Code style

TypeScript strict, ESM, no default exports.

Comments explain why, not what. A comment restating the code is noise. A comment explaining that aux_rand is fixed to zero to close a covert channel, and that this is a deliberate trade against fault resistance, is the reason anyone can review this code at all.

Security-relevant code names the spec id it implements in a comment. When someone changes that code later, they need to know which spec they are about to falsify.

Secrets use the Secret wrapper, never a raw Buffer or Uint8Array. No lint rule enforces this yet: review does, so a raw secret buffer is a reason to block a pull request. The wrapper's zeroization is tested in packages/core/test/util.secret.test.ts. It exists so that zeroization is explicit and auditable rather than something everyone remembers to do until one person does not.

Never silently catch an error in a signing path. Fail loudly and visibly. A swallowed exception in this codebase is how a user signs something they did not review.

---