@taquito/signer 25.1.0-rc0 → 25.2.0-beta0

package/dist/taquito-signer.es6.js

@@ -1,12 +1,11 @@
 import { openSecretBox } from '@stablelib/nacl';
 import { b58DecodeAndCheckPrefix, PrefixV2, b58Encode, compareArrays, InvalidPublicKeyError, BLS12_381_DST, POP_DST, payloadLength, mergebuf, hex2buf, buf2hex } from '@taquito/utils';
-import { ed25519 as ed25519$1 } from '@noble/curves/ed25519';
-import { secp256k1 } from '@noble/curves/secp256k1';
+import { ed25519 as ed25519$1 } from '@noble/curves/ed25519.js';
+import { secp256k1 } from '@noble/curves/secp256k1.js';
 import { p256 } from '@noble/curves/nist.js';
 import { ParameterValidationError, UnsupportedActionError, InvalidHexStringError, InvalidDerivationPathError, InvalidKeyError, ProhibitedActionError } from '@taquito/core';
-import { p256 as p256$1 } from '@noble/curves/nist';
 import BN from 'bn.js';
-import { bls12_381 } from '@noble/curves/bls12-381';
+import { bls12_381 } from '@noble/curves/bls12-381.js';
 
 /******************************************************************************
 Copyright (c) Microsoft Corporation.
@@ -53,7 +52,7 @@ typeof SuppressedError === "function" ? SuppressedError : function (error, suppr
  * isBytes(new Uint8Array([1, 2, 3]));
  * ```
  */
-function isBytes$2(a) {
+function isBytes$1(a) {
     // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases.
     // The fallback still requires a real ArrayBuffer view, so plain
     // JSON-deserialized `{ constructor: ... }` spoofing is rejected, and
@@ -64,10 +63,14 @@ function isBytes$2(a) {
             'BYTES_PER_ELEMENT' in a &&
             a.BYTES_PER_ELEMENT === 1));
 }
+// Shared error-message prefix builder. Only called on throw paths, so assert
+// success paths never pay for the string concatenation.
+const atitle$2 = (title) => (title ? `"${title}" ` : '');
 /**
  * Asserts something is a non-negative integer.
  * @param n - number to validate
  * @param title - label included in thrown errors
+ * @returns The validated number.
  * @throws On wrong argument types. {@link TypeError}
  * @throws On wrong argument ranges or values. {@link RangeError}
  * @example
@@ -76,15 +79,12 @@ function isBytes$2(a) {
  * anumber(32, 'length');
  * ```
  */
-function anumber$2(n, title = '') {
-    if (typeof n !== 'number') {
-        const prefix = title && `"${title}" `;
-        throw new TypeError(`${prefix}expected number, got ${typeof n}`);
-    }
-    if (!Number.isSafeInteger(n) || n < 0) {
-        const prefix = title && `"${title}" `;
-        throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
-    }
+function anumber$1(n, title = '') {
+    if (typeof n !== 'number')
+        throw new TypeError(atitle$2(title) + 'expected number, got ' + typeof n);
+    if (!Number.isSafeInteger(n) || n < 0)
+        throw new RangeError(atitle$2(title) + 'expected integer >= 0, got ' + n);
+    return n;
 }
 /**
  * Asserts something is Uint8Array.
@@ -101,19 +101,37 @@ function anumber$2(n, title = '') {
  * ```
  */
 function abytes$1(value, length, title = '') {
-    const bytes = isBytes$2(value);
-    const len = value?.length;
-    const needsLen = length !== undefined;
-    if (!bytes || (needsLen && len !== length)) {
-        const prefix = title && `"${title}" `;
-        const ofLen = needsLen ? ` of length ${length}` : '';
-        const got = bytes ? `length=${len}` : `type=${typeof value}`;
-        const message = prefix + 'expected Uint8Array' + ofLen + ', got ' + got;
-        if (!bytes)
-            throw new TypeError(message);
-        throw new RangeError(message);
-    }
-    return value;
+    // Success path first: this runs at the start of every update() / digestInto(), and the
+    // common `abytes(data)` form must not pay for length handling it does not use.
+    if (isBytes$1(value) && (length === undefined || value.length === length))
+        return value;
+    // Error path: recompute freely to build the exact message.
+    if (length !== undefined)
+        anumber$1(length, 'length');
+    const bytes = isBytes$1(value);
+    const ofLen = length !== undefined ? ` of length ${length}` : '';
+    const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+    const message = atitle$2(title) + 'expected Uint8Array' + ofLen + ', got ' + got;
+    if (!bytes)
+        throw new TypeError(message);
+    throw new RangeError(message);
+}
+/**
+ * Copies bytes into a fresh Uint8Array.
+ * Buffer-style slices can alias the same backing store, so callers that need ownership should copy.
+ * @param bytes - source bytes to clone
+ * @returns Freshly allocated copy of `bytes`.
+ * @throws On wrong argument types. {@link TypeError}
+ * @example
+ * Clone a byte array before mutating it.
+ * ```ts
+ * const copy = copyBytes(new Uint8Array([1, 2, 3]));
+ * ```
+ */
+function copyBytes(bytes) {
+    // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict
+    // because callers use it at byte-validation boundaries before mutating the detached copy.
+    return Uint8Array.from(abytes$1(bytes));
 }
 /**
  * Asserts something is a wrapped hash constructor.
@@ -131,16 +149,28 @@ function abytes$1(value, length, title = '') {
  */
 function ahash$1(h) {
     if (typeof h !== 'function' || typeof h.create !== 'function')
-        throw new TypeError('Hash must wrapped by utils.createHasher');
-    anumber$2(h.outputLen);
-    anumber$2(h.blockLen);
+        throw new TypeError('expected hash wrapped by utils.createHasher');
+    anumber$1(h.outputLen);
+    anumber$1(h.blockLen);
     // HMAC and KDF callers treat these as real byte lengths; allowing zero lets fake wrappers pass
     // validation and can produce empty outputs instead of failing fast.
-    if (h.outputLen < 1)
-        throw new Error('"outputLen" must be >= 1');
-    if (h.blockLen < 1)
-        throw new Error('"blockLen" must be >= 1');
+    if (h.outputLen < 1 || h.blockLen < 1)
+        throw new Error('hash blockLen / outputLen must be >= 1');
 }
+const aobject$3 = (value, label) => {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        throw new TypeError((label === 'object' ? '' : `"${label}" `) + 'expected object, got type=' + typeof value);
+};
+const aopts$1 = (value, label) => {
+    aobject$3(value, label);
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null)
+        throw new TypeError(`"${label}" expected plain object`);
+    // Object.assign() treats an own "__proto__" source key as a write to the target's legacy
+    // prototype setter. Reject it before merging so inherited option values cannot be injected.
+    if (Object.hasOwn(value, '__proto__'))
+        throw new TypeError(`"${label}.__proto__" is not allowed`);
+};
 /**
  * Asserts a hash instance has not been destroyed or finished.
  * @param instance - hash instance to validate
@@ -156,10 +186,12 @@ function ahash$1(h) {
  * ```
  */
 function aexists$1(instance, checkFinished = true) {
+    // Runs on every update()/digestInto(); the flags are library-owned booleans, so only their
+    // truthiness is checked - re-validating their type per call was pure hot-path overhead.
     if (instance.destroyed)
-        throw new Error('Hash instance has been destroyed');
+        throw new Error('hash was destroyed');
     if (checkFinished && instance.finished)
-        throw new Error('Hash#digest() has already been called');
+        throw new Error('digest() was already called');
 }
 /**
  * Asserts output is a sufficiently-sized byte array.
@@ -178,10 +210,12 @@ function aexists$1(instance, checkFinished = true) {
  * ```
  */
 function aoutput$1(out, instance) {
-    abytes$1(out, undefined, 'digestInto() output');
+    abytes$1(out, undefined, 'output');
+    // `outputLen` is a library-owned readonly number; the negated comparison keeps failing fast
+    // when it is missing/NaN (comparisons with undefined/NaN are false) without an anumber() call.
     const min = instance.outputLen;
-    if (out.length < min) {
-        throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+    if (!(out.length >= min)) {
+        throw new RangeError('"output" expected length >= ' + min);
     }
 }
 /**
@@ -317,7 +351,15 @@ const swap32IfBE$1 = isLE$1
 function utf8ToBytes(str) {
     if (typeof str !== 'string')
         throw new TypeError('string expected');
-    return new Uint8Array(new TextEncoder().encode(str)); // https://bugzil.la/1681809
+    const encoded = new TextEncoder().encode(str);
+    try {
+        // Copy into the current realm for Firefox extension contexts. Callers that own the returned
+        // buffer can then wipe it independently of TextEncoder's temporary result.
+        return new Uint8Array(encoded); // https://bugzil.la/1681809
+    }
+    finally {
+        clean$1(encoded);
+    }
 }
 /**
  * Helper for KDFs: consumes Uint8Array or string.
@@ -341,7 +383,8 @@ function kdfInputToBytes(data, errorTitle = '') {
  * Merges default options and passed options.
  * @param defaults - base option object
  * @param opts - user overrides
- * @returns Merged option object. The merge mutates `defaults` in place.
+ * @param title - label included in thrown override errors
+ * @returns Fresh merged option object with a null prototype.
  * @throws On wrong argument types. {@link TypeError}
  * @example
  * Merge user overrides onto default options.
@@ -349,10 +392,13 @@ function kdfInputToBytes(data, errorTitle = '') {
  * checkOpts({ dkLen: 32 }, { asyncTick: 10 });
  * ```
  */
-function checkOpts$1(defaults, opts) {
-    if (opts !== undefined && {}.toString.call(opts) !== '[object Object]')
-        throw new TypeError('options must be object or undefined');
-    const merged = Object.assign(defaults, opts);
+function checkOpts$1(defaults, opts, title = 'opts') {
+    aopts$1(defaults, 'defaults');
+    if (opts !== undefined)
+        aopts$1(opts, title);
+    // Callers read optional fields directly, so omitted values must not fall through to ambient
+    // Object.prototype pollution (for example a forged `dkLen` changing SHAKE's default output).
+    const merged = Object.assign(Object.create(null), defaults, opts);
     return merged;
 }
 /**
@@ -363,6 +409,7 @@ function checkOpts$1(defaults, opts) {
  *   Wrapper construction eagerly calls `hashCons(undefined)` once to read
  *   `outputLen` / `blockLen`, so constructor side effects happen at module
  *   init time.
+ * @throws On wrong argument types. {@link TypeError}
  * @example
  * Wrap a stateful hash constructor into a callable helper.
  * ```ts
@@ -373,6 +420,9 @@ function checkOpts$1(defaults, opts) {
  * ```
  */
 function createHasher$1(hashCons, info = {}) {
+    if (typeof hashCons !== 'function')
+        throw new TypeError('"hashCons" expected function, got type=' + typeof hashCons);
+    info = checkOpts$1({}, info, 'info');
     const hashC = (msg, opts) => hashCons(opts)
         .update(msg)
         .digest();
@@ -384,6 +434,37 @@ function createHasher$1(hashCons, info = {}) {
     Object.assign(hashC, info);
     return Object.freeze(hashC);
 }
+/**
+ * Cryptographically secure PRNG backed by `crypto.getRandomValues`.
+ * @param bytesLength - number of random bytes to generate
+ * @returns Random bytes.
+ * The platform `getRandomValues()` implementation still defines any
+ * single-call length cap, and this helper rejects oversize requests
+ * with a stable library `RangeError` instead of host-specific errors.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @throws If the current runtime does not provide `crypto.getRandomValues`. {@link Error}
+ * @example
+ * Generate a fresh random key or nonce.
+ * ```ts
+ * const key = randomBytes(16);
+ * ```
+ */
+function randomBytes$2(bytesLength = 32) {
+    // Match the repo's other length-taking helpers instead of relying on Uint8Array coercion.
+    anumber$1(bytesLength, 'bytesLength');
+    const cr = typeof globalThis === 'object' ? globalThis.crypto : null;
+    if (typeof cr?.getRandomValues !== 'function')
+        throw new Error('crypto.getRandomValues must be defined');
+    // Web Cryptography API Level 2 §10.1.1:
+    // if `byteLength > 65536`, throw `QuotaExceededError`.
+    // Keep the guard explicit so callers can see the quota in code
+    // instead of discovering it by reading the spec or host errors.
+    // This wrapper surfaces the same quota as a stable library RangeError.
+    if (bytesLength > 65536)
+        throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
+    return cr.getRandomValues(new Uint8Array(bytesLength));
+}
 /**
  * Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.
  * @param suffix - final OID byte for the selected hash.
@@ -406,6 +487,9 @@ const oidNist$1 = (suffix) => ({
  * Internal helpers for blake hash.
  * @module
  */
+// Unrealized speed-up: a file-local copy of rotr measured ~1-2% faster blake2s/blake256/blake3
+// on Node 24 (V8 does not inline it into G1s/G2s across the module boundary). Reused from
+// utils for deduplication.
 /**
  * Internal blake permutation table.
  * Rows `0..9` serve BLAKE2s, rows `0..11` serve BLAKE2b with `10..11 = 0..1`, and Blake1 also
@@ -433,6 +517,79 @@ const BSIGMA = /* @__PURE__ */ Uint8Array.from([
     2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9,
 ]);
 
+const U32_MASK64$1 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
+const _32n$1 = /* @__PURE__ */ BigInt(32);
+// Split bigint into two 32-bit halves. With `le=true`, returned fields become `{ h: low, l: high
+// }` to match little-endian word order rather than the property names.
+function fromBig$1(n, le = false) {
+    if (le)
+        return { h: Number(n & U32_MASK64$1), l: Number((n >> _32n$1) & U32_MASK64$1) };
+    return { h: Number((n >> _32n$1) & U32_MASK64$1) | 0, l: Number(n & U32_MASK64$1) | 0 };
+}
+// Split bigint list into `[highWords, lowWords]` when `le=false`; with `le=true`, the first array
+// holds the low halves because `fromBig(...)` swaps the semantic meaning of `h` and `l`.
+function split$1(lst, le = false) {
+    const len = lst.length;
+    let Ah = new Uint32Array(len);
+    let Al = new Uint32Array(len);
+    for (let i = 0; i < len; i++) {
+        const { h, l } = fromBig$1(lst[i], le);
+        [Ah[i], Al[i]] = [h, l];
+    }
+    return [Ah, Al];
+}
+// Split a JS number into u32 halves without a BigInt allocation. Exact only for integers
+// `0 <= n < 2**53`; callers use it on byte / bit counters, which JS length math caps far below
+// that (an ArrayBuffer cannot exceed 2**53 - 1 bytes).
+const fromNumH = (n) => (n / 2 ** 32) | 0;
+const fromNumL = (n) => n >>> 0;
+// Drop-in replacement for `view.setBigUint64(byteOffset, BigInt(n), isLE)` without the per-call
+// BigInt allocation. Same `n < 2**53` precondition as `fromNumH`/`fromNumL`.
+function setU64FromNum(view, byteOffset, n, isLE) {
+    const h = fromNumH(n);
+    const l = fromNumL(n);
+    view.setUint32(byteOffset, isLE ? l : h, isLE);
+    view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
+}
+// High 32-bit half of a 64-bit logical right shift for `s` in `0..31`.
+const shrSH = (h, _l, s) => h >>> s;
+// Low 32-bit half of a 64-bit logical right shift, valid for `s` in `1..31`.
+const shrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
+// High 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.
+const rotrSH = (h, l, s) => (h >>> s) | (l << (32 - s));
+// Low 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.
+const rotrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
+// High 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.
+const rotrBH = (h, l, s) => (h << (64 - s)) | (l >>> (s - 32));
+// Low 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.
+const rotrBL = (h, l, s) => (h >>> (s - 32)) | (l << (64 - s));
+// High 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped low half.
+const rotr32H = (_h, l) => l;
+// Low 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped high half.
+const rotr32L = (h, _l) => h;
+// 64-bit left rotates (rotl*) are not defined here: sha3.ts, their only consumer, keeps
+// local copies so V8 inlines them into keccakP.
+// Add two split 64-bit words and return the split `{ h, l }` sum.
+// JS uses 32-bit signed integers for bitwise operations, so we cannot simply shift the carry out
+// of the low sum and instead use division.
+function add(Ah, Al, Bh, Bl) {
+    const l = (Al >>> 0) + (Bl >>> 0);
+    return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };
+}
+// Addition with more than 2 elements
+// Unmasked low-word accumulator for 3-way addition; pass the raw result into `add3H(...)`.
+const add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+// High-word finalize step for 3-way addition; `low` must be the untruncated output of `add3L(...)`.
+const add3H = (low, Ah, Bh, Ch) => (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;
+// Unmasked low-word accumulator for 4-way addition; pass the raw result into `add4H(...)`.
+const add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+// High-word finalize step for 4-way addition; `low` must be the untruncated output of `add4L(...)`.
+const add4H = (low, Ah, Bh, Ch, Dh) => (Ah + Bh + Ch + Dh + ((low / 2 ** 32) | 0)) | 0;
+// Unmasked low-word accumulator for 5-way addition; pass the raw result into `add5H(...)`.
+const add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+// High-word finalize step for 5-way addition; `low` must be the untruncated output of `add5L(...)`.
+const add5H = (low, Ah, Bh, Ch, Dh, Eh) => (Ah + Bh + Ch + Dh + Eh + ((low / 2 ** 32) | 0)) | 0;
+
 /**
  * Internal Merkle-Damgard hash utils.
  * @module
@@ -515,6 +672,7 @@ class HashMD {
         abytes$1(data);
         const { view, buffer, blockLen } = this;
         const len = data.length;
+        let processed = false;
         for (let pos = 0; pos < len;) {
             const take = Math.min(blockLen - this.pos, len - pos);
             // Fast path only when there is no buffered partial block: `take === blockLen` implies
@@ -523,18 +681,25 @@ class HashMD {
                 const dataView = createView(data);
                 for (; blockLen <= len - pos; pos += blockLen)
                     this.process(dataView, pos);
+                processed = true;
                 continue;
             }
-            buffer.set(data.subarray(pos, pos + take), this.pos);
+            // When the whole input is buffered in one go (common for short messages), passing `data`
+            // directly avoids allocating a subarray view.
+            buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
             this.pos += take;
             pos += take;
             if (this.pos === blockLen) {
                 this.process(view, 0);
                 this.pos = 0;
+                processed = true;
             }
         }
         this.length += data.length;
-        this.roundClean();
+        // Shared schedule buffers only pick up input-derived words inside process(); if everything
+        // was buffered without processing, there is nothing to zero.
+        if (processed)
+            this.roundClean();
         return this;
     }
     digestInto(out) {
@@ -546,32 +711,33 @@ class HashMD {
         // was previously not allocated here. But it won't change performance.
         const { buffer, view, blockLen, isLE } = this;
         let { pos } = this;
-        // append the bit '1' to the message
+        // append the bit '1' to the message, then zero-pad the rest of the block
         buffer[pos++] = 0b10000000;
-        clean$1(this.buffer.subarray(pos));
+        buffer.fill(0, pos);
         // we have less than padOffset left in buffer, so we cannot put length in
         // current block, need process it and pad again
         if (this.padOffset > blockLen - pos) {
             this.process(view, 0);
-            pos = 0;
+            buffer.fill(0);
         }
-        // Pad until full block byte with zeros
-        for (let i = pos; i < blockLen; i++)
-            buffer[i] = 0;
         // `padOffset` reserves the whole length field. For SHA-384/512 the high 64 bits stay zero from
         // the padding fill above, and JS will overflow before user input can make that half non-zero.
-        // So we only need to write the low 64 bits here.
-        view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
+        // So we only need to write the low 64 bits here (`length * 8` only scales the exponent of an
+        // integer below 2**53, so the split inside the helper stays exact).
+        setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
         this.process(view, 0);
-        const oview = createView(out);
+        // The final block above is processed outside update(), so the shared message-schedule
+        // buffers (e.g. SHA256_W) would otherwise retain input-derived words after digest().
+        this.roundClean();
+        // digest() passes our own `buffer` as `out`; reuse its cached view instead of allocating one.
+        const oview = out === buffer ? view : createView(out);
         const len = this.outputLen;
         // NOTE: we do division by 4 later, which must be fused in single op with modulo by JIT
-        if (len % 4)
-            throw new Error('_sha2: outputLen must be aligned to 32bit');
         const outLen = len / 4;
         const state = this.get();
-        if (outLen > state.length)
-            throw new Error('_sha2: outputLen bigger than state');
+        // Subclass-misconfiguration invariant: outputLen must be 32-bit aligned and fit the state.
+        if (len % 4 || outLen > state.length)
+            throw new Error('invalid outputLen');
         for (let i = 0; i < outLen; i++)
             oview.setUint32(4 * i, state[i], isLE);
     }
@@ -584,18 +750,16 @@ class HashMD {
         this.destroy();
         return res;
     }
-    _cloneInto(to) {
-        to ||= new this.constructor();
-        to.set(...this.get());
-        const { blockLen, buffer, length, finished, destroyed, pos } = this;
+    _cloneIntoMeta(to) {
+        const { buffer, length, finished, destroyed, pos } = this;
         to.destroyed = destroyed;
         to.finished = finished;
         to.length = length;
         to.pos = pos;
         // Only partial-block bytes need copying: when `length % blockLen === 0`, `pos === 0` and
         // later `update()` / `digestInto()` overwrite `to.buffer` from the start before reading it.
-        if (length % blockLen)
-            to.buffer.set(buffer);
+        if (pos)
+            to.buffer.set(buffer); // Avoid a hot modulo guard.
         return to;
     }
     clone() {
@@ -621,64 +785,6 @@ const SHA512_IV = /* @__PURE__ */ Uint32Array.from([
     0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179,
 ]);
 
-const U32_MASK64$1 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
-const _32n$1 = /* @__PURE__ */ BigInt(32);
-// Split bigint into two 32-bit halves. With `le=true`, returned fields become `{ h: low, l: high
-// }` to match little-endian word order rather than the property names.
-function fromBig$1(n, le = false) {
-    if (le)
-        return { h: Number(n & U32_MASK64$1), l: Number((n >> _32n$1) & U32_MASK64$1) };
-    return { h: Number((n >> _32n$1) & U32_MASK64$1) | 0, l: Number(n & U32_MASK64$1) | 0 };
-}
-// Split bigint list into `[highWords, lowWords]` when `le=false`; with `le=true`, the first array
-// holds the low halves because `fromBig(...)` swaps the semantic meaning of `h` and `l`.
-function split$1(lst, le = false) {
-    const len = lst.length;
-    let Ah = new Uint32Array(len);
-    let Al = new Uint32Array(len);
-    for (let i = 0; i < len; i++) {
-        const { h, l } = fromBig$1(lst[i], le);
-        [Ah[i], Al[i]] = [h, l];
-    }
-    return [Ah, Al];
-}
-// High 32-bit half of a 64-bit logical right shift for `s` in `0..31`.
-const shrSH = (h, _l, s) => h >>> s;
-// Low 32-bit half of a 64-bit logical right shift, valid for `s` in `1..31`.
-const shrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
-// High 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.
-const rotrSH = (h, l, s) => (h >>> s) | (l << (32 - s));
-// Low 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.
-const rotrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
-// High 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.
-const rotrBH = (h, l, s) => (h << (64 - s)) | (l >>> (s - 32));
-// Low 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.
-const rotrBL = (h, l, s) => (h >>> (s - 32)) | (l << (64 - s));
-// High 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped low half.
-const rotr32H = (_h, l) => l;
-// Low 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped high half.
-const rotr32L = (h, _l) => h;
-// Add two split 64-bit words and return the split `{ h, l }` sum.
-// JS uses 32-bit signed integers for bitwise operations, so we cannot simply shift the carry out
-// of the low sum and instead use division.
-function add(Ah, Al, Bh, Bl) {
-    const l = (Al >>> 0) + (Bl >>> 0);
-    return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };
-}
-// Addition with more than 2 elements
-// Unmasked low-word accumulator for 3-way addition; pass the raw result into `add3H(...)`.
-const add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
-// High-word finalize step for 3-way addition; `low` must be the untruncated output of `add3L(...)`.
-const add3H = (low, Ah, Bh, Ch) => (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;
-// Unmasked low-word accumulator for 4-way addition; pass the raw result into `add4H(...)`.
-const add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
-// High-word finalize step for 4-way addition; `low` must be the untruncated output of `add4L(...)`.
-const add4H = (low, Ah, Bh, Ch, Dh) => (Ah + Bh + Ch + Dh + ((low / 2 ** 32) | 0)) | 0;
-// Unmasked low-word accumulator for 5-way addition; pass the raw result into `add5H(...)`.
-const add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
-// High-word finalize step for 5-way addition; `low` must be the untruncated output of `add5L(...)`.
-const add5H = (low, Ah, Bh, Ch, Dh, Eh) => (Ah + Bh + Ch + Dh + Eh + ((low / 2 ** 32) | 0)) | 0;
-
 /**
  * blake2b (64-bit) & blake2s (8 to 32-bit) hash functions.
  * b could have been faster, but there is no fast u64 in js, so s is 1.5x faster.
@@ -701,21 +807,28 @@ function G1b(a, b, c, d, msg, x) {
     let Cl = BBUF[2 * c], Ch = BBUF[2 * c + 1]; // prettier-ignore
     let Dl = BBUF[2 * d], Dh = BBUF[2 * d + 1]; // prettier-ignore
     // v[a] = (v[a] + v[b] + x) | 0;
-    let ll = add3L(Al, Bl, Xl);
+    const ll = add3L(Al, Bl, Xl);
     Ah = add3H(ll, Ah, Bh, Xh);
     Al = ll | 0;
     // v[d] = rotr(v[d] ^ v[a], 32)
-    ({ Dh, Dl } = { Dh: Dh ^ Ah, Dl: Dl ^ Al });
-    ({ Dh, Dl } = { Dh: rotr32H(Dh, Dl), Dl: rotr32L(Dh) });
+    let xh = Dh ^ Ah, xl = Dl ^ Al; // prettier-ignore
+    Dh = rotr32H(xh, xl);
+    Dl = rotr32L(xh);
     // v[c] = (v[c] + v[d]) | 0;
     ({ h: Ch, l: Cl } = add(Ch, Cl, Dh, Dl));
     // v[b] = rotr(v[b] ^ v[c], 24)
-    ({ Bh, Bl } = { Bh: Bh ^ Ch, Bl: Bl ^ Cl });
-    ({ Bh, Bl } = { Bh: rotrSH(Bh, Bl, 24), Bl: rotrSL(Bh, Bl, 24) });
-    ((BBUF[2 * a] = Al), (BBUF[2 * a + 1] = Ah));
-    ((BBUF[2 * b] = Bl), (BBUF[2 * b + 1] = Bh));
-    ((BBUF[2 * c] = Cl), (BBUF[2 * c + 1] = Ch));
-    ((BBUF[2 * d] = Dl), (BBUF[2 * d + 1] = Dh));
+    xh = Bh ^ Ch;
+    xl = Bl ^ Cl;
+    Bh = rotrSH(xh, xl, 24);
+    Bl = rotrSL(xh, xl, 24);
+    BBUF[2 * a] = Al;
+    BBUF[2 * a + 1] = Ah;
+    BBUF[2 * b] = Bl;
+    BBUF[2 * b + 1] = Bh;
+    BBUF[2 * c] = Cl;
+    BBUF[2 * c + 1] = Ch;
+    BBUF[2 * d] = Dl;
+    BBUF[2 * d + 1] = Dh;
 }
 // Second half-round of the same LE-limb BLAKE2b G mix; `x` is the message word offset.
 function G2b(a, b, c, d, msg, x) {
@@ -726,27 +839,35 @@ function G2b(a, b, c, d, msg, x) {
     let Cl = BBUF[2 * c], Ch = BBUF[2 * c + 1]; // prettier-ignore
     let Dl = BBUF[2 * d], Dh = BBUF[2 * d + 1]; // prettier-ignore
     // v[a] = (v[a] + v[b] + x) | 0;
-    let ll = add3L(Al, Bl, Xl);
+    const ll = add3L(Al, Bl, Xl);
     Ah = add3H(ll, Ah, Bh, Xh);
     Al = ll | 0;
     // v[d] = rotr(v[d] ^ v[a], 16)
-    ({ Dh, Dl } = { Dh: Dh ^ Ah, Dl: Dl ^ Al });
-    ({ Dh, Dl } = { Dh: rotrSH(Dh, Dl, 16), Dl: rotrSL(Dh, Dl, 16) });
+    let xh = Dh ^ Ah, xl = Dl ^ Al; // prettier-ignore
+    Dh = rotrSH(xh, xl, 16);
+    Dl = rotrSL(xh, xl, 16);
     // v[c] = (v[c] + v[d]) | 0;
     ({ h: Ch, l: Cl } = add(Ch, Cl, Dh, Dl));
     // v[b] = rotr(v[b] ^ v[c], 63)
-    ({ Bh, Bl } = { Bh: Bh ^ Ch, Bl: Bl ^ Cl });
-    ({ Bh, Bl } = { Bh: rotrBH(Bh, Bl, 63), Bl: rotrBL(Bh, Bl, 63) });
-    ((BBUF[2 * a] = Al), (BBUF[2 * a + 1] = Ah));
-    ((BBUF[2 * b] = Bl), (BBUF[2 * b + 1] = Bh));
-    ((BBUF[2 * c] = Cl), (BBUF[2 * c + 1] = Ch));
-    ((BBUF[2 * d] = Dl), (BBUF[2 * d + 1] = Dh));
+    xh = Bh ^ Ch;
+    xl = Bl ^ Cl;
+    Bh = rotrBH(xh, xl, 63);
+    Bl = rotrBL(xh, xl, 63);
+    BBUF[2 * a] = Al;
+    BBUF[2 * a + 1] = Ah;
+    BBUF[2 * b] = Bl;
+    BBUF[2 * b + 1] = Bh;
+    BBUF[2 * c] = Cl;
+    BBUF[2 * c + 1] = Ch;
+    BBUF[2 * d] = Dl;
+    BBUF[2 * d + 1] = Dh;
 }
 function checkBlake2Opts(outputLen, opts = {}, keyLen, saltLen, persLen) {
-    anumber$2(keyLen);
-    // RFC 7693 §2.1 requires digest length nn in 1..keyLen.
+    anumber$1(keyLen);
+    // RFC 7693 §2.1 requires digest length nn in 1..keyLen (keyLen doubles as
+    // the per-variant max for both key and digest lengths: 64 for b, 32 for s).
     if (outputLen <= 0 || outputLen > keyLen)
-        throw new Error('outputLen bigger than keyLen');
+        throw new Error('"dkLen" must be 1..' + keyLen + ', got ' + outputLen);
     const { key, salt, personalization } = opts;
     // This API uses `undefined` for the RFC 7693 `kk = 0` case, so a provided key must be non-empty.
     if (key !== undefined && (key.length < 1 || key.length > keyLen))
@@ -768,8 +889,8 @@ class _BLAKE2 {
     outputLen;
     canXOF = false;
     constructor(blockLen, outputLen) {
-        anumber$2(blockLen);
-        anumber$2(outputLen);
+        anumber$1(blockLen);
+        anumber$1(outputLen);
         this.blockLen = blockLen;
         this.outputLen = outputLen;
         this.buffer = new Uint8Array(blockLen);
@@ -807,7 +928,9 @@ class _BLAKE2 {
                 swap32IfBE$1(data32);
                 continue;
             }
-            buffer.set(data.subarray(pos, pos + take), this.pos);
+            // When the whole input is buffered in one go (common for short messages), passing `data`
+            // directly avoids allocating a subarray view.
+            buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
             this.pos += take;
             this.length += take;
             pos += take;
@@ -817,18 +940,19 @@ class _BLAKE2 {
     digestInto(out) {
         aexists$1(this);
         aoutput$1(out, this);
+        // Reject unaligned views explicitly instead of hiding them behind a full scratch copy.
+        if (out.byteOffset & 3)
+            throw new RangeError('"output" expected 4-byte aligned byteOffset, got ' + out.byteOffset);
         const { pos, buffer32 } = this;
         this.finished = true;
         // Padding
-        clean$1(this.buffer.subarray(pos));
+        this.buffer.fill(0, pos);
         swap32IfBE$1(buffer32);
         this.compress(buffer32, 0, true);
         swap32IfBE$1(buffer32);
-        // Reject unaligned views explicitly instead of hiding them behind a full scratch copy.
-        if (out.byteOffset & 3)
-            throw new RangeError('"digestInto() output" expected 4-byte aligned byteOffset, got ' + out.byteOffset);
         const state = this.get();
-        const out32 = u32$1(out);
+        // digest() passes our own `buffer` as `out`; reuse its cached u32 view instead of allocating.
+        const out32 = out === this.buffer ? buffer32 : u32$1(out);
         const full = Math.floor(this.outputLen / 4);
         for (let i = 0; i < full; i++)
             out32[i] = swap8IfBE(state[i]);
@@ -853,6 +977,7 @@ class _BLAKE2 {
         // Recreate only `dkLen`; key/salt/personalization are already absorbed into the copied state.
         to ||= new this.constructor({ dkLen: outputLen });
         to.set(...this.get());
+        // Last-block-aware lazy compression keeps the pending block live even when full.
         to.buffer.set(buffer);
         to.destroyed = destroyed;
         to.finished = finished;
@@ -886,6 +1011,7 @@ class _BLAKE2b extends _BLAKE2 {
     v7l = B2B_IV[14] | 0;
     v7h = B2B_IV[15] | 0;
     constructor(opts = {}) {
+        opts = checkOpts$1({}, opts);
         const olen = opts.dkLen === undefined ? 64 : opts.dkLen;
         super(128, olen);
         checkBlake2Opts(olen, opts, 64, 16, 16);
@@ -900,7 +1026,8 @@ class _BLAKE2b extends _BLAKE2 {
         this.v0l ^= this.outputLen | (keyLength << 8) | (0x01 << 16) | (0x01 << 24);
         if (salt !== undefined) {
             abytes$1(salt, undefined, 'salt');
-            const slt = u32$1(salt);
+            // Copy: u32() would throw on views with byteOffset not divisible by 4.
+            const slt = u32$1(copyBytes(salt));
             this.v4l ^= swap8IfBE(slt[0]);
             this.v4h ^= swap8IfBE(slt[1]);
             this.v5l ^= swap8IfBE(slt[2]);
@@ -908,7 +1035,8 @@ class _BLAKE2b extends _BLAKE2 {
         }
         if (personalization !== undefined) {
             abytes$1(personalization, undefined, 'personalization');
-            const pers = u32$1(personalization);
+            // Copy: u32() would throw on views with byteOffset not divisible by 4.
+            const pers = u32$1(copyBytes(personalization));
             this.v6l ^= swap8IfBE(pers[0]);
             this.v6h ^= swap8IfBE(pers[1]);
             this.v7l ^= swap8IfBE(pers[2]);
@@ -919,6 +1047,8 @@ class _BLAKE2b extends _BLAKE2 {
             const tmp = new Uint8Array(this.blockLen);
             tmp.set(key);
             this.update(tmp);
+            // The padded copy holds key material; buffer/state keep what they need.
+            clean$1(tmp);
         }
     }
     // prettier-ignore
@@ -946,9 +1076,32 @@ class _BLAKE2b extends _BLAKE2 {
         this.v7h = v7h | 0;
     }
     compress(msg, offset, isLast) {
-        this.get().forEach((v, i) => (BBUF[i] = v)); // First half from state.
+        // First half from state. Direct writes: get() would allocate an array +
+        // closure per block.
+        // prettier-ignore
+        const { v0l, v0h, v1l, v1h, v2l, v2h, v3l, v3h, v4l, v4h, v5l, v5h, v6l, v6h, v7l, v7h } = this;
+        // prettier-ignore
+        {
+            BBUF[0] = v0l;
+            BBUF[1] = v0h;
+            BBUF[2] = v1l;
+            BBUF[3] = v1h;
+            BBUF[4] = v2l;
+            BBUF[5] = v2h;
+            BBUF[6] = v3l;
+            BBUF[7] = v3h;
+            BBUF[8] = v4l;
+            BBUF[9] = v4h;
+            BBUF[10] = v5l;
+            BBUF[11] = v5h;
+            BBUF[12] = v6l;
+            BBUF[13] = v6h;
+            BBUF[14] = v7l;
+            BBUF[15] = v7h;
+        }
         BBUF.set(B2B_IV, 16); // Second half from IV.
-        let { h, l } = fromBig$1(BigInt(this.length));
+        const l = fromNumL(this.length);
+        const h = fromNumH(this.length);
         BBUF[24] = B2B_IV[8] ^ l; // Low word of the offset.
         BBUF[25] = B2B_IV[9] ^ h; // High word.
         // Invert all bits for last block
@@ -1014,6 +1167,16 @@ class _BLAKE2b extends _BLAKE2 {
  * ```ts
  * blake2b(new Uint8Array([97, 98, 99]));
  * ```
+ * @example
+ * Hash a message with Blake2b while selecting output, MAC, salt, and personalization settings.
+ * ```ts
+ * blake2b(new Uint8Array([97, 98, 99]), {
+ *   dkLen: 32,
+ *   key: new Uint8Array(32),
+ *   salt: new Uint8Array(16),
+ *   personalization: new Uint8Array(16),
+ * });
+ * ```
  */
 const blake2b = /* @__PURE__ */ createHasher$1((opts) => new _BLAKE2b(opts));
 
@@ -1268,18 +1431,16 @@ class ECKey {
         const hash = blake2b(bytes, { dkLen: 32 });
         let signature;
         if (__classPrivateFieldGet(this, _ECKey_keyPair, "f").curve === 'secp256k1') {
-            signature = secp256k1
-                .sign(hash, __classPrivateFieldGet(this, _ECKey_keyPair, "f").secretKey, {
+            signature = secp256k1.sign(hash, __classPrivateFieldGet(this, _ECKey_keyPair, "f").secretKey, {
                 lowS: true, // Use canonical signatures (prevents malleability)
-            })
-                .toBytes('compact');
+                prehash: false,
+            });
         }
         else {
-            signature = p256
-                .sign(hash, __classPrivateFieldGet(this, _ECKey_keyPair, "f").secretKey, {
+            signature = p256.sign(hash, __classPrivateFieldGet(this, _ECKey_keyPair, "f").secretKey, {
                 lowS: true, // Use canonical signatures (prevents malleability)
-            })
-                .toBytes('compact');
+                prehash: false,
+            });
         }
         return {
             rawSignature: signature,
@@ -1350,12 +1511,12 @@ class ECPublicKey {
         // We need to convert the stored public key to the requested format
         if (this.curve === 'secp256k1') {
             // For secp256k1, we need to get the public key from the stored bytes and convert format
-            const point = secp256k1.Point.fromHex(__classPrivateFieldGet(this, _ECPublicKey_key, "f"));
+            const point = secp256k1.Point.fromBytes(__classPrivateFieldGet(this, _ECPublicKey_key, "f"));
             return point.toBytes(compress);
         }
         else {
             // For p256, we need to get the public key from the stored bytes and convert format
-            const point = p256.Point.fromHex(__classPrivateFieldGet(this, _ECPublicKey_key, "f"));
+            const point = p256.Point.fromBytes(__classPrivateFieldGet(this, _ECPublicKey_key, "f"));
             return point.toBytes(compress);
         }
     }
@@ -1395,7 +1556,7 @@ class _HMAC {
         abytes$1(key, undefined, 'key');
         this.iHash = hash.create();
         if (typeof this.iHash.update !== 'function')
-            throw new Error('Expected instance of class which extends utils.Hash');
+            throw new Error('expected Hash instance');
         this.blockLen = this.iHash.blockLen;
         this.outputLen = this.iHash.outputLen;
         const blockLen = this.blockLen;
@@ -1440,12 +1601,13 @@ class _HMAC {
         // Create new instance without calling constructor since the key
         // is already in state and we don't know it.
         to ||= Object.create(Object.getPrototypeOf(this), {});
-        const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+        const { oHash, iHash, finished, destroyed, blockLen, outputLen, canXOF } = this;
         to = to;
         to.finished = finished;
         to.destroyed = destroyed;
         to.blockLen = blockLen;
         to.outputLen = outputLen;
+        to.canXOF = canXOF;
         to.oHash = oHash._cloneInto(to.oHash);
         to.iHash = iHash._cloneInto(to.iHash);
         return to;
@@ -1469,16 +1631,16 @@ const hmac = /* @__PURE__ */ (() => {
  * PBKDF (RFC 2898). Can be used to create a key from password and salt.
  * @module
  */
-// Common start and end for sync/async functions
+// Common validation and per-call state setup for sync/async functions.
 function pbkdf2Init(hash, _password, _salt, _opts) {
     ahash$1(hash);
     const opts = checkOpts$1({ dkLen: 32, asyncTick: 10 }, _opts);
     const { c, dkLen, asyncTick } = opts;
-    anumber$2(c, 'c');
-    anumber$2(dkLen, 'dkLen');
-    anumber$2(asyncTick, 'asyncTick');
+    anumber$1(c, 'c');
+    anumber$1(dkLen, 'dkLen');
+    anumber$1(asyncTick, 'asyncTick');
     if (c < 1)
-        throw new Error('iterations (c) must be >= 1');
+        throw new Error('"c" (iterations) must be >= 1');
     // RFC 8018 §5.2 defines `dkLen` as "a positive integer".
     if (dkLen < 1)
         throw new Error('"dkLen" must be >= 1');
@@ -1486,25 +1648,69 @@ function pbkdf2Init(hash, _password, _salt, _opts) {
     // before allocating the destination buffer.
     if (dkLen > (2 ** 32 - 1) * hash.outputLen)
         throw new Error('derived key too long');
-    const password = kdfInputToBytes(_password, 'password');
-    const salt = kdfInputToBytes(_salt, 'salt');
-    // DK = PBKDF2(PRF, Password, Salt, c, dkLen);
-    const DK = new Uint8Array(dkLen);
-    // U1 = PRF(Password, Salt + INT_32_BE(i))
-    const PRF = hmac.create(hash, password);
-    // Cache PRF(P, S || ...) prefix state so each block only appends INT_32_BE(i).
-    const PRFSalt = PRF._cloneInto().update(salt);
-    return { c, dkLen, asyncTick, DK, PRF, PRFSalt };
+    const p = kdfInputToBytes(_password, 'password');
+    try {
+        const s = kdfInputToBytes(_salt, 'salt');
+        try {
+            // DK = PBKDF2(PRF, Password, Salt, c, dkLen);
+            const DK = new Uint8Array(dkLen);
+            const { iHash, oHash, outputLen } = hmac.create(hash, p);
+            // Drive keyed hashes directly; the wrapper is only needed to initialize their HMAC midstates.
+            const u = new Uint8Array(outputLen);
+            const eng = pbkdf2Engine(iHash, oHash, s, u);
+            return { c, dkLen, asyncTick, DK, outputLen, eng };
+        }
+        finally {
+            // Uint8Array inputs belong to the caller; only wipe our UTF-8 conversion.
+            if (typeof _salt === 'string')
+                clean$1(s);
+        }
+    }
+    finally {
+        if (typeof _password === 'string')
+            clean$1(p);
+    }
 }
-function pbkdf2Output(PRF, PRFSalt, DK, prfW, u) {
-    // Shared sync/async cleanup point: wipe transient PRF state
-    // while preserving the derived key buffer.
-    PRF.destroy();
-    PRFSalt.destroy();
-    if (prfW)
-        prfW.destroy();
-    clean$1(u);
-    return DK;
+// Per-call PRF driver writes U1 into both `u` and `Ti`, then later digests into `u`;
+// shared by the sync and async variants.
+function pbkdf2Engine(iHash, oHash, salt, u) {
+    const counter = new Uint8Array(4);
+    const view = createView(counter);
+    // Full clones retain tree/config state; absorb salt before async yields without cloning input.
+    const salted = iHash._cloneInto().update(salt);
+    // u1() overwrites the worker before reading it. Seed from the outer midstate so a long salt
+    // cannot pre-populate a tree stack that the first reset would abandon without wiping.
+    const work = oHash._cloneInto();
+    const iClone = iHash._cloneInto; // Capture before mixed feedback can materialize state tuples.
+    const oClone = oHash._cloneInto;
+    return {
+        u1: (ti, Ti) => {
+            view.setInt32(0, ti, false);
+            salted._cloneInto(work).update(counter).digestInto(u);
+            oHash._cloneInto(work).update(u).digestInto(u);
+            Ti.set(u.subarray(0, Ti.length));
+        },
+        // Whole `F` inner loop for the sync variant: one optimized function owns the hot loop.
+        rounds: (c, Ti) => {
+            for (let ui = 1; ui < c; ui++) {
+                iClone.call(iHash, work).update(u).digestInto(u);
+                oClone.call(oHash, work).update(u).digestInto(u);
+                for (let i = 0; i < Ti.length; i++)
+                    Ti[i] ^= u[i];
+            }
+        },
+        output: (DK) => {
+            // Keyed templates and derived worker states are secret material.
+            iHash.destroy();
+            oHash.destroy();
+            salted.destroy();
+            work.destroy();
+            // Shared sync/async cleanup point: wipe transient PRF state
+            // while preserving the derived key buffer.
+            clean$1(u);
+            return DK;
+        },
+    };
 }
 /**
  * PBKDF2-HMAC: RFC 8018 key derivation function.
@@ -1525,30 +1731,20 @@ function pbkdf2Output(PRF, PRFSalt, DK, prfW, u) {
  * ```
  */
 function pbkdf2(hash, password, salt, opts) {
-    const { c, dkLen, DK, PRF, PRFSalt } = pbkdf2Init(hash, password, salt, opts);
-    let prfW; // Working copy
-    const arr = new Uint8Array(4);
-    const view = createView(arr);
-    const u = new Uint8Array(PRF.outputLen);
+    const { c, dkLen, DK, outputLen, eng } = pbkdf2Init(hash, password, salt, opts);
     // DK = T1 + T2 + ⋯ + Tdklen/hlen
-    for (let ti = 1, pos = 0; pos < dkLen; ti++, pos += PRF.outputLen) {
+    for (let ti = 1, pos = 0; pos < dkLen; ti++, pos += outputLen) {
         // Ti = F(Password, Salt, c, i)
         // The last Ti view can be shorter than hLen, which applies
         // RFC 8018 §5.2 step 4's T_l<0..r-1> truncation without extra copies.
-        const Ti = DK.subarray(pos, pos + PRF.outputLen);
-        view.setInt32(0, ti, false);
+        const Ti = DK.subarray(pos, pos + outputLen);
         // F(Password, Salt, c, i) = U1 ^ U2 ^ ⋯ ^ Uc
         // U1 = PRF(Password, Salt + INT_32_BE(i))
-        (prfW = PRFSalt._cloneInto(prfW)).update(arr).digestInto(u);
-        Ti.set(u.subarray(0, Ti.length));
-        for (let ui = 1; ui < c; ui++) {
-            // Uc = PRF(Password, Uc−1)
-            PRF._cloneInto(prfW).update(u).digestInto(u);
-            for (let i = 0; i < Ti.length; i++)
-                Ti[i] ^= u[i];
-        }
+        eng.u1(ti, Ti);
+        // Uc = PRF(Password, Uc−1); Ti ^= Uc
+        eng.rounds(c, Ti);
     }
-    return pbkdf2Output(PRF, PRFSalt, DK, prfW, u);
+    return eng.output(DK);
 }
 
 /**
@@ -1577,8 +1773,28 @@ const SHA256_K = /* @__PURE__ */ Uint32Array.from([
 const SHA256_W = /* @__PURE__ */ new Uint32Array(64);
 /** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */
 class SHA2_32B extends HashMD {
-    constructor(outputLen) {
+    // We cannot use array here since array allows indexing by variable
+    // which means optimizer/compiler cannot use registers.
+    // Numeric initializers matter: starting the fields as `undefined` changes
+    // V8's field representation and makes sha256 3x slower (measured).
+    A = 0;
+    B = 0;
+    C = 0;
+    D = 0;
+    E = 0;
+    F = 0;
+    G = 0;
+    H = 0;
+    constructor(outputLen, IV) {
         super(64, outputLen, 8, false);
+        this.A = IV[0] | 0;
+        this.B = IV[1] | 0;
+        this.C = IV[2] | 0;
+        this.D = IV[3] | 0;
+        this.E = IV[4] | 0;
+        this.F = IV[5] | 0;
+        this.G = IV[6] | 0;
+        this.H = IV[7] | 0;
     }
     get() {
         const { A, B, C, D, E, F, G, H } = this;
@@ -1595,6 +1811,10 @@ class SHA2_32B extends HashMD {
         this.G = G | 0;
         this.H = H | 0;
     }
+    _cloneInto(to) {
+        (to ||= new this.constructor()).set(...this.get());
+        return this._cloneIntoMeta(to);
+    }
     process(view, offset) {
         // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array
         for (let i = 0; i < 16; i++, offset += 4)
@@ -1646,18 +1866,8 @@ class SHA2_32B extends HashMD {
 }
 /** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */
 class _SHA256 extends SHA2_32B {
-    // We cannot use array here since array allows indexing by variable
-    // which means optimizer/compiler cannot use registers.
-    A = SHA256_IV[0] | 0;
-    B = SHA256_IV[1] | 0;
-    C = SHA256_IV[2] | 0;
-    D = SHA256_IV[3] | 0;
-    E = SHA256_IV[4] | 0;
-    F = SHA256_IV[5] | 0;
-    G = SHA256_IV[6] | 0;
-    H = SHA256_IV[7] | 0;
     constructor() {
-        super(32);
+        super(32, SHA256_IV);
     }
 }
 // SHA2-512 is slower than sha256 in js because u64 operations are slow.
@@ -1694,8 +1904,45 @@ const SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
 const SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
 /** Internal SHA-384 / SHA-512 compression engine from RFC 6234 §6.4. */
 class SHA2_64B extends HashMD {
-    constructor(outputLen) {
+    // We cannot use array here since array allows indexing by variable
+    // which means optimizer/compiler cannot use registers.
+    // h -- high 32 bits, l -- low 32 bits
+    // Numeric initializers matter: starting the fields as `undefined` changes
+    // V8's field representation and slows hashing down (measured on sha256).
+    Ah = 0;
+    Al = 0;
+    Bh = 0;
+    Bl = 0;
+    Ch = 0;
+    Cl = 0;
+    Dh = 0;
+    Dl = 0;
+    Eh = 0;
+    El = 0;
+    Fh = 0;
+    Fl = 0;
+    Gh = 0;
+    Gl = 0;
+    Hh = 0;
+    Hl = 0;
+    constructor(outputLen, IV) {
         super(128, outputLen, 16, false);
+        this.Ah = IV[0] | 0;
+        this.Al = IV[1] | 0;
+        this.Bh = IV[2] | 0;
+        this.Bl = IV[3] | 0;
+        this.Ch = IV[4] | 0;
+        this.Cl = IV[5] | 0;
+        this.Dh = IV[6] | 0;
+        this.Dl = IV[7] | 0;
+        this.Eh = IV[8] | 0;
+        this.El = IV[9] | 0;
+        this.Fh = IV[10] | 0;
+        this.Fl = IV[11] | 0;
+        this.Gh = IV[12] | 0;
+        this.Gl = IV[13] | 0;
+        this.Hh = IV[14] | 0;
+        this.Hl = IV[15] | 0;
     }
     // prettier-ignore
     get() {
@@ -1721,6 +1968,10 @@ class SHA2_64B extends HashMD {
         this.Hh = Hh | 0;
         this.Hl = Hl | 0;
     }
+    _cloneInto(to) {
+        (to ||= new this.constructor()).set(...this.get());
+        return this._cloneIntoMeta(to);
+    }
     process(view, offset) {
         // Extend the first 16 words into the remaining 64 words w[16..79] of the message schedule array
         for (let i = 0; i < 16; i++, offset += 4) {
@@ -1804,24 +2055,8 @@ class SHA2_64B extends HashMD {
 }
 /** Internal SHA-512 hash class grounded in RFC 6234 §6.3 and §6.4. */
 class _SHA512 extends SHA2_64B {
-    Ah = SHA512_IV[0] | 0;
-    Al = SHA512_IV[1] | 0;
-    Bh = SHA512_IV[2] | 0;
-    Bl = SHA512_IV[3] | 0;
-    Ch = SHA512_IV[4] | 0;
-    Cl = SHA512_IV[5] | 0;
-    Dh = SHA512_IV[6] | 0;
-    Dl = SHA512_IV[7] | 0;
-    Eh = SHA512_IV[8] | 0;
-    El = SHA512_IV[9] | 0;
-    Fh = SHA512_IV[10] | 0;
-    Fl = SHA512_IV[11] | 0;
-    Gh = SHA512_IV[12] | 0;
-    Gl = SHA512_IV[13] | 0;
-    Hh = SHA512_IV[14] | 0;
-    Hl = SHA512_IV[15] | 0;
     constructor() {
-        super(64);
+        super(64, SHA512_IV);
     }
 }
 /**
@@ -1832,6 +2067,7 @@ class _SHA512 extends SHA2_64B {
  * - Each sha256 hash is executing 2^18 bit operations.
  * - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.
  * @param msg - message bytes to hash
+ * @param opts - Reserved hash options.
  * @returns Digest bytes.
  * @example
  * Hash a message with SHA2-256.
@@ -1844,6 +2080,7 @@ const sha256 = /* @__PURE__ */ createHasher$1(() => new _SHA256(),
 /**
  * SHA2-512 hash function from RFC 4634.
  * @param msg - message bytes to hash
+ * @param opts - Reserved hash options.
  * @returns Digest bytes.
  * @example
  * Hash a message with SHA2-512.
@@ -1854,353 +2091,28 @@ const sha256 = /* @__PURE__ */ createHasher$1(() => new _SHA256(),
 const sha512 = /* @__PURE__ */ createHasher$1(() => new _SHA512(), 
 /* @__PURE__ */ oidNist$1(0x03));
 
-/*! scure-base - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-function isBytes$1(a) {
-    // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases. The
-    // fallback still requires a real ArrayBuffer view, so plain JSON-deserialized
-    // `{ constructor: ... }` spoofing is rejected. `BYTES_PER_ELEMENT === 1` keeps the
-    // fallback on byte-oriented views.
-    return (a instanceof Uint8Array ||
-        (ArrayBuffer.isView(a) &&
-            a.constructor.name === 'Uint8Array' &&
-            'BYTES_PER_ELEMENT' in a &&
-            a.BYTES_PER_ELEMENT === 1));
-}
-function isArrayOf(isString, arr) {
-    if (!Array.isArray(arr))
-        return false;
-    if (arr.length === 0)
-        return true;
-    if (isString) {
-        return arr.every((item) => typeof item === 'string');
-    }
-    else {
-        return arr.every((item) => Number.isSafeInteger(item));
+/*! scure-bip39 - MIT License (c) 2022 Patricio Palladino, Paul Miller (paulmillr.com) */
+// Japanese wordlist
+// The canonical BIP-39 Japanese wordlist starts with あいこくしん.
+// Use that sentinel so generated phrases use U+3000 ideographic spaces.
+const isJapanese = (wordlist) => wordlist[0] === '\u3042\u3044\u3053\u304f\u3057\u3093';
+// JavaScript strings can contain unpaired UTF-16 surrogates, which cannot be encoded as UTF-8.
+function isWellFormedUnicode(value) {
+    for (let i = 0; i < value.length; i++) {
+        const current = value.charCodeAt(i);
+        if (current >= 0xd800 && current <= 0xdbff) {
+            if (i + 1 >= value.length)
+                return false;
+            const next = value.charCodeAt(++i);
+            if (next < 0xdc00 || next > 0xdfff)
+                return false;
+        }
+        else if (current >= 0xdc00 && current <= 0xdfff) {
+            return false;
+        }
     }
-}
-function afn(input) {
-    if (typeof input !== 'function')
-        throw new TypeError('function expected');
     return true;
 }
-function astr(label, input) {
-    if (typeof input !== 'string')
-        throw new TypeError(`${label}: string expected`);
-    return true;
-}
-function anumber$1(n) {
-    if (typeof n !== 'number')
-        throw new TypeError(`number expected, got ${typeof n}`);
-    if (!Number.isSafeInteger(n))
-        throw new RangeError(`invalid integer: ${n}`);
-}
-function aArr(input) {
-    if (!Array.isArray(input))
-        throw new TypeError('array expected');
-}
-function astrArr(label, input) {
-    if (!isArrayOf(true, input))
-        throw new TypeError(`${label}: array of strings expected`);
-}
-function anumArr(label, input) {
-    if (!isArrayOf(false, input))
-        throw new TypeError(`${label}: array of numbers expected`);
-}
-/**
- * @__NO_SIDE_EFFECTS__
- */
-function chain(...args) {
-    const id = (a) => a;
-    // Wrap call in closure so JIT can inline calls
-    const wrap = (a, b) => (c) => a(b(c));
-    // Construct chain of args[-1].encode(args[-2].encode([...]))
-    const encode = args.map((x) => x.encode).reduceRight(wrap, id);
-    // Construct chain of args[0].decode(args[1].decode(...))
-    const decode = args.map((x) => x.decode).reduce(wrap, id);
-    return { encode, decode };
-}
-/**
- * Encodes integer radix representation to array of strings using alphabet and back.
- * Could also be array of strings.
- * @__NO_SIDE_EFFECTS__
- */
-function alphabet(letters) {
-    // mapping 1 to "b"
-    const lettersA = typeof letters === 'string' ? letters.split('') : letters;
-    const len = lettersA.length;
-    astrArr('alphabet', lettersA);
-    // mapping "b" to 1
-    const indexes = new Map(lettersA.map((l, i) => [l, i]));
-    return {
-        encode: (digits) => {
-            aArr(digits);
-            return digits.map((i) => {
-                if (!Number.isSafeInteger(i) || i < 0 || i >= len)
-                    throw new Error(`alphabet.encode: digit index outside alphabet "${i}". Allowed: ${letters}`);
-                return lettersA[i];
-            });
-        },
-        decode: (input) => {
-            aArr(input);
-            return input.map((letter) => {
-                astr('alphabet.decode', letter);
-                const i = indexes.get(letter);
-                if (i === undefined)
-                    throw new Error(`Unknown letter: "${letter}". Allowed: ${letters}`);
-                return i;
-            });
-        },
-    };
-}
-/**
- * @__NO_SIDE_EFFECTS__
- */
-function join(separator = '') {
-    astr('join', separator);
-    // join('') is only lossless when each chunk is already unambiguous, such as single-symbol alphabets.
-    // Multi-character tokens need a separator that cannot appear inside the chunks.
-    return {
-        encode: (from) => {
-            astrArr('join.decode', from);
-            return from.join(separator);
-        },
-        decode: (to) => {
-            astr('join.decode', to);
-            return to.split(separator);
-        },
-    };
-}
-/**
- * Pad strings array so it has integer number of bits
- * @__NO_SIDE_EFFECTS__
- */
-function padding(bits, chr = '=') {
-    anumber$1(bits);
-    astr('padding', chr);
-    return {
-        encode(data) {
-            astrArr('padding.encode', data);
-            // Mutates the intermediate token array in place while appending pad chars.
-            // utils.padding callers that need to preserve their input should pass a copy.
-            while ((data.length * bits) % 8)
-                data.push(chr);
-            return data;
-        },
-        decode(input) {
-            astrArr('padding.decode', input);
-            let end = input.length;
-            if ((end * bits) % 8)
-                throw new Error('padding: invalid, string should have whole number of bytes');
-            for (; end > 0 && input[end - 1] === chr; end--) {
-                const last = end - 1;
-                const byte = last * bits;
-                if (byte % 8 === 0)
-                    throw new Error('padding: invalid, string has too much padding');
-            }
-            return input.slice(0, end);
-        },
-    };
-}
-/**
- * Slow: O(n^2) time complexity
- */
-function convertRadix(data, from, to) {
-    // base 1 is impossible
-    if (from < 2)
-        throw new RangeError(`convertRadix: invalid from=${from}, base cannot be less than 2`);
-    if (to < 2)
-        throw new RangeError(`convertRadix: invalid to=${to}, base cannot be less than 2`);
-    aArr(data);
-    if (!data.length)
-        return [];
-    let pos = 0;
-    const res = [];
-    const digits = Array.from(data, (d) => {
-        anumber$1(d);
-        if (d < 0 || d >= from)
-            throw new Error(`invalid integer: ${d}`);
-        return d;
-    });
-    const dlen = digits.length;
-    while (true) {
-        let carry = 0;
-        let done = true;
-        for (let i = pos; i < dlen; i++) {
-            const digit = digits[i];
-            const fromCarry = from * carry;
-            const digitBase = fromCarry + digit;
-            if (!Number.isSafeInteger(digitBase) ||
-                fromCarry / from !== carry ||
-                digitBase - digit !== fromCarry) {
-                throw new Error('convertRadix: carry overflow');
-            }
-            const div = digitBase / to;
-            carry = digitBase % to;
-            const rounded = Math.floor(div);
-            digits[i] = rounded;
-            if (!Number.isSafeInteger(rounded) || rounded * to + carry !== digitBase)
-                throw new Error('convertRadix: carry overflow');
-            if (!done)
-                continue;
-            else if (!rounded)
-                pos = i;
-            else
-                done = false;
-        }
-        res.push(carry);
-        if (done)
-            break;
-    }
-    // Preserve explicit leading zero digits so callers like base58 keep zero-prefix semantics.
-    for (let i = 0; i < data.length - 1 && data[i] === 0; i++)
-        res.push(0);
-    return res.reverse();
-}
-const gcd = (a, b) => (b === 0 ? a : gcd(b, a % b));
-// Maximum carry width before the `pos` cycle repeats.
-// Residues advance in gcd(from, to) steps, so the largest pre-drain width is from + (to - gcd).
-const radix2carry = /* @__NO_SIDE_EFFECTS__ */ (from, to) => from + (to - gcd(from, to));
-const powers = /* @__PURE__ */ (() => {
-    let res = [];
-    for (let i = 0; i < 40; i++)
-        res.push(2 ** i);
-    return res;
-})();
-/**
- * Implemented with numbers, because BigInt is 5x slower
- */
-function convertRadix2(data, from, to, padding) {
-    aArr(data);
-    if (from <= 0 || from > 32)
-        throw new RangeError(`convertRadix2: wrong from=${from}`);
-    if (to <= 0 || to > 32)
-        throw new RangeError(`convertRadix2: wrong to=${to}`);
-    if (radix2carry(from, to) > 32) {
-        throw new Error(`convertRadix2: carry overflow from=${from} to=${to} carryBits=${radix2carry(from, to)}`);
-    }
-    let carry = 0;
-    let pos = 0; // bitwise position in current element
-    const max = powers[from];
-    const mask = powers[to] - 1;
-    const res = [];
-    for (const n of data) {
-        anumber$1(n);
-        if (n >= max)
-            throw new Error(`convertRadix2: invalid data word=${n} from=${from}`);
-        carry = (carry << from) | n;
-        if (pos + from > 32)
-            throw new Error(`convertRadix2: carry overflow pos=${pos} from=${from}`);
-        pos += from;
-        for (; pos >= to; pos -= to)
-            res.push(((carry >> (pos - to)) & mask) >>> 0);
-        const pow = powers[pos];
-        if (pow === undefined)
-            throw new Error('invalid carry');
-        carry &= pow - 1; // clean carry, otherwise it will cause overflow
-    }
-    carry = (carry << (to - pos)) & mask;
-    // Canonical decode paths reject leftover whole input words and non-zero pad bits.
-    // For Bech32 5->8 regrouping, this is the "4 bits or less, all zeroes" tail rule.
-    if (!padding && pos >= from)
-        throw new Error('Excess padding');
-    if (!padding && carry > 0)
-        throw new Error(`Non-zero padding: ${carry}`);
-    if (padding && pos > 0)
-        res.push(carry >>> 0);
-    return res;
-}
-/**
- * @__NO_SIDE_EFFECTS__
- */
-function radix(num) {
-    anumber$1(num);
-    const _256 = 2 ** 8;
-    // Base-range and carry-overflow checks live in convertRadix so encode/decode reject unsupported bases symmetrically.
-    return {
-        encode: (bytes) => {
-            if (!isBytes$1(bytes))
-                throw new TypeError('radix.encode input should be Uint8Array');
-            return convertRadix(Array.from(bytes), _256, num);
-        },
-        decode: (digits) => {
-            anumArr('radix.decode', digits);
-            return Uint8Array.from(convertRadix(digits, num, _256));
-        },
-    };
-}
-/**
- * If both bases are power of same number (like `2**8 <-> 2**64`),
- * there is a linear algorithm. For now we have implementation for power-of-two bases only.
- * @__NO_SIDE_EFFECTS__
- */
-function radix2(bits, revPadding = false) {
-    anumber$1(bits);
-    if (bits <= 0 || bits > 32)
-        throw new RangeError('radix2: bits should be in (0..32]');
-    if (radix2carry(8, bits) > 32 || radix2carry(bits, 8) > 32)
-        throw new RangeError('radix2: carry overflow');
-    // revPadding flips which direction allows a partial zero tail.
-    // Default pads 8->bits and rejects extra bits on bits->8; `true` does the opposite.
-    return {
-        encode: (bytes) => {
-            if (!isBytes$1(bytes))
-                throw new TypeError('radix2.encode input should be Uint8Array');
-            return convertRadix2(Array.from(bytes), 8, bits, !revPadding);
-        },
-        decode: (digits) => {
-            anumArr('radix2.decode', digits);
-            return Uint8Array.from(convertRadix2(digits, bits, 8, revPadding));
-        },
-    };
-}
-function checksum(len, fn) {
-    anumber$1(len);
-    // Reject degenerate zero-byte checksums up front so callers don't accidentally
-    // build a no-op checksum stage.
-    if (len <= 0)
-        throw new RangeError(`checksum length must be positive: ${len}`);
-    afn(fn);
-    const _fn = fn;
-    // Uses the first `len` bytes of fn(data) in both directions.
-    // Current call sites rely on `len > 0` and checksum functions that return at least that many bytes.
-    return {
-        encode(data) {
-            if (!isBytes$1(data))
-                throw new TypeError('checksum.encode: input should be Uint8Array');
-            const sum = _fn(data).slice(0, len);
-            const res = new Uint8Array(data.length + len);
-            res.set(data);
-            res.set(sum, data.length);
-            return res;
-        },
-        decode(data) {
-            if (!isBytes$1(data))
-                throw new TypeError('checksum.decode: input should be Uint8Array');
-            const payload = data.slice(0, -len);
-            const oldChecksum = data.slice(-len);
-            const newChecksum = _fn(payload).slice(0, len);
-            for (let i = 0; i < len; i++)
-                if (newChecksum[i] !== oldChecksum[i])
-                    throw new Error('Invalid checksum');
-            return payload;
-        },
-    };
-}
-// prettier-ignore
-/**
- * Low-level building blocks used by the exported codecs.
- * @example
- * Build a radix-32 coder from the low-level helpers.
- * ```ts
- * import { utils } from '@scure/base';
- * utils.radix2(5).encode(Uint8Array.from([1, 2, 3]));
- * ```
- */
-const utils = /* @__PURE__ */ Object.freeze({
-    alphabet, chain, checksum, convertRadix, convertRadix2, radix, radix2, join, padding,
-});
-
-/*! scure-bip39 - MIT License (c) 2022 Patricio Palladino, Paul Miller (paulmillr.com) */
 // Normalization replaces equivalent sequences of characters
 // so that any two texts that are equivalent will be reduced
 // to the same sequence of code points, called the normal form of the original text.
@@ -2210,6 +2122,8 @@ const utils = /* @__PURE__ */ Object.freeze({
 function nfkd(str) {
     if (typeof str !== 'string')
         throw new TypeError('invalid mnemonic type: ' + typeof str);
+    if (!isWellFormedUnicode(str))
+        throw new TypeError('expected well-formed Unicode string');
     return str.normalize('NFKD');
 }
 // BIP-39 mnemonics are consumed in NFKD form.
@@ -2227,23 +2141,97 @@ function aentropy(ent) {
     if (![16, 20, 24, 28, 32].includes(ent.length))
         throw new RangeError('invalid entropy length');
 }
+/**
+ * Generate x random words. Uses Cryptographically-Secure Random Number Generator.
+ * @param wordlist - Imported wordlist for a specific language.
+ * @param strength - Mnemonic strength, from 128 to 256 bits.
+ * @returns 12-24 word mnemonic phrase.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Generate a new English mnemonic.
+ * ```ts
+ * import { generateMnemonic } from '@scure/bip39';
+ * import { wordlist } from '@scure/bip39/wordlists/english.js';
+ * const mnemonic = generateMnemonic(wordlist, 128);
+ * // 'legal winner thank year wave sausage worth useful legal winner thank yellow'
+ * ```
+ */
+function generateMnemonic$1(wordlist, strength = 128) {
+    anumber$1(strength);
+    if (strength % 32 !== 0 || strength > 256)
+        throw new RangeError('Invalid entropy');
+    return entropyToMnemonic$1(randomBytes$2(strength / 8), wordlist);
+}
+// BIP-39 checksum is the first ENT/32 bits of SHA-256(entropy).
+// Returned as a byte with checksum bits on the left and zeroes on the right.
 const calcChecksum = (entropy) => {
     // Checksum is ent.length/4 bits long
     const bitsLeft = 8 - entropy.length / 4;
     // Zero rightmost "bitsLeft" bits in byte
     // For example: bitsLeft=4 val=10111101 -> 10110000
-    return new Uint8Array([(sha256(entropy)[0] >> bitsLeft) << bitsLeft]);
+    return (sha256(entropy)[0] >> bitsLeft) << bitsLeft;
 };
-function getCoder(wordlist) {
+function awordlist(wordlist) {
     if (!Array.isArray(wordlist) || wordlist.length !== 2048 || typeof wordlist[0] !== 'string')
         throw new TypeError('Wordlist: expected array of 2048 strings');
     wordlist.forEach((i) => {
         if (typeof i !== 'string')
             throw new TypeError('wordlist: non-string element: ' + i);
+        // Wordlists become mnemonic output, so apply the same lossless UTF-8 boundary as input phrases.
+        if (!isWellFormedUnicode(i))
+            throw new TypeError('wordlist: expected well-formed Unicode string');
     });
-    // BIP-39 appends checksum bits to entropy.
-    // It then splits the bitstream into 11-bit indexes for a 2048-word list.
-    return utils.chain(utils.checksum(1, calcChecksum), utils.radix2(11, true), utils.alphabet(wordlist));
+}
+// BIP-39 appends checksum bits to entropy,
+// then splits the bitstream into 11-bit indexes for a 2048-word list.
+function encodeWords(entropy, wordlist) {
+    awordlist(wordlist);
+    const bytes = new Uint8Array(entropy.length + 1); // entropy || checksum byte
+    bytes.set(entropy);
+    bytes[entropy.length] = calcChecksum(entropy);
+    const words = [];
+    let carry = 0; // bit accumulator, holds < 19 bits
+    let bits = 0;
+    for (const byte of bytes) {
+        carry = (carry << 8) | byte;
+        bits += 8;
+        if (bits >= 11) {
+            bits -= 11;
+            words.push(wordlist[(carry >>> bits) & 0x7ff]);
+            carry &= (1 << bits) - 1;
+        }
+    }
+    // Bits still in carry are the zero right bits of the checksum byte; drop them.
+    return words;
+}
+// Reverse of encodeWords: repacks 11-bit indexes into bytes and verifies checksum.
+function decodeWords(words, wordlist) {
+    awordlist(wordlist);
+    const entLen = (words.length / 3) * 4; // every 3 words hold 32 entropy bits + 1 checksum bit
+    const bytes = new Uint8Array(entLen + 1); // entropy || checksum byte
+    let carry = 0; // bit accumulator, holds < 19 bits
+    let bits = 0;
+    let pos = 0;
+    for (const word of words) {
+        const index = wordlist.indexOf(word);
+        if (index === -1)
+            throw new Error('Unknown word: ' + word);
+        carry = (carry << 11) | index;
+        bits += 11;
+        while (bits >= 8) {
+            bits -= 8;
+            bytes[pos++] = (carry >>> bits) & 0xff;
+        }
+        carry &= (1 << bits) - 1;
+    }
+    // Left-align leftover checksum bits, matching calcChecksum output.
+    if (bits > 0)
+        bytes[pos] = carry << (8 - bits);
+    const entropy = bytes.subarray(0, entLen);
+    if (bytes[entLen] !== calcChecksum(entropy))
+        throw new Error('Invalid checksum');
+    return Uint8Array.from(entropy);
 }
 /**
  * Reversible: Converts mnemonic string to raw entropy in form of byte array.
@@ -2267,12 +2255,37 @@ function getCoder(wordlist) {
  * ])
  * ```
  */
-function mnemonicToEntropy(mnemonic, wordlist) {
+function mnemonicToEntropy$1(mnemonic, wordlist) {
     const { words } = normalize(mnemonic);
-    const entropy = getCoder(wordlist).decode(words);
+    const entropy = decodeWords(words, wordlist);
     aentropy(entropy);
     return entropy;
 }
+/**
+ * Reversible: Converts raw entropy in form of byte array to mnemonic string.
+ * @param entropy - Byte array.
+ * @param wordlist - Imported wordlist for a specific language.
+ * @returns 12-24 words.
+ * @throws On wrong argument types. {@link TypeError}
+ * @throws On wrong argument ranges or values. {@link RangeError}
+ * @example
+ * Convert raw entropy into an English mnemonic.
+ * ```ts
+ * import { entropyToMnemonic } from '@scure/bip39';
+ * import { wordlist } from '@scure/bip39/wordlists/english.js';
+ * const ent = new Uint8Array([
+ *   0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f,
+ *   0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f
+ * ]);
+ * const mnemonic = entropyToMnemonic(ent, wordlist);
+ * // 'legal winner thank year wave sausage worth useful legal winner thank yellow'
+ * ```
+ */
+function entropyToMnemonic$1(entropy, wordlist) {
+    aentropy(entropy);
+    const words = encodeWords(entropy, wordlist);
+    return words.join(isJapanese(wordlist) ? '\u3000' : ' ');
+}
 /**
  * Validates mnemonic for being 12-24 words contained in `wordlist`.
  * @param mnemonic - 12-24 words.
@@ -2292,7 +2305,7 @@ function mnemonicToEntropy(mnemonic, wordlist) {
  */
 function validateMnemonic(mnemonic, wordlist) {
     try {
-        mnemonicToEntropy(mnemonic, wordlist);
+        mnemonicToEntropy$1(mnemonic, wordlist);
     }
     catch (e) {
         return false;
@@ -2300,7 +2313,11 @@ function validateMnemonic(mnemonic, wordlist) {
     return true;
 }
 // BIP-39 salts PBKDF2 with the UTF-8 NFKD string "mnemonic" + passphrase.
-const psalt = (passphrase) => nfkd('mnemonic' + passphrase);
+const psalt = (passphrase) => {
+    if (typeof passphrase !== 'string')
+        throw new TypeError('invalid passphrase type: ' + typeof passphrase);
+    return nfkd('mnemonic' + passphrase);
+};
 /**
  * Irreversible: Uses KDF to derive 64 bytes of key data from mnemonic + optional password.
  * @param mnemonic - 12-24 words.
@@ -4487,7 +4504,7 @@ class PrivateKey {
         const privateKeyUint8 = new Uint8Array(privateKeyBytes);
         const publicKey = priv.curve === 'secp256k1'
             ? secp256k1.getPublicKey(privateKeyUint8, true) // compressed public key
-            : p256$1.getPublicKey(privateKeyUint8, true); // compressed public key
+            : p256.getPublicKey(privateKeyUint8, true); // compressed public key
         this.keyPair = {
             curve: priv.curve,
             secretKey: priv.secretKey,
@@ -4514,7 +4531,7 @@ class PrivateKey {
             curveOrder = new BN(secp256k1.Point.CURVE().n.toString());
         }
         else {
-            curveOrder = new BN(p256$1.Point.CURVE().n.toString());
+            curveOrder = new BN(p256.Point.CURVE().n.toString());
         }
         if (curveOrder.bitLength() !== 256) {
             throw new InvalidBitSize(`Invalid curve "${curve}" with bit size "${curveOrder.bitLength()}" expecting bit size "256"`);
@@ -4564,7 +4581,7 @@ class PrivateKey {
                 curveOrder = new BN(secp256k1.Point.CURVE().n.toString());
             }
             else {
-                curveOrder = new BN(p256$1.Point.CURVE().n.toString());
+                curveOrder = new BN(p256.Point.CURVE().n.toString());
             }
             if (d.cmp(curveOrder) < 0) {
                 d = d.add(this.keyPair.secretKey).mod(curveOrder);
@@ -4682,6 +4699,73 @@ const generateSecretKey = (seed, derivationPath, curve) => {
     }
 };
 
+/**
+ * Converts an English BIP39 mnemonic to entropy bytes.
+ * @throws InvalidMnemonicError for an invalid phrase, without including its text.
+ */
+function mnemonicToEntropy(mnemonic) {
+    try {
+        return mnemonicToEntropy$1(mnemonic, wordlist);
+    }
+    catch {
+        throw new InvalidMnemonicError();
+    }
+}
+/**
+ * Converts 16, 20, 24, 28 or 32 entropy bytes to an English BIP39 mnemonic.
+ * Strings must contain unprefixed, even-length hexadecimal. Leading zeros matter.
+ */
+function entropyToMnemonic(entropy) {
+    let bytes;
+    if (typeof entropy === 'string') {
+        if (!/^(?:[0-9a-fA-F]{2})+$/.test(entropy)) {
+            throw new Error('Entropy must be unprefixed, even-length hexadecimal');
+        }
+        bytes = Uint8Array.from({ length: entropy.length / 2 }, (_, index) => parseInt(entropy.slice(index * 2, index * 2 + 2), 16));
+    }
+    else {
+        if (!(entropy instanceof Uint8Array) &&
+            !(ArrayBuffer.isView(entropy) &&
+                Object.prototype.toString.call(entropy) === '[object Uint8Array]')) {
+            throw new TypeError('Entropy must be a Uint8Array');
+        }
+        bytes = new Uint8Array(entropy);
+    }
+    return entropyToMnemonic$1(bytes, wordlist);
+}
+/**
+ * Generates an English BIP39 mnemonic with the dependency's secure random source.
+ * @param strength Entropy bits, 128, 160, 192, 224 or 256. Defaults to 128.
+ */
+function generateMnemonic(strength = 128) {
+    return generateMnemonic$1(wordlist, strength);
+}
+// Shared with the signer, but not exported from the package entrypoint.
+function deriveMnemonicSecretKey({ mnemonic, password = '', derivationPath = "44'/1729'/0'/0'", curve = 'ed25519', }) {
+    if (!validateMnemonic(mnemonic, wordlist)) {
+        throw new InvalidMnemonicError();
+    }
+    const seed = mnemonicToSeedSync(mnemonic, password);
+    return { secretKey: generateSecretKey(seed, derivationPath, curve), curve };
+}
+/**
+ * Derives key material without constructing an InMemorySigner.
+ * Uses the same defaults, English BIP39 phrases, password and paths as fromMnemonic.
+ * Supports Ed25519, secp256k1 and P-256 mnemonic derivation.
+ * The returned secretKey is unencrypted and matches InMemorySigner.secretKey(),
+ * including the expanded Ed25519 form. Avoid logging or sharing the result.
+ */
+function deriveKeyFromMnemonic(params) {
+    const { secretKey, curve } = deriveMnemonicSecretKey(params);
+    const key = curve === 'ed25519' ? new EdKey(secretKey) : new ECKey(secretKey);
+    const publicKey = key.publicKey();
+    return {
+        publicKey: String(publicKey),
+        publicKeyHash: publicKey.hash(),
+        secretKey: key.secretKey(),
+    };
+}
+
 function isPOP(k) {
     return 'provePossession' in k;
 }
@@ -4724,8 +4808,21 @@ class BLSKey {
     sign(message) {
         return this.signDst(message, BLS12_381_DST);
     }
-    provePossession() {
-        return this.signDst(__classPrivateFieldGet(this, _BLSKey_publicKey, "f"), POP_DST);
+    provePossession(overridePublicKey) {
+        let message = __classPrivateFieldGet(this, _BLSKey_publicKey, "f");
+        if (overridePublicKey !== undefined) {
+            try {
+                if (typeof overridePublicKey !== 'string')
+                    throw new Error('Expected a public key');
+                message = b58DecodeAndCheckPrefix(overridePublicKey, [PrefixV2.BLS12_381PublicKey], true);
+                // Match Octez's compressed G1 parser, including subgroup checks and its accepted infinity encoding.
+                bls12_381.G1.Point.fromBytes(message).assertValidity();
+            }
+            catch {
+                throw new InvalidPublicKeyError('BLS override public key', 'Expecting a valid BLS public key');
+            }
+        }
+        return this.signDst(message, POP_DST);
     }
     publicKey() {
         return new BLSPublicKey(__classPrivateFieldGet(this, _BLSKey_publicKey, "f"));
@@ -7311,15 +7408,9 @@ class InMemorySigner {
      * @returns InMemorySigner
      * @throws InvalidMnemonicError
      */
-    static fromMnemonic({ mnemonic, password = '', derivationPath = "44'/1729'/0'/0'", curve = 'ed25519', }) {
-        // check if curve is defined if not default tz1
-        if (!validateMnemonic(mnemonic, wordlist)) {
-            // avoiding exposing mnemonic again in case of mistake making invalid
-            throw new InvalidMnemonicError();
-        }
-        const seed = mnemonicToSeedSync(mnemonic, password);
-        const sk = generateSecretKey(seed, derivationPath, curve);
-        return new InMemorySigner(sk);
+    static fromMnemonic(params) {
+        const { secretKey } = deriveMnemonicSecretKey(params);
+        return new InMemorySigner(secretKey);
     }
     /**
      *
@@ -7423,9 +7514,9 @@ class InMemorySigner {
             sbytes: buf2hex(mergebuf(msg, signatureBytes)),
         };
     }
-    async provePossession() {
+    async provePossession(overridePublicKey) {
         if (isPOP(__classPrivateFieldGet(this, _InMemorySigner_key, "f"))) {
-            return __classPrivateFieldGet(this, _InMemorySigner_key, "f").provePossession();
+            return __classPrivateFieldGet(this, _InMemorySigner_key, "f").provePossession(overridePublicKey);
         }
         else {
             throw new ProhibitedActionError('Only BLS keys can prove possession');
@@ -7478,9 +7569,9 @@ function publicKeyFromString(src) {
 
 // IMPORTANT: THIS FILE IS AUTO GENERATED! DO NOT MANUALLY EDIT!
 const VERSION = {
-    "commitHash": "0066d5b7ac03a306ff843604d16bb70e90b35225",
-    "version": "25.1.0-rc0"
+    "commitHash": "78ca0b9cb430f230c3230cd28b7e89a310e84c15",
+    "version": "25.2.0-beta0"
 };
 
-export { ecdsa as ECDSA, ed25519 as Ed25519, Hard, InMemorySigner, InvalidPassphraseError, Path, VERSION, generateSecretKey, publicKeyFromString };
+export { ecdsa as ECDSA, ed25519 as Ed25519, Hard, InMemorySigner, InvalidMnemonicError, InvalidPassphraseError, Path, VERSION, deriveKeyFromMnemonic, entropyToMnemonic, generateMnemonic, generateSecretKey, mnemonicToEntropy, publicKeyFromString };
 //# sourceMappingURL=taquito-signer.es6.js.map