@openclaw/nostr 2026.5.20-beta.2 → 2026.5.22

package/node_modules/@noble/curves/src/misc.ts

@@ -0,0 +1,140 @@
+/**
+ * Miscellaneous, rarely used curves.
+ * jubjub, babyjubjub, pallas, vesta.
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { blake256 } from '@noble/hashes/blake1.js';
+import { blake2s } from '@noble/hashes/blake2.js';
+import { sha256, sha384, sha512 } from '@noble/hashes/sha2.js';
+import { concatBytes } from '@noble/hashes/utils.js';
+import {
+  eddsa,
+  edwards,
+  type EdDSA,
+  type EdwardsOpts,
+  type EdwardsPoint,
+} from './abstract/edwards.ts';
+import { ecdsa, weierstrass, type ECDSA, type WeierstrassOpts } from './abstract/weierstrass.ts';
+import { asciiToBytes } from './utils.ts';
+
+// Jubjub curves have 𝔽p over scalar fields of other curves. They are friendly to ZK proofs.
+
+// jubjub p = bls n, verify in bls12-381.ts
+const jubjub_CURVE: EdwardsOpts = {
+  p: BigInt('0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001'),
+  n: BigInt('0xe7db4ea6533afa906673b0101343b00a6682093ccc81082d0970e5ed6f72cb7'),
+  h: BigInt(8),
+  a: BigInt('0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000000'),
+  d: BigInt('0x2a9318e74bfa2b48f5fd9207e6bd7fd4292d7f6d37579d2601065fd6d6343eb1'),
+  Gx: BigInt('0x11dafe5d23e1218086a365b99fbf3d3be72f6afd7d1f72623e6b071492d1122b'),
+  Gy: BigInt('0x1d523cf1ddab1a1793132e78c866c0c33e26ba5cc220fed7cc3f870e59d292aa'),
+};
+/** Curve over scalar field of bls12-381. jubjub Fp = bls n */
+export const jubjub: EdDSA = /* @__PURE__ */ eddsa(edwards(jubjub_CURVE), sha512);
+
+// babyjubjub p = bn254 n, verify in bn254.ts
+const babyjubjub_CURVE: EdwardsOpts = {
+  p: BigInt('0x30644e72e131a029b85045b68181585d2833e84879b9709143e1f593f0000001'),
+  n: BigInt('0x30644e72e131a029b85045b68181585d59f76dc1c90770533b94bee1c9093788'),
+  h: BigInt(8),
+  a: BigInt('168700'),
+  d: BigInt('168696'),
+  Gx: BigInt('0x23343e3445b673d38bcba38f25645adb494b1255b1162bb40f41a59f4d4b45e'),
+  Gy: BigInt('0xc19139cb84c680a6e14116da06056174a0cfa121e6e5c2450f87d64fc000001'),
+};
+/** Curve over scalar field of bn254. babyjubjub Fp = bn254 n */
+export const babyjubjub: EdDSA = /* @__PURE__ */ eddsa(edwards(babyjubjub_CURVE), blake256);
+
+const jubjub_gh_first_block = asciiToBytes(
+  '096b36a5804bfacef1691e173c366a47ff5ba84a44f26ddd7e8d9f79d5b42df0'
+);
+
+// Returns point at JubJub curve which is prime order and not zero
+export function jubjub_groupHash(tag: Uint8Array, personalization: Uint8Array): EdwardsPoint {
+  const h = blake2s.create({ personalization, dkLen: 32 });
+  h.update(jubjub_gh_first_block);
+  h.update(tag);
+  // NOTE: returns EdwardsPoint, in case it will be multiplied later
+  let p = jubjub.Point.fromBytes(h.digest());
+  // NOTE: cannot replace with isSmallOrder, returns Point*8
+  p = p.multiply(jubjub_CURVE.h);
+  if (p.equals(jubjub.Point.ZERO)) throw new Error('Point has small order');
+  return p;
+}
+
+// No secret data is leaked here at all.
+// It operates over public data:
+// const G_SPEND = jubjub.findGroupHash(Uint8Array.of(), asciiToBytes('Item_G_'));
+export function jubjub_findGroupHash(m: Uint8Array, personalization: Uint8Array): EdwardsPoint {
+  const tag = concatBytes(m, Uint8Array.of(0));
+  const hashes = [];
+  for (let i = 0; i < 256; i++) {
+    tag[tag.length - 1] = i;
+    try {
+      hashes.push(jubjub_groupHash(tag, personalization));
+    } catch (e) {}
+  }
+  if (!hashes.length) throw new Error('findGroupHash tag overflow');
+  return hashes[0];
+}
+
+const brainpoolP256r1_CURVE: WeierstrassOpts<bigint> = {
+  p: BigInt('0xa9fb57dba1eea9bc3e660a909d838d726e3bf623d52620282013481d1f6e5377'),
+  a: BigInt('0x7d5a0975fc2c3057eef67530417affe7fb8055c126dc5c6ce94a4b44f330b5d9'),
+  b: BigInt('0x26dc5c6ce94a4b44f330b5d9bbd77cbf958416295cf7e1ce6bccdc18ff8c07b6'),
+  n: BigInt('0xa9fb57dba1eea9bc3e660a909d838d718c397aa3b561a6f7901e0e82974856a7'),
+  Gx: BigInt('0x8bd2aeb9cb7e57cb2c4b482ffc81b7afb9de27e1e3bd23c23a4453bd9ace3262'),
+  Gy: BigInt('0x547ef835c3dac4fd97f8461a14611dc9c27745132ded8e545c1d54c72f046997'),
+  h: BigInt(1),
+};
+/** Brainpool P256r1 with sha256, from RFC 5639. */
+export const brainpoolP256r1: ECDSA = ecdsa(weierstrass(brainpoolP256r1_CURVE), sha256);
+
+const brainpoolP384r1_CURVE: WeierstrassOpts<bigint> = {
+  p: BigInt(
+    '0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b412b1da197fb71123acd3a729901d1a71874700133107ec53'
+  ),
+  a: BigInt(
+    '0x7bc382c63d8c150c3c72080ace05afa0c2bea28e4fb22787139165efba91f90f8aa5814a503ad4eb04a8c7dd22ce2826'
+  ),
+  b: BigInt(
+    '0x04a8c7dd22ce28268b39b55416f0447c2fb77de107dcd2a62e880ea53eeb62d57cb4390295dbc9943ab78696fa504c11'
+  ),
+  n: BigInt(
+    '0x8cb91e82a3386d280f5d6f7e50e641df152f7109ed5456b31f166e6cac0425a7cf3ab6af6b7fc3103b883202e9046565'
+  ),
+  Gx: BigInt(
+    '0x1d1c64f068cf45ffa2a63a81b7c13f6b8847a3e77ef14fe3db7fcafe0cbd10e8e826e03436d646aaef87b2e247d4af1e'
+  ),
+  Gy: BigInt(
+    '0x8abe1d7520f9c2a45cb1eb8e95cfd55262b70b29feec5864e19c054ff99129280e4646217791811142820341263c5315'
+  ),
+  h: BigInt(1),
+};
+/** Brainpool P384r1 with sha384, from RFC 5639. */
+export const brainpoolP384r1: ECDSA = ecdsa(weierstrass(brainpoolP384r1_CURVE), sha384);
+
+const brainpoolP512r1_CURVE: WeierstrassOpts<bigint> = {
+  p: BigInt(
+    '0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca703308717d4d9b009bc66842aecda12ae6a380e62881ff2f2d82c68528aa6056583a48f3'
+  ),
+  a: BigInt(
+    '0x7830a3318b603b89e2327145ac234cc594cbdd8d3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94ca'
+  ),
+  b: BigInt(
+    '0x3df91610a83441caea9863bc2ded5d5aa8253aa10a2ef1c98b9ac8b57f1117a72bf2c7b9e7c1ac4d77fc94cadc083e67984050b75ebae5dd2809bd638016f723'
+  ),
+  n: BigInt(
+    '0xaadd9db8dbe9c48b3fd4e6ae33c9fc07cb308db3b3c9d20ed6639cca70330870553e5c414ca92619418661197fac10471db1d381085ddaddb58796829ca90069'
+  ),
+  Gx: BigInt(
+    '0x81aee4bdd82ed9645a21322e9c4c6a9385ed9f70b5d916c1b43b62eef4d0098eff3b1f78e2d0d48d50d1687b93b97d5f7c6d5047406a5e688b352209bcb9f822'
+  ),
+  Gy: BigInt(
+    '0x7dde385d566332ecc0eabfa9cf7822fdf209f70024a57b1aa000c55b881f8111b2dcde494a5f485e5bca4bd88a2763aed1ca2b2fa8f0540678cd1e0f3ad80892'
+  ),
+  h: BigInt(1),
+};
+/** Brainpool P521r1 with sha512, from RFC 5639. */
+export const brainpoolP512r1: ECDSA = ecdsa(weierstrass(brainpoolP512r1_CURVE), sha512);

package/node_modules/@noble/curves/src/nist.ts

@@ -0,0 +1,204 @@
+/**
+ * Internal module for NIST P256, P384, P521 curves.
+ * Do not use for now.
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { sha256, sha384, sha512 } from '@noble/hashes/sha2.js';
+import { createHasher, type H2CHasher } from './abstract/hash-to-curve.ts';
+import { Field } from './abstract/modular.ts';
+import { createORPF, type OPRF } from './abstract/oprf.ts';
+import {
+  ecdsa,
+  mapToCurveSimpleSWU,
+  weierstrass,
+  type ECDSA,
+  type WeierstrassOpts,
+  type WeierstrassPointCons,
+} from './abstract/weierstrass.ts';
+
+// p = 2n**224n * (2n**32n-1n) + 2n**192n + 2n**96n - 1n
+// a = Fp256.create(BigInt('-3'));
+const p256_CURVE: WeierstrassOpts<bigint> = /* @__PURE__ */ (() => ({
+  p: BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'),
+  n: BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),
+  h: BigInt(1),
+  a: BigInt('0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc'),
+  b: BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b'),
+  Gx: BigInt('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),
+  Gy: BigInt('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),
+}))();
+
+// p = 2n**384n - 2n**128n - 2n**96n + 2n**32n - 1n
+const p384_CURVE: WeierstrassOpts<bigint> = /* @__PURE__ */ (() => ({
+  p: BigInt(
+    '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffff'
+  ),
+  n: BigInt(
+    '0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973'
+  ),
+  h: BigInt(1),
+  a: BigInt(
+    '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffc'
+  ),
+  b: BigInt(
+    '0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aef'
+  ),
+  Gx: BigInt(
+    '0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7'
+  ),
+  Gy: BigInt(
+    '0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5f'
+  ),
+}))();
+
+// p = 2n**521n - 1n
+const p521_CURVE: WeierstrassOpts<bigint> = /* @__PURE__ */ (() => ({
+  p: BigInt(
+    '0x1ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff'
+  ),
+  n: BigInt(
+    '0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409'
+  ),
+  h: BigInt(1),
+  a: BigInt(
+    '0x1fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc'
+  ),
+  b: BigInt(
+    '0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00'
+  ),
+  Gx: BigInt(
+    '0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66'
+  ),
+  Gy: BigInt(
+    '0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650'
+  ),
+}))();
+
+type SwuOpts = {
+  A: bigint;
+  B: bigint;
+  Z: bigint;
+};
+
+function createSWU(Point: WeierstrassPointCons<bigint>, opts: SwuOpts) {
+  const map = mapToCurveSimpleSWU(Point.Fp, opts);
+  return (scalars: bigint[]) => map(scalars[0]);
+}
+
+// NIST P256
+const p256_Point = /* @__PURE__ */ weierstrass(p256_CURVE);
+/**
+ * NIST P256 (aka secp256r1, prime256v1) curve, ECDSA and ECDH methods.
+ * Hashes inputs with sha256 by default.
+ *
+ * @example
+ * ```js
+ * import { p256 } from '@noble/curves/nist.js';
+ * const { secretKey, publicKey } = p256.keygen();
+ * // const publicKey = p256.getPublicKey(secretKey);
+ * const msg = new TextEncoder().encode('hello noble');
+ * const sig = p256.sign(msg, secretKey);
+ * const isValid = p256.verify(sig, msg, publicKey);
+ * // const sigKeccak = p256.sign(keccak256(msg), secretKey, { prehash: false });
+ * ```
+ */
+export const p256: ECDSA = /* @__PURE__ */ ecdsa(p256_Point, sha256);
+/** Hashing / encoding to p256 points / field. RFC 9380 methods. */
+export const p256_hasher: H2CHasher<WeierstrassPointCons<bigint>> = /* @__PURE__ */ (() => {
+  return createHasher(
+    p256_Point,
+    createSWU(p256_Point, {
+      A: p256_CURVE.a,
+      B: p256_CURVE.b,
+      Z: p256_Point.Fp.create(BigInt('-10')),
+    }),
+    {
+      DST: 'P256_XMD:SHA-256_SSWU_RO_',
+      encodeDST: 'P256_XMD:SHA-256_SSWU_NU_',
+      p: p256_CURVE.p,
+      m: 1,
+      k: 128,
+      expand: 'xmd',
+      hash: sha256,
+    }
+  );
+})();
+/** p256 OPRF, defined in RFC 9497. */
+export const p256_oprf: OPRF = /* @__PURE__ */ (() =>
+  createORPF({
+    name: 'P256-SHA256',
+    Point: p256_Point,
+    hash: sha256,
+    hashToGroup: p256_hasher.hashToCurve,
+    hashToScalar: p256_hasher.hashToScalar,
+  }))();
+
+// NIST P384
+const p384_Point = /* @__PURE__ */ weierstrass(p384_CURVE);
+/** NIST P384 (aka secp384r1) curve, ECDSA and ECDH methods. Hashes inputs with sha384 by default. */
+export const p384: ECDSA = /* @__PURE__ */ ecdsa(p384_Point, sha384);
+/** Hashing / encoding to p384 points / field. RFC 9380 methods. */
+export const p384_hasher: H2CHasher<WeierstrassPointCons<bigint>> = /* @__PURE__ */ (() => {
+  return createHasher(
+    p384_Point,
+    createSWU(p384_Point, {
+      A: p384_CURVE.a,
+      B: p384_CURVE.b,
+      Z: p384_Point.Fp.create(BigInt('-12')),
+    }),
+    {
+      DST: 'P384_XMD:SHA-384_SSWU_RO_',
+      encodeDST: 'P384_XMD:SHA-384_SSWU_NU_',
+      p: p384_CURVE.p,
+      m: 1,
+      k: 192,
+      expand: 'xmd',
+      hash: sha384,
+    }
+  );
+})();
+/** p384 OPRF, defined in RFC 9497. */
+export const p384_oprf: OPRF = /* @__PURE__ */ (() =>
+  createORPF({
+    name: 'P384-SHA384',
+    Point: p384_Point,
+    hash: sha384,
+    hashToGroup: p384_hasher.hashToCurve,
+    hashToScalar: p384_hasher.hashToScalar,
+  }))();
+
+// NIST P521
+const Fn521 = /* @__PURE__ */ (() => Field(p521_CURVE.n, { allowedLengths: [65, 66] }))();
+const p521_Point = /* @__PURE__ */ weierstrass(p521_CURVE, { Fn: Fn521 });
+/** NIST P521 (aka secp521r1) curve, ECDSA and ECDH methods. Hashes inputs with sha512 by default. */
+export const p521: ECDSA = /* @__PURE__ */ ecdsa(p521_Point, sha512);
+/** Hashing / encoding to p521 points / field. RFC 9380 methods. */
+export const p521_hasher: H2CHasher<WeierstrassPointCons<bigint>> = /* @__PURE__ */ (() => {
+  return createHasher(
+    p521_Point,
+    createSWU(p521_Point, {
+      A: p521_CURVE.a,
+      B: p521_CURVE.b,
+      Z: p521_Point.Fp.create(BigInt('-4')),
+    }),
+    {
+      DST: 'P521_XMD:SHA-512_SSWU_RO_',
+      encodeDST: 'P521_XMD:SHA-512_SSWU_NU_',
+      p: p521_CURVE.p,
+      m: 1,
+      k: 256,
+      expand: 'xmd',
+      hash: sha512,
+    }
+  );
+})();
+/** p521 OPRF, defined in RFC 9497. */
+export const p521_oprf: OPRF = /* @__PURE__ */ (() =>
+  createORPF({
+    name: 'P521-SHA512',
+    Point: p521_Point,
+    hash: sha512,
+    hashToGroup: p521_hasher.hashToCurve,
+    hashToScalar: p521_hasher.hashToScalar, // produces L=98 just like in RFC
+  }))();

package/node_modules/@noble/curves/src/secp256k1.ts

@@ -0,0 +1,327 @@
+/**
+ * SECG secp256k1. See [pdf](https://www.secg.org/sec2-v2.pdf).
+ *
+ * Belongs to Koblitz curves: it has efficiently-computable GLV endomorphism ψ,
+ * check out {@link EndomorphismOpts}. Seems to be rigid (not backdoored).
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+import { sha256 } from '@noble/hashes/sha2.js';
+import { randomBytes } from '@noble/hashes/utils.js';
+import { createKeygen, type CurveLengths } from './abstract/curve.ts';
+import { createHasher, type H2CHasher, isogenyMap } from './abstract/hash-to-curve.ts';
+import { Field, mapHashToField, pow2 } from './abstract/modular.ts';
+import {
+  type ECDSA,
+  ecdsa,
+  type EndomorphismOpts,
+  mapToCurveSimpleSWU,
+  type WeierstrassPoint as PointType,
+  weierstrass,
+  type WeierstrassOpts,
+  type WeierstrassPointCons,
+} from './abstract/weierstrass.ts';
+import { abytes, asciiToBytes, bytesToNumberBE, concatBytes } from './utils.ts';
+
+// Seems like generator was produced from some seed:
+// `Pointk1.BASE.multiply(Pointk1.Fn.inv(2n, N)).toAffine().x`
+// // gives short x 0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63n
+const secp256k1_CURVE: WeierstrassOpts<bigint> = {
+  p: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'),
+  n: BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'),
+  h: BigInt(1),
+  a: BigInt(0),
+  b: BigInt(7),
+  Gx: BigInt('0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'),
+  Gy: BigInt('0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8'),
+};
+
+const secp256k1_ENDO: EndomorphismOpts = {
+  beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),
+  basises: [
+    [BigInt('0x3086d221a7d46bcde86c90e49284eb15'), -BigInt('0xe4437ed6010e88286f547fa90abfe4c3')],
+    [BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8'), BigInt('0x3086d221a7d46bcde86c90e49284eb15')],
+  ],
+};
+
+const _0n = /* @__PURE__ */ BigInt(0);
+const _2n = /* @__PURE__ */ BigInt(2);
+
+/**
+ * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.
+ * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]
+ */
+function sqrtMod(y: bigint): bigint {
+  const P = secp256k1_CURVE.p;
+  // prettier-ignore
+  const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);
+  // prettier-ignore
+  const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);
+  const b2 = (y * y * y) % P; // x^3, 11
+  const b3 = (b2 * b2 * y) % P; // x^7
+  const b6 = (pow2(b3, _3n, P) * b3) % P;
+  const b9 = (pow2(b6, _3n, P) * b3) % P;
+  const b11 = (pow2(b9, _2n, P) * b2) % P;
+  const b22 = (pow2(b11, _11n, P) * b11) % P;
+  const b44 = (pow2(b22, _22n, P) * b22) % P;
+  const b88 = (pow2(b44, _44n, P) * b44) % P;
+  const b176 = (pow2(b88, _88n, P) * b88) % P;
+  const b220 = (pow2(b176, _44n, P) * b44) % P;
+  const b223 = (pow2(b220, _3n, P) * b3) % P;
+  const t1 = (pow2(b223, _23n, P) * b22) % P;
+  const t2 = (pow2(t1, _6n, P) * b2) % P;
+  const root = pow2(t2, _2n, P);
+  if (!Fpk1.eql(Fpk1.sqr(root), y)) throw new Error('Cannot find square root');
+  return root;
+}
+
+const Fpk1 = Field(secp256k1_CURVE.p, { sqrt: sqrtMod });
+const Pointk1 = /* @__PURE__ */ weierstrass(secp256k1_CURVE, {
+  Fp: Fpk1,
+  endo: secp256k1_ENDO,
+});
+
+/**
+ * secp256k1 curve: ECDSA and ECDH methods.
+ *
+ * Uses sha256 to hash messages. To use a different hash,
+ * pass `{ prehash: false }` to sign / verify.
+ *
+ * @example
+ * ```js
+ * import { secp256k1 } from '@noble/curves/secp256k1.js';
+ * const { secretKey, publicKey } = secp256k1.keygen();
+ * // const publicKey = secp256k1.getPublicKey(secretKey);
+ * const msg = new TextEncoder().encode('hello noble');
+ * const sig = secp256k1.sign(msg, secretKey);
+ * const isValid = secp256k1.verify(sig, msg, publicKey);
+ * // const sigKeccak = secp256k1.sign(keccak256(msg), secretKey, { prehash: false });
+ * ```
+ */
+export const secp256k1: ECDSA = /* @__PURE__ */ ecdsa(Pointk1, sha256);
+
+// Schnorr signatures are superior to ECDSA from above. Below is Schnorr-specific BIP0340 code.
+// https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki
+/** An object mapping tags to their tagged hash prefix of [SHA256(tag) | SHA256(tag)] */
+const TAGGED_HASH_PREFIXES: { [tag: string]: Uint8Array } = {};
+function taggedHash(tag: string, ...messages: Uint8Array[]): Uint8Array {
+  let tagP = TAGGED_HASH_PREFIXES[tag];
+  if (tagP === undefined) {
+    const tagH = sha256(asciiToBytes(tag));
+    tagP = concatBytes(tagH, tagH);
+    TAGGED_HASH_PREFIXES[tag] = tagP;
+  }
+  return sha256(concatBytes(tagP, ...messages));
+}
+
+// ECDSA compact points are 33-byte. Schnorr is 32: we strip first byte 0x02 or 0x03
+const pointToBytes = (point: PointType<bigint>) => point.toBytes(true).slice(1);
+const hasEven = (y: bigint) => y % _2n === _0n;
+
+// Calculate point, scalar and bytes
+function schnorrGetExtPubKey(priv: Uint8Array) {
+  const { Fn, BASE } = Pointk1;
+  const d_ = Fn.fromBytes(priv);
+  const p = BASE.multiply(d_); // P = d'⋅G; 0 < d' < n check is done inside
+  const scalar = hasEven(p.y) ? d_ : Fn.neg(d_);
+  return { scalar, bytes: pointToBytes(p) };
+}
+/**
+ * lift_x from BIP340. Convert 32-byte x coordinate to elliptic curve point.
+ * @returns valid point checked for being on-curve
+ */
+function lift_x(x: bigint): PointType<bigint> {
+  const Fp = Fpk1;
+  if (!Fp.isValidNot0(x)) throw new Error('invalid x: Fail if x ≥ p');
+  const xx = Fp.create(x * x);
+  const c = Fp.create(xx * x + BigInt(7)); // Let c = x³ + 7 mod p.
+  let y = Fp.sqrt(c); // Let y = c^(p+1)/4 mod p. Same as sqrt().
+  // Return the unique point P such that x(P) = x and
+  // y(P) = y if y mod 2 = 0 or y(P) = p-y otherwise.
+  if (!hasEven(y)) y = Fp.neg(y);
+  const p = Pointk1.fromAffine({ x, y });
+  p.assertValidity();
+  return p;
+}
+const num = bytesToNumberBE;
+/**
+ * Create tagged hash, convert it to bigint, reduce modulo-n.
+ */
+function challenge(...args: Uint8Array[]): bigint {
+  return Pointk1.Fn.create(num(taggedHash('BIP0340/challenge', ...args)));
+}
+
+/**
+ * Schnorr public key is just `x` coordinate of Point as per BIP340.
+ */
+function schnorrGetPublicKey(secretKey: Uint8Array): Uint8Array {
+  return schnorrGetExtPubKey(secretKey).bytes; // d'=int(sk). Fail if d'=0 or d'≥n. Ret bytes(d'⋅G)
+}
+
+/**
+ * Creates Schnorr signature as per BIP340. Verifies itself before returning anything.
+ * auxRand is optional and is not the sole source of k generation: bad CSPRNG won't be dangerous.
+ */
+function schnorrSign(
+  message: Uint8Array,
+  secretKey: Uint8Array,
+  auxRand: Uint8Array = randomBytes(32)
+): Uint8Array {
+  const { Fn } = Pointk1;
+  const m = abytes(message, undefined, 'message');
+  const { bytes: px, scalar: d } = schnorrGetExtPubKey(secretKey); // checks for isWithinCurveOrder
+  const a = abytes(auxRand, 32, 'auxRand'); // Auxiliary random data a: a 32-byte array
+  const t = Fn.toBytes(d ^ num(taggedHash('BIP0340/aux', a))); // Let t be the byte-wise xor of bytes(d) and hash/aux(a)
+  const rand = taggedHash('BIP0340/nonce', t, px, m); // Let rand = hash/nonce(t || bytes(P) || m)
+  // Let k' = int(rand) mod n. Fail if k' = 0. Let R = k'⋅G
+  const { bytes: rx, scalar: k } = schnorrGetExtPubKey(rand);
+  const e = challenge(rx, px, m); // Let e = int(hash/challenge(bytes(R) || bytes(P) || m)) mod n.
+  const sig = new Uint8Array(64); // Let sig = bytes(R) || bytes((k + ed) mod n).
+  sig.set(rx, 0);
+  sig.set(Fn.toBytes(Fn.create(k + e * d)), 32);
+  // If Verify(bytes(P), m, sig) (see below) returns failure, abort
+  if (!schnorrVerify(sig, m, px)) throw new Error('sign: Invalid signature produced');
+  return sig;
+}
+
+/**
+ * Verifies Schnorr signature.
+ * Will swallow errors & return false except for initial type validation of arguments.
+ */
+function schnorrVerify(signature: Uint8Array, message: Uint8Array, publicKey: Uint8Array): boolean {
+  const { Fp, Fn, BASE } = Pointk1;
+  const sig = abytes(signature, 64, 'signature');
+  const m = abytes(message, undefined, 'message');
+  const pub = abytes(publicKey, 32, 'publicKey');
+  try {
+    const P = lift_x(num(pub)); // P = lift_x(int(pk)); fail if that fails
+    const r = num(sig.subarray(0, 32)); // Let r = int(sig[0:32]); fail if r ≥ p.
+    if (!Fp.isValidNot0(r)) return false;
+    const s = num(sig.subarray(32, 64)); // Let s = int(sig[32:64]); fail if s ≥ n.
+    if (!Fn.isValidNot0(s)) return false;
+
+    const e = challenge(Fn.toBytes(r), pointToBytes(P), m); // int(challenge(bytes(r)||bytes(P)||m))%n
+    // R = s⋅G - e⋅P, where -eP == (n-e)P
+    const R = BASE.multiplyUnsafe(s).add(P.multiplyUnsafe(Fn.neg(e)));
+    const { x, y } = R.toAffine();
+    // Fail if is_infinite(R) / not has_even_y(R) / x(R) ≠ r.
+    if (R.is0() || !hasEven(y) || x !== r) return false;
+    return true;
+  } catch (error) {
+    return false;
+  }
+}
+
+export type SecpSchnorr = {
+  keygen: (seed?: Uint8Array) => { secretKey: Uint8Array; publicKey: Uint8Array };
+  getPublicKey: typeof schnorrGetPublicKey;
+  sign: typeof schnorrSign;
+  verify: typeof schnorrVerify;
+  Point: WeierstrassPointCons<bigint>;
+  utils: {
+    randomSecretKey: (seed?: Uint8Array) => Uint8Array;
+    pointToBytes: (point: PointType<bigint>) => Uint8Array;
+    lift_x: typeof lift_x;
+    taggedHash: typeof taggedHash;
+  };
+  lengths: CurveLengths;
+};
+/**
+ * Schnorr signatures over secp256k1.
+ * https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki
+ * @example
+ * ```js
+ * import { schnorr } from '@noble/curves/secp256k1.js';
+ * const { secretKey, publicKey } = schnorr.keygen();
+ * // const publicKey = schnorr.getPublicKey(secretKey);
+ * const msg = new TextEncoder().encode('hello');
+ * const sig = schnorr.sign(msg, secretKey);
+ * const isValid = schnorr.verify(sig, msg, publicKey);
+ * ```
+ */
+export const schnorr: SecpSchnorr = /* @__PURE__ */ (() => {
+  const size = 32;
+  const seedLength = 48;
+  const randomSecretKey = (seed = randomBytes(seedLength)): Uint8Array => {
+    return mapHashToField(seed, secp256k1_CURVE.n);
+  };
+  return {
+    keygen: createKeygen(randomSecretKey, schnorrGetPublicKey),
+    getPublicKey: schnorrGetPublicKey,
+    sign: schnorrSign,
+    verify: schnorrVerify,
+    Point: Pointk1,
+    utils: {
+      randomSecretKey,
+      taggedHash,
+      lift_x,
+      pointToBytes,
+    },
+    lengths: {
+      secretKey: size,
+      publicKey: size,
+      publicKeyHasPrefix: false,
+      signature: size * 2,
+      seed: seedLength,
+    },
+  };
+})();
+
+const isoMap = /* @__PURE__ */ (() =>
+  isogenyMap(
+    Fpk1,
+    [
+      // xNum
+      [
+        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa8c7',
+        '0x7d3d4c80bc321d5b9f315cea7fd44c5d595d2fc0bf63b92dfff1044f17c6581',
+        '0x534c328d23f234e6e2a413deca25caece4506144037c40314ecbd0b53d9dd262',
+        '0x8e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38e38daaaaa88c',
+      ],
+      // xDen
+      [
+        '0xd35771193d94918a9ca34ccbb7b640dd86cd409542f8487d9fe6b745781eb49b',
+        '0xedadc6f64383dc1df7c4b2d51b54225406d36b641f5e41bbc52a56612a8c6d14',
+        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1
+      ],
+      // yNum
+      [
+        '0x4bda12f684bda12f684bda12f684bda12f684bda12f684bda12f684b8e38e23c',
+        '0xc75e0c32d5cb7c0fa9d0a54b12a0a6d5647ab046d686da6fdffc90fc201d71a3',
+        '0x29a6194691f91a73715209ef6512e576722830a201be2018a765e85a9ecee931',
+        '0x2f684bda12f684bda12f684bda12f684bda12f684bda12f684bda12f38e38d84',
+      ],
+      // yDen
+      [
+        '0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffff93b',
+        '0x7a06534bb8bdb49fd5e9e6632722c2989467c1bfc8e8d978dfb425d2685c2573',
+        '0x6484aa716545ca2cf3a70c3fa8fe337e0a3d21162f0d6299a7bf8192bfd2a76f',
+        '0x0000000000000000000000000000000000000000000000000000000000000001', // LAST 1
+      ],
+    ].map((i) => i.map((j) => BigInt(j))) as [bigint[], bigint[], bigint[], bigint[]]
+  ))();
+const mapSWU = /* @__PURE__ */ (() =>
+  mapToCurveSimpleSWU(Fpk1, {
+    A: BigInt('0x3f8731abdd661adca08a5558f0f5d272e953d363cb6f0e5d405447c01a444533'),
+    B: BigInt('1771'),
+    Z: Fpk1.create(BigInt('-11')),
+  }))();
+
+/** Hashing / encoding to secp256k1 points / field. RFC 9380 methods. */
+export const secp256k1_hasher: H2CHasher<WeierstrassPointCons<bigint>> = /* @__PURE__ */ (() =>
+  createHasher(
+    Pointk1,
+    (scalars: bigint[]) => {
+      const { x, y } = mapSWU(Fpk1.create(scalars[0]));
+      return isoMap(x, y);
+    },
+    {
+      DST: 'secp256k1_XMD:SHA-256_SSWU_RO_',
+      encodeDST: 'secp256k1_XMD:SHA-256_SSWU_NU_',
+      p: Fpk1.ORDER,
+      m: 1,
+      k: 128,
+      expand: 'xmd',
+      hash: sha256,
+    }
+  ))();