nostr-tools 1.1.1 → 1.1.2

package/README.md

@@ -182,7 +182,7 @@ let pk2 = getPublicKey(sk2)
 
 // on the sender side
 let message = 'hello'
-let ciphertext = await nip04.encrypt(sk1, pk2, 'hello')
+let ciphertext = await nip04.encrypt(sk1, pk2, message)
 
 let event = {
   kind: 4,
@@ -196,7 +196,7 @@ sendEvent(event)
 
 // on the receiver side
 sub.on('event', (event) => {
-  let sender = event.tags.find(([k, v]) => k === 'p' && && v && v !== '')[1]
+  let sender = event.tags.find(([k, v]) => k === 'p' && v && v !== '')[1]
   pk1 === sender
   let plaintext = await nip04.decrypt(sk2, pk1, event.content)
 })

package/lib/nostr.bundle.js

@@ -3644,7 +3644,38 @@ zoo`.split("\n");
     Gy: BigInt("32670510020758816978083085130507043184471273380659243275938904335757337482424"),
     beta: BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee")
   });
-  function weistrass(x) {
+  var divNearest = (a, b) => (a + b / _2n) / b;
+  var endo = {
+    beta: BigInt("0x7ae96a2b657c07106e64479eac3434e99cf0497512f58995c1396c28719501ee"),
+    splitScalar(k) {
+      const { n } = CURVE;
+      const a1 = BigInt("0x3086d221a7d46bcde86c90e49284eb15");
+      const b1 = -_1n * BigInt("0xe4437ed6010e88286f547fa90abfe4c3");
+      const a2 = BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8");
+      const b2 = a1;
+      const POW_2_128 = BigInt("0x100000000000000000000000000000000");
+      const c1 = divNearest(b2 * k, n);
+      const c2 = divNearest(-b1 * k, n);
+      let k1 = mod(k - c1 * a1 - c2 * a2, n);
+      let k2 = mod(-c1 * b1 - c2 * b2, n);
+      const k1neg = k1 > POW_2_128;
+      const k2neg = k2 > POW_2_128;
+      if (k1neg)
+        k1 = n - k1;
+      if (k2neg)
+        k2 = n - k2;
+      if (k1 > POW_2_128 || k2 > POW_2_128) {
+        throw new Error("splitScalarEndo: Endomorphism failed, k=" + k);
+      }
+      return { k1neg, k1, k2neg, k2 };
+    }
+  };
+  var fieldLen = 32;
+  var groupLen = 32;
+  var hashLen = 32;
+  var compressedLen = fieldLen + 1;
+  var uncompressedLen = 2 * fieldLen + 1;
+  function weierstrass(x) {
     const { a, b } = CURVE;
     const x2 = mod(x * x);
     const x3 = mod(x2 * x);
@@ -3656,6 +3687,10 @@ zoo`.split("\n");
       super(message);
     }
   };
+  function assertJacPoint(other) {
+    if (!(other instanceof JacobianPoint))
+      throw new TypeError("JacobianPoint expected");
+  }
   var JacobianPoint = class {
     constructor(x, y, z) {
       this.x = x;
@@ -3666,6 +3701,8 @@ zoo`.split("\n");
       if (!(p instanceof Point)) {
         throw new TypeError("JacobianPoint#fromAffine: expected Point");
       }
+      if (p.equals(Point.ZERO))
+        return JacobianPoint.ZERO;
       return new JacobianPoint(p.x, p.y, _1n);
     }
     static toAffineBatch(points) {
@@ -3676,8 +3713,7 @@ zoo`.split("\n");
       return JacobianPoint.toAffineBatch(points).map(JacobianPoint.fromAffine);
     }
     equals(other) {
-      if (!(other instanceof JacobianPoint))
-        throw new TypeError("JacobianPoint expected");
+      assertJacPoint(other);
       const { x: X1, y: Y1, z: Z1 } = this;
       const { x: X2, y: Y2, z: Z2 } = other;
       const Z1Z1 = mod(Z1 * Z1);
@@ -3706,8 +3742,7 @@ zoo`.split("\n");
       return new JacobianPoint(X3, Y3, Z3);
     }
     add(other) {
-      if (!(other instanceof JacobianPoint))
-        throw new TypeError("JacobianPoint expected");
+      assertJacPoint(other);
       const { x: X1, y: Y1, z: Z1 } = this;
       const { x: X2, y: Y2, z: Z2 } = other;
       if (X2 === _0n || Y2 === _0n)
@@ -3758,7 +3793,7 @@ zoo`.split("\n");
         }
         return p;
       }
-      let { k1neg, k1, k2neg, k2 } = splitScalarEndo(n);
+      let { k1neg, k1, k2neg, k2 } = endo.splitScalar(n);
       let k1p = P0;
       let k2p = P0;
       let d = this;
@@ -3775,7 +3810,7 @@ zoo`.split("\n");
         k1p = k1p.negate();
       if (k2neg)
         k2p = k2p.negate();
-      k2p = new JacobianPoint(mod(k2p.x * CURVE.beta), k2p.y, k2p.z);
+      k2p = new JacobianPoint(mod(k2p.x * endo.beta), k2p.y, k2p.z);
       return k1p.add(k2p);
     }
     precomputeWindow(W) {
@@ -3810,7 +3845,7 @@ zoo`.split("\n");
         }
       }
       let p = JacobianPoint.ZERO;
-      let f2 = JacobianPoint.ZERO;
+      let f2 = JacobianPoint.BASE;
       const windows = 1 + (USE_ENDOMORPHISM ? 128 / W : 256 / W);
       const windowSize = 2 ** (W - 1);
       const mask = BigInt(2 ** W - 1);
@@ -3824,16 +3859,14 @@ zoo`.split("\n");
           wbits -= maxNumber;
           n += _1n;
         }
+        const offset1 = offset;
+        const offset2 = offset + Math.abs(wbits) - 1;
+        const cond1 = window % 2 !== 0;
+        const cond2 = wbits < 0;
         if (wbits === 0) {
-          let pr = precomputes[offset];
-          if (window % 2)
-            pr = pr.negate();
-          f2 = f2.add(pr);
+          f2 = f2.add(constTimeNegate(cond1, precomputes[offset1]));
         } else {
-          let cached = precomputes[offset + Math.abs(wbits) - 1];
-          if (wbits < 0)
-            cached = cached.negate();
-          p = p.add(cached);
+          p = p.add(constTimeNegate(cond2, precomputes[offset2]));
         }
       }
       return { p, f: f2 };
@@ -3843,14 +3876,12 @@ zoo`.split("\n");
       let point;
       let fake;
       if (USE_ENDOMORPHISM) {
-        const { k1neg, k1, k2neg, k2 } = splitScalarEndo(n);
+        const { k1neg, k1, k2neg, k2 } = endo.splitScalar(n);
         let { p: k1p, f: f1p } = this.wNAF(k1, affinePoint);
         let { p: k2p, f: f2p } = this.wNAF(k2, affinePoint);
-        if (k1neg)
-          k1p = k1p.negate();
-        if (k2neg)
-          k2p = k2p.negate();
-        k2p = new JacobianPoint(mod(k2p.x * CURVE.beta), k2p.y, k2p.z);
+        k1p = constTimeNegate(k1neg, k1p);
+        k2p = constTimeNegate(k2neg, k2p);
+        k2p = new JacobianPoint(mod(k2p.x * endo.beta), k2p.y, k2p.z);
         point = k1p.add(k2p);
         fake = f1p.add(f2p);
       } else {
@@ -3860,14 +3891,19 @@ zoo`.split("\n");
       }
       return JacobianPoint.normalizeZ([point, fake])[0];
     }
-    toAffine(invZ = invert(this.z)) {
+    toAffine(invZ) {
       const { x, y, z } = this;
+      const is0 = this.equals(JacobianPoint.ZERO);
+      if (invZ == null)
+        invZ = is0 ? _8n : invert(z);
       const iz1 = invZ;
       const iz2 = mod(iz1 * iz1);
       const iz3 = mod(iz2 * iz1);
       const ax = mod(x * iz2);
       const ay = mod(y * iz3);
       const zz = mod(z * iz1);
+      if (is0)
+        return Point.ZERO;
       if (zz !== _1n)
         throw new Error("invZ was invalid");
       return new Point(ax, ay);
@@ -3875,6 +3911,10 @@ zoo`.split("\n");
   };
   JacobianPoint.BASE = new JacobianPoint(CURVE.Gx, CURVE.Gy, _1n);
   JacobianPoint.ZERO = new JacobianPoint(_0n, _1n, _0n);
+  function constTimeNegate(condition, item) {
+    const neg = item.negate();
+    return condition ? neg : item;
+  }
   var pointPrecomputes = /* @__PURE__ */ new WeakMap();
   var Point = class {
     constructor(x, y) {
@@ -3893,7 +3933,7 @@ zoo`.split("\n");
       const x = bytesToNumber(isShort ? bytes2 : bytes2.subarray(1));
       if (!isValidFieldElement(x))
         throw new Error("Point is not on curve");
-      const y2 = weistrass(x);
+      const y2 = weierstrass(x);
       let y = sqrtMod(y2);
       const isYOdd = (y & _1n) === _1n;
       if (isShort) {
@@ -3909,8 +3949,8 @@ zoo`.split("\n");
       return point;
     }
     static fromUncompressedHex(bytes2) {
-      const x = bytesToNumber(bytes2.subarray(1, 33));
-      const y = bytesToNumber(bytes2.subarray(33, 65));
+      const x = bytesToNumber(bytes2.subarray(1, fieldLen + 1));
+      const y = bytesToNumber(bytes2.subarray(fieldLen + 1, fieldLen * 2 + 1));
       const point = new Point(x, y);
       point.assertValidity();
       return point;
@@ -3919,29 +3959,30 @@ zoo`.split("\n");
       const bytes2 = ensureBytes(hex2);
       const len = bytes2.length;
       const header = bytes2[0];
-      if (len === 32 || len === 33 && (header === 2 || header === 3)) {
+      if (len === fieldLen)
+        return this.fromCompressedHex(bytes2);
+      if (len === compressedLen && (header === 2 || header === 3)) {
         return this.fromCompressedHex(bytes2);
       }
-      if (len === 65 && header === 4)
+      if (len === uncompressedLen && header === 4)
         return this.fromUncompressedHex(bytes2);
-      throw new Error(`Point.fromHex: received invalid point. Expected 32-33 compressed bytes or 65 uncompressed bytes, not ${len}`);
+      throw new Error(`Point.fromHex: received invalid point. Expected 32-${compressedLen} compressed bytes or ${uncompressedLen} uncompressed bytes, not ${len}`);
     }
     static fromPrivateKey(privateKey) {
       return Point.BASE.multiply(normalizePrivateKey(privateKey));
     }
     static fromSignature(msgHash, signature, recovery) {
-      msgHash = ensureBytes(msgHash);
-      const h = truncateHash(msgHash);
       const { r, s } = normalizeSignature(signature);
-      if (recovery !== 0 && recovery !== 1) {
-        throw new Error("Cannot recover signature: invalid recovery bit");
-      }
-      const prefix = recovery & 1 ? "03" : "02";
-      const R = Point.fromHex(prefix + numTo32bStr(r));
+      if (![0, 1, 2, 3].includes(recovery))
+        throw new Error("Cannot recover: invalid recovery bit");
+      const h = truncateHash(ensureBytes(msgHash));
       const { n } = CURVE;
-      const rinv = invert(r, n);
+      const radj = recovery === 2 || recovery === 3 ? r + n : r;
+      const rinv = invert(radj, n);
       const u1 = mod(-h * rinv, n);
       const u2 = mod(s * rinv, n);
+      const prefix = recovery & 1 ? "03" : "02";
+      const R = Point.fromHex(prefix + numTo32bStr(radj));
       const Q = Point.BASE.multiplyAndAddUnsafe(R, u1, u2);
       if (!Q)
         throw new Error("Cannot recover signature: point at infinify");
@@ -3972,7 +4013,7 @@ zoo`.split("\n");
       if (!isValidFieldElement(x) || !isValidFieldElement(y))
         throw new Error(msg);
       const left = mod(y * y);
-      const right = weistrass(x);
+      const right = weierstrass(x);
       if (mod(left - right) !== _0n)
         throw new Error(msg);
     }
@@ -4073,19 +4114,19 @@ zoo`.split("\n");
       return this.s > HALF;
     }
     normalizeS() {
-      return this.hasHighS() ? new Signature(this.r, CURVE.n - this.s) : this;
+      return this.hasHighS() ? new Signature(this.r, mod(-this.s, CURVE.n)) : this;
     }
-    toDERRawBytes(isCompressed = false) {
-      return hexToBytes(this.toDERHex(isCompressed));
+    toDERRawBytes() {
+      return hexToBytes(this.toDERHex());
     }
-    toDERHex(isCompressed = false) {
+    toDERHex() {
       const sHex = sliceDER(numberToHexUnpadded(this.s));
-      if (isCompressed)
-        return sHex;
       const rHex = sliceDER(numberToHexUnpadded(this.r));
-      const rLen = numberToHexUnpadded(rHex.length / 2);
-      const sLen = numberToHexUnpadded(sHex.length / 2);
-      const length = numberToHexUnpadded(rHex.length / 2 + sHex.length / 2 + 4);
+      const sHexL = sHex.length / 2;
+      const rHexL = rHex.length / 2;
+      const sLen = numberToHexUnpadded(sHexL);
+      const rLen = numberToHexUnpadded(rHexL);
+      const length = numberToHexUnpadded(rHexL + sHexL + 4);
       return `30${length}02${rLen}${rHex}02${sLen}${sHex}`;
     }
     toRawBytes() {
@@ -4130,7 +4171,7 @@ zoo`.split("\n");
     if (typeof num !== "bigint")
       throw new Error("Expected bigint");
     if (!(_0n <= num && num < POW_2_256))
-      throw new Error("Expected number < 2^256");
+      throw new Error("Expected number 0 <= n < 2^256");
     return num.toString(16).padStart(64, "0");
   }
   function numTo32b(num) {
@@ -4213,7 +4254,11 @@ zoo`.split("\n");
     const b223 = pow2(b220, _3n) * b3 % P;
     const t1 = pow2(b223, _23n) * b22 % P;
     const t2 = pow2(t1, _6n) * b2 % P;
-    return pow2(t2, _2n);
+    const rt = pow2(t2, _2n);
+    const xc = rt * rt % P;
+    if (xc !== x)
+      throw new Error("Cannot find square root");
+    return rt;
   }
   function invert(number2, modulo = CURVE.P) {
     if (number2 === _0n || modulo <= _0n) {
@@ -4251,49 +4296,30 @@ zoo`.split("\n");
     }, inverted);
     return scratch;
   }
-  var divNearest = (a, b) => (a + b / _2n) / b;
-  var ENDO = {
-    a1: BigInt("0x3086d221a7d46bcde86c90e49284eb15"),
-    b1: -_1n * BigInt("0xe4437ed6010e88286f547fa90abfe4c3"),
-    a2: BigInt("0x114ca50f7a8e2f3f657c1108d9d44cfd8"),
-    b2: BigInt("0x3086d221a7d46bcde86c90e49284eb15"),
-    POW_2_128: BigInt("0x100000000000000000000000000000000")
-  };
-  function splitScalarEndo(k) {
-    const { n } = CURVE;
-    const { a1, b1, a2, b2, POW_2_128 } = ENDO;
-    const c1 = divNearest(b2 * k, n);
-    const c2 = divNearest(-b1 * k, n);
-    let k1 = mod(k - c1 * a1 - c2 * a2, n);
-    let k2 = mod(-c1 * b1 - c2 * b2, n);
-    const k1neg = k1 > POW_2_128;
-    const k2neg = k2 > POW_2_128;
-    if (k1neg)
-      k1 = n - k1;
-    if (k2neg)
-      k2 = n - k2;
-    if (k1 > POW_2_128 || k2 > POW_2_128) {
-      throw new Error("splitScalarEndo: Endomorphism failed, k=" + k);
-    }
-    return { k1neg, k1, k2neg, k2 };
+  function bits2int_2(bytes2) {
+    const delta = bytes2.length * 8 - groupLen * 8;
+    const num = bytesToNumber(bytes2);
+    return delta > 0 ? num >> BigInt(delta) : num;
   }
-  function truncateHash(hash2) {
+  function truncateHash(hash2, truncateOnly = false) {
+    const h = bits2int_2(hash2);
+    if (truncateOnly)
+      return h;
     const { n } = CURVE;
-    const byteLength = hash2.length;
-    const delta = byteLength * 8 - 256;
-    let h = bytesToNumber(hash2);
-    if (delta > 0)
-      h = h >> BigInt(delta);
-    if (h >= n)
-      h -= n;
-    return h;
+    return h >= n ? h - n : h;
   }
   var _sha256Sync;
   var _hmacSha256Sync;
   var HmacDrbg = class {
-    constructor() {
-      this.v = new Uint8Array(32).fill(1);
-      this.k = new Uint8Array(32).fill(0);
+    constructor(hashLen2, qByteLen) {
+      this.hashLen = hashLen2;
+      this.qByteLen = qByteLen;
+      if (typeof hashLen2 !== "number" || hashLen2 < 2)
+        throw new Error("hashLen must be a number");
+      if (typeof qByteLen !== "number" || qByteLen < 2)
+        throw new Error("qByteLen must be a number");
+      this.v = new Uint8Array(hashLen2).fill(1);
+      this.k = new Uint8Array(hashLen2).fill(0);
       this.counter = 0;
     }
     hmac(...values) {
@@ -4330,14 +4356,28 @@ zoo`.split("\n");
     }
     async generate() {
       this.incr();
-      this.v = await this.hmac(this.v);
-      return this.v;
+      let len = 0;
+      const out = [];
+      while (len < this.qByteLen) {
+        this.v = await this.hmac(this.v);
+        const sl = this.v.slice();
+        out.push(sl);
+        len += this.v.length;
+      }
+      return concatBytes(...out);
     }
     generateSync() {
       this.checkSync();
       this.incr();
-      this.v = this.hmacSync(this.v);
-      return this.v;
+      let len = 0;
+      const out = [];
+      while (len < this.qByteLen) {
+        this.v = this.hmacSync(this.v);
+        const sl = this.v.slice();
+        out.push(sl);
+        len += this.v.length;
+      }
+      return concatBytes(...out);
     }
   };
   function isWithinCurveOrder(num) {
@@ -4346,20 +4386,25 @@ zoo`.split("\n");
   function isValidFieldElement(num) {
     return _0n < num && num < CURVE.P;
   }
-  function kmdToSig(kBytes, m, d) {
-    const k = bytesToNumber(kBytes);
+  function kmdToSig(kBytes, m, d, lowS = true) {
+    const { n } = CURVE;
+    const k = truncateHash(kBytes, true);
     if (!isWithinCurveOrder(k))
       return;
-    const { n } = CURVE;
+    const kinv = invert(k, n);
     const q = Point.BASE.multiply(k);
     const r = mod(q.x, n);
     if (r === _0n)
       return;
-    const s = mod(invert(k, n) * mod(m + d * r, n), n);
+    const s = mod(kinv * mod(m + d * r, n), n);
     if (s === _0n)
       return;
-    const sig = new Signature(r, s);
-    const recovery = (q.x === sig.r ? 0 : 2) | Number(q.y & _1n);
+    let sig = new Signature(r, s);
+    let recovery = (q.x === sig.r ? 0 : 2) | Number(q.y & _1n);
+    if (lowS && sig.hasHighS()) {
+      sig = sig.normalizeS();
+      recovery ^= 1;
+    }
     return { sig, recovery };
   }
   function normalizePrivateKey(key) {
@@ -4369,11 +4414,11 @@ zoo`.split("\n");
     } else if (typeof key === "number" && Number.isSafeInteger(key) && key > 0) {
       num = BigInt(key);
     } else if (typeof key === "string") {
-      if (key.length !== 64)
+      if (key.length !== 2 * groupLen)
         throw new Error("Expected 32 bytes of private key");
       num = hexToNumber(key);
     } else if (key instanceof Uint8Array) {
-      if (key.length !== 32)
+      if (key.length !== groupLen)
         throw new Error("Expected 32 bytes of private key");
       num = bytesToNumber(key);
     } else {
@@ -4410,9 +4455,9 @@ zoo`.split("\n");
     const str = typeof item === "string";
     const len = (arr || str) && item.length;
     if (arr)
-      return len === 33 || len === 65;
+      return len === compressedLen || len === uncompressedLen;
     if (str)
-      return len === 66 || len === 130;
+      return len === compressedLen * 2 || len === uncompressedLen * 2;
     if (item instanceof Point)
       return true;
     return false;
@@ -4427,7 +4472,7 @@ zoo`.split("\n");
     return b.multiply(normalizePrivateKey(privateA)).toRawBytes(isCompressed);
   }
   function bits2int(bytes2) {
-    const slice = bytes2.length > 32 ? bytes2.slice(0, 32) : bytes2;
+    const slice = bytes2.length > fieldLen ? bytes2.slice(0, fieldLen) : bytes2;
     return bytesToNumber(slice);
   }
   function bits2octets(bytes2) {
@@ -4446,10 +4491,10 @@ zoo`.split("\n");
     const seedArgs = [int2octets(d), bits2octets(h1)];
     if (extraEntropy != null) {
       if (extraEntropy === true)
-        extraEntropy = utils.randomBytes(32);
+        extraEntropy = utils.randomBytes(fieldLen);
       const e = ensureBytes(extraEntropy);
-      if (e.length !== 32)
-        throw new Error("sign: Expected 32 bytes of extra data");
+      if (e.length !== fieldLen)
+        throw new Error(`sign: Expected ${fieldLen} bytes of extra data`);
       seedArgs.push(e);
     }
     const seed = concatBytes(...seedArgs);
@@ -4457,21 +4502,17 @@ zoo`.split("\n");
     return { seed, m, d };
   }
   function finalizeSig(recSig, opts) {
-    let { sig, recovery } = recSig;
-    const { canonical, der, recovered } = Object.assign({ canonical: true, der: true }, opts);
-    if (canonical && sig.hasHighS()) {
-      sig = sig.normalizeS();
-      recovery ^= 1;
-    }
+    const { sig, recovery } = recSig;
+    const { der, recovered } = Object.assign({ canonical: true, der: true }, opts);
     const hashed = der ? sig.toDERRawBytes() : sig.toCompactRawBytes();
     return recovered ? [hashed, recovery] : hashed;
   }
   function signSync(msgHash, privKey, opts = {}) {
     const { seed, m, d } = initSigArgs(msgHash, privKey, opts.extraEntropy);
-    let sig;
-    const drbg = new HmacDrbg();
+    const drbg = new HmacDrbg(hashLen, groupLen);
     drbg.reseedSync(seed);
-    while (!(sig = kmdToSig(drbg.generateSync(), m, d)))
+    let sig;
+    while (!(sig = kmdToSig(drbg.generateSync(), m, d, opts.canonical)))
       drbg.reseedSync();
     return finalizeSig(sig, opts);
   }
@@ -4672,8 +4713,10 @@ zoo`.split("\n");
     _normalizePrivateKey: normalizePrivateKey,
     hashToPrivateKey: (hash2) => {
       hash2 = ensureBytes(hash2);
-      if (hash2.length < 40 || hash2.length > 1024)
-        throw new Error("Expected 40-1024 bytes of private key as per FIPS 186");
+      const minLen = groupLen + 8;
+      if (hash2.length < minLen || hash2.length > 1024) {
+        throw new Error(`Expected valid bytes of private key as per FIPS 186`);
+      }
       const num = mod(bytesToNumber(hash2), CURVE.n - _1n) + _1n;
       return numTo32b(num);
     },
@@ -4687,8 +4730,12 @@ zoo`.split("\n");
         throw new Error("The environment doesn't have randomBytes function");
       }
     },
-    randomPrivateKey: () => {
-      return utils.hashToPrivateKey(utils.randomBytes(40));
+    randomPrivateKey: () => utils.hashToPrivateKey(utils.randomBytes(groupLen + 8)),
+    precompute(windowSize = 8, point = Point.BASE) {
+      const cached = point === Point.BASE ? point : new Point(point.x, point.y);
+      cached._setWindowSize(windowSize);
+      cached.multiply(_3n);
+      return cached;
     },
     sha256: async (...messages) => {
       if (crypto2.web) {
@@ -4740,12 +4787,7 @@ zoo`.split("\n");
       }
       return _sha256Sync(tagP, ...messages);
     },
-    precompute(windowSize = 8, point = Point.BASE) {
-      const cached = point === Point.BASE ? point : new Point(point.x, point.y);
-      cached._setWindowSize(windowSize);
-      cached.multiply(_3n);
-      return cached;
-    }
+    _JacobianPoint: JacobianPoint
   };
   Object.defineProperties(utils, {
     sha256Sync: {
@@ -7004,7 +7046,11 @@ zoo`.split("\n");
           }
           opt.privateKey = added;
         } else {
-          opt.publicKey = Point.fromHex(this.pubKey).add(Point.fromPrivateKey(childTweak)).toRawBytes(true);
+          const added = Point.fromHex(this.pubKey).add(Point.fromPrivateKey(childTweak));
+          if (added.equals(Point.ZERO)) {
+            throw new Error("The tweak was equal to negative P, which made the result key invalid");
+          }
+          opt.publicKey = added.toRawBytes(true);
         }
         return new HDKey(opt);
       } catch (err) {
@@ -7059,8 +7105,8 @@ zoo`.split("\n");
   };
 
   // nip06.ts
-  function privateKeyFromSeedWords(mnemonic) {
-    let root = HDKey.fromMasterSeed((0, import_bip39.mnemonicToSeedSync)(mnemonic));
+  function privateKeyFromSeedWords(mnemonic, passphrase) {
+    let root = HDKey.fromMasterSeed((0, import_bip39.mnemonicToSeedSync)(mnemonic, passphrase));
     let privateKey = root.derive(`m/44'/1237'/0'/0/0`).privateKey;
     if (!privateKey)
       throw new Error("could not derive private key");
@@ -7084,8 +7130,9 @@ zoo`.split("\n");
     nsecEncode: () => nsecEncode
   });
   init_define_process();
+  var Bech32MaxSize = 5e3;
   function decode(nip19) {
-    let { prefix, words } = bech32.decode(nip19, 1500);
+    let { prefix, words } = bech32.decode(nip19, Bech32MaxSize);
     let data = new Uint8Array(bech32.fromWords(words));
     if (prefix === "nprofile") {
       let tlv = parseTLV(data);
@@ -7147,7 +7194,7 @@ zoo`.split("\n");
   function encodeBytes(prefix, hex2) {
     let data = utils.hexToBytes(hex2);
     let words = bech32.toWords(data);
-    return bech32.encode(prefix, words, 1500);
+    return bech32.encode(prefix, words, Bech32MaxSize);
   }
   function nprofileEncode(profile) {
     let data = encodeTLV({
@@ -7155,7 +7202,7 @@ zoo`.split("\n");
       1: (profile.relays || []).map((url) => utf8Encoder.encode(url))
     });
     let words = bech32.toWords(data);
-    return bech32.encode("nprofile", words, 1500);
+    return bech32.encode("nprofile", words, Bech32MaxSize);
   }
   function neventEncode(event) {
     let data = encodeTLV({
@@ -7163,7 +7210,7 @@ zoo`.split("\n");
       1: (event.relays || []).map((url) => utf8Encoder.encode(url))
     });
     let words = bech32.toWords(data);
-    return bech32.encode("nevent", words, 1500);
+    return bech32.encode("nevent", words, Bech32MaxSize);
   }
   function encodeTLV(tlv) {
     let entries = [];