//! Bernstein-Yang constant-time modular inversion via 724 divsteps.
//!
//! `Divstep` encapsulates the full SafeGCD state machine: `delta`, signed
//! `(f, g)` pair, and Bézout coefficients `(d, e)`. Twelve macroiterations
//! of 62 divsteps each guarantee convergence for 256-bit moduli.

use crate::u256::U256;

/// State for Bernstein-Yang constant-time modular inversion.
///
/// Maintains:
/// - `delta`: divstep counter (starts at 1)
/// - `f`, `g`: signed 256-bit values being reduced toward `gcd(f, g)`
/// - `f_neg`, `g_neg`: sign flags for `f` and `g`
/// - `d`, `e`: Bézout coefficients tracking `d*modulus + e*input = g`
/// - `modulus`: the prime modulus
pub(crate) struct Divstep {
    delta: i64,
    f: U256,
    f_neg: bool,
    g: U256,
    g_neg: bool,
    d: U256,
    e: U256,
    modulus: U256,
}

mod new;
mod run;
mod macrostep;
mod inverse;
