@scure/btc-signer 1.8.1 → 2.0.0

package/src/musig2.ts

@@ -1,15 +1,8 @@
-import { mod } from '@noble/curves/abstract/modular.js';
-import {
-  aInRange,
-  bytesToNumberBE,
-  concatBytes,
-  equalBytes,
-  numberToBytesBE,
-} from '@noble/curves/abstract/utils.js';
 import { schnorr, secp256k1 } from '@noble/curves/secp256k1.js';
+import { aInRange, concatBytes, equalBytes, numberToBytesBE } from '@noble/curves/utils.js';
 import { abytes, anumber, randomBytes } from '@noble/hashes/utils.js';
 import * as P from 'micro-packed';
-import { compareBytes } from './utils.ts';
+import { compareBytes, hasEven } from './utils.ts';
 
 /*
 MuSig2. This is not the full protocol: only an implementation of primitives from BIP-327.
@@ -45,20 +38,20 @@ export class InvalidContributionErr extends Error {
 
 // Utils
 const { taggedHash, pointToBytes } = schnorr.utils;
-const Point = secp256k1.ProjectivePoint;
+const Point = secp256k1.Point;
 type Point = typeof Point.BASE;
-const PUBKEY_LEN = 33;
+const Fn = Point.Fn;
+const PUBKEY_LEN = secp256k1.lengths.publicKey!;
 const ZERO = new Uint8Array(PUBKEY_LEN); // Compressed zero point
-const SECP_N = secp256k1.CURVE.n;
 
 // Encoding
 // TODO: re-use in PSBT?
 const compressed = P.apply(P.bytes(33), {
-  decode: (p: Point) => (isZero(p) ? ZERO : p.toRawBytes(true)),
-  encode: (b: Uint8Array) => (equalBytes(b, ZERO) ? Point.ZERO : Point.fromHex(b)),
+  decode: (p: Point) => (isZero(p) ? ZERO : p.toBytes(true)),
+  encode: (b: Uint8Array) => (equalBytes(b, ZERO) ? Point.ZERO : Point.fromBytes(b)),
 });
 const scalar = P.validate(P.U256BE, (n) => {
-  aInRange('n', n, 1n, SECP_N);
+  aInRange('n', n, 1n, Fn.ORDER);
   return n;
 });
 const PubNonce = P.struct({ R1: compressed, R2: compressed });
@@ -81,10 +74,9 @@ function aXonly(lst: boolean[]) {
   });
 }
 
-const modN = (x: bigint) => mod(x, SECP_N);
 const taggedInt = (tag: string, ...messages: Uint8Array[]) =>
-  modN(bytesToNumberBE(taggedHash(tag, ...messages)));
-const evenScalar = (p: Point, n: bigint) => (p.hasEvenY() ? n : modN(-n));
+  Fn.create(Fn.fromBytes(taggedHash(tag, ...messages), true));
+const evenScalar = (p: Point, n: bigint) => (hasEven(p.y) ? n : Fn.neg(n));
 
 // Short utility for compat with reference implementation
 export function IndividualPubkey(seckey: Uint8Array): Uint8Array {
@@ -158,23 +150,22 @@ export function keyAggregate(
   for (let i = 0; i < publicKeys.length; i++) {
     let Pi;
     try {
-      Pi = Point.fromHex(publicKeys[i]);
+      Pi = Point.fromBytes(publicKeys[i]);
     } catch (error) {
       throw new InvalidContributionErr(i, 'pubkey');
     }
     aggPublicKey = aggPublicKey.add(Pi.multiply(keyAggCoeffInternal(publicKeys[i], pk2, L)));
   }
-  let gAcc = 1n;
-  let tweakAcc = 0n;
+  let gAcc = Fn.ONE;
+  let tweakAcc = Fn.ZERO;
   // Apply tweaks
   for (let i = 0; i < tweaks.length; i++) {
-    const g = isXonly[i] && !aggPublicKey.hasEvenY() ? modN(-1n) : 1n;
-    const t = bytesToNumberBE(tweaks[i]);
-    aInRange('tweak', t, 0n, SECP_N);
+    const g = isXonly[i] && !hasEven(aggPublicKey.y) ? Fn.neg(Fn.ONE) : Fn.ONE;
+    const t = Fn.fromBytes(tweaks[i]);
     aggPublicKey = aggPublicKey.multiply(g).add(mulBase(t));
     if (isZero(aggPublicKey)) throw new Error('The result of tweaking cannot be infinity');
-    gAcc = modN(g * gAcc);
-    tweakAcc = modN(t + g * tweakAcc);
+    gAcc = Fn.mul(g, gAcc);
+    tweakAcc = Fn.add(t, Fn.mul(g, tweakAcc));
   }
   return { aggPublicKey, gAcc, tweakAcc };
 }
@@ -183,7 +174,7 @@ export function keyAggregate(
  * @param ctx The result of the keyAggregate function.
  * @returns The aggregate public key as a byte array.
  */
-export function keyAggExport(ctx: ReturnType<typeof keyAggregate>) {
+export function keyAggExport(ctx: ReturnType<typeof keyAggregate>): Uint8Array {
   return pointToBytes(ctx.aggPublicKey);
 }
 
@@ -237,7 +228,8 @@ export function nonceGen(
 ): Nonces {
   abytes(publicKey, PUBKEY_LEN);
   abytesOptional(secretKey, 32);
-  abytes(aggPublicKey, 0, 32);
+  abytes(aggPublicKey);
+  if (![0, 32].includes(aggPublicKey.length)) throw new Error('wrong aggPublicKey');
   abytesOptional(msg);
   abytes(extraIn);
   abytes(rand, 32);
@@ -245,8 +237,8 @@ export function nonceGen(
   if (secretKey !== undefined) rand = aux(secretKey, rand);
   const msgPrefixed =
     msg !== undefined
-      ? concatBytes(new Uint8Array([1]), numberToBytesBE(msg.length, 8), msg)
-      : new Uint8Array([0]);
+      ? concatBytes(Uint8Array.of(1), numberToBytesBE(msg.length, 8), msg)
+      : Uint8Array.of(0);
   const k1 = nonceHash(rand, publicKey, aggPublicKey, 0, msgPrefixed, extraIn);
   const k2 = nonceHash(rand, publicKey, aggPublicKey, 1, msgPrefixed, extraIn);
   return {
@@ -342,7 +334,7 @@ export class Session {
    */
   private getSessionKeyAggCoeff(P: Point): bigint {
     const { publicKeys } = this;
-    const pk = P.toRawBytes(true);
+    const pk = P.toBytes(true);
     const found = publicKeys.some((p) => equalBytes(p, pk));
     if (!found) throw new Error("The signer's pubkey must be included in the list of pubkeys");
     return keyAggCoeffInternal(pk, this.secondKey, this.L);
@@ -353,16 +345,16 @@ export class Session {
     publicKey: Uint8Array
   ): boolean {
     const { Q, gAcc, b, R, e } = this;
-    const s = bytesToNumberBE(partialSig);
-    if (s >= SECP_N) return false;
+    const s = Fn.fromBytes(partialSig, true);
+    if (!Fn.isValid(s)) return false;
     const { R1, R2 } = PubNonce.decode(publicNonce);
     const Re_s_ = R1.add(R2.multiply(b));
-    const Re_s = R.hasEvenY() ? Re_s_ : Re_s_.negate();
-    const P = Point.fromHex(publicKey);
+    const Re_s = hasEven(R.y) ? Re_s_ : Re_s_.negate();
+    const P = Point.fromBytes(publicKey);
     const a = this.getSessionKeyAggCoeff(P);
-    const g = modN(evenScalar(Q, 1n) * gAcc);
+    const g = Fn.mul(evenScalar(Q, 1n), gAcc);
     const left = mulBase(s);
-    const right = Re_s.add(P.multiply(modN(e * a * g)));
+    const right = Re_s.add(P.multiply(Fn.mul(e, Fn.mul(a, g))));
     return left.equals(right);
   }
 
@@ -383,20 +375,21 @@ export class Session {
     // zero-out the first 64 bytes of secretNonce so it cannot be reused
     // TODO: this was in reference implementation, but feels very broken. Modifying input arguments is pretty bad.
     secretNonce.fill(0, 0, 64);
-    aInRange('k1', k1_, 0n, SECP_N);
-    aInRange('k2', k2_, 0n, SECP_N);
+    if (!Fn.isValid(k1_)) throw new Error('wrong k1');
+    if (!Fn.isValid(k2_)) throw new Error('wrong k1');
     const k1 = evenScalar(R, k1_);
     const k2 = evenScalar(R, k2_);
-    const d_ = bytesToNumberBE(secret);
-    aInRange('d_', d_, 1n, SECP_N);
+    const d_ = Fn.fromBytes(secret);
+    if (Fn.is0(d_)) throw new Error('wrong d_');
     const P = mulBase(d_);
-    const pk = P.toRawBytes(true);
+    const pk = P.toBytes(true);
     if (!equalBytes(pk, originalPk)) throw new Error('Public key does not match nonceGen argument');
     const a = this.getSessionKeyAggCoeff(P);
     const g = evenScalar(Q, 1n);
-    const d = modN(g * gAcc * d_);
-    const s = modN(k1 + b * k2 + e * a * d);
-    const partialSig = numberToBytesBE(s, 32);
+    const d = Fn.mul(g, Fn.mul(gAcc, d_));
+    /// k1 + (b*k2) + (e*a*d)
+    const s = Fn.add(k1, Fn.add(Fn.mul(b, k2), Fn.mul(e, Fn.mul(a, d))));
+    const partialSig = Fn.toBytes(s);
     // Skip validation in fast-sign mode
     if (!fastSign) {
       const publicNonce = PubNonce.encode({
@@ -447,13 +440,13 @@ export class Session {
     const { Q, tweakAcc, R, e } = this;
     let s = 0n;
     for (let i = 0; i < partialSigs.length; i++) {
-      const si = bytesToNumberBE(partialSigs[i]);
-      if (si >= SECP_N) throw new InvalidContributionErr(i, 'psig');
-      s = modN(s + si);
+      const si = Fn.fromBytes(partialSigs[i], true);
+      if (!Fn.isValid(si)) throw new InvalidContributionErr(i, 'psig');
+      s = Fn.add(s, si);
     }
     const g = evenScalar(Q, 1n);
-    s = modN(s + e * g * tweakAcc);
-    return concatBytes(pointToBytes(R), numberToBytesBE(s, 32));
+    s = Fn.add(s, Fn.mul(e, Fn.mul(g, tweakAcc))); // s + e * g * tweakAcc
+    return concatBytes(pointToBytes(R), Fn.toBytes(s));
   }
 }
 

package/src/p2p.ts

@@ -19,21 +19,14 @@
  */
 
 import { FpIsSquare } from '@noble/curves/abstract/modular.js';
-import type { Hex } from '@noble/curves/abstract/utils.js';
-import {
-  bytesToNumberBE,
-  concatBytes,
-  ensureBytes,
-  numberToBytesBE,
-} from '@noble/curves/abstract/utils.js';
-import { type ProjPointType as PointType } from '@noble/curves/abstract/weierstrass.js';
+import { concatBytes, abytes } from '@noble/curves/utils.js';
 import { schnorr, secp256k1 } from '@noble/curves/secp256k1.js';
 import { randomBytes } from '@noble/hashes/utils.js';
-import { tagSchnorr } from './utils.ts';
-
-const Fp = secp256k1.CURVE.Fp;
-const Point = secp256k1.ProjectivePoint;
+import { tagSchnorr, type Bytes } from './utils.ts';
 
+const Point = secp256k1.Point;
+const Fp = Point.Fp;
+const Fn = Point.Fn;
 const _1n = BigInt(1);
 const _2n = BigInt(2);
 
@@ -86,29 +79,23 @@ export const elligatorSwift = {
     return Fp.mul(w0, Fp.add(Fp.div(Fp.mul(u, t0), _2n), v));
   },
   // Encode public key (point or x coordinate bigint) into 64-byte pseudorandom encoding
-  encode: (x: bigint | PointType<bigint>): Uint8Array => {
-    if (x instanceof secp256k1.ProjectivePoint) x = x.x;
-    if (typeof x !== 'bigint') {
-      throw new Error(
-        'elligatorSwift.encode: wrong public key. Should be Projective point or x coordinate (bigint)'
-      );
-    }
+  encode: (x: bigint): Uint8Array => {
     // 200k test cycles per keygen: avg=4 max=48
     // seems too much, but same as for reference implementation
     while (true) {
       // random scalar 1..Fp.ORDER
-      const u = Fp.create(Fp.fromBytes(secp256k1.utils.randomPrivateKey()));
+      const u = Fp.create(Fp.fromBytes(secp256k1.utils.randomSecretKey()));
       const ellCase = randomBytes(1)[0] & 7; // [0..8)
       const t = elligatorSwift._inv(x, u, ellCase);
       if (!t) continue;
-      return concatBytes(numberToBytesBE(u, 32), numberToBytesBE(t, 32));
+      return concatBytes(Fp.toBytes(u), Fp.toBytes(t));
     }
   },
   // Decode elligatorSwift point to xonly
-  decode: (data: Hex): Uint8Array => {
-    const _data = ensureBytes('data', data, 64);
-    let u = Fp.create(Fp.fromBytes(_data.subarray(0, 32)));
-    let t = Fp.create(Fp.fromBytes(_data.subarray(32, 64)));
+  decode: (data: Uint8Array): Uint8Array => {
+    const _data = abytes(data, 64, 'data');
+    let u = Fp.create(Fp.fromBytes(_data.subarray(0, 32), true));
+    let t = Fp.create(Fp.fromBytes(_data.subarray(32, 64), true));
     if (Fp.is0(u)) u = Fp.create(_1n);
     if (Fp.is0(t)) t = Fp.create(_1n);
     const u3 = Fp.mul(Fp.mul(u, u), u); // u**3
@@ -121,36 +108,37 @@ export const elligatorSwift = {
     const y = Fp.div(Fp.add(x, t), Fp.mul(MINUS_3_SQRT, u));
     // try different cases
     let res = Fp.add(u, Fp.mul(Fp.mul(y, y), _4n)); // u + 4 * Y ** 2,
-    if (isValidX(res)) return numberToBytesBE(res, 32);
+    if (isValidX(res)) return Fp.toBytes(res);
     res = Fp.div(Fp.sub(Fp.div(Fp.neg(x), y), u), _2n); // (-X / Y - u) / 2
-    if (isValidX(res)) return numberToBytesBE(res, 32);
+    if (isValidX(res)) return Fp.toBytes(res);
     res = Fp.div(Fp.sub(Fp.div(x, y), u), _2n); // (X / Y - u) / 2
-    if (isValidX(res)) return numberToBytesBE(res, 32);
+    if (isValidX(res)) return Fp.toBytes(res);
     throw new Error('elligatorSwift: cannot decode public key');
   },
   // Generate pair (public key, secret key)
   keygen: () => {
-    const privateKey = secp256k1.utils.randomPrivateKey();
-    const publicKey = elligatorSwift.encode(Point.fromPrivateKey(privateKey));
+    const privateKey: Bytes = secp256k1.utils.randomSecretKey();
+    const p = Point.BASE.multiply(Point.Fn.fromBytes(privateKey));
+    const publicKey: Bytes = elligatorSwift.encode(p.x);
     return { privateKey, publicKey };
   },
   // Generates shared secret between a pub key and a priv key
-  getSharedSecret: (privateKeyA: Hex, publicKeyB: Hex) => {
+  getSharedSecret: (privateKeyA: Uint8Array, publicKeyB: Uint8Array): Bytes => {
     const pub = elligatorSwift.decode(publicKeyB);
-    const priv = ensureBytes('privKey', privateKeyA, 32);
+    const priv = abytes(privateKeyA, 32, 'privKey');
     const point = schnorr.utils.lift_x(Fp.fromBytes(pub));
-    const d = bytesToNumberBE(priv);
-    return numberToBytesBE(point.multiply(d).x, 32);
+    const d = Fn.fromBytes(priv);
+    return Fp.toBytes(point.multiply(d).x);
   },
   // BIP324 shared secret
   getSharedSecretBip324: (
-    privateKeyOurs: Hex,
-    publicKeyTheirs: Hex,
-    publicKeyOurs: Hex,
+    privateKeyOurs: Uint8Array,
+    publicKeyTheirs: Uint8Array,
+    publicKeyOurs: Uint8Array,
     initiating: boolean
-  ) => {
-    const ours = ensureBytes('publicKeyOurs', publicKeyOurs);
-    const theirs = ensureBytes('publicKeyTheirs', publicKeyTheirs);
+  ): Uint8Array => {
+    const ours = abytes(publicKeyOurs, undefined, 'publicKeyOurs');
+    const theirs = abytes(publicKeyTheirs, undefined, 'publicKeyTheirs');
     const ecdhPoint = elligatorSwift.getSharedSecret(privateKeyOurs, theirs);
     const pubs = initiating ? [ours, theirs] : [theirs, ours];
     return tagSchnorr('bip324_ellswift_xonly_ecdh', ...pubs, ecdhPoint);

package/src/psbt.ts

@@ -14,13 +14,13 @@ import { type Bytes, compareBytes, equalBytes, PubT, validatePubkey } from './ut
 // PSBT BIP174, BIP370, BIP371
 
 // Can be 33 or 64 bytes
-const PubKeyECDSA: P.CoderType<Uint8Array> = P.validate(P.bytes(null), (pub) =>
+const PubKeyECDSA: P.CoderType<Bytes> = P.validate(P.bytes(null), (pub) =>
   validatePubkey(pub, PubT.ecdsa)
 );
-const PubKeySchnorr: P.CoderType<Uint8Array> = P.validate(P.bytes(32), (pub) =>
+const PubKeySchnorr: P.CoderType<Bytes> = P.validate(P.bytes(32), (pub) =>
   validatePubkey(pub, PubT.schnorr)
 );
-const SignatureSchnorr: P.CoderType<Uint8Array> = P.validate(P.bytes(null), (sig) => {
+const SignatureSchnorr: P.CoderType<Bytes> = P.validate(P.bytes(null), (sig) => {
   if (sig.length !== 64 && sig.length !== 65)
     throw new Error('Schnorr signature should be 64 or 65 bytes long');
   return sig;
@@ -61,9 +61,9 @@ const tapTree = P.array(
   })
 );
 
-const BytesInf: P.CoderType<P.Bytes> = P.bytes(null); // Bytes will conflict with Bytes type
-const Bytes20: P.CoderType<P.Bytes> = P.bytes(20);
-const Bytes32: P.CoderType<P.Bytes> = P.bytes(32);
+const BytesInf: P.CoderType<Bytes> = P.bytes(null); // Bytes will conflict with Bytes type
+const Bytes20: P.CoderType<Bytes> = P.bytes(20);
+const Bytes32: P.CoderType<Bytes> = P.bytes(32);
 // versionsRequiringExclusing = !versionsAllowsInclusion (as set)
 // {name: [tag, keyCoder, valueCoder, versionsRequiringInclusion, versionsRequiringExclusing, versionsAllowsInclusion, silentIgnore]}
 // SilentIgnore: we use some v2 fields for v1 representation too, so we just clean them before serialize
@@ -180,7 +180,7 @@ type PSBTKeyMap = Record<string, PSBTKeyMapInfo>;
 const PSBTUnknownKey: P.CoderType<
   P.StructInput<{
     type: number;
-    key: Uint8Array;
+    key: Bytes;
   }>
 > = P.struct({ type: CompactSizeLen, key: P.bytes(null) });
 type PSBTUnknownFields = { unknown?: [P.UnwrapCoder<typeof PSBTUnknownKey>, Bytes][] };

package/src/script.ts

@@ -1,39 +1,42 @@
 import * as P from 'micro-packed';
-import { isBytes } from './utils.ts';
+import { isBytes, reverseObject, type ValueOf, type Bytes } from './utils.ts';
 
 export const MAX_SCRIPT_BYTE_LENGTH = 520;
 
 // prettier-ignore
-export enum OP {
-  OP_0 = 0x00, PUSHDATA1 = 0x4c, PUSHDATA2, PUSHDATA4, '1NEGATE',
-  RESERVED = 0x50,
-  OP_1, OP_2, OP_3, OP_4, OP_5, OP_6, OP_7, OP_8,
-  OP_9, OP_10, OP_11, OP_12, OP_13, OP_14, OP_15, OP_16,
+export const OP = {
+  OP_0: 0, PUSHDATA1: 76, PUSHDATA2: 77, PUSHDATA4: 78, '1NEGATE': 79,
+  RESERVED: 80,
+  OP_1: 81, OP_2: 82, OP_3: 83, OP_4: 84, OP_5: 85, OP_6: 86, OP_7: 87, OP_8: 88, OP_9: 89,
+  OP_10: 90, OP_11: 91, OP_12: 92, OP_13: 93, OP_14: 94, OP_15: 95, OP_16: 96,
   // Control
-  NOP, VER, IF, NOTIF, VERIF, VERNOTIF, ELSE, ENDIF, VERIFY, RETURN,
+  NOP: 97, VER: 98, IF: 99, NOTIF: 100, VERIF: 101, VERNOTIF: 102, ELSE: 103, ENDIF: 104, VERIFY: 105, RETURN: 106,
   // Stack
-  TOALTSTACK, FROMALTSTACK, '2DROP', '2DUP', '3DUP', '2OVER', '2ROT', '2SWAP',
-  IFDUP, DEPTH, DROP, DUP, NIP, OVER, PICK, ROLL, ROT, SWAP, TUCK,
+  TOALTSTACK: 107, FROMALTSTACK: 108, '2DROP': 109, '2DUP': 110, '3DUP': 111, '2OVER': 112, '2ROT': 113, '2SWAP': 114,
+  IFDUP: 115, DEPTH: 116, DROP: 117, DUP: 118, NIP: 119, OVER: 120, PICK: 121, ROLL: 122, ROT: 123, SWAP: 124, TUCK: 125,
   // Splice
-  CAT, SUBSTR, LEFT, RIGHT, SIZE,
+  CAT: 126, SUBSTR: 127, LEFT: 128, RIGHT: 129, SIZE: 130,
   // Boolean logic
-  INVERT, AND, OR, XOR, EQUAL, EQUALVERIFY, RESERVED1, RESERVED2,
-  // Numbers
-  '1ADD', '1SUB', '2MUL', '2DIV',
-  NEGATE, ABS, NOT, '0NOTEQUAL',
-  ADD, SUB, MUL, DIV, MOD, LSHIFT, RSHIFT, BOOLAND, BOOLOR,
-  NUMEQUAL, NUMEQUALVERIFY, NUMNOTEQUAL, LESSTHAN, GREATERTHAN,
-  LESSTHANOREQUAL, GREATERTHANOREQUAL, MIN, MAX, WITHIN,
+  INVERT: 131, AND: 132, OR: 133, XOR: 134, EQUAL: 135, EQUALVERIFY: 136, RESERVED1: 137, RESERVED2: 138,
+    // Numbers
+  '1ADD': 139, '1SUB': 140, '2MUL': 141, '2DIV': 142,
+  NEGATE: 143, ABS: 144, NOT: 145, '0NOTEQUAL': 146,
+  ADD: 147, SUB: 148, MUL: 149, DIV: 150, MOD: 151, LSHIFT: 152, RSHIFT: 153, BOOLAND: 154, BOOLOR: 155,
+  NUMEQUAL: 156, NUMEQUALVERIFY: 157, NUMNOTEQUAL: 158, LESSTHAN: 159, GREATERTHAN: 160,
+  LESSTHANOREQUAL: 161, GREATERTHANOREQUAL: 162, MIN: 163, MAX: 164, WITHIN: 165,
   // Crypto
-  RIPEMD160, SHA1, SHA256, HASH160, HASH256, CODESEPARATOR,
-  CHECKSIG, CHECKSIGVERIFY, CHECKMULTISIG, CHECKMULTISIGVERIFY,
+  RIPEMD160: 166, SHA1: 167, SHA256: 168, HASH160: 169, HASH256: 170, CODESEPARATOR: 171,
+  CHECKSIG: 172, CHECKSIGVERIFY: 173, CHECKMULTISIG: 174, CHECKMULTISIGVERIFY: 175,
   // Expansion
-  NOP1, CHECKLOCKTIMEVERIFY, CHECKSEQUENCEVERIFY, NOP4, NOP5, NOP6, NOP7, NOP8, NOP9, NOP10,
+  NOP1: 176, CHECKLOCKTIMEVERIFY: 177, CHECKSEQUENCEVERIFY: 178, NOP4: 179, NOP5: 180, NOP6: 181, NOP7: 182, NOP8: 183, NOP9: 184, NOP10: 185,
   // BIP 342
-  CHECKSIGADD,
+  CHECKSIGADD: 186,
   // Invalid
-  INVALID = 0xff,
-}
+  INVALID: 255,
+};
+
+export const OPNames = reverseObject(OP);
+export type OP = ValueOf<typeof OP>;
 
 export type ScriptOP = keyof typeof OP | Uint8Array | number;
 export type ScriptType = ScriptOP[];
@@ -157,7 +160,7 @@ export const Script: P.CoderType<ScriptType> = P.wrap({
       } else if (OP.OP_1 <= cur && cur <= OP.OP_16) {
         out.push(cur - (OP.OP_1 - 1));
       } else {
-        const op = OP[cur] as keyof typeof OP;
+        const op = OPNames[cur] as keyof typeof OP;
         if (op === undefined) throw new Error(`Unknown opcode=${cur.toString(16)}`);
         out.push(op);
       }
@@ -200,10 +203,10 @@ export const CompactSize: P.CoderType<bigint> = P.wrap({
 export const CompactSizeLen: P.CoderType<number> = P.apply(CompactSize, P.coders.numberBigint);
 
 // ui8a of size <CompactSize>
-export const VarBytes: P.CoderType<Uint8Array> = P.bytes(CompactSize);
+export const VarBytes: P.CoderType<Bytes> = P.bytes(CompactSize);
 
 // SegWit v0 stack of witness buffers
-export const RawWitness: P.CoderType<Uint8Array[]> = P.array(CompactSizeLen, VarBytes);
+export const RawWitness: P.CoderType<Bytes[]> = P.array(CompactSizeLen, VarBytes);
 
 // Array of size <CompactSize>
 export const BTCArray = <T>(t: P.CoderType<T>): P.CoderType<T[]> => P.array(CompactSize, t);

package/src/transaction.ts

@@ -14,7 +14,7 @@ import {
 import * as u from './utils.ts';
 import { type Bytes, NETWORK, concatBytes, equalBytes, isBytes } from './utils.ts';
 
-const EMPTY32 = new Uint8Array(32);
+const EMPTY32: Uint8Array = new Uint8Array(32);
 const EMPTY_OUTPUT: P.UnwrapCoder<typeof RawOutput> = {
   amount: 0xffffffffffffffffn,
   script: P.EMPTY,
@@ -94,24 +94,26 @@ export interface TxOpts {
  * Internal, exported only for backwards-compat. Use `SigHash` instead.
  * @deprecated
  */
-export enum SignatureHash {
-  DEFAULT,
-  ALL,
-  NONE,
-  SINGLE,
-  ANYONECANPAY = 0x80,
-}
+export const SignatureHash = {
+  DEFAULT: 0,
+  ALL: 1,
+  NONE: 2,
+  SINGLE: 3,
+  ANYONECANPAY: 0x80,
+};
 
-export enum SigHash {
-  DEFAULT = SignatureHash.DEFAULT,
-  ALL = SignatureHash.ALL,
-  NONE = SignatureHash.NONE,
-  SINGLE = SignatureHash.SINGLE,
-  DEFAULT_ANYONECANPAY = SignatureHash.DEFAULT | SignatureHash.ANYONECANPAY,
-  ALL_ANYONECANPAY = SignatureHash.ALL | SignatureHash.ANYONECANPAY,
-  NONE_ANYONECANPAY = SignatureHash.NONE | SignatureHash.ANYONECANPAY,
-  SINGLE_ANYONECANPAY = SignatureHash.SINGLE | SignatureHash.ANYONECANPAY,
-}
+export const SigHash = {
+  DEFAULT: SignatureHash.DEFAULT,
+  ALL: SignatureHash.ALL,
+  NONE: SignatureHash.NONE,
+  SINGLE: SignatureHash.SINGLE,
+  DEFAULT_ANYONECANPAY: SignatureHash.DEFAULT | SignatureHash.ANYONECANPAY,
+  ALL_ANYONECANPAY: SignatureHash.ALL | SignatureHash.ANYONECANPAY,
+  NONE_ANYONECANPAY: SignatureHash.NONE | SignatureHash.ANYONECANPAY,
+  SINGLE_ANYONECANPAY: SignatureHash.SINGLE | SignatureHash.ANYONECANPAY,
+} as const;
+export const SigHashNames = u.reverseObject(SigHash);
+export type SigHash = u.ValueOf<typeof SigHash>;
 
 function getTaprootKeys(
   privKey: Bytes,
@@ -163,7 +165,7 @@ function cleanFinalInput(i: psbt.TransactionInput) {
 const TxHashIdx = P.struct({ txid: P.bytes(32, true), index: P.U32LE });
 
 function validateSigHash(s: SigHash) {
-  if (typeof s !== 'number' || typeof SigHash[s] !== 'string')
+  if (typeof s !== 'number' || typeof SigHashNames[s] !== 'string')
     throw new Error(`Invalid SigHash=${s}`);
   return s;
 }
@@ -635,11 +637,9 @@ export class Transaction {
   }
 
   get hash(): string {
-    if (!this.isFinal) throw new Error('Transaction is not finalized');
     return hex.encode(u.sha256x2(this.toBytes(true)));
   }
   get id(): string {
-    if (!this.isFinal) throw new Error('Transaction is not finalized');
     return hex.encode(u.sha256x2(this.toBytes(true)).reverse());
   }
   // Input stuff

package/src/utils.ts

@@ -1,12 +1,15 @@
 import { schnorr, secp256k1 as secp } from '@noble/curves/secp256k1.js';
+import { bytesToNumberBE, numberToBytesBE } from '@noble/curves/utils.js';
 import { ripemd160 } from '@noble/hashes/legacy.js';
 import { sha256 } from '@noble/hashes/sha2.js';
 import { utils as packedUtils, U32LE } from 'micro-packed';
 
 export type Hex = string | Uint8Array;
 export type Bytes = Uint8Array;
-const Point = secp.ProjectivePoint;
-const CURVE_ORDER = secp.CURVE.n;
+const Point = secp.Point;
+const Fn = Point.Fn;
+const CURVE_ORDER = Point.Fn.ORDER;
+export const hasEven = (y: bigint) => y % 2n === 0n;
 
 const isBytes: (a: unknown) => a is Uint8Array = packedUtils.isBytes;
 const concatBytes: (...arrays: Uint8Array[]) => Uint8Array = packedUtils.concatBytes;
@@ -15,9 +18,9 @@ export { concatBytes, equalBytes, isBytes, sha256 };
 
 export const hash160 = (msg: Uint8Array): Uint8Array => ripemd160(sha256(msg));
 export const sha256x2 = (...msgs: Uint8Array[]): Uint8Array => sha256(sha256(concatBytes(...msgs)));
-export const randomPrivateKeyBytes: () => Uint8Array = schnorr.utils.randomPrivateKey;
+export const randomPrivateKeyBytes: () => Uint8Array = schnorr.utils.randomSecretKey;
 export const pubSchnorr = schnorr.getPublicKey as (priv: string | Uint8Array) => Uint8Array;
-export const pubECDSA: (privateKey: string | Uint8Array, isCompressed?: boolean) => Uint8Array =
+export const pubECDSA: (privateKey: Uint8Array, isCompressed?: boolean) => Uint8Array =
   secp.getPublicKey;
 
 // low-r signature grinding. Used to reduce tx size by 1 byte.
@@ -26,35 +29,37 @@ export const pubECDSA: (privateKey: string | Uint8Array, isCompressed?: boolean)
 // Not best way, but closest to bitcoin implementation (easier to check)
 const hasLowR = (sig: { r: bigint; s: bigint }) => sig.r < CURVE_ORDER / 2n;
 export function signECDSA(hash: Bytes, privateKey: Bytes, lowR = false): Bytes {
-  let sig = secp.sign(hash, privateKey);
+  let sig = secp.Signature.fromBytes(secp.sign(hash, privateKey, { prehash: false }));
   if (lowR && !hasLowR(sig)) {
     const extraEntropy = new Uint8Array(32);
     let counter = 0;
     while (!hasLowR(sig)) {
       extraEntropy.set(U32LE.encode(counter++));
-      sig = secp.sign(hash, privateKey, { extraEntropy });
+      sig = secp.Signature.fromBytes(secp.sign(hash, privateKey, { prehash: false, extraEntropy }));
       if (counter > 4294967295) throw new Error('lowR counter overflow: report the error');
     }
   }
-  return sig.toDERRawBytes();
+  return sig.toBytes('der');
 }
 
 export const signSchnorr: typeof schnorr.sign = schnorr.sign;
 export const tagSchnorr: typeof schnorr.utils.taggedHash = schnorr.utils.taggedHash;
 
-export enum PubT {
-  ecdsa,
-  schnorr,
-}
+export const PubT = {
+  ecdsa: 0,
+  schnorr: 1,
+};
+export type PubT = ValueOf<typeof PubT>;
+
 export function validatePubkey(pub: Bytes, type: PubT): Bytes {
   const len = pub.length;
   if (type === PubT.ecdsa) {
     if (len === 32) throw new Error('Expected non-Schnorr key');
-    Point.fromHex(pub); // does assertValidity
+    Point.fromBytes(pub); // does assertValidity
     return pub;
   } else if (type === PubT.schnorr) {
     if (len !== 32) throw new Error('Expected 32-byte Schnorr key');
-    schnorr.utils.lift_x(schnorr.utils.bytesToNumberBE(pub));
+    schnorr.utils.lift_x(bytesToNumberBE(pub));
     return pub;
   } else {
     throw new Error('Unknown key type');
@@ -64,30 +69,30 @@ export function validatePubkey(pub: Bytes, type: PubT): Bytes {
 export function tapTweak(a: Bytes, b: Bytes): bigint {
   const u = schnorr.utils;
   const t = u.taggedHash('TapTweak', a, b);
-  const tn = u.bytesToNumberBE(t);
+  const tn = bytesToNumberBE(t);
   if (tn >= CURVE_ORDER) throw new Error('tweak higher than curve order');
   return tn;
 }
 
 export function taprootTweakPrivKey(privKey: Bytes, merkleRoot: Bytes = Uint8Array.of()): Bytes {
   const u = schnorr.utils;
-  const seckey0 = u.bytesToNumberBE(privKey); // seckey0 = int_from_bytes(seckey0)
-  const P = Point.fromPrivateKey(seckey0); // P = point_mul(G, seckey0)
+  const seckey0 = bytesToNumberBE(privKey); // seckey0 = int_from_bytes(seckey0)
+  const P = Point.BASE.multiply(seckey0); // P = point_mul(G, seckey0)
   // seckey = seckey0 if has_even_y(P) else SECP256K1_ORDER - seckey0
-  const seckey = P.hasEvenY() ? seckey0 : u.mod(-seckey0, CURVE_ORDER);
+  const seckey = hasEven(P.y) ? seckey0 : Fn.neg(seckey0);
   const xP = u.pointToBytes(P);
   // t = int_from_bytes(tagged_hash("TapTweak", bytes_from_int(x(P)) + h)); >= SECP256K1_ORDER check
   const t = tapTweak(xP, merkleRoot);
   // bytes_from_int((seckey + t) % SECP256K1_ORDER)
-  return u.numberToBytesBE(u.mod(seckey + t, CURVE_ORDER), 32);
+  return numberToBytesBE(Fn.add(seckey, t), 32);
 }
 
 export function taprootTweakPubkey(pubKey: Bytes, h: Bytes): [Bytes, number] {
   const u = schnorr.utils;
   const t = tapTweak(pubKey, h); // t = int_from_bytes(tagged_hash("TapTweak", pubkey + h))
-  const P = u.lift_x(u.bytesToNumberBE(pubKey)); // P = lift_x(int_from_bytes(pubkey))
-  const Q = P.add(Point.fromPrivateKey(t)); // Q = point_add(P, point_mul(G, t))
-  const parity = Q.hasEvenY() ? 0 : 1; // 0 if has_even_y(Q) else 1
+  const P = u.lift_x(bytesToNumberBE(pubKey)); // P = lift_x(int_from_bytes(pubkey))
+  const Q = P.add(Point.BASE.multiply(t)); // Q = point_add(P, point_mul(G, t))
+  const parity = hasEven(Q.y) ? 0 : 1; // 0 if has_even_y(Q) else 1
   return [u.pointToBytes(Q), parity]; // bytes_from_int(x(Q))
 }
 
@@ -97,7 +102,7 @@ export function taprootTweakPubkey(pubKey: Bytes, h: Bytes): [Bytes, number] {
 // It is possible to switch SECP256K1_GENERATOR_POINT with some random point;
 // but it's too complex to prove.
 // Also used by bitcoin-core and bitcoinjs-lib
-export const TAPROOT_UNSPENDABLE_KEY: Bytes = sha256(Point.BASE.toRawBytes(false));
+export const TAPROOT_UNSPENDABLE_KEY: Bytes = sha256(Point.BASE.toBytes(false));
 
 export type BTC_NETWORK = {
   bech32: string;
@@ -127,3 +132,17 @@ export function compareBytes(a: Bytes, b: Bytes): number {
   for (let i = 0; i < len; i++) if (a[i] != b[i]) return Math.sign(a[i] - b[i]);
   return Math.sign(a.length - b.length);
 }
+
+// Reverses key<->values
+export function reverseObject<T extends Record<string, string | number>>(
+  obj: T
+): { [K in T[keyof T]]: Extract<keyof T, string> } {
+  const res = {} as any;
+  for (const k in obj) {
+    if (res[obj[k]] !== undefined) throw new Error('duplicate key');
+    res[obj[k]] = k;
+  }
+  return res;
+}
+
+export type ValueOf<T> = T[keyof T];