@taquito/signer 25.0.0 → 25.1.0-beta0

package/dist/taquito-signer.es6.js

@@ -1,5 +1,5 @@
 import { openSecretBox } from '@stablelib/nacl';
-import { b58DecodeAndCheckPrefix, PrefixV2, b58Encode, compareArrays, InvalidPublicKeyError, BLS12_381_DST, POP_DST, hex2buf, mergebuf, buf2hex } from '@taquito/utils';
+import { b58DecodeAndCheckPrefix, PrefixV2, b58Encode, compareArrays, InvalidPublicKeyError, BLS12_381_DST, POP_DST, payloadLength, mergebuf, hex2buf, buf2hex } from '@taquito/utils';
 import { ed25519 as ed25519$1 } from '@noble/curves/ed25519';
 import { secp256k1 } from '@noble/curves/secp256k1';
 import { p256 } from '@noble/curves/nist.js';
@@ -53,7 +53,7 @@ typeof SuppressedError === "function" ? SuppressedError : function (error, suppr
  * isBytes(new Uint8Array([1, 2, 3]));
  * ```
  */
-function isBytes$1(a) {
+function isBytes$2(a) {
     // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases.
     // The fallback still requires a real ArrayBuffer view, so plain
     // JSON-deserialized `{ constructor: ... }` spoofing is rejected, and
@@ -76,7 +76,7 @@ function isBytes$1(a) {
  * anumber(32, 'length');
  * ```
  */
-function anumber$1(n, title = '') {
+function anumber$2(n, title = '') {
     if (typeof n !== 'number') {
         const prefix = title && `"${title}" `;
         throw new TypeError(`${prefix}expected number, got ${typeof n}`);
@@ -100,8 +100,8 @@ function anumber$1(n, title = '') {
  * abytes(new Uint8Array([1, 2, 3]));
  * ```
  */
-function abytes(value, length, title = '') {
-    const bytes = isBytes$1(value);
+function abytes$1(value, length, title = '') {
+    const bytes = isBytes$2(value);
     const len = value?.length;
     const needsLen = length !== undefined;
     if (!bytes || (needsLen && len !== length)) {
@@ -129,11 +129,11 @@ function abytes(value, length, title = '') {
  * ahash(sha256);
  * ```
  */
-function ahash(h) {
+function ahash$1(h) {
     if (typeof h !== 'function' || typeof h.create !== 'function')
         throw new TypeError('Hash must wrapped by utils.createHasher');
-    anumber$1(h.outputLen);
-    anumber$1(h.blockLen);
+    anumber$2(h.outputLen);
+    anumber$2(h.blockLen);
     // HMAC and KDF callers treat these as real byte lengths; allowing zero lets fake wrappers pass
     // validation and can produce empty outputs instead of failing fast.
     if (h.outputLen < 1)
@@ -155,7 +155,7 @@ function ahash(h) {
  * aexists(hash);
  * ```
  */
-function aexists(instance, checkFinished = true) {
+function aexists$1(instance, checkFinished = true) {
     if (instance.destroyed)
         throw new Error('Hash instance has been destroyed');
     if (checkFinished && instance.finished)
@@ -177,8 +177,8 @@ function aexists(instance, checkFinished = true) {
  * aoutput(new Uint8Array(hash.outputLen), hash);
  * ```
  */
-function aoutput(out, instance) {
-    abytes(out, undefined, 'digestInto() output');
+function aoutput$1(out, instance) {
+    abytes$1(out, undefined, 'digestInto() output');
     const min = instance.outputLen;
     if (out.length < min) {
         throw new RangeError('"digestInto() output" expected to be of length >=' + min);
@@ -196,7 +196,7 @@ function aoutput(out, instance) {
  * u32(new Uint8Array(8));
  * ```
  */
-function u32(arr) {
+function u32$1(arr) {
     return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
 }
 /**
@@ -208,7 +208,7 @@ function u32(arr) {
  * clean(new Uint8Array([1, 2, 3]));
  * ```
  */
-function clean(...arrays) {
+function clean$1(...arrays) {
     for (let i = 0; i < arrays.length; i++) {
         arrays[i].fill(0);
     }
@@ -241,7 +241,7 @@ function rotr(word, shift) {
     return (word << (32 - shift)) | (word >>> shift);
 }
 /** Whether the current platform is little-endian. */
-const isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();
+const isLE$1 = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();
 /**
  * Byte-swap operation for uint32 values.
  * @param word - source word
@@ -252,7 +252,7 @@ const isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([0x11223344])
  * byteSwap(0x11223344);
  * ```
  */
-function byteSwap(word) {
+function byteSwap$1(word) {
     return (((word << 24) & 0xff000000) |
         ((word << 8) & 0xff0000) |
         ((word >>> 8) & 0xff00) |
@@ -268,9 +268,9 @@ function byteSwap(word) {
  * swap8IfBE(0x11223344);
  * ```
  */
-const swap8IfBE = isLE
+const swap8IfBE = isLE$1
     ? (n) => n
-    : (n) => byteSwap(n) >>> 0;
+    : (n) => byteSwap$1(n) >>> 0;
 /**
  * Byte-swaps every word of a Uint32Array in place.
  * @param arr - array to mutate
@@ -281,9 +281,9 @@ const swap8IfBE = isLE
  * byteSwap32(new Uint32Array([0x11223344]));
  * ```
  */
-function byteSwap32(arr) {
+function byteSwap32$1(arr) {
     for (let i = 0; i < arr.length; i++) {
-        arr[i] = byteSwap(arr[i]);
+        arr[i] = byteSwap$1(arr[i]);
     }
     return arr;
 }
@@ -298,9 +298,9 @@ function byteSwap32(arr) {
  * swap32IfBE(new Uint32Array([0x11223344]));
  * ```
  */
-const swap32IfBE = isLE
+const swap32IfBE$1 = isLE$1
     ? (u) => u
-    : byteSwap32;
+    : byteSwap32$1;
 /**
  * Converts string to bytes using UTF8 encoding.
  * Built-in doesn't validate input to be string: we do the check.
@@ -335,7 +335,7 @@ function utf8ToBytes(str) {
 function kdfInputToBytes(data, errorTitle = '') {
     if (typeof data === 'string')
         return utf8ToBytes(data);
-    return abytes(data, undefined, errorTitle);
+    return abytes$1(data, undefined, errorTitle);
 }
 /**
  * Merges default options and passed options.
@@ -349,7 +349,7 @@ function kdfInputToBytes(data, errorTitle = '') {
  * checkOpts({ dkLen: 32 }, { asyncTick: 10 });
  * ```
  */
-function checkOpts(defaults, opts) {
+function checkOpts$1(defaults, opts) {
     if (opts !== undefined && {}.toString.call(opts) !== '[object Object]')
         throw new TypeError('options must be object or undefined');
     const merged = Object.assign(defaults, opts);
@@ -372,7 +372,7 @@ function checkOpts(defaults, opts) {
  * wrapped(new Uint8Array([1]));
  * ```
  */
-function createHasher(hashCons, info = {}) {
+function createHasher$1(hashCons, info = {}) {
     const hashC = (msg, opts) => hashCons(opts)
         .update(msg)
         .digest();
@@ -396,7 +396,7 @@ function createHasher(hashCons, info = {}) {
  * oidNist(0x01);
  * ```
  */
-const oidNist = (suffix) => ({
+const oidNist$1 = (suffix) => ({
     // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
     // Larger suffix values would need base-128 OID encoding and a different length byte.
     oid: Uint8Array.from([0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, suffix]),
@@ -511,8 +511,8 @@ class HashMD {
         this.view = createView(this.buffer);
     }
     update(data) {
-        aexists(this);
-        abytes(data);
+        aexists$1(this);
+        abytes$1(data);
         const { view, buffer, blockLen } = this;
         const len = data.length;
         for (let pos = 0; pos < len;) {
@@ -538,8 +538,8 @@ class HashMD {
         return this;
     }
     digestInto(out) {
-        aexists(this);
-        aoutput(out, this);
+        aexists$1(this);
+        aoutput$1(out, this);
         this.finished = true;
         // Padding
         // We can avoid allocation of buffer for padding completely if it
@@ -548,7 +548,7 @@ class HashMD {
         let { pos } = this;
         // append the bit '1' to the message
         buffer[pos++] = 0b10000000;
-        clean(this.buffer.subarray(pos));
+        clean$1(this.buffer.subarray(pos));
         // we have less than padOffset left in buffer, so we cannot put length in
         // current block, need process it and pad again
         if (this.padOffset > blockLen - pos) {
@@ -621,23 +621,23 @@ const SHA512_IV = /* @__PURE__ */ Uint32Array.from([
     0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179,
 ]);
 
-const U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
-const _32n = /* @__PURE__ */ BigInt(32);
+const U32_MASK64$1 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
+const _32n$1 = /* @__PURE__ */ BigInt(32);
 // Split bigint into two 32-bit halves. With `le=true`, returned fields become `{ h: low, l: high
 // }` to match little-endian word order rather than the property names.
-function fromBig(n, le = false) {
+function fromBig$1(n, le = false) {
     if (le)
-        return { h: Number(n & U32_MASK64), l: Number((n >> _32n) & U32_MASK64) };
-    return { h: Number((n >> _32n) & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+        return { h: Number(n & U32_MASK64$1), l: Number((n >> _32n$1) & U32_MASK64$1) };
+    return { h: Number((n >> _32n$1) & U32_MASK64$1) | 0, l: Number(n & U32_MASK64$1) | 0 };
 }
 // Split bigint list into `[highWords, lowWords]` when `le=false`; with `le=true`, the first array
 // holds the low halves because `fromBig(...)` swaps the semantic meaning of `h` and `l`.
-function split(lst, le = false) {
+function split$1(lst, le = false) {
     const len = lst.length;
     let Ah = new Uint32Array(len);
     let Al = new Uint32Array(len);
     for (let i = 0; i < len; i++) {
-        const { h, l } = fromBig(lst[i], le);
+        const { h, l } = fromBig$1(lst[i], le);
         [Ah[i], Al[i]] = [h, l];
     }
     return [Ah, Al];
@@ -743,7 +743,7 @@ function G2b(a, b, c, d, msg, x) {
     ((BBUF[2 * d] = Dl), (BBUF[2 * d + 1] = Dh));
 }
 function checkBlake2Opts(outputLen, opts = {}, keyLen, saltLen, persLen) {
-    anumber$1(keyLen);
+    anumber$2(keyLen);
     // RFC 7693 §2.1 requires digest length nn in 1..keyLen.
     if (outputLen <= 0 || outputLen > keyLen)
         throw new Error('outputLen bigger than keyLen');
@@ -752,9 +752,9 @@ function checkBlake2Opts(outputLen, opts = {}, keyLen, saltLen, persLen) {
     if (key !== undefined && (key.length < 1 || key.length > keyLen))
         throw new Error('"key" expected to be undefined or of length=1..' + keyLen);
     if (salt !== undefined)
-        abytes(salt, saltLen, 'salt');
+        abytes$1(salt, saltLen, 'salt');
     if (personalization !== undefined)
-        abytes(personalization, persLen, 'personalization');
+        abytes$1(personalization, persLen, 'personalization');
 }
 /** Internal base class for BLAKE2. */
 class _BLAKE2 {
@@ -768,16 +768,16 @@ class _BLAKE2 {
     outputLen;
     canXOF = false;
     constructor(blockLen, outputLen) {
-        anumber$1(blockLen);
-        anumber$1(outputLen);
+        anumber$2(blockLen);
+        anumber$2(outputLen);
         this.blockLen = blockLen;
         this.outputLen = outputLen;
         this.buffer = new Uint8Array(blockLen);
-        this.buffer32 = u32(this.buffer);
+        this.buffer32 = u32$1(this.buffer);
     }
     update(data) {
-        aexists(this);
-        abytes(data);
+        aexists$1(this);
+        abytes$1(data);
         // Main difference with other hashes: there is flag for last block,
         // so we cannot process current block before we know that there
         // is the next one. This significantly complicates logic and reduces ability
@@ -789,9 +789,9 @@ class _BLAKE2 {
         for (let pos = 0; pos < len;) {
             // If buffer is full and we still have input (don't process last block, same as blake2s)
             if (this.pos === blockLen) {
-                swap32IfBE(buffer32);
+                swap32IfBE$1(buffer32);
                 this.compress(buffer32, 0, false);
-                swap32IfBE(buffer32);
+                swap32IfBE$1(buffer32);
                 this.pos = 0;
             }
             const take = Math.min(blockLen - this.pos, len - pos);
@@ -799,12 +799,12 @@ class _BLAKE2 {
             // Zero-copy only for full, 4-byte-aligned, non-final blocks.
             if (take === blockLen && !(dataOffset % 4) && pos + take < len) {
                 const data32 = new Uint32Array(buf, dataOffset, Math.floor((len - pos) / 4));
-                swap32IfBE(data32);
+                swap32IfBE$1(data32);
                 for (let pos32 = 0; pos + blockLen < len; pos32 += buffer32.length, pos += blockLen) {
                     this.length += blockLen;
                     this.compress(data32, pos32, false);
                 }
-                swap32IfBE(data32);
+                swap32IfBE$1(data32);
                 continue;
             }
             buffer.set(data.subarray(pos, pos + take), this.pos);
@@ -815,20 +815,20 @@ class _BLAKE2 {
         return this;
     }
     digestInto(out) {
-        aexists(this);
-        aoutput(out, this);
+        aexists$1(this);
+        aoutput$1(out, this);
         const { pos, buffer32 } = this;
         this.finished = true;
         // Padding
-        clean(this.buffer.subarray(pos));
-        swap32IfBE(buffer32);
+        clean$1(this.buffer.subarray(pos));
+        swap32IfBE$1(buffer32);
         this.compress(buffer32, 0, true);
-        swap32IfBE(buffer32);
+        swap32IfBE$1(buffer32);
         // Reject unaligned views explicitly instead of hiding them behind a full scratch copy.
         if (out.byteOffset & 3)
             throw new RangeError('"digestInto() output" expected 4-byte aligned byteOffset, got ' + out.byteOffset);
         const state = this.get();
-        const out32 = u32(out);
+        const out32 = u32$1(out);
         const full = Math.floor(this.outputLen / 4);
         for (let i = 0; i < full; i++)
             out32[i] = swap8IfBE(state[i]);
@@ -892,23 +892,23 @@ class _BLAKE2b extends _BLAKE2 {
         let { key, personalization, salt } = opts;
         let keyLength = 0;
         if (key !== undefined) {
-            abytes(key, undefined, 'key');
+            abytes$1(key, undefined, 'key');
             keyLength = key.length;
         }
         // RFC 7693 §2.5: xor `p[0] = 0x0101kknn` into the low 32 bits of `h[0]`;
         // the high 32 bits stay at `IV[0]`.
         this.v0l ^= this.outputLen | (keyLength << 8) | (0x01 << 16) | (0x01 << 24);
         if (salt !== undefined) {
-            abytes(salt, undefined, 'salt');
-            const slt = u32(salt);
+            abytes$1(salt, undefined, 'salt');
+            const slt = u32$1(salt);
             this.v4l ^= swap8IfBE(slt[0]);
             this.v4h ^= swap8IfBE(slt[1]);
             this.v5l ^= swap8IfBE(slt[2]);
             this.v5h ^= swap8IfBE(slt[3]);
         }
         if (personalization !== undefined) {
-            abytes(personalization, undefined, 'personalization');
-            const pers = u32(personalization);
+            abytes$1(personalization, undefined, 'personalization');
+            const pers = u32$1(personalization);
             this.v6l ^= swap8IfBE(pers[0]);
             this.v6h ^= swap8IfBE(pers[1]);
             this.v7l ^= swap8IfBE(pers[2]);
@@ -948,7 +948,7 @@ class _BLAKE2b extends _BLAKE2 {
     compress(msg, offset, isLast) {
         this.get().forEach((v, i) => (BBUF[i] = v)); // First half from state.
         BBUF.set(B2B_IV, 16); // Second half from IV.
-        let { h, l } = fromBig(BigInt(this.length));
+        let { h, l } = fromBig$1(BigInt(this.length));
         BBUF[24] = B2B_IV[8] ^ l; // Low word of the offset.
         BBUF[25] = B2B_IV[9] ^ h; // High word.
         // Invert all bits for last block
@@ -994,11 +994,11 @@ class _BLAKE2b extends _BLAKE2 {
         this.v6h ^= BBUF[13] ^ BBUF[29];
         this.v7l ^= BBUF[14] ^ BBUF[30];
         this.v7h ^= BBUF[15] ^ BBUF[31];
-        clean(BBUF);
+        clean$1(BBUF);
     }
     destroy() {
         this.destroyed = true;
-        clean(this.buffer32);
+        clean$1(this.buffer32);
         this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
     }
 }
@@ -1015,7 +1015,7 @@ class _BLAKE2b extends _BLAKE2 {
  * blake2b(new Uint8Array([97, 98, 99]));
  * ```
  */
-const blake2b = /* @__PURE__ */ createHasher((opts) => new _BLAKE2b(opts));
+const blake2b = /* @__PURE__ */ createHasher$1((opts) => new _BLAKE2b(opts));
 
 var _EdKey_keyPair, _EdPublicKey_key;
 function generateKeyPairFromSeed$1(seed) {
@@ -1391,8 +1391,8 @@ class _HMAC {
     finished = false;
     destroyed = false;
     constructor(hash, key) {
-        ahash(hash);
-        abytes(key, undefined, 'key');
+        ahash$1(hash);
+        abytes$1(key, undefined, 'key');
         this.iHash = hash.create();
         if (typeof this.iHash.update !== 'function')
             throw new Error('Expected instance of class which extends utils.Hash');
@@ -1412,16 +1412,16 @@ class _HMAC {
         for (let i = 0; i < pad.length; i++)
             pad[i] ^= 0x36 ^ 0x5c;
         this.oHash.update(pad);
-        clean(pad);
+        clean$1(pad);
     }
     update(buf) {
-        aexists(this);
+        aexists$1(this);
         this.iHash.update(buf);
         return this;
     }
     digestInto(out) {
-        aexists(this);
-        aoutput(out, this);
+        aexists$1(this);
+        aoutput$1(out, this);
         this.finished = true;
         const buf = out.subarray(0, this.outputLen);
         // Reuse the first outputLen bytes for the inner digest; the outer hash consumes them before
@@ -1471,12 +1471,12 @@ const hmac = /* @__PURE__ */ (() => {
  */
 // Common start and end for sync/async functions
 function pbkdf2Init(hash, _password, _salt, _opts) {
-    ahash(hash);
-    const opts = checkOpts({ dkLen: 32, asyncTick: 10 }, _opts);
+    ahash$1(hash);
+    const opts = checkOpts$1({ dkLen: 32, asyncTick: 10 }, _opts);
     const { c, dkLen, asyncTick } = opts;
-    anumber$1(c, 'c');
-    anumber$1(dkLen, 'dkLen');
-    anumber$1(asyncTick, 'asyncTick');
+    anumber$2(c, 'c');
+    anumber$2(dkLen, 'dkLen');
+    anumber$2(asyncTick, 'asyncTick');
     if (c < 1)
         throw new Error('iterations (c) must be >= 1');
     // RFC 8018 §5.2 defines `dkLen` as "a positive integer".
@@ -1503,7 +1503,7 @@ function pbkdf2Output(PRF, PRFSalt, DK, prfW, u) {
     PRFSalt.destroy();
     if (prfW)
         prfW.destroy();
-    clean(u);
+    clean$1(u);
     return DK;
 }
 /**
@@ -1634,14 +1634,14 @@ class SHA2_32B extends HashMD {
         this.set(A, B, C, D, E, F, G, H);
     }
     roundClean() {
-        clean(SHA256_W);
+        clean$1(SHA256_W);
     }
     destroy() {
         // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves
         // update()/digest() callable on reused instances.
         this.destroyed = true;
         this.set(0, 0, 0, 0, 0, 0, 0, 0);
-        clean(this.buffer);
+        clean$1(this.buffer);
     }
 }
 /** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */
@@ -1664,7 +1664,7 @@ class _SHA256 extends SHA2_32B {
 // SHA-384 / SHA-512 round constants from RFC 6234 §5.2:
 // 80 full 64-bit words split into high/low halves.
 // prettier-ignore
-const K512 = /* @__PURE__ */ (() => split([
+const K512 = /* @__PURE__ */ (() => split$1([
     '0x428a2f98d728ae22', '0x7137449123ef65cd', '0xb5c0fbcfec4d3b2f', '0xe9b5dba58189dbbc',
     '0x3956c25bf348b538', '0x59f111f1b605d019', '0x923f82a4af194f9b', '0xab1c5ed5da6d8118',
     '0xd807aa98a3030242', '0x12835b0145706fbe', '0x243185be4ee4b28c', '0x550c7dc3d5ffb4e2',
@@ -1792,13 +1792,13 @@ class SHA2_64B extends HashMD {
         this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
     }
     roundClean() {
-        clean(SHA512_W_H, SHA512_W_L);
+        clean$1(SHA512_W_H, SHA512_W_L);
     }
     destroy() {
         // HashMD callers route post-destroy usability through `destroyed`; zeroizing alone still leaves
         // update()/digest() callable on reused instances.
         this.destroyed = true;
-        clean(this.buffer);
+        clean$1(this.buffer);
         this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
     }
 }
@@ -1839,8 +1839,8 @@ class _SHA512 extends SHA2_64B {
  * sha256(new Uint8Array([97, 98, 99]));
  * ```
  */
-const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(), 
-/* @__PURE__ */ oidNist(0x01));
+const sha256 = /* @__PURE__ */ createHasher$1(() => new _SHA256(), 
+/* @__PURE__ */ oidNist$1(0x01));
 /**
  * SHA2-512 hash function from RFC 4634.
  * @param msg - message bytes to hash
@@ -1851,11 +1851,11 @@ const sha256 = /* @__PURE__ */ createHasher(() => new _SHA256(),
  * sha512(new Uint8Array([97, 98, 99]));
  * ```
  */
-const sha512 = /* @__PURE__ */ createHasher(() => new _SHA512(), 
-/* @__PURE__ */ oidNist(0x03));
+const sha512 = /* @__PURE__ */ createHasher$1(() => new _SHA512(), 
+/* @__PURE__ */ oidNist$1(0x03));
 
 /*! scure-base - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-function isBytes(a) {
+function isBytes$1(a) {
     // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases. The
     // fallback still requires a real ArrayBuffer view, so plain JSON-deserialized
     // `{ constructor: ... }` spoofing is rejected. `BYTES_PER_ELEMENT === 1` keeps the
@@ -1888,7 +1888,7 @@ function astr(label, input) {
         throw new TypeError(`${label}: string expected`);
     return true;
 }
-function anumber(n) {
+function anumber$1(n) {
     if (typeof n !== 'number')
         throw new TypeError(`number expected, got ${typeof n}`);
     if (!Number.isSafeInteger(n))
@@ -1975,7 +1975,7 @@ function join(separator = '') {
  * @__NO_SIDE_EFFECTS__
  */
 function padding(bits, chr = '=') {
-    anumber(bits);
+    anumber$1(bits);
     astr('padding', chr);
     return {
         encode(data) {
@@ -2016,7 +2016,7 @@ function convertRadix(data, from, to) {
     let pos = 0;
     const res = [];
     const digits = Array.from(data, (d) => {
-        anumber(d);
+        anumber$1(d);
         if (d < 0 || d >= from)
             throw new Error(`invalid integer: ${d}`);
         return d;
@@ -2084,7 +2084,7 @@ function convertRadix2(data, from, to, padding) {
     const mask = powers[to] - 1;
     const res = [];
     for (const n of data) {
-        anumber(n);
+        anumber$1(n);
         if (n >= max)
             throw new Error(`convertRadix2: invalid data word=${n} from=${from}`);
         carry = (carry << from) | n;
@@ -2113,12 +2113,12 @@ function convertRadix2(data, from, to, padding) {
  * @__NO_SIDE_EFFECTS__
  */
 function radix(num) {
-    anumber(num);
+    anumber$1(num);
     const _256 = 2 ** 8;
     // Base-range and carry-overflow checks live in convertRadix so encode/decode reject unsupported bases symmetrically.
     return {
         encode: (bytes) => {
-            if (!isBytes(bytes))
+            if (!isBytes$1(bytes))
                 throw new TypeError('radix.encode input should be Uint8Array');
             return convertRadix(Array.from(bytes), _256, num);
         },
@@ -2134,7 +2134,7 @@ function radix(num) {
  * @__NO_SIDE_EFFECTS__
  */
 function radix2(bits, revPadding = false) {
-    anumber(bits);
+    anumber$1(bits);
     if (bits <= 0 || bits > 32)
         throw new RangeError('radix2: bits should be in (0..32]');
     if (radix2carry(8, bits) > 32 || radix2carry(bits, 8) > 32)
@@ -2143,7 +2143,7 @@ function radix2(bits, revPadding = false) {
     // Default pads 8->bits and rejects extra bits on bits->8; `true` does the opposite.
     return {
         encode: (bytes) => {
-            if (!isBytes(bytes))
+            if (!isBytes$1(bytes))
                 throw new TypeError('radix2.encode input should be Uint8Array');
             return convertRadix2(Array.from(bytes), 8, bits, !revPadding);
         },
@@ -2154,7 +2154,7 @@ function radix2(bits, revPadding = false) {
     };
 }
 function checksum(len, fn) {
-    anumber(len);
+    anumber$1(len);
     // Reject degenerate zero-byte checksums up front so callers don't accidentally
     // build a no-op checksum stage.
     if (len <= 0)
@@ -2165,7 +2165,7 @@ function checksum(len, fn) {
     // Current call sites rely on `len > 0` and checksum functions that return at least that many bytes.
     return {
         encode(data) {
-            if (!isBytes(data))
+            if (!isBytes$1(data))
                 throw new TypeError('checksum.encode: input should be Uint8Array');
             const sum = _fn(data).slice(0, len);
             const res = new Uint8Array(data.length + len);
@@ -2174,7 +2174,7 @@ function checksum(len, fn) {
             return res;
         },
         decode(data) {
-            if (!isBytes(data))
+            if (!isBytes$1(data))
                 throw new TypeError('checksum.decode: input should be Uint8Array');
             const payload = data.slice(0, -len);
             const oldChecksum = data.slice(-len);
@@ -2223,7 +2223,7 @@ function normalize(str) {
 }
 // BIP-39 entropy payloads are 128-256 bits in 32-bit increments, i.e. 16/20/24/28/32 bytes.
 function aentropy(ent) {
-    abytes(ent);
+    abytes$1(ent);
     if (![16, 20, 24, 28, 32].includes(ent.length))
         throw new RangeError('invalid entropy length');
 }
@@ -4772,60 +4772,2576 @@ class BLSPublicKey {
 }
 _BLSPublicKey_key = new WeakMap();
 
-var _InMemorySigner_key;
 /**
- * A local implementation of the signer. Will represent a Tezos account and be able to produce signature in its behalf
- *
- * @remarks If running in production and dealing with tokens that have real value, it is strongly recommended to use a HSM backed signer so that private key material is not stored in memory or on disk
- * @throws InvalidMnemonicError
+ * Checks if something is Uint8Array. Be careful: nodejs Buffer will return true.
+ * @param a - value to test
+ * @returns `true` when the value is a Uint8Array-compatible view.
+ * @example
+ * Check whether a value is a Uint8Array-compatible view.
+ * ```ts
+ * isBytes(new Uint8Array([1, 2, 3]));
+ * ```
  */
-class InMemorySigner {
-    static fromFundraiser(email, password, mnemonic) {
-        if (!validateMnemonic(mnemonic, wordlist)) {
-            throw new InvalidMnemonicError();
-        }
-        const seed = mnemonicToSeedSync(mnemonic, `${email}${password}`);
-        const key = b58Encode(seed.subarray(0, 32), PrefixV2.Ed25519Seed);
-        return new InMemorySigner(key);
+function isBytes(a) {
+    // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases.
+    // The fallback still requires a real ArrayBuffer view, so plain
+    // JSON-deserialized `{ constructor: ... }` spoofing is rejected, and
+    // `BYTES_PER_ELEMENT === 1` keeps the fallback on byte-oriented views.
+    return (a instanceof Uint8Array ||
+        (ArrayBuffer.isView(a) &&
+            a.constructor.name === 'Uint8Array' &&
+            'BYTES_PER_ELEMENT' in a &&
+            a.BYTES_PER_ELEMENT === 1));
+}
+// Shared error-message prefix builder. Only called on throw paths, so assert
+// success paths never pay for the string concatenation.
+const atitle$1 = (title) => (title ? `"${title}" ` : '');
+/**
+ * Asserts something is a non-negative integer.
+ * @param n - number to validate
+ * @param title - label included in thrown errors
+ * @returns The validated number.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Validate a non-negative integer option.
+ * ```ts
+ * anumber(32, 'length');
+ * ```
+ */
+function anumber(n, title = '') {
+    if (typeof n !== 'number')
+        throw new TypeError(atitle$1(title) + 'expected number, got ' + typeof n);
+    if (!Number.isSafeInteger(n) || n < 0)
+        throw new RangeError(atitle$1(title) + 'expected integer >= 0, got ' + n);
+    return n;
+}
+/**
+ * Asserts something is a boolean.
+ * @param value - value to validate
+ * @param title - label included in thrown errors
+ * @returns The validated boolean.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Validate a boolean option.
+ * ```ts
+ * abool(true, 'enableXOF');
+ * ```
+ */
+function abool$1(value, title = '') {
+    if (typeof value !== 'boolean')
+        throw new TypeError(atitle$1(title) + 'expected boolean, got type=' + typeof value);
+    return value;
+}
+/**
+ * Asserts something is Uint8Array.
+ * @param value - value to validate
+ * @param length - optional exact length constraint
+ * @param title - label included in thrown errors
+ * @returns The validated byte array.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Validate that a value is a byte array.
+ * ```ts
+ * abytes(new Uint8Array([1, 2, 3]));
+ * ```
+ */
+function abytes(value, length, title = '') {
+    // Success path first: this runs at the start of every update() / digestInto(), and the
+    // common `abytes(data)` form must not pay for length handling it does not use.
+    if (isBytes(value) && (length === undefined || value.length === length))
+        return value;
+    // Error path: recompute freely to build the exact message.
+    if (length !== undefined)
+        anumber(length, 'length');
+    const bytes = isBytes(value);
+    const ofLen = length !== undefined ? ` of length ${length}` : '';
+    const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+    const message = atitle$1(title) + 'expected Uint8Array' + ofLen + ', got ' + got;
+    if (!bytes)
+        throw new TypeError(message);
+    throw new RangeError(message);
+}
+/**
+ * Asserts something is a wrapped hash constructor.
+ * @param h - hash constructor to validate
+ * @throws On wrong argument types or invalid hash wrapper shape. {@link TypeError}
+ * @throws On invalid hash metadata ranges or values. {@link RangeError}
+ * @throws If the hash metadata allows empty outputs or block sizes. {@link Error}
+ * @example
+ * Validate a callable hash wrapper.
+ * ```ts
+ * import { ahash } from '@noble/hashes/utils.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * ahash(sha256);
+ * ```
+ */
+function ahash(h) {
+    if (typeof h !== 'function' || typeof h.create !== 'function')
+        throw new TypeError('expected hash wrapped by utils.createHasher');
+    anumber(h.outputLen);
+    anumber(h.blockLen);
+    // HMAC and KDF callers treat these as real byte lengths; allowing zero lets fake wrappers pass
+    // validation and can produce empty outputs instead of failing fast.
+    if (h.outputLen < 1 || h.blockLen < 1)
+        throw new Error('hash blockLen / outputLen must be >= 1');
+}
+const aobject$2 = (value, label) => {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new TypeError((label === 'object' ? '' : `"${label}" `) + 'expected object, got type=' + typeof value);
+};
+const aopts = (value, label) => {
+    aobject$2(value, label);
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null)
+        throw new TypeError(`"${label}" expected plain object`);
+    // Object.assign() treats an own "__proto__" source key as a write to the target's legacy
+    // prototype setter. Reject it before merging so inherited option values cannot be injected.
+    if (Object.hasOwn(value, '__proto__'))
+        throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
+/**
+ * Asserts a hash instance has not been destroyed or finished.
+ * @param instance - hash instance to validate
+ * @param checkFinished - whether to reject finalized instances
+ * @throws If the hash instance has already been destroyed or finalized. {@link Error}
+ * @example
+ * Validate that a hash instance is still usable.
+ * ```ts
+ * import { aexists } from '@noble/hashes/utils.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const hash = sha256.create();
+ * aexists(hash);
+ * ```
+ */
+function aexists(instance, checkFinished = true) {
+    // Runs on every update()/digestInto(); the flags are library-owned booleans, so only their
+    // truthiness is checked - re-validating their type per call was pure hot-path overhead.
+    if (instance.destroyed)
+        throw new Error('hash was destroyed');
+    if (checkFinished && instance.finished)
+        throw new Error('digest() was already called');
+}
+/**
+ * Asserts output is a sufficiently-sized byte array.
+ * @param out - destination buffer
+ * @param instance - hash instance providing output length
+ * Oversized buffers are allowed; downstream code only promises to fill the first `outputLen` bytes.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Validate a caller-provided digest buffer.
+ * ```ts
+ * import { aoutput } from '@noble/hashes/utils.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const hash = sha256.create();
+ * aoutput(new Uint8Array(hash.outputLen), hash);
+ * ```
+ */
+function aoutput(out, instance) {
+    abytes(out, undefined, 'output');
+    // `outputLen` is a library-owned readonly number; the negated comparison keeps failing fast
+    // when it is missing/NaN (comparisons with undefined/NaN are false) without an anumber() call.
+    const min = instance.outputLen;
+    if (!(out.length >= min)) {
+        throw new RangeError('"output" expected length >= ' + min);
     }
-    static async fromSecretKey(key, passphrase) {
-        return new InMemorySigner(key, passphrase);
+}
+/**
+ * Casts a typed array view to Uint32Array.
+ * `arr.byteOffset` must already be 4-byte aligned or the platform
+ * Uint32Array constructor will throw.
+ * @param arr - source typed array
+ * @returns Uint32Array view over the same buffer.
+ * @example
+ * Reinterpret a byte array as 32-bit words.
+ * ```ts
+ * u32(new Uint8Array(8));
+ * ```
+ */
+function u32(arr) {
+    return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
+}
+/**
+ * Zeroizes typed arrays in place. Warning: JS provides no guarantees.
+ * @param arrays - arrays to overwrite with zeros
+ * @example
+ * Zeroize sensitive buffers in place.
+ * ```ts
+ * clean(new Uint8Array([1, 2, 3]));
+ * ```
+ */
+function clean(...arrays) {
+    for (let i = 0; i < arrays.length; i++) {
+        arrays[i].fill(0);
     }
-    /**
-     *
-     * Instantiation of an InMemorySigner instance from a mnemonic
-     * @returns InMemorySigner
-     * @throws InvalidMnemonicError
-     */
-    static fromMnemonic({ mnemonic, password = '', derivationPath = "44'/1729'/0'/0'", curve = 'ed25519', }) {
-        // check if curve is defined if not default tz1
-        if (!validateMnemonic(mnemonic, wordlist)) {
-            // avoiding exposing mnemonic again in case of mistake making invalid
-            throw new InvalidMnemonicError();
-        }
-        const seed = mnemonicToSeedSync(mnemonic, password);
-        const sk = generateSecretKey(seed, derivationPath, curve);
-        return new InMemorySigner(sk);
+}
+/** Whether the current platform is little-endian. */
+const isLE = /* @__PURE__ */ (() => new Uint8Array(new Uint32Array([0x11223344]).buffer)[0] === 0x44)();
+/**
+ * Byte-swap operation for uint32 values.
+ * @param word - source word
+ * @returns Word with reversed byte order.
+ * @example
+ * Reverse the byte order of a 32-bit word.
+ * ```ts
+ * byteSwap(0x11223344);
+ * ```
+ */
+function byteSwap(word) {
+    return (((word << 24) & 0xff000000) |
+        ((word << 8) & 0xff0000) |
+        ((word >>> 8) & 0xff00) |
+        ((word >>> 24) & 0xff));
+}
+/**
+ * Byte-swaps every word of a Uint32Array in place.
+ * @param arr - array to mutate
+ * @returns The same array after mutation; callers pass live state arrays here.
+ * @example
+ * Reverse the byte order of every word in place.
+ * ```ts
+ * byteSwap32(new Uint32Array([0x11223344]));
+ * ```
+ */
+function byteSwap32(arr) {
+    for (let i = 0; i < arr.length; i++) {
+        arr[i] = byteSwap(arr[i]);
     }
-    /**
-     *
-     * @param key Encoded private key
-     * @param passphrase Passphrase to decrypt the private key if it is encrypted
-     * @throws InvalidKeyError
-     *
-     */
-    constructor(key, passphrase) {
-        _InMemorySigner_key.set(this, void 0);
-        const keyPrefixes = [
-            PrefixV2.Ed25519EncryptedSeed,
-            PrefixV2.Ed25519Seed,
-            PrefixV2.Ed25519SecretKey,
-            PrefixV2.Secp256k1EncryptedSecretKey,
-            PrefixV2.Secp256k1SecretKey,
+    return arr;
+}
+/**
+ * Conditionally byte-swaps a Uint32Array on big-endian platforms.
+ * @param u - array to normalize for host endianness
+ * @returns Original or byte-swapped array depending on platform endianness.
+ *   On big-endian runtimes this mutates `u` in place via `byteSwap32(...)`.
+ * @example
+ * Normalize a word array for host endianness.
+ * ```ts
+ * swap32IfBE(new Uint32Array([0x11223344]));
+ * ```
+ */
+const swap32IfBE = isLE
+    ? (u) => u
+    : byteSwap32;
+// Built-in hex conversion https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex
+const hasHexBuiltin = /* @__PURE__ */ (() => 
+// @ts-ignore
+typeof Uint8Array.from([]).toHex === 'function' && typeof Uint8Array.fromHex === 'function')();
+// Array where index 0xf0 (240) is mapped to string 'f0'
+const hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));
+/**
+ * Convert byte array to hex string.
+ * Uses the built-in function when available and assumes it matches the tested
+ * fallback semantics.
+ * @param bytes - bytes to encode
+ * @returns Lowercase hexadecimal string.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Convert bytes to lowercase hexadecimal.
+ * ```ts
+ * bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])); // 'cafe0123'
+ * ```
+ */
+function bytesToHex(bytes) {
+    abytes(bytes);
+    // @ts-ignore
+    if (hasHexBuiltin)
+        return bytes.toHex();
+    // pre-caching improves the speed 6x
+    let hex = '';
+    for (let i = 0; i < bytes.length; i++) {
+        hex += hexes[bytes[i]];
+    }
+    return hex;
+}
+/**
+ * Copies several Uint8Arrays into one.
+ * @param arrays - arrays to concatenate
+ * @returns Concatenated byte array.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Concatenate multiple byte arrays.
+ * ```ts
+ * concatBytes(new Uint8Array([1]), new Uint8Array([2]));
+ * ```
+ */
+function concatBytes(...arrays) {
+    let sum = 0;
+    for (let i = 0; i < arrays.length; i++) {
+        const a = arrays[i];
+        abytes(a);
+        sum += a.length;
+    }
+    const res = new Uint8Array(sum);
+    for (let i = 0, pad = 0; i < arrays.length; i++) {
+        const a = arrays[i];
+        res.set(a, pad);
+        pad += a.length;
+    }
+    return res;
+}
+/**
+ * Merges default options and passed options.
+ * @param defaults - base option object
+ * @param opts - user overrides
+ * @param title - label included in thrown override errors
+ * @returns Fresh merged option object with a null prototype.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Merge user overrides onto default options.
+ * ```ts
+ * checkOpts({ dkLen: 32 }, { asyncTick: 10 });
+ * ```
+ */
+function checkOpts(defaults, opts, title = 'opts') {
+    aopts(defaults, 'defaults');
+    if (opts !== undefined)
+        aopts(opts, title);
+    // Callers read optional fields directly, so omitted values must not fall through to ambient
+    // Object.prototype pollution (for example a forged `dkLen` changing SHAKE's default output).
+    const merged = Object.assign(Object.create(null), defaults, opts);
+    return merged;
+}
+/**
+ * Creates a callable hash function from a stateful class constructor.
+ * @param hashCons - hash constructor or factory
+ * @param info - optional metadata such as DER OID
+ * @returns Frozen callable hash wrapper with `.create()`.
+ *   Wrapper construction eagerly calls `hashCons(undefined)` once to read
+ *   `outputLen` / `blockLen`, so constructor side effects happen at module
+ *   init time.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Wrap a stateful hash constructor into a callable helper.
+ * ```ts
+ * import { createHasher } from '@noble/hashes/utils.js';
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * const wrapped = createHasher(sha256.create, { oid: sha256.oid });
+ * wrapped(new Uint8Array([1]));
+ * ```
+ */
+function createHasher(hashCons, info = {}) {
+    if (typeof hashCons !== 'function')
+        throw new TypeError('"hashCons" expected function, got type=' + typeof hashCons);
+    info = checkOpts({}, info, 'info');
+    const hashC = (msg, opts) => hashCons(opts)
+        .update(msg)
+        .digest();
+    const tmp = hashCons(undefined);
+    hashC.outputLen = tmp.outputLen;
+    hashC.blockLen = tmp.blockLen;
+    hashC.canXOF = tmp.canXOF;
+    hashC.create = (opts) => hashCons(opts);
+    Object.assign(hashC, info);
+    return Object.freeze(hashC);
+}
+/**
+ * Cryptographically secure PRNG backed by `crypto.getRandomValues`.
+ * @param bytesLength - number of random bytes to generate
+ * @returns Random bytes.
+ * The platform `getRandomValues()` implementation still defines any
+ * single-call length cap, and this helper rejects oversize requests
+ * with a stable library `RangeError` instead of host-specific errors.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @throws If the current runtime does not provide `crypto.getRandomValues`. {@link Error}
+ * @example
+ * Generate a fresh random key or nonce.
+ * ```ts
+ * const key = randomBytes(16);
+ * ```
+ */
+function randomBytes$1(bytesLength = 32) {
+    // Match the repo's other length-taking helpers instead of relying on Uint8Array coercion.
+    anumber(bytesLength, 'bytesLength');
+    const cr = typeof globalThis === 'object' ? globalThis.crypto : null;
+    if (typeof cr?.getRandomValues !== 'function')
+        throw new Error('crypto.getRandomValues must be defined');
+    // Web Cryptography API Level 2 §10.1.1:
+    // if `byteLength > 65536`, throw `QuotaExceededError`.
+    // Keep the guard explicit so callers can see the quota in code
+    // instead of discovering it by reading the spec or host errors.
+    // This wrapper surfaces the same quota as a stable library RangeError.
+    if (bytesLength > 65536)
+        throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
+    return cr.getRandomValues(new Uint8Array(bytesLength));
+}
+/**
+ * Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.
+ * @param suffix - final OID byte for the selected hash.
+ *   The helper accepts any byte even though only the documented NIST hash
+ *   suffixes are meaningful downstream.
+ * @returns Object containing the DER-encoded OID.
+ * @example
+ * Build OID metadata for a NIST hash.
+ * ```ts
+ * oidNist(0x01);
+ * ```
+ */
+const oidNist = (suffix) => ({
+    // Current NIST hashAlgs suffixes used here fit in one DER subidentifier octet.
+    // Larger suffix values would need base-128 OID encoding and a different length byte.
+    oid: Uint8Array.from([0x06, 0x09, 0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02, suffix]),
+});
+
+/**
+ * Hex, bytes and number utilities.
+ * @module
+ */
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+/**
+ * Asserts something is a plain object-ish value, not null or array.
+ * @param value - Value to validate.
+ * @param title - Label included in thrown errors.
+ * @returns The validated object.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Validate an options object before checking fields.
+ *
+ * ```ts
+ * aobject({ flag: true });
+ * ```
+ */
+function aobject$1(value, title = 'object') {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new TypeError(title === 'object'
+            ? 'expected valid options object'
+            : `"${title}" expected object, got type=${typeof value}`);
+    return value;
+}
+// Shared error-message prefix builder. Only called on throw paths, so assert
+// success paths never pay for the string concatenation.
+const atitle = (title) => (title ? `"${title}" ` : '');
+/**
+ * Validates that a flag is boolean.
+ * @param value - Value to validate.
+ * @param title - Optional field name.
+ * @returns Original value.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Reject non-boolean option flags early.
+ *
+ * ```ts
+ * abool(true);
+ * ```
+ */
+function abool(value, title = '') {
+    if (typeof value !== 'boolean')
+        throw new TypeError(atitle(title) + 'expected boolean, got type=' + typeof value);
+    return value;
+}
+/**
+ * Validates declared required and optional field types on a plain object.
+ * Extra keys are intentionally ignored because many callers validate only the subset they use from
+ * richer option bags or runtime objects.
+ * This walks field schemas and formats detailed errors, so avoid it on hot paths; use direct
+ * one-line guards such as `aobject()`, `afunction()`, `abool()`, or `asafenumber()` instead.
+ * @param object - Object to validate.
+ * @param fields - Required field types.
+ * @param optFields - Optional field types.
+ * @param title - Object label included in thrown errors.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Check user options before building a curve helper.
+ *
+ * ```ts
+ * validateObject({ flag: true }, { flag: 'boolean' });
+ * ```
+ */
+function validateObject(object, fields = {}, optFields = {}, title = 'object') {
+    aobject$1(object, title);
+    aobject$1(fields, 'fields');
+    aobject$1(optFields, 'optFields');
+    function checkField(fieldName, expectedType, isOpt) {
+        const label = title === 'object' ? `param "${String(fieldName)}"` : `"${title}.${String(fieldName)}"`;
+        // Config fields must be explicit own properties. Optional inherited values are rejected too
+        // because callers keep reading the same options object after validation.
+        const val = object[fieldName];
+        // Runtime objects such as Field instances intentionally satisfy required method slots
+        // via their shared prototype.
+        if (!Object.hasOwn(object, fieldName) &&
+            (isOpt ? val !== undefined : expectedType !== 'function')) {
+            throw new TypeError(`${label} is invalid: expected own property`);
+        }
+        if (isOpt && val === undefined)
+            return;
+        const current = typeof val;
+        if (current !== expectedType || val === null)
+            throw new TypeError(`${label} is invalid: expected ${expectedType}, got ${current}`);
+    }
+    const iter = (f, isOpt) => Object.entries(f).forEach(([k, v]) => checkField(k, v, isOpt));
+    iter(fields, false);
+    iter(optFields, true);
+}
+
+const U32_MASK64 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
+const _32n = /* @__PURE__ */ BigInt(32);
+// Split bigint into two 32-bit halves. With `le=true`, returned fields become `{ h: low, l: high
+// }` to match little-endian word order rather than the property names.
+function fromBig(n, le = false) {
+    if (le)
+        return { h: Number(n & U32_MASK64), l: Number((n >> _32n) & U32_MASK64) };
+    return { h: Number((n >> _32n) & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
+}
+// Split bigint list into `[highWords, lowWords]` when `le=false`; with `le=true`, the first array
+// holds the low halves because `fromBig(...)` swaps the semantic meaning of `h` and `l`.
+function split(lst, le = false) {
+    const len = lst.length;
+    let Ah = new Uint32Array(len);
+    let Al = new Uint32Array(len);
+    for (let i = 0; i < len; i++) {
+        const { h, l } = fromBig(lst[i], le);
+        [Ah[i], Al[i]] = [h, l];
+    }
+    return [Ah, Al];
+}
+
+/**
+ * SHA3 (keccak) hash function, based on a new "Sponge function" design.
+ * Different from older hashes, the internal state is bigger than output size.
+ *
+ * Check out
+ * {@link https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf | FIPS-202},
+ * {@link https://keccak.team/keccak.html | Website}, and
+ * {@link https://crypto.stackexchange.com/q/15727 | the differences between
+ * SHA-3 and Keccak}.
+ *
+ * Check out `sha3-addons` module for cSHAKE, k12, and others.
+ * @module
+ */
+// No __PURE__ annotations in sha3 header:
+// EVERYTHING is in fact used on every export.
+// Various per round constants calculations
+const _0n = BigInt(0);
+const _1n = BigInt(1);
+const _2n = BigInt(2);
+const _7n = BigInt(7);
+const _256n = BigInt(256);
+// FIPS 202 Algorithm 5 rc(): when the outgoing bit is 1, the 8-bit LFSR xors
+// taps 0, 4, 5, and 6, which compresses to the feedback mask `0x71`.
+const _0x71n = BigInt(0x71);
+const SHA3_PI = [];
+const SHA3_ROTL = [];
+const _SHA3_IOTA = []; // no pure annotation: var is always used
+for (let round = 0, R = _1n, x = 1, y = 0; round < 24; round++) {
+    // Pi
+    [x, y] = [y, (2 * x + 3 * y) % 5];
+    SHA3_PI.push(2 * (5 * y + x));
+    // Rotational
+    SHA3_ROTL.push((((round + 1) * (round + 2)) / 2) % 64);
+    // Iota
+    let t = _0n;
+    for (let j = 0; j < 7; j++) {
+        R = ((R << _1n) ^ ((R >> _7n) * _0x71n)) % _256n;
+        if (R & _2n)
+            t ^= _1n << ((_1n << BigInt(j)) - _1n);
+    }
+    _SHA3_IOTA.push(t);
+}
+const IOTAS = split(_SHA3_IOTA, true);
+// `split(..., true)` keeps the local little-endian lane-word layout used by
+// `state32`, so these `H` / `L` tables follow the file's first-word /
+// second-word lane slots rather than `_u64.ts`'s usual high/low naming.
+const SHA3_IOTA_H = IOTAS[0];
+const SHA3_IOTA_L = IOTAS[1];
+// 64-bit left rotates as u32 pairs. Inlined here (not imported from _u64) so V8 can
+// inline them into keccakP — the import path costs ~24% on sha3_256. SHA3 is the only
+// consumer of left-rotates; other hashes use right-rotates from _u64.
+// Valid for s in 1..31 (SH/SL) and 33..63 (BH/BL); keccak never rotates by 0/32/64.
+const rotlSH = (h, l, s) => (h << s) | (l >>> (32 - s));
+const rotlSL = (h, l, s) => (l << s) | (h >>> (32 - s));
+const rotlBH = (h, l, s) => (l << (s - 32)) | (h >>> (64 - s));
+const rotlBL = (h, l, s) => (h << (s - 32)) | (l >>> (64 - s));
+const rotlH = (h, l, s) => (s > 32 ? rotlBH(h, l, s) : rotlSH(h, l, s));
+const rotlL = (h, l, s) => (s > 32 ? rotlBL(h, l, s) : rotlSL(h, l, s));
+// Reused Theta scratch buffer (column parities), same pattern as SHA256_W in sha2.
+// keccakP never calls user code, so the shared buffer cannot be observed mid-permutation.
+const B = new Uint32Array(5 * 2);
+/**
+ * `keccakf1600` internal permutation, additionally allows adjusting the round count.
+ * @param s - 5x5 Keccak state encoded as 25 lanes split into 50 uint32 words
+ *   in this file's local little-endian lane-word order
+ * @param rounds - number of rounds to execute
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @throws If `rounds` is outside the supported `1..24` range. {@link Error}
+ * @example
+ * Permute a Keccak state with the default 24 rounds.
+ * ```ts
+ * keccakP(new Uint32Array(50));
+ * ```
+ */
+function keccakP(s, rounds = 24) {
+    if (!(s instanceof Uint32Array))
+        throw new TypeError('"s" expected Uint32Array(50), got type=' + typeof s);
+    if (s.length !== 50)
+        throw new RangeError('"s" expected Uint32Array(50), got length=' + s.length);
+    anumber(rounds, 'rounds');
+    // This implementation precomputes only the standard Keccak-f[1600] 24-round Iota table.
+    if (rounds < 1 || rounds > 24)
+        throw new Error('"rounds" expected integer 1..24');
+    // NOTE: all indices are x2 since we store state as u32 instead of u64 (bigints to slow in js)
+    for (let round = 24 - rounds; round < 24; round++) {
+        // Theta θ
+        for (let x = 0; x < 10; x++)
+            B[x] = s[x] ^ s[x + 10] ^ s[x + 20] ^ s[x + 30] ^ s[x + 40];
+        for (let x = 0; x < 10; x += 2) {
+            const idx1 = (x + 8) % 10;
+            const idx0 = (x + 2) % 10;
+            const B0 = B[idx0];
+            const B1 = B[idx0 + 1];
+            const Th = rotlH(B0, B1, 1) ^ B[idx1];
+            const Tl = rotlL(B0, B1, 1) ^ B[idx1 + 1];
+            for (let y = 0; y < 50; y += 10) {
+                s[x + y] ^= Th;
+                s[x + y + 1] ^= Tl;
+            }
+        }
+        // Rho (ρ) and Pi (π)
+        let curH = s[2];
+        let curL = s[3];
+        for (let t = 0; t < 24; t++) {
+            const shift = SHA3_ROTL[t];
+            const Th = rotlH(curH, curL, shift);
+            const Tl = rotlL(curH, curL, shift);
+            const PI = SHA3_PI[t];
+            curH = s[PI];
+            curL = s[PI + 1];
+            s[PI] = Th;
+            s[PI + 1] = Tl;
+        }
+        // Chi (χ)
+        // Same as:
+        // for (let x = 0; x < 10; x++) B[x] = s[y + x];
+        // for (let x = 0; x < 10; x++) s[y + x] ^= ~B[(x + 2) % 10] & B[(x + 4) % 10];
+        for (let y = 0; y < 50; y += 10) {
+            const b0 = s[y], b1 = s[y + 1], b2 = s[y + 2], b3 = s[y + 3];
+            s[y] ^= ~s[y + 2] & s[y + 4];
+            s[y + 1] ^= ~s[y + 3] & s[y + 5];
+            s[y + 2] ^= ~s[y + 4] & s[y + 6];
+            s[y + 3] ^= ~s[y + 5] & s[y + 7];
+            s[y + 4] ^= ~s[y + 6] & s[y + 8];
+            s[y + 5] ^= ~s[y + 7] & s[y + 9];
+            s[y + 6] ^= ~s[y + 8] & b0;
+            s[y + 7] ^= ~s[y + 9] & b1;
+            s[y + 8] ^= ~b0 & b2;
+            s[y + 9] ^= ~b1 & b3;
+        }
+        // Iota (ι)
+        s[0] ^= SHA3_IOTA_H[round];
+        s[1] ^= SHA3_IOTA_L[round];
+    }
+    clean(B);
+}
+/**
+ * Keccak sponge function.
+ * @param blockLen - absorb/squeeze rate in bytes
+ * @param suffix - domain separation suffix byte
+ * @param outputLen - default digest length in bytes. This base sponge only
+ *   requires a non-negative integer; wrappers that need positive output
+ *   lengths must enforce that themselves.
+ * @param enableXOF - whether XOF output is allowed
+ * @param rounds - number of Keccak-f rounds
+ * @example
+ * Build a sponge state, absorb bytes, then finalize a digest.
+ * ```ts
+ * const hash = new Keccak(136, 0x06, 32);
+ * hash.update(new Uint8Array([1, 2, 3]));
+ * hash.digest();
+ * ```
+ */
+class Keccak {
+    state;
+    pos = 0;
+    posOut = 0;
+    finished = false;
+    state32;
+    destroyed = false;
+    blockLen;
+    suffix;
+    outputLen;
+    canXOF;
+    enableXOF = false;
+    rounds;
+    // NOTE: we accept arguments in bytes instead of bits here.
+    constructor(blockLen, suffix, outputLen, enableXOF = false, rounds = 24) {
+        anumber(blockLen, 'blockLen');
+        anumber(suffix, 'suffix');
+        anumber(rounds, 'rounds');
+        abool$1(enableXOF, 'enableXOF');
+        this.blockLen = blockLen;
+        this.suffix = suffix;
+        this.outputLen = outputLen;
+        this.enableXOF = enableXOF;
+        this.canXOF = enableXOF;
+        this.rounds = rounds;
+        // Can be passed from user as dkLen
+        anumber(outputLen, 'outputLen');
+        // Only keccak-f1600 is supported: 1600 bits (5x5 matrix of 64bit) === 200 bytes of state.
+        if (!(0 < blockLen && blockLen < 200))
+            throw new Error('"blockLen" must be 1..199');
+        this.state = new Uint8Array(200);
+        this.state32 = u32(this.state);
+    }
+    clone() {
+        return this._cloneInto();
+    }
+    keccak() {
+        swap32IfBE(this.state32);
+        keccakP(this.state32, this.rounds);
+        swap32IfBE(this.state32);
+        this.posOut = 0;
+        this.pos = 0;
+    }
+    update(data) {
+        aexists(this);
+        abytes(data);
+        const { blockLen, state, state32 } = this;
+        const len = data.length;
+        // Absorb full blocks with u32 XORs when both sides are 4-byte aligned.
+        // XOR of same-position words equals XOR of same-position bytes, so this is endianness-safe.
+        const canUseU32 = blockLen % 4 === 0 && data.byteOffset % 4 === 0;
+        const blockLen32 = blockLen / 4;
+        const data32 = canUseU32 && len >= blockLen ? u32(data) : undefined;
+        for (let pos = 0; pos < len;) {
+            if (data32 !== undefined && this.pos === 0 && pos % 4 === 0 && len - pos >= blockLen) {
+                for (let i = 0, o = pos / 4; i < blockLen32; i++)
+                    state32[i] ^= data32[o + i];
+                pos += blockLen;
+                // Subclasses (_KeccakPRG) read `this.pos` inside their `keccak()` override,
+                // so it must reflect the fully-absorbed block before the permutation fires.
+                this.pos = blockLen;
+                this.keccak();
+                continue;
+            }
+            const take = Math.min(blockLen - this.pos, len - pos);
+            for (let i = 0; i < take; i++)
+                state[this.pos++] ^= data[pos++];
+            if (this.pos === blockLen)
+                this.keccak();
+        }
+        return this;
+    }
+    finish() {
+        if (this.finished)
+            return;
+        this.finished = true;
+        const { state, suffix, pos, blockLen } = this;
+        // FIPS 202 appends the SHA3/SHAKE domain-separation suffix before pad10*1.
+        // These byte values already include the first padding bit, while the
+        // final `0x80` below supplies the closing `1` bit in the last rate byte.
+        state[pos] ^= suffix;
+        // If that combined suffix lands in the last rate byte and already sets
+        // bit 7, absorb it first so the final pad10*1 bit can be xored into a
+        // fresh block.
+        if ((suffix & 0x80) !== 0 && pos === blockLen - 1)
+            this.keccak();
+        state[blockLen - 1] ^= 0x80;
+        this.keccak();
+    }
+    writeInto(out) {
+        aexists(this, false);
+        abytes(out);
+        this.finish();
+        const bufferOut = this.state;
+        const { blockLen } = this;
+        for (let pos = 0, len = out.length; pos < len;) {
+            if (this.posOut >= blockLen)
+                this.keccak();
+            const take = Math.min(blockLen - this.posOut, len - pos);
+            out.set(bufferOut.subarray(this.posOut, this.posOut + take), pos);
+            this.posOut += take;
+            pos += take;
+        }
+        return out;
+    }
+    xofInto(out) {
+        // Plain SHA3/Keccak usage with XOF is probably a mistake, but this base
+        // class is also reused by SHAKE/cSHAKE/KMAC/TupleHash/ParallelHash/
+        // TurboSHAKE/KangarooTwelve wrappers that intentionally enable XOF.
+        if (!this.enableXOF)
+            throw new Error('XOF is not enabled');
+        return this.writeInto(out);
+    }
+    xof(bytes) {
+        anumber(bytes);
+        return this.xofInto(new Uint8Array(bytes));
+    }
+    digestInto(out) {
+        aoutput(out, this);
+        if (this.finished)
+            throw new Error('digest() was already called');
+        // `aoutput(...)` allows oversized buffers; digestInto() must fill only the advertised digest.
+        this.writeInto(out.length === this.outputLen ? out : out.subarray(0, this.outputLen));
+        this.destroy();
+    }
+    digest() {
+        const out = new Uint8Array(this.outputLen);
+        this.digestInto(out);
+        return out;
+    }
+    destroy() {
+        this.destroyed = true;
+        clean(this.state);
+    }
+    _cloneInto(to) {
+        const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
+        to ||= new Keccak(blockLen, suffix, outputLen, enableXOF, rounds);
+        // Reused destinations can come from a different rate/capacity variant, so clone must rewrite
+        // the sponge geometry as well as the state words.
+        to.blockLen = blockLen;
+        to.state32.set(this.state32);
+        // Sponge padding and XOF output are positional, so both offsets are part of the clone state.
+        to.pos = this.pos;
+        to.posOut = this.posOut;
+        to.finished = this.finished;
+        to.rounds = rounds;
+        // Suffix can change in cSHAKE
+        to.suffix = suffix;
+        to.outputLen = outputLen;
+        to.enableXOF = enableXOF;
+        // Clones must preserve the public capability bit too; `_KMAC` reuses this path and deep clone
+        // tests compare instance fields directly, so leaving `canXOF` behind makes the clone lie.
+        to.canXOF = this.canXOF;
+        to.destroyed = this.destroyed;
+        return to;
+    }
+}
+const genShake = (suffix, blockLen, outputLen, info = {}) => createHasher((opts = {}) => {
+    opts = checkOpts({}, opts);
+    return new Keccak(blockLen, suffix, opts.dkLen === undefined ? outputLen : opts.dkLen, true);
+}, info);
+/**
+ * SHAKE128 XOF with 128-bit security and a 16-byte default output.
+ * @param msg - message bytes to hash
+ * @param opts - Optional output-length override. See {@link ShakeOpts}.
+ * @returns Digest bytes.
+ * @example
+ * Hash a message with SHAKE128.
+ * ```ts
+ * shake128(new Uint8Array([97, 98, 99]), { dkLen: 32 });
+ * ```
+ */
+const shake128 = 
+/* @__PURE__ */
+genShake(0x1f, 168, 16, /* @__PURE__ */ oidNist(0x0b));
+/**
+ * SHAKE256 XOF with 256-bit security and a 32-byte default output.
+ * @param msg - message bytes to hash
+ * @param opts - Optional output-length override. See {@link ShakeOpts}.
+ * @returns Digest bytes.
+ * @example
+ * Hash a message with SHAKE256.
+ * ```ts
+ * shake256(new Uint8Array([97, 98, 99]), { dkLen: 64 });
+ * ```
+ */
+const shake256 = 
+/* @__PURE__ */
+genShake(0x1f, 136, 32, /* @__PURE__ */ oidNist(0x0c));
+
+/**
+ * Experimental implementation of NTT / FFT (Fast Fourier Transform) over finite fields.
+ * API may change at any time. The code has not been audited. Feature requests are welcome.
+ * @module
+ */
+function checkU32(n, title = 'n') {
+    // 0xff_ff_ff_ff
+    if (typeof n !== 'number')
+        throw new TypeError(`wrong u32 integer "${title}": expected number, got type=${typeof n}`);
+    if (!Number.isSafeInteger(n) || n < 0 || n > 0xffffffff)
+        throw new RangeError(`wrong u32 integer "${title}": expected 0..4294967295, got ${n}`);
+    return n;
+}
+/**
+ * Checks if integer is in form of `1 << X`.
+ * @param x - Integer to inspect.
+ * @returns `true` when the value is a power of two.
+ * @example
+ * Validate that an FFT size is a power of two.
+ *
+ * ```ts
+ * isPowerOfTwo(8);
+ * ```
+ */
+function isPowerOfTwo(x) {
+    checkU32(x, 'x');
+    return (x & (x - 1)) === 0 && x !== 0;
+}
+/**
+ * @param n - Value to reverse.
+ * @param bits - Number of bits to use.
+ * @returns Bit-reversed integer.
+ * @throws If `n` is not a valid unsigned 32-bit integer. {@link Error}
+ * @example
+ * Reverse the low `bits` bits of one index.
+ *
+ * ```ts
+ * reverseBits(3, 3);
+ * ```
+ */
+function reverseBits(n, bits) {
+    checkU32(n);
+    if (typeof bits !== 'number')
+        throw new TypeError('"bits" expected number, got type=' + typeof bits);
+    if (!Number.isSafeInteger(bits) || bits < 0 || bits > 32)
+        throw new Error(`expected integer 0 <= bits <= 32, got ${bits}`);
+    let reversed = 0;
+    for (let i = 0; i < bits; i++, n >>>= 1)
+        reversed = (reversed << 1) | (n & 1);
+    // JS bitwise ops are signed i32; cast back so 32-bit reversals stay in the unsigned u32 domain.
+    return reversed >>> 0;
+}
+/**
+ * Similar to `bitLen(x)-1` but much faster for small integers, like indices.
+ * @param n - Input value.
+ * @returns Base-2 logarithm. For `n = 0`, the current implementation returns `-1`.
+ * @example
+ * Compute the radix-2 stage count for one transform size.
+ *
+ * ```ts
+ * log2(8);
+ * ```
+ */
+function log2(n) {
+    checkU32(n);
+    return 31 - Math.clz32(n);
+}
+/**
+ * Moves lowest bit to highest position, which at first step splits
+ * array on even and odd indices, then it applied again to each part,
+ * which is core of fft
+ * @param values - Mutable coefficient array.
+ * @returns Mutated input array.
+ * @throws If the array length is not a positive power of two. {@link Error}
+ * @example
+ * Reorder coefficients into bit-reversed order in place.
+ *
+ * ```ts
+ * const values = Uint8Array.from([0, 1, 2, 3]);
+ * bitReversalInplace(values);
+ * ```
+ */
+function bitReversalInplace(values) {
+    if (!values ||
+        typeof values !== 'object' ||
+        typeof values.length !== 'number')
+        throw new TypeError('"values" expected array-like, got type=' + typeof values);
+    const n = values.length;
+    // Size-1 FFT is the identity, so bit-reversal must stay a no-op there instead of rejecting it.
+    if (!isPowerOfTwo(n))
+        throw new Error('expected positive power-of-two length, got ' + n);
+    const bits = log2(n);
+    for (let i = 0; i < n; i++) {
+        const j = reverseBits(i, bits);
+        if (i < j) {
+            const tmp = values[i];
+            values[i] = values[j];
+            values[j] = tmp;
+        }
+    }
+    return values;
+}
+/**
+ * Constructs different flavors of FFT. radix2 implementation of low level mutating API. Flavors:
+ *
+ * - DIT (Decimation-in-Time): Bottom-Up (leaves to root), Cooley-Tukey
+ * - DIF (Decimation-in-Frequency): Top-Down (root to leaves), Gentleman-Sande
+ *
+ * DIT takes brp input, returns natural output.
+ * DIF takes natural input, returns brp output.
+ *
+ * The output is actually identical. Time / frequence distinction is not meaningful
+ * for Polynomial multiplication in fields.
+ * Which means if protocol supports/needs brp output/inputs, then we can skip this step.
+ *
+ * Cyclic NTT: Rq = Zq[x]/(x^n-1). butterfly_DIT+loop_DIT OR butterfly_DIF+loop_DIT, roots are omega
+ * Negacyclic NTT: Rq = Zq[x]/(x^n+1). butterfly_DIT+loop_DIF, at least for mlkem / mldsa
+ *
+ * `invertButterflies` indexes roots by a per-butterfly-group counter (`grp`): forward
+ * (`dit: false`) reads `roots[grp]` with grp = 1..; inverse (`dit: true`) reads `roots[N - grp]`
+ * with grp restarting at 1. With `skipStages: 0` one table serves both directions (ωᴺ = 1 makes
+ * the reversed walk self-inverse). With `skipStages > 0` the inverse walk starts at `N - 1`
+ * instead of continuing where the skipped stages would have left off, so the caller must supply
+ * a table shaped for that (ML-KEM: `ζ^BitRev7(i)` over all N=256 indices, whose aliased upper
+ * half is exactly the FIPS 203 inverse walk).
+ * @param F - Field operations.
+ * @param coreOpts - FFT configuration. See {@link FFTCoreOpts}:
+ *   - `N`: Transform size. Must be a power of two.
+ *   - `roots`: Stage roots for the selected transform size.
+ *   - `dit`: Whether to run the DIT variant instead of DIF.
+ *   - `invertButterflies` (optional): Whether to invert butterfly placement.
+ *   - `skipStages` (optional): Number of initial stages to skip.
+ *   - `brp` (optional): Whether to apply bit-reversal permutation at the boundary.
+ * @returns Low-level FFT loop.
+ * @throws If the FFT options or cached roots are invalid for the requested size. {@link Error}
+ * @example
+ * Constructs different flavors of FFT.
+ *
+ * ```ts
+ * import { FFTCore, rootsOfUnity } from '@noble/curves/abstract/fft.js';
+ * import { Field } from '@noble/curves/abstract/modular.js';
+ * const Fp = Field(17n);
+ * const roots = rootsOfUnity(Fp).roots(2);
+ * const loop = FFTCore(Fp, { N: 4, roots, dit: true });
+ * const values = loop([1n, 2n, 3n, 4n]);
+ * ```
+ */
+const FFTCore = (F, coreOpts) => {
+    validateObject(coreOpts, { N: 'number', roots: 'object', dit: 'boolean' }, { invertButterflies: 'boolean', skipStages: 'number', brp: 'boolean' }, 'coreOpts');
+    const { N, roots, dit, invertButterflies = false, skipStages = 0, brp = true } = coreOpts;
+    checkU32(N, 'coreOpts.N');
+    const bits = log2(N);
+    if (!isPowerOfTwo(N))
+        throw new Error('FFT: Polynomial size should be power of two');
+    checkU32(skipStages, 'coreOpts.skipStages');
+    const maxSkipStages = bits === 0 ? 0 : bits - 1;
+    // Skipping every stage leaves only boundary layout changes, not a valid FFT loop shape.
+    if (skipStages > maxSkipStages)
+        throw new Error(`FFT: wrong skipStages: expected 0 <= skipStages <= ${maxSkipStages}`);
+    // Wrong-sized root tables can stay in-bounds for some loop shapes and silently compute nonsense.
+    if (roots.length !== N)
+        throw new Error(`FFT: wrong roots length: expected ${N}, got ${roots.length}`);
+    const isDit = dit !== invertButterflies;
+    return (values) => {
+        if (values.length !== N)
+            throw new Error('FFT: wrong Polynomial length');
+        if (dit && brp)
+            bitReversalInplace(values);
+        for (let i = 0, g = 1; i < bits - skipStages; i++) {
+            // For each stage s (sub-FFT length m = 2^s)
+            const s = dit ? i + 1 + skipStages : bits - i;
+            const m = 1 << s;
+            const m2 = m >> 1;
+            const stride = N >> s;
+            // Loop over each subarray of length m
+            for (let k = 0; k < N; k += m) {
+                // Loop over each butterfly within the subarray
+                for (let j = 0, grp = g++; j < m2; j++) {
+                    const rootPos = invertButterflies ? (dit ? N - grp : grp) : j * stride;
+                    const i0 = k + j;
+                    const i1 = k + j + m2;
+                    const omega = roots[rootPos];
+                    const b = values[i1];
+                    const a = values[i0];
+                    // Inlining gives us 10% perf in kyber vs functions
+                    if (isDit) {
+                        const t = F.mul(b, omega); // Standard DIT butterfly
+                        values[i0] = F.add(a, t);
+                        values[i1] = F.sub(a, t);
+                    }
+                    else if (invertButterflies) {
+                        values[i0] = F.add(b, a); // DIT loop + inverted butterflies (Kyber decode)
+                        values[i1] = F.mul(F.sub(b, a), omega);
+                    }
+                    else {
+                        values[i0] = F.add(a, b); // Standard DIF butterfly
+                        values[i1] = F.mul(F.sub(a, b), omega);
+                    }
+                }
+            }
+        }
+        if (!dit && brp)
+            bitReversalInplace(values);
+        return values;
+    };
+};
+
+/**
+ * Utilities for hex, bytearray and number handling.
+ * @module
+ */
+/*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
+/**
+ * Asserts that a value is a byte array and optionally checks its length.
+ * Returns the original reference unchanged on success, and currently also accepts Node `Buffer`
+ * values through the upstream validator.
+ * This helper throws on malformed input, so APIs that must return `false` need to guard lengths
+ * before decoding or before calling it.
+ * @example
+ * Validate that a value is a byte array with the expected length.
+ * ```ts
+ * abytes(new Uint8Array([1]), 1);
+ * ```
+ */
+const abytesDoc = abytes;
+/**
+ * Returns cryptographically secure random bytes.
+ * Requires `globalThis.crypto.getRandomValues` and throws if that API is unavailable.
+ * `bytesLength` is validated by the upstream helper as a non-negative integer before allocation,
+ * so negative and fractional values both throw instead of truncating through JS `ToIndex`.
+ * @param bytesLength - Number of random bytes to generate.
+ * @returns Fresh random bytes.
+ * @example
+ * Generate a fresh random seed.
+ * ```ts
+ * const seed = randomBytes(4);
+ * ```
+ */
+const randomBytes = randomBytes$1;
+function aarray(item, title, inner = () => { }) {
+    if (!Array.isArray(item))
+        throw new TypeError(`"${title}" expected array, got type=${typeof item}`);
+    for (let i = 0; i < item.length; i++)
+        inner(item[i], `${title}[${i}]`);
+    return item;
+}
+function aobject(value, title = 'object') {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new TypeError(title === 'object'
+            ? 'expected valid options object'
+            : `"${title}" expected object, got type=${typeof value}`);
+    return value;
+}
+/**
+ * Compares two byte arrays in a length-constant way for equal lengths.
+ * Inputs are validated as byte arrays; unequal lengths return `false` immediately.
+ * @param a - First byte array.
+ * @param b - Second byte array.
+ * @returns Whether both arrays contain the same bytes.
+ * @example
+ * Compare two byte arrays for equality.
+ * ```ts
+ * equalBytes(new Uint8Array([1]), new Uint8Array([1]));
+ * ```
+ */
+function equalBytes(a, b) {
+    a = abytes(a);
+    b = abytes(b);
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+/**
+ * Validates that an options bag is a plain object.
+ * @param opts - Options object to validate.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Validate that an options bag is a plain object.
+ * ```ts
+ * validateOpts({});
+ * ```
+ */
+function validateOpts(opts) {
+    // Arrays silently passed here before, but these call sites expect named option-bag fields.
+    if (isBytes(opts))
+        throw new TypeError('"opts" expected object, got Uint8Array');
+    aobject(opts, 'opts');
+    const proto = Object.getPrototypeOf(opts);
+    // Options are security parameters, not general class instances. Restricting the bag to own
+    // properties prevents values injected through Object.prototype (or a custom shared prototype)
+    // from silently changing signing behavior. Null-prototype records remain supported.
+    if (proto !== null && proto !== Object.prototype)
+        throw new TypeError('"opts" expected a plain object');
+}
+// Frozen because they are exported: an unfrozen array export lets anything in the
+// process push a key onto the accepted set and silently re-open exactly the hole this
+// validation closes.
+/** Keys accepted by `verify`. */
+const VER_OPT_KEYS = /* @__PURE__ */ Object.freeze([
+    'context',
+]);
+/** Keys accepted by `sign`. */
+const SIG_OPT_KEYS = /* @__PURE__ */ Object.freeze([
+    'context',
+    'extraEntropy',
+]);
+/**
+ * Rejects option keys the caller did not mean to set.
+ *
+ * Validating the types of known keys while ignoring unknown ones makes a typo
+ * indistinguishable from an omission, and for these options an omission is a
+ * security downgrade rather than a no-op: `{ ctx }` instead of `{ context }` signs
+ * with no domain separation, succeeds, and verifies for anyone who also supplies
+ * none. Nothing at any layer reports it. TypeScript catches this through excess
+ * property checks, so the exposure is JavaScript callers specifically.
+ *
+ * @param opts - Options object to check.
+ * @param allowed - The keys this call site accepts.
+ * Returns a frozen null-prototype snapshot so later reads cannot fall through to a polluted
+ * prototype. Like `checkOpts()` in noble-hashes, only enumerable own properties are copied.
+ * @throws If any other copied key is present or the bag has a custom prototype. {@link TypeError}
+ * @returns Sanitized snapshot of the enumerable own options.
+ * @example
+ * Accept a known option key. A key the list does not name, such as `ctx`, throws instead.
+ * ```ts
+ * import { checkOptKeys } from '@noble/post-quantum/utils.js';
+ * checkOptKeys({ context: new Uint8Array() }, ['context']);
+ * ```
+ */
+function checkOptKeys(opts, allowed) {
+    validateOpts(opts);
+    // Snapshot once before validation: Object.assign follows the same own-enumerable option-bag
+    // semantics as noble-hashes, while the null prototype keeps omitted fields immune to pollution.
+    const normalized = Object.assign(Object.create(null), opts);
+    for (const [k, v] of Object.entries(normalized)) {
+        // `undefined` means unset everywhere else in these validators, and building an options bag by
+        // spread is a normal way to reach these calls, so present-but-undefined stays equivalent to
+        // omission.
+        if (v === undefined)
+            continue;
+        if (!allowed.includes(k))
+            throw new TypeError('unexpected option "' + String(k) + '"; expected one of: ' + allowed.join(', '));
+    }
+    return Object.freeze(normalized);
+}
+/**
+ * Validates common verification options.
+ * `context` itself is validated with `abytes(...)`, and individual algorithms may narrow support
+ * further after this shared plain-object gate.
+ * @param opts - Verification options. See {@link VerOpts}.
+ * @param allowed - Keys this call site accepts. Defaults to {@link VER_OPT_KEYS}; surfaces that
+ * take extra keys, or take fewer, pass their own list.
+ * @throws On wrong argument types. {@link TypeError}
+ * @returns Frozen null-prototype snapshot of the validated options.
+ * @example
+ * Validate common verification options.
+ * ```ts
+ * validateVerOpts({ context: new Uint8Array([1]) });
+ * ```
+ */
+function validateVerOpts(opts, allowed = VER_OPT_KEYS) {
+    const normalized = checkOptKeys(opts, allowed);
+    if (normalized.context !== undefined)
+        abytes(normalized.context, undefined, 'opts.context');
+    return normalized;
+}
+/**
+ * Validates common signing options.
+ * `extraEntropy` is validated with `abytes(...)`; exact lengths and extra algorithm-specific
+ * restrictions are enforced later by callers.
+ * @param opts - Signing options. See {@link SigOpts}.
+ * @param allowed - Keys this call site accepts. Defaults to {@link SIG_OPT_KEYS}; surfaces that
+ * take extra keys, or take fewer, pass their own list.
+ * @throws On wrong argument types. {@link TypeError}
+ * @returns Frozen null-prototype snapshot of the validated options.
+ * @example
+ * Validate common signing options.
+ * ```ts
+ * validateSigOpts({ extraEntropy: new Uint8Array([1]) });
+ * ```
+ */
+function validateSigOpts(opts, allowed = SIG_OPT_KEYS) {
+    const normalized = checkOptKeys(opts, allowed);
+    if (normalized.context !== undefined)
+        abytes(normalized.context, undefined, 'opts.context');
+    if (normalized.extraEntropy !== false && normalized.extraEntropy !== undefined)
+        abytes(normalized.extraEntropy, undefined, 'opts.extraEntropy');
+    return normalized;
+}
+/**
+ * Builds a fixed-layout coder from byte lengths and nested coders.
+ * Raw-length fields decode as zero-copy `subarray(...)` views, and nested coders may preserve that
+ * aliasing too. Nested coder `encode(...)` results are treated as owned scratch: `splitCoder`
+ * copies them into the output and then zeroizes them with `fill(0)`. If a nested encoder forwards
+ * caller-owned bytes, it must do so only after detaching them into a disposable copy.
+ * @param label - Label used in validation errors.
+ * @param lengths - Field lengths or nested coders.
+ * @returns Composite fixed-length coder.
+ * @example
+ * Build a fixed-layout coder from byte lengths and nested coders.
+ * ```ts
+ * splitCoder('demo', 1, 2).encode([new Uint8Array([1]), new Uint8Array([2, 3])]);
+ * ```
+ */
+function splitCoder(label, ...lengths) {
+    const getLength = (c) => typeof c === 'number' ? c : c.bytesLen;
+    const bytesLen = lengths.reduce((sum, a) => sum + getLength(a), 0);
+    return {
+        bytesLen,
+        encode: (bufs) => {
+            const res = new Uint8Array(bytesLen);
+            for (let i = 0, pos = 0; i < lengths.length; i++) {
+                const c = lengths[i];
+                const l = getLength(c);
+                const b = typeof c === 'number' ? bufs[i] : c.encode(bufs[i]);
+                abytes(b, l, label);
+                res.set(b, pos);
+                if (typeof c !== 'number')
+                    b.fill(0); // clean
+                pos += l;
+            }
+            return res;
+        },
+        decode: (buf) => {
+            abytes(buf, bytesLen, label);
+            const res = [];
+            for (const c of lengths) {
+                const l = getLength(c);
+                const b = buf.subarray(0, l);
+                res.push(typeof c === 'number' ? b : c.decode(b));
+                buf = buf.subarray(l);
+            }
+            return res;
+        },
+    };
+}
+// nano-packed.array (fixed size)
+/**
+ * Builds a fixed-length vector coder from another fixed-length coder.
+ * Element decoding receives `subarray(...)` views, so aliasing depends on the element coder.
+ * Element coder `encode(...)` results are treated as owned scratch: `vecCoder` copies them into
+ * the output and then zeroizes them with `fill(0)`. If an element encoder forwards caller-owned
+ * bytes, it must do so only after detaching them into a disposable copy. `vecCoder` also trusts
+ * the `BytesCoderLen` contract: each encoded element must already be exactly `c.bytesLen` bytes.
+ * @param c - Element coder.
+ * @param vecLen - Number of elements in the vector.
+ * @returns Fixed-length vector coder.
+ * @example
+ * Build a fixed-length vector coder from another fixed-length coder.
+ * ```ts
+ * vecCoder(
+ *   { bytesLen: 1, encode: (n: number) => Uint8Array.of(n), decode: (b: Uint8Array) => b[0] || 0 },
+ *   2
+ * ).encode([1, 2]);
+ * ```
+ */
+function vecCoder(c, vecLen) {
+    const coder = c;
+    const bytesLen = vecLen * coder.bytesLen;
+    return {
+        bytesLen,
+        encode: (u) => {
+            const uArr = aarray(u, 'u');
+            if (uArr.length !== vecLen)
+                throw new RangeError(`vecCoder.encode: wrong length=${uArr.length}. Expected: ${vecLen}`);
+            const res = new Uint8Array(bytesLen);
+            for (let i = 0, pos = 0; i < uArr.length; i++) {
+                const b = coder.encode(uArr[i]);
+                res.set(b, pos);
+                b.fill(0); // clean
+                pos += b.length;
+            }
+            return res;
+        },
+        decode: (a) => {
+            abytes(a, bytesLen);
+            const r = [];
+            for (let i = 0; i < a.length; i += coder.bytesLen)
+                r.push(coder.decode(a.subarray(i, i + coder.bytesLen)));
+            return r;
+        },
+    };
+}
+/**
+ * Overwrites supported typed-array inputs with zeroes in place.
+ * Accepts direct typed arrays and one-level arrays of them.
+ * @param list - Typed arrays or one-level lists of typed arrays to clear.
+ * @example
+ * Overwrite typed arrays with zeroes.
+ * ```ts
+ * const buf = Uint8Array.of(1, 2, 3);
+ * cleanBytes(buf);
+ * ```
+ */
+function cleanBytes(...list) {
+    for (const t of list) {
+        if (Array.isArray(t))
+            for (const b of t)
+                b.fill(0);
+        else
+            t.fill(0);
+    }
+}
+/**
+ * Creates a 32-bit mask with the lowest `bits` bits set.
+ * @param bits - Number of low bits to keep.
+ * @returns Bit mask with `bits` ones.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Create a low-bit mask for packed-field operations.
+ * ```ts
+ * const mask = getMask(4);
+ * ```
+ */
+function getMask(bits) {
+    anumber(bits, 'bits');
+    if (bits > 32)
+        throw new RangeError('"bits" expected <= 32, got ' + bits);
+    // JS shifts are modulo 32, so bit 32 needs an explicit full-width mask.
+    return bits === 32 ? 0xffffffff : ~(-1 << bits) >>> 0;
+}
+/** Shared empty byte array used as the default context. */
+const EMPTY = /* @__PURE__ */ Uint8Array.of();
+/**
+ * Builds the domain-separated message payload for the pure sign/verify paths.
+ * Context length `255` is valid; only `ctx.length > 255` is rejected.
+ * @param msg - Message bytes.
+ * @param ctx - Optional context bytes.
+ * @returns Domain-separated message payload.
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Build the domain-separated payload before direct signing.
+ * ```ts
+ * const payload = getMessage(new Uint8Array([1, 2]));
+ * ```
+ */
+function getMessage(msg, ctx = EMPTY) {
+    abytes(msg, undefined, 'msg');
+    abytes(ctx, undefined, 'ctx');
+    if (ctx.length > 255)
+        throw new RangeError('context should be 255 bytes or less');
+    return concatBytes(new Uint8Array([0, ctx.length]), ctx, msg);
+}
+// DER tag+length plus the shared NIST hash OID arc 2.16.840.1.101.3.4.2.* used by the
+// FIPS 204 / FIPS 205 pre-hash wrappers; the final byte selects SHA-256, SHA-512, SHAKE128,
+// SHAKE256, or another approved hash/XOF under that subtree.
+// 06 09 60 86 48 01 65 03 04 02
+const oidNistP = /* @__PURE__ */ Uint8Array.from([6, 9, 0x60, 0x86, 0x48, 1, 0x65, 3, 4, 2]);
+/**
+ * Output length, in bytes, that each XOF OID under this arc denotes.
+ *
+ * Unlike a fixed hash, an XOF's OID is a promise about the digest length: RFC 8702
+ * defines id-shake128 as SHAKE128 with 256-bit output and id-shake256 as SHAKE256 with
+ * 512-bit output, and FIPS 204 / FIPS 205 use exactly those pairings for pre-hash. Both
+ * bare noble-hashes defaults are half these values, so neither can be signed under its
+ * own OID.
+ */
+const XOF_OID_OUTPUT_LEN = /* @__PURE__ */ (() => ({
+    '060960864801650304020b': 32, // id-shake128, SHAKE128(M, 256)
+    '060960864801650304020c': 64, // id-shake256, SHAKE256(M, 512)
+}))();
+/**
+ * Validates that a hash exposes a NIST hash OID and enough collision resistance.
+ * Current accepted surface is broader than the FIPS algorithm tables: any hash/XOF under the NIST
+ * `2.16.840.1.101.3.4.2.*` subtree is accepted if its effective `outputLen` is strong enough.
+ * XOF callers must pass a callable whose `outputLen` matches the digest length they actually intend
+ * to sign; bare `shake128` / `shake256` defaults are too short for the stronger prehash modes.
+ * @param hash - Hash function to validate.
+ * @param requiredStrength - Minimum required collision-resistance strength in bits.
+ * @throws If the hash metadata or collision resistance is insufficient. {@link Error}
+ * @example
+ * Validate that a hash exposes a NIST hash OID and enough collision resistance.
+ * ```ts
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * import { checkHash } from '@noble/post-quantum/utils.js';
+ * checkHash(sha256, 128);
+ * ```
+ */
+function checkHash(hash, requiredStrength = 0) {
+    if (typeof hash !== 'function' || typeof hash.create !== 'function')
+        throw new TypeError('"hash" expected hash function, got type=' + typeof hash);
+    ahash(hash);
+    anumber(requiredStrength, 'requiredStrength');
+    const oid = hash.oid;
+    abytes(oid, undefined, 'hash.oid');
+    if (!equalBytes(oid.subarray(0, 10), oidNistP))
+        throw new Error('"hash.oid" is invalid: expected NIST hash');
+    // FIPS 204 / FIPS 205 require both collision and second-preimage strength; for approved NIST
+    // hashes/XOFs under this OID subtree, the collision bound from the configured digest length is
+    // the tighter runtime check, so enforce that lower bound here.
+    // XOFs under this arc are identified by an OID that fixes their output length:
+    // FIPS 204 §5.4.1 (SHAKE128) and FIPS 205 §10.2.2 (both SHAKEs), matching RFC 8702, pair
+    // id-shake128 with SHAKE128(M, 256) and id-shake256 with SHAKE256(M, 512). getMessagePrehash embeds
+    // hash.oid beside hash(msg), so a shorter digest signs an M' that claims a length
+    // it does not have: noble-hashes' bare shake256 defaults to 32 bytes and cleared
+    // the collision bound at the 128-bit level, producing signatures a conformant
+    // verifier rejects because it recomputes 512 bits. Check the length the OID
+    // denotes rather than the generic bound.
+    const xofLen = XOF_OID_OUTPUT_LEN[bytesToHex(oid)];
+    if (xofLen !== undefined && hash.outputLen !== xofLen) {
+        throw new Error('Pre-hash XOF output length must be ' + xofLen + ' bytes for this OID, got: ' + hash.outputLen);
+    }
+    const collisionResistance = (hash.outputLen * 8) / 2;
+    if (requiredStrength > collisionResistance) {
+        throw new Error('Pre-hash security strength too low: ' +
+            collisionResistance +
+            ', required: ' +
+            requiredStrength);
+    }
+}
+/**
+ * Builds the domain-separated prehash payload for the prehash sign/verify paths.
+ * Callers are expected to vet `hash.oid` first, e.g. via `checkHash(...)`; calling this helper
+ * directly with a hash object that lacks `oid` currently throws later inside `concatBytes(...)`.
+ * Context length `255` is valid; only `ctx.length > 255` is rejected.
+ * @param hash - Prehash function.
+ * @param msg - Message bytes.
+ * @param ctx - Optional context bytes.
+ * @returns Domain-separated prehash payload.
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Build the domain-separated prehash payload for external hashing.
+ * ```ts
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * import { getMessagePrehash } from '@noble/post-quantum/utils.js';
+ * getMessagePrehash(sha256, new Uint8Array([1, 2]));
+ * ```
+ */
+function getMessagePrehash(hash, msg, ctx = EMPTY) {
+    checkHash(hash);
+    abytes(msg, undefined, 'msg');
+    abytes(ctx, undefined, 'ctx');
+    if (ctx.length > 255)
+        throw new RangeError('context should be 255 bytes or less');
+    const hashed = hash(msg);
+    return concatBytes(new Uint8Array([1, ctx.length]), ctx, hash.oid, hashed);
+}
+
+/**
+ * Internal methods for lattice-based ML-KEM and ML-DSA.
+ * @module
+ */
+/*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
+/**
+ * Creates shared modular arithmetic, NTT, and packing helpers for CRYSTALS schemes.
+ * @param opts - Polynomial and transform parameters. See {@link CrystalOpts}.
+ * @returns CRYSTALS arithmetic and encoding helpers.
+ * @example
+ * Create shared modular arithmetic and NTT helpers for a CRYSTALS parameter set.
+ * ```ts
+ * const crystals = genCrystals({
+ *   newPoly: (n) => new Uint16Array(n),
+ *   N: 256,
+ *   Q: 3329,
+ *   F: 3303,
+ *   ROOT_OF_UNITY: 17,
+ *   brvBits: 7,
+ *   isKyber: true,
+ * });
+ * const reduced = crystals.mod(-1);
+ * ```
+ */
+const genCrystals = (opts) => {
+    // isKyber: true means Kyber, false means Dilithium
+    const { newPoly, N, Q, F, ROOT_OF_UNITY, brvBits} = opts;
+    // Normalize JS `%` into the canonical Z_m representative `[0, modulo-1]` expected by
+    // FIPS 203 §2.3 / FIPS 204 §2.3 before downstream mod-q arithmetic.
+    const mod = (a, modulo = Q) => {
+        const result = (a % modulo) | 0;
+        return (result >= 0 ? result | 0 : (modulo + result) | 0) | 0;
+    };
+    // FIPS 204 §7.4 uses the centered `mod ±` representative for low bits, keeping the
+    // positive midpoint when `modulo` is even.
+    // Center to `[-floor((modulo-1)/2), floor(modulo/2)]`.
+    const smod = (a, modulo = Q) => {
+        const r = mod(a, modulo) | 0;
+        return (r > modulo >> 1 ? (r - modulo) | 0 : r) | 0;
+    };
+    // Kyber uses the FIPS 203 Appendix A `BitRev_7` table here via the first 128 entries, while
+    // Dilithium uses the FIPS 204 §7.5 / Appendix B `BitRev_8` zetas table over all 256 entries.
+    function getZettas() {
+        const out = newPoly(N);
+        for (let i = 0; i < N; i++) {
+            const b = reverseBits(i, brvBits);
+            const p = BigInt(ROOT_OF_UNITY) ** BigInt(b) % BigInt(Q);
+            out[i] = Number(p) | 0;
+        }
+        return out;
+    }
+    const nttZetas = getZettas();
+    // Number-Theoretic Transform
+    // Explained: https://electricdusk.com/ntt.html
+    // Kyber has slightly different params, since there is no 512th primitive root of unity mod q,
+    // only 256th primitive root of unity mod. Which also complicates MultiplyNTT.
+    const inv = (_a) => {
+        throw new Error('not implemented');
+    };
+    // ML-KEM (Kyber) polynomials always enter the transform reduced to [0, Q), so add/sub only
+    // need one conditional correction instead of `%`; measured ~20% faster NTT there.
+    // ML-DSA keeps the generic mod() path on purpose: its first forward stage sees centered
+    // (negative) coefficients, and `sub(a, t)` can drop below -Q (t is a mul output in [0, Q)),
+    // so a single correction is not enough. A guarded fast path with mod() fallback was measured
+    // slower than plain `%` for the 23-bit Q (V8 int32 modulo is one div; the branches lose).
+    const field = {
+            add: (a, b) => mod((a | 0) + (b | 0)) | 0,
+            sub: (a, b) => mod((a | 0) - (b | 0)) | 0,
+            mul: (a, b) => mod((a | 0) * (b | 0)) | 0,
+            inv,
+        };
+    const nttOpts = {
+        N,
+        roots: nttZetas,
+        invertButterflies: true,
+        skipStages: 0,
+        brp: false,
+    };
+    const dif = FFTCore(field, { dit: false, ...nttOpts });
+    const dit = FFTCore(field, { dit: true, ...nttOpts });
+    const NTT = {
+        encode: (r) => {
+            return dif(r);
+        },
+        decode: (r) => {
+            dit(r);
+            // The inverse-NTT normalization factor is family-specific: FIPS 203 Algorithm 10 line 14
+            // uses `128^-1 mod q` for Kyber, while FIPS 204 Algorithm 42 lines 21-23 use `256^-1 mod q`.
+            // kyber uses 128 here, because brv && stuff
+            for (let i = 0; i < r.length; i++)
+                r[i] = mod(F * r[i]);
+            return r;
+        },
+    };
+    // Pack one little-endian `d`-bit word per coefficient, matching FIPS 203 ByteEncode /
+    // ByteDecode and the FIPS 204 BitsToBytes-based polynomial packing helpers.
+    const bitsCoder = (d, c) => {
+        // Validate the carry shape once: JS bitwise operations silently truncate wider accumulators.
+        for (let i = 0, bufLen = 0; i < N; i++) {
+            bufLen += d;
+            if (bufLen > 32)
+                getMask(bufLen);
+            bufLen %= 8;
+        }
+        const mask = getMask(d);
+        const bytesLen = d * (N / 8);
+        return {
+            bytesLen,
+            encode: (poly_) => {
+                const poly = poly_;
+                const r = new Uint8Array(bytesLen);
+                for (let i = 0, buf = 0, bufLen = 0, pos = 0; i < poly.length; i++) {
+                    buf |= (c.encode(poly[i]) & mask) << bufLen;
+                    bufLen += d;
+                    // Take the low byte directly: `& 0xff` matches the previous getMask(bufLen) result
+                    // after Uint8Array truncation, without a validated function call per output byte.
+                    for (; bufLen >= 8; bufLen -= 8, buf >>= 8)
+                        r[pos++] = buf & 0xff;
+                }
+                return r;
+            },
+            decode: (bytes) => {
+                const r = newPoly(N);
+                for (let i = 0, buf = 0, bufLen = 0, pos = 0; i < bytes.length; i++) {
+                    buf |= bytes[i] << bufLen;
+                    bufLen += 8;
+                    for (; bufLen >= d; bufLen -= d, buf >>= d)
+                        r[pos++] = c.decode(buf & mask);
+                }
+                return r;
+            },
+        };
+    };
+    return {
+        mod,
+        smod,
+        nttZetas: nttZetas,
+        NTT: {
+            encode: (r) => NTT.encode(r),
+            decode: (r) => NTT.decode(r),
+        },
+        bitsCoder: bitsCoder,
+    };
+};
+const createXofShake = (shake) => (seed, blockLen) => {
+    if (!blockLen)
+        blockLen = shake.blockLen;
+    // Optimizations that won't mater:
+    // - cached seed update (two .update(), on start and on the end)
+    // - another cache which cloned into working copy
+    // Faster than multiple updates, since seed less than blockLen
+    const _seed = new Uint8Array(seed.length + 2);
+    _seed.set(seed);
+    const seedLen = seed.length;
+    const buf = new Uint8Array(blockLen); // == shake128.blockLen
+    let h = shake.create({});
+    let calls = 0;
+    let xofs = 0;
+    return {
+        stats: () => ({ calls, xofs }),
+        get: (x, y) => {
+            // Rebind to `seed || x || y` so callers can implement the spec's per-coordinate
+            // SHAKE inputs like `rho || j || i` and `rho || IntegerToBytes(counter, 2)`.
+            _seed[seedLen + 0] = x;
+            _seed[seedLen + 1] = y;
+            h.destroy();
+            h = shake.create({}).update(_seed);
+            calls++;
+            return () => {
+                xofs++;
+                return h.xofInto(buf);
+            };
+        },
+        clean: () => {
+            h.destroy();
+            cleanBytes(buf, _seed);
+        },
+    };
+};
+/**
+ * SHAKE128-based extendable-output reader factory used by ML-KEM.
+ * `get(x, y)` selects one coordinate pair at a time; calling it again invalidates previously
+ * returned readers, and each squeeze reuses one mutable internal output buffer.
+ * @param seed - Seed bytes for the reader.
+ * @param blockLen - Optional output block length.
+ * @returns Stateful XOF reader.
+ * @example
+ * Build the ML-KEM SHAKE128 matrix expander and read one block.
+ * ```ts
+ * import { randomBytes } from '@noble/post-quantum/utils.js';
+ * import { XOF128 } from '@noble/post-quantum/_crystals.js';
+ * const reader = XOF128(randomBytes(32));
+ * const block = reader.get(0, 0)();
+ * ```
+ */
+const XOF128 = /* @__PURE__ */ createXofShake(shake128);
+/**
+ * SHAKE256-based extendable-output reader factory used by ML-DSA.
+ * `get(x, y)` appends raw one-byte coordinates to the seed, invalidates previously returned
+ * readers, and reuses one mutable internal output buffer for each squeeze.
+ * @param seed - Seed bytes for the reader.
+ * @param blockLen - Optional output block length.
+ * @returns Stateful XOF reader.
+ * @example
+ * Build the ML-DSA SHAKE256 coefficient expander and read one block.
+ * ```ts
+ * import { randomBytes } from '@noble/post-quantum/utils.js';
+ * import { XOF256 } from '@noble/post-quantum/_crystals.js';
+ * const reader = XOF256(randomBytes(32));
+ * const block = reader.get(0, 0)();
+ * ```
+ */
+const XOF256 = /* @__PURE__ */ createXofShake(shake256);
+
+/**
+ * ML-DSA: Module Lattice-based Digital Signature Algorithm from
+ * [FIPS-204](https://csrc.nist.gov/pubs/fips/204/ipd). A.k.a. CRYSTALS-Dilithium.
+ *
+ * Has similar internals to ML-KEM, but their keys and params are different.
+ * Check out [official site](https://www.pq-crystals.org/dilithium/index.shtml),
+ * [repo](https://github.com/pq-crystals/dilithium).
+ * @module
+ */
+/*! noble-post-quantum - MIT License (c) 2024 Paul Miller (paulmillr.com) */
+/**
+ * Keys each internal surface accepts.
+ *
+ * `context` is deliberately absent from both. The internal functions never read it: the
+ * public wrappers consume it when they format `M'` and must not pass it down, because a
+ * key that is accepted and then not acted on is the same silent downgrade this validation
+ * exists to prevent. `externalMu` is the mirror case, existing here and rejected above.
+ * `extraEntropy` is signing-only, so verification does not take it either.
+ */
+const INTERNAL_SIG_OPT_KEYS = /* @__PURE__ */ Object.freeze([
+    'extraEntropy',
+    'externalMu',
+]);
+const INTERNAL_VER_OPT_KEYS = /* @__PURE__ */ Object.freeze(['externalMu']);
+function validateInternalOpts(opts, allowed) {
+    const normalized = checkOptKeys(opts, allowed);
+    if (normalized.externalMu !== undefined)
+        abool(normalized.externalMu, 'opts.externalMu');
+    return normalized;
+}
+// Constants
+// FIPS 204 fixes ML-DSA over R = Z[X]/(X^256 + 1), so every polynomial has 256 coefficients.
+const N = 256;
+// 2**23 − 2**13 + 1, 23 bits: multiply will be 46. We have enough precision in JS to avoid bigints
+const Q = 8380417;
+// FIPS 204 §2.5 / Table 1 fixes zeta = 1753 as the 512th root of unity used by ML-DSA's NTT.
+const ROOT_OF_UNITY = 1753;
+// f = 256**−1 mod q, pow(256, -1, q) = 8347681 (python3)
+const F = 8347681;
+// FIPS 204 Table 1 / §7.4 fixes d = 13 dropped low bits for Power2Round on t.
+const D = 13;
+// FIPS 204 Table 1 fixes gamma2 to (q-1)/88 for ML-DSA-44 and (q-1)/32 for ML-DSA-65/87;
+// §7.4 then uses alpha = 2*gamma2 for Decompose / MakeHint / UseHint.
+// Dilithium is kinda parametrized over GAMMA2, but everything will break with any other value.
+const GAMMA2_1 = Math.floor((Q - 1) / 88) | 0;
+const GAMMA2_2 = Math.floor((Q - 1) / 32) | 0;
+/** Internal params for different versions of ML-DSA  */
+// prettier-ignore
+/** Built-in ML-DSA parameter presets keyed by security categories `2/3/5`
+ * for `ml_dsa44` / `ml_dsa65` / `ml_dsa87`.
+ * This is only the Table 1 subset used directly here: `BETA = TAU * ETA` is derived later,
+ * while `C_TILDE_BYTES`, `TR_BYTES`, `CRH_BYTES`, and `securityLevel` live in the preset wrappers.
+ */
+const PARAMS = /* @__PURE__ */ (() => Object.freeze({
+    2: Object.freeze({
+        K: 4, L: 4, D, GAMMA1: 2 ** 17, GAMMA2: GAMMA2_1, TAU: 39, ETA: 2, OMEGA: 80
+    }),
+    3: Object.freeze({
+        K: 6, L: 5, D, GAMMA1: 2 ** 19, GAMMA2: GAMMA2_2, TAU: 49, ETA: 4, OMEGA: 55
+    }),
+    5: Object.freeze({
+        K: 8, L: 7, D, GAMMA1: 2 ** 19, GAMMA2: GAMMA2_2, TAU: 60, ETA: 2, OMEGA: 75
+    }),
+}))();
+const newPoly = (n) => new Int32Array(n);
+// Shared CRYSTALS helper in the ML-DSA branch: non-Kyber mode, 8-bit bit-reversal,
+// and Int32Array polys because ordinary-form coefficients can be negative / centered.
+const crystals = /* @__PURE__ */ genCrystals({
+    N,
+    Q,
+    F,
+    ROOT_OF_UNITY,
+    newPoly,
+    brvBits: 8,
+});
+const id = (n) => n;
+// compress()/verify() must be compatible in both directions:
+// wrap the shared d-bit packer with the FIPS 204 SimpleBitPack / BitPack coefficient maps.
+// malformed-input rejection only happens through the optional verify hook.
+const polyCoder = (d, compress = id, verify = id) => crystals.bitsCoder(d, {
+    encode: (i) => compress(verify(i)),
+    decode: (i) => verify(compress(i)),
+});
+// Mutates `a` in place; callers must pass same-length polynomials.
+// NOTE: conditional-reduction variants (as in ml-kem) were measured performance-neutral here —
+// int32 `%` with 23-bit Q is already cheap — so the simpler mod() form is kept for audit.
+const polyAdd = (a_, b_) => {
+    const a = a_;
+    const b = b_;
+    for (let i = 0; i < a.length; i++)
+        a[i] = crystals.mod(a[i] + b[i]);
+    return a;
+};
+// Mutates `a` in place; callers must pass same-length polynomials.
+const polySub = (a_, b_) => {
+    const a = a_;
+    const b = b_;
+    for (let i = 0; i < a.length; i++)
+        a[i] = crystals.mod(a[i] - b[i]);
+    return a;
+};
+// Mutates `p` in place and assumes it is a decoded `t1`-range polynomial.
+const polyShiftl = (p_) => {
+    const p = p_;
+    for (let i = 0; i < N; i++)
+        p[i] <<= D;
+    return p;
+};
+const polyChknorm = (p_, B) => {
+    const p = p_;
+    // FIPS 204 Algorithms 7 and 8 express the same centered-norm check with explicit inequalities.
+    for (let i = 0; i < N; i++)
+        if (Math.abs(crystals.smod(p[i])) >= B)
+            return true;
+    return false;
+};
+// Both inputs must already be in NTT / `T_q` form.
+const MultiplyNTTs = (a_, b_) => {
+    const a = a_;
+    const b = b_;
+    // NOTE: we don't use montgomery reduction in code, since it requires 64 bit ints,
+    // which is not available in JS. mod(a[i] * b[i]) is ok, since Q is 23 bit,
+    // which means a[i] * b[i] is 46 bit, which is safe to use in JS. (number is 53 bits).
+    // Barrett reduction is slower than mod :(
+    const c = newPoly(N);
+    for (let i = 0; i < a.length; i++)
+        c[i] = crystals.mod(a[i] * b[i]);
+    return c;
+};
+// Return poly in NTT representation
+function RejNTTPoly(xof_) {
+    const xof = xof_;
+    // Samples a polynomial ∈ Tq. xof() must return byte lengths divisible by 3.
+    const r = newPoly(N);
+    // NOTE: we can represent 3xu24 as 4xu32, but it doesn't improve perf :(
+    for (let j = 0; j < N;) {
+        const b = xof();
+        if (b.length % 3)
+            throw new Error('RejNTTPoly: unaligned block');
+        for (let i = 0; j < N && i <= b.length - 3; i += 3) {
+            // FIPS 204 Algorithm 14 clears the top bit of b2 before forming the 23-bit candidate.
+            const t = (b[i + 0] | (b[i + 1] << 8) | (b[i + 2] << 16)) & 0x7fffff; // 3 bytes
+            if (t < Q)
+                r[j++] = t;
+        }
+    }
+    return r;
+}
+// Instantiate one ML-DSA parameter set from the Table 1 lattice constants plus the
+// Table 2 byte lengths / hash-width choices used by the public wrappers below.
+function getDilithium(opts_) {
+    const opts = opts_;
+    const { K, L, GAMMA1, GAMMA2, TAU, ETA, OMEGA } = opts;
+    const { CRH_BYTES, TR_BYTES, C_TILDE_BYTES, XOF128, XOF256, securityLevel } = opts;
+    if (![2, 4].includes(ETA))
+        throw new Error('Wrong ETA');
+    if (![1 << 17, 1 << 19].includes(GAMMA1))
+        throw new Error('Wrong GAMMA1');
+    if (![GAMMA2_1, GAMMA2_2].includes(GAMMA2))
+        throw new Error('Wrong GAMMA2');
+    const BETA = TAU * ETA;
+    const decompose = (r) => {
+        // Decomposes r into (r1, r0) such that r ≡ r1(2γ2) + r0 mod q.
+        const rPlus = crystals.mod(r);
+        const r0 = crystals.smod(rPlus, 2 * GAMMA2) | 0;
+        // FIPS 204 Algorithm 36 folds the top bucket `q-1` back to `(r1, r0) = (0, r0-1)`.
+        if (rPlus - r0 === Q - 1)
+            return { r1: 0 | 0, r0: (r0 - 1) | 0 };
+        const r1 = Math.floor((rPlus - r0) / (2 * GAMMA2)) | 0;
+        return { r1, r0 }; // r1 = HighBits, r0 = LowBits
+    };
+    const HighBits = (r) => decompose(r).r1;
+    const LowBits = (r) => decompose(r).r0;
+    const MakeHint = (z, r) => {
+        // Compute hint bit indicating whether adding z to r alters the high bits of r.
+        // FIPS 204 §6.2 also permits the Section 5.1 alternative from [6], which uses the
+        // transformed low-bits/high-bits state at this call site instead of Algorithm 39 literally.
+        // This optimized predicate only applies to those transformed Section 5.1 inputs; it is
+        // not a drop-in replacement for Algorithm 39 on arbitrary `(z, r)` pairs.
+        // From dilithium code
+        const res0 = z <= GAMMA2 || z > Q - GAMMA2 || (z === Q - GAMMA2 && r === 0) ? 0 : 1;
+        // from FIPS204:
+        // // const r1 = HighBits(r);
+        // // const v1 = HighBits(r + z);
+        // // const res1 = +(r1 !== v1);
+        // But they return different results! However, decompose is same.
+        // So, either there is a bug in Dilithium ref implementation or in FIPS204.
+        // For now, lets use dilithium one, so test vectors can be passed.
+        // The round-3 Dilithium / ML-DSA code uses the same low-bits / high-bits convention after
+        // `r0 += ct0`.
+        // See dilithium-py README section "Optimising decomposition and making hints".
+        return res0;
+    };
+    // m = (q-1)/(2γ2): 44 for ML-DSA-44, 16 for 65/87. Hoisted out of UseHint, which runs
+    // per coefficient during verification.
+    const HINT_M = Math.floor((Q - 1) / (2 * GAMMA2));
+    const UseHint = (h, r) => {
+        // Returns the high bits of r adjusted according to hint h
+        const { r1, r0 } = decompose(r);
+        // 3: if h = 1 and r0 > 0 return (r1 + 1) mod m
+        // 4: if h = 1 and r0 ≤ 0 return (r1 − 1) mod m
+        if (h === 1)
+            return r0 > 0 ? crystals.mod(r1 + 1, HINT_M) | 0 : crystals.mod(r1 - 1, HINT_M) | 0;
+        return r1 | 0;
+    };
+    const Power2Round = (r) => {
+        // Decomposes r into (r1, r0) such that r ≡ r1*(2**d) + r0 mod q.
+        const rPlus = crystals.mod(r);
+        const r0 = crystals.smod(rPlus, 2 ** D) | 0;
+        return { r1: Math.floor((rPlus - r0) / 2 ** D) | 0, r0 };
+    };
+    const hintCoder = {
+        bytesLen: OMEGA + K,
+        encode: (h_) => {
+            const h = h_;
+            if (h === false)
+                throw new Error('hint.encode: hint is false'); // should never happen
+            const res = new Uint8Array(OMEGA + K);
+            for (let i = 0, k = 0; i < K; i++) {
+                for (let j = 0; j < N; j++)
+                    if (h[i][j] !== 0)
+                        res[k++] = j;
+                res[OMEGA + i] = k;
+            }
+            return res;
+        },
+        decode: (buf) => {
+            const h = [];
+            let k = 0;
+            for (let i = 0; i < K; i++) {
+                const hi = newPoly(N);
+                if (buf[OMEGA + i] < k || buf[OMEGA + i] > OMEGA)
+                    return false;
+                for (let j = k; j < buf[OMEGA + i]; j++) {
+                    if (j > k && buf[j] <= buf[j - 1])
+                        return false;
+                    hi[buf[j]] = 1;
+                }
+                k = buf[OMEGA + i];
+                h.push(hi);
+            }
+            for (let j = k; j < OMEGA; j++)
+                if (buf[j] !== 0)
+                    return false;
+            return h;
+        },
+    };
+    const ETACoder = polyCoder(ETA === 2 ? 3 : 4, (i) => ETA - i, (i) => {
+        if (!(-ETA <= i && i <= ETA))
+            throw new Error(`malformed key s1/s3 ${i} outside of ETA range [${-ETA}, ${ETA}]`);
+        return i;
+    });
+    const T0Coder = polyCoder(13, (i) => (1 << (D - 1)) - i);
+    const T1Coder = polyCoder(10);
+    // Requires smod. Need to fix!
+    const ZCoder = polyCoder(GAMMA1 === 1 << 17 ? 18 : 20, (i) => crystals.smod(GAMMA1 - i));
+    const W1Coder = polyCoder(GAMMA2 === GAMMA2_1 ? 6 : 4);
+    const W1Vec = vecCoder(W1Coder, K);
+    // Main structures
+    const publicCoder = splitCoder('publicKey', 32, vecCoder(T1Coder, K));
+    const secretCoder = splitCoder('secretKey', 32, 32, TR_BYTES, vecCoder(ETACoder, L), vecCoder(ETACoder, K), vecCoder(T0Coder, K));
+    const sigCoder = splitCoder('signature', C_TILDE_BYTES, vecCoder(ZCoder, L), hintCoder);
+    const CoefFromHalfByte = ETA === 2
+        ? (n) => (n < 15 ? 2 - (n % 5) : false)
+        : (n) => (n < 9 ? 4 - n : false);
+    // Return poly in ordinary representation.
+    // This helper returns ordinary-form `[-ETA, ETA]` coefficients for ExpandS; callers apply
+    // `NTT.encode()` later when needed.
+    function RejBoundedPoly(xof_) {
+        const xof = xof_;
+        // Samples an element a ∈ Rq with coeffcients in [−η, η] computed via rejection sampling from ρ.
+        const r = newPoly(N);
+        for (let j = 0; j < N;) {
+            const b = xof();
+            for (let i = 0; j < N && i < b.length; i += 1) {
+                // half byte. Should be superfast with vector instructions. But very slow with js :(
+                const d1 = CoefFromHalfByte(b[i] & 0x0f);
+                const d2 = CoefFromHalfByte((b[i] >> 4) & 0x0f);
+                if (d1 !== false)
+                    r[j++] = d1;
+                if (j < N && d2 !== false)
+                    r[j++] = d2;
+            }
+        }
+        return r;
+    }
+    const SampleInBall = (seed) => {
+        // Samples a polynomial c ∈ Rq with coeffcients from {−1, 0, 1} and Hamming weight τ
+        const pre = newPoly(N);
+        const s = shake256.create({}).update(seed);
+        const buf = new Uint8Array(shake256.blockLen);
+        s.xofInto(buf);
+        // FIPS 204 Algorithm 29 uses the first 8 squeezed bytes as the 64 sign bits `h`,
+        // then rejection-samples coefficient positions from the remaining XOF stream.
+        const masks = buf.slice(0, 8);
+        for (let i = N - TAU, pos = 8, maskPos = 0, maskBit = 0; i < N; i++) {
+            let b = i + 1;
+            for (; b > i;) {
+                b = buf[pos++];
+                if (pos < shake256.blockLen)
+                    continue;
+                s.xofInto(buf);
+                pos = 0;
+            }
+            pre[i] = pre[b];
+            pre[b] = 1 - (((masks[maskPos] >> maskBit++) & 1) << 1);
+            if (maskBit >= 8) {
+                maskPos++;
+                maskBit = 0;
+            }
+        }
+        return pre;
+    };
+    const polyPowerRound = (p_) => {
+        const p = p_;
+        const res0 = newPoly(N);
+        const res1 = newPoly(N);
+        for (let i = 0; i < p.length; i++) {
+            const { r0, r1 } = Power2Round(p[i]);
+            res0[i] = r0;
+            res1[i] = r1;
+        }
+        return { r0: res0, r1: res1 };
+    };
+    const polyUseHint = (u_, h_) => {
+        const u = u_;
+        const h = h_;
+        // In-place on `u`: verification only needs the recovered high bits, so reuse the
+        // temporary `wApprox` buffer instead of allocating another polynomial.
+        for (let i = 0; i < N; i++)
+            u[i] = UseHint(h[i], u[i]);
+        return u;
+    };
+    const polyMakeHint = (a_, b_) => {
+        const a = a_;
+        const b = b_;
+        const v = newPoly(N);
+        let cnt = 0;
+        for (let i = 0; i < N; i++) {
+            const h = MakeHint(a[i], b[i]);
+            v[i] = h;
+            cnt += h;
+        }
+        return { v, cnt };
+    };
+    const signRandBytes = 32;
+    const seedCoder = splitCoder('seed', 32, 64, 32);
+    // API & argument positions are exactly as in FIPS204.
+    const internal = Object.freeze({
+        info: Object.freeze({ type: 'internal-ml-dsa' }),
+        lengths: Object.freeze({
+            secretKey: secretCoder.bytesLen,
+            publicKey: publicCoder.bytesLen,
+            seed: 32,
+            signature: sigCoder.bytesLen,
+            signRand: signRandBytes,
+        }),
+        keygen: (seed) => {
+            // H(𝜉||IntegerToBytes(𝑘, 1)||IntegerToBytes(ℓ, 1), 128) 2: ▷ expand seed
+            const seedDst = new Uint8Array(32 + 2);
+            const randSeed = seed === undefined;
+            if (randSeed)
+                seed = randomBytes(32);
+            abytesDoc(seed, 32, 'seed');
+            seedDst.set(seed);
+            if (randSeed)
+                cleanBytes(seed);
+            seedDst[32] = K;
+            seedDst[33] = L;
+            const [rho, rhoPrime, K_] = seedCoder.decode(shake256(seedDst, { dkLen: seedCoder.bytesLen }));
+            const xofPrime = XOF256(rhoPrime);
+            const s1 = [];
+            for (let i = 0; i < L; i++)
+                s1.push(RejBoundedPoly(xofPrime.get(i & 0xff, (i >> 8) & 0xff)));
+            const s2 = [];
+            for (let i = L; i < L + K; i++)
+                s2.push(RejBoundedPoly(xofPrime.get(i & 0xff, (i >> 8) & 0xff)));
+            const s1Hat = s1.map((i) => crystals.NTT.encode(i.slice()));
+            const t0 = [];
+            const t1 = [];
+            const xof = XOF128(rho);
+            const t = newPoly(N);
+            for (let i = 0; i < K; i++) {
+                // t ← NTT−1(A*NTT(s1)) + s2
+                cleanBytes(t); // don't-reallocate
+                for (let j = 0; j < L; j++) {
+                    const aij = RejNTTPoly(xof.get(j, i)); // super slow!
+                    polyAdd(t, MultiplyNTTs(aij, s1Hat[j]));
+                }
+                crystals.NTT.decode(t);
+                const { r0, r1 } = polyPowerRound(polyAdd(t, s2[i])); // (t1, t0) ← Power2Round(t, d)
+                t0.push(r0);
+                t1.push(r1);
+            }
+            const publicKey = publicCoder.encode([rho, t1]); // pk ← pkEncode(ρ, t1)
+            const tr = shake256(publicKey, { dkLen: TR_BYTES }); // tr ← H(BytesToBits(pk), 512)
+            // sk ← skEncode(ρ, K,tr, s1, s2, t0)
+            const secretKey = secretCoder.encode([rho, K_, tr, s1, s2, t0]);
+            xof.clean();
+            xofPrime.clean();
+            // STATS
+            // Kyber512: { calls: 4, xofs: 12 }, Kyber768: { calls: 9, xofs: 27 },
+            // Kyber1024: { calls: 16, xofs: 48 }
+            // DSA44: { calls: 24, xofs: 24 }, DSA65: { calls: 41, xofs: 41 },
+            // DSA87: { calls: 71, xofs: 71 }
+            cleanBytes(rho, rhoPrime, K_, s1, s2, s1Hat, t, t0, t1, tr, seedDst);
+            return {
+                publicKey: publicKey,
+                secretKey: secretKey,
+            };
+        },
+        getPublicKey: (secretKey) => {
+            // (ρ, K,tr, s1, s2, t0) ← skDecode(sk)
+            const [rho, _K, _tr, s1, s2, _t0] = secretCoder.decode(secretKey);
+            const xof = XOF128(rho);
+            const s1Hat = s1.map((p) => crystals.NTT.encode(p.slice()));
+            const t1 = [];
+            const tmp = newPoly(N);
+            for (let i = 0; i < K; i++) {
+                tmp.fill(0);
+                for (let j = 0; j < L; j++) {
+                    const aij = RejNTTPoly(xof.get(j, i)); // A_ij in NTT
+                    polyAdd(tmp, MultiplyNTTs(aij, s1Hat[j])); // += A_ij * s1_j
+                }
+                crystals.NTT.decode(tmp); // NTT⁻¹
+                polyAdd(tmp, s2[i]); // t_i = A·s1 + s2
+                const { r1 } = polyPowerRound(tmp); // r1 = t1, r0 ≈ t0
+                t1.push(r1);
+            }
+            xof.clean();
+            cleanBytes(tmp, s1Hat, _t0, s1, s2);
+            return publicCoder.encode([rho, t1]);
+        },
+        // NOTE: random is optional.
+        sign: (msg, secretKey, opts = {}) => {
+            opts = validateSigOpts(opts, INTERNAL_SIG_OPT_KEYS);
+            opts = validateInternalOpts(opts, INTERNAL_SIG_OPT_KEYS);
+            const { extraEntropy: random, externalMu = false } = opts;
+            // FIPS 204 external-mu mode expects the 64-byte message representative µ = H(tr || M).
+            if (externalMu)
+                abytesDoc(msg, CRH_BYTES, 'mu');
+            // Prepare entropy before touching decoded secrets: randomBytes() may throw, and an RNG
+            // failure must not leave expanded secret-polynomial copies behind.
+            const ownRnd = random === false || random === undefined;
+            const rnd = random === false
+                ? new Uint8Array(32)
+                : random === undefined
+                    ? randomBytes(signRandBytes)
+                    : random;
+            abytesDoc(rnd, 32, 'extraEntropy');
+            // This part can be pre-cached per secretKey, but there is only minor performance improvement,
+            // since we re-use a lot of variables to computation.
+            // (ρ, K,tr, s1, s2, t0) ← skDecode(sk)
+            const decoded = (() => {
+                try {
+                    return secretCoder.decode(secretKey);
+                }
+                catch (error) {
+                    // A malformed key must not strand entropy owned by the library.
+                    if (ownRnd)
+                        cleanBytes(rnd);
+                    throw error;
+                }
+            })();
+            const [rho, _K, tr, s1, s2, t0] = decoded;
+            // Cache matrix to avoid re-compute later
+            const A = []; // A ← ExpandA(ρ)
+            const xof = XOF128(rho);
+            for (let i = 0; i < K; i++) {
+                const pv = [];
+                for (let j = 0; j < L; j++)
+                    pv.push(RejNTTPoly(xof.get(j, i)));
+                A.push(pv);
+            }
+            xof.clean();
+            for (let i = 0; i < L; i++)
+                crystals.NTT.encode(s1[i]); // sˆ1 ← NTT(s1)
+            for (let i = 0; i < K; i++) {
+                crystals.NTT.encode(s2[i]); // sˆ2 ← NTT(s2)
+                crystals.NTT.encode(t0[i]); // tˆ0 ← NTT(t0)
+            }
+            // This part is per msg
+            const mu = externalMu
+                ? msg
+                : // 6: µ ← H(tr||M, 512)
+                    //    ▷ Compute message representative µ
+                    shake256.create({ dkLen: CRH_BYTES }).update(tr).update(msg).digest();
+            const rhoprime = shake256
+                .create({ dkLen: CRH_BYTES })
+                .update(_K)
+                .update(rnd)
+                .update(mu)
+                .digest(); // ρ′← H(K||rnd||µ, 512)
+            // Only wipe entropy we generated; caller-provided extraEntropy stays caller-owned.
+            if (ownRnd)
+                cleanBytes(rnd);
+            abytesDoc(rhoprime, CRH_BYTES);
+            const x256 = XOF256(rhoprime, ZCoder.bytesLen);
+            //  Rejection sampling loop
+            main_loop: for (let kappa = 0;;) {
+                const y = [];
+                // y ← ExpandMask(ρ , κ)
+                for (let i = 0; i < L; i++, kappa++)
+                    y.push(ZCoder.decode(x256.get(kappa & 0xff, kappa >> 8)()));
+                const z = y.map((i) => crystals.NTT.encode(i.slice()));
+                const w = [];
+                for (let i = 0; i < K; i++) {
+                    // w ← NTT−1(A ◦ NTT(y))
+                    const wi = newPoly(N);
+                    for (let j = 0; j < L; j++)
+                        polyAdd(wi, MultiplyNTTs(A[i][j], z[j]));
+                    crystals.NTT.decode(wi);
+                    w.push(wi);
+                }
+                const w1 = w.map((j) => j.map(HighBits)); // w1 ← HighBits(w)
+                // Commitment hash: c˜ ∈{0, 1 2λ } ← H(µ||w1Encode(w1), 2λ)
+                const cTilde = shake256
+                    .create({ dkLen: C_TILDE_BYTES })
+                    .update(mu)
+                    .update(W1Vec.encode(w1))
+                    .digest();
+                // Verifer’s challenge
+                // c ← SampleInBall(c˜1); cˆ ← NTT(c)
+                const cHat = crystals.NTT.encode(SampleInBall(cTilde));
+                // ⟨⟨cs1⟩⟩ ← NTT−1(cˆ◦ sˆ1)
+                const cs1 = s1.map((i) => MultiplyNTTs(i, cHat));
+                for (let i = 0; i < L; i++) {
+                    polyAdd(crystals.NTT.decode(cs1[i]), y[i]); // z ← y + ⟨⟨cs1⟩⟩
+                    if (polyChknorm(cs1[i], GAMMA1 - BETA)) {
+                        // Rejected. Wipe this iteration's secret-derived buffers before retrying; the
+                        // accepted path wipes the same set, and only the persistent key material (s1, s2,
+                        // t0, A, rhoprime) is kept for the next iteration and cleaned at the very end.
+                        cleanBytes(cTilde, cs1, cHat, w1, w, z, y);
+                        continue main_loop; // ||z||∞ ≥ γ1 − β
+                    }
+                }
+                // cs1 is now z (▷ Signer’s response)
+                let cnt = 0;
+                const h = [];
+                for (let i = 0; i < K; i++) {
+                    const cs2 = crystals.NTT.decode(MultiplyNTTs(s2[i], cHat)); // ⟨⟨cs2⟩⟩ ← NTT−1(cˆ◦ sˆ2)
+                    const r0 = polySub(w[i], cs2).map(LowBits); // r0 ← LowBits(w − ⟨⟨cs2⟩⟩)
+                    if (polyChknorm(r0, GAMMA2 - BETA)) {
+                        cleanBytes(cTilde, cs1, cHat, w1, w, z, y, h, cs2, r0);
+                        continue main_loop; // ||r0||∞ ≥ γ2 − β
+                    }
+                    const ct0 = crystals.NTT.decode(MultiplyNTTs(t0[i], cHat)); // ⟨⟨ct0⟩⟩ ← NTT−1(cˆ◦ tˆ0)
+                    if (polyChknorm(ct0, GAMMA2)) {
+                        cleanBytes(cTilde, cs1, cHat, w1, w, z, y, h, cs2, r0, ct0);
+                        continue main_loop;
+                    }
+                    polyAdd(r0, ct0);
+                    // ▷ Signer’s hint
+                    const hint = polyMakeHint(r0, w1[i]); // h ← MakeHint(−⟨⟨ct0⟩⟩, w− ⟨⟨cs2⟩⟩ + ⟨⟨ct0⟩⟩)
+                    h.push(hint.v);
+                    cnt += hint.cnt;
+                }
+                if (cnt > OMEGA) {
+                    cleanBytes(cTilde, cs1, cHat, w1, w, z, y, h);
+                    continue; // the number of 1’s in h is greater than ω
+                }
+                x256.clean();
+                const res = sigCoder.encode([cTilde, cs1, h]); // σ ← sigEncode(c˜, z mod±q, h)
+                // rho, _K, tr is subarray of secretKey, cannot clean.
+                cleanBytes(cTilde, cs1, h, cHat, w1, w, z, y, rhoprime, s1, s2, t0, ...A);
+                // `externalMu` hands ownership of `mu` to the caller,
+                // so only wipe the internally derived digest form here;
+                // zeroizing caller memory would break the caller's own reuse / verify path.
+                if (!externalMu)
+                    cleanBytes(mu);
+                return res;
+            }
+            // @ts-ignore
+            throw new Error('Unreachable code path reached, report this error');
+        },
+        verify: (sig, msg, publicKey, opts = {}) => {
+            opts = validateInternalOpts(opts, INTERNAL_VER_OPT_KEYS);
+            const { externalMu = false } = opts;
+            // FIPS 204 external-mu mode expects the 64-byte message representative µ = H(tr || M).
+            if (externalMu)
+                abytesDoc(msg, CRH_BYTES, 'mu');
+            // ML-DSA.Verify(pk, M, σ): Verifes a signature σ for a message M.
+            const [rho, t1] = publicCoder.decode(publicKey); // (ρ, t1) ← pkDecode(pk)
+            const tr = shake256(publicKey, { dkLen: TR_BYTES }); // 6: tr ← H(BytesToBits(pk), 512)
+            if (sig.length !== sigCoder.bytesLen)
+                return false; // return false instead of exception
+            // (c˜, z, h) ← sigDecode(σ)
+            // ▷ Signer’s commitment hash c ˜, response z and hint
+            const [cTilde, z, h] = sigCoder.decode(sig);
+            if (h === false)
+                return false; // if h = ⊥ then return false
+            for (let i = 0; i < L; i++)
+                if (polyChknorm(z[i], GAMMA1 - BETA))
+                    return false;
+            const mu = externalMu
+                ? msg
+                : // 7: µ ← H(tr||M, 512)
+                    shake256.create({ dkLen: CRH_BYTES }).update(tr).update(msg).digest();
+            // Compute verifer’s challenge from c˜
+            const c = crystals.NTT.encode(SampleInBall(cTilde)); // c ← SampleInBall(c˜1)
+            const zNtt = z.map((i) => i.slice()); // zNtt = NTT(z)
+            for (let i = 0; i < L; i++)
+                crystals.NTT.encode(zNtt[i]);
+            const wTick1 = [];
+            const xof = XOF128(rho);
+            for (let i = 0; i < K; i++) {
+                const ct12d = MultiplyNTTs(crystals.NTT.encode(polyShiftl(t1[i])), c); //c * t1 * (2**d)
+                const Az = newPoly(N); // // A * z
+                for (let j = 0; j < L; j++) {
+                    const aij = RejNTTPoly(xof.get(j, i)); // A[i][j] inplace
+                    polyAdd(Az, MultiplyNTTs(aij, zNtt[j]));
+                }
+                // wApprox = A*z - c*t1 * (2**d)
+                const wApprox = crystals.NTT.decode(polySub(Az, ct12d));
+                // Reconstruction of signer’s commitment
+                wTick1.push(polyUseHint(wApprox, h[i])); // w ′ ← UseHint(h, w'approx )
+            }
+            xof.clean();
+            // c˜′← H (µ||w1Encode(w′1), 2λ),  Hash it; this should match c˜
+            const c2 = shake256
+                .create({ dkLen: C_TILDE_BYTES })
+                .update(mu)
+                .update(W1Vec.encode(wTick1))
+                .digest();
+            // Additional checks in FIPS-204:
+            // [[ ||z||∞ < γ1 − β ]] and [[c ˜ = c˜′]] and [[number of 1’s in h is ≤ ω]]
+            for (const t of h) {
+                const sum = t.reduce((acc, i) => acc + i, 0);
+                if (!(sum <= OMEGA))
+                    return false;
+            }
+            for (const t of z)
+                if (polyChknorm(t, GAMMA1 - BETA))
+                    return false;
+            return equalBytes(cTilde, c2);
+        },
+    });
+    return Object.freeze({
+        info: Object.freeze({ type: 'ml-dsa' }),
+        internal,
+        securityLevel: securityLevel,
+        keygen: internal.keygen,
+        lengths: internal.lengths,
+        getPublicKey: internal.getPublicKey,
+        sign: (msg, secretKey, opts = {}) => {
+            opts = validateSigOpts(opts);
+            const M = getMessage(msg, opts.context);
+            // `context` is consumed by getMessage() above; forwarding it would make the internal
+            // surface accept a key it never reads.
+            const res = internal.sign(M, secretKey, {
+                extraEntropy: opts.extraEntropy,
+                externalMu: false,
+            });
+            cleanBytes(M);
+            return res;
+        },
+        verify: (sig, msg, publicKey, opts = {}) => {
+            opts = validateVerOpts(opts);
+            abytesDoc(sig, undefined, 'signature');
+            return internal.verify(sig, getMessage(msg, opts.context), publicKey, { externalMu: false });
+        },
+        prehash: (hash) => {
+            checkHash(hash, securityLevel);
+            const rawHash = hash;
+            return Object.freeze({
+                info: Object.freeze({ type: 'hashml-dsa' }),
+                securityLevel: securityLevel,
+                lengths: internal.lengths,
+                keygen: internal.keygen,
+                getPublicKey: internal.getPublicKey,
+                sign: (msg, secretKey, opts = {}) => {
+                    opts = validateSigOpts(opts);
+                    const M = getMessagePrehash(rawHash, msg, opts.context);
+                    // As above: getMessagePrehash() consumes `context`, so it must not travel further.
+                    const res = internal.sign(M, secretKey, {
+                        extraEntropy: opts.extraEntropy,
+                        externalMu: false,
+                    });
+                    cleanBytes(M);
+                    return res;
+                },
+                verify: (sig, msg, publicKey, opts = {}) => {
+                    opts = validateVerOpts(opts);
+                    abytesDoc(sig, undefined, 'signature');
+                    return internal.verify(sig, getMessagePrehash(rawHash, msg, opts.context), publicKey, {
+                        externalMu: false,
+                    });
+                },
+            });
+        },
+    });
+}
+/**
+ * ML-DSA-44 for 128-bit security level. Not recommended after 2030, as per ASD.
+ * @example
+ * Generate deterministic ML-DSA-44 keys, sign one message, and verify the signature.
+ * ```ts
+ * import { sha256 } from '@noble/hashes/sha2.js';
+ * import { ml_dsa44 } from '@noble/post-quantum/ml-dsa.js';
+ * const seed = new Uint8Array(ml_dsa44.lengths.seed!);
+ * const { secretKey, publicKey } = ml_dsa44.keygen(seed);
+ * const msg = new TextEncoder().encode('hello noble');
+ * const sig = ml_dsa44.sign(msg, secretKey);
+ * const isValid = ml_dsa44.verify(sig, msg, publicKey);
+ * const recovered = ml_dsa44.getPublicKey(secretKey);
+ * const context = new Uint8Array([1, 2, 3]);
+ * const prehash = ml_dsa44.prehash(sha256);
+ * const preSig = prehash.sign(msg, secretKey, { context });
+ * const preValid = prehash.verify(preSig, msg, publicKey, { context });
+ * const internalSig = ml_dsa44.internal.sign(msg, secretKey);
+ * ```
+ */
+const ml_dsa44 = /* @__PURE__ */ (() => getDilithium({
+    ...PARAMS[2],
+    CRH_BYTES: 64,
+    TR_BYTES: 64,
+    C_TILDE_BYTES: 32,
+    XOF128,
+    XOF256,
+    securityLevel: 128,
+}))();
+
+var _MLDSAKey_key, _MLDSAPublicKey_key;
+// Octez stores the 2560-byte ML-DSA-44 secret followed by its 1312-byte public key.
+const SECRET_KEY_SIZE = 2560;
+class MLDSAKey {
+    constructor(key, decrypt) {
+        _MLDSAKey_key.set(this, void 0);
+        const [encoded, prefix] = b58DecodeAndCheckPrefix(key, [
+            PrefixV2.MLDSA44SecretKey,
+            PrefixV2.MLDSA44EncryptedSecretKey,
+        ]);
+        let data = encoded;
+        if (prefix === PrefixV2.MLDSA44EncryptedSecretKey) {
+            if (!decrypt)
+                throw new Error('decryption function is not provided');
+            data = decrypt(data);
+        }
+        if (data.length !== payloadLength[PrefixV2.MLDSA44SecretKey]) {
+            throw new InvalidKeyError('Invalid ML-DSA-44 secret key length');
+        }
+        __classPrivateFieldSet(this, _MLDSAKey_key, Uint8Array.from(data), "f");
+    }
+    sign(message) {
+        // Octez uses pure ML-DSA with an empty context over Blake2b-256(message),
+        // not HashML-DSA. InMemorySigner has already prepended any watermark.
+        const rawSignature = ml_dsa44.sign(blake2b(message, { dkLen: 32 }), __classPrivateFieldGet(this, _MLDSAKey_key, "f").subarray(0, SECRET_KEY_SIZE));
+        const encoded = b58Encode(rawSignature, PrefixV2.MLDSA44Signature);
+        return { rawSignature, sig: encoded, prefixSig: encoded };
+    }
+    publicKey() {
+        return new MLDSAPublicKey(__classPrivateFieldGet(this, _MLDSAKey_key, "f").subarray(SECRET_KEY_SIZE));
+    }
+    secretKey() {
+        return b58Encode(__classPrivateFieldGet(this, _MLDSAKey_key, "f"), PrefixV2.MLDSA44SecretKey);
+    }
+}
+_MLDSAKey_key = new WeakMap();
+class MLDSAPublicKey {
+    constructor(src) {
+        _MLDSAPublicKey_key.set(this, void 0);
+        const key = typeof src === 'string' ? b58DecodeAndCheckPrefix(src, [PrefixV2.MLDSA44PublicKey])[0] : src;
+        if (key.length !== payloadLength[PrefixV2.MLDSA44PublicKey]) {
+            throw new InvalidPublicKeyError('Invalid ML-DSA-44 public key length');
+        }
+        __classPrivateFieldSet(this, _MLDSAPublicKey_key, Uint8Array.from(key), "f");
+    }
+    compare(other) {
+        if (!(other instanceof MLDSAPublicKey)) {
+            throw new InvalidPublicKeyError('ML-DSA-44 key expected');
+        }
+        return compareArrays(__classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"), __classPrivateFieldGet(other, _MLDSAPublicKey_key, "f"));
+    }
+    hash() {
+        return b58Encode(blake2b(__classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"), { dkLen: 20 }), PrefixV2.MLDSA44PublicKeyHash);
+    }
+    bytes() {
+        return __classPrivateFieldGet(this, _MLDSAPublicKey_key, "f").slice();
+    }
+    toProtocol() {
+        return mergebuf(new Uint8Array([4]), __classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"));
+    }
+    toString() {
+        return b58Encode(__classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"), PrefixV2.MLDSA44PublicKey);
+    }
+}
+_MLDSAPublicKey_key = new WeakMap();
+
+var _InMemorySigner_key;
+/**
+ * A local implementation of the signer. Will represent a Tezos account and be able to produce signature in its behalf
+ *
+ * @remarks If running in production and dealing with tokens that have real value, it is strongly recommended to use a HSM backed signer so that private key material is not stored in memory or on disk
+ * @throws InvalidMnemonicError
+ */
+class InMemorySigner {
+    static fromFundraiser(email, password, mnemonic) {
+        if (!validateMnemonic(mnemonic, wordlist)) {
+            throw new InvalidMnemonicError();
+        }
+        const seed = mnemonicToSeedSync(mnemonic, `${email}${password}`);
+        const key = b58Encode(seed.subarray(0, 32), PrefixV2.Ed25519Seed);
+        return new InMemorySigner(key);
+    }
+    static async fromSecretKey(key, passphrase) {
+        return new InMemorySigner(key, passphrase);
+    }
+    /**
+     *
+     * Instantiation of an InMemorySigner instance from a mnemonic
+     * @returns InMemorySigner
+     * @throws InvalidMnemonicError
+     */
+    static fromMnemonic({ mnemonic, password = '', derivationPath = "44'/1729'/0'/0'", curve = 'ed25519', }) {
+        // check if curve is defined if not default tz1
+        if (!validateMnemonic(mnemonic, wordlist)) {
+            // avoiding exposing mnemonic again in case of mistake making invalid
+            throw new InvalidMnemonicError();
+        }
+        const seed = mnemonicToSeedSync(mnemonic, password);
+        const sk = generateSecretKey(seed, derivationPath, curve);
+        return new InMemorySigner(sk);
+    }
+    /**
+     *
+     * @param key Encoded private key
+     * @param passphrase Passphrase to decrypt the private key if it is encrypted
+     * @throws InvalidKeyError
+     *
+     */
+    constructor(key, passphrase) {
+        _InMemorySigner_key.set(this, void 0);
+        const keyPrefixes = [
+            PrefixV2.Ed25519EncryptedSeed,
+            PrefixV2.Ed25519Seed,
+            PrefixV2.Ed25519SecretKey,
+            PrefixV2.Secp256k1EncryptedSecretKey,
+            PrefixV2.Secp256k1SecretKey,
             PrefixV2.P256EncryptedSecretKey,
             PrefixV2.P256SecretKey,
             PrefixV2.BLS12_381EncryptedSecretKey,
             PrefixV2.BLS12_381SecretKey,
+            PrefixV2.MLDSA44EncryptedSecretKey,
+            PrefixV2.MLDSA44SecretKey,
         ];
         const pre = (() => {
             try {
@@ -4839,7 +7355,8 @@ class InMemorySigner {
         const encrypted = pre === PrefixV2.Ed25519EncryptedSeed ||
             pre === PrefixV2.Secp256k1EncryptedSecretKey ||
             pre === PrefixV2.P256EncryptedSecretKey ||
-            pre === PrefixV2.BLS12_381EncryptedSecretKey;
+            pre === PrefixV2.BLS12_381EncryptedSecretKey ||
+            pre === PrefixV2.MLDSA44EncryptedSecretKey;
         let decrypt;
         if (encrypted) {
             if (!passphrase) {
@@ -4878,6 +7395,10 @@ class InMemorySigner {
             case PrefixV2.BLS12_381SecretKey:
                 __classPrivateFieldSet(this, _InMemorySigner_key, new BLSKey(key, decrypt), "f");
                 break;
+            case PrefixV2.MLDSA44EncryptedSecretKey:
+            case PrefixV2.MLDSA44SecretKey:
+                __classPrivateFieldSet(this, _InMemorySigner_key, new MLDSAKey(key, decrypt), "f");
+                break;
         }
     }
     /**
@@ -4889,13 +7410,17 @@ class InMemorySigner {
         const msg = typeof message == 'string' ? hex2buf(message) : message;
         const watermarkMsg = watermark !== undefined ? mergebuf(watermark, msg) : msg;
         const { rawSignature, sig: signature, prefixSig: prefixedSignature, } = await __classPrivateFieldGet(this, _InMemorySigner_key, "f").sign(watermarkMsg);
+        // Variable-length operation signatures carry the signature-prefix marker
+        // and scheme tag before the complete signature payload (Octez signature_v3).
+        const signatureTag = __classPrivateFieldGet(this, _InMemorySigner_key, "f") instanceof MLDSAKey ? 4 : __classPrivateFieldGet(this, _InMemorySigner_key, "f") instanceof BLSKey ? 3 : undefined;
+        const signatureBytes = signatureTag === undefined
+            ? rawSignature
+            : mergebuf(new Uint8Array([255, signatureTag]), rawSignature);
         return {
             bytes: buf2hex(msg),
             sig: signature,
             prefixSig: prefixedSignature,
-            sbytes: buf2hex(mergebuf(msg, 
-            // bls only Signature_prefix ff03 ref:https://octez.tezos.com/docs/shell/p2p_api.html#signature-prefix-tag-255 & https://octez.tezos.com/docs/shell/p2p_api.html#bls-prefix-tag-3
-            isPOP(__classPrivateFieldGet(this, _InMemorySigner_key, "f")) ? mergebuf(new Uint8Array([255, 3]), rawSignature) : rawSignature)),
+            sbytes: buf2hex(mergebuf(msg, signatureBytes)),
         };
     }
     async provePossession() {
@@ -4935,6 +7460,7 @@ function publicKeyFromString(src) {
         PrefixV2.Secp256k1PublicKey,
         PrefixV2.P256PublicKey,
         PrefixV2.BLS12_381PublicKey,
+        PrefixV2.MLDSA44PublicKey,
     ]);
     switch (pre) {
         case PrefixV2.Ed25519PublicKey:
@@ -4945,13 +7471,15 @@ function publicKeyFromString(src) {
             return new ECPublicKey(keyData, 'p256');
         case PrefixV2.BLS12_381PublicKey:
             return new BLSPublicKey(keyData);
+        case PrefixV2.MLDSA44PublicKey:
+            return new MLDSAPublicKey(keyData);
     }
 }
 
 // IMPORTANT: THIS FILE IS AUTO GENERATED! DO NOT MANUALLY EDIT!
 const VERSION = {
-    "commitHash": "13f62cd47ea018312f100b660d0225604c757afa",
-    "version": "25.0.0"
+    "commitHash": "a1d45363559ba27998bbc263b69c961710e4710a",
+    "version": "25.1.0-beta0"
 };
 
 export { ecdsa as ECDSA, ed25519 as Ed25519, Hard, InMemorySigner, InvalidPassphraseError, Path, VERSION, generateSecretKey, publicKeyFromString };