coordinate. */
-    negate() {
-        return new Point(mod(-this.X), this.Y, this.Z, mod(-this.T));
-    }
-    /** Point doubling. Complete formula. Cost: `4M + 4S + 1*a + 6add + 1*2`. */
-    double() {
-        const { X: X1, Y: Y1, Z: Z1 } = this;
-        const a = _a;
-        // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#doubling-dbl-2008-hwcd
-        const A = modP(X1 * X1);
-        const B = modP(Y1 * Y1);
-        const C = modP(2n * Z1 * Z1);
-        const D = modP(a * A);
-        const x1y1 = mod(X1 + Y1);
-        const E = mod(modP(x1y1 * x1y1) - A - B);
-        const G = mod(D + B);
-        const F = mod(G - C);
-        const H = mod(D - B);
-        const X3 = modP(E * F);
-        const Y3 = modP(G * H);
-        const T3 = modP(E * H);
-        const Z3 = modP(F * G);
-        return new Point(X3, Y3, Z3, T3);
-    }
-    /** Point addition. Complete formula. Cost: `9M + 1*a + 1*d + 7add`. */
-    add(other) {
-        const { X: X1, Y: Y1, Z: Z1, T: T1 } = this;
-        const { X: X2, Y: Y2, Z: Z2, T: T2 } = apoint(other); // doesn't check if other on-curve
-        const a = _a;
-        const d = _d;
-        // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
-        const A = modP(X1 * X2);
-        const B = modP(Y1 * Y2);
-        const C = modP(modP(T1 * d) * T2);
-        const D = modP(Z1 * Z2);
-        const E = mod(modP(mod(X1 + Y1) * mod(X2 + Y2)) - A - B);
-        const F = mod(D - C);
-        const G = mod(D + C);
-        const H = mod(B - modP(a * A));
-        const X3 = modP(E * F);
-        const Y3 = modP(G * H);
-        const T3 = modP(E * H);
-        const Z3 = modP(F * G);
-        return new Point(X3, Y3, Z3, T3);
-    }
-    subtract(other) {
-        return this.add(apoint(other).negate());
-    }
-    /**
-     * Point-by-scalar multiplication. Safe mode requires `1 <= n < CURVE.n`.
-     * Unsafe mode additionally permits `n = 0` and returns the identity point for that case.
-     * Uses {@link wNAF} for base point.
-     * Uses fake point to mitigate side-channel leakage.
-     * @param n - scalar by which point is multiplied
-     * @param safe - safe mode guards against timing attacks; unsafe mode is faster
-     */
-    multiply(n, safe = true) {
-        // Mirror noble-curves: unsafe mode still validates scalar range first, but intentionally keeps
-        // `n = 0` as the one extra accepted case used by verification-style callers.
-        if (!safe && n === 0n)
-            return I;
-        arange(n, 1n, N);
-        if (!safe && this.is0())
-            return I;
-        if (n === 1n)
-            return this;
-        if (this.equals(G))
-            return wNAF(n).p;
-        // init result point & fake point
-        let p = I;
-        let f = G;
-        let d = this;
-        // Safe mode always runs 256 iterations so ladder length can't leak the scalar's
-        // leading zero bits; unsafe mode stops at the top set bit for speed.
-        for (let i = 0; safe ? i < 256 : n > 0n; i++) {
-            // if bit is present, add to point
-            // if not present, add to fake, for timing safety
-            if (n & 1n)
-                p = p.add(d);
-            else if (safe)
-                f = f.add(d);
-            d = d.double();
-            n >>= 1n;
-        }
-        return p;
-    }
-    multiplyUnsafe(scalar) {
-        return this.multiply(scalar, false);
-    }
-    /** Convert point to 2d xy affine point. (X, Y, Z) ∋ (x=X/Z, y=Y/Z) */
-    toAffine() {
-        const { X, Y, Z } = this;
-        // Fast-path only for the identity point; all other inputs still go through inversion.
-        if (this.equals(I))
-            return { x: 0n, y: 1n };
-        const iz = invert(Z, P);
-        // (Z * Z^-1) must be 1, otherwise bad math
-        if (modP(Z * iz) !== 1n)
-            throw new Error('invalid inverse');
-        // x = X*Z^-1; y = Y*Z^-1
-        return { x: modP(X * iz), y: modP(Y * iz) };
-    }
-    toBytes() {
-        const { x, y } = this.toAffine();
-        const b = numTo32bLE(y);
-        // store sign in first LE byte
-        b[31] |= x & 1n ? 0x80 : 0;
-        return b;
-    }
-    toHex() {
-        return bytesToHex(this.toBytes());
-    }
-    clearCofactor() {
-        return this.multiply(8n, false); // h = 8
-    }
-    isSmallOrder() {
-        return this.clearCofactor().is0();
-    }
-    isTorsionFree() {
-        // Multiply by big number N. We can't `mul(N)` because of checks. Instead, we `mul(N/2)*2+1`;
-        // N is odd, so N/2 truncates and the final `add(this)` is always needed.
-        return this.multiply(N / 2n, false)
-            .double()
-            .add(this)
-            .is0();
-    }
-}
-/** Generator / base point */
-const G = new Point(Gx, Gy, 1n, mod(Gx * Gy));
-/** Identity / zero point */
-const I = new Point(0n, 1n, 1n, 0n);
-// Static aliases
-Point.BASE = G;
-Point.ZERO = I;
-const numTo32bLE = (num) => hexToBytes(padh(arange(num, 0n, B256), 64)).reverse();
-// Caller-enforced width: some sites require 32-byte RFC encodings, while others intentionally feed
-// wider SHA-512 output chunks through the same little-endian parser.
-const bytesToNumberLE = (b) => BigInt('0x' + bytesToHex(Uint8Array.from(abytes(b)).reverse()));
-const pow2 = (x, power) => {
-    // pow2(x, 4) == x^(2^4)
-    // Negative `power` values are not rejected here and currently leave `x` unchanged.
-    let r = x;
-    while (power-- > 0) {
-        r = modP(r * r);
-    }
-    return r;
-};
-// prettier-ignore
-const pow_2_252_3 = (x) => {
-    const x2 = modP(x * x); // x^2,       bits 1
-    const b2 = modP(x2 * x); // x^3,       bits 11
-    const b4 = modP(pow2(b2, 2) * b2); // x^(2^4-1), bits 1111
-    const b5 = modP(pow2(b4, 1) * x); // x^(2^5-1), bits 11111
-    const b10 = modP(pow2(b5, 5) * b5); // x^(2^10-1)
-    const b20 = modP(pow2(b10, 10) * b10); // x^(2^20-1)
-    const b40 = modP(pow2(b20, 20) * b20); // x^(2^40-1)
-    const b80 = modP(pow2(b40, 40) * b40); // x^(2^80-1)
-    const b160 = modP(pow2(b80, 80) * b80); // x^(2^160-1)
-    const b240 = modP(pow2(b160, 80) * b80); // x^(2^240-1)
-    const b250 = modP(pow2(b240, 10) * b10); // x^(2^250-1)
-    return modP(pow2(b250, 2) * x); // x^((p-5)/8), used by RFC8032 point decode
-};
-const RM1 = 0x2b8324804fc1df0b2b4d00993dfbd7a72f431806ad2fe478c4ee1b274a0ea0b0n; // 2^((p-1)/4) = sqrt(-1)
-// RFC8032 §5.1.3 square-root helper for point decompression. `value` is only meaningful when
-// `isValid` is true; callers are also expected to pass canonical field elements with non-zero `v`.
-// prettier-ignore
-const uvRatio = (u, v) => {
-    const v3 = modP(v * modP(v * v)); // v³
-    const v7 = modP(modP(v3 * v3) * v); // v⁷
-    const pow = pow_2_252_3(modP(u * v7)); // (uv⁷)^(p-5)/8
-    let x = modP(u * modP(v3 * pow)); // (uv³)(uv⁷)^(p-5)/8
-    const vx2 = modP(v * modP(x * x)); // vx²
-    const root1 = x; // First root candidate
-    const root2 = modP(x * RM1); // Second root candidate; RM1 is √-1
-    const useRoot1 = vx2 === u; // If vx² = u (mod p), x is a square root
-    const useRoot2 = vx2 === mod(-u); // If vx² = -u, set x <-- x * 2^((p-1)/4)
-    const noRoot = vx2 === mod(-u * RM1); // There is no valid root, vx² = -u√-1
-    if (useRoot1)
-        x = root1;
-    if (useRoot2 || noRoot)
-        x = root2; // We return root2 anyway, for const-time
-    if ((mod(x) & 1n) === 1n)
-        x = mod(-x); // edIsNegative
-    return { isValid: useRoot1 || useRoot2, value: x };
-};
-// Reduce a little-endian byte string modulo the subgroup order `N` (RFC 8032's `L`); the `hash`
-// param name reflects the common caller shape, not an input restriction.
-const modL_LE = (hash) => modN(bytesToNumberLE(hash));
-// RFC8032 5.1.5. Split the 64-byte hashed seed into the clamped scalar half and nonce prefix.
-const hashedToExtK = (hashed) => {
-    // slice creates a copy, unlike subarray
-    const copy = snapshotBytes(hashed);
-    const head = copy.slice(0, 32);
-    head[0] &= 248; // Clamp bits: 0b1111_1000
-    head[31] &= 127; // 0b0111_1111
-    head[31] |= 64; // 0b0100_0000
-    const prefix = copy.slice(32); // secret key "prefix"
-    // RFC words this as `[s]B`; reducing the clamped little-endian scalar modulo `N` is equivalent
-    // for base-point multiplication because `G` already has subgroup order `N`.
-    const scalar = modL_LE(head);
-    const point = G.multiply(scalar); // public key point
-    const pointBytes = point.toBytes(); // point serialized to Uint8Array
-    return { head, prefix, scalar, point, pointBytes };
-};
-// RFC8032 5.1.5; getPublicKey async, sync. Hash secret key and extract point.
-const getExtendedPublicKeyAsync = (secretKey) => callHashAsync('sha512Async', abytes(secretKey, LEN, 'secretKey')).then(hashedToExtK);
-const getExtendedPublicKey = (secretKey) => hashedToExtK(callHash('sha512', abytes(secretKey, LEN, 'secretKey')));
-/**
- * Creates a 32-byte Ed25519 public key from the RFC 8032 32-byte secret-key seed. Async.
- * @param secretKey - 32-byte RFC 8032 secret-key seed, not a 64-byte expanded secret key.
- * @returns 32-byte public key.
- * @throws On wrong argument types. {@link TypeError}
- * @throws On wrong argument ranges or values. {@link RangeError}
- * @example
- * Derive the public key bytes for a newly generated signer secret.
- *
- * ```ts
- * import * as ed from '@noble/ed25519';
- *
- * const secretKey = ed.utils.randomSecretKey();
- * const publicKey = await ed.getPublicKeyAsync(secretKey);
- * ```
- */
-const getPublicKeyAsync = (secretKey) => getExtendedPublicKeyAsync(secretKey).then((p) => p.pointBytes);
-/**
- * Creates a 32-byte Ed25519 public key from the RFC 8032 32-byte secret-key seed.
- * To use, set `hashes.sha512` first.
- * @param secretKey - 32-byte RFC 8032 secret-key seed, not a 64-byte expanded secret key.
- * @returns 32-byte public key.
- * @throws If synchronous SHA-512 has not been configured in `hashes`. {@link Error}
- * @throws On wrong argument types. {@link TypeError}
- * @throws On wrong argument ranges or values. {@link RangeError}
- * @example
- * Derive the public key entirely through the synchronous API.
- *
- * ```ts
- * import * as ed from '@noble/ed25519';
- * import { sha512 } from '@noble/hashes/sha2.js';
- *
- * ed.hashes.sha512 = sha512;
- * const secretKey = ed.utils.randomSecretKey();
- * const publicKey = ed.getPublicKey(secretKey);
- * ```
- */
-const getPublicKey = (secretKey) => getExtendedPublicKey(secretKey).pointBytes;
-const hashFinishAsync = async (res) => res[1](await callHashAsync('sha512Async', res[0]));
-const hashFinishSync = (res) => res[1](callHash('sha512', res[0]));
-// Code, shared between sync & async sign
-const _sign = (e, rBytes, msg) => {
-    const { pointBytes: A, scalar: s } = e;
-    const r = modL_LE(rBytes); // r was created outside, reduce it modulo L
-    // RFC 8032 5.1.6 allows r mod L = 0, and SUPERCOP ref10 accepts the resulting identity-point
-    // signature.
-    // We intentionally keep the safe multiply() rejection here so a miswired all-zero SHA-512 provider
-    // fails loudly instead of silently producing a degenerate signature.
-    const R = G.multiply(r).toBytes(); // R = [r]B
-    const hashable = concatBytes(R, A, msg); // dom2(F, C) || R || A || PH(M)
-    const finish = (hashed) => {
-        // k = SHA512(dom2(F, C) || R || A || PH(M))
-        const S = modN(r + modL_LE(hashed) * s); // S = (r + k * s) mod L; 0 <= s < l
-        return abytes(concatBytes(R, numTo32bLE(S)), 64); // 64-byte sig: 32-byte encoded R point || 32-byte LE(S)
-    };
-    return [hashable, finish];
-};
-/**
- * Signs message using secret key. Async.
- * Follows RFC8032 5.1.6.
- * @param message - Message bytes to sign.
- * @param secretKey - 32-byte RFC 8032 secret-key seed, not a 64-byte expanded secret key.
- * @returns 64-byte Ed25519 signature.
- * @throws On wrong argument types. {@link TypeError}
- * @throws On wrong argument ranges or values. {@link RangeError}
- * @example
- * Sign an arbitrary message with a fresh Ed25519 secret key.
- *
- * ```ts
- * import * as ed from '@noble/ed25519';
- *
- * const secretKey = ed.utils.randomSecretKey();
- * const message = new Uint8Array([1, 2, 3]);
- * const signature = await ed.signAsync(message, secretKey);
- * ```
- */
-const signAsync = async (message, secretKey) => {
-    const m = snapshotBytes(message, 'message');
-    const e = await getExtendedPublicKeyAsync(secretKey);
-    // r = SHA512(dom2(F, C) || prefix || PH(M)); then generate R, k, S and the signature.
-    return hashFinishAsync(_sign(e, await callHashAsync('sha512Async', e.prefix, m), m));
-};
-/**
- * Signs message using secret key. To use, set `hashes.sha512` first.
- * Follows RFC8032 5.1.6.
- * @param message - Message bytes to sign.
- * @param secretKey - 32-byte RFC 8032 secret-key seed, not a 64-byte expanded secret key.
- * @returns 64-byte Ed25519 signature.
- * @throws If synchronous SHA-512 has not been configured in `hashes`. {@link Error}
- * @throws On wrong argument types. {@link TypeError}
- * @throws On wrong argument ranges or values. {@link RangeError}
- * @example
- * Use the sync API when you've wired a SHA-512 implementation yourself.
- *
- * ```ts
- * import * as ed from '@noble/ed25519';
- * import { sha512 } from '@noble/hashes/sha2.js';
- *
- * ed.hashes.sha512 = sha512;
- * const secretKey = ed.utils.randomSecretKey();
- * const signature = ed.sign(new Uint8Array([1, 2, 3]), secretKey);
- * ```
- */
-const sign = (message, secretKey) => {
-    const m = snapshotBytes(message, 'message');
-    const e = getExtendedPublicKey(secretKey);
-    // r = SHA512(dom2(F, C) || prefix || PH(M)); then generate R, k, S and the signature.
-    return hashFinishSync(_sign(e, callHash('sha512', e.prefix, m), m));
-};
-// Exported defaults favor ZIP-215 interoperability semantics; callers must opt into the stricter
-// branch with `{ zip215: false }`.
-// Preserves the exported ZIP-215 default for `{}` / `{ zip215: undefined }`, not just omitted opts.
-const getZip215 = (options) => {
-    if (options === null || typeof options !== 'object')
-        throw new TypeError('expected valid options object');
-    return options.zip215 ?? true;
-};
-const _verify = (sig, msg, publicKey, options) => {
-    sig = abytes(sig, 64, 'signature'); // Signature hex str/Bytes, must be 64 bytes
-    msg = abytes(msg, undefined, 'message'); // Message hex str/Bytes
-    publicKey = abytes(publicKey, LEN, 'publicKey');
-    const zip215 = getZip215(options);
-    // zip215=false keeps the library's stricter branch, which still canonicalizes `R` / `A` before
-    // hashing and rejects small-order public keys earlier than pure RFC8032 text would require.
-    const r = sig.subarray(0, LEN);
-    const s = bytesToNumberLE(sig.subarray(LEN, 64)); // Decode second half as an integer S;
-    let A, R, SB;
-    let hashable = Uint8Array.of();
-    let finished = false;
-    try {
-        // zip215=true is good for consensus-critical apps. =false follows RFC8032 / NIST186-5.
-        // zip215=true:  0 <= y < MASK (2^256 for ed25519)
-        // zip215=false: 0 <= y < P (2^255-19 for ed25519)
-        A = Point.fromBytes(publicKey, zip215);
-        R = Point.fromBytes(r, zip215);
-        SB = G.multiply(s, false); // 0 <= s < l is done inside
-        // ZIP-215 accepts noncanonical / unreduced point encodings, so the challenge hash must use the
-        // exact signature/public-key bytes rather than canonicalized re-encodings of the decoded points.
-        hashable = concatBytes(r, publicKey, msg); // dom2(F, C) || R || A || PH(M)
-        finished = true;
-    }
-    catch (error) { }
-    const finish = (hashed) => {
-        if (!finished)
-            return false;
-        // Policy: strict mode intentionally rejects all small-order public keys, even though the raw RFC
-        // equation text is looser here. This matches libsodium and avoids weak / ambiguous verification
-        // outcomes where unusual low-order public keys can make distinct key/signature combinations verify.
-        if (!zip215 && A.isSmallOrder())
-            return false;
-        // k = SHA512(dom2(F, C) || R || A || PH(M))
-        const k = modL_LE(hashed);
-        const RkA = R.add(A.multiply(k, false));
-        // Extended group equation
-        // [8][S]B = [8]R + [8][k]A'
-        return RkA.subtract(SB).clearCofactor().is0();
-    };
-    return [hashable, finish];
-};
-/**
- * Verifies a signature on message and public key. Async.
- * The implementation is based on RFC8032 5.1.7, but default opts use ZIP-215 semantics; pass
- * `{ zip215: false }` for the library's stricter branch.
- * @param signature - 64-byte signature.
- * @param message - Signed message bytes.
- * @param publicKey - 32-byte public key.
- * @param opts - Verification options. Defaults to ZIP-215 semantics. See {@link EdDSAVerifyOpts}.
- * @returns `true` when the signature is valid.
- * @throws On wrong argument types. {@link TypeError}
- * @throws On wrong argument ranges or values. {@link RangeError}
- * @example
- * Verify the signature against the same message and derived public key.
- *
- * ```ts
- * import * as ed from '@noble/ed25519';
- *
- * const secretKey = ed.utils.randomSecretKey();
- * const message = new Uint8Array([1, 2, 3]);
- * const publicKey = await ed.getPublicKeyAsync(secretKey);
- * const signature = await ed.signAsync(message, secretKey);
- * const isValid = await ed.verifyAsync(signature, message, publicKey);
- * ```
- */
-const verifyAsync = async (signature, message, publicKey, opts = {}) => hashFinishAsync(_verify(signature, message, publicKey, opts));
-/**
- * Verifies a signature on message and public key using the synchronous hash path.
- * The implementation is based on RFC8032 5.1.7, but default opts use ZIP-215 semantics; pass
- * `{ zip215: false }` for the library's stricter branch.
- * @param signature - 64-byte signature.
- * @param message - Signed message bytes.
- * @param publicKey - 32-byte public key.
- * @param opts - Verification options. Defaults to ZIP-215 semantics. See {@link EdDSAVerifyOpts}.
- * @returns `true` when the signature is valid.
- * @throws If synchronous SHA-512 has not been configured in `hashes`. {@link Error}
- * @throws On wrong argument types. {@link TypeError}
- * @throws On wrong argument ranges or values. {@link RangeError}
- * @example
- * Verify a signature entirely through the synchronous API.
- *
- * ```ts
- * import * as ed from '@noble/ed25519';
- * import { sha512 } from '@noble/hashes/sha2.js';
- *
- * ed.hashes.sha512 = sha512;
- * const secretKey = ed.utils.randomSecretKey();
- * const message = new Uint8Array([1, 2, 3]);
- * const publicKey = ed.getPublicKey(secretKey);
- * const signature = ed.sign(message, secretKey);
- * const isValid = ed.verify(signature, message, publicKey);
- * ```
- */
-const verify = (signature, message, publicKey, opts = {}) => hashFinishSync(_verify(signature, message, publicKey, opts));
-/**
- * Math, hex, byte helpers. Not in `utils` because utils share API with noble-curves.
- * Exposes the same low-level field-default `mod` reducer and non-CT `invert` helper used
- * internally.
- * @example
- * Convert bytes to a hex string with the low-level helper namespace.
- *
- * ```ts
- * const hex = etc.bytesToHex(new Uint8Array([1, 2, 3]));
- * ```
- */
-const etc = /* @__PURE__ */ freeze({
-    bytesToHex,
-    hexToBytes,
-    concatBytes,
-    mod,
-    invert,
-    randomBytes,
-});
-/**
- * Hash implementations used by the synchronous API plus the default async WebCrypto provider.
- * Both slots are configurable API surface; wrapper helpers revalidate that providers still return
- * 64-byte SHA-512 digests.
- * @example
- * Provide a SHA-512 implementation before calling synchronous helpers.
- *
- * ```ts
- * import * as ed from '@noble/ed25519';
- * import { sha512 } from '@noble/hashes/sha2.js';
- *
- * ed.hashes.sha512 = sha512;
- * const { publicKey } = ed.keygen();
- * ```
- */
-const hashes = {
-    sha512Async: async (message) => {
-        const s = globalThis?.crypto?.subtle;
-        if (!s)
-            throw new Error('crypto.subtle must be defined, consider polyfill');
-        return new Uint8Array(await s.digest('SHA-512', concatBytes(message)));
-    },
-    sha512: undefined,
-};
-// Returns the final 32-byte Ed25519 secret-key seed verbatim, generating fresh random bytes only
-// when omitted.
-const randomSecretKey = (seed) => {
-    return abytes(seed === undefined ? randomBytes() : seed, LEN, 'seed');
-};
-/**
- * Generates a secret/public keypair.
- * @param seed - Optional 32-byte Ed25519 secret-key seed, returned verbatim as `secretKey`.
- * @returns Keypair with `secretKey` and `publicKey`.
- * @throws If synchronous SHA-512 has not been configured in `hashes`. {@link Error}
- * @throws On wrong argument types. {@link TypeError}
- * @throws On wrong argument ranges or values. {@link RangeError}
- * @example
- * Generate a new keypair through the synchronous API after wiring SHA-512.
- *
- * ```ts
- * import * as ed from '@noble/ed25519';
- * import { sha512 } from '@noble/hashes/sha2.js';
- *
- * ed.hashes.sha512 = sha512;
- * const { secretKey, publicKey } = ed.keygen();
- * ```
- */
-const keygen = (seed) => {
-    const secretKey = randomSecretKey(seed);
-    const publicKey = getPublicKey(secretKey);
-    return { secretKey, publicKey };
-};
-/**
- * Generates a secret/public keypair asynchronously.
- * @param seed - Optional 32-byte Ed25519 secret-key seed, returned verbatim as `secretKey`.
- * @returns Keypair with `secretKey` and `publicKey`.
- * @throws On wrong argument types. {@link TypeError}
- * @throws On wrong argument ranges or values. {@link RangeError}
- * @example
- * Generate a new keypair through the asynchronous WebCrypto-backed path.
- *
- * ```ts
- * import * as ed from '@noble/ed25519';
- *
- * const { secretKey, publicKey } = await ed.keygenAsync();
- * ```
- */
-const keygenAsync = async (seed) => {
-    const secretKey = randomSecretKey(seed);
-    const publicKey = await getPublicKeyAsync(secretKey);
-    return { secretKey, publicKey };
-};
-/**
- * Ed25519-specific key utilities.
- * `utils.getExtendedPublicKey*` expose secret-derived internals (`head`, `prefix`, `scalar`, and
- * point objects), not just public-key bytes.
- * @example
- * Generate a new Ed25519 secret key and derive the matching public key.
- *
- * ```ts
- * import * as ed from '@noble/ed25519';
- *
- * const secretKey = ed.utils.randomSecretKey();
- * const publicKey = await ed.getPublicKeyAsync(secretKey);
- * ```
- */
-const utils = /* @__PURE__ */ freeze({
-    getExtendedPublicKeyAsync,
-    getExtendedPublicKey,
-    randomSecretKey,
-});
-// ## Precomputes
-// --------------
-// Fixed W=8 window: 33 windows (ceil(256/8) + 1, NOT 32 - see wNAF loop), 128 points per window.
-// Layout is grouped by window: each block stores the positive multiples `1*base .. 128*base` for
-// that window, and the extra `+1` window absorbs carries from signed-digit recoding.
-const precompute = () => {
-    const points = [];
-    let p = G;
-    let b;
-    for (let w = 0; w < 33; w++) {
-        b = p;
-        points.push(b);
-        for (let i = 1; i < 128; i++) {
-            b = b.add(p);
-            points.push(b);
-        } // i=1, bc we skip 0
-        p = b.double();
-    }
-    return points;
-};
-let Gpows = undefined; // shared process-wide cache of base-point precomputes
-// Branch-based negate helper used for JS/JIT mitigation symmetry, not a strict constant-time claim.
-const ctneg = (cnd, p) => {
-    const n = p.negate();
-    return cnd ? n : p;
-};
-/**
- * Precomputes give 12x faster getPublicKey(), 10x sign(), 2x verify() by
- * caching multiples of G (base point). Cache is stored in 32MB of RAM.
- * Any time `G.multiply` is done, precomputes are used.
- * Not used for getSharedSecret, which instead multiplies random pubkey `P.multiply`.
- *
- * w-ary non-adjacent form (wNAF) precomputation method is 10% slower than windowed method,
- * but takes 2x less RAM. RAM reduction is possible by utilizing `.subtract`.
- * Returns the real accumulator `p` plus a fake accumulator `f`; callers only care about `p`, while
- * `f` exists to keep similar work in zero-digit branches as a JS/JIT side-channel mitigation.
- *
- * !! Precomputes can be disabled by commenting-out call of the wNAF() inside Point#multiply().
- */
-const wNAF = (n) => {
-    const comp = Gpows || (Gpows = precompute());
-    let p = I;
-    let f = G; // f must be G, or could become I in the end
-    for (let w = 0; w < 33; w++) {
-        let wbits = Number(n & 255n); // extract W=8 bits.
-        n >>= 8n; // shift number by W=8 bits.
-        // We use negative indexes to reduce size of precomputed table by 2x.
-        // Instead of needing precomputes 0..256, we only calculate them for 0..128.
-        // If an index > 128 is found, we do (256-index) - where 256 is next window.
-        // Naive: index +127 => 127, +224 => 224
-        // Optimized: index +127 => 127, +224 => 256-32
-        if (wbits > 128) {
-            wbits -= 256;
-            n += 1n;
-        }
-        const off = w * 128; // offset of this window's block; also the fake-add index
-        const offP = off + Math.abs(wbits) - 1; // real-add index; both offsets always evaluated
-        const isOddW = w % 2 !== 0; // conditions, evaluate both; alternates fake-add sign per window
-        const isNeg = wbits < 0;
-        if (wbits === 0) {
-            // wbits == 0 means the real index would be I: can't add it. Add window offset `off` instead.
-            f = f.add(ctneg(isOddW, comp[off])); // bits are 0: add garbage to fake point
-        }
-        else {
-            p = p.add(ctneg(isNeg, comp[offP])); // bits are 1: add to result point
-        }
-    }
-    if (n !== 0n)
-        throw new Error('invalid wnaf');
-    return { p, f }; // return both real and fake points for JIT/leakage-shape symmetry
-};
-// !! Remove the export to easily use in REPL / browser console
-export { etc, getPublicKey, getPublicKeyAsync, hash, hashes, keygen, keygenAsync, Point, sign, signAsync, utils, verify, verifyAsync, };