{"ast":null,"code":"\"use strict\";\n\nObject.defineProperty(exports, \"__esModule\", {\n  value: true\n});\nexports.DER = exports.DERErr = void 0;\nexports._splitEndoScalar = _splitEndoScalar;\nexports._normFnElement = _normFnElement;\nexports.weierstrassN = weierstrassN;\nexports.SWUFpSqrtRatio = SWUFpSqrtRatio;\nexports.mapToCurveSimpleSWU = mapToCurveSimpleSWU;\nexports.ecdh = ecdh;\nexports.ecdsa = ecdsa;\nexports.weierstrassPoints = weierstrassPoints;\nexports._legacyHelperEquat = _legacyHelperEquat;\nexports.weierstrass = weierstrass;\n/**\n * Short Weierstrass curve methods. The formula is: y² = x³ + ax + b.\n *\n * ### Design rationale for types\n *\n * * Interaction between classes from different curves should fail:\n *   `k256.Point.BASE.add(p256.Point.BASE)`\n * * For this purpose we want to use `instanceof` operator, which is fast and works during runtime\n * * Different calls of `curve()` would return different classes -\n *   `curve(params) !== curve(params)`: if somebody decided to monkey-patch their curve,\n *   it won't affect others\n *\n * TypeScript can't infer types for classes created inside a function. Classes is one instance\n * of nominative types in TypeScript and interfaces only check for shape, so it's hard to create\n * unique type for every function call.\n *\n * We can use generic types via some param, like curve opts, but that would:\n *     1. Enable interaction between `curve(params)` and `curve(params)` (curves of same params)\n *     which is hard to debug.\n *     2. Params can be generic and we can't enforce them to be constant value:\n *     if somebody creates curve from non-constant params,\n *     it would be allowed to interact with other curves with non-constant params\n *\n * @todo https://www.typescriptlang.org/docs/handbook/release-notes/typescript-2-7.html#unique-symbol\n * @module\n */\n/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */\nconst hmac_js_1 = require(\"@noble/hashes/hmac.js\");\nconst utils_1 = require(\"@noble/hashes/utils\");\nconst utils_ts_1 = require(\"../utils.js\");\nconst curve_ts_1 = require(\"./curve.js\");\nconst modular_ts_1 = require(\"./modular.js\");\n// We construct basis in such way that den is always positive and equals n, but num sign depends on basis (not on secret value)\nconst divNearest = (num, den) => (num + (num >= 0 ? den : -den) / _2n) / den;\n/**\n * Splits scalar for GLV endomorphism.\n */\nfunction _splitEndoScalar(k, basis, n) {\n  // Split scalar into two such that part is ~half bits: `abs(part) < sqrt(N)`\n  // Since part can be negative, we need to do this on point.\n  // TODO: verifyScalar function which consumes lambda\n  const [[a1, b1], [a2, b2]] = basis;\n  const c1 = divNearest(b2 * k, n);\n  const c2 = divNearest(-b1 * k, n);\n  // |k1|/|k2| is < sqrt(N), but can be negative.\n  // If we do `k1 mod N`, we'll get big scalar (`> sqrt(N)`): so, we do cheaper negation instead.\n  let k1 = k - c1 * a1 - c2 * a2;\n  let k2 = -c1 * b1 - c2 * b2;\n  const k1neg = k1 < _0n;\n  const k2neg = k2 < _0n;\n  if (k1neg) k1 = -k1;\n  if (k2neg) k2 = -k2;\n  // Double check that resulting scalar less than half bits of N: otherwise wNAF will fail.\n  // This should only happen on wrong basises. Also, math inside is too complex and I don't trust it.\n  const MAX_NUM = (0, utils_ts_1.bitMask)(Math.ceil((0, utils_ts_1.bitLen)(n) / 2)) + _1n; // Half bits of N\n  if (k1 < _0n || k1 >= MAX_NUM || k2 < _0n || k2 >= MAX_NUM) {\n    throw new Error('splitScalar (endomorphism): failed, k=' + k);\n  }\n  return {\n    k1neg,\n    k1,\n    k2neg,\n    k2\n  };\n}\nfunction validateSigFormat(format) {\n  if (!['compact', 'recovered', 'der'].includes(format)) throw new Error('Signature format must be \"compact\", \"recovered\", or \"der\"');\n  return format;\n}\nfunction validateSigOpts(opts, def) {\n  const optsn = {};\n  for (let optName of Object.keys(def)) {\n    // @ts-ignore\n    optsn[optName] = opts[optName] === undefined ? def[optName] : opts[optName];\n  }\n  (0, utils_ts_1._abool2)(optsn.lowS, 'lowS');\n  (0, utils_ts_1._abool2)(optsn.prehash, 'prehash');\n  if (optsn.format !== undefined) validateSigFormat(optsn.format);\n  return optsn;\n}\nclass DERErr extends Error {\n  constructor(m = '') {\n    super(m);\n  }\n}\nexports.DERErr = DERErr;\n/**\n * ASN.1 DER encoding utilities. ASN is very complex & fragile. Format:\n *\n *     [0x30 (SEQUENCE), bytelength, 0x02 (INTEGER), intLength, R, 0x02 (INTEGER), intLength, S]\n *\n * Docs: https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/, https://luca.ntop.org/Teaching/Appunti/asn1.html\n */\nexports.DER = {\n  // asn.1 DER encoding utils\n  Err: DERErr,\n  // Basic building block is TLV (Tag-Length-Value)\n  _tlv: {\n    encode: (tag, data) => {\n      const {\n        Err: E\n      } = exports.DER;\n      if (tag < 0 || tag > 256) throw new E('tlv.encode: wrong tag');\n      if (data.length & 1) throw new E('tlv.encode: unpadded data');\n      const dataLen = data.length / 2;\n      const len = (0, utils_ts_1.numberToHexUnpadded)(dataLen);\n      if (len.length / 2 & 128) throw new E('tlv.encode: long form length too big');\n      // length of length with long form flag\n      const lenLen = dataLen > 127 ? (0, utils_ts_1.numberToHexUnpadded)(len.length / 2 | 128) : '';\n      const t = (0, utils_ts_1.numberToHexUnpadded)(tag);\n      return t + lenLen + len + data;\n    },\n    // v - value, l - left bytes (unparsed)\n    decode(tag, data) {\n      const {\n        Err: E\n      } = exports.DER;\n      let pos = 0;\n      if (tag < 0 || tag > 256) throw new E('tlv.encode: wrong tag');\n      if (data.length < 2 || data[pos++] !== tag) throw new E('tlv.decode: wrong tlv');\n      const first = data[pos++];\n      const isLong = !!(first & 128); // First bit of first length byte is flag for short/long form\n      let length = 0;\n      if (!isLong) length = first;else {\n        // Long form: [longFlag(1bit), lengthLength(7bit), length (BE)]\n        const lenLen = first & 127;\n        if (!lenLen) throw new E('tlv.decode(long): indefinite length not supported');\n        if (lenLen > 4) throw new E('tlv.decode(long): byte length is too big'); // this will overflow u32 in js\n        const lengthBytes = data.subarray(pos, pos + lenLen);\n        if (lengthBytes.length !== lenLen) throw new E('tlv.decode: length bytes not complete');\n        if (lengthBytes[0] === 0) throw new E('tlv.decode(long): zero leftmost byte');\n        for (const b of lengthBytes) length = length << 8 | b;\n        pos += lenLen;\n        if (length < 128) throw new E('tlv.decode(long): not minimal encoding');\n      }\n      const v = data.subarray(pos, pos + length);\n      if (v.length !== length) throw new E('tlv.decode: wrong value length');\n      return {\n        v,\n        l: data.subarray(pos + length)\n      };\n    }\n  },\n  // https://crypto.stackexchange.com/a/57734 Leftmost bit of first byte is 'negative' flag,\n  // since we always use positive integers here. It must always be empty:\n  // - add zero byte if exists\n  // - if next byte doesn't have a flag, leading zero is not allowed (minimal encoding)\n  _int: {\n    encode(num) {\n      const {\n        Err: E\n      } = exports.DER;\n      if (num < _0n) throw new E('integer: negative integers are not allowed');\n      let hex = (0, utils_ts_1.numberToHexUnpadded)(num);\n      // Pad with zero byte if negative flag is present\n      if (Number.parseInt(hex[0], 16) & 0b1000) hex = '00' + hex;\n      if (hex.length & 1) throw new E('unexpected DER parsing assertion: unpadded hex');\n      return hex;\n    },\n    decode(data) {\n      const {\n        Err: E\n      } = exports.DER;\n      if (data[0] & 128) throw new E('invalid signature integer: negative');\n      if (data[0] === 0x00 && !(data[1] & 128)) throw new E('invalid signature integer: unnecessary leading zero');\n      return (0, utils_ts_1.bytesToNumberBE)(data);\n    }\n  },\n  toSig(hex) {\n    // parse DER signature\n    const {\n      Err: E,\n      _int: int,\n      _tlv: tlv\n    } = exports.DER;\n    const data = (0, utils_ts_1.ensureBytes)('signature', hex);\n    const {\n      v: seqBytes,\n      l: seqLeftBytes\n    } = tlv.decode(0x30, data);\n    if (seqLeftBytes.length) throw new E('invalid signature: left bytes after parsing');\n    const {\n      v: rBytes,\n      l: rLeftBytes\n    } = tlv.decode(0x02, seqBytes);\n    const {\n      v: sBytes,\n      l: sLeftBytes\n    } = tlv.decode(0x02, rLeftBytes);\n    if (sLeftBytes.length) throw new E('invalid signature: left bytes after parsing');\n    return {\n      r: int.decode(rBytes),\n      s: int.decode(sBytes)\n    };\n  },\n  hexFromSig(sig) {\n    const {\n      _tlv: tlv,\n      _int: int\n    } = exports.DER;\n    const rs = tlv.encode(0x02, int.encode(sig.r));\n    const ss = tlv.encode(0x02, int.encode(sig.s));\n    const seq = rs + ss;\n    return tlv.encode(0x30, seq);\n  }\n};\n// Be friendly to bad ECMAScript parsers by not using bigint literals\n// prettier-ignore\nconst _0n = BigInt(0),\n  _1n = BigInt(1),\n  _2n = BigInt(2),\n  _3n = BigInt(3),\n  _4n = BigInt(4);\nfunction _normFnElement(Fn, key) {\n  const {\n    BYTES: expected\n  } = Fn;\n  let num;\n  if (typeof key === 'bigint') {\n    num = key;\n  } else {\n    let bytes = (0, utils_ts_1.ensureBytes)('private key', key);\n    try {\n      num = Fn.fromBytes(bytes);\n    } catch (error) {\n      throw new Error(`invalid private key: expected ui8a of size ${expected}, got ${typeof key}`);\n    }\n  }\n  if (!Fn.isValidNot0(num)) throw new Error('invalid private key: out of range [1..N-1]');\n  return num;\n}\n/**\n * Creates weierstrass Point constructor, based on specified curve options.\n *\n * @example\n```js\nconst opts = {\n  p: BigInt('0xffffffff00000001000000000000000000000000ffffffffffffffffffffffff'),\n  n: BigInt('0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551'),\n  h: BigInt(1),\n  a: BigInt('0xffffffff00000001000000000000000000000000fffffffffffffffffffffffc'),\n  b: BigInt('0x5ac635d8aa3a93e7b3ebbd55769886bc651d06b0cc53b0f63bce3c3e27d2604b'),\n  Gx: BigInt('0x6b17d1f2e12c4247f8bce6e563a440f277037d812deb33a0f4a13945d898c296'),\n  Gy: BigInt('0x4fe342e2fe1a7f9b8ee7eb4a7c0f9e162bce33576b315ececbb6406837bf51f5'),\n};\nconst p256_Point = weierstrass(opts);\n```\n */\nfunction weierstrassN(params, extraOpts = {}) {\n  const validated = (0, curve_ts_1._createCurveFields)('weierstrass', params, extraOpts);\n  const {\n    Fp,\n    Fn\n  } = validated;\n  let CURVE = validated.CURVE;\n  const {\n    h: cofactor,\n    n: CURVE_ORDER\n  } = CURVE;\n  (0, utils_ts_1._validateObject)(extraOpts, {}, {\n    allowInfinityPoint: 'boolean',\n    clearCofactor: 'function',\n    isTorsionFree: 'function',\n    fromBytes: 'function',\n    toBytes: 'function',\n    endo: 'object',\n    wrapPrivateKey: 'boolean'\n  });\n  const {\n    endo\n  } = extraOpts;\n  if (endo) {\n    // validateObject(endo, { beta: 'bigint', splitScalar: 'function' });\n    if (!Fp.is0(CURVE.a) || typeof endo.beta !== 'bigint' || !Array.isArray(endo.basises)) {\n      throw new Error('invalid endo: expected \"beta\": bigint and \"basises\": array');\n    }\n  }\n  const lengths = getWLengths(Fp, Fn);\n  function assertCompressionIsSupported() {\n    if (!Fp.isOdd) throw new Error('compression is not supported: Field does not have .isOdd()');\n  }\n  // Implements IEEE P1363 point encoding\n  function pointToBytes(_c, point, isCompressed) {\n    const {\n      x,\n      y\n    } = point.toAffine();\n    const bx = Fp.toBytes(x);\n    (0, utils_ts_1._abool2)(isCompressed, 'isCompressed');\n    if (isCompressed) {\n      assertCompressionIsSupported();\n      const hasEvenY = !Fp.isOdd(y);\n      return (0, utils_ts_1.concatBytes)(pprefix(hasEvenY), bx);\n    } else {\n      return (0, utils_ts_1.concatBytes)(Uint8Array.of(0x04), bx, Fp.toBytes(y));\n    }\n  }\n  function pointFromBytes(bytes) {\n    (0, utils_ts_1._abytes2)(bytes, undefined, 'Point');\n    const {\n      publicKey: comp,\n      publicKeyUncompressed: uncomp\n    } = lengths; // e.g. for 32-byte: 33, 65\n    const length = bytes.length;\n    const head = bytes[0];\n    const tail = bytes.subarray(1);\n    // No actual validation is done here: use .assertValidity()\n    if (length === comp && (head === 0x02 || head === 0x03)) {\n      const x = Fp.fromBytes(tail);\n      if (!Fp.isValid(x)) throw new Error('bad point: is not on curve, wrong x');\n      const y2 = weierstrassEquation(x); // y² = x³ + ax + b\n      let y;\n      try {\n        y = Fp.sqrt(y2); // y = y² ^ (p+1)/4\n      } catch (sqrtError) {\n        const err = sqrtError instanceof Error ? ': ' + sqrtError.message : '';\n        throw new Error('bad point: is not on curve, sqrt error' + err);\n      }\n      assertCompressionIsSupported();\n      const isYOdd = Fp.isOdd(y); // (y & _1n) === _1n;\n      const isHeadOdd = (head & 1) === 1; // ECDSA-specific\n      if (isHeadOdd !== isYOdd) y = Fp.neg(y);\n      return {\n        x,\n        y\n      };\n    } else if (length === uncomp && head === 0x04) {\n      // TODO: more checks\n      const L = Fp.BYTES;\n      const x = Fp.fromBytes(tail.subarray(0, L));\n      const y = Fp.fromBytes(tail.subarray(L, L * 2));\n      if (!isValidXY(x, y)) throw new Error('bad point: is not on curve');\n      return {\n        x,\n        y\n      };\n    } else {\n      throw new Error(`bad point: got length ${length}, expected compressed=${comp} or uncompressed=${uncomp}`);\n    }\n  }\n  const encodePoint = extraOpts.toBytes || pointToBytes;\n  const decodePoint = extraOpts.fromBytes || pointFromBytes;\n  function weierstrassEquation(x) {\n    const x2 = Fp.sqr(x); // x * x\n    const x3 = Fp.mul(x2, x); // x² * x\n    return Fp.add(Fp.add(x3, Fp.mul(x, CURVE.a)), CURVE.b); // x³ + a * x + b\n  }\n  // TODO: move top-level\n  /** Checks whether equation holds for given x, y: y² == x³ + ax + b */\n  function isValidXY(x, y) {\n    const left = Fp.sqr(y); // y²\n    const right = weierstrassEquation(x); // x³ + ax + b\n    return Fp.eql(left, right);\n  }\n  // Validate whether the passed curve params are valid.\n  // Test 1: equation y² = x³ + ax + b should work for generator point.\n  if (!isValidXY(CURVE.Gx, CURVE.Gy)) throw new Error('bad curve params: generator point');\n  // Test 2: discriminant Δ part should be non-zero: 4a³ + 27b² != 0.\n  // Guarantees curve is genus-1, smooth (non-singular).\n  const _4a3 = Fp.mul(Fp.pow(CURVE.a, _3n), _4n);\n  const _27b2 = Fp.mul(Fp.sqr(CURVE.b), BigInt(27));\n  if (Fp.is0(Fp.add(_4a3, _27b2))) throw new Error('bad curve params: a or b');\n  /** Asserts coordinate is valid: 0 <= n < Fp.ORDER. */\n  function acoord(title, n, banZero = false) {\n    if (!Fp.isValid(n) || banZero && Fp.is0(n)) throw new Error(`bad point coordinate ${title}`);\n    return n;\n  }\n  function aprjpoint(other) {\n    if (!(other instanceof Point)) throw new Error('ProjectivePoint expected');\n  }\n  function splitEndoScalarN(k) {\n    if (!endo || !endo.basises) throw new Error('no endo');\n    return _splitEndoScalar(k, endo.basises, Fn.ORDER);\n  }\n  // Memoized toAffine / validity check. They are heavy. Points are immutable.\n  // Converts Projective point to affine (x, y) coordinates.\n  // Can accept precomputed Z^-1 - for example, from invertBatch.\n  // (X, Y, Z) ∋ (x=X/Z, y=Y/Z)\n  const toAffineMemo = (0, utils_ts_1.memoized)((p, iz) => {\n    const {\n      X,\n      Y,\n      Z\n    } = p;\n    // Fast-path for normalized points\n    if (Fp.eql(Z, Fp.ONE)) return {\n      x: X,\n      y: Y\n    };\n    const is0 = p.is0();\n    // If invZ was 0, we return zero point. However we still want to execute\n    // all operations, so we replace invZ with a random number, 1.\n    if (iz == null) iz = is0 ? Fp.ONE : Fp.inv(Z);\n    const x = Fp.mul(X, iz);\n    const y = Fp.mul(Y, iz);\n    const zz = Fp.mul(Z, iz);\n    if (is0) return {\n      x: Fp.ZERO,\n      y: Fp.ZERO\n    };\n    if (!Fp.eql(zz, Fp.ONE)) throw new Error('invZ was invalid');\n    return {\n      x,\n      y\n    };\n  });\n  // NOTE: on exception this will crash 'cached' and no value will be set.\n  // Otherwise true will be return\n  const assertValidMemo = (0, utils_ts_1.memoized)(p => {\n    if (p.is0()) {\n      // (0, 1, 0) aka ZERO is invalid in most contexts.\n      // In BLS, ZERO can be serialized, so we allow it.\n      // (0, 0, 0) is invalid representation of ZERO.\n      if (extraOpts.allowInfinityPoint && !Fp.is0(p.Y)) return;\n      throw new Error('bad point: ZERO');\n    }\n    // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`\n    const {\n      x,\n      y\n    } = p.toAffine();\n    if (!Fp.isValid(x) || !Fp.isValid(y)) throw new Error('bad point: x or y not field elements');\n    if (!isValidXY(x, y)) throw new Error('bad point: equation left != right');\n    if (!p.isTorsionFree()) throw new Error('bad point: not in prime-order subgroup');\n    return true;\n  });\n  function finishEndo(endoBeta, k1p, k2p, k1neg, k2neg) {\n    k2p = new Point(Fp.mul(k2p.X, endoBeta), k2p.Y, k2p.Z);\n    k1p = (0, curve_ts_1.negateCt)(k1neg, k1p);\n    k2p = (0, curve_ts_1.negateCt)(k2neg, k2p);\n    return k1p.add(k2p);\n  }\n  /**\n   * Projective Point works in 3d / projective (homogeneous) coordinates:(X, Y, Z) ∋ (x=X/Z, y=Y/Z).\n   * Default Point works in 2d / affine coordinates: (x, y).\n   * We're doing calculations in projective, because its operations don't require costly inversion.\n   */\n  class Point {\n    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n    constructor(X, Y, Z) {\n      this.X = acoord('x', X);\n      this.Y = acoord('y', Y, true);\n      this.Z = acoord('z', Z);\n      Object.freeze(this);\n    }\n    static CURVE() {\n      return CURVE;\n    }\n    /** Does NOT validate if the point is valid. Use `.assertValidity()`. */\n    static fromAffine(p) {\n      const {\n        x,\n        y\n      } = p || {};\n      if (!p || !Fp.isValid(x) || !Fp.isValid(y)) throw new Error('invalid affine point');\n      if (p instanceof Point) throw new Error('projective point not allowed');\n      // (0, 0) would've produced (0, 0, 1) - instead, we need (0, 1, 0)\n      if (Fp.is0(x) && Fp.is0(y)) return Point.ZERO;\n      return new Point(x, y, Fp.ONE);\n    }\n    static fromBytes(bytes) {\n      const P = Point.fromAffine(decodePoint((0, utils_ts_1._abytes2)(bytes, undefined, 'point')));\n      P.assertValidity();\n      return P;\n    }\n    static fromHex(hex) {\n      return Point.fromBytes((0, utils_ts_1.ensureBytes)('pointHex', hex));\n    }\n    get x() {\n      return this.toAffine().x;\n    }\n    get y() {\n      return this.toAffine().y;\n    }\n    /**\n     *\n     * @param windowSize\n     * @param isLazy true will defer table computation until the first multiplication\n     * @returns\n     */\n    precompute(windowSize = 8, isLazy = true) {\n      wnaf.createCache(this, windowSize);\n      if (!isLazy) this.multiply(_3n); // random number\n      return this;\n    }\n    // TODO: return `this`\n    /** A point on curve is valid if it conforms to equation. */\n    assertValidity() {\n      assertValidMemo(this);\n    }\n    hasEvenY() {\n      const {\n        y\n      } = this.toAffine();\n      if (!Fp.isOdd) throw new Error(\"Field doesn't support isOdd\");\n      return !Fp.isOdd(y);\n    }\n    /** Compare one point to another. */\n    equals(other) {\n      aprjpoint(other);\n      const {\n        X: X1,\n        Y: Y1,\n        Z: Z1\n      } = this;\n      const {\n        X: X2,\n        Y: Y2,\n        Z: Z2\n      } = other;\n      const U1 = Fp.eql(Fp.mul(X1, Z2), Fp.mul(X2, Z1));\n      const U2 = Fp.eql(Fp.mul(Y1, Z2), Fp.mul(Y2, Z1));\n      return U1 && U2;\n    }\n    /** Flips point to one corresponding to (x, -y) in Affine coordinates. */\n    negate() {\n      return new Point(this.X, Fp.neg(this.Y), this.Z);\n    }\n    // Renes-Costello-Batina exception-free doubling formula.\n    // There is 30% faster Jacobian formula, but it is not complete.\n    // https://eprint.iacr.org/2015/1060, algorithm 3\n    // Cost: 8M + 3S + 3*a + 2*b3 + 15add.\n    double() {\n      const {\n        a,\n        b\n      } = CURVE;\n      const b3 = Fp.mul(b, _3n);\n      const {\n        X: X1,\n        Y: Y1,\n        Z: Z1\n      } = this;\n      let X3 = Fp.ZERO,\n        Y3 = Fp.ZERO,\n        Z3 = Fp.ZERO; // prettier-ignore\n      let t0 = Fp.mul(X1, X1); // step 1\n      let t1 = Fp.mul(Y1, Y1);\n      let t2 = Fp.mul(Z1, Z1);\n      let t3 = Fp.mul(X1, Y1);\n      t3 = Fp.add(t3, t3); // step 5\n      Z3 = Fp.mul(X1, Z1);\n      Z3 = Fp.add(Z3, Z3);\n      X3 = Fp.mul(a, Z3);\n      Y3 = Fp.mul(b3, t2);\n      Y3 = Fp.add(X3, Y3); // step 10\n      X3 = Fp.sub(t1, Y3);\n      Y3 = Fp.add(t1, Y3);\n      Y3 = Fp.mul(X3, Y3);\n      X3 = Fp.mul(t3, X3);\n      Z3 = Fp.mul(b3, Z3); // step 15\n      t2 = Fp.mul(a, t2);\n      t3 = Fp.sub(t0, t2);\n      t3 = Fp.mul(a, t3);\n      t3 = Fp.add(t3, Z3);\n      Z3 = Fp.add(t0, t0); // step 20\n      t0 = Fp.add(Z3, t0);\n      t0 = Fp.add(t0, t2);\n      t0 = Fp.mul(t0, t3);\n      Y3 = Fp.add(Y3, t0);\n      t2 = Fp.mul(Y1, Z1); // step 25\n      t2 = Fp.add(t2, t2);\n      t0 = Fp.mul(t2, t3);\n      X3 = Fp.sub(X3, t0);\n      Z3 = Fp.mul(t2, t1);\n      Z3 = Fp.add(Z3, Z3); // step 30\n      Z3 = Fp.add(Z3, Z3);\n      return new Point(X3, Y3, Z3);\n    }\n    // Renes-Costello-Batina exception-free addition formula.\n    // There is 30% faster Jacobian formula, but it is not complete.\n    // https://eprint.iacr.org/2015/1060, algorithm 1\n    // Cost: 12M + 0S + 3*a + 3*b3 + 23add.\n    add(other) {\n      aprjpoint(other);\n      const {\n        X: X1,\n        Y: Y1,\n        Z: Z1\n      } = this;\n      const {\n        X: X2,\n        Y: Y2,\n        Z: Z2\n      } = other;\n      let X3 = Fp.ZERO,\n        Y3 = Fp.ZERO,\n        Z3 = Fp.ZERO; // prettier-ignore\n      const a = CURVE.a;\n      const b3 = Fp.mul(CURVE.b, _3n);\n      let t0 = Fp.mul(X1, X2); // step 1\n      let t1 = Fp.mul(Y1, Y2);\n      let t2 = Fp.mul(Z1, Z2);\n      let t3 = Fp.add(X1, Y1);\n      let t4 = Fp.add(X2, Y2); // step 5\n      t3 = Fp.mul(t3, t4);\n      t4 = Fp.add(t0, t1);\n      t3 = Fp.sub(t3, t4);\n      t4 = Fp.add(X1, Z1);\n      let t5 = Fp.add(X2, Z2); // step 10\n      t4 = Fp.mul(t4, t5);\n      t5 = Fp.add(t0, t2);\n      t4 = Fp.sub(t4, t5);\n      t5 = Fp.add(Y1, Z1);\n      X3 = Fp.add(Y2, Z2); // step 15\n      t5 = Fp.mul(t5, X3);\n      X3 = Fp.add(t1, t2);\n      t5 = Fp.sub(t5, X3);\n      Z3 = Fp.mul(a, t4);\n      X3 = Fp.mul(b3, t2); // step 20\n      Z3 = Fp.add(X3, Z3);\n      X3 = Fp.sub(t1, Z3);\n      Z3 = Fp.add(t1, Z3);\n      Y3 = Fp.mul(X3, Z3);\n      t1 = Fp.add(t0, t0); // step 25\n      t1 = Fp.add(t1, t0);\n      t2 = Fp.mul(a, t2);\n      t4 = Fp.mul(b3, t4);\n      t1 = Fp.add(t1, t2);\n      t2 = Fp.sub(t0, t2); // step 30\n      t2 = Fp.mul(a, t2);\n      t4 = Fp.add(t4, t2);\n      t0 = Fp.mul(t1, t4);\n      Y3 = Fp.add(Y3, t0);\n      t0 = Fp.mul(t5, t4); // step 35\n      X3 = Fp.mul(t3, X3);\n      X3 = Fp.sub(X3, t0);\n      t0 = Fp.mul(t3, t1);\n      Z3 = Fp.mul(t5, Z3);\n      Z3 = Fp.add(Z3, t0); // step 40\n      return new Point(X3, Y3, Z3);\n    }\n    subtract(other) {\n      return this.add(other.negate());\n    }\n    is0() {\n      return this.equals(Point.ZERO);\n    }\n    /**\n     * Constant time multiplication.\n     * Uses wNAF method. Windowed method may be 10% faster,\n     * but takes 2x longer to generate and consumes 2x memory.\n     * Uses precomputes when available.\n     * Uses endomorphism for Koblitz curves.\n     * @param scalar by which the point would be multiplied\n     * @returns New point\n     */\n    multiply(scalar) {\n      const {\n        endo\n      } = extraOpts;\n      if (!Fn.isValidNot0(scalar)) throw new Error('invalid scalar: out of range'); // 0 is invalid\n      let point, fake; // Fake point is used to const-time mult\n      const mul = n => wnaf.cached(this, n, p => (0, curve_ts_1.normalizeZ)(Point, p));\n      /** See docs for {@link EndomorphismOpts} */\n      if (endo) {\n        const {\n          k1neg,\n          k1,\n          k2neg,\n          k2\n        } = splitEndoScalarN(scalar);\n        const {\n          p: k1p,\n          f: k1f\n        } = mul(k1);\n        const {\n          p: k2p,\n          f: k2f\n        } = mul(k2);\n        fake = k1f.add(k2f);\n        point = finishEndo(endo.beta, k1p, k2p, k1neg, k2neg);\n      } else {\n        const {\n          p,\n          f\n        } = mul(scalar);\n        point = p;\n        fake = f;\n      }\n      // Normalize `z` for both points, but return only real one\n      return (0, curve_ts_1.normalizeZ)(Point, [point, fake])[0];\n    }\n    /**\n     * Non-constant-time multiplication. Uses double-and-add algorithm.\n     * It's faster, but should only be used when you don't care about\n     * an exposed secret key e.g. sig verification, which works over *public* keys.\n     */\n    multiplyUnsafe(sc) {\n      const {\n        endo\n      } = extraOpts;\n      const p = this;\n      if (!Fn.isValid(sc)) throw new Error('invalid scalar: out of range'); // 0 is valid\n      if (sc === _0n || p.is0()) return Point.ZERO;\n      if (sc === _1n) return p; // fast-path\n      if (wnaf.hasCache(this)) return this.multiply(sc);\n      if (endo) {\n        const {\n          k1neg,\n          k1,\n          k2neg,\n          k2\n        } = splitEndoScalarN(sc);\n        const {\n          p1,\n          p2\n        } = (0, curve_ts_1.mulEndoUnsafe)(Point, p, k1, k2); // 30% faster vs wnaf.unsafe\n        return finishEndo(endo.beta, p1, p2, k1neg, k2neg);\n      } else {\n        return wnaf.unsafe(p, sc);\n      }\n    }\n    multiplyAndAddUnsafe(Q, a, b) {\n      const sum = this.multiplyUnsafe(a).add(Q.multiplyUnsafe(b));\n      return sum.is0() ? undefined : sum;\n    }\n    /**\n     * Converts Projective point to affine (x, y) coordinates.\n     * @param invertedZ Z^-1 (inverted zero) - optional, precomputation is useful for invertBatch\n     */\n    toAffine(invertedZ) {\n      return toAffineMemo(this, invertedZ);\n    }\n    /**\n     * Checks whether Point is free of torsion elements (is in prime subgroup).\n     * Always torsion-free for cofactor=1 curves.\n     */\n    isTorsionFree() {\n      const {\n        isTorsionFree\n      } = extraOpts;\n      if (cofactor === _1n) return true;\n      if (isTorsionFree) return isTorsionFree(Point, this);\n      return wnaf.unsafe(this, CURVE_ORDER).is0();\n    }\n    clearCofactor() {\n      const {\n        clearCofactor\n      } = extraOpts;\n      if (cofactor === _1n) return this; // Fast-path\n      if (clearCofactor) return clearCofactor(Point, this);\n      return this.multiplyUnsafe(cofactor);\n    }\n    isSmallOrder() {\n      // can we use this.clearCofactor()?\n      return this.multiplyUnsafe(cofactor).is0();\n    }\n    toBytes(isCompressed = true) {\n      (0, utils_ts_1._abool2)(isCompressed, 'isCompressed');\n      this.assertValidity();\n      return encodePoint(Point, this, isCompressed);\n    }\n    toHex(isCompressed = true) {\n      return (0, utils_ts_1.bytesToHex)(this.toBytes(isCompressed));\n    }\n    toString() {\n      return `<Point ${this.is0() ? 'ZERO' : this.toHex()}>`;\n    }\n    // TODO: remove\n    get px() {\n      return this.X;\n    }\n    get py() {\n      return this.X;\n    }\n    get pz() {\n      return this.Z;\n    }\n    toRawBytes(isCompressed = true) {\n      return this.toBytes(isCompressed);\n    }\n    _setWindowSize(windowSize) {\n      this.precompute(windowSize);\n    }\n    static normalizeZ(points) {\n      return (0, curve_ts_1.normalizeZ)(Point, points);\n    }\n    static msm(points, scalars) {\n      return (0, curve_ts_1.pippenger)(Point, Fn, points, scalars);\n    }\n    static fromPrivateKey(privateKey) {\n      return Point.BASE.multiply(_normFnElement(Fn, privateKey));\n    }\n  }\n  // base / generator point\n  Point.BASE = new Point(CURVE.Gx, CURVE.Gy, Fp.ONE);\n  // zero / infinity / identity point\n  Point.ZERO = new Point(Fp.ZERO, Fp.ONE, Fp.ZERO); // 0, 1, 0\n  // math field\n  Point.Fp = Fp;\n  // scalar field\n  Point.Fn = Fn;\n  const bits = Fn.BITS;\n  const wnaf = new curve_ts_1.wNAF(Point, extraOpts.endo ? Math.ceil(bits / 2) : bits);\n  Point.BASE.precompute(8); // Enable precomputes. Slows down first publicKey computation by 20ms.\n  return Point;\n}\n// Points start with byte 0x02 when y is even; otherwise 0x03\nfunction pprefix(hasEvenY) {\n  return Uint8Array.of(hasEvenY ? 0x02 : 0x03);\n}\n/**\n * Implementation of the Shallue and van de Woestijne method for any weierstrass curve.\n * TODO: check if there is a way to merge this with uvRatio in Edwards; move to modular.\n * b = True and y = sqrt(u / v) if (u / v) is square in F, and\n * b = False and y = sqrt(Z * (u / v)) otherwise.\n * @param Fp\n * @param Z\n * @returns\n */\nfunction SWUFpSqrtRatio(Fp, Z) {\n  // Generic implementation\n  const q = Fp.ORDER;\n  let l = _0n;\n  for (let o = q - _1n; o % _2n === _0n; o /= _2n) l += _1n;\n  const c1 = l; // 1. c1, the largest integer such that 2^c1 divides q - 1.\n  // We need 2n ** c1 and 2n ** (c1-1). We can't use **; but we can use <<.\n  // 2n ** c1 == 2n << (c1-1)\n  const _2n_pow_c1_1 = _2n << c1 - _1n - _1n;\n  const _2n_pow_c1 = _2n_pow_c1_1 * _2n;\n  const c2 = (q - _1n) / _2n_pow_c1; // 2. c2 = (q - 1) / (2^c1)  # Integer arithmetic\n  const c3 = (c2 - _1n) / _2n; // 3. c3 = (c2 - 1) / 2            # Integer arithmetic\n  const c4 = _2n_pow_c1 - _1n; // 4. c4 = 2^c1 - 1                # Integer arithmetic\n  const c5 = _2n_pow_c1_1; // 5. c5 = 2^(c1 - 1)                  # Integer arithmetic\n  const c6 = Fp.pow(Z, c2); // 6. c6 = Z^c2\n  const c7 = Fp.pow(Z, (c2 + _1n) / _2n); // 7. c7 = Z^((c2 + 1) / 2)\n  let sqrtRatio = (u, v) => {\n    let tv1 = c6; // 1. tv1 = c6\n    let tv2 = Fp.pow(v, c4); // 2. tv2 = v^c4\n    let tv3 = Fp.sqr(tv2); // 3. tv3 = tv2^2\n    tv3 = Fp.mul(tv3, v); // 4. tv3 = tv3 * v\n    let tv5 = Fp.mul(u, tv3); // 5. tv5 = u * tv3\n    tv5 = Fp.pow(tv5, c3); // 6. tv5 = tv5^c3\n    tv5 = Fp.mul(tv5, tv2); // 7. tv5 = tv5 * tv2\n    tv2 = Fp.mul(tv5, v); // 8. tv2 = tv5 * v\n    tv3 = Fp.mul(tv5, u); // 9. tv3 = tv5 * u\n    let tv4 = Fp.mul(tv3, tv2); // 10. tv4 = tv3 * tv2\n    tv5 = Fp.pow(tv4, c5); // 11. tv5 = tv4^c5\n    let isQR = Fp.eql(tv5, Fp.ONE); // 12. isQR = tv5 == 1\n    tv2 = Fp.mul(tv3, c7); // 13. tv2 = tv3 * c7\n    tv5 = Fp.mul(tv4, tv1); // 14. tv5 = tv4 * tv1\n    tv3 = Fp.cmov(tv2, tv3, isQR); // 15. tv3 = CMOV(tv2, tv3, isQR)\n    tv4 = Fp.cmov(tv5, tv4, isQR); // 16. tv4 = CMOV(tv5, tv4, isQR)\n    // 17. for i in (c1, c1 - 1, ..., 2):\n    for (let i = c1; i > _1n; i--) {\n      let tv5 = i - _2n; // 18.    tv5 = i - 2\n      tv5 = _2n << tv5 - _1n; // 19.    tv5 = 2^tv5\n      let tvv5 = Fp.pow(tv4, tv5); // 20.    tv5 = tv4^tv5\n      const e1 = Fp.eql(tvv5, Fp.ONE); // 21.    e1 = tv5 == 1\n      tv2 = Fp.mul(tv3, tv1); // 22.    tv2 = tv3 * tv1\n      tv1 = Fp.mul(tv1, tv1); // 23.    tv1 = tv1 * tv1\n      tvv5 = Fp.mul(tv4, tv1); // 24.    tv5 = tv4 * tv1\n      tv3 = Fp.cmov(tv2, tv3, e1); // 25.    tv3 = CMOV(tv2, tv3, e1)\n      tv4 = Fp.cmov(tvv5, tv4, e1); // 26.    tv4 = CMOV(tv5, tv4, e1)\n    }\n    return {\n      isValid: isQR,\n      value: tv3\n    };\n  };\n  if (Fp.ORDER % _4n === _3n) {\n    // sqrt_ratio_3mod4(u, v)\n    const c1 = (Fp.ORDER - _3n) / _4n; // 1. c1 = (q - 3) / 4     # Integer arithmetic\n    const c2 = Fp.sqrt(Fp.neg(Z)); // 2. c2 = sqrt(-Z)\n    sqrtRatio = (u, v) => {\n      let tv1 = Fp.sqr(v); // 1. tv1 = v^2\n      const tv2 = Fp.mul(u, v); // 2. tv2 = u * v\n      tv1 = Fp.mul(tv1, tv2); // 3. tv1 = tv1 * tv2\n      let y1 = Fp.pow(tv1, c1); // 4. y1 = tv1^c1\n      y1 = Fp.mul(y1, tv2); // 5. y1 = y1 * tv2\n      const y2 = Fp.mul(y1, c2); // 6. y2 = y1 * c2\n      const tv3 = Fp.mul(Fp.sqr(y1), v); // 7. tv3 = y1^2; 8. tv3 = tv3 * v\n      const isQR = Fp.eql(tv3, u); // 9. isQR = tv3 == u\n      let y = Fp.cmov(y2, y1, isQR); // 10. y = CMOV(y2, y1, isQR)\n      return {\n        isValid: isQR,\n        value: y\n      }; // 11. return (isQR, y) isQR ? y : y*c2\n    };\n  }\n  // No curves uses that\n  // if (Fp.ORDER % _8n === _5n) // sqrt_ratio_5mod8\n  return sqrtRatio;\n}\n/**\n * Simplified Shallue-van de Woestijne-Ulas Method\n * https://www.rfc-editor.org/rfc/rfc9380#section-6.6.2\n */\nfunction mapToCurveSimpleSWU(Fp, opts) {\n  (0, modular_ts_1.validateField)(Fp);\n  const {\n    A,\n    B,\n    Z\n  } = opts;\n  if (!Fp.isValid(A) || !Fp.isValid(B) || !Fp.isValid(Z)) throw new Error('mapToCurveSimpleSWU: invalid opts');\n  const sqrtRatio = SWUFpSqrtRatio(Fp, Z);\n  if (!Fp.isOdd) throw new Error('Field does not have .isOdd()');\n  // Input: u, an element of F.\n  // Output: (x, y), a point on E.\n  return u => {\n    // prettier-ignore\n    let tv1, tv2, tv3, tv4, tv5, tv6, x, y;\n    tv1 = Fp.sqr(u); // 1.  tv1 = u^2\n    tv1 = Fp.mul(tv1, Z); // 2.  tv1 = Z * tv1\n    tv2 = Fp.sqr(tv1); // 3.  tv2 = tv1^2\n    tv2 = Fp.add(tv2, tv1); // 4.  tv2 = tv2 + tv1\n    tv3 = Fp.add(tv2, Fp.ONE); // 5.  tv3 = tv2 + 1\n    tv3 = Fp.mul(tv3, B); // 6.  tv3 = B * tv3\n    tv4 = Fp.cmov(Z, Fp.neg(tv2), !Fp.eql(tv2, Fp.ZERO)); // 7.  tv4 = CMOV(Z, -tv2, tv2 != 0)\n    tv4 = Fp.mul(tv4, A); // 8.  tv4 = A * tv4\n    tv2 = Fp.sqr(tv3); // 9.  tv2 = tv3^2\n    tv6 = Fp.sqr(tv4); // 10. tv6 = tv4^2\n    tv5 = Fp.mul(tv6, A); // 11. tv5 = A * tv6\n    tv2 = Fp.add(tv2, tv5); // 12. tv2 = tv2 + tv5\n    tv2 = Fp.mul(tv2, tv3); // 13. tv2 = tv2 * tv3\n    tv6 = Fp.mul(tv6, tv4); // 14. tv6 = tv6 * tv4\n    tv5 = Fp.mul(tv6, B); // 15. tv5 = B * tv6\n    tv2 = Fp.add(tv2, tv5); // 16. tv2 = tv2 + tv5\n    x = Fp.mul(tv1, tv3); // 17.   x = tv1 * tv3\n    const {\n      isValid,\n      value\n    } = sqrtRatio(tv2, tv6); // 18. (is_gx1_square, y1) = sqrt_ratio(tv2, tv6)\n    y = Fp.mul(tv1, u); // 19.   y = tv1 * u  -> Z * u^3 * y1\n    y = Fp.mul(y, value); // 20.   y = y * y1\n    x = Fp.cmov(x, tv3, isValid); // 21.   x = CMOV(x, tv3, is_gx1_square)\n    y = Fp.cmov(y, value, isValid); // 22.   y = CMOV(y, y1, is_gx1_square)\n    const e1 = Fp.isOdd(u) === Fp.isOdd(y); // 23.  e1 = sgn0(u) == sgn0(y)\n    y = Fp.cmov(Fp.neg(y), y, e1); // 24.   y = CMOV(-y, y, e1)\n    const tv4_inv = (0, modular_ts_1.FpInvertBatch)(Fp, [tv4], true)[0];\n    x = Fp.mul(x, tv4_inv); // 25.   x = x / tv4\n    return {\n      x,\n      y\n    };\n  };\n}\nfunction getWLengths(Fp, Fn) {\n  return {\n    secretKey: Fn.BYTES,\n    publicKey: 1 + Fp.BYTES,\n    publicKeyUncompressed: 1 + 2 * Fp.BYTES,\n    publicKeyHasPrefix: true,\n    signature: 2 * Fn.BYTES\n  };\n}\n/**\n * Sometimes users only need getPublicKey, getSharedSecret, and secret key handling.\n * This helper ensures no signature functionality is present. Less code, smaller bundle size.\n */\nfunction ecdh(Point, ecdhOpts = {}) {\n  const {\n    Fn\n  } = Point;\n  const randomBytes_ = ecdhOpts.randomBytes || utils_ts_1.randomBytes;\n  const lengths = Object.assign(getWLengths(Point.Fp, Fn), {\n    seed: (0, modular_ts_1.getMinHashLength)(Fn.ORDER)\n  });\n  function isValidSecretKey(secretKey) {\n    try {\n      return !!_normFnElement(Fn, secretKey);\n    } catch (error) {\n      return false;\n    }\n  }\n  function isValidPublicKey(publicKey, isCompressed) {\n    const {\n      publicKey: comp,\n      publicKeyUncompressed\n    } = lengths;\n    try {\n      const l = publicKey.length;\n      if (isCompressed === true && l !== comp) return false;\n      if (isCompressed === false && l !== publicKeyUncompressed) return false;\n      return !!Point.fromBytes(publicKey);\n    } catch (error) {\n      return false;\n    }\n  }\n  /**\n   * Produces cryptographically secure secret key from random of size\n   * (groupLen + ceil(groupLen / 2)) with modulo bias being negligible.\n   */\n  function randomSecretKey(seed = randomBytes_(lengths.seed)) {\n    return (0, modular_ts_1.mapHashToField)((0, utils_ts_1._abytes2)(seed, lengths.seed, 'seed'), Fn.ORDER);\n  }\n  /**\n   * Computes public key for a secret key. Checks for validity of the secret key.\n   * @param isCompressed whether to return compact (default), or full key\n   * @returns Public key, full when isCompressed=false; short when isCompressed=true\n   */\n  function getPublicKey(secretKey, isCompressed = true) {\n    return Point.BASE.multiply(_normFnElement(Fn, secretKey)).toBytes(isCompressed);\n  }\n  function keygen(seed) {\n    const secretKey = randomSecretKey(seed);\n    return {\n      secretKey,\n      publicKey: getPublicKey(secretKey)\n    };\n  }\n  /**\n   * Quick and dirty check for item being public key. Does not validate hex, or being on-curve.\n   */\n  function isProbPub(item) {\n    if (typeof item === 'bigint') return false;\n    if (item instanceof Point) return true;\n    const {\n      secretKey,\n      publicKey,\n      publicKeyUncompressed\n    } = lengths;\n    if (Fn.allowedLengths || secretKey === publicKey) return undefined;\n    const l = (0, utils_ts_1.ensureBytes)('key', item).length;\n    return l === publicKey || l === publicKeyUncompressed;\n  }\n  /**\n   * ECDH (Elliptic Curve Diffie Hellman).\n   * Computes shared public key from secret key A and public key B.\n   * Checks: 1) secret key validity 2) shared key is on-curve.\n   * Does NOT hash the result.\n   * @param isCompressed whether to return compact (default), or full key\n   * @returns shared public key\n   */\n  function getSharedSecret(secretKeyA, publicKeyB, isCompressed = true) {\n    if (isProbPub(secretKeyA) === true) throw new Error('first arg must be private key');\n    if (isProbPub(publicKeyB) === false) throw new Error('second arg must be public key');\n    const s = _normFnElement(Fn, secretKeyA);\n    const b = Point.fromHex(publicKeyB); // checks for being on-curve\n    return b.multiply(s).toBytes(isCompressed);\n  }\n  const utils = {\n    isValidSecretKey,\n    isValidPublicKey,\n    randomSecretKey,\n    // TODO: remove\n    isValidPrivateKey: isValidSecretKey,\n    randomPrivateKey: randomSecretKey,\n    normPrivateKeyToScalar: key => _normFnElement(Fn, key),\n    precompute(windowSize = 8, point = Point.BASE) {\n      return point.precompute(windowSize, false);\n    }\n  };\n  return Object.freeze({\n    getPublicKey,\n    getSharedSecret,\n    keygen,\n    Point,\n    utils,\n    lengths\n  });\n}\n/**\n * Creates ECDSA signing interface for given elliptic curve `Point` and `hash` function.\n * We need `hash` for 2 features:\n * 1. Message prehash-ing. NOT used if `sign` / `verify` are called with `prehash: false`\n * 2. k generation in `sign`, using HMAC-drbg(hash)\n *\n * ECDSAOpts are only rarely needed.\n *\n * @example\n * ```js\n * const p256_Point = weierstrass(...);\n * const p256_sha256 = ecdsa(p256_Point, sha256);\n * const p256_sha224 = ecdsa(p256_Point, sha224);\n * const p256_sha224_r = ecdsa(p256_Point, sha224, { randomBytes: (length) => { ... } });\n * ```\n */\nfunction ecdsa(Point, hash, ecdsaOpts = {}) {\n  (0, utils_1.ahash)(hash);\n  (0, utils_ts_1._validateObject)(ecdsaOpts, {}, {\n    hmac: 'function',\n    lowS: 'boolean',\n    randomBytes: 'function',\n    bits2int: 'function',\n    bits2int_modN: 'function'\n  });\n  const randomBytes = ecdsaOpts.randomBytes || utils_ts_1.randomBytes;\n  const hmac = ecdsaOpts.hmac || ((key, ...msgs) => (0, hmac_js_1.hmac)(hash, key, (0, utils_ts_1.concatBytes)(...msgs)));\n  const {\n    Fp,\n    Fn\n  } = Point;\n  const {\n    ORDER: CURVE_ORDER,\n    BITS: fnBits\n  } = Fn;\n  const {\n    keygen,\n    getPublicKey,\n    getSharedSecret,\n    utils,\n    lengths\n  } = ecdh(Point, ecdsaOpts);\n  const defaultSigOpts = {\n    prehash: false,\n    lowS: typeof ecdsaOpts.lowS === 'boolean' ? ecdsaOpts.lowS : false,\n    format: undefined,\n    //'compact' as ECDSASigFormat,\n    extraEntropy: false\n  };\n  const defaultSigOpts_format = 'compact';\n  function isBiggerThanHalfOrder(number) {\n    const HALF = CURVE_ORDER >> _1n;\n    return number > HALF;\n  }\n  function validateRS(title, num) {\n    if (!Fn.isValidNot0(num)) throw new Error(`invalid signature ${title}: out of range 1..Point.Fn.ORDER`);\n    return num;\n  }\n  function validateSigLength(bytes, format) {\n    validateSigFormat(format);\n    const size = lengths.signature;\n    const sizer = format === 'compact' ? size : format === 'recovered' ? size + 1 : undefined;\n    return (0, utils_ts_1._abytes2)(bytes, sizer, `${format} signature`);\n  }\n  /**\n   * ECDSA signature with its (r, s) properties. Supports compact, recovered & DER representations.\n   */\n  class Signature {\n    constructor(r, s, recovery) {\n      this.r = validateRS('r', r); // r in [1..N-1];\n      this.s = validateRS('s', s); // s in [1..N-1];\n      if (recovery != null) this.recovery = recovery;\n      Object.freeze(this);\n    }\n    static fromBytes(bytes, format = defaultSigOpts_format) {\n      validateSigLength(bytes, format);\n      let recid;\n      if (format === 'der') {\n        const {\n          r,\n          s\n        } = exports.DER.toSig((0, utils_ts_1._abytes2)(bytes));\n        return new Signature(r, s);\n      }\n      if (format === 'recovered') {\n        recid = bytes[0];\n        format = 'compact';\n        bytes = bytes.subarray(1);\n      }\n      const L = Fn.BYTES;\n      const r = bytes.subarray(0, L);\n      const s = bytes.subarray(L, L * 2);\n      return new Signature(Fn.fromBytes(r), Fn.fromBytes(s), recid);\n    }\n    static fromHex(hex, format) {\n      return this.fromBytes((0, utils_ts_1.hexToBytes)(hex), format);\n    }\n    addRecoveryBit(recovery) {\n      return new Signature(this.r, this.s, recovery);\n    }\n    recoverPublicKey(messageHash) {\n      const FIELD_ORDER = Fp.ORDER;\n      const {\n        r,\n        s,\n        recovery: rec\n      } = this;\n      if (rec == null || ![0, 1, 2, 3].includes(rec)) throw new Error('recovery id invalid');\n      // ECDSA recovery is hard for cofactor > 1 curves.\n      // In sign, `r = q.x mod n`, and here we recover q.x from r.\n      // While recovering q.x >= n, we need to add r+n for cofactor=1 curves.\n      // However, for cofactor>1, r+n may not get q.x:\n      // r+n*i would need to be done instead where i is unknown.\n      // To easily get i, we either need to:\n      // a. increase amount of valid recid values (4, 5...); OR\n      // b. prohibit non-prime-order signatures (recid > 1).\n      const hasCofactor = CURVE_ORDER * _2n < FIELD_ORDER;\n      if (hasCofactor && rec > 1) throw new Error('recovery id is ambiguous for h>1 curve');\n      const radj = rec === 2 || rec === 3 ? r + CURVE_ORDER : r;\n      if (!Fp.isValid(radj)) throw new Error('recovery id 2 or 3 invalid');\n      const x = Fp.toBytes(radj);\n      const R = Point.fromBytes((0, utils_ts_1.concatBytes)(pprefix((rec & 1) === 0), x));\n      const ir = Fn.inv(radj); // r^-1\n      const h = bits2int_modN((0, utils_ts_1.ensureBytes)('msgHash', messageHash)); // Truncate hash\n      const u1 = Fn.create(-h * ir); // -hr^-1\n      const u2 = Fn.create(s * ir); // sr^-1\n      // (sr^-1)R-(hr^-1)G = -(hr^-1)G + (sr^-1). unsafe is fine: there is no private data.\n      const Q = Point.BASE.multiplyUnsafe(u1).add(R.multiplyUnsafe(u2));\n      if (Q.is0()) throw new Error('point at infinify');\n      Q.assertValidity();\n      return Q;\n    }\n    // Signatures should be low-s, to prevent malleability.\n    hasHighS() {\n      return isBiggerThanHalfOrder(this.s);\n    }\n    toBytes(format = defaultSigOpts_format) {\n      validateSigFormat(format);\n      if (format === 'der') return (0, utils_ts_1.hexToBytes)(exports.DER.hexFromSig(this));\n      const r = Fn.toBytes(this.r);\n      const s = Fn.toBytes(this.s);\n      if (format === 'recovered') {\n        if (this.recovery == null) throw new Error('recovery bit must be present');\n        return (0, utils_ts_1.concatBytes)(Uint8Array.of(this.recovery), r, s);\n      }\n      return (0, utils_ts_1.concatBytes)(r, s);\n    }\n    toHex(format) {\n      return (0, utils_ts_1.bytesToHex)(this.toBytes(format));\n    }\n    // TODO: remove\n    assertValidity() {}\n    static fromCompact(hex) {\n      return Signature.fromBytes((0, utils_ts_1.ensureBytes)('sig', hex), 'compact');\n    }\n    static fromDER(hex) {\n      return Signature.fromBytes((0, utils_ts_1.ensureBytes)('sig', hex), 'der');\n    }\n    normalizeS() {\n      return this.hasHighS() ? new Signature(this.r, Fn.neg(this.s), this.recovery) : this;\n    }\n    toDERRawBytes() {\n      return this.toBytes('der');\n    }\n    toDERHex() {\n      return (0, utils_ts_1.bytesToHex)(this.toBytes('der'));\n    }\n    toCompactRawBytes() {\n      return this.toBytes('compact');\n    }\n    toCompactHex() {\n      return (0, utils_ts_1.bytesToHex)(this.toBytes('compact'));\n    }\n  }\n  // RFC6979: ensure ECDSA msg is X bytes and < N. RFC suggests optional truncating via bits2octets.\n  // FIPS 186-4 4.6 suggests the leftmost min(nBitLen, outLen) bits, which matches bits2int.\n  // bits2int can produce res>N, we can do mod(res, N) since the bitLen is the same.\n  // int2octets can't be used; pads small msgs with 0: unacceptatble for trunc as per RFC vectors\n  const bits2int = ecdsaOpts.bits2int || function bits2int_def(bytes) {\n    // Our custom check \"just in case\", for protection against DoS\n    if (bytes.length > 8192) throw new Error('input is too large');\n    // For curves with nBitLength % 8 !== 0: bits2octets(bits2octets(m)) !== bits2octets(m)\n    // for some cases, since bytes.length * 8 is not actual bitLength.\n    const num = (0, utils_ts_1.bytesToNumberBE)(bytes); // check for == u8 done here\n    const delta = bytes.length * 8 - fnBits; // truncate to nBitLength leftmost bits\n    return delta > 0 ? num >> BigInt(delta) : num;\n  };\n  const bits2int_modN = ecdsaOpts.bits2int_modN || function bits2int_modN_def(bytes) {\n    return Fn.create(bits2int(bytes)); // can't use bytesToNumberBE here\n  };\n  // Pads output with zero as per spec\n  const ORDER_MASK = (0, utils_ts_1.bitMask)(fnBits);\n  /** Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`. */\n  function int2octets(num) {\n    // IMPORTANT: the check ensures working for case `Fn.BYTES != Fn.BITS * 8`\n    (0, utils_ts_1.aInRange)('num < 2^' + fnBits, num, _0n, ORDER_MASK);\n    return Fn.toBytes(num);\n  }\n  function validateMsgAndHash(message, prehash) {\n    (0, utils_ts_1._abytes2)(message, undefined, 'message');\n    return prehash ? (0, utils_ts_1._abytes2)(hash(message), undefined, 'prehashed message') : message;\n  }\n  /**\n   * Steps A, D of RFC6979 3.2.\n   * Creates RFC6979 seed; converts msg/privKey to numbers.\n   * Used only in sign, not in verify.\n   *\n   * Warning: we cannot assume here that message has same amount of bytes as curve order,\n   * this will be invalid at least for P521. Also it can be bigger for P224 + SHA256.\n   */\n  function prepSig(message, privateKey, opts) {\n    if (['recovered', 'canonical'].some(k => k in opts)) throw new Error('sign() legacy options not supported');\n    const {\n      lowS,\n      prehash,\n      extraEntropy\n    } = validateSigOpts(opts, defaultSigOpts);\n    message = validateMsgAndHash(message, prehash); // RFC6979 3.2 A: h1 = H(m)\n    // We can't later call bits2octets, since nested bits2int is broken for curves\n    // with fnBits % 8 !== 0. Because of that, we unwrap it here as int2octets call.\n    // const bits2octets = (bits) => int2octets(bits2int_modN(bits))\n    const h1int = bits2int_modN(message);\n    const d = _normFnElement(Fn, privateKey); // validate secret key, convert to bigint\n    const seedArgs = [int2octets(d), int2octets(h1int)];\n    // extraEntropy. RFC6979 3.6: additional k' (optional).\n    if (extraEntropy != null && extraEntropy !== false) {\n      // K = HMAC_K(V || 0x00 || int2octets(x) || bits2octets(h1) || k')\n      // gen random bytes OR pass as-is\n      const e = extraEntropy === true ? randomBytes(lengths.secretKey) : extraEntropy;\n      seedArgs.push((0, utils_ts_1.ensureBytes)('extraEntropy', e)); // check for being bytes\n    }\n    const seed = (0, utils_ts_1.concatBytes)(...seedArgs); // Step D of RFC6979 3.2\n    const m = h1int; // NOTE: no need to call bits2int second time here, it is inside truncateHash!\n    // Converts signature params into point w r/s, checks result for validity.\n    // To transform k => Signature:\n    // q = k⋅G\n    // r = q.x mod n\n    // s = k^-1(m + rd) mod n\n    // Can use scalar blinding b^-1(bm + bdr) where b ∈ [1,q−1] according to\n    // https://tches.iacr.org/index.php/TCHES/article/view/7337/6509. We've decided against it:\n    // a) dependency on CSPRNG b) 15% slowdown c) doesn't really help since bigints are not CT\n    function k2sig(kBytes) {\n      // RFC 6979 Section 3.2, step 3: k = bits2int(T)\n      // Important: all mod() calls here must be done over N\n      const k = bits2int(kBytes); // mod n, not mod p\n      if (!Fn.isValidNot0(k)) return; // Valid scalars (including k) must be in 1..N-1\n      const ik = Fn.inv(k); // k^-1 mod n\n      const q = Point.BASE.multiply(k).toAffine(); // q = k⋅G\n      const r = Fn.create(q.x); // r = q.x mod n\n      if (r === _0n) return;\n      const s = Fn.create(ik * Fn.create(m + r * d)); // Not using blinding here, see comment above\n      if (s === _0n) return;\n      let recovery = (q.x === r ? 0 : 2) | Number(q.y & _1n); // recovery bit (2 or 3, when q.x > n)\n      let normS = s;\n      if (lowS && isBiggerThanHalfOrder(s)) {\n        normS = Fn.neg(s); // if lowS was passed, ensure s is always\n        recovery ^= 1; // // in the bottom half of N\n      }\n      return new Signature(r, normS, recovery); // use normS, not s\n    }\n    return {\n      seed,\n      k2sig\n    };\n  }\n  /**\n   * Signs message hash with a secret key.\n   *\n   * ```\n   * sign(m, d) where\n   *   k = rfc6979_hmac_drbg(m, d)\n   *   (x, y) = G × k\n   *   r = x mod n\n   *   s = (m + dr) / k mod n\n   * ```\n   */\n  function sign(message, secretKey, opts = {}) {\n    message = (0, utils_ts_1.ensureBytes)('message', message);\n    const {\n      seed,\n      k2sig\n    } = prepSig(message, secretKey, opts); // Steps A, D of RFC6979 3.2.\n    const drbg = (0, utils_ts_1.createHmacDrbg)(hash.outputLen, Fn.BYTES, hmac);\n    const sig = drbg(seed, k2sig); // Steps B, C, D, E, F, G\n    return sig;\n  }\n  function tryParsingSig(sg) {\n    // Try to deduce format\n    let sig = undefined;\n    const isHex = typeof sg === 'string' || (0, utils_ts_1.isBytes)(sg);\n    const isObj = !isHex && sg !== null && typeof sg === 'object' && typeof sg.r === 'bigint' && typeof sg.s === 'bigint';\n    if (!isHex && !isObj) throw new Error('invalid signature, expected Uint8Array, hex string or Signature instance');\n    if (isObj) {\n      sig = new Signature(sg.r, sg.s);\n    } else if (isHex) {\n      try {\n        sig = Signature.fromBytes((0, utils_ts_1.ensureBytes)('sig', sg), 'der');\n      } catch (derError) {\n        if (!(derError instanceof exports.DER.Err)) throw derError;\n      }\n      if (!sig) {\n        try {\n          sig = Signature.fromBytes((0, utils_ts_1.ensureBytes)('sig', sg), 'compact');\n        } catch (error) {\n          return false;\n        }\n      }\n    }\n    if (!sig) return false;\n    return sig;\n  }\n  /**\n   * Verifies a signature against message and public key.\n   * Rejects lowS signatures by default: see {@link ECDSAVerifyOpts}.\n   * Implements section 4.1.4 from https://www.secg.org/sec1-v2.pdf:\n   *\n   * ```\n   * verify(r, s, h, P) where\n   *   u1 = hs^-1 mod n\n   *   u2 = rs^-1 mod n\n   *   R = u1⋅G + u2⋅P\n   *   mod(R.x, n) == r\n   * ```\n   */\n  function verify(signature, message, publicKey, opts = {}) {\n    const {\n      lowS,\n      prehash,\n      format\n    } = validateSigOpts(opts, defaultSigOpts);\n    publicKey = (0, utils_ts_1.ensureBytes)('publicKey', publicKey);\n    message = validateMsgAndHash((0, utils_ts_1.ensureBytes)('message', message), prehash);\n    if ('strict' in opts) throw new Error('options.strict was renamed to lowS');\n    const sig = format === undefined ? tryParsingSig(signature) : Signature.fromBytes((0, utils_ts_1.ensureBytes)('sig', signature), format);\n    if (sig === false) return false;\n    try {\n      const P = Point.fromBytes(publicKey);\n      if (lowS && sig.hasHighS()) return false;\n      const {\n        r,\n        s\n      } = sig;\n      const h = bits2int_modN(message); // mod n, not mod p\n      const is = Fn.inv(s); // s^-1 mod n\n      const u1 = Fn.create(h * is); // u1 = hs^-1 mod n\n      const u2 = Fn.create(r * is); // u2 = rs^-1 mod n\n      const R = Point.BASE.multiplyUnsafe(u1).add(P.multiplyUnsafe(u2)); // u1⋅G + u2⋅P\n      if (R.is0()) return false;\n      const v = Fn.create(R.x); // v = r.x mod n\n      return v === r;\n    } catch (e) {\n      return false;\n    }\n  }\n  function recoverPublicKey(signature, message, opts = {}) {\n    const {\n      prehash\n    } = validateSigOpts(opts, defaultSigOpts);\n    message = validateMsgAndHash(message, prehash);\n    return Signature.fromBytes(signature, 'recovered').recoverPublicKey(message).toBytes();\n  }\n  return Object.freeze({\n    keygen,\n    getPublicKey,\n    getSharedSecret,\n    utils,\n    lengths,\n    Point,\n    sign,\n    verify,\n    recoverPublicKey,\n    Signature,\n    hash\n  });\n}\n/** @deprecated use `weierstrass` in newer releases */\nfunction weierstrassPoints(c) {\n  const {\n    CURVE,\n    curveOpts\n  } = _weierstrass_legacy_opts_to_new(c);\n  const Point = weierstrassN(CURVE, curveOpts);\n  return _weierstrass_new_output_to_legacy(c, Point);\n}\nfunction _weierstrass_legacy_opts_to_new(c) {\n  const CURVE = {\n    a: c.a,\n    b: c.b,\n    p: c.Fp.ORDER,\n    n: c.n,\n    h: c.h,\n    Gx: c.Gx,\n    Gy: c.Gy\n  };\n  const Fp = c.Fp;\n  let allowedLengths = c.allowedPrivateKeyLengths ? Array.from(new Set(c.allowedPrivateKeyLengths.map(l => Math.ceil(l / 2)))) : undefined;\n  const Fn = (0, modular_ts_1.Field)(CURVE.n, {\n    BITS: c.nBitLength,\n    allowedLengths: allowedLengths,\n    modFromBytes: c.wrapPrivateKey\n  });\n  const curveOpts = {\n    Fp,\n    Fn,\n    allowInfinityPoint: c.allowInfinityPoint,\n    endo: c.endo,\n    isTorsionFree: c.isTorsionFree,\n    clearCofactor: c.clearCofactor,\n    fromBytes: c.fromBytes,\n    toBytes: c.toBytes\n  };\n  return {\n    CURVE,\n    curveOpts\n  };\n}\nfunction _ecdsa_legacy_opts_to_new(c) {\n  const {\n    CURVE,\n    curveOpts\n  } = _weierstrass_legacy_opts_to_new(c);\n  const ecdsaOpts = {\n    hmac: c.hmac,\n    randomBytes: c.randomBytes,\n    lowS: c.lowS,\n    bits2int: c.bits2int,\n    bits2int_modN: c.bits2int_modN\n  };\n  return {\n    CURVE,\n    curveOpts,\n    hash: c.hash,\n    ecdsaOpts\n  };\n}\nfunction _legacyHelperEquat(Fp, a, b) {\n  /**\n   * y² = x³ + ax + b: Short weierstrass curve formula. Takes x, returns y².\n   * @returns y²\n   */\n  function weierstrassEquation(x) {\n    const x2 = Fp.sqr(x); // x * x\n    const x3 = Fp.mul(x2, x); // x² * x\n    return Fp.add(Fp.add(x3, Fp.mul(x, a)), b); // x³ + a * x + b\n  }\n  return weierstrassEquation;\n}\nfunction _weierstrass_new_output_to_legacy(c, Point) {\n  const {\n    Fp,\n    Fn\n  } = Point;\n  function isWithinCurveOrder(num) {\n    return (0, utils_ts_1.inRange)(num, _1n, Fn.ORDER);\n  }\n  const weierstrassEquation = _legacyHelperEquat(Fp, c.a, c.b);\n  return Object.assign({}, {\n    CURVE: c,\n    Point: Point,\n    ProjectivePoint: Point,\n    normPrivateKeyToScalar: key => _normFnElement(Fn, key),\n    weierstrassEquation,\n    isWithinCurveOrder\n  });\n}\nfunction _ecdsa_new_output_to_legacy(c, _ecdsa) {\n  const Point = _ecdsa.Point;\n  return Object.assign({}, _ecdsa, {\n    ProjectivePoint: Point,\n    CURVE: Object.assign({}, c, (0, modular_ts_1.nLength)(Point.Fn.ORDER, Point.Fn.BITS))\n  });\n}\n// _ecdsa_legacy\nfunction weierstrass(c) {\n  const {\n    CURVE,\n    curveOpts,\n    hash,\n    ecdsaOpts\n  } = _ecdsa_legacy_opts_to_new(c);\n  const Point = weierstrassN(CURVE, curveOpts);\n  const signs = ecdsa(Point, hash, ecdsaOpts);\n  return _ecdsa_new_output_to_legacy(c, signs);\n}\n//# sourceMappingURL=weierstrass.js.map","map":null,"metadata":{},"sourceType":"script","externalDependencies":[]}