@xchainjs/xchain-radix 2.0.7 → 2.0.9

package/lib/index.esm.js

@@ -2,8 +2,9 @@ import { NetworkId, generateRandomNonce, RadixEngineToolkit, Convert, ManifestBu
 import { Network, BaseXChainClient, singleFee, FeeType, TxType } from '@xchainjs/xchain-client';
 import { getSeed } from '@xchainjs/xchain-crypto';
 import { AssetType, assetToBase, assetAmount, eqAsset, baseAmount } from '@xchainjs/xchain-util';
-import { createBase58check, bech32m } from '@scure/base';
-import { derivePath } from 'ed25519-hd-key';
+import { bech32m } from '@scure/base';
+import { HDKey } from '@scure/bip32';
+import slip10 from 'micro-key-producer/slip10.js';
 import { GatewayApiClient } from '@radixdlt/babylon-gateway-api-sdk';
 
 /******************************************************************************
@@ -38,3369 +39,6 @@ typeof SuppressedError === "function" ? SuppressedError : function (error, suppr
     return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
 };
 
-const crypto = typeof globalThis === 'object' && 'crypto' in globalThis ? globalThis.crypto : undefined;
-
-/**
- * Utilities for hex, bytes, CSPRNG.
- * @module
- */
-/*! noble-hashes - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-// We use WebCrypto aka globalThis.crypto, which exists in browsers and node.js 16+.
-// node.js versions earlier than v19 don't declare it in global scope.
-// For node.js, package.json#exports field mapping rewrites import
-// from `crypto` to `cryptoNode`, which imports native module.
-// Makes the utils un-importable in browsers without a bundler.
-// Once node.js 18 is deprecated (2025-04-30), we can just drop the import.
-/** Checks if something is Uint8Array. Be careful: nodejs Buffer will return true. */
-function isBytes(a) {
-    return a instanceof Uint8Array || (ArrayBuffer.isView(a) && a.constructor.name === 'Uint8Array');
-}
-/** Asserts something is positive integer. */
-function anumber(n) {
-    if (!Number.isSafeInteger(n) || n < 0)
-        throw new Error('positive integer expected, got ' + n);
-}
-/** Asserts something is Uint8Array. */
-function abytes(b, ...lengths) {
-    if (!isBytes(b))
-        throw new Error('Uint8Array expected');
-    if (lengths.length > 0 && !lengths.includes(b.length))
-        throw new Error('Uint8Array expected of length ' + lengths + ', got length=' + b.length);
-}
-/** Asserts something is hash */
-function ahash(h) {
-    if (typeof h !== 'function' || typeof h.create !== 'function')
-        throw new Error('Hash should be wrapped by utils.createHasher');
-    anumber(h.outputLen);
-    anumber(h.blockLen);
-}
-/** Asserts a hash instance has not been destroyed / finished */
-function aexists(instance, checkFinished = true) {
-    if (instance.destroyed)
-        throw new Error('Hash instance has been destroyed');
-    if (checkFinished && instance.finished)
-        throw new Error('Hash#digest() has already been called');
-}
-/** Asserts output is properly-sized byte array */
-function aoutput(out, instance) {
-    abytes(out);
-    const min = instance.outputLen;
-    if (out.length < min) {
-        throw new Error('digestInto() expects output buffer of length at least ' + min);
-    }
-}
-/** Zeroize a byte array. Warning: JS provides no guarantees. */
-function clean(...arrays) {
-    for (let i = 0; i < arrays.length; i++) {
-        arrays[i].fill(0);
-    }
-}
-/** Create DataView of an array for easy byte-level manipulation. */
-function createView(arr) {
-    return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
-}
-/** The rotate right (circular right shift) operation for uint32 */
-function rotr(word, shift) {
-    return (word << (32 - shift)) | (word >>> shift);
-}
-/** The rotate left (circular left shift) operation for uint32 */
-function rotl(word, shift) {
-    return (word << shift) | ((word >>> (32 - shift)) >>> 0);
-}
-// Built-in hex conversion https://caniuse.com/mdn-javascript_builtins_uint8array_fromhex
-const hasHexBuiltin = /* @__PURE__ */ (() => 
-// @ts-ignore
-typeof Uint8Array.from([]).toHex === 'function' && typeof Uint8Array.fromHex === 'function')();
-// Array where index 0xf0 (240) is mapped to string 'f0'
-const hexes = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));
-/**
- * Convert byte array to hex string. Uses built-in function, when available.
- * @example bytesToHex(Uint8Array.from([0xca, 0xfe, 0x01, 0x23])) // 'cafe0123'
- */
-function bytesToHex(bytes) {
-    abytes(bytes);
-    // @ts-ignore
-    if (hasHexBuiltin)
-        return bytes.toHex();
-    // pre-caching improves the speed 6x
-    let hex = '';
-    for (let i = 0; i < bytes.length; i++) {
-        hex += hexes[bytes[i]];
-    }
-    return hex;
-}
-// We use optimized technique to convert hex string to byte array
-const asciis = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
-function asciiToBase16(ch) {
-    if (ch >= asciis._0 && ch <= asciis._9)
-        return ch - asciis._0; // '2' => 50-48
-    if (ch >= asciis.A && ch <= asciis.F)
-        return ch - (asciis.A - 10); // 'B' => 66-(65-10)
-    if (ch >= asciis.a && ch <= asciis.f)
-        return ch - (asciis.a - 10); // 'b' => 98-(97-10)
-    return;
-}
-/**
- * Convert hex string to byte array. Uses built-in function, when available.
- * @example hexToBytes('cafe0123') // Uint8Array.from([0xca, 0xfe, 0x01, 0x23])
- */
-function hexToBytes(hex) {
-    if (typeof hex !== 'string')
-        throw new Error('hex string expected, got ' + typeof hex);
-    // @ts-ignore
-    if (hasHexBuiltin)
-        return Uint8Array.fromHex(hex);
-    const hl = hex.length;
-    const al = hl / 2;
-    if (hl % 2)
-        throw new Error('hex string expected, got unpadded hex of length ' + hl);
-    const array = new Uint8Array(al);
-    for (let ai = 0, hi = 0; ai < al; ai++, hi += 2) {
-        const n1 = asciiToBase16(hex.charCodeAt(hi));
-        const n2 = asciiToBase16(hex.charCodeAt(hi + 1));
-        if (n1 === undefined || n2 === undefined) {
-            const char = hex[hi] + hex[hi + 1];
-            throw new Error('hex string expected, got non-hex character "' + char + '" at index ' + hi);
-        }
-        array[ai] = n1 * 16 + n2; // multiply first octet, e.g. 'a3' => 10*16+3 => 160 + 3 => 163
-    }
-    return array;
-}
-/**
- * Converts string to bytes using UTF8 encoding.
- * @example utf8ToBytes('abc') // Uint8Array.from([97, 98, 99])
- */
-function utf8ToBytes(str) {
-    if (typeof str !== 'string')
-        throw new Error('string expected');
-    return new Uint8Array(new TextEncoder().encode(str)); // https://bugzil.la/1681809
-}
-/**
- * Normalizes (non-hex) string or Uint8Array to Uint8Array.
- * Warning: when Uint8Array is passed, it would NOT get copied.
- * Keep in mind for future mutable operations.
- */
-function toBytes(data) {
-    if (typeof data === 'string')
-        data = utf8ToBytes(data);
-    abytes(data);
-    return data;
-}
-/** Copies several Uint8Arrays into one. */
-function concatBytes(...arrays) {
-    let sum = 0;
-    for (let i = 0; i < arrays.length; i++) {
-        const a = arrays[i];
-        abytes(a);
-        sum += a.length;
-    }
-    const res = new Uint8Array(sum);
-    for (let i = 0, pad = 0; i < arrays.length; i++) {
-        const a = arrays[i];
-        res.set(a, pad);
-        pad += a.length;
-    }
-    return res;
-}
-/** For runtime check if class implements interface */
-class Hash {
-}
-/** Wraps hash function, creating an interface on top of it */
-function createHasher(hashCons) {
-    const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
-    const tmp = hashCons();
-    hashC.outputLen = tmp.outputLen;
-    hashC.blockLen = tmp.blockLen;
-    hashC.create = () => hashCons();
-    return hashC;
-}
-/** Cryptographically secure PRNG. Uses internal OS-level `crypto.getRandomValues`. */
-function randomBytes(bytesLength = 32) {
-    if (crypto && typeof crypto.getRandomValues === 'function') {
-        return crypto.getRandomValues(new Uint8Array(bytesLength));
-    }
-    // Legacy Node.js compatibility
-    if (crypto && typeof crypto.randomBytes === 'function') {
-        return Uint8Array.from(crypto.randomBytes(bytesLength));
-    }
-    throw new Error('crypto.getRandomValues must be defined');
-}
-
-/**
- * Hex, bytes and number utilities.
- * @module
- */
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-const _0n$3 = /* @__PURE__ */ BigInt(0);
-const _1n$4 = /* @__PURE__ */ BigInt(1);
-function abool(title, value) {
-    if (typeof value !== 'boolean')
-        throw new Error(title + ' boolean expected, got ' + value);
-}
-// Used in weierstrass, der
-function numberToHexUnpadded(num) {
-    const hex = num.toString(16);
-    return hex.length & 1 ? '0' + hex : hex;
-}
-function hexToNumber(hex) {
-    if (typeof hex !== 'string')
-        throw new Error('hex string expected, got ' + typeof hex);
-    return hex === '' ? _0n$3 : BigInt('0x' + hex); // Big Endian
-}
-// BE: Big Endian, LE: Little Endian
-function bytesToNumberBE(bytes) {
-    return hexToNumber(bytesToHex(bytes));
-}
-function bytesToNumberLE(bytes) {
-    abytes(bytes);
-    return hexToNumber(bytesToHex(Uint8Array.from(bytes).reverse()));
-}
-function numberToBytesBE(n, len) {
-    return hexToBytes(n.toString(16).padStart(len * 2, '0'));
-}
-function numberToBytesLE(n, len) {
-    return numberToBytesBE(n, len).reverse();
-}
-/**
- * Takes hex string or Uint8Array, converts to Uint8Array.
- * Validates output length.
- * Will throw error for other types.
- * @param title descriptive title for an error e.g. 'private key'
- * @param hex hex string or Uint8Array
- * @param expectedLength optional, will compare to result array's length
- * @returns
- */
-function ensureBytes(title, hex, expectedLength) {
-    let res;
-    if (typeof hex === 'string') {
-        try {
-            res = hexToBytes(hex);
-        }
-        catch (e) {
-            throw new Error(title + ' must be hex string or Uint8Array, cause: ' + e);
-        }
-    }
-    else if (isBytes(hex)) {
-        // Uint8Array.from() instead of hash.slice() because node.js Buffer
-        // is instance of Uint8Array, and its slice() creates **mutable** copy
-        res = Uint8Array.from(hex);
-    }
-    else {
-        throw new Error(title + ' must be hex string or Uint8Array');
-    }
-    const len = res.length;
-    if (typeof expectedLength === 'number' && len !== expectedLength)
-        throw new Error(title + ' of length ' + expectedLength + ' expected, got ' + len);
-    return res;
-}
-/**
- * @example utf8ToBytes('abc') // new Uint8Array([97, 98, 99])
- */
-// export const utf8ToBytes: typeof utf8ToBytes_ = utf8ToBytes_;
-/**
- * Converts bytes to string using UTF8 encoding.
- * @example bytesToUtf8(Uint8Array.from([97, 98, 99])) // 'abc'
- */
-// export const bytesToUtf8: typeof bytesToUtf8_ = bytesToUtf8_;
-// Is positive bigint
-const isPosBig = (n) => typeof n === 'bigint' && _0n$3 <= n;
-function inRange(n, min, max) {
-    return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;
-}
-/**
- * Asserts min <= n < max. NOTE: It's < max and not <= max.
- * @example
- * aInRange('x', x, 1n, 256n); // would assume x is in (1n..255n)
- */
-function aInRange(title, n, min, max) {
-    // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?
-    // consider P=256n, min=0n, max=P
-    // - a for min=0 would require -1:          `inRange('x', x, -1n, P)`
-    // - b would commonly require subtraction:  `inRange('x', x, 0n, P - 1n)`
-    // - our way is the cleanest:               `inRange('x', x, 0n, P)
-    if (!inRange(n, min, max))
-        throw new Error('expected valid ' + title + ': ' + min + ' <= n < ' + max + ', got ' + n);
-}
-// Bit operations
-/**
- * Calculates amount of bits in a bigint.
- * Same as `n.toString(2).length`
- * TODO: merge with nLength in modular
- */
-function bitLen(n) {
-    let len;
-    for (len = 0; n > _0n$3; n >>= _1n$4, len += 1)
-        ;
-    return len;
-}
-/**
- * Calculate mask for N bits. Not using ** operator with bigints because of old engines.
- * Same as BigInt(`0b${Array(i).fill('1').join('')}`)
- */
-const bitMask = (n) => (_1n$4 << BigInt(n)) - _1n$4;
-/**
- * Minimal HMAC-DRBG from NIST 800-90 for RFC6979 sigs.
- * @returns function that will call DRBG until 2nd arg returns something meaningful
- * @example
- *   const drbg = createHmacDRBG<Key>(32, 32, hmac);
- *   drbg(seed, bytesToKey); // bytesToKey must return Key or undefined
- */
-function createHmacDrbg(hashLen, qByteLen, hmacFn) {
-    if (typeof hashLen !== 'number' || hashLen < 2)
-        throw new Error('hashLen must be a number');
-    if (typeof qByteLen !== 'number' || qByteLen < 2)
-        throw new Error('qByteLen must be a number');
-    if (typeof hmacFn !== 'function')
-        throw new Error('hmacFn must be a function');
-    // Step B, Step C: set hashLen to 8*ceil(hlen/8)
-    const u8n = (len) => new Uint8Array(len); // creates Uint8Array
-    const u8of = (byte) => Uint8Array.of(byte); // another shortcut
-    let v = u8n(hashLen); // Minimal non-full-spec HMAC-DRBG from NIST 800-90 for RFC6979 sigs.
-    let k = u8n(hashLen); // Steps B and C of RFC6979 3.2: set hashLen, in our case always same
-    let i = 0; // Iterations counter, will throw when over 1000
-    const reset = () => {
-        v.fill(1);
-        k.fill(0);
-        i = 0;
-    };
-    const h = (...b) => hmacFn(k, v, ...b); // hmac(k)(v, ...values)
-    const reseed = (seed = u8n(0)) => {
-        // HMAC-DRBG reseed() function. Steps D-G
-        k = h(u8of(0x00), seed); // k = hmac(k || v || 0x00 || seed)
-        v = h(); // v = hmac(k || v)
-        if (seed.length === 0)
-            return;
-        k = h(u8of(0x01), seed); // k = hmac(k || v || 0x01 || seed)
-        v = h(); // v = hmac(k || v)
-    };
-    const gen = () => {
-        // HMAC-DRBG generate() function
-        if (i++ >= 1000)
-            throw new Error('drbg: tried 1000 values');
-        let len = 0;
-        const out = [];
-        while (len < qByteLen) {
-            v = h();
-            const sl = v.slice();
-            out.push(sl);
-            len += v.length;
-        }
-        return concatBytes(...out);
-    };
-    const genUntil = (seed, pred) => {
-        reset();
-        reseed(seed); // Steps D-G
-        let res = undefined; // Step H: grind until k is in [1..n-1]
-        while (!(res = pred(gen())))
-            reseed();
-        reset();
-        return res;
-    };
-    return genUntil;
-}
-function _validateObject(object, fields, optFields = {}) {
-    if (!object || typeof object !== 'object')
-        throw new Error('expected valid options object');
-    function checkField(fieldName, expectedType, isOpt) {
-        const val = object[fieldName];
-        if (isOpt && val === undefined)
-            return;
-        const current = typeof val;
-        if (current !== expectedType || val === null)
-            throw new Error(`param "${fieldName}" is invalid: expected ${expectedType}, got ${current}`);
-    }
-    Object.entries(fields).forEach(([k, v]) => checkField(k, v, false));
-    Object.entries(optFields).forEach(([k, v]) => checkField(k, v, true));
-}
-/**
- * Memoizes (caches) computation result.
- * Uses WeakMap: the value is going auto-cleaned by GC after last reference is removed.
- */
-function memoized(fn) {
-    const map = new WeakMap();
-    return (arg, ...args) => {
-        const val = map.get(arg);
-        if (val !== undefined)
-            return val;
-        const computed = fn(arg, ...args);
-        map.set(arg, computed);
-        return computed;
-    };
-}
-
-/**
- * Utils for modular division and fields.
- * Field over 11 is a finite (Galois) field is integer number operations `mod 11`.
- * There is no division: it is replaced by modular multiplicative inverse.
- * @module
- */
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-// prettier-ignore
-const _0n$2 = BigInt(0), _1n$3 = BigInt(1), _2n$2 = /* @__PURE__ */ BigInt(2), _3n$1 = /* @__PURE__ */ BigInt(3);
-// prettier-ignore
-const _4n$1 = /* @__PURE__ */ BigInt(4), _5n = /* @__PURE__ */ BigInt(5);
-const _8n = /* @__PURE__ */ BigInt(8);
-// Calculates a modulo b
-function mod(a, b) {
-    const result = a % b;
-    return result >= _0n$2 ? result : b + result;
-}
-/** Does `x^(2^power)` mod p. `pow2(30, 4)` == `30^(2^4)` */
-function pow2(x, power, modulo) {
-    let res = x;
-    while (power-- > _0n$2) {
-        res *= res;
-        res %= modulo;
-    }
-    return res;
-}
-/**
- * Inverses number over modulo.
- * Implemented using [Euclidean GCD](https://brilliant.org/wiki/extended-euclidean-algorithm/).
- */
-function invert(number, modulo) {
-    if (number === _0n$2)
-        throw new Error('invert: expected non-zero number');
-    if (modulo <= _0n$2)
-        throw new Error('invert: expected positive modulus, got ' + modulo);
-    // Fermat's little theorem "CT-like" version inv(n) = n^(m-2) mod m is 30x slower.
-    let a = mod(number, modulo);
-    let b = modulo;
-    // prettier-ignore
-    let x = _0n$2, u = _1n$3;
-    while (a !== _0n$2) {
-        // JIT applies optimization if those two lines follow each other
-        const q = b / a;
-        const r = b % a;
-        const m = x - u * q;
-        // prettier-ignore
-        b = a, a = r, x = u, u = m;
-    }
-    const gcd = b;
-    if (gcd !== _1n$3)
-        throw new Error('invert: does not exist');
-    return mod(x, modulo);
-}
-// Not all roots are possible! Example which will throw:
-// const NUM =
-// n = 72057594037927816n;
-// Fp = Field(BigInt('0x1a0111ea397fe69a4b1ba7b6434bacd764774b84f38512bf6730d2a0f6b0f6241eabfffeb153ffffb9feffffffffaaab'));
-function sqrt3mod4(Fp, n) {
-    const p1div4 = (Fp.ORDER + _1n$3) / _4n$1;
-    const root = Fp.pow(n, p1div4);
-    // Throw if root^2 != n
-    if (!Fp.eql(Fp.sqr(root), n))
-        throw new Error('Cannot find square root');
-    return root;
-}
-function sqrt5mod8(Fp, n) {
-    const p5div8 = (Fp.ORDER - _5n) / _8n;
-    const n2 = Fp.mul(n, _2n$2);
-    const v = Fp.pow(n2, p5div8);
-    const nv = Fp.mul(n, v);
-    const i = Fp.mul(Fp.mul(nv, _2n$2), v);
-    const root = Fp.mul(nv, Fp.sub(i, Fp.ONE));
-    if (!Fp.eql(Fp.sqr(root), n))
-        throw new Error('Cannot find square root');
-    return root;
-}
-// TODO: Commented-out for now. Provide test vectors.
-// Tonelli is too slow for extension fields Fp2.
-// That means we can't use sqrt (c1, c2...) even for initialization constants.
-// if (P % _16n === _9n) return sqrt9mod16;
-// // prettier-ignore
-// function sqrt9mod16<T>(Fp: IField<T>, n: T, p7div16?: bigint) {
-//   if (p7div16 === undefined) p7div16 = (Fp.ORDER + BigInt(7)) / _16n;
-//   const c1 = Fp.sqrt(Fp.neg(Fp.ONE)); //  1. c1 = sqrt(-1) in F, i.e., (c1^2) == -1 in F
-//   const c2 = Fp.sqrt(c1);             //  2. c2 = sqrt(c1) in F, i.e., (c2^2) == c1 in F
-//   const c3 = Fp.sqrt(Fp.neg(c1));     //  3. c3 = sqrt(-c1) in F, i.e., (c3^2) == -c1 in F
-//   const c4 = p7div16;                 //  4. c4 = (q + 7) / 16        # Integer arithmetic
-//   let tv1 = Fp.pow(n, c4);            //  1. tv1 = x^c4
-//   let tv2 = Fp.mul(c1, tv1);          //  2. tv2 = c1 * tv1
-//   const tv3 = Fp.mul(c2, tv1);        //  3. tv3 = c2 * tv1
-//   let tv4 = Fp.mul(c3, tv1);          //  4. tv4 = c3 * tv1
-//   const e1 = Fp.eql(Fp.sqr(tv2), n);  //  5.  e1 = (tv2^2) == x
-//   const e2 = Fp.eql(Fp.sqr(tv3), n);  //  6.  e2 = (tv3^2) == x
-//   tv1 = Fp.cmov(tv1, tv2, e1); //  7. tv1 = CMOV(tv1, tv2, e1)  # Select tv2 if (tv2^2) == x
-//   tv2 = Fp.cmov(tv4, tv3, e2); //  8. tv2 = CMOV(tv4, tv3, e2)  # Select tv3 if (tv3^2) == x
-//   const e3 = Fp.eql(Fp.sqr(tv2), n);  //  9.  e3 = (tv2^2) == x
-//   return Fp.cmov(tv1, tv2, e3); // 10.  z = CMOV(tv1, tv2, e3) # Select the sqrt from tv1 and tv2
-// }
-/**
- * Tonelli-Shanks square root search algorithm.
- * 1. https://eprint.iacr.org/2012/685.pdf (page 12)
- * 2. Square Roots from 1; 24, 51, 10 to Dan Shanks
- * @param P field order
- * @returns function that takes field Fp (created from P) and number n
- */
-function tonelliShanks(P) {
-    // Initialization (precomputation).
-    // Caching initialization could boost perf by 7%.
-    if (P < BigInt(3))
-        throw new Error('sqrt is not defined for small field');
-    // Factor P - 1 = Q * 2^S, where Q is odd
-    let Q = P - _1n$3;
-    let S = 0;
-    while (Q % _2n$2 === _0n$2) {
-        Q /= _2n$2;
-        S++;
-    }
-    // Find the first quadratic non-residue Z >= 2
-    let Z = _2n$2;
-    const _Fp = Field(P);
-    while (FpLegendre(_Fp, Z) === 1) {
-        // Basic primality test for P. After x iterations, chance of
-        // not finding quadratic non-residue is 2^x, so 2^1000.
-        if (Z++ > 1000)
-            throw new Error('Cannot find square root: probably non-prime P');
-    }
-    // Fast-path; usually done before Z, but we do "primality test".
-    if (S === 1)
-        return sqrt3mod4;
-    // Slow-path
-    // TODO: test on Fp2 and others
-    let cc = _Fp.pow(Z, Q); // c = z^Q
-    const Q1div2 = (Q + _1n$3) / _2n$2;
-    return function tonelliSlow(Fp, n) {
-        if (Fp.is0(n))
-            return n;
-        // Check if n is a quadratic residue using Legendre symbol
-        if (FpLegendre(Fp, n) !== 1)
-            throw new Error('Cannot find square root');
-        // Initialize variables for the main loop
-        let M = S;
-        let c = Fp.mul(Fp.ONE, cc); // c = z^Q, move cc from field _Fp into field Fp
-        let t = Fp.pow(n, Q); // t = n^Q, first guess at the fudge factor
-        let R = Fp.pow(n, Q1div2); // R = n^((Q+1)/2), first guess at the square root
-        // Main loop
-        // while t != 1
-        while (!Fp.eql(t, Fp.ONE)) {
-            if (Fp.is0(t))
-                return Fp.ZERO; // if t=0 return R=0
-            let i = 1;
-            // Find the smallest i >= 1 such that t^(2^i) ≡ 1 (mod P)
-            let t_tmp = Fp.sqr(t); // t^(2^1)
-            while (!Fp.eql(t_tmp, Fp.ONE)) {
-                i++;
-                t_tmp = Fp.sqr(t_tmp); // t^(2^2)...
-                if (i === M)
-                    throw new Error('Cannot find square root');
-            }
-            // Calculate the exponent for b: 2^(M - i - 1)
-            const exponent = _1n$3 << BigInt(M - i - 1); // bigint is important
-            const b = Fp.pow(c, exponent); // b = 2^(M - i - 1)
-            // Update variables
-            M = i;
-            c = Fp.sqr(b); // c = b^2
-            t = Fp.mul(t, c); // t = (t * b^2)
-            R = Fp.mul(R, b); // R = R*b
-        }
-        return R;
-    };
-}
-/**
- * Square root for a finite field. Will try optimized versions first:
- *
- * 1. P ≡ 3 (mod 4)
- * 2. P ≡ 5 (mod 8)
- * 3. Tonelli-Shanks algorithm
- *
- * Different algorithms can give different roots, it is up to user to decide which one they want.
- * For example there is FpSqrtOdd/FpSqrtEven to choice root based on oddness (used for hash-to-curve).
- */
-function FpSqrt(P) {
-    // P ≡ 3 (mod 4) => √n = n^((P+1)/4)
-    if (P % _4n$1 === _3n$1)
-        return sqrt3mod4;
-    // P ≡ 5 (mod 8) => Atkin algorithm, page 10 of https://eprint.iacr.org/2012/685.pdf
-    if (P % _8n === _5n)
-        return sqrt5mod8;
-    // P ≡ 9 (mod 16) not implemented, see above
-    // Tonelli-Shanks algorithm
-    return tonelliShanks(P);
-}
-// prettier-ignore
-const FIELD_FIELDS = [
-    'create', 'isValid', 'is0', 'neg', 'inv', 'sqrt', 'sqr',
-    'eql', 'add', 'sub', 'mul', 'pow', 'div',
-    'addN', 'subN', 'mulN', 'sqrN'
-];
-function validateField(field) {
-    const initial = {
-        ORDER: 'bigint',
-        MASK: 'bigint',
-        BYTES: 'number',
-        BITS: 'number',
-    };
-    const opts = FIELD_FIELDS.reduce((map, val) => {
-        map[val] = 'function';
-        return map;
-    }, initial);
-    _validateObject(field, opts);
-    // const max = 16384;
-    // if (field.BYTES < 1 || field.BYTES > max) throw new Error('invalid field');
-    // if (field.BITS < 1 || field.BITS > 8 * max) throw new Error('invalid field');
-    return field;
-}
-// Generic field functions
-/**
- * Same as `pow` but for Fp: non-constant-time.
- * Unsafe in some contexts: uses ladder, so can expose bigint bits.
- */
-function FpPow(Fp, num, power) {
-    if (power < _0n$2)
-        throw new Error('invalid exponent, negatives unsupported');
-    if (power === _0n$2)
-        return Fp.ONE;
-    if (power === _1n$3)
-        return num;
-    let p = Fp.ONE;
-    let d = num;
-    while (power > _0n$2) {
-        if (power & _1n$3)
-            p = Fp.mul(p, d);
-        d = Fp.sqr(d);
-        power >>= _1n$3;
-    }
-    return p;
-}
-/**
- * Efficiently invert an array of Field elements.
- * Exception-free. Will return `undefined` for 0 elements.
- * @param passZero map 0 to 0 (instead of undefined)
- */
-function FpInvertBatch(Fp, nums, passZero = false) {
-    const inverted = new Array(nums.length).fill(passZero ? Fp.ZERO : undefined);
-    // Walk from first to last, multiply them by each other MOD p
-    const multipliedAcc = nums.reduce((acc, num, i) => {
-        if (Fp.is0(num))
-            return acc;
-        inverted[i] = acc;
-        return Fp.mul(acc, num);
-    }, Fp.ONE);
-    // Invert last element
-    const invertedAcc = Fp.inv(multipliedAcc);
-    // Walk from last to first, multiply them by inverted each other MOD p
-    nums.reduceRight((acc, num, i) => {
-        if (Fp.is0(num))
-            return acc;
-        inverted[i] = Fp.mul(acc, inverted[i]);
-        return Fp.mul(acc, num);
-    }, invertedAcc);
-    return inverted;
-}
-/**
- * Legendre symbol.
- * Legendre constant is used to calculate Legendre symbol (a | p)
- * which denotes the value of a^((p-1)/2) (mod p).
- *
- * * (a | p) ≡ 1    if a is a square (mod p), quadratic residue
- * * (a | p) ≡ -1   if a is not a square (mod p), quadratic non residue
- * * (a | p) ≡ 0    if a ≡ 0 (mod p)
- */
-function FpLegendre(Fp, n) {
-    // We can use 3rd argument as optional cache of this value
-    // but seems unneeded for now. The operation is very fast.
-    const p1mod2 = (Fp.ORDER - _1n$3) / _2n$2;
-    const powered = Fp.pow(n, p1mod2);
-    const yes = Fp.eql(powered, Fp.ONE);
-    const zero = Fp.eql(powered, Fp.ZERO);
-    const no = Fp.eql(powered, Fp.neg(Fp.ONE));
-    if (!yes && !zero && !no)
-        throw new Error('invalid Legendre symbol result');
-    return yes ? 1 : zero ? 0 : -1;
-}
-// CURVE.n lengths
-function nLength(n, nBitLength) {
-    // Bit size, byte size of CURVE.n
-    if (nBitLength !== undefined)
-        anumber(nBitLength);
-    const _nBitLength = nBitLength !== undefined ? nBitLength : n.toString(2).length;
-    const nByteLength = Math.ceil(_nBitLength / 8);
-    return { nBitLength: _nBitLength, nByteLength };
-}
-/**
- * Creates a finite field. Major performance optimizations:
- * * 1. Denormalized operations like mulN instead of mul.
- * * 2. Identical object shape: never add or remove keys.
- * * 3. `Object.freeze`.
- * Fragile: always run a benchmark on a change.
- * Security note: operations don't check 'isValid' for all elements for performance reasons,
- * it is caller responsibility to check this.
- * This is low-level code, please make sure you know what you're doing.
- *
- * Note about field properties:
- * * CHARACTERISTIC p = prime number, number of elements in main subgroup.
- * * ORDER q = similar to cofactor in curves, may be composite `q = p^m`.
- *
- * @param ORDER field order, probably prime, or could be composite
- * @param bitLen how many bits the field consumes
- * @param isLE (default: false) if encoding / decoding should be in little-endian
- * @param redef optional faster redefinitions of sqrt and other methods
- */
-function Field(ORDER, bitLenOrOpts, isLE = false, opts = {}) {
-    if (ORDER <= _0n$2)
-        throw new Error('invalid field: expected ORDER > 0, got ' + ORDER);
-    let _nbitLength = undefined;
-    let _sqrt = undefined;
-    if (typeof bitLenOrOpts === 'object' && bitLenOrOpts != null) {
-        if (opts.sqrt || isLE)
-            throw new Error('cannot specify opts in two arguments');
-        const _opts = bitLenOrOpts;
-        if (_opts.BITS)
-            _nbitLength = _opts.BITS;
-        if (_opts.sqrt)
-            _sqrt = _opts.sqrt;
-        if (typeof _opts.isLE === 'boolean')
-            isLE = _opts.isLE;
-    }
-    else {
-        if (typeof bitLenOrOpts === 'number')
-            _nbitLength = bitLenOrOpts;
-        if (opts.sqrt)
-            _sqrt = opts.sqrt;
-    }
-    const { nBitLength: BITS, nByteLength: BYTES } = nLength(ORDER, _nbitLength);
-    if (BYTES > 2048)
-        throw new Error('invalid field: expected ORDER of <= 2048 bytes');
-    let sqrtP; // cached sqrtP
-    const f = Object.freeze({
-        ORDER,
-        isLE,
-        BITS,
-        BYTES,
-        MASK: bitMask(BITS),
-        ZERO: _0n$2,
-        ONE: _1n$3,
-        create: (num) => mod(num, ORDER),
-        isValid: (num) => {
-            if (typeof num !== 'bigint')
-                throw new Error('invalid field element: expected bigint, got ' + typeof num);
-            return _0n$2 <= num && num < ORDER; // 0 is valid element, but it's not invertible
-        },
-        is0: (num) => num === _0n$2,
-        // is valid and invertible
-        isValidNot0: (num) => !f.is0(num) && f.isValid(num),
-        isOdd: (num) => (num & _1n$3) === _1n$3,
-        neg: (num) => mod(-num, ORDER),
-        eql: (lhs, rhs) => lhs === rhs,
-        sqr: (num) => mod(num * num, ORDER),
-        add: (lhs, rhs) => mod(lhs + rhs, ORDER),
-        sub: (lhs, rhs) => mod(lhs - rhs, ORDER),
-        mul: (lhs, rhs) => mod(lhs * rhs, ORDER),
-        pow: (num, power) => FpPow(f, num, power),
-        div: (lhs, rhs) => mod(lhs * invert(rhs, ORDER), ORDER),
-        // Same as above, but doesn't normalize
-        sqrN: (num) => num * num,
-        addN: (lhs, rhs) => lhs + rhs,
-        subN: (lhs, rhs) => lhs - rhs,
-        mulN: (lhs, rhs) => lhs * rhs,
-        inv: (num) => invert(num, ORDER),
-        sqrt: _sqrt ||
-            ((n) => {
-                if (!sqrtP)
-                    sqrtP = FpSqrt(ORDER);
-                return sqrtP(f, n);
-            }),
-        toBytes: (num) => (isLE ? numberToBytesLE(num, BYTES) : numberToBytesBE(num, BYTES)),
-        fromBytes: (bytes) => {
-            if (bytes.length !== BYTES)
-                throw new Error('Field.fromBytes: expected ' + BYTES + ' bytes, got ' + bytes.length);
-            return isLE ? bytesToNumberLE(bytes) : bytesToNumberBE(bytes);
-        },
-        // TODO: we don't need it here, move out to separate fn
-        invertBatch: (lst) => FpInvertBatch(f, lst),
-        // We can't move this out because Fp6, Fp12 implement it
-        // and it's unclear what to return in there.
-        cmov: (a, b, c) => (c ? b : a),
-    });
-    return Object.freeze(f);
-}
-/**
- * Returns total number of bytes consumed by the field element.
- * For example, 32 bytes for usual 256-bit weierstrass curve.
- * @param fieldOrder number of field elements, usually CURVE.n
- * @returns byte length of field
- */
-function getFieldBytesLength(fieldOrder) {
-    if (typeof fieldOrder !== 'bigint')
-        throw new Error('field order must be bigint');
-    const bitLength = fieldOrder.toString(2).length;
-    return Math.ceil(bitLength / 8);
-}
-/**
- * Returns minimal amount of bytes that can be safely reduced
- * by field order.
- * Should be 2^-128 for 128-bit curve such as P256.
- * @param fieldOrder number of field elements, usually CURVE.n
- * @returns byte length of target hash
- */
-function getMinHashLength(fieldOrder) {
-    const length = getFieldBytesLength(fieldOrder);
-    return length + Math.ceil(length / 2);
-}
-/**
- * "Constant-time" private key generation utility.
- * Can take (n + n/2) or more bytes of uniform input e.g. from CSPRNG or KDF
- * and convert them into private scalar, with the modulo bias being negligible.
- * Needs at least 48 bytes of input for 32-byte private key.
- * https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-to-modulo-bias-and-how-to-avoid-it/
- * FIPS 186-5, A.2 https://csrc.nist.gov/publications/detail/fips/186/5/final
- * RFC 9380, https://www.rfc-editor.org/rfc/rfc9380#section-5
- * @param hash hash output from SHA3 or a similar function
- * @param groupOrder size of subgroup - (e.g. secp256k1.CURVE.n)
- * @param isLE interpret hash bytes as LE num
- * @returns valid private scalar
- */
-function mapHashToField(key, fieldOrder, isLE = false) {
-    const len = key.length;
-    const fieldLen = getFieldBytesLength(fieldOrder);
-    const minLen = getMinHashLength(fieldOrder);
-    // No small numbers: need to understand bias story. No huge numbers: easier to detect JS timings.
-    if (len < 16 || len < minLen || len > 1024)
-        throw new Error('expected ' + minLen + '-1024 bytes of input, got ' + len);
-    const num = isLE ? bytesToNumberLE(key) : bytesToNumberBE(key);
-    // `mod(x, 11)` can sometimes produce 0. `mod(x, 10) + 1` is the same, but no 0
-    const reduced = mod(num, fieldOrder - _1n$3) + _1n$3;
-    return isLE ? numberToBytesLE(reduced, fieldLen) : numberToBytesBE(reduced, fieldLen);
-}
-
-/**
- * Internal Merkle-Damgard hash utils.
- * @module
- */
-/** Polyfill for Safari 14. https://caniuse.com/mdn-javascript_builtins_dataview_setbiguint64 */
-function setBigUint64(view, byteOffset, value, isLE) {
-    if (typeof view.setBigUint64 === 'function')
-        return view.setBigUint64(byteOffset, value, isLE);
-    const _32n = BigInt(32);
-    const _u32_max = BigInt(0xffffffff);
-    const wh = Number((value >> _32n) & _u32_max);
-    const wl = Number(value & _u32_max);
-    const h = isLE ? 4 : 0;
-    const l = isLE ? 0 : 4;
-    view.setUint32(byteOffset + h, wh, isLE);
-    view.setUint32(byteOffset + l, wl, isLE);
-}
-/** Choice: a ? b : c */
-function Chi(a, b, c) {
-    return (a & b) ^ (~a & c);
-}
-/** Majority function, true if any two inputs is true. */
-function Maj(a, b, c) {
-    return (a & b) ^ (a & c) ^ (b & c);
-}
-/**
- * Merkle-Damgard hash construction base class.
- * Could be used to create MD5, RIPEMD, SHA1, SHA2.
- */
-class HashMD extends Hash {
-    constructor(blockLen, outputLen, padOffset, isLE) {
-        super();
-        this.finished = false;
-        this.length = 0;
-        this.pos = 0;
-        this.destroyed = false;
-        this.blockLen = blockLen;
-        this.outputLen = outputLen;
-        this.padOffset = padOffset;
-        this.isLE = isLE;
-        this.buffer = new Uint8Array(blockLen);
-        this.view = createView(this.buffer);
-    }
-    update(data) {
-        aexists(this);
-        data = toBytes(data);
-        abytes(data);
-        const { view, buffer, blockLen } = this;
-        const len = data.length;
-        for (let pos = 0; pos < len;) {
-            const take = Math.min(blockLen - this.pos, len - pos);
-            // Fast path: we have at least one block in input, cast it to view and process
-            if (take === blockLen) {
-                const dataView = createView(data);
-                for (; blockLen <= len - pos; pos += blockLen)
-                    this.process(dataView, pos);
-                continue;
-            }
-            buffer.set(data.subarray(pos, pos + take), this.pos);
-            this.pos += take;
-            pos += take;
-            if (this.pos === blockLen) {
-                this.process(view, 0);
-                this.pos = 0;
-            }
-        }
-        this.length += data.length;
-        this.roundClean();
-        return this;
-    }
-    digestInto(out) {
-        aexists(this);
-        aoutput(out, this);
-        this.finished = true;
-        // Padding
-        // We can avoid allocation of buffer for padding completely if it
-        // was previously not allocated here. But it won't change performance.
-        const { buffer, view, blockLen, isLE } = this;
-        let { pos } = this;
-        // append the bit '1' to the message
-        buffer[pos++] = 0b10000000;
-        clean(this.buffer.subarray(pos));
-        // we have less than padOffset left in buffer, so we cannot put length in
-        // current block, need process it and pad again
-        if (this.padOffset > blockLen - pos) {
-            this.process(view, 0);
-            pos = 0;
-        }
-        // Pad until full block byte with zeros
-        for (let i = pos; i < blockLen; i++)
-            buffer[i] = 0;
-        // Note: sha512 requires length to be 128bit integer, but length in JS will overflow before that
-        // You need to write around 2 exabytes (u64_max / 8 / (1024**6)) for this to happen.
-        // So we just write lowest 64 bits of that value.
-        setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE);
-        this.process(view, 0);
-        const oview = createView(out);
-        const len = this.outputLen;
-        // NOTE: we do division by 4 later, which should be fused in single op with modulo by JIT
-        if (len % 4)
-            throw new Error('_sha2: outputLen should be aligned to 32bit');
-        const outLen = len / 4;
-        const state = this.get();
-        if (outLen > state.length)
-            throw new Error('_sha2: outputLen bigger than state');
-        for (let i = 0; i < outLen; i++)
-            oview.setUint32(4 * i, state[i], isLE);
-    }
-    digest() {
-        const { buffer, outputLen } = this;
-        this.digestInto(buffer);
-        const res = buffer.slice(0, outputLen);
-        this.destroy();
-        return res;
-    }
-    _cloneInto(to) {
-        to || (to = new this.constructor());
-        to.set(...this.get());
-        const { blockLen, buffer, length, finished, destroyed, pos } = this;
-        to.destroyed = destroyed;
-        to.finished = finished;
-        to.length = length;
-        to.pos = pos;
-        if (length % blockLen)
-            to.buffer.set(buffer);
-        return to;
-    }
-    clone() {
-        return this._cloneInto();
-    }
-}
-/**
- * Initial SHA-2 state: fractional parts of square roots of first 16 primes 2..53.
- * Check out `test/misc/sha2-gen-iv.js` for recomputation guide.
- */
-/** Initial SHA256 state. Bits 0..32 of frac part of sqrt of primes 2..19 */
-const SHA256_IV = /* @__PURE__ */ Uint32Array.from([
-    0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
-]);
-/** Initial SHA512 state. Bits 0..64 of frac part of sqrt of primes 2..19 */
-const SHA512_IV = /* @__PURE__ */ Uint32Array.from([
-    0x6a09e667, 0xf3bcc908, 0xbb67ae85, 0x84caa73b, 0x3c6ef372, 0xfe94f82b, 0xa54ff53a, 0x5f1d36f1,
-    0x510e527f, 0xade682d1, 0x9b05688c, 0x2b3e6c1f, 0x1f83d9ab, 0xfb41bd6b, 0x5be0cd19, 0x137e2179,
-]);
-
-/**
- * Internal helpers for u64. BigUint64Array is too slow as per 2025, so we implement it using Uint32Array.
- * @todo re-check https://issues.chromium.org/issues/42212588
- * @module
- */
-const U32_MASK64 = /* @__PURE__ */ BigInt(2 ** 32 - 1);
-const _32n = /* @__PURE__ */ BigInt(32);
-function fromBig(n, le = false) {
-    if (le)
-        return { h: Number(n & U32_MASK64), l: Number((n >> _32n) & U32_MASK64) };
-    return { h: Number((n >> _32n) & U32_MASK64) | 0, l: Number(n & U32_MASK64) | 0 };
-}
-function split(lst, le = false) {
-    const len = lst.length;
-    let Ah = new Uint32Array(len);
-    let Al = new Uint32Array(len);
-    for (let i = 0; i < len; i++) {
-        const { h, l } = fromBig(lst[i], le);
-        [Ah[i], Al[i]] = [h, l];
-    }
-    return [Ah, Al];
-}
-// for Shift in [0, 32)
-const shrSH = (h, _l, s) => h >>> s;
-const shrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
-// Right rotate for Shift in [1, 32)
-const rotrSH = (h, l, s) => (h >>> s) | (l << (32 - s));
-const rotrSL = (h, l, s) => (h << (32 - s)) | (l >>> s);
-// Right rotate for Shift in (32, 64), NOTE: 32 is special case.
-const rotrBH = (h, l, s) => (h << (64 - s)) | (l >>> (s - 32));
-const rotrBL = (h, l, s) => (h >>> (s - 32)) | (l << (64 - s));
-// JS uses 32-bit signed integers for bitwise operations which means we cannot
-// simple take carry out of low bit sum by shift, we need to use division.
-function add(Ah, Al, Bh, Bl) {
-    const l = (Al >>> 0) + (Bl >>> 0);
-    return { h: (Ah + Bh + ((l / 2 ** 32) | 0)) | 0, l: l | 0 };
-}
-// Addition with more than 2 elements
-const add3L = (Al, Bl, Cl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0);
-const add3H = (low, Ah, Bh, Ch) => (Ah + Bh + Ch + ((low / 2 ** 32) | 0)) | 0;
-const add4L = (Al, Bl, Cl, Dl) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0);
-const add4H = (low, Ah, Bh, Ch, Dh) => (Ah + Bh + Ch + Dh + ((low / 2 ** 32) | 0)) | 0;
-const add5L = (Al, Bl, Cl, Dl, El) => (Al >>> 0) + (Bl >>> 0) + (Cl >>> 0) + (Dl >>> 0) + (El >>> 0);
-const add5H = (low, Ah, Bh, Ch, Dh, Eh) => (Ah + Bh + Ch + Dh + Eh + ((low / 2 ** 32) | 0)) | 0;
-
-/**
- * SHA2 hash function. A.k.a. sha256, sha384, sha512, sha512_224, sha512_256.
- * SHA256 is the fastest hash implementable in JS, even faster than Blake3.
- * Check out [RFC 4634](https://datatracker.ietf.org/doc/html/rfc4634) and
- * [FIPS 180-4](https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf).
- * @module
- */
-/**
- * Round constants:
- * First 32 bits of fractional parts of the cube roots of the first 64 primes 2..311)
- */
-// prettier-ignore
-const SHA256_K = /* @__PURE__ */ Uint32Array.from([
-    0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
-    0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
-    0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
-    0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
-    0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
-    0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
-    0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
-    0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
-]);
-/** Reusable temporary buffer. "W" comes straight from spec. */
-const SHA256_W = /* @__PURE__ */ new Uint32Array(64);
-class SHA256 extends HashMD {
-    constructor(outputLen = 32) {
-        super(64, outputLen, 8, false);
-        // We cannot use array here since array allows indexing by variable
-        // which means optimizer/compiler cannot use registers.
-        this.A = SHA256_IV[0] | 0;
-        this.B = SHA256_IV[1] | 0;
-        this.C = SHA256_IV[2] | 0;
-        this.D = SHA256_IV[3] | 0;
-        this.E = SHA256_IV[4] | 0;
-        this.F = SHA256_IV[5] | 0;
-        this.G = SHA256_IV[6] | 0;
-        this.H = SHA256_IV[7] | 0;
-    }
-    get() {
-        const { A, B, C, D, E, F, G, H } = this;
-        return [A, B, C, D, E, F, G, H];
-    }
-    // prettier-ignore
-    set(A, B, C, D, E, F, G, H) {
-        this.A = A | 0;
-        this.B = B | 0;
-        this.C = C | 0;
-        this.D = D | 0;
-        this.E = E | 0;
-        this.F = F | 0;
-        this.G = G | 0;
-        this.H = H | 0;
-    }
-    process(view, offset) {
-        // Extend the first 16 words into the remaining 48 words w[16..63] of the message schedule array
-        for (let i = 0; i < 16; i++, offset += 4)
-            SHA256_W[i] = view.getUint32(offset, false);
-        for (let i = 16; i < 64; i++) {
-            const W15 = SHA256_W[i - 15];
-            const W2 = SHA256_W[i - 2];
-            const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ (W15 >>> 3);
-            const s1 = rotr(W2, 17) ^ rotr(W2, 19) ^ (W2 >>> 10);
-            SHA256_W[i] = (s1 + SHA256_W[i - 7] + s0 + SHA256_W[i - 16]) | 0;
-        }
-        // Compression function main loop, 64 rounds
-        let { A, B, C, D, E, F, G, H } = this;
-        for (let i = 0; i < 64; i++) {
-            const sigma1 = rotr(E, 6) ^ rotr(E, 11) ^ rotr(E, 25);
-            const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;
-            const sigma0 = rotr(A, 2) ^ rotr(A, 13) ^ rotr(A, 22);
-            const T2 = (sigma0 + Maj(A, B, C)) | 0;
-            H = G;
-            G = F;
-            F = E;
-            E = (D + T1) | 0;
-            D = C;
-            C = B;
-            B = A;
-            A = (T1 + T2) | 0;
-        }
-        // Add the compressed chunk to the current hash value
-        A = (A + this.A) | 0;
-        B = (B + this.B) | 0;
-        C = (C + this.C) | 0;
-        D = (D + this.D) | 0;
-        E = (E + this.E) | 0;
-        F = (F + this.F) | 0;
-        G = (G + this.G) | 0;
-        H = (H + this.H) | 0;
-        this.set(A, B, C, D, E, F, G, H);
-    }
-    roundClean() {
-        clean(SHA256_W);
-    }
-    destroy() {
-        this.set(0, 0, 0, 0, 0, 0, 0, 0);
-        clean(this.buffer);
-    }
-}
-// SHA2-512 is slower than sha256 in js because u64 operations are slow.
-// Round contants
-// First 32 bits of the fractional parts of the cube roots of the first 80 primes 2..409
-// prettier-ignore
-const K512 = /* @__PURE__ */ (() => split([
-    '0x428a2f98d728ae22', '0x7137449123ef65cd', '0xb5c0fbcfec4d3b2f', '0xe9b5dba58189dbbc',
-    '0x3956c25bf348b538', '0x59f111f1b605d019', '0x923f82a4af194f9b', '0xab1c5ed5da6d8118',
-    '0xd807aa98a3030242', '0x12835b0145706fbe', '0x243185be4ee4b28c', '0x550c7dc3d5ffb4e2',
-    '0x72be5d74f27b896f', '0x80deb1fe3b1696b1', '0x9bdc06a725c71235', '0xc19bf174cf692694',
-    '0xe49b69c19ef14ad2', '0xefbe4786384f25e3', '0x0fc19dc68b8cd5b5', '0x240ca1cc77ac9c65',
-    '0x2de92c6f592b0275', '0x4a7484aa6ea6e483', '0x5cb0a9dcbd41fbd4', '0x76f988da831153b5',
-    '0x983e5152ee66dfab', '0xa831c66d2db43210', '0xb00327c898fb213f', '0xbf597fc7beef0ee4',
-    '0xc6e00bf33da88fc2', '0xd5a79147930aa725', '0x06ca6351e003826f', '0x142929670a0e6e70',
-    '0x27b70a8546d22ffc', '0x2e1b21385c26c926', '0x4d2c6dfc5ac42aed', '0x53380d139d95b3df',
-    '0x650a73548baf63de', '0x766a0abb3c77b2a8', '0x81c2c92e47edaee6', '0x92722c851482353b',
-    '0xa2bfe8a14cf10364', '0xa81a664bbc423001', '0xc24b8b70d0f89791', '0xc76c51a30654be30',
-    '0xd192e819d6ef5218', '0xd69906245565a910', '0xf40e35855771202a', '0x106aa07032bbd1b8',
-    '0x19a4c116b8d2d0c8', '0x1e376c085141ab53', '0x2748774cdf8eeb99', '0x34b0bcb5e19b48a8',
-    '0x391c0cb3c5c95a63', '0x4ed8aa4ae3418acb', '0x5b9cca4f7763e373', '0x682e6ff3d6b2b8a3',
-    '0x748f82ee5defb2fc', '0x78a5636f43172f60', '0x84c87814a1f0ab72', '0x8cc702081a6439ec',
-    '0x90befffa23631e28', '0xa4506cebde82bde9', '0xbef9a3f7b2c67915', '0xc67178f2e372532b',
-    '0xca273eceea26619c', '0xd186b8c721c0c207', '0xeada7dd6cde0eb1e', '0xf57d4f7fee6ed178',
-    '0x06f067aa72176fba', '0x0a637dc5a2c898a6', '0x113f9804bef90dae', '0x1b710b35131c471b',
-    '0x28db77f523047d84', '0x32caab7b40c72493', '0x3c9ebe0a15c9bebc', '0x431d67c49c100d4c',
-    '0x4cc5d4becb3e42b6', '0x597f299cfc657e2a', '0x5fcb6fab3ad6faec', '0x6c44198c4a475817'
-].map(n => BigInt(n))))();
-const SHA512_Kh = /* @__PURE__ */ (() => K512[0])();
-const SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
-// Reusable temporary buffers
-const SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
-const SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
-class SHA512 extends HashMD {
-    constructor(outputLen = 64) {
-        super(128, outputLen, 16, false);
-        // We cannot use array here since array allows indexing by variable
-        // which means optimizer/compiler cannot use registers.
-        // h -- high 32 bits, l -- low 32 bits
-        this.Ah = SHA512_IV[0] | 0;
-        this.Al = SHA512_IV[1] | 0;
-        this.Bh = SHA512_IV[2] | 0;
-        this.Bl = SHA512_IV[3] | 0;
-        this.Ch = SHA512_IV[4] | 0;
-        this.Cl = SHA512_IV[5] | 0;
-        this.Dh = SHA512_IV[6] | 0;
-        this.Dl = SHA512_IV[7] | 0;
-        this.Eh = SHA512_IV[8] | 0;
-        this.El = SHA512_IV[9] | 0;
-        this.Fh = SHA512_IV[10] | 0;
-        this.Fl = SHA512_IV[11] | 0;
-        this.Gh = SHA512_IV[12] | 0;
-        this.Gl = SHA512_IV[13] | 0;
-        this.Hh = SHA512_IV[14] | 0;
-        this.Hl = SHA512_IV[15] | 0;
-    }
-    // prettier-ignore
-    get() {
-        const { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
-        return [Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl];
-    }
-    // prettier-ignore
-    set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl) {
-        this.Ah = Ah | 0;
-        this.Al = Al | 0;
-        this.Bh = Bh | 0;
-        this.Bl = Bl | 0;
-        this.Ch = Ch | 0;
-        this.Cl = Cl | 0;
-        this.Dh = Dh | 0;
-        this.Dl = Dl | 0;
-        this.Eh = Eh | 0;
-        this.El = El | 0;
-        this.Fh = Fh | 0;
-        this.Fl = Fl | 0;
-        this.Gh = Gh | 0;
-        this.Gl = Gl | 0;
-        this.Hh = Hh | 0;
-        this.Hl = Hl | 0;
-    }
-    process(view, offset) {
-        // Extend the first 16 words into the remaining 64 words w[16..79] of the message schedule array
-        for (let i = 0; i < 16; i++, offset += 4) {
-            SHA512_W_H[i] = view.getUint32(offset);
-            SHA512_W_L[i] = view.getUint32((offset += 4));
-        }
-        for (let i = 16; i < 80; i++) {
-            // s0 := (w[i-15] rightrotate 1) xor (w[i-15] rightrotate 8) xor (w[i-15] rightshift 7)
-            const W15h = SHA512_W_H[i - 15] | 0;
-            const W15l = SHA512_W_L[i - 15] | 0;
-            const s0h = rotrSH(W15h, W15l, 1) ^ rotrSH(W15h, W15l, 8) ^ shrSH(W15h, W15l, 7);
-            const s0l = rotrSL(W15h, W15l, 1) ^ rotrSL(W15h, W15l, 8) ^ shrSL(W15h, W15l, 7);
-            // s1 := (w[i-2] rightrotate 19) xor (w[i-2] rightrotate 61) xor (w[i-2] rightshift 6)
-            const W2h = SHA512_W_H[i - 2] | 0;
-            const W2l = SHA512_W_L[i - 2] | 0;
-            const s1h = rotrSH(W2h, W2l, 19) ^ rotrBH(W2h, W2l, 61) ^ shrSH(W2h, W2l, 6);
-            const s1l = rotrSL(W2h, W2l, 19) ^ rotrBL(W2h, W2l, 61) ^ shrSL(W2h, W2l, 6);
-            // SHA256_W[i] = s0 + s1 + SHA256_W[i - 7] + SHA256_W[i - 16];
-            const SUMl = add4L(s0l, s1l, SHA512_W_L[i - 7], SHA512_W_L[i - 16]);
-            const SUMh = add4H(SUMl, s0h, s1h, SHA512_W_H[i - 7], SHA512_W_H[i - 16]);
-            SHA512_W_H[i] = SUMh | 0;
-            SHA512_W_L[i] = SUMl | 0;
-        }
-        let { Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl } = this;
-        // Compression function main loop, 80 rounds
-        for (let i = 0; i < 80; i++) {
-            // S1 := (e rightrotate 14) xor (e rightrotate 18) xor (e rightrotate 41)
-            const sigma1h = rotrSH(Eh, El, 14) ^ rotrSH(Eh, El, 18) ^ rotrBH(Eh, El, 41);
-            const sigma1l = rotrSL(Eh, El, 14) ^ rotrSL(Eh, El, 18) ^ rotrBL(Eh, El, 41);
-            //const T1 = (H + sigma1 + Chi(E, F, G) + SHA256_K[i] + SHA256_W[i]) | 0;
-            const CHIh = (Eh & Fh) ^ (~Eh & Gh);
-            const CHIl = (El & Fl) ^ (~El & Gl);
-            // T1 = H + sigma1 + Chi(E, F, G) + SHA512_K[i] + SHA512_W[i]
-            // prettier-ignore
-            const T1ll = add5L(Hl, sigma1l, CHIl, SHA512_Kl[i], SHA512_W_L[i]);
-            const T1h = add5H(T1ll, Hh, sigma1h, CHIh, SHA512_Kh[i], SHA512_W_H[i]);
-            const T1l = T1ll | 0;
-            // S0 := (a rightrotate 28) xor (a rightrotate 34) xor (a rightrotate 39)
-            const sigma0h = rotrSH(Ah, Al, 28) ^ rotrBH(Ah, Al, 34) ^ rotrBH(Ah, Al, 39);
-            const sigma0l = rotrSL(Ah, Al, 28) ^ rotrBL(Ah, Al, 34) ^ rotrBL(Ah, Al, 39);
-            const MAJh = (Ah & Bh) ^ (Ah & Ch) ^ (Bh & Ch);
-            const MAJl = (Al & Bl) ^ (Al & Cl) ^ (Bl & Cl);
-            Hh = Gh | 0;
-            Hl = Gl | 0;
-            Gh = Fh | 0;
-            Gl = Fl | 0;
-            Fh = Eh | 0;
-            Fl = El | 0;
-            ({ h: Eh, l: El } = add(Dh | 0, Dl | 0, T1h | 0, T1l | 0));
-            Dh = Ch | 0;
-            Dl = Cl | 0;
-            Ch = Bh | 0;
-            Cl = Bl | 0;
-            Bh = Ah | 0;
-            Bl = Al | 0;
-            const All = add3L(T1l, sigma0l, MAJl);
-            Ah = add3H(All, T1h, sigma0h, MAJh);
-            Al = All | 0;
-        }
-        // Add the compressed chunk to the current hash value
-        ({ h: Ah, l: Al } = add(this.Ah | 0, this.Al | 0, Ah | 0, Al | 0));
-        ({ h: Bh, l: Bl } = add(this.Bh | 0, this.Bl | 0, Bh | 0, Bl | 0));
-        ({ h: Ch, l: Cl } = add(this.Ch | 0, this.Cl | 0, Ch | 0, Cl | 0));
-        ({ h: Dh, l: Dl } = add(this.Dh | 0, this.Dl | 0, Dh | 0, Dl | 0));
-        ({ h: Eh, l: El } = add(this.Eh | 0, this.El | 0, Eh | 0, El | 0));
-        ({ h: Fh, l: Fl } = add(this.Fh | 0, this.Fl | 0, Fh | 0, Fl | 0));
-        ({ h: Gh, l: Gl } = add(this.Gh | 0, this.Gl | 0, Gh | 0, Gl | 0));
-        ({ h: Hh, l: Hl } = add(this.Hh | 0, this.Hl | 0, Hh | 0, Hl | 0));
-        this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
-    }
-    roundClean() {
-        clean(SHA512_W_H, SHA512_W_L);
-    }
-    destroy() {
-        clean(this.buffer);
-        this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
-    }
-}
-/**
- * SHA2-256 hash function from RFC 4634.
- *
- * It is the fastest JS hash, even faster than Blake3.
- * To break sha256 using birthday attack, attackers need to try 2^128 hashes.
- * BTC network is doing 2^70 hashes/sec (2^95 hashes/year) as per 2025.
- */
-const sha256 = /* @__PURE__ */ createHasher(() => new SHA256());
-/** SHA2-512 hash function from RFC 4634. */
-const sha512 = /* @__PURE__ */ createHasher(() => new SHA512());
-
-/**
- * HMAC: RFC2104 message authentication code.
- * @module
- */
-class HMAC extends Hash {
-    constructor(hash, _key) {
-        super();
-        this.finished = false;
-        this.destroyed = false;
-        ahash(hash);
-        const key = toBytes(_key);
-        this.iHash = hash.create();
-        if (typeof this.iHash.update !== 'function')
-            throw new Error('Expected instance of class which extends utils.Hash');
-        this.blockLen = this.iHash.blockLen;
-        this.outputLen = this.iHash.outputLen;
-        const blockLen = this.blockLen;
-        const pad = new Uint8Array(blockLen);
-        // blockLen can be bigger than outputLen
-        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
-        for (let i = 0; i < pad.length; i++)
-            pad[i] ^= 0x36;
-        this.iHash.update(pad);
-        // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone
-        this.oHash = hash.create();
-        // Undo internal XOR && apply outer XOR
-        for (let i = 0; i < pad.length; i++)
-            pad[i] ^= 0x36 ^ 0x5c;
-        this.oHash.update(pad);
-        clean(pad);
-    }
-    update(buf) {
-        aexists(this);
-        this.iHash.update(buf);
-        return this;
-    }
-    digestInto(out) {
-        aexists(this);
-        abytes(out, this.outputLen);
-        this.finished = true;
-        this.iHash.digestInto(out);
-        this.oHash.update(out);
-        this.oHash.digestInto(out);
-        this.destroy();
-    }
-    digest() {
-        const out = new Uint8Array(this.oHash.outputLen);
-        this.digestInto(out);
-        return out;
-    }
-    _cloneInto(to) {
-        // Create new instance without calling constructor since key already in state and we don't know it.
-        to || (to = Object.create(Object.getPrototypeOf(this), {}));
-        const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
-        to = to;
-        to.finished = finished;
-        to.destroyed = destroyed;
-        to.blockLen = blockLen;
-        to.outputLen = outputLen;
-        to.oHash = oHash._cloneInto(to.oHash);
-        to.iHash = iHash._cloneInto(to.iHash);
-        return to;
-    }
-    clone() {
-        return this._cloneInto();
-    }
-    destroy() {
-        this.destroyed = true;
-        this.oHash.destroy();
-        this.iHash.destroy();
-    }
-}
-/**
- * HMAC: RFC2104 message authentication code.
- * @param hash - function that would be used e.g. sha256
- * @param key - message key
- * @param message - message data
- * @example
- * import { hmac } from '@noble/hashes/hmac';
- * import { sha256 } from '@noble/hashes/sha2';
- * const mac1 = hmac(sha256, 'key', 'message');
- */
-const hmac = (hash, key, message) => new HMAC(hash, key).update(message).digest();
-hmac.create = (hash, key) => new HMAC(hash, key);
-
-/**
- * Methods for elliptic curve multiplication by scalars.
- * Contains wNAF, pippenger
- * @module
- */
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-const _0n$1 = BigInt(0);
-const _1n$2 = BigInt(1);
-function negateCt(condition, item) {
-    const neg = item.negate();
-    return condition ? neg : item;
-}
-/**
- * Takes a bunch of Projective Points but executes only one
- * inversion on all of them. Inversion is very slow operation,
- * so this improves performance massively.
- * Optimization: converts a list of projective points to a list of identical points with Z=1.
- */
-function normalizeZ(c, property, points) {
-    const getz = (p) => p.pz ;
-    const toInv = FpInvertBatch(c.Fp, points.map(getz));
-    // @ts-ignore
-    const affined = points.map((p, i) => p.toAffine(toInv[i]));
-    return affined.map(c.fromAffine);
-}
-function validateW(W, bits) {
-    if (!Number.isSafeInteger(W) || W <= 0 || W > bits)
-        throw new Error('invalid window size, expected [1..' + bits + '], got W=' + W);
-}
-function calcWOpts(W, scalarBits) {
-    validateW(W, scalarBits);
-    const windows = Math.ceil(scalarBits / W) + 1; // W=8 33. Not 32, because we skip zero
-    const windowSize = 2 ** (W - 1); // W=8 128. Not 256, because we skip zero
-    const maxNumber = 2 ** W; // W=8 256
-    const mask = bitMask(W); // W=8 255 == mask 0b11111111
-    const shiftBy = BigInt(W); // W=8 8
-    return { windows, windowSize, mask, maxNumber, shiftBy };
-}
-function calcOffsets(n, window, wOpts) {
-    const { windowSize, mask, maxNumber, shiftBy } = wOpts;
-    let wbits = Number(n & mask); // extract W bits.
-    let nextN = n >> shiftBy; // shift number by W bits.
-    // What actually happens here:
-    // const highestBit = Number(mask ^ (mask >> 1n));
-    // let wbits2 = wbits - 1; // skip zero
-    // if (wbits2 & highestBit) { wbits2 ^= Number(mask); // (~);
-    // split if bits > max: +224 => 256-32
-    if (wbits > windowSize) {
-        // we skip zero, which means instead of `>= size-1`, we do `> size`
-        wbits -= maxNumber; // -32, can be maxNumber - wbits, but then we need to set isNeg here.
-        nextN += _1n$2; // +256 (carry)
-    }
-    const offsetStart = window * windowSize;
-    const offset = offsetStart + Math.abs(wbits) - 1; // -1 because we skip zero
-    const isZero = wbits === 0; // is current window slice a 0?
-    const isNeg = wbits < 0; // is current window slice negative?
-    const isNegF = window % 2 !== 0; // fake random statement for noise
-    const offsetF = offsetStart; // fake offset for noise
-    return { nextN, offset, isZero, isNeg, isNegF, offsetF };
-}
-function validateMSMPoints(points, c) {
-    if (!Array.isArray(points))
-        throw new Error('array expected');
-    points.forEach((p, i) => {
-        if (!(p instanceof c))
-            throw new Error('invalid point at index ' + i);
-    });
-}
-function validateMSMScalars(scalars, field) {
-    if (!Array.isArray(scalars))
-        throw new Error('array of scalars expected');
-    scalars.forEach((s, i) => {
-        if (!field.isValid(s))
-            throw new Error('invalid scalar at index ' + i);
-    });
-}
-// Since points in different groups cannot be equal (different object constructor),
-// we can have single place to store precomputes.
-// Allows to make points frozen / immutable.
-const pointPrecomputes = new WeakMap();
-const pointWindowSizes = new WeakMap();
-function getW(P) {
-    return pointWindowSizes.get(P) || 1;
-}
-function assert0(n) {
-    if (n !== _0n$1)
-        throw new Error('invalid wNAF');
-}
-/**
- * Elliptic curve multiplication of Point by scalar. Fragile.
- * Scalars should always be less than curve order: this should be checked inside of a curve itself.
- * Creates precomputation tables for fast multiplication:
- * - private scalar is split by fixed size windows of W bits
- * - every window point is collected from window's table & added to accumulator
- * - since windows are different, same point inside tables won't be accessed more than once per calc
- * - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)
- * - +1 window is neccessary for wNAF
- * - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication
- *
- * @todo Research returning 2d JS array of windows, instead of a single window.
- * This would allow windows to be in different memory locations
- */
-function wNAF(c, bits) {
-    return {
-        constTimeNegate: negateCt,
-        hasPrecomputes(elm) {
-            return getW(elm) !== 1;
-        },
-        // non-const time multiplication ladder
-        unsafeLadder(elm, n, p = c.ZERO) {
-            let d = elm;
-            while (n > _0n$1) {
-                if (n & _1n$2)
-                    p = p.add(d);
-                d = d.double();
-                n >>= _1n$2;
-            }
-            return p;
-        },
-        /**
-         * Creates a wNAF precomputation window. Used for caching.
-         * Default window size is set by `utils.precompute()` and is equal to 8.
-         * Number of precomputed points depends on the curve size:
-         * 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
-         * - 𝑊 is the window size
-         * - 𝑛 is the bitlength of the curve order.
-         * For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
-         * @param elm Point instance
-         * @param W window size
-         * @returns precomputed point tables flattened to a single array
-         */
-        precomputeWindow(elm, W) {
-            const { windows, windowSize } = calcWOpts(W, bits);
-            const points = [];
-            let p = elm;
-            let base = p;
-            for (let window = 0; window < windows; window++) {
-                base = p;
-                points.push(base);
-                // i=1, bc we skip 0
-                for (let i = 1; i < windowSize; i++) {
-                    base = base.add(p);
-                    points.push(base);
-                }
-                p = base.double();
-            }
-            return points;
-        },
-        /**
-         * Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
-         * @param W window size
-         * @param precomputes precomputed tables
-         * @param n scalar (we don't check here, but should be less than curve order)
-         * @returns real and fake (for const-time) points
-         */
-        wNAF(W, precomputes, n) {
-            // Smaller version:
-            // https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
-            // TODO: check the scalar is less than group order?
-            // wNAF behavior is undefined otherwise. But have to carefully remove
-            // other checks before wNAF. ORDER == bits here.
-            // Accumulators
-            let p = c.ZERO;
-            let f = c.BASE;
-            // This code was first written with assumption that 'f' and 'p' will never be infinity point:
-            // since each addition is multiplied by 2 ** W, it cannot cancel each other. However,
-            // there is negate now: it is possible that negated element from low value
-            // would be the same as high element, which will create carry into next window.
-            // It's not obvious how this can fail, but still worth investigating later.
-            const wo = calcWOpts(W, bits);
-            for (let window = 0; window < wo.windows; window++) {
-                // (n === _0n) is handled and not early-exited. isEven and offsetF are used for noise
-                const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);
-                n = nextN;
-                if (isZero) {
-                    // bits are 0: add garbage to fake point
-                    // Important part for const-time getPublicKey: add random "noise" point to f.
-                    f = f.add(negateCt(isNegF, precomputes[offsetF]));
-                }
-                else {
-                    // bits are 1: add to result point
-                    p = p.add(negateCt(isNeg, precomputes[offset]));
-                }
-            }
-            assert0(n);
-            // Return both real and fake points: JIT won't eliminate f.
-            // At this point there is a way to F be infinity-point even if p is not,
-            // which makes it less const-time: around 1 bigint multiply.
-            return { p, f };
-        },
-        /**
-         * Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.
-         * @param W window size
-         * @param precomputes precomputed tables
-         * @param n scalar (we don't check here, but should be less than curve order)
-         * @param acc accumulator point to add result of multiplication
-         * @returns point
-         */
-        wNAFUnsafe(W, precomputes, n, acc = c.ZERO) {
-            const wo = calcWOpts(W, bits);
-            for (let window = 0; window < wo.windows; window++) {
-                if (n === _0n$1)
-                    break; // Early-exit, skip 0 value
-                const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);
-                n = nextN;
-                if (isZero) {
-                    // Window bits are 0: skip processing.
-                    // Move to next window.
-                    continue;
-                }
-                else {
-                    const item = precomputes[offset];
-                    acc = acc.add(isNeg ? item.negate() : item); // Re-using acc allows to save adds in MSM
-                }
-            }
-            assert0(n);
-            return acc;
-        },
-        getPrecomputes(W, P, transform) {
-            // Calculate precomputes on a first run, reuse them after
-            let comp = pointPrecomputes.get(P);
-            if (!comp) {
-                comp = this.precomputeWindow(P, W);
-                if (W !== 1) {
-                    // Doing transform outside of if brings 15% perf hit
-                    if (typeof transform === 'function')
-                        comp = transform(comp);
-                    pointPrecomputes.set(P, comp);
-                }
-            }
-            return comp;
-        },
-        wNAFCached(P, n, transform) {
-            const W = getW(P);
-            return this.wNAF(W, this.getPrecomputes(W, P, transform), n);
-        },
-        wNAFCachedUnsafe(P, n, transform, prev) {
-            const W = getW(P);
-            if (W === 1)
-                return this.unsafeLadder(P, n, prev); // For W=1 ladder is ~x2 faster
-            return this.wNAFUnsafe(W, this.getPrecomputes(W, P, transform), n, prev);
-        },
-        // We calculate precomputes for elliptic curve point multiplication
-        // using windowed method. This specifies window size and
-        // stores precomputed values. Usually only base point would be precomputed.
-        setWindowSize(P, W) {
-            validateW(W, bits);
-            pointWindowSizes.set(P, W);
-            pointPrecomputes.delete(P);
-        },
-    };
-}
-/**
- * Endomorphism-specific multiplication for Koblitz curves.
- * Cost: 128 dbl, 0-256 adds.
- */
-function mulEndoUnsafe(c, point, k1, k2) {
-    let acc = point;
-    let p1 = c.ZERO;
-    let p2 = c.ZERO;
-    while (k1 > _0n$1 || k2 > _0n$1) {
-        if (k1 & _1n$2)
-            p1 = p1.add(acc);
-        if (k2 & _1n$2)
-            p2 = p2.add(acc);
-        acc = acc.double();
-        k1 >>= _1n$2;
-        k2 >>= _1n$2;
-    }
-    return { p1, p2 };
-}
-/**
- * Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).
- * 30x faster vs naive addition on L=4096, 10x faster than precomputes.
- * For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.
- * Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.
- * @param c Curve Point constructor
- * @param fieldN field over CURVE.N - important that it's not over CURVE.P
- * @param points array of L curve points
- * @param scalars array of L scalars (aka private keys / bigints)
- */
-function pippenger(c, fieldN, points, scalars) {
-    // If we split scalars by some window (let's say 8 bits), every chunk will only
-    // take 256 buckets even if there are 4096 scalars, also re-uses double.
-    // TODO:
-    // - https://eprint.iacr.org/2024/750.pdf
-    // - https://tches.iacr.org/index.php/TCHES/article/view/10287
-    // 0 is accepted in scalars
-    validateMSMPoints(points, c);
-    validateMSMScalars(scalars, fieldN);
-    const plength = points.length;
-    const slength = scalars.length;
-    if (plength !== slength)
-        throw new Error('arrays of points and scalars must have equal length');
-    // if (plength === 0) throw new Error('array must be of length >= 2');
-    const zero = c.ZERO;
-    const wbits = bitLen(BigInt(plength));
-    let windowSize = 1; // bits
-    if (wbits > 12)
-        windowSize = wbits - 3;
-    else if (wbits > 4)
-        windowSize = wbits - 2;
-    else if (wbits > 0)
-        windowSize = 2;
-    const MASK = bitMask(windowSize);
-    const buckets = new Array(Number(MASK) + 1).fill(zero); // +1 for zero array
-    const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;
-    let sum = zero;
-    for (let i = lastBits; i >= 0; i -= windowSize) {
-        buckets.fill(zero);
-        for (let j = 0; j < slength; j++) {
-            const scalar = scalars[j];
-            const wbits = Number((scalar >> BigInt(i)) & MASK);
-            buckets[wbits] = buckets[wbits].add(points[j]);
-        }
-        let resI = zero; // not using this will do small speed-up, but will lose ct
-        // Skip first bucket, because it is zero
-        for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {
-            sumI = sumI.add(buckets[j]);
-            resI = resI.add(sumI);
-        }
-        sum = sum.add(resI);
-        if (i !== 0)
-            for (let j = 0; j < windowSize; j++)
-                sum = sum.double();
-    }
-    return sum;
-}
-function createField(order, field) {
-    if (field) {
-        if (field.ORDER !== order)
-            throw new Error('Field.ORDER must match order: Fp == p, Fn == n');
-        validateField(field);
-        return field;
-    }
-    else {
-        return Field(order);
-    }
-}
-/** Validates CURVE opts and creates fields */
-function _createCurveFields(type, CURVE, curveOpts = {}) {
-    if (!CURVE || typeof CURVE !== 'object')
-        throw new Error(`expected valid ${type} CURVE object`);
-    for (const p of ['p', 'n', 'h']) {
-        const val = CURVE[p];
-        if (!(typeof val === 'bigint' && val > _0n$1))
-            throw new Error(`CURVE.${p} must be positive bigint`);
-    }
-    const Fp = createField(CURVE.p, curveOpts.Fp);
-    const Fn = createField(CURVE.n, curveOpts.Fn);
-    const _b = 'b' ;
-    const params = ['Gx', 'Gy', 'a', _b];
-    for (const p of params) {
-        // @ts-ignore
-        if (!Fp.isValid(CURVE[p]))
-            throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
-    }
-    return { Fp, Fn };
-}
-
-/**
- * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.
- *
- * ### Design rationale for types
- *
- * * Interaction between classes from different curves should fail:
- *   `k256.Point.BASE.add(p256.Point.BASE)`
- * * For this purpose we want to use `instanceof` operator, which is fast and works during runtime
- * * Different calls of `curve()` would return different classes -
- *   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,
- *   it won't affect others
- *
- * TypeScript can't infer types for classes created inside a function. Classes is one instance
- * of nominative types in TypeScript and interfaces only check for shape, so it's hard to create
- * unique type for every function call.
- *
- * We can use generic types via some param, like curve opts, but that would:
- *     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)
- *     which is hard to debug.
- *     2. Params can be generic and we can't enforce them to be constant value:
- *     if somebody creates curve from non-constant params,
- *     it would be allowed to interact with other curves with non-constant params
- *
- * @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol
- * @module
- */
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-function validateSigVerOpts(opts) {
-    if (opts.lowS !== undefined)
-        abool('lowS', opts.lowS);
-    if (opts.prehash !== undefined)
-        abool('prehash', opts.prehash);
-}
-class DERErr extends Error {
-    constructor(m = '') {
-        super(m);
-    }
-}
-/**
- * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:
- *
- *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]
- *
- * Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html
- */
-const DER = {
-    // asn.1 DER encoding utils
-    Err: DERErr,
-    // Basic building block is TLV (Tag-Length-Value)
-    _tlv: {
-        encode: (tag, data) => {
-            const { Err: E } = DER;
-            if (tag < 0 || tag > 256)
-                throw new E('tlv.encode: wrong tag');
-            if (data.length & 1)
-                throw new E('tlv.encode: unpadded data');
-            const dataLen = data.length / 2;
-            const len = numberToHexUnpadded(dataLen);
-            if ((len.length / 2) & 128)
-                throw new E('tlv.encode: long form length too big');
-            // length of length with long form flag
-            const lenLen = dataLen > 127 ? numberToHexUnpadded((len.length / 2) | 128) : '';
-            const t = numberToHexUnpadded(tag);
-            return t + lenLen + len + data;
-        },
-        // v - value, l - left bytes (unparsed)
-        decode(tag, data) {
-            const { Err: E } = DER;
-            let pos = 0;
-            if (tag < 0 || tag > 256)
-                throw new E('tlv.encode: wrong tag');
-            if (data.length < 2 || data[pos++] !== tag)
-                throw new E('tlv.decode: wrong tlv');
-            const first = data[pos++];
-            const isLong = !!(first & 128); // First bit of first length byte is flag for short/long form
-            let length = 0;
-            if (!isLong)
-                length = first;
-            else {
-                // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]
-                const lenLen = first & 127;
-                if (!lenLen)
-                    throw new E('tlv.decode(long): indefinite length not supported');
-                if (lenLen > 4)
-                    throw new E('tlv.decode(long): byte length is too big'); // this will overflow u32 in js
-                const lengthBytes = data.subarray(pos, pos + lenLen);
-                if (lengthBytes.length !== lenLen)
-                    throw new E('tlv.decode: length bytes not complete');
-                if (lengthBytes[0] === 0)
-                    throw new E('tlv.decode(long): zero leftmost byte');
-                for (const b of lengthBytes)
-                    length = (length << 8) | b;
-                pos += lenLen;
-                if (length < 128)
-                    throw new E('tlv.decode(long): not minimal encoding');
-            }
-            const v = data.subarray(pos, pos + length);
-            if (v.length !== length)
-                throw new E('tlv.decode: wrong value length');
-            return { v, l: data.subarray(pos + length) };
-        },
-    },
-    // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,
-    // since we always use positive integers here. It must always be empty:
-    // - add zero byte if exists
-    // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)
-    _int: {
-        encode(num) {
-            const { Err: E } = DER;
-            if (num < _0n)
-                throw new E('integer: negative integers are not allowed');
-            let hex = numberToHexUnpadded(num);
-            // Pad with zero byte if negative flag is present
-            if (Number.parseInt(hex[0], 16) & 0b1000)
-                hex = '00' + hex;
-            if (hex.length & 1)
-                throw new E('unexpected DER parsing assertion: unpadded hex');
-            return hex;
-        },
-        decode(data) {
-            const { Err: E } = DER;
-            if (data[0] & 128)
-                throw new E('invalid signature integer: negative');
-            if (data[0] === 0x00 && !(data[1] & 128))
-                throw new E('invalid signature integer: unnecessary leading zero');
-            return bytesToNumberBE(data);
-        },
-    },
-    toSig(hex) {
-        // parse DER signature
-        const { Err: E, _int: int, _tlv: tlv } = DER;
-        const data = ensureBytes('signature', hex);
-        const { v: seqBytes, l: seqLeftBytes } = tlv.decode(0x30, data);
-        if (seqLeftBytes.length)
-            throw new E('invalid signature: left bytes after parsing');
-        const { v: rBytes, l: rLeftBytes } = tlv.decode(0x02, seqBytes);
-        const { v: sBytes, l: sLeftBytes } = tlv.decode(0x02, rLeftBytes);
-        if (sLeftBytes.length)
-            throw new E('invalid signature: left bytes after parsing');
-        return { r: int.decode(rBytes), s: int.decode(sBytes) };
-    },
-    hexFromSig(sig) {
-        const { _tlv: tlv, _int: int } = DER;
-        const rs = tlv.encode(0x02, int.encode(sig.r));
-        const ss = tlv.encode(0x02, int.encode(sig.s));
-        const seq = rs + ss;
-        return tlv.encode(0x30, seq);
-    },
-};
-// Be friendly to bad ECMAScript parsers by not using bigint literals
-// prettier-ignore
-const _0n = BigInt(0), _1n$1 = BigInt(1), _2n$1 = BigInt(2), _3n = BigInt(3), _4n = BigInt(4);
-// TODO: remove
-function _legacyHelperEquat(Fp, a, b) {
-    /**
-     * y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².
-     * @returns y²
-     */
-    function weierstrassEquation(x) {
-        const x2 = Fp.sqr(x); // x * x
-        const x3 = Fp.mul(x2, x); // x² * x
-        return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x³ + a * x + b
-    }
-    return weierstrassEquation;
-}
-function _legacyHelperNormPriv(Fn, allowedPrivateKeyLengths, wrapPrivateKey) {
-    const { BYTES: expected } = Fn;
-    // Validates if priv key is valid and converts it to bigint.
-    function normPrivateKeyToScalar(key) {
-        let num;
-        if (typeof key === 'bigint') {
-            num = key;
-        }
-        else {
-            let bytes = ensureBytes('private key', key);
-            if (allowedPrivateKeyLengths) {
-                if (!allowedPrivateKeyLengths.includes(bytes.length * 2))
-                    throw new Error('invalid private key');
-                const padded = new Uint8Array(expected);
-                padded.set(bytes, padded.length - bytes.length);
-                bytes = padded;
-            }
-            try {
-                num = Fn.fromBytes(bytes);
-            }
-            catch (error) {
-                throw new Error(`invalid private key: expected ui8a of size ${expected}, got ${typeof key}`);
-            }
-        }
-        if (wrapPrivateKey)
-            num = Fn.create(num); // disabled by default, enabled for BLS
-        if (!Fn.isValidNot0(num))
-            throw new Error('invalid private key: out of range [1..N-1]');
-        return num;
-    }
-    return normPrivateKeyToScalar;
-}
-function weierstrassN(CURVE, curveOpts = {}) {
-    const { Fp, Fn } = _createCurveFields('weierstrass', CURVE, curveOpts);
-    const { h: cofactor, n: CURVE_ORDER } = CURVE;
-    _validateObject(curveOpts, {}, {
-        allowInfinityPoint: 'boolean',
-        clearCofactor: 'function',
-        isTorsionFree: 'function',
-        fromBytes: 'function',
-        toBytes: 'function',
-        endo: 'object',
-        wrapPrivateKey: 'boolean',
-    });
-    const { endo } = curveOpts;
-    if (endo) {
-        // validateObject(endo, { beta: 'bigint', splitScalar: 'function' });
-        if (!Fp.is0(CURVE.a) ||
-            typeof endo.beta !== 'bigint' ||
-            typeof endo.splitScalar !== 'function') {
-            throw new Error('invalid endo: expected "beta": bigint and "splitScalar": function');
-        }
-    }
-    function assertCompressionIsSupported() {
-        if (!Fp.isOdd)
-            throw new Error('compression is not supported: Field does not have .isOdd()');
-    }
-    // Implements IEEE P1363 point encoding
-    function pointToBytes(_c, point, isCompressed) {
-        const { x, y } = point.toAffine();
-        const bx = Fp.toBytes(x);
-        abool('isCompressed', isCompressed);
-        if (isCompressed) {
-            assertCompressionIsSupported();
-            const hasEvenY = !Fp.isOdd(y);
-            return concatBytes(pprefix(hasEvenY), bx);
-        }
-        else {
-            return concatBytes(Uint8Array.of(0x04), bx, Fp.toBytes(y));
-        }
-    }
-    function pointFromBytes(bytes) {
-        abytes(bytes);
-        const L = Fp.BYTES;
-        const LC = L + 1; // length compressed, e.g. 33 for 32-byte field
-        const LU = 2 * L + 1; // length uncompressed, e.g. 65 for 32-byte field
-        const length = bytes.length;
-        const head = bytes[0];
-        const tail = bytes.subarray(1);
-        // No actual validation is done here: use .assertValidity()
-        if (length === LC && (head === 0x02 || head === 0x03)) {
-            const x = Fp.fromBytes(tail);
-            if (!Fp.isValid(x))
-                throw new Error('bad point: is not on curve, wrong x');
-            const y2 = weierstrassEquation(x); // y² = x³ + ax + b
-            let y;
-            try {
-                y = Fp.sqrt(y2); // y = y² ^ (p+1)/4
-            }
-            catch (sqrtError) {
-                const err = sqrtError instanceof Error ? ': ' + sqrtError.message : '';
-                throw new Error('bad point: is not on curve, sqrt error' + err);
-            }
-            assertCompressionIsSupported();
-            const isYOdd = Fp.isOdd(y); // (y & _1n) === _1n;
-            const isHeadOdd = (head & 1) === 1; // ECDSA-specific
-            if (isHeadOdd !== isYOdd)
-                y = Fp.neg(y);
-            return { x, y };
-        }
-        else if (length === LU && head === 0x04) {
-            // TODO: more checks
-            const x = Fp.fromBytes(tail.subarray(L * 0, L * 1));
-            const y = Fp.fromBytes(tail.subarray(L * 1, L * 2));
-            if (!isValidXY(x, y))
-                throw new Error('bad point: is not on curve');
-            return { x, y };
-        }
-        else {
-            throw new Error(`bad point: got length ${length}, expected compressed=${LC} or uncompressed=${LU}`);
-        }
-    }
-    const toBytes = curveOpts.toBytes || pointToBytes;
-    const fromBytes = curveOpts.fromBytes || pointFromBytes;
-    const weierstrassEquation = _legacyHelperEquat(Fp, CURVE.a, CURVE.b);
-    // TODO: move top-level
-    /** Checks whether equation holds for given x, y: y² == x³ + ax + b */
-    function isValidXY(x, y) {
-        const left = Fp.sqr(y); // y²
-        const right = weierstrassEquation(x); // x³ + ax + b
-        return Fp.eql(left, right);
-    }
-    // Validate whether the passed curve params are valid.
-    // Test 1: equation y² = x³ + ax + b should work for generator point.
-    if (!isValidXY(CURVE.Gx, CURVE.Gy))
-        throw new Error('bad curve params: generator point');
-    // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.
-    // Guarantees curve is genus-1, smooth (non-singular).
-    const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);
-    const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));
-    if (Fp.is0(Fp.add(_4a3, _27b2)))
-        throw new Error('bad curve params: a or b');
-    /** Asserts coordinate is valid: 0 <= n < Fp.ORDER. */
-    function acoord(title, n, banZero = false) {
-        if (!Fp.isValid(n) || (banZero && Fp.is0(n)))
-            throw new Error(`bad point coordinate ${title}`);
-        return n;
-    }
-    function aprjpoint(other) {
-        if (!(other instanceof Point))
-            throw new Error('ProjectivePoint expected');
-    }
-    // Memoized toAffine / validity check. They are heavy. Points are immutable.
-    // Converts Projective point to affine (x, y) coordinates.
-    // Can accept precomputed Z^-1 - for example, from invertBatch.
-    // (X, Y, Z) ∋ (x=X/Z, y=Y/Z)
-    const toAffineMemo = memoized((p, iz) => {
-        const { px: x, py: y, pz: z } = p;
-        // Fast-path for normalized points
-        if (Fp.eql(z, Fp.ONE))
-            return { x, y };
-        const is0 = p.is0();
-        // If invZ was 0, we return zero point. However we still want to execute
-        // all operations, so we replace invZ with a random number, 1.
-        if (iz == null)
-            iz = is0 ? Fp.ONE : Fp.inv(z);
-        const ax = Fp.mul(x, iz);
-        const ay = Fp.mul(y, iz);
-        const zz = Fp.mul(z, iz);
-        if (is0)
-            return { x: Fp.ZERO, y: Fp.ZERO };
-        if (!Fp.eql(zz, Fp.ONE))
-            throw new Error('invZ was invalid');
-        return { x: ax, y: ay };
-    });
-    // NOTE: on exception this will crash 'cached' and no value will be set.
-    // Otherwise true will be return
-    const assertValidMemo = memoized((p) => {
-        if (p.is0()) {
-            // (0, 1, 0) aka ZERO is invalid in most contexts.
-            // In BLS, ZERO can be serialized, so we allow it.
-            // (0, 0, 0) is invalid representation of ZERO.
-            if (curveOpts.allowInfinityPoint && !Fp.is0(p.py))
-                return;
-            throw new Error('bad point: ZERO');
-        }
-        // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`
-        const { x, y } = p.toAffine();
-        if (!Fp.isValid(x) || !Fp.isValid(y))
-            throw new Error('bad point: x or y not field elements');
-        if (!isValidXY(x, y))
-            throw new Error('bad point: equation left != right');
-        if (!p.isTorsionFree())
-            throw new Error('bad point: not in prime-order subgroup');
-        return true;
-    });
-    function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {
-        k2p = new Point(Fp.mul(k2p.px, endoBeta), k2p.py, k2p.pz);
-        k1p = negateCt(k1neg, k1p);
-        k2p = negateCt(k2neg, k2p);
-        return k1p.add(k2p);
-    }
-    /**
-     * Projective Point works in 3d / projective (homogeneous) coordinates:(X, Y, Z) ∋ (x=X/Z, y=Y/Z).
-     * Default Point works in 2d / affine coordinates: (x, y).
-     * We're doing calculations in projective, because its operations don't require costly inversion.
-     */
-    class Point {
-        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
-        constructor(px, py, pz) {
-            this.px = acoord('x', px);
-            this.py = acoord('y', py, true);
-            this.pz = acoord('z', pz);
-            Object.freeze(this);
-        }
-        /** Does NOT validate if the point is valid. Use `.assertValidity()`. */
-        static fromAffine(p) {
-            const { x, y } = p || {};
-            if (!p || !Fp.isValid(x) || !Fp.isValid(y))
-                throw new Error('invalid affine point');
-            if (p instanceof Point)
-                throw new Error('projective point not allowed');
-            // (0, 0) would've produced (0, 0, 1) - instead, we need (0, 1, 0)
-            if (Fp.is0(x) && Fp.is0(y))
-                return Point.ZERO;
-            return new Point(x, y, Fp.ONE);
-        }
-        get x() {
-            return this.toAffine().x;
-        }
-        get y() {
-            return this.toAffine().y;
-        }
-        static normalizeZ(points) {
-            return normalizeZ(Point, 'pz', points);
-        }
-        static fromBytes(bytes) {
-            abytes(bytes);
-            return Point.fromHex(bytes);
-        }
-        /** Converts hash string or Uint8Array to Point. */
-        static fromHex(hex) {
-            const P = Point.fromAffine(fromBytes(ensureBytes('pointHex', hex)));
-            P.assertValidity();
-            return P;
-        }
-        /** Multiplies generator point by privateKey. */
-        static fromPrivateKey(privateKey) {
-            const normPrivateKeyToScalar = _legacyHelperNormPriv(Fn, curveOpts.allowedPrivateKeyLengths, curveOpts.wrapPrivateKey);
-            return Point.BASE.multiply(normPrivateKeyToScalar(privateKey));
-        }
-        /** Multiscalar Multiplication */
-        static msm(points, scalars) {
-            return pippenger(Point, Fn, points, scalars);
-        }
-        /**
-         *
-         * @param windowSize
-         * @param isLazy true will defer table computation until the first multiplication
-         * @returns
-         */
-        precompute(windowSize = 8, isLazy = true) {
-            wnaf.setWindowSize(this, windowSize);
-            if (!isLazy)
-                this.multiply(_3n); // random number
-            return this;
-        }
-        /** "Private method", don't use it directly */
-        _setWindowSize(windowSize) {
-            this.precompute(windowSize);
-        }
-        // TODO: return `this`
-        /** A point on curve is valid if it conforms to equation. */
-        assertValidity() {
-            assertValidMemo(this);
-        }
-        hasEvenY() {
-            const { y } = this.toAffine();
-            if (!Fp.isOdd)
-                throw new Error("Field doesn't support isOdd");
-            return !Fp.isOdd(y);
-        }
-        /** Compare one point to another. */
-        equals(other) {
-            aprjpoint(other);
-            const { px: X1, py: Y1, pz: Z1 } = this;
-            const { px: X2, py: Y2, pz: Z2 } = other;
-            const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));
-            const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));
-            return U1 && U2;
-        }
-        /** Flips point to one corresponding to (x, -y) in Affine coordinates. */
-        negate() {
-            return new Point(this.px, Fp.neg(this.py), this.pz);
-        }
-        // Renes-Costello-Batina exception-free doubling formula.
-        // There is 30% faster Jacobian formula, but it is not complete.
-        // https://eprint.iacr.org/2015/1060, algorithm 3
-        // Cost: 8M + 3S + 3*a + 2*b3 + 15add.
-        double() {
-            const { a, b } = CURVE;
-            const b3 = Fp.mul(b, _3n);
-            const { px: X1, py: Y1, pz: Z1 } = this;
-            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore
-            let t0 = Fp.mul(X1, X1); // step 1
-            let t1 = Fp.mul(Y1, Y1);
-            let t2 = Fp.mul(Z1, Z1);
-            let t3 = Fp.mul(X1, Y1);
-            t3 = Fp.add(t3, t3); // step 5
-            Z3 = Fp.mul(X1, Z1);
-            Z3 = Fp.add(Z3, Z3);
-            X3 = Fp.mul(a, Z3);
-            Y3 = Fp.mul(b3, t2);
-            Y3 = Fp.add(X3, Y3); // step 10
-            X3 = Fp.sub(t1, Y3);
-            Y3 = Fp.add(t1, Y3);
-            Y3 = Fp.mul(X3, Y3);
-            X3 = Fp.mul(t3, X3);
-            Z3 = Fp.mul(b3, Z3); // step 15
-            t2 = Fp.mul(a, t2);
-            t3 = Fp.sub(t0, t2);
-            t3 = Fp.mul(a, t3);
-            t3 = Fp.add(t3, Z3);
-            Z3 = Fp.add(t0, t0); // step 20
-            t0 = Fp.add(Z3, t0);
-            t0 = Fp.add(t0, t2);
-            t0 = Fp.mul(t0, t3);
-            Y3 = Fp.add(Y3, t0);
-            t2 = Fp.mul(Y1, Z1); // step 25
-            t2 = Fp.add(t2, t2);
-            t0 = Fp.mul(t2, t3);
-            X3 = Fp.sub(X3, t0);
-            Z3 = Fp.mul(t2, t1);
-            Z3 = Fp.add(Z3, Z3); // step 30
-            Z3 = Fp.add(Z3, Z3);
-            return new Point(X3, Y3, Z3);
-        }
-        // Renes-Costello-Batina exception-free addition formula.
-        // There is 30% faster Jacobian formula, but it is not complete.
-        // https://eprint.iacr.org/2015/1060, algorithm 1
-        // Cost: 12M + 0S + 3*a + 3*b3 + 23add.
-        add(other) {
-            aprjpoint(other);
-            const { px: X1, py: Y1, pz: Z1 } = this;
-            const { px: X2, py: Y2, pz: Z2 } = other;
-            let X3 = Fp.ZERO, Y3 = Fp.ZERO, Z3 = Fp.ZERO; // prettier-ignore
-            const a = CURVE.a;
-            const b3 = Fp.mul(CURVE.b, _3n);
-            let t0 = Fp.mul(X1, X2); // step 1
-            let t1 = Fp.mul(Y1, Y2);
-            let t2 = Fp.mul(Z1, Z2);
-            let t3 = Fp.add(X1, Y1);
-            let t4 = Fp.add(X2, Y2); // step 5
-            t3 = Fp.mul(t3, t4);
-            t4 = Fp.add(t0, t1);
-            t3 = Fp.sub(t3, t4);
-            t4 = Fp.add(X1, Z1);
-            let t5 = Fp.add(X2, Z2); // step 10
-            t4 = Fp.mul(t4, t5);
-            t5 = Fp.add(t0, t2);
-            t4 = Fp.sub(t4, t5);
-            t5 = Fp.add(Y1, Z1);
-            X3 = Fp.add(Y2, Z2); // step 15
-            t5 = Fp.mul(t5, X3);
-            X3 = Fp.add(t1, t2);
-            t5 = Fp.sub(t5, X3);
-            Z3 = Fp.mul(a, t4);
-            X3 = Fp.mul(b3, t2); // step 20
-            Z3 = Fp.add(X3, Z3);
-            X3 = Fp.sub(t1, Z3);
-            Z3 = Fp.add(t1, Z3);
-            Y3 = Fp.mul(X3, Z3);
-            t1 = Fp.add(t0, t0); // step 25
-            t1 = Fp.add(t1, t0);
-            t2 = Fp.mul(a, t2);
-            t4 = Fp.mul(b3, t4);
-            t1 = Fp.add(t1, t2);
-            t2 = Fp.sub(t0, t2); // step 30
-            t2 = Fp.mul(a, t2);
-            t4 = Fp.add(t4, t2);
-            t0 = Fp.mul(t1, t4);
-            Y3 = Fp.add(Y3, t0);
-            t0 = Fp.mul(t5, t4); // step 35
-            X3 = Fp.mul(t3, X3);
-            X3 = Fp.sub(X3, t0);
-            t0 = Fp.mul(t3, t1);
-            Z3 = Fp.mul(t5, Z3);
-            Z3 = Fp.add(Z3, t0); // step 40
-            return new Point(X3, Y3, Z3);
-        }
-        subtract(other) {
-            return this.add(other.negate());
-        }
-        is0() {
-            return this.equals(Point.ZERO);
-        }
-        /**
-         * Constant time multiplication.
-         * Uses wNAF method. Windowed method may be 10% faster,
-         * but takes 2x longer to generate and consumes 2x memory.
-         * Uses precomputes when available.
-         * Uses endomorphism for Koblitz curves.
-         * @param scalar by which the point would be multiplied
-         * @returns New point
-         */
-        multiply(scalar) {
-            const { endo } = curveOpts;
-            if (!Fn.isValidNot0(scalar))
-                throw new Error('invalid scalar: out of range'); // 0 is invalid
-            let point, fake; // Fake point is used to const-time mult
-            const mul = (n) => wnaf.wNAFCached(this, n, Point.normalizeZ);
-            /** See docs for {@link EndomorphismOpts} */
-            if (endo) {
-                const { k1neg, k1, k2neg, k2 } = endo.splitScalar(scalar);
-                const { p: k1p, f: k1f } = mul(k1);
-                const { p: k2p, f: k2f } = mul(k2);
-                fake = k1f.add(k2f);
-                point = finishEndo(endo.beta, k1p, k2p, k1neg, k2neg);
-            }
-            else {
-                const { p, f } = mul(scalar);
-                point = p;
-                fake = f;
-            }
-            // Normalize `z` for both points, but return only real one
-            return Point.normalizeZ([point, fake])[0];
-        }
-        /**
-         * Non-constant-time multiplication. Uses double-and-add algorithm.
-         * It's faster, but should only be used when you don't care about
-         * an exposed private key e.g. sig verification, which works over *public* keys.
-         */
-        multiplyUnsafe(sc) {
-            const { endo } = curveOpts;
-            const p = this;
-            if (!Fn.isValid(sc))
-                throw new Error('invalid scalar: out of range'); // 0 is valid
-            if (sc === _0n || p.is0())
-                return Point.ZERO;
-            if (sc === _1n$1)
-                return p; // fast-path
-            if (wnaf.hasPrecomputes(this))
-                return this.multiply(sc);
-            if (endo) {
-                const { k1neg, k1, k2neg, k2 } = endo.splitScalar(sc);
-                // `wNAFCachedUnsafe` is 30% slower
-                const { p1, p2 } = mulEndoUnsafe(Point, p, k1, k2);
-                return finishEndo(endo.beta, p1, p2, k1neg, k2neg);
-            }
-            else {
-                return wnaf.wNAFCachedUnsafe(p, sc);
-            }
-        }
-        multiplyAndAddUnsafe(Q, a, b) {
-            const sum = this.multiplyUnsafe(a).add(Q.multiplyUnsafe(b));
-            return sum.is0() ? undefined : sum;
-        }
-        /**
-         * Converts Projective point to affine (x, y) coordinates.
-         * @param invertedZ Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch
-         */
-        toAffine(invertedZ) {
-            return toAffineMemo(this, invertedZ);
-        }
-        /**
-         * Checks whether Point is free of torsion elements (is in prime subgroup).
-         * Always torsion-free for cofactor=1 curves.
-         */
-        isTorsionFree() {
-            const { isTorsionFree } = curveOpts;
-            if (cofactor === _1n$1)
-                return true;
-            if (isTorsionFree)
-                return isTorsionFree(Point, this);
-            return wnaf.wNAFCachedUnsafe(this, CURVE_ORDER).is0();
-        }
-        clearCofactor() {
-            const { clearCofactor } = curveOpts;
-            if (cofactor === _1n$1)
-                return this; // Fast-path
-            if (clearCofactor)
-                return clearCofactor(Point, this);
-            return this.multiplyUnsafe(cofactor);
-        }
-        toBytes(isCompressed = true) {
-            abool('isCompressed', isCompressed);
-            this.assertValidity();
-            return toBytes(Point, this, isCompressed);
-        }
-        /** @deprecated use `toBytes` */
-        toRawBytes(isCompressed = true) {
-            return this.toBytes(isCompressed);
-        }
-        toHex(isCompressed = true) {
-            return bytesToHex(this.toBytes(isCompressed));
-        }
-        toString() {
-            return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;
-        }
-    }
-    // base / generator point
-    Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);
-    // zero / infinity / identity point
-    Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0
-    // fields
-    Point.Fp = Fp;
-    Point.Fn = Fn;
-    const bits = Fn.BITS;
-    const wnaf = wNAF(Point, curveOpts.endo ? Math.ceil(bits / 2) : bits);
-    return Point;
-}
-// Points start with byte 0x02 when y is even; otherwise 0x03
-function pprefix(hasEvenY) {
-    return Uint8Array.of(hasEvenY ? 0x02 : 0x03);
-}
-function ecdsa(Point, ecdsaOpts, curveOpts = {}) {
-    _validateObject(ecdsaOpts, { hash: 'function' }, {
-        hmac: 'function',
-        lowS: 'boolean',
-        randomBytes: 'function',
-        bits2int: 'function',
-        bits2int_modN: 'function',
-    });
-    const randomBytes_ = ecdsaOpts.randomBytes || randomBytes;
-    const hmac_ = ecdsaOpts.hmac ||
-        ((key, ...msgs) => hmac(ecdsaOpts.hash, key, concatBytes(...msgs)));
-    const { Fp, Fn } = Point;
-    const { ORDER: CURVE_ORDER, BITS: fnBits } = Fn;
-    function isBiggerThanHalfOrder(number) {
-        const HALF = CURVE_ORDER >> _1n$1;
-        return number > HALF;
-    }
-    function normalizeS(s) {
-        return isBiggerThanHalfOrder(s) ? Fn.neg(s) : s;
-    }
-    function aValidRS(title, num) {
-        if (!Fn.isValidNot0(num))
-            throw new Error(`invalid signature ${title}: out of range 1..CURVE.n`);
-    }
-    /**
-     * ECDSA signature with its (r, s) properties. Supports DER & compact representations.
-     */
-    class Signature {
-        constructor(r, s, recovery) {
-            aValidRS('r', r); // r in [1..N-1]
-            aValidRS('s', s); // s in [1..N-1]
-            this.r = r;
-            this.s = s;
-            if (recovery != null)
-                this.recovery = recovery;
-            Object.freeze(this);
-        }
-        // pair (bytes of r, bytes of s)
-        static fromCompact(hex) {
-            const L = Fn.BYTES;
-            const b = ensureBytes('compactSignature', hex, L * 2);
-            return new Signature(Fn.fromBytes(b.subarray(0, L)), Fn.fromBytes(b.subarray(L, L * 2)));
-        }
-        // DER encoded ECDSA signature
-        // https://bitcoin.stackexchange.com/questions/57644/what-are-the-parts-of-a-bitcoin-transaction-input-script
-        static fromDER(hex) {
-            const { r, s } = DER.toSig(ensureBytes('DER', hex));
-            return new Signature(r, s);
-        }
-        /**
-         * @todo remove
-         * @deprecated
-         */
-        assertValidity() { }
-        addRecoveryBit(recovery) {
-            return new Signature(this.r, this.s, recovery);
-        }
-        // ProjPointType<bigint>
-        recoverPublicKey(msgHash) {
-            const FIELD_ORDER = Fp.ORDER;
-            const { r, s, recovery: rec } = this;
-            if (rec == null || ![0, 1, 2, 3].includes(rec))
-                throw new Error('recovery id invalid');
-            // ECDSA recovery is hard for cofactor > 1 curves.
-            // In sign, `r = q.x mod n`, and here we recover q.x from r.
-            // While recovering q.x >= n, we need to add r+n for cofactor=1 curves.
-            // However, for cofactor>1, r+n may not get q.x:
-            // r+n*i would need to be done instead where i is unknown.
-            // To easily get i, we either need to:
-            // a. increase amount of valid recid values (4, 5...); OR
-            // b. prohibit non-prime-order signatures (recid > 1).
-            const hasCofactor = CURVE_ORDER * _2n$1 < FIELD_ORDER;
-            if (hasCofactor && rec > 1)
-                throw new Error('recovery id is ambiguous for h>1 curve');
-            const radj = rec === 2 || rec === 3 ? r + CURVE_ORDER : r;
-            if (!Fp.isValid(radj))
-                throw new Error('recovery id 2 or 3 invalid');
-            const x = Fp.toBytes(radj);
-            const R = Point.fromHex(concatBytes(pprefix((rec & 1) === 0), x));
-            const ir = Fn.inv(radj); // r^-1
-            const h = bits2int_modN(ensureBytes('msgHash', msgHash)); // Truncate hash
-            const u1 = Fn.create(-h * ir); // -hr^-1
-            const u2 = Fn.create(s * ir); // sr^-1
-            // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1). unsafe is fine: there is no private data.
-            const Q = Point.BASE.multiplyUnsafe(u1).add(R.multiplyUnsafe(u2));
-            if (Q.is0())
-                throw new Error('point at infinify');
-            Q.assertValidity();
-            return Q;
-        }
-        // Signatures should be low-s, to prevent malleability.
-        hasHighS() {
-            return isBiggerThanHalfOrder(this.s);
-        }
-        normalizeS() {
-            return this.hasHighS() ? new Signature(this.r, Fn.neg(this.s), this.recovery) : this;
-        }
-        toBytes(format) {
-            if (format === 'compact')
-                return concatBytes(Fn.toBytes(this.r), Fn.toBytes(this.s));
-            if (format === 'der')
-                return hexToBytes(DER.hexFromSig(this));
-            throw new Error('invalid format');
-        }
-        // DER-encoded
-        toDERRawBytes() {
-            return this.toBytes('der');
-        }
-        toDERHex() {
-            return bytesToHex(this.toBytes('der'));
-        }
-        // padded bytes of r, then padded bytes of s
-        toCompactRawBytes() {
-            return this.toBytes('compact');
-        }
-        toCompactHex() {
-            return bytesToHex(this.toBytes('compact'));
-        }
-    }
-    const normPrivateKeyToScalar = _legacyHelperNormPriv(Fn, curveOpts.allowedPrivateKeyLengths, curveOpts.wrapPrivateKey);
-    const utils = {
-        isValidPrivateKey(privateKey) {
-            try {
-                normPrivateKeyToScalar(privateKey);
-                return true;
-            }
-            catch (error) {
-                return false;
-            }
-        },
-        normPrivateKeyToScalar: normPrivateKeyToScalar,
-        /**
-         * Produces cryptographically secure private key from random of size
-         * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.
-         */
-        randomPrivateKey: () => {
-            const n = CURVE_ORDER;
-            return mapHashToField(randomBytes_(getMinHashLength(n)), n);
-        },
-        precompute(windowSize = 8, point = Point.BASE) {
-            return point.precompute(windowSize, false);
-        },
-    };
-    /**
-     * Computes public key for a private key. Checks for validity of the private key.
-     * @param privateKey private key
-     * @param isCompressed whether to return compact (default), or full key
-     * @returns Public key, full when isCompressed=false; short when isCompressed=true
-     */
-    function getPublicKey(privateKey, isCompressed = true) {
-        return Point.fromPrivateKey(privateKey).toBytes(isCompressed);
-    }
-    /**
-     * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.
-     */
-    function isProbPub(item) {
-        if (typeof item === 'bigint')
-            return false;
-        if (item instanceof Point)
-            return true;
-        const arr = ensureBytes('key', item);
-        const length = arr.length;
-        const L = Fp.BYTES;
-        const LC = L + 1; // e.g. 33 for 32
-        const LU = 2 * L + 1; // e.g. 65 for 32
-        if (curveOpts.allowedPrivateKeyLengths || Fn.BYTES === LC) {
-            return undefined;
-        }
-        else {
-            return length === LC || length === LU;
-        }
-    }
-    /**
-     * ECDH (Elliptic Curve Diffie Hellman).
-     * Computes shared public key from private key and public key.
-     * Checks: 1) private key validity 2) shared key is on-curve.
-     * Does NOT hash the result.
-     * @param privateA private key
-     * @param publicB different public key
-     * @param isCompressed whether to return compact (default), or full key
-     * @returns shared public key
-     */
-    function getSharedSecret(privateA, publicB, isCompressed = true) {
-        if (isProbPub(privateA) === true)
-            throw new Error('first arg must be private key');
-        if (isProbPub(publicB) === false)
-            throw new Error('second arg must be public key');
-        const b = Point.fromHex(publicB); // check for being on-curve
-        return b.multiply(normPrivateKeyToScalar(privateA)).toBytes(isCompressed);
-    }
-    // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.
-    // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.
-    // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.
-    // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors
-    const bits2int = ecdsaOpts.bits2int ||
-        function (bytes) {
-            // Our custom check "just in case", for protection against DoS
-            if (bytes.length > 8192)
-                throw new Error('input is too large');
-            // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)
-            // for some cases, since bytes.length * 8 is not actual bitLength.
-            const num = bytesToNumberBE(bytes); // check for == u8 done here
-            const delta = bytes.length * 8 - fnBits; // truncate to nBitLength leftmost bits
-            return delta > 0 ? num >> BigInt(delta) : num;
-        };
-    const bits2int_modN = ecdsaOpts.bits2int_modN ||
-        function (bytes) {
-            return Fn.create(bits2int(bytes)); // can't use bytesToNumberBE here
-        };
-    // NOTE: pads output with zero as per spec
-    const ORDER_MASK = bitMask(fnBits);
-    /**
-     * Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`.
-     */
-    function int2octets(num) {
-        // IMPORTANT: the check ensures working for case `Fn.BYTES != Fn.BITS * 8`
-        aInRange('num < 2^' + fnBits, num, _0n, ORDER_MASK);
-        return Fn.toBytes(num);
-    }
-    // Steps A, D of RFC6979 3.2
-    // Creates RFC6979 seed; converts msg/privKey to numbers.
-    // Used only in sign, not in verify.
-    // NOTE: we cannot assume here that msgHash has same amount of bytes as curve order,
-    // this will be invalid at least for P521. Also it can be bigger for P224 + SHA256
-    function prepSig(msgHash, privateKey, opts = defaultSigOpts) {
-        if (['recovered', 'canonical'].some((k) => k in opts))
-            throw new Error('sign() legacy options not supported');
-        const { hash } = ecdsaOpts;
-        let { lowS, prehash, extraEntropy: ent } = opts; // generates low-s sigs by default
-        if (lowS == null)
-            lowS = true; // RFC6979 3.2: we skip step A, because we already provide hash
-        msgHash = ensureBytes('msgHash', msgHash);
-        validateSigVerOpts(opts);
-        if (prehash)
-            msgHash = ensureBytes('prehashed msgHash', hash(msgHash));
-        // We can't later call bits2octets, since nested bits2int is broken for curves
-        // with fnBits % 8 !== 0. Because of that, we unwrap it here as int2octets call.
-        // const bits2octets = (bits) => int2octets(bits2int_modN(bits))
-        const h1int = bits2int_modN(msgHash);
-        const d = normPrivateKeyToScalar(privateKey); // validate private key, convert to bigint
-        const seedArgs = [int2octets(d), int2octets(h1int)];
-        // extraEntropy. RFC6979 3.6: additional k' (optional).
-        if (ent != null && ent !== false) {
-            // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')
-            const e = ent === true ? randomBytes_(Fp.BYTES) : ent; // generate random bytes OR pass as-is
-            seedArgs.push(ensureBytes('extraEntropy', e)); // check for being bytes
-        }
-        const seed = concatBytes(...seedArgs); // Step D of RFC6979 3.2
-        const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!
-        // Converts signature params into point w r/s, checks result for validity.
-        // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to
-        // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:
-        // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT
-        function k2sig(kBytes) {
-            // RFC 6979 Section 3.2, step 3: k = bits2int(T)
-            // Important: all mod() calls here must be done over N
-            const k = bits2int(kBytes); // Cannot use fields methods, since it is group element
-            if (!Fn.isValidNot0(k))
-                return; // Valid scalars (including k) must be in 1..N-1
-            const ik = Fn.inv(k); // k^-1 mod n
-            const q = Point.BASE.multiply(k).toAffine(); // q = Gk
-            const r = Fn.create(q.x); // r = q.x mod n
-            if (r === _0n)
-                return;
-            const s = Fn.create(ik * Fn.create(m + r * d)); // Not using blinding here, see comment above
-            if (s === _0n)
-                return;
-            let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n$1); // recovery bit (2 or 3, when q.x > n)
-            let normS = s;
-            if (lowS && isBiggerThanHalfOrder(s)) {
-                normS = normalizeS(s); // if lowS was passed, ensure s is always
-                recovery ^= 1; // // in the bottom half of N
-            }
-            return new Signature(r, normS, recovery); // use normS, not s
-        }
-        return { seed, k2sig };
-    }
-    const defaultSigOpts = { lowS: ecdsaOpts.lowS, prehash: false };
-    const defaultVerOpts = { lowS: ecdsaOpts.lowS, prehash: false };
-    /**
-     * Signs message hash with a private key.
-     * ```
-     * sign(m, d, k) where
-     *   (x, y) = G × k
-     *   r = x mod n
-     *   s = (m + dr)/k mod n
-     * ```
-     * @param msgHash NOT message. msg needs to be hashed to `msgHash`, or use `prehash`.
-     * @param privKey private key
-     * @param opts lowS for non-malleable sigs. extraEntropy for mixing randomness into k. prehash will hash first arg.
-     * @returns signature with recovery param
-     */
-    function sign(msgHash, privKey, opts = defaultSigOpts) {
-        const { seed, k2sig } = prepSig(msgHash, privKey, opts); // Steps A, D of RFC6979 3.2.
-        const drbg = createHmacDrbg(ecdsaOpts.hash.outputLen, Fn.BYTES, hmac_);
-        return drbg(seed, k2sig); // Steps B, C, D, E, F, G
-    }
-    // Enable precomputes. Slows down first publicKey computation by 20ms.
-    Point.BASE.precompute(8);
-    /**
-     * Verifies a signature against message hash and public key.
-     * Rejects lowS signatures by default: to override,
-     * specify option `{lowS: false}`. Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:
-     *
-     * ```
-     * verify(r, s, h, P) where
-     *   U1 = hs^-1 mod n
-     *   U2 = rs^-1 mod n
-     *   R = U1⋅G - U2⋅P
-     *   mod(R.x, n) == r
-     * ```
-     */
-    function verify(signature, msgHash, publicKey, opts = defaultVerOpts) {
-        const sg = signature;
-        msgHash = ensureBytes('msgHash', msgHash);
-        publicKey = ensureBytes('publicKey', publicKey);
-        // Verify opts
-        validateSigVerOpts(opts);
-        const { lowS, prehash, format } = opts;
-        // TODO: remove
-        if ('strict' in opts)
-            throw new Error('options.strict was renamed to lowS');
-        if (format !== undefined && !['compact', 'der', 'js'].includes(format))
-            throw new Error('format must be "compact", "der" or "js"');
-        const isHex = typeof sg === 'string' || isBytes(sg);
-        const isObj = !isHex &&
-            !format &&
-            typeof sg === 'object' &&
-            sg !== null &&
-            typeof sg.r === 'bigint' &&
-            typeof sg.s === 'bigint';
-        if (!isHex && !isObj)
-            throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');
-        let _sig = undefined;
-        let P;
-        // deduce signature format
-        try {
-            // if (format === 'js') {
-            //   if (sg != null && !isBytes(sg)) _sig = new Signature(sg.r, sg.s);
-            // } else if (format === 'compact') {
-            //   _sig = Signature.fromCompact(sg);
-            // } else if (format === 'der') {
-            //   _sig = Signature.fromDER(sg);
-            // } else {
-            //   throw new Error('invalid format');
-            // }
-            if (isObj) {
-                if (format === undefined || format === 'js') {
-                    _sig = new Signature(sg.r, sg.s);
-                }
-                else {
-                    throw new Error('invalid format');
-                }
-            }
-            if (isHex) {
-                // TODO: remove this malleable check
-                // Signature can be represented in 2 ways: compact (2*Fn.BYTES) & DER (variable-length).
-                // Since DER can also be 2*Fn.BYTES bytes, we check for it first.
-                try {
-                    if (format !== 'compact')
-                        _sig = Signature.fromDER(sg);
-                }
-                catch (derError) {
-                    if (!(derError instanceof DER.Err))
-                        throw derError;
-                }
-                if (!_sig && format !== 'der')
-                    _sig = Signature.fromCompact(sg);
-            }
-            P = Point.fromHex(publicKey);
-        }
-        catch (error) {
-            return false;
-        }
-        if (!_sig)
-            return false;
-        if (lowS && _sig.hasHighS())
-            return false;
-        // todo: optional.hash => hash
-        if (prehash)
-            msgHash = ecdsaOpts.hash(msgHash);
-        const { r, s } = _sig;
-        const h = bits2int_modN(msgHash); // Cannot use fields methods, since it is group element
-        const is = Fn.inv(s); // s^-1
-        const u1 = Fn.create(h * is); // u1 = hs^-1 mod n
-        const u2 = Fn.create(r * is); // u2 = rs^-1 mod n
-        const R = Point.BASE.multiplyUnsafe(u1).add(P.multiplyUnsafe(u2));
-        if (R.is0())
-            return false;
-        const v = Fn.create(R.x); // v = r.x mod n
-        return v === r;
-    }
-    // TODO: clarify API for cloning .clone({hash: sha512}) ? .createWith({hash: sha512})?
-    // const clone = (hash: CHash): ECDSA => ecdsa(Point, { ...ecdsaOpts, ...getHash(hash) }, curveOpts);
-    return Object.freeze({
-        getPublicKey,
-        getSharedSecret,
-        sign,
-        verify,
-        utils,
-        Point,
-        Signature,
-    });
-}
-function _weierstrass_legacy_opts_to_new(c) {
-    const CURVE = {
-        a: c.a,
-        b: c.b,
-        p: c.Fp.ORDER,
-        n: c.n,
-        h: c.h,
-        Gx: c.Gx,
-        Gy: c.Gy,
-    };
-    const Fp = c.Fp;
-    const Fn = Field(CURVE.n, c.nBitLength);
-    const curveOpts = {
-        Fp,
-        Fn,
-        allowedPrivateKeyLengths: c.allowedPrivateKeyLengths,
-        allowInfinityPoint: c.allowInfinityPoint,
-        endo: c.endo,
-        wrapPrivateKey: c.wrapPrivateKey,
-        isTorsionFree: c.isTorsionFree,
-        clearCofactor: c.clearCofactor,
-        fromBytes: c.fromBytes,
-        toBytes: c.toBytes,
-    };
-    return { CURVE, curveOpts };
-}
-function _ecdsa_legacy_opts_to_new(c) {
-    const { CURVE, curveOpts } = _weierstrass_legacy_opts_to_new(c);
-    const ecdsaOpts = {
-        hash: c.hash,
-        hmac: c.hmac,
-        randomBytes: c.randomBytes,
-        lowS: c.lowS,
-        bits2int: c.bits2int,
-        bits2int_modN: c.bits2int_modN,
-    };
-    return { CURVE, curveOpts, ecdsaOpts };
-}
-function _ecdsa_new_output_to_legacy(c, ecdsa) {
-    return Object.assign({}, ecdsa, {
-        ProjectivePoint: ecdsa.Point,
-        CURVE: c,
-    });
-}
-// _ecdsa_legacy
-function weierstrass(c) {
-    const { CURVE, curveOpts, ecdsaOpts } = _ecdsa_legacy_opts_to_new(c);
-    const Point = weierstrassN(CURVE, curveOpts);
-    const signs = ecdsa(Point, ecdsaOpts, curveOpts);
-    return _ecdsa_new_output_to_legacy(c, signs);
-}
-
-/**
- * Utilities for short weierstrass curves, combined with noble-hashes.
- * @module
- */
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-function createCurve(curveDef, defHash) {
-    const create = (hash) => weierstrass({ ...curveDef, hash: hash });
-    return { ...create(defHash), create };
-}
-
-/**
- * SECG secp256k1. See [pdf](https://www.secg.org/sec2-v2.pdf).
- *
- * Belongs to Koblitz curves: it has efficiently-computable GLV endomorphism ψ,
- * check out {@link EndomorphismOpts}. Seems to be rigid (not backdoored).
- * @module
- */
-/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-// Seems like generator was produced from some seed:
-// `Point.BASE.multiply(Point.Fn.inv(2n, N)).toAffine().x`
-// // gives short x 0x3b78ce563f89a0ed9414f5aa28ad0d96d6795f9c63n
-const secp256k1_CURVE = {
-    p: BigInt('0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'),
-    n: BigInt('0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141'),
-    h: BigInt(1),
-    a: BigInt(0),
-    b: BigInt(7),
-    Gx: BigInt('0x79be667ef9dcbbac55a06295ce870b07029bfcdb2dce28d959f2815b16f81798'),
-    Gy: BigInt('0x483ada7726a3c4655da4fbfc0e1108a8fd17b448a68554199c47d08ffb10d4b8'),
-};
-BigInt(0);
-const _1n = BigInt(1);
-const _2n = BigInt(2);
-const divNearest = (a, b) => (a + b / _2n) / b;
-/**
- * √n = n^((p+1)/4) for fields p = 3 mod 4. We unwrap the loop and multiply bit-by-bit.
- * (P+1n/4n).toString(2) would produce bits [223x 1, 0, 22x 1, 4x 0, 11, 00]
- */
-function sqrtMod(y) {
-    const P = secp256k1_CURVE.p;
-    // prettier-ignore
-    const _3n = BigInt(3), _6n = BigInt(6), _11n = BigInt(11), _22n = BigInt(22);
-    // prettier-ignore
-    const _23n = BigInt(23), _44n = BigInt(44), _88n = BigInt(88);
-    const b2 = (y * y * y) % P; // x^3, 11
-    const b3 = (b2 * b2 * y) % P; // x^7
-    const b6 = (pow2(b3, _3n, P) * b3) % P;
-    const b9 = (pow2(b6, _3n, P) * b3) % P;
-    const b11 = (pow2(b9, _2n, P) * b2) % P;
-    const b22 = (pow2(b11, _11n, P) * b11) % P;
-    const b44 = (pow2(b22, _22n, P) * b22) % P;
-    const b88 = (pow2(b44, _44n, P) * b44) % P;
-    const b176 = (pow2(b88, _88n, P) * b88) % P;
-    const b220 = (pow2(b176, _44n, P) * b44) % P;
-    const b223 = (pow2(b220, _3n, P) * b3) % P;
-    const t1 = (pow2(b223, _23n, P) * b22) % P;
-    const t2 = (pow2(t1, _6n, P) * b2) % P;
-    const root = pow2(t2, _2n, P);
-    if (!Fpk1.eql(Fpk1.sqr(root), y))
-        throw new Error('Cannot find square root');
-    return root;
-}
-const Fpk1 = Field(secp256k1_CURVE.p, undefined, undefined, { sqrt: sqrtMod });
-/**
- * secp256k1 curve, ECDSA and ECDH methods.
- *
- * Field: `2n**256n - 2n**32n - 2n**9n - 2n**8n - 2n**7n - 2n**6n - 2n**4n - 1n`
- *
- * @example
- * ```js
- * import { secp256k1 } from '@noble/curves/secp256k1';
- * const priv = secp256k1.utils.randomPrivateKey();
- * const pub = secp256k1.getPublicKey(priv);
- * const msg = new Uint8Array(32).fill(1); // message hash (not message) in ecdsa
- * const sig = secp256k1.sign(msg, priv); // `{prehash: true}` option is available
- * const isValid = secp256k1.verify(sig, msg, pub) === true;
- * ```
- */
-const secp256k1 = createCurve({
-    ...secp256k1_CURVE,
-    Fp: Fpk1,
-    lowS: true, // Allow only low-S signatures by default in sign() and verify()
-    endo: {
-        // Endomorphism, see above
-        beta: BigInt('0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee'),
-        splitScalar: (k) => {
-            const n = secp256k1_CURVE.n;
-            const a1 = BigInt('0x3086d221a7d46bcde86c90e49284eb15');
-            const b1 = -_1n * BigInt('0xe4437ed6010e88286f547fa90abfe4c3');
-            const a2 = BigInt('0x114ca50f7a8e2f3f657c1108d9d44cfd8');
-            const b2 = a1;
-            const POW_2_128 = BigInt('0x100000000000000000000000000000000'); // (2n**128n).toString(16)
-            const c1 = divNearest(b2 * k, n);
-            const c2 = divNearest(-b1 * k, n);
-            let k1 = mod(k - c1 * a1 - c2 * a2, n);
-            let k2 = mod(-c1 * b1 - c2 * b2, n);
-            const k1neg = k1 > POW_2_128;
-            const k2neg = k2 > POW_2_128;
-            if (k1neg)
-                k1 = n - k1;
-            if (k2neg)
-                k2 = n - k2;
-            if (k1 > POW_2_128 || k2 > POW_2_128) {
-                throw new Error('splitScalar: Endomorphism failed, k=' + k);
-            }
-            return { k1neg, k1, k2neg, k2 };
-        },
-    },
-}, sha256);
-
-/**
-
-SHA1 (RFC 3174), MD5 (RFC 1321) and RIPEMD160 (RFC 2286) legacy, weak hash functions.
-Don't use them in a new protocol. What "weak" means:
-
-- Collisions can be made with 2^18 effort in MD5, 2^60 in SHA1, 2^80 in RIPEMD160.
-- No practical pre-image attacks (only theoretical, 2^123.4)
-- HMAC seems kinda ok: https://datatracker.ietf.org/doc/html/rfc6151
- * @module
- */
-// RIPEMD-160
-const Rho160 = /* @__PURE__ */ Uint8Array.from([
-    7, 4, 13, 1, 10, 6, 15, 3, 12, 0, 9, 5, 2, 14, 11, 8,
-]);
-const Id160 = /* @__PURE__ */ (() => Uint8Array.from(new Array(16).fill(0).map((_, i) => i)))();
-const Pi160 = /* @__PURE__ */ (() => Id160.map((i) => (9 * i + 5) % 16))();
-const idxLR = /* @__PURE__ */ (() => {
-    const L = [Id160];
-    const R = [Pi160];
-    const res = [L, R];
-    for (let i = 0; i < 4; i++)
-        for (let j of res)
-            j.push(j[i].map((k) => Rho160[k]));
-    return res;
-})();
-const idxL = /* @__PURE__ */ (() => idxLR[0])();
-const idxR = /* @__PURE__ */ (() => idxLR[1])();
-// const [idxL, idxR] = idxLR;
-const shifts160 = /* @__PURE__ */ [
-    [11, 14, 15, 12, 5, 8, 7, 9, 11, 13, 14, 15, 6, 7, 9, 8],
-    [12, 13, 11, 15, 6, 9, 9, 7, 12, 15, 11, 13, 7, 8, 7, 7],
-    [13, 15, 14, 11, 7, 7, 6, 8, 13, 14, 13, 12, 5, 5, 6, 9],
-    [14, 11, 12, 14, 8, 6, 5, 5, 15, 12, 15, 14, 9, 9, 8, 6],
-    [15, 12, 13, 13, 9, 5, 8, 6, 14, 11, 12, 11, 8, 6, 5, 5],
-].map((i) => Uint8Array.from(i));
-const shiftsL160 = /* @__PURE__ */ idxL.map((idx, i) => idx.map((j) => shifts160[i][j]));
-const shiftsR160 = /* @__PURE__ */ idxR.map((idx, i) => idx.map((j) => shifts160[i][j]));
-const Kl160 = /* @__PURE__ */ Uint32Array.from([
-    0x00000000, 0x5a827999, 0x6ed9eba1, 0x8f1bbcdc, 0xa953fd4e,
-]);
-const Kr160 = /* @__PURE__ */ Uint32Array.from([
-    0x50a28be6, 0x5c4dd124, 0x6d703ef3, 0x7a6d76e9, 0x00000000,
-]);
-// It's called f() in spec.
-function ripemd_f(group, x, y, z) {
-    if (group === 0)
-        return x ^ y ^ z;
-    if (group === 1)
-        return (x & y) | (~x & z);
-    if (group === 2)
-        return (x | ~y) ^ z;
-    if (group === 3)
-        return (x & z) | (y & ~z);
-    return x ^ (y | ~z);
-}
-// Reusable temporary buffer
-const BUF_160 = /* @__PURE__ */ new Uint32Array(16);
-class RIPEMD160 extends HashMD {
-    constructor() {
-        super(64, 20, 8, true);
-        this.h0 = 0x67452301 | 0;
-        this.h1 = 0xefcdab89 | 0;
-        this.h2 = 0x98badcfe | 0;
-        this.h3 = 0x10325476 | 0;
-        this.h4 = 0xc3d2e1f0 | 0;
-    }
-    get() {
-        const { h0, h1, h2, h3, h4 } = this;
-        return [h0, h1, h2, h3, h4];
-    }
-    set(h0, h1, h2, h3, h4) {
-        this.h0 = h0 | 0;
-        this.h1 = h1 | 0;
-        this.h2 = h2 | 0;
-        this.h3 = h3 | 0;
-        this.h4 = h4 | 0;
-    }
-    process(view, offset) {
-        for (let i = 0; i < 16; i++, offset += 4)
-            BUF_160[i] = view.getUint32(offset, true);
-        // prettier-ignore
-        let al = this.h0 | 0, ar = al, bl = this.h1 | 0, br = bl, cl = this.h2 | 0, cr = cl, dl = this.h3 | 0, dr = dl, el = this.h4 | 0, er = el;
-        // Instead of iterating 0 to 80, we split it into 5 groups
-        // And use the groups in constants, functions, etc. Much simpler
-        for (let group = 0; group < 5; group++) {
-            const rGroup = 4 - group;
-            const hbl = Kl160[group], hbr = Kr160[group]; // prettier-ignore
-            const rl = idxL[group], rr = idxR[group]; // prettier-ignore
-            const sl = shiftsL160[group], sr = shiftsR160[group]; // prettier-ignore
-            for (let i = 0; i < 16; i++) {
-                const tl = (rotl(al + ripemd_f(group, bl, cl, dl) + BUF_160[rl[i]] + hbl, sl[i]) + el) | 0;
-                al = el, el = dl, dl = rotl(cl, 10) | 0, cl = bl, bl = tl; // prettier-ignore
-            }
-            // 2 loops are 10% faster
-            for (let i = 0; i < 16; i++) {
-                const tr = (rotl(ar + ripemd_f(rGroup, br, cr, dr) + BUF_160[rr[i]] + hbr, sr[i]) + er) | 0;
-                ar = er, er = dr, dr = rotl(cr, 10) | 0, cr = br, br = tr; // prettier-ignore
-            }
-        }
-        // Add the compressed chunk to the current hash value
-        this.set((this.h1 + cl + dr) | 0, (this.h2 + dl + er) | 0, (this.h3 + el + ar) | 0, (this.h4 + al + br) | 0, (this.h0 + bl + cr) | 0);
-    }
-    roundClean() {
-        clean(BUF_160);
-    }
-    destroy() {
-        this.destroyed = true;
-        clean(this.buffer);
-        this.set(0, 0, 0, 0, 0);
-    }
-}
-/**
- * RIPEMD-160 - a legacy hash function from 1990s.
- * * https://homes.esat.kuleuven.be/~bosselae/ripemd160.html
- * * https://homes.esat.kuleuven.be/~bosselae/ripemd160/pdf/AB-9601/AB-9601.pdf
- */
-const ripemd160 = /* @__PURE__ */ createHasher(() => new RIPEMD160());
-
-/**
- * @module BIP32 hierarchical deterministic (HD) wallets over secp256k1.
- * @example
- * ```js
- * import { HDKey } from "@scure/bip32";
- * const hdkey1 = HDKey.fromMasterSeed(seed);
- * const hdkey2 = HDKey.fromExtendedKey(base58key);
- * const hdkey3 = HDKey.fromJSON({ xpriv: string });
- *
- * // props
- * [hdkey1.depth, hdkey1.index, hdkey1.chainCode];
- * console.log(hdkey2.privateKey, hdkey2.publicKey);
- * console.log(hdkey3.derive("m/0/2147483647'/1"));
- * const sig = hdkey3.sign(hash);
- * hdkey3.verify(hash, sig);
- * ```
- */
-/*! scure-bip32 - MIT License (c) 2022 Patricio Palladino, Paul Miller (paulmillr.com) */
-const Point = secp256k1.ProjectivePoint;
-const base58check = createBase58check(sha256);
-function bytesToNumber(bytes) {
-    abytes(bytes);
-    const h = bytes.length === 0 ? '0' : bytesToHex(bytes);
-    return BigInt('0x' + h);
-}
-function numberToBytes(num) {
-    if (typeof num !== 'bigint')
-        throw new Error('bigint expected');
-    return hexToBytes(num.toString(16).padStart(64, '0'));
-}
-const MASTER_SECRET = utf8ToBytes('Bitcoin seed');
-// Bitcoin hardcoded by default
-const BITCOIN_VERSIONS = { private: 0x0488ade4, public: 0x0488b21e };
-const HARDENED_OFFSET = 0x80000000;
-const hash160 = (data) => ripemd160(sha256(data));
-const fromU32 = (data) => createView(data).getUint32(0, false);
-const toU32 = (n) => {
-    if (!Number.isSafeInteger(n) || n < 0 || n > 2 ** 32 - 1) {
-        throw new Error('invalid number, should be from 0 to 2**32-1, got ' + n);
-    }
-    const buf = new Uint8Array(4);
-    createView(buf).setUint32(0, n, false);
-    return buf;
-};
-class HDKey {
-    get fingerprint() {
-        if (!this.pubHash) {
-            throw new Error('No publicKey set!');
-        }
-        return fromU32(this.pubHash);
-    }
-    get identifier() {
-        return this.pubHash;
-    }
-    get pubKeyHash() {
-        return this.pubHash;
-    }
-    get privateKey() {
-        return this.privKeyBytes || null;
-    }
-    get publicKey() {
-        return this.pubKey || null;
-    }
-    get privateExtendedKey() {
-        const priv = this.privateKey;
-        if (!priv) {
-            throw new Error('No private key');
-        }
-        return base58check.encode(this.serialize(this.versions.private, concatBytes(new Uint8Array([0]), priv)));
-    }
-    get publicExtendedKey() {
-        if (!this.pubKey) {
-            throw new Error('No public key');
-        }
-        return base58check.encode(this.serialize(this.versions.public, this.pubKey));
-    }
-    static fromMasterSeed(seed, versions = BITCOIN_VERSIONS) {
-        abytes(seed);
-        if (8 * seed.length < 128 || 8 * seed.length > 512) {
-            throw new Error('HDKey: seed length must be between 128 and 512 bits; 256 bits is advised, got ' +
-                seed.length);
-        }
-        const I = hmac(sha512, MASTER_SECRET, seed);
-        return new HDKey({
-            versions,
-            chainCode: I.slice(32),
-            privateKey: I.slice(0, 32),
-        });
-    }
-    static fromExtendedKey(base58key, versions = BITCOIN_VERSIONS) {
-        // => version(4) || depth(1) || fingerprint(4) || index(4) || chain(32) || key(33)
-        const keyBuffer = base58check.decode(base58key);
-        const keyView = createView(keyBuffer);
-        const version = keyView.getUint32(0, false);
-        const opt = {
-            versions,
-            depth: keyBuffer[4],
-            parentFingerprint: keyView.getUint32(5, false),
-            index: keyView.getUint32(9, false),
-            chainCode: keyBuffer.slice(13, 45),
-        };
-        const key = keyBuffer.slice(45);
-        const isPriv = key[0] === 0;
-        if (version !== versions[isPriv ? 'private' : 'public']) {
-            throw new Error('Version mismatch');
-        }
-        if (isPriv) {
-            return new HDKey({ ...opt, privateKey: key.slice(1) });
-        }
-        else {
-            return new HDKey({ ...opt, publicKey: key });
-        }
-    }
-    static fromJSON(json) {
-        return HDKey.fromExtendedKey(json.xpriv);
-    }
-    constructor(opt) {
-        this.depth = 0;
-        this.index = 0;
-        this.chainCode = null;
-        this.parentFingerprint = 0;
-        if (!opt || typeof opt !== 'object') {
-            throw new Error('HDKey.constructor must not be called directly');
-        }
-        this.versions = opt.versions || BITCOIN_VERSIONS;
-        this.depth = opt.depth || 0;
-        this.chainCode = opt.chainCode || null;
-        this.index = opt.index || 0;
-        this.parentFingerprint = opt.parentFingerprint || 0;
-        if (!this.depth) {
-            if (this.parentFingerprint || this.index) {
-                throw new Error('HDKey: zero depth with non-zero index/parent fingerprint');
-            }
-        }
-        if (opt.publicKey && opt.privateKey) {
-            throw new Error('HDKey: publicKey and privateKey at same time.');
-        }
-        if (opt.privateKey) {
-            if (!secp256k1.utils.isValidPrivateKey(opt.privateKey)) {
-                throw new Error('Invalid private key');
-            }
-            this.privKey =
-                typeof opt.privateKey === 'bigint' ? opt.privateKey : bytesToNumber(opt.privateKey);
-            this.privKeyBytes = numberToBytes(this.privKey);
-            this.pubKey = secp256k1.getPublicKey(opt.privateKey, true);
-        }
-        else if (opt.publicKey) {
-            this.pubKey = Point.fromHex(opt.publicKey).toRawBytes(true); // force compressed point
-        }
-        else {
-            throw new Error('HDKey: no public or private key provided');
-        }
-        this.pubHash = hash160(this.pubKey);
-    }
-    derive(path) {
-        if (!/^[mM]'?/.test(path)) {
-            throw new Error('Path must start with "m" or "M"');
-        }
-        if (/^[mM]'?$/.test(path)) {
-            return this;
-        }
-        const parts = path.replace(/^[mM]'?\//, '').split('/');
-        // tslint:disable-next-line
-        let child = this;
-        for (const c of parts) {
-            const m = /^(\d+)('?)$/.exec(c);
-            const m1 = m && m[1];
-            if (!m || m.length !== 3 || typeof m1 !== 'string')
-                throw new Error('invalid child index: ' + c);
-            let idx = +m1;
-            if (!Number.isSafeInteger(idx) || idx >= HARDENED_OFFSET) {
-                throw new Error('Invalid index');
-            }
-            // hardened key
-            if (m[2] === "'") {
-                idx += HARDENED_OFFSET;
-            }
-            child = child.deriveChild(idx);
-        }
-        return child;
-    }
-    deriveChild(index) {
-        if (!this.pubKey || !this.chainCode) {
-            throw new Error('No publicKey or chainCode set');
-        }
-        let data = toU32(index);
-        if (index >= HARDENED_OFFSET) {
-            // Hardened
-            const priv = this.privateKey;
-            if (!priv) {
-                throw new Error('Could not derive hardened child key');
-            }
-            // Hardened child: 0x00 || ser256(kpar) || ser32(index)
-            data = concatBytes(new Uint8Array([0]), priv, data);
-        }
-        else {
-            // Normal child: serP(point(kpar)) || ser32(index)
-            data = concatBytes(this.pubKey, data);
-        }
-        const I = hmac(sha512, this.chainCode, data);
-        const childTweak = bytesToNumber(I.slice(0, 32));
-        const chainCode = I.slice(32);
-        if (!secp256k1.utils.isValidPrivateKey(childTweak)) {
-            throw new Error('Tweak bigger than curve order');
-        }
-        const opt = {
-            versions: this.versions,
-            chainCode,
-            depth: this.depth + 1,
-            parentFingerprint: this.fingerprint,
-            index,
-        };
-        try {
-            // Private parent key -> private child key
-            if (this.privateKey) {
-                const added = mod(this.privKey + childTweak, secp256k1.CURVE.n);
-                if (!secp256k1.utils.isValidPrivateKey(added)) {
-                    throw new Error('The tweak was out of range or the resulted private key is invalid');
-                }
-                opt.privateKey = added;
-            }
-            else {
-                const added = Point.fromHex(this.pubKey).add(Point.fromPrivateKey(childTweak));
-                // Cryptographically impossible: hmac-sha512 preimage would need to be found
-                if (added.equals(Point.ZERO)) {
-                    throw new Error('The tweak was equal to negative P, which made the result key invalid');
-                }
-                opt.publicKey = added.toRawBytes(true);
-            }
-            return new HDKey(opt);
-        }
-        catch (err) {
-            return this.deriveChild(index + 1);
-        }
-    }
-    sign(hash) {
-        if (!this.privateKey) {
-            throw new Error('No privateKey set!');
-        }
-        abytes(hash, 32);
-        return secp256k1.sign(hash, this.privKey).toCompactRawBytes();
-    }
-    verify(hash, signature) {
-        abytes(hash, 32);
-        abytes(signature, 64);
-        if (!this.publicKey) {
-            throw new Error('No publicKey set!');
-        }
-        let sig;
-        try {
-            sig = secp256k1.Signature.fromCompact(signature);
-        }
-        catch (error) {
-            return false;
-        }
-        return secp256k1.verify(sig, hash, this.publicKey);
-    }
-    wipePrivateData() {
-        this.privKey = undefined;
-        if (this.privKeyBytes) {
-            this.privKeyBytes.fill(0);
-            this.privKeyBytes = undefined;
-        }
-        return this;
-    }
-    toJSON() {
-        return {
-            xpriv: this.privateExtendedKey,
-            xpub: this.publicExtendedKey,
-        };
-    }
-    serialize(version, key) {
-        if (!this.chainCode) {
-            throw new Error('No chainCode set');
-        }
-        abytes(key, 33);
-        // version(4) || depth(1) || fingerprint(4) || index(4) || chain(32) || key(33)
-        return concatBytes(toU32(version), new Uint8Array([this.depth]), toU32(this.parentFingerprint), toU32(this.index), this.chainCode, key);
-    }
-}
-
 /**
  * Chain identifier for Radix.
  * This constant represents the identifier for the Radix Chain.
@@ -3837,9 +475,11 @@ class Client extends BaseXChainClient {
         }
         const updatedDerivationPath = derivationPath.replace(/\/$/, '') + `/${index}'`;
         if (this.curve === 'Ed25519') {
-            const seedHex = seed.toString('hex');
-            const keys = derivePath(updatedDerivationPath, seedHex);
-            return keys.key;
+            const masterKey = slip10.fromMasterSeed(seed);
+            const childKey = masterKey.derive(updatedDerivationPath);
+            if (!childKey.privateKey)
+                throw new Error('child does not have a privateKey');
+            return Buffer.from(childKey.privateKey);
         }
         else {
             const node = HDKey.fromMasterSeed(seed);
@@ -3941,7 +581,7 @@ class Client extends BaseXChainClient {
             }
             return true;
         }
-        catch (error) {
+        catch (_error) {
             return false;
         }
     }
@@ -4015,7 +655,7 @@ class Client extends BaseXChainClient {
                         txList.txs.push(transaction);
                     }
                 }
-                catch (error) { }
+                catch (_error) { }
             }
             txList.total = txList.txs.length;
             return txList;
@@ -4052,7 +692,7 @@ class Client extends BaseXChainClient {
                     throw new Error('Incomplete transaction data received');
                 }
             }
-            catch (error) {
+            catch (_error) {
                 throw new Error('Failed to fetch transaction data');
             }
         });
@@ -4103,7 +743,7 @@ class Client extends BaseXChainClient {
                 };
                 return transaction;
             }
-            catch (error) {
+            catch (_error) {
                 return {
                     from: [],
                     to: [],