@taquito/signer 25.1.0 → 25.2.0-beta0

package/dist/taquito-signer.umd.js

@@ -1,8 +1,8 @@
 (function (global, factory) {
-    typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('@stablelib/nacl'), require('@taquito/utils'), require('@noble/curves/ed25519'), require('@noble/curves/secp256k1'), require('@noble/curves/nist.js'), require('@taquito/core'), require('@noble/curves/nist'), require('bn.js'), require('@noble/curves/bls12-381')) :
-    typeof define === 'function' && define.amd ? define(['exports', '@stablelib/nacl', '@taquito/utils', '@noble/curves/ed25519', '@noble/curves/secp256k1', '@noble/curves/nist.js', '@taquito/core', '@noble/curves/nist', 'bn.js', '@noble/curves/bls12-381'], factory) :
-    (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.taquitoSigner = {}, global.nacl, global.utils, global.ed25519, global.secp256k1, global.nist, global.core, global.nist, global.BN, global.bls12381));
-})(this, (function (exports, nacl, utils$1, ed25519$1, secp256k1, nist_js, core, nist, BN, bls12381) { 'use strict';
+    typeof exports === 'object' && typeof module !== 'undefined' ? factory(exports, require('@stablelib/nacl'), require('@taquito/utils'), require('@noble/curves/ed25519.js'), require('@noble/curves/secp256k1.js'), require('@noble/curves/nist.js'), require('@taquito/core'), require('bn.js'), require('@noble/curves/bls12-381.js')) :
+    typeof define === 'function' && define.amd ? define(['exports', '@stablelib/nacl', '@taquito/utils', '@noble/curves/ed25519.js', '@noble/curves/secp256k1.js', '@noble/curves/nist.js', '@taquito/core', 'bn.js', '@noble/curves/bls12-381.js'], factory) :
+    (global = typeof globalThis !== 'undefined' ? globalThis : global || self, factory(global.taquitoSigner = {}, global.nacl, global.utils, global.ed25519, global.secp256k1, global.nist, global.core, global.BN, global.bls12381));
+})(this, (function (exports, nacl, utils, ed25519_js, secp256k1_js, nist_js, core, BN, bls12381_js) { 'use strict';
 
     /******************************************************************************
     Copyright (c) Microsoft Corporation.
@@ -49,7 +49,7 @@
      * isBytes(new Uint8Array([1, 2, 3]));
      * ```
      */
-    function isBytes$2(a) {
+    function isBytes$1(a) {
         // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases.
         // The fallback still requires a real ArrayBuffer view, so plain
         // JSON-deserialized `{ constructor: ... }` spoofing is rejected, and
@@ -60,10 +60,14 @@
                 'BYTES_PER_ELEMENT' in a &&
                 a.BYTES_PER_ELEMENT === 1));
     }
+    // Shared error-message prefix builder. Only called on throw paths, so assert
+    // success paths never pay for the string concatenation.
+    const atitle$2 = (title) => (title ? `"${title}" ` : '');
     /**
      * Asserts something is a non-negative integer.
      * @param n - number to validate
      * @param title - label included in thrown errors
+     * @returns The validated number.
      * @throws On wrong argument types. {@link TypeError}
      * @throws On wrong argument ranges or values. {@link RangeError}
      * @example
@@ -72,15 +76,12 @@
      * anumber(32, 'length');
      * ```
      */
-    function anumber$2(n, title = '') {
-        if (typeof n !== 'number') {
-            const prefix = title && `"${title}" `;
-            throw new TypeError(`${prefix}expected number, got ${typeof n}`);
-        }
-        if (!Number.isSafeInteger(n) || n < 0) {
-            const prefix = title && `"${title}" `;
-            throw new RangeError(`${prefix}expected integer >= 0, got ${n}`);
-        }
+    function anumber$1(n, title = '') {
+        if (typeof n !== 'number')
+            throw new TypeError(atitle$2(title) + 'expected number, got ' + typeof n);
+        if (!Number.isSafeInteger(n) || n < 0)
+            throw new RangeError(atitle$2(title) + 'expected integer >= 0, got ' + n);
+        return n;
     }
     /**
      * Asserts something is Uint8Array.
@@ -97,19 +98,37 @@
      * ```
      */
     function abytes$1(value, length, title = '') {
-        const bytes = isBytes$2(value);
-        const len = value?.length;
-        const needsLen = length !== undefined;
-        if (!bytes || (needsLen && len !== length)) {
-            const prefix = title && `"${title}" `;
-            const ofLen = needsLen ? ` of length ${length}` : '';
-            const got = bytes ? `length=${len}` : `type=${typeof value}`;
-            const message = prefix + 'expected Uint8Array' + ofLen + ', got ' + got;
-            if (!bytes)
-                throw new TypeError(message);
-            throw new RangeError(message);
-        }
-        return value;
+        // Success path first: this runs at the start of every update() / digestInto(), and the
+        // common `abytes(data)` form must not pay for length handling it does not use.
+        if (isBytes$1(value) && (length === undefined || value.length === length))
+            return value;
+        // Error path: recompute freely to build the exact message.
+        if (length !== undefined)
+            anumber$1(length, 'length');
+        const bytes = isBytes$1(value);
+        const ofLen = length !== undefined ? ` of length ${length}` : '';
+        const got = bytes ? `length=${value.length}` : `type=${typeof value}`;
+        const message = atitle$2(title) + 'expected Uint8Array' + ofLen + ', got ' + got;
+        if (!bytes)
+            throw new TypeError(message);
+        throw new RangeError(message);
+    }
+    /**
+     * Copies bytes into a fresh Uint8Array.
+     * Buffer-style slices can alias the same backing store, so callers that need ownership should copy.
+     * @param bytes - source bytes to clone
+     * @returns Freshly allocated copy of `bytes`.
+     * @throws On wrong argument types. {@link TypeError}
+     * @example
+     * Clone a byte array before mutating it.
+     * ```ts
+     * const copy = copyBytes(new Uint8Array([1, 2, 3]));
+     * ```
+     */
+    function copyBytes(bytes) {
+        // `Uint8Array.from(...)` would also accept arrays / other typed arrays. Keep this helper strict
+        // because callers use it at byte-validation boundaries before mutating the detached copy.
+        return Uint8Array.from(abytes$1(bytes));
     }
     /**
      * Asserts something is a wrapped hash constructor.
@@ -127,16 +146,28 @@
      */
     function ahash$1(h) {
         if (typeof h !== 'function' || typeof h.create !== 'function')
-            throw new TypeError('Hash must wrapped by utils.createHasher');
-        anumber$2(h.outputLen);
-        anumber$2(h.blockLen);
+            throw new TypeError('expected hash wrapped by utils.createHasher');
+        anumber$1(h.outputLen);
+        anumber$1(h.blockLen);
         // HMAC and KDF callers treat these as real byte lengths; allowing zero lets fake wrappers pass
         // validation and can produce empty outputs instead of failing fast.
-        if (h.outputLen < 1)
-            throw new Error('"outputLen" must be >= 1');
-        if (h.blockLen < 1)
-            throw new Error('"blockLen" must be >= 1');
+        if (h.outputLen < 1 || h.blockLen < 1)
+            throw new Error('hash blockLen / outputLen must be >= 1');
     }
+    const aobject$3 = (value, label) => {
+        if (value === null || typeof value !== 'object' || Array.isArray(value))
+            throw new TypeError((label === 'object' ? '' : `"${label}" `) + 'expected object, got type=' + typeof value);
+    };
+    const aopts$1 = (value, label) => {
+        aobject$3(value, label);
+        const proto = Object.getPrototypeOf(value);
+        if (proto !== Object.prototype && proto !== null)
+            throw new TypeError(`"${label}" expected plain object`);
+        // Object.assign() treats an own "__proto__" source key as a write to the target's legacy
+        // prototype setter. Reject it before merging so inherited option values cannot be injected.
+        if (Object.hasOwn(value, '__proto__'))
+            throw new TypeError(`"${label}.__proto__" is not allowed`);
+    };
     /**
      * Asserts a hash instance has not been destroyed or finished.
      * @param instance - hash instance to validate
@@ -152,10 +183,12 @@
      * ```
      */
     function aexists$1(instance, checkFinished = true) {
+        // Runs on every update()/digestInto(); the flags are library-owned booleans, so only their
+        // truthiness is checked - re-validating their type per call was pure hot-path overhead.
         if (instance.destroyed)
-            throw new Error('Hash instance has been destroyed');
+            throw new Error('hash was destroyed');
         if (checkFinished && instance.finished)
-            throw new Error('Hash#digest() has already been called');
+            throw new Error('digest() was already called');
     }
     /**
      * Asserts output is a sufficiently-sized byte array.
@@ -174,10 +207,12 @@
      * ```
      */
     function aoutput$1(out, instance) {
-        abytes$1(out, undefined, 'digestInto() output');
+        abytes$1(out, undefined, 'output');
+        // `outputLen` is a library-owned readonly number; the negated comparison keeps failing fast
+        // when it is missing/NaN (comparisons with undefined/NaN are false) without an anumber() call.
         const min = instance.outputLen;
-        if (out.length < min) {
-            throw new RangeError('"digestInto() output" expected to be of length >=' + min);
+        if (!(out.length >= min)) {
+            throw new RangeError('"output" expected length >= ' + min);
         }
     }
     /**
@@ -313,7 +348,15 @@
     function utf8ToBytes(str) {
         if (typeof str !== 'string')
             throw new TypeError('string expected');
-        return new Uint8Array(new TextEncoder().encode(str)); // https://bugzil.la/1681809
+        const encoded = new TextEncoder().encode(str);
+        try {
+            // Copy into the current realm for Firefox extension contexts. Callers that own the returned
+            // buffer can then wipe it independently of TextEncoder's temporary result.
+            return new Uint8Array(encoded); // https://bugzil.la/1681809
+        }
+        finally {
+            clean$1(encoded);
+        }
     }
     /**
      * Helper for KDFs: consumes Uint8Array or string.
@@ -337,7 +380,8 @@
      * Merges default options and passed options.
      * @param defaults - base option object
      * @param opts - user overrides
-     * @returns Merged option object. The merge mutates `defaults` in place.
+     * @param title - label included in thrown override errors
+     * @returns Fresh merged option object with a null prototype.
      * @throws On wrong argument types. {@link TypeError}
      * @example
      * Merge user overrides onto default options.
@@ -345,10 +389,13 @@
      * checkOpts({ dkLen: 32 }, { asyncTick: 10 });
      * ```
      */
-    function checkOpts$1(defaults, opts) {
-        if (opts !== undefined && {}.toString.call(opts) !== '[object Object]')
-            throw new TypeError('options must be object or undefined');
-        const merged = Object.assign(defaults, opts);
+    function checkOpts$1(defaults, opts, title = 'opts') {
+        aopts$1(defaults, 'defaults');
+        if (opts !== undefined)
+            aopts$1(opts, title);
+        // Callers read optional fields directly, so omitted values must not fall through to ambient
+        // Object.prototype pollution (for example a forged `dkLen` changing SHAKE's default output).
+        const merged = Object.assign(Object.create(null), defaults, opts);
         return merged;
     }
     /**
@@ -359,6 +406,7 @@
      *   Wrapper construction eagerly calls `hashCons(undefined)` once to read
      *   `outputLen` / `blockLen`, so constructor side effects happen at module
      *   init time.
+     * @throws On wrong argument types. {@link TypeError}
      * @example
      * Wrap a stateful hash constructor into a callable helper.
      * ```ts
@@ -369,6 +417,9 @@
      * ```
      */
     function createHasher$1(hashCons, info = {}) {
+        if (typeof hashCons !== 'function')
+            throw new TypeError('"hashCons" expected function, got type=' + typeof hashCons);
+        info = checkOpts$1({}, info, 'info');
         const hashC = (msg, opts) => hashCons(opts)
             .update(msg)
             .digest();
@@ -380,6 +431,37 @@
         Object.assign(hashC, info);
         return Object.freeze(hashC);
     }
+    /**
+     * Cryptographically secure PRNG backed by `crypto.getRandomValues`.
+     * @param bytesLength - number of random bytes to generate
+     * @returns Random bytes.
+     * The platform `getRandomValues()` implementation still defines any
+     * single-call length cap, and this helper rejects oversize requests
+     * with a stable library `RangeError` instead of host-specific errors.
+     * @throws On wrong argument types. {@link TypeError}
+     * @throws On wrong argument ranges or values. {@link RangeError}
+     * @throws If the current runtime does not provide `crypto.getRandomValues`. {@link Error}
+     * @example
+     * Generate a fresh random key or nonce.
+     * ```ts
+     * const key = randomBytes(16);
+     * ```
+     */
+    function randomBytes$2(bytesLength = 32) {
+        // Match the repo's other length-taking helpers instead of relying on Uint8Array coercion.
+        anumber$1(bytesLength, 'bytesLength');
+        const cr = typeof globalThis === 'object' ? globalThis.crypto : null;
+        if (typeof cr?.getRandomValues !== 'function')
+            throw new Error('crypto.getRandomValues must be defined');
+        // Web Cryptography API Level 2 §10.1.1:
+        // if `byteLength > 65536`, throw `QuotaExceededError`.
+        // Keep the guard explicit so callers can see the quota in code
+        // instead of discovering it by reading the spec or host errors.
+        // This wrapper surfaces the same quota as a stable library RangeError.
+        if (bytesLength > 65536)
+            throw new RangeError(`"bytesLength" expected <= 65536, got ${bytesLength}`);
+        return cr.getRandomValues(new Uint8Array(bytesLength));
+    }
     /**
      * Creates OID metadata for NIST hashes with prefix `06 09 60 86 48 01 65 03 04 02`.
      * @param suffix - final OID byte for the selected hash.
@@ -402,6 +484,9 @@
      * Internal helpers for blake hash.
      * @module
      */
+    // Unrealized speed-up: a file-local copy of rotr measured ~1-2% faster blake2s/blake256/blake3
+    // on Node 24 (V8 does not inline it into G1s/G2s across the module boundary). Reused from
+    // utils for deduplication.
     /**
      * Internal blake permutation table.
      * Rows `0..9` serve BLAKE2s, rows `0..11` serve BLAKE2b with `10..11 = 0..1`, and Blake1 also
@@ -429,6 +514,79 @@
         2, 12, 6, 10, 0, 11, 8, 3, 4, 13, 7, 5, 15, 14, 1, 9,
     ]);
 
+    const U32_MASK64$1 = /* @__PURE__ */ (() => BigInt(2 ** 32 - 1))();
+    const _32n$1 = /* @__PURE__ */ BigInt(32);
+    // Split bigint into two 32-bit halves. With `le=true`, returned fields become `{ h: low, l: high
+    // }` to match little-endian word order rather than the property names.
+    function fromBig$1(n, le = false) {
+        if (le)
+            return { h: Number(n & U32_MASK64$1), l: Number((n >> _32n$1) & U32_MASK64$1) };
+        return { h: Number((n >> _32n$1) & U32_MASK64$1) | 0, l: Number(n & U32_MASK64$1) | 0 };
+    }
+    // Split bigint list into `[highWords, lowWords]` when `le=false`; with `le=true`, the first array
+    // holds the low halves because `fromBig(...)` swaps the semantic meaning of `h` and `l`.
+    function split$1(lst, le = false) {
+        const len = lst.length;
+        let Ah = new Uint32Array(len);
+        let Al = new Uint32Array(len);
+        for (let i = 0; i < len; i++) {
+            const { h, l } = fromBig$1(lst[i], le);
+            [Ah[i], Al[i]] = [h, l];
+        }
+        return [Ah, Al];
+    }
+    // Split a JS number into u32 halves without a BigInt allocation. Exact only for integers
+    // `0 <= n < 2**53`; callers use it on byte / bit counters, which JS length math caps far below
+    // that (an ArrayBuffer cannot exceed 2**53 - 1 bytes).
+    const fromNumH = (n) => (n / 2 ** 32) | 0;
+    const fromNumL = (n) => n >>> 0;
+    // Drop-in replacement for `view.setBigUint64(byteOffset, BigInt(n), isLE)` without the per-call
+    // BigInt allocation. Same `n < 2**53` precondition as `fromNumH`/`fromNumL`.
+    function setU64FromNum(view, byteOffset, n, isLE) {
+        const h = fromNumH(n);
+        const l = fromNumL(n);
+        view.setUint32(byteOffset, isLE ? l : h, isLE);
+        view.setUint32(byteOffset + 4, isLE ? h : l, isLE);
+    }
+    // High 32-bit half of a 64-bit logical right shift for `s` in `0..31`.
+    const shrSH = (h, _l, s) => h >>> s;
+    // Low 32-bit half of a 64-bit logical right shift, valid for `s` in `1..31`.
+    const shrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
+    // High 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.
+    const rotrSH = (h, l, s) => (h >>> s) | (l << (32 - s));
+    // Low 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.
+    const rotrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
+    // High 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.
+    const rotrBH = (h, l, s) => (h << (64 - s)) | (l >>> (s - 32));
+    // Low 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.
+    const rotrBL = (h, l, s) => (h >>> (s - 32)) | (l << (64 - s));
+    // High 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped low half.
+    const rotr32H = (_h, l) => l;
+    // Low 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped high half.
+    const rotr32L = (h, _l) => h;
+    // 64-bit left rotates (rotl*) are not defined here: sha3.ts, their only consumer, keeps
+    // local copies so V8 inlines them into keccakP.
+    // Add two split 64-bit words and return the split `{ h, l }` sum.
+    // JS uses 32-bit signed integers for bitwise operations, so we cannot simply shift the carry out
+    // of the low sum and instead use division.
+    function add(Ah, Al, Bh, Bl) {
+        const l = (Al >>> 0) + (Bl >>> 0);
+        return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };
+    }
+    // Addition with more than 2 elements
+    // Unmasked low-word accumulator for 3-way addition; pass the raw result into `add3H(...)`.
+    const add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
+    // High-word finalize step for 3-way addition; `low` must be the untruncated output of `add3L(...)`.
+    const add3H = (low, Ah, Bh, Ch) => (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;
+    // Unmasked low-word accumulator for 4-way addition; pass the raw result into `add4H(...)`.
+    const add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
+    // High-word finalize step for 4-way addition; `low` must be the untruncated output of `add4L(...)`.
+    const add4H = (low, Ah, Bh, Ch, Dh) => (Ah + Bh + Ch + Dh + ((low / 2 ** 32) | 0)) | 0;
+    // Unmasked low-word accumulator for 5-way addition; pass the raw result into `add5H(...)`.
+    const add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
+    // High-word finalize step for 5-way addition; `low` must be the untruncated output of `add5L(...)`.
+    const add5H = (low, Ah, Bh, Ch, Dh, Eh) => (Ah + Bh + Ch + Dh + Eh + ((low / 2 ** 32) | 0)) | 0;
+
     /**
      * Internal Merkle-Damgard hash utils.
      * @module
@@ -511,6 +669,7 @@
             abytes$1(data);
             const { view, buffer, blockLen } = this;
             const len = data.length;
+            let processed = false;
             for (let pos = 0; pos < len;) {
                 const take = Math.min(blockLen - this.pos, len - pos);
                 // Fast path only when there is no buffered partial block: `take === blockLen` implies
@@ -519,18 +678,25 @@
                     const dataView = createView(data);
                     for (; blockLen <= len - pos; pos += blockLen)
                         this.process(dataView, pos);
+                    processed = true;
                     continue;
                 }
-                buffer.set(data.subarray(pos, pos + take), this.pos);
+                // When the whole input is buffered in one go (common for short messages), passing `data`
+                // directly avoids allocating a subarray view.
+                buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
                 this.pos += take;
                 pos += take;
                 if (this.pos === blockLen) {
                     this.process(view, 0);
                     this.pos = 0;
+                    processed = true;
                 }
             }
             this.length += data.length;
-            this.roundClean();
+            // Shared schedule buffers only pick up input-derived words inside process(); if everything
+            // was buffered without processing, there is nothing to zero.
+            if (processed)
+                this.roundClean();
             return this;
         }
         digestInto(out) {
@@ -542,32 +708,33 @@
             // was previously not allocated here. But it won't change performance.
             const { buffer, view, blockLen, isLE } = this;
             let { pos } = this;
-            // append the bit '1' to the message
+            // append the bit '1' to the message, then zero-pad the rest of the block
             buffer[pos++] = 0b10000000;
-            clean$1(this.buffer.subarray(pos));
+            buffer.fill(0, pos);
             // we have less than padOffset left in buffer, so we cannot put length in
             // current block, need process it and pad again
             if (this.padOffset > blockLen - pos) {
                 this.process(view, 0);
-                pos = 0;
+                buffer.fill(0);
             }
-            // Pad until full block byte with zeros
-            for (let i = pos; i < blockLen; i++)
-                buffer[i] = 0;
             // `padOffset` reserves the whole length field. For SHA-384/512 the high 64 bits stay zero from
             // the padding fill above, and JS will overflow before user input can make that half non-zero.
-            // So we only need to write the low 64 bits here.
-            view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE);
+            // So we only need to write the low 64 bits here (`length * 8` only scales the exponent of an
+            // integer below 2**53, so the split inside the helper stays exact).
+            setU64FromNum(view, blockLen - 8, this.length * 8, isLE);
             this.process(view, 0);
-            const oview = createView(out);
+            // The final block above is processed outside update(), so the shared message-schedule
+            // buffers (e.g. SHA256_W) would otherwise retain input-derived words after digest().
+            this.roundClean();
+            // digest() passes our own `buffer` as `out`; reuse its cached view instead of allocating one.
+            const oview = out === buffer ? view : createView(out);
             const len = this.outputLen;
             // NOTE: we do division by 4 later, which must be fused in single op with modulo by JIT
-            if (len % 4)
-                throw new Error('_sha2: outputLen must be aligned to 32bit');
             const outLen = len / 4;
             const state = this.get();
-            if (outLen > state.length)
-                throw new Error('_sha2: outputLen bigger than state');
+            // Subclass-misconfiguration invariant: outputLen must be 32-bit aligned and fit the state.
+            if (len % 4 || outLen > state.length)
+                throw new Error('invalid outputLen');
             for (let i = 0; i < outLen; i++)
                 oview.setUint32(4 * i, state[i], isLE);
         }
@@ -580,18 +747,16 @@
             this.destroy();
             return res;
         }
-        _cloneInto(to) {
-            to ||= new this.constructor();
-            to.set(...this.get());
-            const { blockLen, buffer, length, finished, destroyed, pos } = this;
+        _cloneIntoMeta(to) {
+            const { buffer, length, finished, destroyed, pos } = this;
             to.destroyed = destroyed;
             to.finished = finished;
             to.length = length;
             to.pos = pos;
             // Only partial-block bytes need copying: when `length % blockLen === 0`, `pos === 0` and
             // later `update()` / `digestInto()` overwrite `to.buffer` from the start before reading it.
-            if (length % blockLen)
-                to.buffer.set(buffer);
+            if (pos)
+                to.buffer.set(buffer); // Avoid a hot modulo guard.
             return to;
         }
         clone() {
@@ -617,64 +782,6 @@
         0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179,
     ]);
 
-    const U32_MASK64$1 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
-    const _32n$1 = /* @__PURE__ */ BigInt(32);
-    // Split bigint into two 32-bit halves. With `le=true`, returned fields become `{ h: low, l: high
-    // }` to match little-endian word order rather than the property names.
-    function fromBig$1(n, le = false) {
-        if (le)
-            return { h: Number(n & U32_MASK64$1), l: Number((n >> _32n$1) & U32_MASK64$1) };
-        return { h: Number((n >> _32n$1) & U32_MASK64$1) | 0, l: Number(n & U32_MASK64$1) | 0 };
-    }
-    // Split bigint list into `[highWords, lowWords]` when `le=false`; with `le=true`, the first array
-    // holds the low halves because `fromBig(...)` swaps the semantic meaning of `h` and `l`.
-    function split$1(lst, le = false) {
-        const len = lst.length;
-        let Ah = new Uint32Array(len);
-        let Al = new Uint32Array(len);
-        for (let i = 0; i < len; i++) {
-            const { h, l } = fromBig$1(lst[i], le);
-            [Ah[i], Al[i]] = [h, l];
-        }
-        return [Ah, Al];
-    }
-    // High 32-bit half of a 64-bit logical right shift for `s` in `0..31`.
-    const shrSH = (h, _l, s) => h >>> s;
-    // Low 32-bit half of a 64-bit logical right shift, valid for `s` in `1..31`.
-    const shrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
-    // High 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.
-    const rotrSH = (h, l, s) => (h >>> s) | (l << (32 - s));
-    // Low 32-bit half of a 64-bit right rotate, valid for `s` in `1..31`.
-    const rotrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
-    // High 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.
-    const rotrBH = (h, l, s) => (h << (64 - s)) | (l >>> (s - 32));
-    // Low 32-bit half of a 64-bit right rotate, valid for `s` in `33..63`; `32` uses `rotr32*`.
-    const rotrBL = (h, l, s) => (h >>> (s - 32)) | (l << (64 - s));
-    // High 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped low half.
-    const rotr32H = (_h, l) => l;
-    // Low 32-bit half of a 64-bit right rotate for `s === 32`; this is just the swapped high half.
-    const rotr32L = (h, _l) => h;
-    // Add two split 64-bit words and return the split `{ h, l }` sum.
-    // JS uses 32-bit signed integers for bitwise operations, so we cannot simply shift the carry out
-    // of the low sum and instead use division.
-    function add(Ah, Al, Bh, Bl) {
-        const l = (Al >>> 0) + (Bl >>> 0);
-        return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };
-    }
-    // Addition with more than 2 elements
-    // Unmasked low-word accumulator for 3-way addition; pass the raw result into `add3H(...)`.
-    const add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
-    // High-word finalize step for 3-way addition; `low` must be the untruncated output of `add3L(...)`.
-    const add3H = (low, Ah, Bh, Ch) => (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;
-    // Unmasked low-word accumulator for 4-way addition; pass the raw result into `add4H(...)`.
-    const add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
-    // High-word finalize step for 4-way addition; `low` must be the untruncated output of `add4L(...)`.
-    const add4H = (low, Ah, Bh, Ch, Dh) => (Ah + Bh + Ch + Dh + ((low / 2 ** 32) | 0)) | 0;
-    // Unmasked low-word accumulator for 5-way addition; pass the raw result into `add5H(...)`.
-    const add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
-    // High-word finalize step for 5-way addition; `low` must be the untruncated output of `add5L(...)`.
-    const add5H = (low, Ah, Bh, Ch, Dh, Eh) => (Ah + Bh + Ch + Dh + Eh + ((low / 2 ** 32) | 0)) | 0;
-
     /**
      * blake2b (64-bit) & blake2s (8 to 32-bit) hash functions.
      * b could have been faster, but there is no fast u64 in js, so s is 1.5x faster.
@@ -697,21 +804,28 @@
         let Cl = BBUF[2 * c], Ch = BBUF[2 * c + 1]; // prettier-ignore
         let Dl = BBUF[2 * d], Dh = BBUF[2 * d + 1]; // prettier-ignore
         // v[a] = (v[a] + v[b] + x) | 0;
-        let ll = add3L(Al, Bl, Xl);
+        const ll = add3L(Al, Bl, Xl);
         Ah = add3H(ll, Ah, Bh, Xh);
         Al = ll | 0;
         // v[d] = rotr(v[d] ^ v[a], 32)
-        ({ Dh, Dl } = { Dh: Dh ^ Ah, Dl: Dl ^ Al });
-        ({ Dh, Dl } = { Dh: rotr32H(Dh, Dl), Dl: rotr32L(Dh) });
+        let xh = Dh ^ Ah, xl = Dl ^ Al; // prettier-ignore
+        Dh = rotr32H(xh, xl);
+        Dl = rotr32L(xh);
         // v[c] = (v[c] + v[d]) | 0;
         ({ h: Ch, l: Cl } = add(Ch, Cl, Dh, Dl));
         // v[b] = rotr(v[b] ^ v[c], 24)
-        ({ Bh, Bl } = { Bh: Bh ^ Ch, Bl: Bl ^ Cl });
-        ({ Bh, Bl } = { Bh: rotrSH(Bh, Bl, 24), Bl: rotrSL(Bh, Bl, 24) });
-        ((BBUF[2 * a] = Al), (BBUF[2 * a + 1] = Ah));
-        ((BBUF[2 * b] = Bl), (BBUF[2 * b + 1] = Bh));
-        ((BBUF[2 * c] = Cl), (BBUF[2 * c + 1] = Ch));
-        ((BBUF[2 * d] = Dl), (BBUF[2 * d + 1] = Dh));
+        xh = Bh ^ Ch;
+        xl = Bl ^ Cl;
+        Bh = rotrSH(xh, xl, 24);
+        Bl = rotrSL(xh, xl, 24);
+        BBUF[2 * a] = Al;
+        BBUF[2 * a + 1] = Ah;
+        BBUF[2 * b] = Bl;
+        BBUF[2 * b + 1] = Bh;
+        BBUF[2 * c] = Cl;
+        BBUF[2 * c + 1] = Ch;
+        BBUF[2 * d] = Dl;
+        BBUF[2 * d + 1] = Dh;
     }
     // Second half-round of the same LE-limb BLAKE2b G mix; `x` is the message word offset.
     function G2b(a, b, c, d, msg, x) {
@@ -722,27 +836,35 @@
         let Cl = BBUF[2 * c], Ch = BBUF[2 * c + 1]; // prettier-ignore
         let Dl = BBUF[2 * d], Dh = BBUF[2 * d + 1]; // prettier-ignore
         // v[a] = (v[a] + v[b] + x) | 0;
-        let ll = add3L(Al, Bl, Xl);
+        const ll = add3L(Al, Bl, Xl);
         Ah = add3H(ll, Ah, Bh, Xh);
         Al = ll | 0;
         // v[d] = rotr(v[d] ^ v[a], 16)
-        ({ Dh, Dl } = { Dh: Dh ^ Ah, Dl: Dl ^ Al });
-        ({ Dh, Dl } = { Dh: rotrSH(Dh, Dl, 16), Dl: rotrSL(Dh, Dl, 16) });
+        let xh = Dh ^ Ah, xl = Dl ^ Al; // prettier-ignore
+        Dh = rotrSH(xh, xl, 16);
+        Dl = rotrSL(xh, xl, 16);
         // v[c] = (v[c] + v[d]) | 0;
         ({ h: Ch, l: Cl } = add(Ch, Cl, Dh, Dl));
         // v[b] = rotr(v[b] ^ v[c], 63)
-        ({ Bh, Bl } = { Bh: Bh ^ Ch, Bl: Bl ^ Cl });
-        ({ Bh, Bl } = { Bh: rotrBH(Bh, Bl, 63), Bl: rotrBL(Bh, Bl, 63) });
-        ((BBUF[2 * a] = Al), (BBUF[2 * a + 1] = Ah));
-        ((BBUF[2 * b] = Bl), (BBUF[2 * b + 1] = Bh));
-        ((BBUF[2 * c] = Cl), (BBUF[2 * c + 1] = Ch));
-        ((BBUF[2 * d] = Dl), (BBUF[2 * d + 1] = Dh));
+        xh = Bh ^ Ch;
+        xl = Bl ^ Cl;
+        Bh = rotrBH(xh, xl, 63);
+        Bl = rotrBL(xh, xl, 63);
+        BBUF[2 * a] = Al;
+        BBUF[2 * a + 1] = Ah;
+        BBUF[2 * b] = Bl;
+        BBUF[2 * b + 1] = Bh;
+        BBUF[2 * c] = Cl;
+        BBUF[2 * c + 1] = Ch;
+        BBUF[2 * d] = Dl;
+        BBUF[2 * d + 1] = Dh;
     }
     function checkBlake2Opts(outputLen, opts = {}, keyLen, saltLen, persLen) {
-        anumber$2(keyLen);
-        // RFC 7693 §2.1 requires digest length nn in 1..keyLen.
+        anumber$1(keyLen);
+        // RFC 7693 §2.1 requires digest length nn in 1..keyLen (keyLen doubles as
+        // the per-variant max for both key and digest lengths: 64 for b, 32 for s).
         if (outputLen <= 0 || outputLen > keyLen)
-            throw new Error('outputLen bigger than keyLen');
+            throw new Error('"dkLen" must be 1..' + keyLen + ', got ' + outputLen);
         const { key, salt, personalization } = opts;
         // This API uses `undefined` for the RFC 7693 `kk = 0` case, so a provided key must be non-empty.
         if (key !== undefined && (key.length < 1 || key.length > keyLen))
@@ -764,8 +886,8 @@
         outputLen;
         canXOF = false;
         constructor(blockLen, outputLen) {
-            anumber$2(blockLen);
-            anumber$2(outputLen);
+            anumber$1(blockLen);
+            anumber$1(outputLen);
             this.blockLen = blockLen;
             this.outputLen = outputLen;
             this.buffer = new Uint8Array(blockLen);
@@ -803,7 +925,9 @@
                     swap32IfBE$1(data32);
                     continue;
                 }
-                buffer.set(data.subarray(pos, pos + take), this.pos);
+                // When the whole input is buffered in one go (common for short messages), passing `data`
+                // directly avoids allocating a subarray view.
+                buffer.set(pos === 0 && take === len ? data : data.subarray(pos, pos + take), this.pos);
                 this.pos += take;
                 this.length += take;
                 pos += take;
@@ -813,18 +937,19 @@
         digestInto(out) {
             aexists$1(this);
             aoutput$1(out, this);
+            // Reject unaligned views explicitly instead of hiding them behind a full scratch copy.
+            if (out.byteOffset & 3)
+                throw new RangeError('"output" expected 4-byte aligned byteOffset, got ' + out.byteOffset);
             const { pos, buffer32 } = this;
             this.finished = true;
             // Padding
-            clean$1(this.buffer.subarray(pos));
+            this.buffer.fill(0, pos);
             swap32IfBE$1(buffer32);
             this.compress(buffer32, 0, true);
             swap32IfBE$1(buffer32);
-            // Reject unaligned views explicitly instead of hiding them behind a full scratch copy.
-            if (out.byteOffset & 3)
-                throw new RangeError('"digestInto() output" expected 4-byte aligned byteOffset, got ' + out.byteOffset);
             const state = this.get();
-            const out32 = u32$1(out);
+            // digest() passes our own `buffer` as `out`; reuse its cached u32 view instead of allocating.
+            const out32 = out === this.buffer ? buffer32 : u32$1(out);
             const full = Math.floor(this.outputLen / 4);
             for (let i = 0; i < full; i++)
                 out32[i] = swap8IfBE(state[i]);
@@ -849,6 +974,7 @@
             // Recreate only `dkLen`; key/salt/personalization are already absorbed into the copied state.
             to ||= new this.constructor({ dkLen: outputLen });
             to.set(...this.get());
+            // Last-block-aware lazy compression keeps the pending block live even when full.
             to.buffer.set(buffer);
             to.destroyed = destroyed;
             to.finished = finished;
@@ -882,6 +1008,7 @@
         v7l = B2B_IV[14] | 0;
         v7h = B2B_IV[15] | 0;
         constructor(opts = {}) {
+            opts = checkOpts$1({}, opts);
             const olen = opts.dkLen === undefined ? 64 : opts.dkLen;
             super(128, olen);
             checkBlake2Opts(olen, opts, 64, 16, 16);
@@ -896,7 +1023,8 @@
             this.v0l ^= this.outputLen | (keyLength << 8) | (0x01 << 16) | (0x01 << 24);
             if (salt !== undefined) {
                 abytes$1(salt, undefined, 'salt');
-                const slt = u32$1(salt);
+                // Copy: u32() would throw on views with byteOffset not divisible by 4.
+                const slt = u32$1(copyBytes(salt));
                 this.v4l ^= swap8IfBE(slt[0]);
                 this.v4h ^= swap8IfBE(slt[1]);
                 this.v5l ^= swap8IfBE(slt[2]);
@@ -904,7 +1032,8 @@
             }
             if (personalization !== undefined) {
                 abytes$1(personalization, undefined, 'personalization');
-                const pers = u32$1(personalization);
+                // Copy: u32() would throw on views with byteOffset not divisible by 4.
+                const pers = u32$1(copyBytes(personalization));
                 this.v6l ^= swap8IfBE(pers[0]);
                 this.v6h ^= swap8IfBE(pers[1]);
                 this.v7l ^= swap8IfBE(pers[2]);
@@ -915,6 +1044,8 @@
                 const tmp = new Uint8Array(this.blockLen);
                 tmp.set(key);
                 this.update(tmp);
+                // The padded copy holds key material; buffer/state keep what they need.
+                clean$1(tmp);
             }
         }
         // prettier-ignore
@@ -942,9 +1073,32 @@
             this.v7h = v7h | 0;
         }
         compress(msg, offset, isLast) {
-            this.get().forEach((v, i) => (BBUF[i] = v)); // First half from state.
+            // First half from state. Direct writes: get() would allocate an array +
+            // closure per block.
+            // prettier-ignore
+            const { v0l, v0h, v1l, v1h, v2l, v2h, v3l, v3h, v4l, v4h, v5l, v5h, v6l, v6h, v7l, v7h } = this;
+            // prettier-ignore
+            {
+                BBUF[0] = v0l;
+                BBUF[1] = v0h;
+                BBUF[2] = v1l;
+                BBUF[3] = v1h;
+                BBUF[4] = v2l;
+                BBUF[5] = v2h;
+                BBUF[6] = v3l;
+                BBUF[7] = v3h;
+                BBUF[8] = v4l;
+                BBUF[9] = v4h;
+                BBUF[10] = v5l;
+                BBUF[11] = v5h;
+                BBUF[12] = v6l;
+                BBUF[13] = v6h;
+                BBUF[14] = v7l;
+                BBUF[15] = v7h;
+            }
             BBUF.set(B2B_IV, 16); // Second half from IV.
-            let { h, l } = fromBig$1(BigInt(this.length));
+            const l = fromNumL(this.length);
+            const h = fromNumH(this.length);
             BBUF[24] = B2B_IV[8] ^ l; // Low word of the offset.
             BBUF[25] = B2B_IV[9] ^ h; // High word.
             // Invert all bits for last block
@@ -1010,12 +1164,22 @@
      * ```ts
      * blake2b(new Uint8Array([97, 98, 99]));
      * ```
+     * @example
+     * Hash a message with Blake2b while selecting output, MAC, salt, and personalization settings.
+     * ```ts
+     * blake2b(new Uint8Array([97, 98, 99]), {
+     *   dkLen: 32,
+     *   key: new Uint8Array(32),
+     *   salt: new Uint8Array(16),
+     *   personalization: new Uint8Array(16),
+     * });
+     * ```
      */
     const blake2b = /* @__PURE__ */ createHasher$1((opts) => new _BLAKE2b(opts));
 
     var _EdKey_keyPair, _EdPublicKey_key;
     function generateKeyPairFromSeed$1(seed) {
-        const publicKey = ed25519$1.ed25519.getPublicKey(seed);
+        const publicKey = ed25519_js.ed25519.getPublicKey(seed);
         const secretKey = new Uint8Array(64);
         secretKey.set(seed);
         secretKey.set(publicKey, 32);
@@ -1034,21 +1198,21 @@
          */
         constructor(key, decrypt) {
             _EdKey_keyPair.set(this, void 0);
-            const tmp = utils$1.b58DecodeAndCheckPrefix(key, [
-                utils$1.PrefixV2.Ed25519SecretKey,
-                utils$1.PrefixV2.Ed25519EncryptedSeed,
-                utils$1.PrefixV2.Ed25519Seed,
+            const tmp = utils.b58DecodeAndCheckPrefix(key, [
+                utils.PrefixV2.Ed25519SecretKey,
+                utils.PrefixV2.Ed25519EncryptedSeed,
+                utils.PrefixV2.Ed25519Seed,
             ]);
             let [keyData] = tmp;
             const [, prefix] = tmp;
-            if (prefix === utils$1.PrefixV2.Ed25519SecretKey) {
+            if (prefix === utils.PrefixV2.Ed25519SecretKey) {
                 __classPrivateFieldSet(this, _EdKey_keyPair, {
                     secretKey: keyData,
                     publicKey: keyData.slice(32),
                 }, "f");
             }
             else {
-                if (prefix === utils$1.PrefixV2.Ed25519EncryptedSeed) {
+                if (prefix === utils.PrefixV2.Ed25519EncryptedSeed) {
                     if (decrypt !== undefined) {
                         keyData = decrypt(keyData);
                     }
@@ -1067,11 +1231,11 @@
         sign(bytes) {
             const hash = blake2b(bytes, { dkLen: 32 });
             const seed = __classPrivateFieldGet(this, _EdKey_keyPair, "f").secretKey.subarray(0, 32);
-            const signature = ed25519$1.ed25519.sign(hash, seed);
+            const signature = ed25519_js.ed25519.sign(hash, seed);
             return {
                 rawSignature: signature,
-                sig: utils$1.b58Encode(signature, utils$1.PrefixV2.GenericSignature),
-                prefixSig: utils$1.b58Encode(signature, utils$1.PrefixV2.Ed25519Signature),
+                sig: utils.b58Encode(signature, utils.PrefixV2.GenericSignature),
+                prefixSig: utils.b58Encode(signature, utils.PrefixV2.Ed25519Signature),
             };
         }
         /**
@@ -1084,7 +1248,7 @@
          * @returns Encoded private key
          */
         secretKey() {
-            return utils$1.b58Encode(__classPrivateFieldGet(this, _EdKey_keyPair, "f").secretKey, utils$1.PrefixV2.Ed25519SecretKey);
+            return utils.b58Encode(__classPrivateFieldGet(this, _EdKey_keyPair, "f").secretKey, utils.PrefixV2.Ed25519SecretKey);
         }
     }
     _EdKey_keyPair = new WeakMap();
@@ -1092,7 +1256,7 @@
         constructor(src) {
             _EdPublicKey_key.set(this, void 0);
             if (typeof src === 'string') {
-                const [key, _] = utils$1.b58DecodeAndCheckPrefix(src, [utils$1.PrefixV2.Ed25519PublicKey]);
+                const [key, _] = utils.b58DecodeAndCheckPrefix(src, [utils.PrefixV2.Ed25519PublicKey]);
                 __classPrivateFieldSet(this, _EdPublicKey_key, key, "f");
             }
             else {
@@ -1101,14 +1265,14 @@
         }
         compare(other) {
             if (other instanceof EdPublicKey) {
-                return utils$1.compareArrays(this.bytes(), other.bytes());
+                return utils.compareArrays(this.bytes(), other.bytes());
             }
             else {
-                throw new utils$1.InvalidPublicKeyError('EdDSA key expected');
+                throw new utils.InvalidPublicKeyError('EdDSA key expected');
             }
         }
         hash() {
-            return utils$1.b58Encode(blake2b(__classPrivateFieldGet(this, _EdPublicKey_key, "f"), { dkLen: 20 }), utils$1.PrefixV2.Ed25519PublicKeyHash);
+            return utils.b58Encode(blake2b(__classPrivateFieldGet(this, _EdPublicKey_key, "f"), { dkLen: 20 }), utils.PrefixV2.Ed25519PublicKeyHash);
         }
         bytes() {
             return __classPrivateFieldGet(this, _EdPublicKey_key, "f");
@@ -1120,7 +1284,7 @@
             return res;
         }
         toString() {
-            return utils$1.b58Encode(__classPrivateFieldGet(this, _EdPublicKey_key, "f"), utils$1.PrefixV2.Ed25519PublicKey);
+            return utils.b58Encode(__classPrivateFieldGet(this, _EdPublicKey_key, "f"), utils.PrefixV2.Ed25519PublicKey);
         }
     }
     _EdPublicKey_key = new WeakMap();
@@ -1196,17 +1360,17 @@
     var _ECKey_keyPair, _ECPublicKey_key;
     const pref = {
         p256: {
-            pk: utils$1.PrefixV2.P256PublicKey,
-            sk: utils$1.PrefixV2.P256SecretKey,
-            pkh: utils$1.PrefixV2.P256PublicKeyHash,
-            sig: utils$1.PrefixV2.P256Signature,
+            pk: utils.PrefixV2.P256PublicKey,
+            sk: utils.PrefixV2.P256SecretKey,
+            pkh: utils.PrefixV2.P256PublicKeyHash,
+            sig: utils.PrefixV2.P256Signature,
             tag: 2,
         },
         secp256k1: {
-            pk: utils$1.PrefixV2.Secp256k1PublicKey,
-            sk: utils$1.PrefixV2.Secp256k1SecretKey,
-            pkh: utils$1.PrefixV2.Secp256k1PublicKeyHash,
-            sig: utils$1.PrefixV2.Secp256k1Signature,
+            pk: utils.PrefixV2.Secp256k1PublicKey,
+            sk: utils.PrefixV2.Secp256k1SecretKey,
+            pkh: utils.PrefixV2.Secp256k1PublicKeyHash,
+            sig: utils.PrefixV2.Secp256k1Signature,
             tag: 1,
         },
     };
@@ -1222,26 +1386,26 @@
          */
         constructor(key, decrypt) {
             _ECKey_keyPair.set(this, void 0);
-            const [keyData, prefix] = utils$1.b58DecodeAndCheckPrefix(key, [
-                utils$1.PrefixV2.Secp256k1EncryptedSecretKey,
-                utils$1.PrefixV2.P256EncryptedSecretKey,
-                utils$1.PrefixV2.Secp256k1SecretKey,
-                utils$1.PrefixV2.P256SecretKey,
+            const [keyData, prefix] = utils.b58DecodeAndCheckPrefix(key, [
+                utils.PrefixV2.Secp256k1EncryptedSecretKey,
+                utils.PrefixV2.P256EncryptedSecretKey,
+                utils.PrefixV2.Secp256k1SecretKey,
+                utils.PrefixV2.P256SecretKey,
             ]);
             const [decKey, curve] = (() => {
                 switch (prefix) {
-                    case utils$1.PrefixV2.Secp256k1EncryptedSecretKey:
-                    case utils$1.PrefixV2.P256EncryptedSecretKey:
+                    case utils.PrefixV2.Secp256k1EncryptedSecretKey:
+                    case utils.PrefixV2.P256EncryptedSecretKey:
                         if (decrypt === undefined) {
                             throw new Error('decryption function is not provided');
                         }
                         else {
                             return [
                                 decrypt(keyData),
-                                prefix === utils$1.PrefixV2.Secp256k1EncryptedSecretKey ? 'secp256k1' : 'p256',
+                                prefix === utils.PrefixV2.Secp256k1EncryptedSecretKey ? 'secp256k1' : 'p256',
                             ];
                         }
-                    case utils$1.PrefixV2.Secp256k1SecretKey:
+                    case utils.PrefixV2.Secp256k1SecretKey:
                         return [keyData, 'secp256k1'];
                     default:
                         return [keyData, 'p256'];
@@ -1251,7 +1415,7 @@
                 curve,
                 secretKey: decKey,
                 publicKey: curve === 'secp256k1'
-                    ? secp256k1.secp256k1.getPublicKey(decKey, true)
+                    ? secp256k1_js.secp256k1.getPublicKey(decKey, true)
                     : nist_js.p256.getPublicKey(decKey, true),
             }, "f");
         }
@@ -1264,23 +1428,21 @@
             const hash = blake2b(bytes, { dkLen: 32 });
             let signature;
             if (__classPrivateFieldGet(this, _ECKey_keyPair, "f").curve === 'secp256k1') {
-                signature = secp256k1.secp256k1
-                    .sign(hash, __classPrivateFieldGet(this, _ECKey_keyPair, "f").secretKey, {
+                signature = secp256k1_js.secp256k1.sign(hash, __classPrivateFieldGet(this, _ECKey_keyPair, "f").secretKey, {
                     lowS: true, // Use canonical signatures (prevents malleability)
-                })
-                    .toBytes('compact');
+                    prehash: false,
+                });
             }
             else {
-                signature = nist_js.p256
-                    .sign(hash, __classPrivateFieldGet(this, _ECKey_keyPair, "f").secretKey, {
+                signature = nist_js.p256.sign(hash, __classPrivateFieldGet(this, _ECKey_keyPair, "f").secretKey, {
                     lowS: true, // Use canonical signatures (prevents malleability)
-                })
-                    .toBytes('compact');
+                    prehash: false,
+                });
             }
             return {
                 rawSignature: signature,
-                sig: utils$1.b58Encode(signature, utils$1.PrefixV2.GenericSignature),
-                prefixSig: utils$1.b58Encode(signature, pref[__classPrivateFieldGet(this, _ECKey_keyPair, "f").curve].sig),
+                sig: utils.b58Encode(signature, utils.PrefixV2.GenericSignature),
+                prefixSig: utils.b58Encode(signature, pref[__classPrivateFieldGet(this, _ECKey_keyPair, "f").curve].sig),
             };
         }
         /**
@@ -1293,7 +1455,7 @@
          * @returns Encoded private key
          */
         secretKey() {
-            return utils$1.b58Encode(__classPrivateFieldGet(this, _ECKey_keyPair, "f").secretKey, pref[__classPrivateFieldGet(this, _ECKey_keyPair, "f").curve].sk);
+            return utils.b58Encode(__classPrivateFieldGet(this, _ECKey_keyPair, "f").secretKey, pref[__classPrivateFieldGet(this, _ECKey_keyPair, "f").curve].sk);
         }
     }
     _ECKey_keyPair = new WeakMap();
@@ -1302,11 +1464,11 @@
             _ECPublicKey_key.set(this, void 0);
             const [key, crv] = (() => {
                 if (typeof src === 'string') {
-                    const [key, pre] = utils$1.b58DecodeAndCheckPrefix(src, [
-                        utils$1.PrefixV2.Secp256k1PublicKey,
-                        utils$1.PrefixV2.P256PublicKey,
+                    const [key, pre] = utils.b58DecodeAndCheckPrefix(src, [
+                        utils.PrefixV2.Secp256k1PublicKey,
+                        utils.PrefixV2.P256PublicKey,
                     ]);
-                    return [key, pre === utils$1.PrefixV2.Secp256k1PublicKey ? 'secp256k1' : 'p256'];
+                    return [key, pre === utils.PrefixV2.Secp256k1PublicKey ? 'secp256k1' : 'p256'];
                 }
                 else if (curve !== undefined) {
                     return [src, curve];
@@ -1324,7 +1486,7 @@
             if (other instanceof ECPublicKey) {
                 if (this.curve === other.curve) {
                     const compress = this.curve === 'secp256k1';
-                    return utils$1.compareArrays(this.bytes(compress), other.bytes(compress));
+                    return utils.compareArrays(this.bytes(compress), other.bytes(compress));
                 }
                 else if (this.curve === 'secp256k1') {
                     return -1;
@@ -1334,24 +1496,24 @@
                 }
             }
             else {
-                throw new utils$1.InvalidPublicKeyError('ECDSA key expected');
+                throw new utils.InvalidPublicKeyError('ECDSA key expected');
             }
         }
         hash() {
             const key = this.bytes();
-            return utils$1.b58Encode(blake2b(key, { dkLen: 20 }), pref[this.curve].pkh);
+            return utils.b58Encode(blake2b(key, { dkLen: 20 }), pref[this.curve].pkh);
         }
         bytes(compress = true) {
             // @noble/curves supports both compressed and uncompressed formats
             // We need to convert the stored public key to the requested format
             if (this.curve === 'secp256k1') {
                 // For secp256k1, we need to get the public key from the stored bytes and convert format
-                const point = secp256k1.secp256k1.Point.fromHex(__classPrivateFieldGet(this, _ECPublicKey_key, "f"));
+                const point = secp256k1_js.secp256k1.Point.fromBytes(__classPrivateFieldGet(this, _ECPublicKey_key, "f"));
                 return point.toBytes(compress);
             }
             else {
                 // For p256, we need to get the public key from the stored bytes and convert format
-                const point = nist_js.p256.Point.fromHex(__classPrivateFieldGet(this, _ECPublicKey_key, "f"));
+                const point = nist_js.p256.Point.fromBytes(__classPrivateFieldGet(this, _ECPublicKey_key, "f"));
                 return point.toBytes(compress);
             }
         }
@@ -1364,7 +1526,7 @@
         }
         toString() {
             const key = this.bytes();
-            return utils$1.b58Encode(key, pref[this.curve].pk);
+            return utils.b58Encode(key, pref[this.curve].pk);
         }
     }
     _ECPublicKey_key = new WeakMap();
@@ -1391,7 +1553,7 @@
             abytes$1(key, undefined, 'key');
             this.iHash = hash.create();
             if (typeof this.iHash.update !== 'function')
-                throw new Error('Expected instance of class which extends utils.Hash');
+                throw new Error('expected Hash instance');
             this.blockLen = this.iHash.blockLen;
             this.outputLen = this.iHash.outputLen;
             const blockLen = this.blockLen;
@@ -1436,12 +1598,13 @@
             // Create new instance without calling constructor since the key
             // is already in state and we don't know it.
             to ||= Object.create(Object.getPrototypeOf(this), {});
-            const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+            const { oHash, iHash, finished, destroyed, blockLen, outputLen, canXOF } = this;
             to = to;
             to.finished = finished;
             to.destroyed = destroyed;
             to.blockLen = blockLen;
             to.outputLen = outputLen;
+            to.canXOF = canXOF;
             to.oHash = oHash._cloneInto(to.oHash);
             to.iHash = iHash._cloneInto(to.iHash);
             return to;
@@ -1465,16 +1628,16 @@
      * PBKDF (RFC 2898). Can be used to create a key from password and salt.
      * @module
      */
-    // Common start and end for sync/async functions
+    // Common validation and per-call state setup for sync/async functions.
     function pbkdf2Init(hash, _password, _salt, _opts) {
         ahash$1(hash);
         const opts = checkOpts$1({ dkLen: 32, asyncTick: 10 }, _opts);
         const { c, dkLen, asyncTick } = opts;
-        anumber$2(c, 'c');
-        anumber$2(dkLen, 'dkLen');
-        anumber$2(asyncTick, 'asyncTick');
+        anumber$1(c, 'c');
+        anumber$1(dkLen, 'dkLen');
+        anumber$1(asyncTick, 'asyncTick');
         if (c < 1)
-            throw new Error('iterations (c) must be >= 1');
+            throw new Error('"c" (iterations) must be >= 1');
         // RFC 8018 §5.2 defines `dkLen` as "a positive integer".
         if (dkLen < 1)
             throw new Error('"dkLen" must be >= 1');
@@ -1482,25 +1645,69 @@
         // before allocating the destination buffer.
         if (dkLen > (2 ** 32 - 1) * hash.outputLen)
             throw new Error('derived key too long');
-        const password = kdfInputToBytes(_password, 'password');
-        const salt = kdfInputToBytes(_salt, 'salt');
-        // DK = PBKDF2(PRF, Password, Salt, c, dkLen);
-        const DK = new Uint8Array(dkLen);
-        // U1 = PRF(Password, Salt + INT_32_BE(i))
-        const PRF = hmac.create(hash, password);
-        // Cache PRF(P, S || ...) prefix state so each block only appends INT_32_BE(i).
-        const PRFSalt = PRF._cloneInto().update(salt);
-        return { c, dkLen, asyncTick, DK, PRF, PRFSalt };
+        const p = kdfInputToBytes(_password, 'password');
+        try {
+            const s = kdfInputToBytes(_salt, 'salt');
+            try {
+                // DK = PBKDF2(PRF, Password, Salt, c, dkLen);
+                const DK = new Uint8Array(dkLen);
+                const { iHash, oHash, outputLen } = hmac.create(hash, p);
+                // Drive keyed hashes directly; the wrapper is only needed to initialize their HMAC midstates.
+                const u = new Uint8Array(outputLen);
+                const eng = pbkdf2Engine(iHash, oHash, s, u);
+                return { c, dkLen, asyncTick, DK, outputLen, eng };
+            }
+            finally {
+                // Uint8Array inputs belong to the caller; only wipe our UTF-8 conversion.
+                if (typeof _salt === 'string')
+                    clean$1(s);
+            }
+        }
+        finally {
+            if (typeof _password === 'string')
+                clean$1(p);
+        }
     }
-    function pbkdf2Output(PRF, PRFSalt, DK, prfW, u) {
-        // Shared sync/async cleanup point: wipe transient PRF state
-        // while preserving the derived key buffer.
-        PRF.destroy();
-        PRFSalt.destroy();
-        if (prfW)
-            prfW.destroy();
-        clean$1(u);
-        return DK;
+    // Per-call PRF driver writes U1 into both `u` and `Ti`, then later digests into `u`;
+    // shared by the sync and async variants.
+    function pbkdf2Engine(iHash, oHash, salt, u) {
+        const counter = new Uint8Array(4);
+        const view = createView(counter);
+        // Full clones retain tree/config state; absorb salt before async yields without cloning input.
+        const salted = iHash._cloneInto().update(salt);
+        // u1() overwrites the worker before reading it. Seed from the outer midstate so a long salt
+        // cannot pre-populate a tree stack that the first reset would abandon without wiping.
+        const work = oHash._cloneInto();
+        const iClone = iHash._cloneInto; // Capture before mixed feedback can materialize state tuples.
+        const oClone = oHash._cloneInto;
+        return {
+            u1: (ti, Ti) => {
+                view.setInt32(0, ti, false);
+                salted._cloneInto(work).update(counter).digestInto(u);
+                oHash._cloneInto(work).update(u).digestInto(u);
+                Ti.set(u.subarray(0, Ti.length));
+            },
+            // Whole `F` inner loop for the sync variant: one optimized function owns the hot loop.
+            rounds: (c, Ti) => {
+                for (let ui = 1; ui < c; ui++) {
+                    iClone.call(iHash, work).update(u).digestInto(u);
+                    oClone.call(oHash, work).update(u).digestInto(u);
+                    for (let i = 0; i < Ti.length; i++)
+                        Ti[i] ^= u[i];
+                }
+            },
+            output: (DK) => {
+                // Keyed templates and derived worker states are secret material.
+                iHash.destroy();
+                oHash.destroy();
+                salted.destroy();
+                work.destroy();
+                // Shared sync/async cleanup point: wipe transient PRF state
+                // while preserving the derived key buffer.
+                clean$1(u);
+                return DK;
+            },
+        };
     }
     /**
      * PBKDF2-HMAC: RFC 8018 key derivation function.
@@ -1521,30 +1728,20 @@
      * ```
      */
     function pbkdf2(hash, password, salt, opts) {
-        const { c, dkLen, DK, PRF, PRFSalt } = pbkdf2Init(hash, password, salt, opts);
-        let prfW; // Working copy
-        const arr = new Uint8Array(4);
-        const view = createView(arr);
-        const u = new Uint8Array(PRF.outputLen);
+        const { c, dkLen, DK, outputLen, eng } = pbkdf2Init(hash, password, salt, opts);
         // DK = T1 + T2 + ⋯ + Tdklen/hlen
-        for (let ti = 1, pos = 0; pos < dkLen; ti++, pos += PRF.outputLen) {
+        for (let ti = 1, pos = 0; pos < dkLen; ti++, pos += outputLen) {
             // Ti = F(Password, Salt, c, i)
             // The last Ti view can be shorter than hLen, which applies
             // RFC 8018 §5.2 step 4's T_l<0..r-1> truncation without extra copies.
-            const Ti = DK.subarray(pos, pos + PRF.outputLen);
-            view.setInt32(0, ti, false);
+            const Ti = DK.subarray(pos, pos + outputLen);
             // F(Password, Salt, c, i) = U1 ^ U2 ^ ⋯ ^ Uc
             // U1 = PRF(Password, Salt + INT_32_BE(i))
-            (prfW = PRFSalt._cloneInto(prfW)).update(arr).digestInto(u);
-            Ti.set(u.subarray(0, Ti.length));
-            for (let ui = 1; ui < c; ui++) {
-                // Uc = PRF(Password, Uc−1)
-                PRF._cloneInto(prfW).update(u).digestInto(u);
-                for (let i = 0; i < Ti.length; i++)
-                    Ti[i] ^= u[i];
-            }
+            eng.u1(ti, Ti);
+            // Uc = PRF(Password, Uc−1); Ti ^= Uc
+            eng.rounds(c, Ti);
         }
-        return pbkdf2Output(PRF, PRFSalt, DK, prfW, u);
+        return eng.output(DK);
     }
 
     /**
@@ -1573,8 +1770,28 @@
     const SHA256_W = /* @__PURE__ */ new Uint32Array(64);
     /** Internal SHA-224 / SHA-256 compression engine from RFC 6234 §6.2. */
     class SHA2_32B extends HashMD {
-        constructor(outputLen) {
+        // We cannot use array here since array allows indexing by variable
+        // which means optimizer/compiler cannot use registers.
+        // Numeric initializers matter: starting the fields as `undefined` changes
+        // V8's field representation and makes sha256 3x slower (measured).
+        A = 0;
+        B = 0;
+        C = 0;
+        D = 0;
+        E = 0;
+        F = 0;
+        G = 0;
+        H = 0;
+        constructor(outputLen, IV) {
             super(64, outputLen, 8, false);
+            this.A = IV[0] | 0;
+            this.B = IV[1] | 0;
+            this.C = IV[2] | 0;
+            this.D = IV[3] | 0;
+            this.E = IV[4] | 0;
+            this.F = IV[5] | 0;
+            this.G = IV[6] | 0;
+            this.H = IV[7] | 0;
         }
         get() {
             const { A, B, C, D, E, F, G, H } = this;
@@ -1591,6 +1808,10 @@
             this.G = G | 0;
             this.H = H | 0;
         }
+        _cloneInto(to) {
+            (to ||= new this.constructor()).set(...this.get());
+            return this._cloneIntoMeta(to);
+        }
         process(view, offset) {
             // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array
             for (let i = 0; i < 16; i++, offset += 4)
@@ -1642,18 +1863,8 @@
     }
     /** Internal SHA-256 hash class grounded in RFC 6234 §6.2. */
     class _SHA256 extends SHA2_32B {
-        // We cannot use array here since array allows indexing by variable
-        // which means optimizer/compiler cannot use registers.
-        A = SHA256_IV[0] | 0;
-        B = SHA256_IV[1] | 0;
-        C = SHA256_IV[2] | 0;
-        D = SHA256_IV[3] | 0;
-        E = SHA256_IV[4] | 0;
-        F = SHA256_IV[5] | 0;
-        G = SHA256_IV[6] | 0;
-        H = SHA256_IV[7] | 0;
         constructor() {
-            super(32);
+            super(32, SHA256_IV);
         }
     }
     // SHA2-512 is slower than sha256 in js because u64 operations are slow.
@@ -1690,8 +1901,45 @@
     const SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
     /** Internal SHA-384 / SHA-512 compression engine from RFC 6234 §6.4. */
     class SHA2_64B extends HashMD {
-        constructor(outputLen) {
+        // We cannot use array here since array allows indexing by variable
+        // which means optimizer/compiler cannot use registers.
+        // h -- high 32 bits, l -- low 32 bits
+        // Numeric initializers matter: starting the fields as `undefined` changes
+        // V8's field representation and slows hashing down (measured on sha256).
+        Ah = 0;
+        Al = 0;
+        Bh = 0;
+        Bl = 0;
+        Ch = 0;
+        Cl = 0;
+        Dh = 0;
+        Dl = 0;
+        Eh = 0;
+        El = 0;
+        Fh = 0;
+        Fl = 0;
+        Gh = 0;
+        Gl = 0;
+        Hh = 0;
+        Hl = 0;
+        constructor(outputLen, IV) {
             super(128, outputLen, 16, false);
+            this.Ah = IV[0] | 0;
+            this.Al = IV[1] | 0;
+            this.Bh = IV[2] | 0;
+            this.Bl = IV[3] | 0;
+            this.Ch = IV[4] | 0;
+            this.Cl = IV[5] | 0;
+            this.Dh = IV[6] | 0;
+            this.Dl = IV[7] | 0;
+            this.Eh = IV[8] | 0;
+            this.El = IV[9] | 0;
+            this.Fh = IV[10] | 0;
+            this.Fl = IV[11] | 0;
+            this.Gh = IV[12] | 0;
+            this.Gl = IV[13] | 0;
+            this.Hh = IV[14] | 0;
+            this.Hl = IV[15] | 0;
         }
         // prettier-ignore
         get() {
@@ -1717,6 +1965,10 @@
             this.Hh = Hh | 0;
             this.Hl = Hl | 0;
         }
+        _cloneInto(to) {
+            (to ||= new this.constructor()).set(...this.get());
+            return this._cloneIntoMeta(to);
+        }
         process(view, offset) {
             // Extend the first 16 words into the remaining 64 words w[16..79] of the message schedule array
             for (let i = 0; i < 16; i++, offset += 4) {
@@ -1800,24 +2052,8 @@
     }
     /** Internal SHA-512 hash class grounded in RFC 6234 §6.3 and §6.4. */
     class _SHA512 extends SHA2_64B {
-        Ah = SHA512_IV[0] | 0;
-        Al = SHA512_IV[1] | 0;
-        Bh = SHA512_IV[2] | 0;
-        Bl = SHA512_IV[3] | 0;
-        Ch = SHA512_IV[4] | 0;
-        Cl = SHA512_IV[5] | 0;
-        Dh = SHA512_IV[6] | 0;
-        Dl = SHA512_IV[7] | 0;
-        Eh = SHA512_IV[8] | 0;
-        El = SHA512_IV[9] | 0;
-        Fh = SHA512_IV[10] | 0;
-        Fl = SHA512_IV[11] | 0;
-        Gh = SHA512_IV[12] | 0;
-        Gl = SHA512_IV[13] | 0;
-        Hh = SHA512_IV[14] | 0;
-        Hl = SHA512_IV[15] | 0;
         constructor() {
-            super(64);
+            super(64, SHA512_IV);
         }
     }
     /**
@@ -1828,6 +2064,7 @@
      * - Each sha256 hash is executing 2^18 bit operations.
      * - Good 2024 ASICs can do 200Th/sec with 3500 watts of power, corresponding to 2^36 hashes/joule.
      * @param msg - message bytes to hash
+     * @param opts - Reserved hash options.
      * @returns Digest bytes.
      * @example
      * Hash a message with SHA2-256.
@@ -1840,6 +2077,7 @@
     /**
      * SHA2-512 hash function from RFC 4634.
      * @param msg - message bytes to hash
+     * @param opts - Reserved hash options.
      * @returns Digest bytes.
      * @example
      * Hash a message with SHA2-512.
@@ -1850,353 +2088,28 @@
     const sha512 = /* @__PURE__ */ createHasher$1(() => new _SHA512(), 
     /* @__PURE__ */ oidNist$1(0x03));
 
-    /*! scure-base - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-    function isBytes$1(a) {
-        // Plain `instanceof Uint8Array` is too strict for some Buffer / proxy / cross-realm cases. The
-        // fallback still requires a real ArrayBuffer view, so plain JSON-deserialized
-        // `{ constructor: ... }` spoofing is rejected. `BYTES_PER_ELEMENT === 1` keeps the
-        // fallback on byte-oriented views.
-        return (a instanceof Uint8Array ||
-            (ArrayBuffer.isView(a) &&
-                a.constructor.name === 'Uint8Array' &&
-                'BYTES_PER_ELEMENT' in a &&
-                a.BYTES_PER_ELEMENT === 1));
-    }
-    function isArrayOf(isString, arr) {
-        if (!Array.isArray(arr))
-            return false;
-        if (arr.length === 0)
-            return true;
-        if (isString) {
-            return arr.every((item) => typeof item === 'string');
-        }
-        else {
-            return arr.every((item) => Number.isSafeInteger(item));
+    /*! scure-bip39 - MIT License (c) 2022 Patricio Palladino, Paul Miller (paulmillr.com) */
+    // Japanese wordlist
+    // The canonical BIP-39 Japanese wordlist starts with あいこくしん.
+    // Use that sentinel so generated phrases use U+3000 ideographic spaces.
+    const isJapanese = (wordlist) => wordlist[0] === '\u3042\u3044\u3053\u304f\u3057\u3093';
+    // JavaScript strings can contain unpaired UTF-16 surrogates, which cannot be encoded as UTF-8.
+    function isWellFormedUnicode(value) {
+        for (let i = 0; i < value.length; i++) {
+            const current = value.charCodeAt(i);
+            if (current >= 0xd800 && current <= 0xdbff) {
+                if (i + 1 >= value.length)
+                    return false;
+                const next = value.charCodeAt(++i);
+                if (next < 0xdc00 || next > 0xdfff)
+                    return false;
+            }
+            else if (current >= 0xdc00 && current <= 0xdfff) {
+                return false;
+            }
         }
-    }
-    function afn(input) {
-        if (typeof input !== 'function')
-            throw new TypeError('function expected');
         return true;
     }
-    function astr(label, input) {
-        if (typeof input !== 'string')
-            throw new TypeError(`${label}: string expected`);
-        return true;
-    }
-    function anumber$1(n) {
-        if (typeof n !== 'number')
-            throw new TypeError(`number expected, got ${typeof n}`);
-        if (!Number.isSafeInteger(n))
-            throw new RangeError(`invalid integer: ${n}`);
-    }
-    function aArr(input) {
-        if (!Array.isArray(input))
-            throw new TypeError('array expected');
-    }
-    function astrArr(label, input) {
-        if (!isArrayOf(true, input))
-            throw new TypeError(`${label}: array of strings expected`);
-    }
-    function anumArr(label, input) {
-        if (!isArrayOf(false, input))
-            throw new TypeError(`${label}: array of numbers expected`);
-    }
-    /**
-     * @__NO_SIDE_EFFECTS__
-     */
-    function chain(...args) {
-        const id = (a) => a;
-        // Wrap call in closure so JIT can inline calls
-        const wrap = (a, b) => (c) => a(b(c));
-        // Construct chain of args[-1].encode(args[-2].encode([...]))
-        const encode = args.map((x) => x.encode).reduceRight(wrap, id);
-        // Construct chain of args[0].decode(args[1].decode(...))
-        const decode = args.map((x) => x.decode).reduce(wrap, id);
-        return { encode, decode };
-    }
-    /**
-     * Encodes integer radix representation to array of strings using alphabet and back.
-     * Could also be array of strings.
-     * @__NO_SIDE_EFFECTS__
-     */
-    function alphabet(letters) {
-        // mapping 1 to "b"
-        const lettersA = typeof letters === 'string' ? letters.split('') : letters;
-        const len = lettersA.length;
-        astrArr('alphabet', lettersA);
-        // mapping "b" to 1
-        const indexes = new Map(lettersA.map((l, i) => [l, i]));
-        return {
-            encode: (digits) => {
-                aArr(digits);
-                return digits.map((i) => {
-                    if (!Number.isSafeInteger(i) || i < 0 || i >= len)
-                        throw new Error(`alphabet.encode: digit index outside alphabet "${i}". Allowed: ${letters}`);
-                    return lettersA[i];
-                });
-            },
-            decode: (input) => {
-                aArr(input);
-                return input.map((letter) => {
-                    astr('alphabet.decode', letter);
-                    const i = indexes.get(letter);
-                    if (i === undefined)
-                        throw new Error(`Unknown letter: "${letter}". Allowed: ${letters}`);
-                    return i;
-                });
-            },
-        };
-    }
-    /**
-     * @__NO_SIDE_EFFECTS__
-     */
-    function join(separator = '') {
-        astr('join', separator);
-        // join('') is only lossless when each chunk is already unambiguous, such as single-symbol alphabets.
-        // Multi-character tokens need a separator that cannot appear inside the chunks.
-        return {
-            encode: (from) => {
-                astrArr('join.decode', from);
-                return from.join(separator);
-            },
-            decode: (to) => {
-                astr('join.decode', to);
-                return to.split(separator);
-            },
-        };
-    }
-    /**
-     * Pad strings array so it has integer number of bits
-     * @__NO_SIDE_EFFECTS__
-     */
-    function padding(bits, chr = '=') {
-        anumber$1(bits);
-        astr('padding', chr);
-        return {
-            encode(data) {
-                astrArr('padding.encode', data);
-                // Mutates the intermediate token array in place while appending pad chars.
-                // utils.padding callers that need to preserve their input should pass a copy.
-                while ((data.length * bits) % 8)
-                    data.push(chr);
-                return data;
-            },
-            decode(input) {
-                astrArr('padding.decode', input);
-                let end = input.length;
-                if ((end * bits) % 8)
-                    throw new Error('padding: invalid, string should have whole number of bytes');
-                for (; end > 0 && input[end - 1] === chr; end--) {
-                    const last = end - 1;
-                    const byte = last * bits;
-                    if (byte % 8 === 0)
-                        throw new Error('padding: invalid, string has too much padding');
-                }
-                return input.slice(0, end);
-            },
-        };
-    }
-    /**
-     * Slow: O(n^2) time complexity
-     */
-    function convertRadix(data, from, to) {
-        // base 1 is impossible
-        if (from < 2)
-            throw new RangeError(`convertRadix: invalid from=${from}, base cannot be less than 2`);
-        if (to < 2)
-            throw new RangeError(`convertRadix: invalid to=${to}, base cannot be less than 2`);
-        aArr(data);
-        if (!data.length)
-            return [];
-        let pos = 0;
-        const res = [];
-        const digits = Array.from(data, (d) => {
-            anumber$1(d);
-            if (d < 0 || d >= from)
-                throw new Error(`invalid integer: ${d}`);
-            return d;
-        });
-        const dlen = digits.length;
-        while (true) {
-            let carry = 0;
-            let done = true;
-            for (let i = pos; i < dlen; i++) {
-                const digit = digits[i];
-                const fromCarry = from * carry;
-                const digitBase = fromCarry + digit;
-                if (!Number.isSafeInteger(digitBase) ||
-                    fromCarry / from !== carry ||
-                    digitBase - digit !== fromCarry) {
-                    throw new Error('convertRadix: carry overflow');
-                }
-                const div = digitBase / to;
-                carry = digitBase % to;
-                const rounded = Math.floor(div);
-                digits[i] = rounded;
-                if (!Number.isSafeInteger(rounded) || rounded * to + carry !== digitBase)
-                    throw new Error('convertRadix: carry overflow');
-                if (!done)
-                    continue;
-                else if (!rounded)
-                    pos = i;
-                else
-                    done = false;
-            }
-            res.push(carry);
-            if (done)
-                break;
-        }
-        // Preserve explicit leading zero digits so callers like base58 keep zero-prefix semantics.
-        for (let i = 0; i < data.length - 1 && data[i] === 0; i++)
-            res.push(0);
-        return res.reverse();
-    }
-    const gcd = (a, b) => (b === 0 ? a : gcd(b, a % b));
-    // Maximum carry width before the `pos` cycle repeats.
-    // Residues advance in gcd(from, to) steps, so the largest pre-drain width is from + (to - gcd).
-    const radix2carry = /* @__NO_SIDE_EFFECTS__ */ (from, to) => from + (to - gcd(from, to));
-    const powers = /* @__PURE__ */ (() => {
-        let res = [];
-        for (let i = 0; i < 40; i++)
-            res.push(2 ** i);
-        return res;
-    })();
-    /**
-     * Implemented with numbers, because BigInt is 5x slower
-     */
-    function convertRadix2(data, from, to, padding) {
-        aArr(data);
-        if (from <= 0 || from > 32)
-            throw new RangeError(`convertRadix2: wrong from=${from}`);
-        if (to <= 0 || to > 32)
-            throw new RangeError(`convertRadix2: wrong to=${to}`);
-        if (radix2carry(from, to) > 32) {
-            throw new Error(`convertRadix2: carry overflow from=${from} to=${to} carryBits=${radix2carry(from, to)}`);
-        }
-        let carry = 0;
-        let pos = 0; // bitwise position in current element
-        const max = powers[from];
-        const mask = powers[to] - 1;
-        const res = [];
-        for (const n of data) {
-            anumber$1(n);
-            if (n >= max)
-                throw new Error(`convertRadix2: invalid data word=${n} from=${from}`);
-            carry = (carry << from) | n;
-            if (pos + from > 32)
-                throw new Error(`convertRadix2: carry overflow pos=${pos} from=${from}`);
-            pos += from;
-            for (; pos >= to; pos -= to)
-                res.push(((carry >> (pos - to)) & mask) >>> 0);
-            const pow = powers[pos];
-            if (pow === undefined)
-                throw new Error('invalid carry');
-            carry &= pow - 1; // clean carry, otherwise it will cause overflow
-        }
-        carry = (carry << (to - pos)) & mask;
-        // Canonical decode paths reject leftover whole input words and non-zero pad bits.
-        // For Bech32 5->8 regrouping, this is the "4 bits or less, all zeroes" tail rule.
-        if (!padding && pos >= from)
-            throw new Error('Excess padding');
-        if (!padding && carry > 0)
-            throw new Error(`Non-zero padding: ${carry}`);
-        if (padding && pos > 0)
-            res.push(carry >>> 0);
-        return res;
-    }
-    /**
-     * @__NO_SIDE_EFFECTS__
-     */
-    function radix(num) {
-        anumber$1(num);
-        const _256 = 2 ** 8;
-        // Base-range and carry-overflow checks live in convertRadix so encode/decode reject unsupported bases symmetrically.
-        return {
-            encode: (bytes) => {
-                if (!isBytes$1(bytes))
-                    throw new TypeError('radix.encode input should be Uint8Array');
-                return convertRadix(Array.from(bytes), _256, num);
-            },
-            decode: (digits) => {
-                anumArr('radix.decode', digits);
-                return Uint8Array.from(convertRadix(digits, num, _256));
-            },
-        };
-    }
-    /**
-     * If both bases are power of same number (like `2**8 <-> 2**64`),
-     * there is a linear algorithm. For now we have implementation for power-of-two bases only.
-     * @__NO_SIDE_EFFECTS__
-     */
-    function radix2(bits, revPadding = false) {
-        anumber$1(bits);
-        if (bits <= 0 || bits > 32)
-            throw new RangeError('radix2: bits should be in (0..32]');
-        if (radix2carry(8, bits) > 32 || radix2carry(bits, 8) > 32)
-            throw new RangeError('radix2: carry overflow');
-        // revPadding flips which direction allows a partial zero tail.
-        // Default pads 8->bits and rejects extra bits on bits->8; `true` does the opposite.
-        return {
-            encode: (bytes) => {
-                if (!isBytes$1(bytes))
-                    throw new TypeError('radix2.encode input should be Uint8Array');
-                return convertRadix2(Array.from(bytes), 8, bits, !revPadding);
-            },
-            decode: (digits) => {
-                anumArr('radix2.decode', digits);
-                return Uint8Array.from(convertRadix2(digits, bits, 8, revPadding));
-            },
-        };
-    }
-    function checksum(len, fn) {
-        anumber$1(len);
-        // Reject degenerate zero-byte checksums up front so callers don't accidentally
-        // build a no-op checksum stage.
-        if (len <= 0)
-            throw new RangeError(`checksum length must be positive: ${len}`);
-        afn(fn);
-        const _fn = fn;
-        // Uses the first `len` bytes of fn(data) in both directions.
-        // Current call sites rely on `len > 0` and checksum functions that return at least that many bytes.
-        return {
-            encode(data) {
-                if (!isBytes$1(data))
-                    throw new TypeError('checksum.encode: input should be Uint8Array');
-                const sum = _fn(data).slice(0, len);
-                const res = new Uint8Array(data.length + len);
-                res.set(data);
-                res.set(sum, data.length);
-                return res;
-            },
-            decode(data) {
-                if (!isBytes$1(data))
-                    throw new TypeError('checksum.decode: input should be Uint8Array');
-                const payload = data.slice(0, -len);
-                const oldChecksum = data.slice(-len);
-                const newChecksum = _fn(payload).slice(0, len);
-                for (let i = 0; i < len; i++)
-                    if (newChecksum[i] !== oldChecksum[i])
-                        throw new Error('Invalid checksum');
-                return payload;
-            },
-        };
-    }
-    // prettier-ignore
-    /**
-     * Low-level building blocks used by the exported codecs.
-     * @example
-     * Build a radix-32 coder from the low-level helpers.
-     * ```ts
-     * import { utils } from '@scure/base';
-     * utils.radix2(5).encode(Uint8Array.from([1, 2, 3]));
-     * ```
-     */
-    const utils = /* @__PURE__ */ Object.freeze({
-        alphabet, chain, checksum, convertRadix, convertRadix2, radix, radix2, join, padding,
-    });
-
-    /*! scure-bip39 - MIT License (c) 2022 Patricio Palladino, Paul Miller (paulmillr.com) */
     // Normalization replaces equivalent sequences of characters
     // so that any two texts that are equivalent will be reduced
     // to the same sequence of code points, called the normal form of the original text.
@@ -2206,6 +2119,8 @@
     function nfkd(str) {
         if (typeof str !== 'string')
             throw new TypeError('invalid mnemonic type: ' + typeof str);
+        if (!isWellFormedUnicode(str))
+            throw new TypeError('expected well-formed Unicode string');
         return str.normalize('NFKD');
     }
     // BIP-39 mnemonics are consumed in NFKD form.
@@ -2223,23 +2138,97 @@
         if (![16, 20, 24, 28, 32].includes(ent.length))
             throw new RangeError('invalid entropy length');
     }
+    /**
+     * Generate x random words. Uses Cryptographically-Secure Random Number Generator.
+     * @param wordlist - Imported wordlist for a specific language.
+     * @param strength - Mnemonic strength, from 128 to 256 bits.
+     * @returns 12-24 word mnemonic phrase.
+     * @throws On wrong argument types. {@link TypeError}
+     * @throws On wrong argument ranges or values. {@link RangeError}
+     * @example
+     * Generate a new English mnemonic.
+     * ```ts
+     * import { generateMnemonic } from '@scure/bip39';
+     * import { wordlist } from '@scure/bip39/wordlists/english.js';
+     * const mnemonic = generateMnemonic(wordlist, 128);
+     * // 'legal winner thank year wave sausage worth useful legal winner thank yellow'
+     * ```
+     */
+    function generateMnemonic$1(wordlist, strength = 128) {
+        anumber$1(strength);
+        if (strength % 32 !== 0 || strength > 256)
+            throw new RangeError('Invalid entropy');
+        return entropyToMnemonic$1(randomBytes$2(strength / 8), wordlist);
+    }
+    // BIP-39 checksum is the first ENT/32 bits of SHA-256(entropy).
+    // Returned as a byte with checksum bits on the left and zeroes on the right.
     const calcChecksum = (entropy) => {
         // Checksum is ent.length/4 bits long
         const bitsLeft = 8 - entropy.length / 4;
         // Zero rightmost "bitsLeft" bits in byte
         // For example: bitsLeft=4 val=10111101 -> 10110000
-        return new Uint8Array([(sha256(entropy)[0] >> bitsLeft) << bitsLeft]);
+        return (sha256(entropy)[0] >> bitsLeft) << bitsLeft;
     };
-    function getCoder(wordlist) {
+    function awordlist(wordlist) {
         if (!Array.isArray(wordlist) || wordlist.length !== 2048 || typeof wordlist[0] !== 'string')
             throw new TypeError('Wordlist: expected array of 2048 strings');
         wordlist.forEach((i) => {
             if (typeof i !== 'string')
                 throw new TypeError('wordlist: non-string element: ' + i);
+            // Wordlists become mnemonic output, so apply the same lossless UTF-8 boundary as input phrases.
+            if (!isWellFormedUnicode(i))
+                throw new TypeError('wordlist: expected well-formed Unicode string');
         });
-        // BIP-39 appends checksum bits to entropy.
-        // It then splits the bitstream into 11-bit indexes for a 2048-word list.
-        return utils.chain(utils.checksum(1, calcChecksum), utils.radix2(11, true), utils.alphabet(wordlist));
+    }
+    // BIP-39 appends checksum bits to entropy,
+    // then splits the bitstream into 11-bit indexes for a 2048-word list.
+    function encodeWords(entropy, wordlist) {
+        awordlist(wordlist);
+        const bytes = new Uint8Array(entropy.length + 1); // entropy || checksum byte
+        bytes.set(entropy);
+        bytes[entropy.length] = calcChecksum(entropy);
+        const words = [];
+        let carry = 0; // bit accumulator, holds < 19 bits
+        let bits = 0;
+        for (const byte of bytes) {
+            carry = (carry << 8) | byte;
+            bits += 8;
+            if (bits >= 11) {
+                bits -= 11;
+                words.push(wordlist[(carry >>> bits) & 0x7ff]);
+                carry &= (1 << bits) - 1;
+            }
+        }
+        // Bits still in carry are the zero right bits of the checksum byte; drop them.
+        return words;
+    }
+    // Reverse of encodeWords: repacks 11-bit indexes into bytes and verifies checksum.
+    function decodeWords(words, wordlist) {
+        awordlist(wordlist);
+        const entLen = (words.length / 3) * 4; // every 3 words hold 32 entropy bits + 1 checksum bit
+        const bytes = new Uint8Array(entLen + 1); // entropy || checksum byte
+        let carry = 0; // bit accumulator, holds < 19 bits
+        let bits = 0;
+        let pos = 0;
+        for (const word of words) {
+            const index = wordlist.indexOf(word);
+            if (index === -1)
+                throw new Error('Unknown word: ' + word);
+            carry = (carry << 11) | index;
+            bits += 11;
+            while (bits >= 8) {
+                bits -= 8;
+                bytes[pos++] = (carry >>> bits) & 0xff;
+            }
+            carry &= (1 << bits) - 1;
+        }
+        // Left-align leftover checksum bits, matching calcChecksum output.
+        if (bits > 0)
+            bytes[pos] = carry << (8 - bits);
+        const entropy = bytes.subarray(0, entLen);
+        if (bytes[entLen] !== calcChecksum(entropy))
+            throw new Error('Invalid checksum');
+        return Uint8Array.from(entropy);
     }
     /**
      * Reversible: Converts mnemonic string to raw entropy in form of byte array.
@@ -2263,12 +2252,37 @@
      * ])
      * ```
      */
-    function mnemonicToEntropy(mnemonic, wordlist) {
+    function mnemonicToEntropy$1(mnemonic, wordlist) {
         const { words } = normalize(mnemonic);
-        const entropy = getCoder(wordlist).decode(words);
+        const entropy = decodeWords(words, wordlist);
         aentropy(entropy);
         return entropy;
     }
+    /**
+     * Reversible: Converts raw entropy in form of byte array to mnemonic string.
+     * @param entropy - Byte array.
+     * @param wordlist - Imported wordlist for a specific language.
+     * @returns 12-24 words.
+     * @throws On wrong argument types. {@link TypeError}
+     * @throws On wrong argument ranges or values. {@link RangeError}
+     * @example
+     * Convert raw entropy into an English mnemonic.
+     * ```ts
+     * import { entropyToMnemonic } from '@scure/bip39';
+     * import { wordlist } from '@scure/bip39/wordlists/english.js';
+     * const ent = new Uint8Array([
+     *   0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f,
+     *   0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f, 0x7f
+     * ]);
+     * const mnemonic = entropyToMnemonic(ent, wordlist);
+     * // 'legal winner thank year wave sausage worth useful legal winner thank yellow'
+     * ```
+     */
+    function entropyToMnemonic$1(entropy, wordlist) {
+        aentropy(entropy);
+        const words = encodeWords(entropy, wordlist);
+        return words.join(isJapanese(wordlist) ? '\u3000' : ' ');
+    }
     /**
      * Validates mnemonic for being 12-24 words contained in `wordlist`.
      * @param mnemonic - 12-24 words.
@@ -2288,7 +2302,7 @@
      */
     function validateMnemonic(mnemonic, wordlist) {
         try {
-            mnemonicToEntropy(mnemonic, wordlist);
+            mnemonicToEntropy$1(mnemonic, wordlist);
         }
         catch (e) {
             return false;
@@ -2296,7 +2310,11 @@
         return true;
     }
     // BIP-39 salts PBKDF2 with the UTF-8 NFKD string "mnemonic" + passphrase.
-    const psalt = (passphrase) => nfkd('mnemonic' + passphrase);
+    const psalt = (passphrase) => {
+        if (typeof passphrase !== 'string')
+            throw new TypeError('invalid passphrase type: ' + typeof passphrase);
+        return nfkd('mnemonic' + passphrase);
+    };
     /**
      * Irreversible: Uses KDF to derive 64 bytes of key data from mnemonic + optional password.
      * @param mnemonic - 12-24 words.
@@ -4386,7 +4404,7 @@ zoo`.split('\n'));
 
     /* eslint-disable @typescript-eslint/no-this-alias */
     function generateKeyPairFromSeed(seed) {
-        const publicKey = ed25519$1.ed25519.getPublicKey(seed);
+        const publicKey = ed25519_js.ed25519.getPublicKey(seed);
         const secretKey = new Uint8Array(64);
         secretKey.set(seed);
         secretKey.set(publicKey, 32);
@@ -4482,8 +4500,8 @@ zoo`.split('\n'));
             const privateKeyBytes = priv.secretKey.toArray('be', 32);
             const privateKeyUint8 = new Uint8Array(privateKeyBytes);
             const publicKey = priv.curve === 'secp256k1'
-                ? secp256k1.secp256k1.getPublicKey(privateKeyUint8, true) // compressed public key
-                : nist.p256.getPublicKey(privateKeyUint8, true); // compressed public key
+                ? secp256k1_js.secp256k1.getPublicKey(privateKeyUint8, true) // compressed public key
+                : nist_js.p256.getPublicKey(privateKeyUint8, true); // compressed public key
             this.keyPair = {
                 curve: priv.curve,
                 secretKey: priv.secretKey,
@@ -4507,10 +4525,10 @@ zoo`.split('\n'));
             // Get curve order for validation
             let curveOrder;
             if (curve === 'secp256k1') {
-                curveOrder = new BN(secp256k1.secp256k1.Point.CURVE().n.toString());
+                curveOrder = new BN(secp256k1_js.secp256k1.Point.CURVE().n.toString());
             }
             else {
-                curveOrder = new BN(nist.p256.Point.CURVE().n.toString());
+                curveOrder = new BN(nist_js.p256.Point.CURVE().n.toString());
             }
             if (curveOrder.bitLength() !== 256) {
                 throw new InvalidBitSize(`Invalid curve "${curve}" with bit size "${curveOrder.bitLength()}" expecting bit size "256"`);
@@ -4557,10 +4575,10 @@ zoo`.split('\n'));
                 // Get curve order for comparison
                 let curveOrder;
                 if (this.keyPair.curve === 'secp256k1') {
-                    curveOrder = new BN(secp256k1.secp256k1.Point.CURVE().n.toString());
+                    curveOrder = new BN(secp256k1_js.secp256k1.Point.CURVE().n.toString());
                 }
                 else {
-                    curveOrder = new BN(nist.p256.Point.CURVE().n.toString());
+                    curveOrder = new BN(nist_js.p256.Point.CURVE().n.toString());
                 }
                 if (d.cmp(curveOrder) < 0) {
                     d = d.add(this.keyPair.secretKey).mod(curveOrder);
@@ -4657,16 +4675,16 @@ zoo`.split('\n'));
         switch (curve) {
             case 'ed25519': {
                 node = PrivateKey$1.fromSeed(seed).derivePath(path);
-                const sk = utils$1.b58Encode(node.seed().slice(0, 32), utils$1.PrefixV2.Ed25519Seed);
+                const sk = utils.b58Encode(node.seed().slice(0, 32), utils.PrefixV2.Ed25519Seed);
                 return sk;
             }
             case 'secp256k1':
             case 'p256': {
-                const prefixType = curve === 'secp256k1' ? utils$1.PrefixV2.Secp256k1SecretKey : utils$1.PrefixV2.P256SecretKey;
+                const prefixType = curve === 'secp256k1' ? utils.PrefixV2.Secp256k1SecretKey : utils.PrefixV2.P256SecretKey;
                 let privKey = PrivateKey.fromSeed(seed, curve);
                 privKey = privKey.derivePath(path);
                 const uint8arr = new Uint8Array(privKey.keyPair.secretKey.toArray());
-                const sk = utils$1.b58Encode(uint8arr, prefixType);
+                const sk = utils.b58Encode(uint8arr, prefixType);
                 return sk;
             }
             case 'bip25519': {
@@ -4678,23 +4696,90 @@ zoo`.split('\n'));
         }
     };
 
+    /**
+     * Converts an English BIP39 mnemonic to entropy bytes.
+     * @throws InvalidMnemonicError for an invalid phrase, without including its text.
+     */
+    function mnemonicToEntropy(mnemonic) {
+        try {
+            return mnemonicToEntropy$1(mnemonic, wordlist);
+        }
+        catch {
+            throw new InvalidMnemonicError();
+        }
+    }
+    /**
+     * Converts 16, 20, 24, 28 or 32 entropy bytes to an English BIP39 mnemonic.
+     * Strings must contain unprefixed, even-length hexadecimal. Leading zeros matter.
+     */
+    function entropyToMnemonic(entropy) {
+        let bytes;
+        if (typeof entropy === 'string') {
+            if (!/^(?:[0-9a-fA-F]{2})+$/.test(entropy)) {
+                throw new Error('Entropy must be unprefixed, even-length hexadecimal');
+            }
+            bytes = Uint8Array.from({ length: entropy.length / 2 }, (_, index) => parseInt(entropy.slice(index * 2, index * 2 + 2), 16));
+        }
+        else {
+            if (!(entropy instanceof Uint8Array) &&
+                !(ArrayBuffer.isView(entropy) &&
+                    Object.prototype.toString.call(entropy) === '[object Uint8Array]')) {
+                throw new TypeError('Entropy must be a Uint8Array');
+            }
+            bytes = new Uint8Array(entropy);
+        }
+        return entropyToMnemonic$1(bytes, wordlist);
+    }
+    /**
+     * Generates an English BIP39 mnemonic with the dependency's secure random source.
+     * @param strength Entropy bits, 128, 160, 192, 224 or 256. Defaults to 128.
+     */
+    function generateMnemonic(strength = 128) {
+        return generateMnemonic$1(wordlist, strength);
+    }
+    // Shared with the signer, but not exported from the package entrypoint.
+    function deriveMnemonicSecretKey({ mnemonic, password = '', derivationPath = "44'/1729'/0'/0'", curve = 'ed25519', }) {
+        if (!validateMnemonic(mnemonic, wordlist)) {
+            throw new InvalidMnemonicError();
+        }
+        const seed = mnemonicToSeedSync(mnemonic, password);
+        return { secretKey: generateSecretKey(seed, derivationPath, curve), curve };
+    }
+    /**
+     * Derives key material without constructing an InMemorySigner.
+     * Uses the same defaults, English BIP39 phrases, password and paths as fromMnemonic.
+     * Supports Ed25519, secp256k1 and P-256 mnemonic derivation.
+     * The returned secretKey is unencrypted and matches InMemorySigner.secretKey(),
+     * including the expanded Ed25519 form. Avoid logging or sharing the result.
+     */
+    function deriveKeyFromMnemonic(params) {
+        const { secretKey, curve } = deriveMnemonicSecretKey(params);
+        const key = curve === 'ed25519' ? new EdKey(secretKey) : new ECKey(secretKey);
+        const publicKey = key.publicKey();
+        return {
+            publicKey: String(publicKey),
+            publicKeyHash: publicKey.hash(),
+            secretKey: key.secretKey(),
+        };
+    }
+
     function isPOP(k) {
         return 'provePossession' in k;
     }
 
     var _BLSKey_key, _BLSKey_publicKey, _BLSPublicKey_key;
-    const bls = bls12381.bls12_381.longSignatures; // AKA MinPK
+    const bls = bls12381_js.bls12_381.longSignatures; // AKA MinPK
     class BLSKey {
         constructor(key, decrypt) {
             _BLSKey_key.set(this, void 0);
             _BLSKey_publicKey.set(this, void 0);
-            const tmp = utils$1.b58DecodeAndCheckPrefix(key, [
-                utils$1.PrefixV2.BLS12_381EncryptedSecretKey,
-                utils$1.PrefixV2.BLS12_381SecretKey,
+            const tmp = utils.b58DecodeAndCheckPrefix(key, [
+                utils.PrefixV2.BLS12_381EncryptedSecretKey,
+                utils.PrefixV2.BLS12_381SecretKey,
             ]);
             let [keyData] = tmp;
             const [, prefix] = tmp;
-            if (prefix === utils$1.PrefixV2.BLS12_381EncryptedSecretKey) {
+            if (prefix === utils.PrefixV2.BLS12_381EncryptedSecretKey) {
                 if (decrypt !== undefined) {
                     keyData = decrypt(keyData);
                 }
@@ -4713,21 +4798,34 @@ zoo`.split('\n'));
             const sig = bls.sign(point, this.sk()).toBytes();
             return {
                 rawSignature: sig,
-                sig: utils$1.b58Encode(sig, utils$1.PrefixV2.GenericSignature),
-                prefixSig: utils$1.b58Encode(sig, utils$1.PrefixV2.BLS12_381Signature),
+                sig: utils.b58Encode(sig, utils.PrefixV2.GenericSignature),
+                prefixSig: utils.b58Encode(sig, utils.PrefixV2.BLS12_381Signature),
             };
         }
         sign(message) {
-            return this.signDst(message, utils$1.BLS12_381_DST);
+            return this.signDst(message, utils.BLS12_381_DST);
         }
-        provePossession() {
-            return this.signDst(__classPrivateFieldGet(this, _BLSKey_publicKey, "f"), utils$1.POP_DST);
+        provePossession(overridePublicKey) {
+            let message = __classPrivateFieldGet(this, _BLSKey_publicKey, "f");
+            if (overridePublicKey !== undefined) {
+                try {
+                    if (typeof overridePublicKey !== 'string')
+                        throw new Error('Expected a public key');
+                    message = utils.b58DecodeAndCheckPrefix(overridePublicKey, [utils.PrefixV2.BLS12_381PublicKey], true);
+                    // Match Octez's compressed G1 parser, including subgroup checks and its accepted infinity encoding.
+                    bls12381_js.bls12_381.G1.Point.fromBytes(message).assertValidity();
+                }
+                catch {
+                    throw new utils.InvalidPublicKeyError('BLS override public key', 'Expecting a valid BLS public key');
+                }
+            }
+            return this.signDst(message, utils.POP_DST);
         }
         publicKey() {
             return new BLSPublicKey(__classPrivateFieldGet(this, _BLSKey_publicKey, "f"));
         }
         secretKey() {
-            return utils$1.b58Encode(__classPrivateFieldGet(this, _BLSKey_key, "f"), utils$1.PrefixV2.BLS12_381SecretKey);
+            return utils.b58Encode(__classPrivateFieldGet(this, _BLSKey_key, "f"), utils.PrefixV2.BLS12_381SecretKey);
         }
     }
     _BLSKey_key = new WeakMap(), _BLSKey_publicKey = new WeakMap();
@@ -4735,7 +4833,7 @@ zoo`.split('\n'));
         constructor(src) {
             _BLSPublicKey_key.set(this, void 0);
             if (typeof src === 'string') {
-                const [key, _] = utils$1.b58DecodeAndCheckPrefix(src, [utils$1.PrefixV2.BLS12_381PublicKey]);
+                const [key, _] = utils.b58DecodeAndCheckPrefix(src, [utils.PrefixV2.BLS12_381PublicKey]);
                 __classPrivateFieldSet(this, _BLSPublicKey_key, key, "f");
             }
             else {
@@ -4744,14 +4842,14 @@ zoo`.split('\n'));
         }
         compare(other) {
             if (other instanceof BLSPublicKey) {
-                return utils$1.compareArrays(this.bytes(), other.bytes());
+                return utils.compareArrays(this.bytes(), other.bytes());
             }
             else {
-                throw new utils$1.InvalidPublicKeyError('BLS key expected');
+                throw new utils.InvalidPublicKeyError('BLS key expected');
             }
         }
         hash() {
-            return utils$1.b58Encode(blake2b(__classPrivateFieldGet(this, _BLSPublicKey_key, "f"), { dkLen: 20 }), utils$1.PrefixV2.BLS12_381PublicKeyHash);
+            return utils.b58Encode(blake2b(__classPrivateFieldGet(this, _BLSPublicKey_key, "f"), { dkLen: 20 }), utils.PrefixV2.BLS12_381PublicKeyHash);
         }
         bytes() {
             return __classPrivateFieldGet(this, _BLSPublicKey_key, "f");
@@ -4763,7 +4861,7 @@ zoo`.split('\n'));
             return res;
         }
         toString() {
-            return utils$1.b58Encode(__classPrivateFieldGet(this, _BLSPublicKey_key, "f"), utils$1.PrefixV2.BLS12_381PublicKey);
+            return utils.b58Encode(__classPrivateFieldGet(this, _BLSPublicKey_key, "f"), utils.PrefixV2.BLS12_381PublicKey);
         }
     }
     _BLSPublicKey_key = new WeakMap();
@@ -7222,17 +7320,17 @@ zoo`.split('\n'));
     class MLDSAKey {
         constructor(key, decrypt) {
             _MLDSAKey_key.set(this, void 0);
-            const [encoded, prefix] = utils$1.b58DecodeAndCheckPrefix(key, [
-                utils$1.PrefixV2.MLDSA44SecretKey,
-                utils$1.PrefixV2.MLDSA44EncryptedSecretKey,
+            const [encoded, prefix] = utils.b58DecodeAndCheckPrefix(key, [
+                utils.PrefixV2.MLDSA44SecretKey,
+                utils.PrefixV2.MLDSA44EncryptedSecretKey,
             ]);
             let data = encoded;
-            if (prefix === utils$1.PrefixV2.MLDSA44EncryptedSecretKey) {
+            if (prefix === utils.PrefixV2.MLDSA44EncryptedSecretKey) {
                 if (!decrypt)
                     throw new Error('decryption function is not provided');
                 data = decrypt(data);
             }
-            if (data.length !== utils$1.payloadLength[utils$1.PrefixV2.MLDSA44SecretKey]) {
+            if (data.length !== utils.payloadLength[utils.PrefixV2.MLDSA44SecretKey]) {
                 throw new core.InvalidKeyError('Invalid ML-DSA-44 secret key length');
             }
             __classPrivateFieldSet(this, _MLDSAKey_key, Uint8Array.from(data), "f");
@@ -7241,43 +7339,43 @@ zoo`.split('\n'));
             // Octez uses pure ML-DSA with an empty context over Blake2b-256(message),
             // not HashML-DSA. InMemorySigner has already prepended any watermark.
             const rawSignature = ml_dsa44.sign(blake2b(message, { dkLen: 32 }), __classPrivateFieldGet(this, _MLDSAKey_key, "f").subarray(0, SECRET_KEY_SIZE));
-            const encoded = utils$1.b58Encode(rawSignature, utils$1.PrefixV2.MLDSA44Signature);
+            const encoded = utils.b58Encode(rawSignature, utils.PrefixV2.MLDSA44Signature);
             return { rawSignature, sig: encoded, prefixSig: encoded };
         }
         publicKey() {
             return new MLDSAPublicKey(__classPrivateFieldGet(this, _MLDSAKey_key, "f").subarray(SECRET_KEY_SIZE));
         }
         secretKey() {
-            return utils$1.b58Encode(__classPrivateFieldGet(this, _MLDSAKey_key, "f"), utils$1.PrefixV2.MLDSA44SecretKey);
+            return utils.b58Encode(__classPrivateFieldGet(this, _MLDSAKey_key, "f"), utils.PrefixV2.MLDSA44SecretKey);
         }
     }
     _MLDSAKey_key = new WeakMap();
     class MLDSAPublicKey {
         constructor(src) {
             _MLDSAPublicKey_key.set(this, void 0);
-            const key = typeof src === 'string' ? utils$1.b58DecodeAndCheckPrefix(src, [utils$1.PrefixV2.MLDSA44PublicKey])[0] : src;
-            if (key.length !== utils$1.payloadLength[utils$1.PrefixV2.MLDSA44PublicKey]) {
-                throw new utils$1.InvalidPublicKeyError('Invalid ML-DSA-44 public key length');
+            const key = typeof src === 'string' ? utils.b58DecodeAndCheckPrefix(src, [utils.PrefixV2.MLDSA44PublicKey])[0] : src;
+            if (key.length !== utils.payloadLength[utils.PrefixV2.MLDSA44PublicKey]) {
+                throw new utils.InvalidPublicKeyError('Invalid ML-DSA-44 public key length');
             }
             __classPrivateFieldSet(this, _MLDSAPublicKey_key, Uint8Array.from(key), "f");
         }
         compare(other) {
             if (!(other instanceof MLDSAPublicKey)) {
-                throw new utils$1.InvalidPublicKeyError('ML-DSA-44 key expected');
+                throw new utils.InvalidPublicKeyError('ML-DSA-44 key expected');
             }
-            return utils$1.compareArrays(__classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"), __classPrivateFieldGet(other, _MLDSAPublicKey_key, "f"));
+            return utils.compareArrays(__classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"), __classPrivateFieldGet(other, _MLDSAPublicKey_key, "f"));
         }
         hash() {
-            return utils$1.b58Encode(blake2b(__classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"), { dkLen: 20 }), utils$1.PrefixV2.MLDSA44PublicKeyHash);
+            return utils.b58Encode(blake2b(__classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"), { dkLen: 20 }), utils.PrefixV2.MLDSA44PublicKeyHash);
         }
         bytes() {
             return __classPrivateFieldGet(this, _MLDSAPublicKey_key, "f").slice();
         }
         toProtocol() {
-            return utils$1.mergebuf(new Uint8Array([4]), __classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"));
+            return utils.mergebuf(new Uint8Array([4]), __classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"));
         }
         toString() {
-            return utils$1.b58Encode(__classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"), utils$1.PrefixV2.MLDSA44PublicKey);
+            return utils.b58Encode(__classPrivateFieldGet(this, _MLDSAPublicKey_key, "f"), utils.PrefixV2.MLDSA44PublicKey);
         }
     }
     _MLDSAPublicKey_key = new WeakMap();
@@ -7295,7 +7393,7 @@ zoo`.split('\n'));
                 throw new InvalidMnemonicError();
             }
             const seed = mnemonicToSeedSync(mnemonic, `${email}${password}`);
-            const key = utils$1.b58Encode(seed.subarray(0, 32), utils$1.PrefixV2.Ed25519Seed);
+            const key = utils.b58Encode(seed.subarray(0, 32), utils.PrefixV2.Ed25519Seed);
             return new InMemorySigner(key);
         }
         static async fromSecretKey(key, passphrase) {
@@ -7307,15 +7405,9 @@ zoo`.split('\n'));
          * @returns InMemorySigner
          * @throws InvalidMnemonicError
          */
-        static fromMnemonic({ mnemonic, password = '', derivationPath = "44'/1729'/0'/0'", curve = 'ed25519', }) {
-            // check if curve is defined if not default tz1
-            if (!validateMnemonic(mnemonic, wordlist)) {
-                // avoiding exposing mnemonic again in case of mistake making invalid
-                throw new InvalidMnemonicError();
-            }
-            const seed = mnemonicToSeedSync(mnemonic, password);
-            const sk = generateSecretKey(seed, derivationPath, curve);
-            return new InMemorySigner(sk);
+        static fromMnemonic(params) {
+            const { secretKey } = deriveMnemonicSecretKey(params);
+            return new InMemorySigner(secretKey);
         }
         /**
          *
@@ -7327,32 +7419,32 @@ zoo`.split('\n'));
         constructor(key, passphrase) {
             _InMemorySigner_key.set(this, void 0);
             const keyPrefixes = [
-                utils$1.PrefixV2.Ed25519EncryptedSeed,
-                utils$1.PrefixV2.Ed25519Seed,
-                utils$1.PrefixV2.Ed25519SecretKey,
-                utils$1.PrefixV2.Secp256k1EncryptedSecretKey,
-                utils$1.PrefixV2.Secp256k1SecretKey,
-                utils$1.PrefixV2.P256EncryptedSecretKey,
-                utils$1.PrefixV2.P256SecretKey,
-                utils$1.PrefixV2.BLS12_381EncryptedSecretKey,
-                utils$1.PrefixV2.BLS12_381SecretKey,
-                utils$1.PrefixV2.MLDSA44EncryptedSecretKey,
-                utils$1.PrefixV2.MLDSA44SecretKey,
+                utils.PrefixV2.Ed25519EncryptedSeed,
+                utils.PrefixV2.Ed25519Seed,
+                utils.PrefixV2.Ed25519SecretKey,
+                utils.PrefixV2.Secp256k1EncryptedSecretKey,
+                utils.PrefixV2.Secp256k1SecretKey,
+                utils.PrefixV2.P256EncryptedSecretKey,
+                utils.PrefixV2.P256SecretKey,
+                utils.PrefixV2.BLS12_381EncryptedSecretKey,
+                utils.PrefixV2.BLS12_381SecretKey,
+                utils.PrefixV2.MLDSA44EncryptedSecretKey,
+                utils.PrefixV2.MLDSA44SecretKey,
             ];
             const pre = (() => {
                 try {
-                    const [, pre] = utils$1.b58DecodeAndCheckPrefix(key, keyPrefixes);
+                    const [, pre] = utils.b58DecodeAndCheckPrefix(key, keyPrefixes);
                     return pre;
                 }
                 catch {
                     throw new core.InvalidKeyError(`Invalid private key, expecting one of the following prefixes '${keyPrefixes}'.`);
                 }
             })();
-            const encrypted = pre === utils$1.PrefixV2.Ed25519EncryptedSeed ||
-                pre === utils$1.PrefixV2.Secp256k1EncryptedSecretKey ||
-                pre === utils$1.PrefixV2.P256EncryptedSecretKey ||
-                pre === utils$1.PrefixV2.BLS12_381EncryptedSecretKey ||
-                pre === utils$1.PrefixV2.MLDSA44EncryptedSecretKey;
+            const encrypted = pre === utils.PrefixV2.Ed25519EncryptedSeed ||
+                pre === utils.PrefixV2.Secp256k1EncryptedSecretKey ||
+                pre === utils.PrefixV2.P256EncryptedSecretKey ||
+                pre === utils.PrefixV2.BLS12_381EncryptedSecretKey ||
+                pre === utils.PrefixV2.MLDSA44EncryptedSecretKey;
             let decrypt;
             if (encrypted) {
                 if (!passphrase) {
@@ -7376,23 +7468,23 @@ zoo`.split('\n'));
                 };
             }
             switch (pre) {
-                case utils$1.PrefixV2.Ed25519EncryptedSeed:
-                case utils$1.PrefixV2.Ed25519Seed:
-                case utils$1.PrefixV2.Ed25519SecretKey:
+                case utils.PrefixV2.Ed25519EncryptedSeed:
+                case utils.PrefixV2.Ed25519Seed:
+                case utils.PrefixV2.Ed25519SecretKey:
                     __classPrivateFieldSet(this, _InMemorySigner_key, new EdKey(key, decrypt), "f");
                     break;
-                case utils$1.PrefixV2.Secp256k1EncryptedSecretKey:
-                case utils$1.PrefixV2.Secp256k1SecretKey:
-                case utils$1.PrefixV2.P256EncryptedSecretKey:
-                case utils$1.PrefixV2.P256SecretKey:
+                case utils.PrefixV2.Secp256k1EncryptedSecretKey:
+                case utils.PrefixV2.Secp256k1SecretKey:
+                case utils.PrefixV2.P256EncryptedSecretKey:
+                case utils.PrefixV2.P256SecretKey:
                     __classPrivateFieldSet(this, _InMemorySigner_key, new ECKey(key, decrypt), "f");
                     break;
-                case utils$1.PrefixV2.BLS12_381EncryptedSecretKey:
-                case utils$1.PrefixV2.BLS12_381SecretKey:
+                case utils.PrefixV2.BLS12_381EncryptedSecretKey:
+                case utils.PrefixV2.BLS12_381SecretKey:
                     __classPrivateFieldSet(this, _InMemorySigner_key, new BLSKey(key, decrypt), "f");
                     break;
-                case utils$1.PrefixV2.MLDSA44EncryptedSecretKey:
-                case utils$1.PrefixV2.MLDSA44SecretKey:
+                case utils.PrefixV2.MLDSA44EncryptedSecretKey:
+                case utils.PrefixV2.MLDSA44SecretKey:
                     __classPrivateFieldSet(this, _InMemorySigner_key, new MLDSAKey(key, decrypt), "f");
                     break;
             }
@@ -7403,25 +7495,25 @@ zoo`.split('\n'));
          * @param watermark Watermark to append to the bytes
          */
         async sign(message, watermark) {
-            const msg = typeof message == 'string' ? utils$1.hex2buf(message) : message;
-            const watermarkMsg = watermark !== undefined ? utils$1.mergebuf(watermark, msg) : msg;
+            const msg = typeof message == 'string' ? utils.hex2buf(message) : message;
+            const watermarkMsg = watermark !== undefined ? utils.mergebuf(watermark, msg) : msg;
             const { rawSignature, sig: signature, prefixSig: prefixedSignature, } = await __classPrivateFieldGet(this, _InMemorySigner_key, "f").sign(watermarkMsg);
             // Variable-length operation signatures carry the signature-prefix marker
             // and scheme tag before the complete signature payload (Octez signature_v3).
             const signatureTag = __classPrivateFieldGet(this, _InMemorySigner_key, "f") instanceof MLDSAKey ? 4 : __classPrivateFieldGet(this, _InMemorySigner_key, "f") instanceof BLSKey ? 3 : undefined;
             const signatureBytes = signatureTag === undefined
                 ? rawSignature
-                : utils$1.mergebuf(new Uint8Array([255, signatureTag]), rawSignature);
+                : utils.mergebuf(new Uint8Array([255, signatureTag]), rawSignature);
             return {
-                bytes: utils$1.buf2hex(msg),
+                bytes: utils.buf2hex(msg),
                 sig: signature,
                 prefixSig: prefixedSignature,
-                sbytes: utils$1.buf2hex(utils$1.mergebuf(msg, signatureBytes)),
+                sbytes: utils.buf2hex(utils.mergebuf(msg, signatureBytes)),
             };
         }
-        async provePossession() {
+        async provePossession(overridePublicKey) {
             if (isPOP(__classPrivateFieldGet(this, _InMemorySigner_key, "f"))) {
-                return __classPrivateFieldGet(this, _InMemorySigner_key, "f").provePossession();
+                return __classPrivateFieldGet(this, _InMemorySigner_key, "f").provePossession(overridePublicKey);
             }
             else {
                 throw new core.ProhibitedActionError('Only BLS keys can prove possession');
@@ -7451,41 +7543,46 @@ zoo`.split('\n'));
     }
     _InMemorySigner_key = new WeakMap();
     function publicKeyFromString(src) {
-        const [keyData, pre] = utils$1.b58DecodeAndCheckPrefix(src, [
-            utils$1.PrefixV2.Ed25519PublicKey,
-            utils$1.PrefixV2.Secp256k1PublicKey,
-            utils$1.PrefixV2.P256PublicKey,
-            utils$1.PrefixV2.BLS12_381PublicKey,
-            utils$1.PrefixV2.MLDSA44PublicKey,
+        const [keyData, pre] = utils.b58DecodeAndCheckPrefix(src, [
+            utils.PrefixV2.Ed25519PublicKey,
+            utils.PrefixV2.Secp256k1PublicKey,
+            utils.PrefixV2.P256PublicKey,
+            utils.PrefixV2.BLS12_381PublicKey,
+            utils.PrefixV2.MLDSA44PublicKey,
         ]);
         switch (pre) {
-            case utils$1.PrefixV2.Ed25519PublicKey:
+            case utils.PrefixV2.Ed25519PublicKey:
                 return new EdPublicKey(keyData);
-            case utils$1.PrefixV2.Secp256k1PublicKey:
+            case utils.PrefixV2.Secp256k1PublicKey:
                 return new ECPublicKey(keyData, 'secp256k1');
-            case utils$1.PrefixV2.P256PublicKey:
+            case utils.PrefixV2.P256PublicKey:
                 return new ECPublicKey(keyData, 'p256');
-            case utils$1.PrefixV2.BLS12_381PublicKey:
+            case utils.PrefixV2.BLS12_381PublicKey:
                 return new BLSPublicKey(keyData);
-            case utils$1.PrefixV2.MLDSA44PublicKey:
+            case utils.PrefixV2.MLDSA44PublicKey:
                 return new MLDSAPublicKey(keyData);
         }
     }
 
     // IMPORTANT: THIS FILE IS AUTO GENERATED! DO NOT MANUALLY EDIT!
     const VERSION = {
-        "commitHash": "30ba471ba3c43637ad39edd6e9027fab80bfb884",
-        "version": "25.1.0"
+        "commitHash": "78ca0b9cb430f230c3230cd28b7e89a310e84c15",
+        "version": "25.2.0-beta0"
     };
 
     exports.ECDSA = ecdsa;
     exports.Ed25519 = ed25519;
     exports.Hard = Hard;
     exports.InMemorySigner = InMemorySigner;
+    exports.InvalidMnemonicError = InvalidMnemonicError;
     exports.InvalidPassphraseError = InvalidPassphraseError;
     exports.Path = Path;
     exports.VERSION = VERSION;
+    exports.deriveKeyFromMnemonic = deriveKeyFromMnemonic;
+    exports.entropyToMnemonic = entropyToMnemonic;
+    exports.generateMnemonic = generateMnemonic;
     exports.generateSecretKey = generateSecretKey;
+    exports.mnemonicToEntropy = mnemonicToEntropy;
     exports.publicKeyFromString = publicKeyFromString;
 
 }));