@0xpolygonid/js-sdk 1.17.6 → 1.17.8

package/dist/browser/esm/index.js

@@ -2339,9 +2339,9 @@ const sha512$1 = /* @__PURE__ */ wrapConstructor$1(() => new SHA512$1());
 // This is OK: `abstract` directory does not use noble-hashes.
 // User may opt-in into using different hashing library. This way, noble-hashes
 // won't be included into their bundle.
-const _0n$a = BigInt(0);
-const _1n$d = BigInt(1);
-const _2n$9 = BigInt(2);
+const _0n$a = /* @__PURE__ */ BigInt(0);
+const _1n$d = /* @__PURE__ */ BigInt(1);
+const _2n$9 = /* @__PURE__ */ BigInt(2);
 function isBytes$1(a) {
     return (a instanceof Uint8Array ||
         (a != null && typeof a === 'object' && a.constructor.name === 'Uint8Array'));
@@ -2350,6 +2350,10 @@ function abytes(item) {
     if (!isBytes$1(item))
         throw new Error('Uint8Array expected');
 }
+function abool(title, value) {
+    if (typeof value !== 'boolean')
+        throw new Error(`${title} must be valid boolean, got "${value}".`);
+}
 // Array where index 0xf0 (240) is mapped to string 'f0'
 const hexes$1 = /* @__PURE__ */ Array.from({ length: 256 }, (_, i) => i.toString(16).padStart(2, '0'));
 /**
@@ -2492,6 +2496,25 @@ function utf8ToBytes$2(str) {
         throw new Error(`utf8ToBytes expected string, got ${typeof str}`);
     return new Uint8Array(new TextEncoder().encode(str)); // https://bugzil.la/1681809
 }
+// Is positive bigint
+const isPosBig = (n) => typeof n === 'bigint' && _0n$a <= n;
+function inRange(n, min, max) {
+    return isPosBig(n) && isPosBig(min) && isPosBig(max) && min <= n && n < max;
+}
+/**
+ * Asserts min <= n < max. NOTE: It's < max and not <= max.
+ * @example
+ * aInRange('x', x, 1n, 256n); // would assume x is in (1n..255n)
+ */
+function aInRange(title, n, min, max) {
+    // Why min <= n < max and not a (min < n < max) OR b (min <= n <= max)?
+    // consider P=256n, min=0n, max=P
+    // - a for min=0 would require -1:          `inRange('x', x, -1n, P)`
+    // - b would commonly require subtraction:  `inRange('x', x, 0n, P - 1n)`
+    // - our way is the cleanest:               `inRange('x', x, 0n, P)
+    if (!inRange(n, min, max))
+        throw new Error(`expected valid ${title}: ${min} <= n < ${max}, got ${typeof n} ${n}`);
+}
 // Bit operations
 /**
  * Calculates amount of bits in a bigint.
@@ -2622,9 +2645,32 @@ function validateObject$1(object, validators, optValidators = {}) {
 // const z2 = validateObject(o, { a: 'isSafeInteger' }, { c: 'zz' });
 // const z3 = validateObject(o, { test: 'boolean', z: 'bug' });
 // const z4 = validateObject(o, { a: 'boolean', z: 'bug' });
+/**
+ * throws not implemented error
+ */
+const notImplemented = () => {
+    throw new Error('not implemented');
+};
+/**
+ * Memoizes (caches) computation result.
+ * Uses WeakMap: the value is going auto-cleaned by GC after last reference is removed.
+ */
+function memoized(fn) {
+    const map = new WeakMap();
+    return (arg, ...args) => {
+        const val = map.get(arg);
+        if (val !== undefined)
+            return val;
+        const computed = fn(arg, ...args);
+        map.set(arg, computed);
+        return computed;
+    };
+}
 
 var ut$1 = /*#__PURE__*/Object.freeze({
     __proto__: null,
+    aInRange: aInRange,
+    abool: abool,
     abytes: abytes,
     bitGet: bitGet$1,
     bitLen: bitLen$1,
@@ -2639,7 +2685,10 @@ var ut$1 = /*#__PURE__*/Object.freeze({
     equalBytes: equalBytes$1,
     hexToBytes: hexToBytes$2,
     hexToNumber: hexToNumber$1,
+    inRange: inRange,
     isBytes: isBytes$1,
+    memoized: memoized,
+    notImplemented: notImplemented,
     numberToBytesBE: numberToBytesBE$1,
     numberToBytesLE: numberToBytesLE$1,
     numberToHexUnpadded: numberToHexUnpadded$1,
@@ -2653,7 +2702,7 @@ var ut$1 = /*#__PURE__*/Object.freeze({
 // prettier-ignore
 const _0n$9 = BigInt(0), _1n$c = BigInt(1), _2n$8 = BigInt(2), _3n$3 = BigInt(3);
 // prettier-ignore
-const _4n$1 = BigInt(4), _5n$2 = BigInt(5), _8n$2 = BigInt(8);
+const _4n$1 = BigInt(4), _5n$2 = BigInt(5), _8n$3 = BigInt(8);
 // prettier-ignore
 BigInt(9); BigInt(16);
 // Calculates a modulo b
@@ -2799,8 +2848,8 @@ function FpSqrt$1(P) {
         };
     }
     // Atkin algorithm for q ≡ 5 (mod 8), https://eprint.iacr.org/2012/685.pdf (page 10)
-    if (P % _8n$2 === _5n$2) {
-        const c1 = (P - _5n$2) / _8n$2;
+    if (P % _8n$3 === _5n$2) {
+        const c1 = (P - _5n$2) / _8n$3;
         return function sqrt5mod8(Fp, n) {
             const n2 = Fp.mul(n, _2n$8);
             const v = Fp.pow(n2, c1);
@@ -2898,6 +2947,9 @@ function nLength$1(n, nBitLength) {
  * * a) denormalized operations like mulN instead of mul
  * * b) same object shape: never add or remove keys
  * * c) Object.freeze
+ * NOTE: operations don't check 'isValid' for all elements for performance reasons,
+ * it is caller responsibility to check this.
+ * This is low-level code, please make sure you know what you doing.
  * @param ORDER prime positive bigint
  * @param bitLen how many bits the field consumes
  * @param isLE (def: false) if encoding / decoding should be in little-endian
@@ -2953,12 +3005,6 @@ function Field$1(ORDER, bitLen, isLE = false, redef = {}) {
     });
     return Object.freeze(f);
 }
-function FpSqrtEven(Fp, elm) {
-    if (!Fp.isOdd)
-        throw new Error(`Field doesn't have isOdd`);
-    const root = Fp.sqrt(elm);
-    return Fp.isOdd(root) ? Fp.neg(root) : root;
-}
 /**
  * Returns total number of bytes consumed by the field element.
  * For example, 32 bytes for usual 256-bit weierstrass curve.
@@ -3012,6 +3058,10 @@ function mapHashToField$1(key, fieldOrder, isLE = false) {
 // Abelian group utilities
 const _0n$8 = BigInt(0);
 const _1n$b = BigInt(1);
+// Since points in different groups cannot be equal (different object constructor),
+// we can have single place to store precomputes
+const pointPrecomputes = new WeakMap();
+const pointWindowSizes = new WeakMap(); // This allows use make points immutable (nothing changes inside)
 // Elliptic curve multiplication of Point by scalar. Fragile.
 // Scalars should always be less than curve order: this should be checked inside of a curve itself.
 // Creates precomputation tables for fast multiplication:
@@ -3028,7 +3078,12 @@ function wNAF$1(c, bits) {
         const neg = item.negate();
         return condition ? neg : item;
     };
+    const validateW = (W) => {
+        if (!Number.isSafeInteger(W) || W <= 0 || W > bits)
+            throw new Error(`Wrong window size=${W}, should be [1..${bits}]`);
+    };
     const opts = (W) => {
+        validateW(W);
         const windows = Math.ceil(bits / W) + 1; // +1, because
         const windowSize = 2 ** (W - 1); // -1 because we skip zero
         return { windows, windowSize };
@@ -3128,19 +3183,25 @@ function wNAF$1(c, bits) {
             // which makes it less const-time: around 1 bigint multiply.
             return { p, f };
         },
-        wNAFCached(P, precomputesMap, n, transform) {
-            // @ts-ignore
-            const W = P._WINDOW_SIZE || 1;
+        wNAFCached(P, n, transform) {
+            const W = pointWindowSizes.get(P) || 1;
             // Calculate precomputes on a first run, reuse them after
-            let comp = precomputesMap.get(P);
+            let comp = pointPrecomputes.get(P);
             if (!comp) {
                 comp = this.precomputeWindow(P, W);
-                if (W !== 1) {
-                    precomputesMap.set(P, transform(comp));
-                }
+                if (W !== 1)
+                    pointPrecomputes.set(P, transform(comp));
             }
             return this.wNAF(W, comp, n);
         },
+        // We calculate precomputes for elliptic curve point multiplication
+        // using windowed method. This specifies window size and
+        // stores precomputed values. Usually only base point would be precomputed.
+        setWindowSize(P, W) {
+            validateW(W);
+            pointWindowSizes.set(P, W);
+            pointPrecomputes.delete(P);
+        },
     };
 }
 function validateBasic$1(curve) {
@@ -3166,7 +3227,7 @@ function validateBasic$1(curve) {
 // Twisted Edwards curve. The formula is: ax² + y² = 1 + dx²y²
 // Be friendly to bad ECMAScript parsers by not using bigint literals
 // prettier-ignore
-const _0n$7 = BigInt(0), _1n$a = BigInt(1), _2n$7 = BigInt(2), _8n$1 = BigInt(8);
+const _0n$7 = BigInt(0), _1n$a = BigInt(1), _2n$7 = BigInt(2), _8n$2 = BigInt(8);
 // verification rule is either zip215 or rfc8032 / nist186-5. Consult fromHex:
 const VERIFY_DEFAULT = { zip215: true };
 function validateOpts$2(curve) {
@@ -3185,7 +3246,13 @@ function validateOpts$2(curve) {
     // Set defaults
     return Object.freeze({ ...opts });
 }
-// It is not generic twisted curve for now, but ed25519/ed448 generic implementation
+/**
+ * Creates Twisted Edwards curve with EdDSA signatures.
+ * @example
+ * import { Field } from '@noble/curves/abstract/modular';
+ * // Before that, define BigInt-s: a, d, p, n, Gx, Gy, h
+ * const curve = twistedEdwards({ a, d, Fp: Field(p), n, Gx, Gy, h })
+ */
 function twistedEdwards(curveDef) {
     const CURVE = validateOpts$2(curveDef);
     const { Fp, n: CURVE_ORDER, prehash: prehash, hash: cHash, randomBytes, nByteLength, h: cofactor, } = CURVE;
@@ -3204,28 +3271,59 @@ function twistedEdwards(curveDef) {
     const adjustScalarBytes = CURVE.adjustScalarBytes || ((bytes) => bytes); // NOOP
     const domain = CURVE.domain ||
         ((data, ctx, phflag) => {
+            abool('phflag', phflag);
             if (ctx.length || phflag)
                 throw new Error('Contexts/pre-hash are not supported');
             return data;
         }); // NOOP
-    const inBig = (n) => typeof n === 'bigint' && _0n$7 < n; // n in [1..]
-    const inRange = (n, max) => inBig(n) && inBig(max) && n < max; // n in [1..max-1]
-    const in0MaskRange = (n) => n === _0n$7 || inRange(n, MASK); // n in [0..MASK-1]
-    function assertInRange(n, max) {
-        // n in [1..max-1]
-        if (inRange(n, max))
-            return n;
-        throw new Error(`Expected valid scalar < ${max}, got ${typeof n} ${n}`);
-    }
-    function assertGE0(n) {
-        // n in [0..CURVE_ORDER-1]
-        return n === _0n$7 ? n : assertInRange(n, CURVE_ORDER); // GE = prime subgroup, not full group
+    // 0 <= n < MASK
+    // Coordinates larger than Fp.ORDER are allowed for zip215
+    function aCoordinate(title, n) {
+        aInRange('coordinate ' + title, n, _0n$7, MASK);
     }
-    const pointPrecomputes = new Map();
-    function isPoint(other) {
+    function assertPoint(other) {
         if (!(other instanceof Point))
             throw new Error('ExtendedPoint expected');
     }
+    // Converts Extended point to default (x, y) coordinates.
+    // Can accept precomputed Z^-1 - for example, from invertBatch.
+    const toAffineMemo = memoized((p, iz) => {
+        const { ex: x, ey: y, ez: z } = p;
+        const is0 = p.is0();
+        if (iz == null)
+            iz = is0 ? _8n$2 : Fp.inv(z); // 8 was chosen arbitrarily
+        const ax = modP(x * iz);
+        const ay = modP(y * iz);
+        const zz = modP(z * iz);
+        if (is0)
+            return { x: _0n$7, y: _1n$a };
+        if (zz !== _1n$a)
+            throw new Error('invZ was invalid');
+        return { x: ax, y: ay };
+    });
+    const assertValidMemo = memoized((p) => {
+        const { a, d } = CURVE;
+        if (p.is0())
+            throw new Error('bad point: ZERO'); // TODO: optimize, with vars below?
+        // Equation in affine coordinates: ax² + y² = 1 + dx²y²
+        // Equation in projective coordinates (X/Z, Y/Z, Z):  (aX² + Y²)Z² = Z⁴ + dX²Y²
+        const { ex: X, ey: Y, ez: Z, et: T } = p;
+        const X2 = modP(X * X); // X²
+        const Y2 = modP(Y * Y); // Y²
+        const Z2 = modP(Z * Z); // Z²
+        const Z4 = modP(Z2 * Z2); // Z⁴
+        const aX2 = modP(X2 * a); // aX²
+        const left = modP(Z2 * modP(aX2 + Y2)); // (aX² + Y²)Z²
+        const right = modP(Z4 + modP(d * modP(X2 * Y2))); // Z⁴ + dX²Y²
+        if (left !== right)
+            throw new Error('bad point: equation left != right (1)');
+        // In Extended coordinates we also have T, which is x*y=T/Z: check X*Y == Z*T
+        const XY = modP(X * Y);
+        const ZT = modP(Z * T);
+        if (XY !== ZT)
+            throw new Error('bad point: equation left != right (2)');
+        return true;
+    });
     // Extended Point works in extended coordinates: (x, y, z, t) ∋ (x=x/z, y=y/z, t=xy).
     // https://en.wikipedia.org/wiki/Twisted_Edwards_curve#Extended_coordinates
     class Point {
@@ -3234,14 +3332,11 @@ function twistedEdwards(curveDef) {
             this.ey = ey;
             this.ez = ez;
             this.et = et;
-            if (!in0MaskRange(ex))
-                throw new Error('x required');
-            if (!in0MaskRange(ey))
-                throw new Error('y required');
-            if (!in0MaskRange(ez))
-                throw new Error('z required');
-            if (!in0MaskRange(et))
-                throw new Error('t required');
+            aCoordinate('x', ex);
+            aCoordinate('y', ey);
+            aCoordinate('z', ez);
+            aCoordinate('t', et);
+            Object.freeze(this);
         }
         get x() {
             return this.toAffine().x;
@@ -3253,8 +3348,8 @@ function twistedEdwards(curveDef) {
             if (p instanceof Point)
                 throw new Error('extended point not allowed');
             const { x, y } = p || {};
-            if (!in0MaskRange(x) || !in0MaskRange(y))
-                throw new Error('invalid affine point');
+            aCoordinate('x', x);
+            aCoordinate('y', y);
             return new Point(x, y, _1n$a, modP(x * y));
         }
         static normalizeZ(points) {
@@ -3263,36 +3358,16 @@ function twistedEdwards(curveDef) {
         }
         // "Private method", don't use it directly
         _setWindowSize(windowSize) {
-            this._WINDOW_SIZE = windowSize;
-            pointPrecomputes.delete(this);
+            wnaf.setWindowSize(this, windowSize);
         }
         // Not required for fromHex(), which always creates valid points.
         // Could be useful for fromAffine().
         assertValidity() {
-            const { a, d } = CURVE;
-            if (this.is0())
-                throw new Error('bad point: ZERO'); // TODO: optimize, with vars below?
-            // Equation in affine coordinates: ax² + y² = 1 + dx²y²
-            // Equation in projective coordinates (X/Z, Y/Z, Z):  (aX² + Y²)Z² = Z⁴ + dX²Y²
-            const { ex: X, ey: Y, ez: Z, et: T } = this;
-            const X2 = modP(X * X); // X²
-            const Y2 = modP(Y * Y); // Y²
-            const Z2 = modP(Z * Z); // Z²
-            const Z4 = modP(Z2 * Z2); // Z⁴
-            const aX2 = modP(X2 * a); // aX²
-            const left = modP(Z2 * modP(aX2 + Y2)); // (aX² + Y²)Z²
-            const right = modP(Z4 + modP(d * modP(X2 * Y2))); // Z⁴ + dX²Y²
-            if (left !== right)
-                throw new Error('bad point: equation left != right (1)');
-            // In Extended coordinates we also have T, which is x*y=T/Z: check X*Y == Z*T
-            const XY = modP(X * Y);
-            const ZT = modP(Z * T);
-            if (XY !== ZT)
-                throw new Error('bad point: equation left != right (2)');
+            assertValidMemo(this);
         }
         // Compare one point to another.
         equals(other) {
-            isPoint(other);
+            assertPoint(other);
             const { ex: X1, ey: Y1, ez: Z1 } = this;
             const { ex: X2, ey: Y2, ez: Z2 } = other;
             const X1Z2 = modP(X1 * Z2);
@@ -3333,7 +3408,7 @@ function twistedEdwards(curveDef) {
         // https://hyperelliptic.org/EFD/g1p/auto-twisted-extended.html#addition-add-2008-hwcd
         // Cost: 9M + 1*a + 1*d + 7add.
         add(other) {
-            isPoint(other);
+            assertPoint(other);
             const { a, d } = CURVE;
             const { ex: X1, ey: Y1, ez: Z1, et: T1 } = this;
             const { ex: X2, ey: Y2, ez: Z2, et: T2 } = other;
@@ -3376,11 +3451,13 @@ function twistedEdwards(curveDef) {
             return this.add(other.negate());
         }
         wNAF(n) {
-            return wnaf.wNAFCached(this, pointPrecomputes, n, Point.normalizeZ);
+            return wnaf.wNAFCached(this, n, Point.normalizeZ);
         }
         // Constant-time multiplication.
         multiply(scalar) {
-            const { p, f } = this.wNAF(assertInRange(scalar, CURVE_ORDER));
+            const n = scalar;
+            aInRange('scalar', n, _1n$a, CURVE_ORDER); // 1 <= scalar < L
+            const { p, f } = this.wNAF(n);
             return Point.normalizeZ([p, f])[0];
         }
         // Non-constant-time multiplication. Uses double-and-add algorithm.
@@ -3388,7 +3465,8 @@ function twistedEdwards(curveDef) {
         // an exposed private key e.g. sig verification.
         // Does NOT allow scalars higher than CURVE.n.
         multiplyUnsafe(scalar) {
-            let n = assertGE0(scalar); // 0 <= scalar < CURVE.n
+            const n = scalar;
+            aInRange('scalar', n, _0n$7, CURVE_ORDER); // 0 <= scalar < L
             if (n === _0n$7)
                 return I;
             if (this.equals(I) || n === _1n$a)
@@ -3412,18 +3490,7 @@ function twistedEdwards(curveDef) {
         // Converts Extended point to default (x, y) coordinates.
         // Can accept precomputed Z^-1 - for example, from invertBatch.
         toAffine(iz) {
-            const { ex: x, ey: y, ez: z } = this;
-            const is0 = this.is0();
-            if (iz == null)
-                iz = is0 ? _8n$1 : Fp.inv(z); // 8 was chosen arbitrarily
-            const ax = modP(x * iz);
-            const ay = modP(y * iz);
-            const zz = modP(z * iz);
-            if (is0)
-                return { x: _0n$7, y: _1n$a };
-            if (zz !== _1n$a)
-                throw new Error('invZ was invalid');
-            return { x: ax, y: ay };
+            return toAffineMemo(this, iz);
         }
         clearCofactor() {
             const { h: cofactor } = CURVE;
@@ -3437,18 +3504,16 @@ function twistedEdwards(curveDef) {
             const { d, a } = CURVE;
             const len = Fp.BYTES;
             hex = ensureBytes$1('pointHex', hex, len); // copy hex to a new array
+            abool('zip215', zip215);
             const normed = hex.slice(); // copy again, we'll manipulate it
             const lastByte = hex[len - 1]; // select last byte
             normed[len - 1] = lastByte & ~0x80; // clear last bit
             const y = bytesToNumberLE$1(normed);
-            if (y === _0n$7) ;
-            else {
-                // RFC8032 prohibits >= p, but ZIP215 doesn't
-                if (zip215)
-                    assertInRange(y, MASK); // zip215=true [1..P-1] (2^255-19-1 for ed25519)
-                else
-                    assertInRange(y, Fp.ORDER); // zip215=false [1..MASK-1] (2^256-1 for ed25519)
-            }
+            // RFC8032 prohibits >= p, but ZIP215 doesn't
+            // zip215=true:  0 <= y < MASK (2^256 for ed25519)
+            // zip215=false: 0 <= y < P (2^255-19 for ed25519)
+            const max = zip215 ? MASK : Fp.ORDER;
+            aInRange('pointHex.y', y, _0n$7, max);
             // Ed25519: x² = (y²-1)/(dy²+1) mod p. Ed448: x² = (y²-1)/(dy²-1) mod p. Generic case:
             // ax²+y²=1+dx²y² => y²-1=dx²y²-ax² => y²-1=x²(dy²-a) => x²=(y²-1)/(dy²-a)
             const y2 = modP(y * y); // denominator is always non-0 mod p.
@@ -3523,7 +3588,7 @@ function twistedEdwards(curveDef) {
         const R = G.multiply(r).toRawBytes(); // R = rG
         const k = hashDomainToScalar(options.context, R, pointBytes, msg); // R || A || PH(M)
         const s = modN(r + k * scalar); // S = (r + k * s) mod L
-        assertGE0(s); // 0 <= s < l
+        aInRange('signature.s', s, _0n$7, CURVE_ORDER); // 0 <= s < l
         const res = concatBytes$2(R, numberToBytesLE$1(s, Fp.BYTES));
         return ensureBytes$1('result', res, nByteLength * 2); // 64-byte signature
     }
@@ -3533,6 +3598,8 @@ function twistedEdwards(curveDef) {
         const len = Fp.BYTES; // Verifies EdDSA signature against message and public key. RFC8032 5.1.7.
         sig = ensureBytes$1('signature', sig, 2 * len); // An extended group equation is checked.
         msg = ensureBytes$1('message', msg);
+        if (zip215 !== undefined)
+            abool('zip215', zip215);
         if (prehash)
             msg = prehash(msg); // for ed25519ph, etc
         const s = bytesToNumberLE$1(sig.slice(len, 2 * len));
@@ -3590,12 +3657,14 @@ function twistedEdwards(curveDef) {
  */
 const ED25519_P = BigInt('57896044618658097711785492504343953926634992332820282019728792003956564819949');
 // √(-1) aka √(a) aka 2^((p-1)/4)
-const ED25519_SQRT_M1 = BigInt('19681161376707505956807079304988542015446066515923890162744021073123829784752');
+const ED25519_SQRT_M1 = /* @__PURE__ */ BigInt('19681161376707505956807079304988542015446066515923890162744021073123829784752');
 // prettier-ignore
-BigInt(0); const _1n$9 = BigInt(1), _2n$6 = BigInt(2), _5n$1 = BigInt(5);
+BigInt(0); const _1n$9 = BigInt(1), _2n$6 = BigInt(2); BigInt(3);
 // prettier-ignore
-const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
+const _5n$1 = BigInt(5), _8n$1 = BigInt(8);
 function ed25519_pow_2_252_3(x) {
+    // prettier-ignore
+    const _10n = BigInt(10), _20n = BigInt(20), _40n = BigInt(40), _80n = BigInt(80);
     const P = ED25519_P;
     const x2 = (x * x) % P;
     const b2 = (x2 * x) % P; // x^3, 11
@@ -3644,8 +3713,8 @@ function uvRatio(u, v) {
         x = mod$1(-x, P);
     return { isValid: useRoot1 || useRoot2, value: x };
 }
-const Fp$3 = Field$1(ED25519_P, undefined, true);
-const ed25519Defaults = {
+const Fp$3 = /* @__PURE__ */ (() => Field$1(ED25519_P, undefined, true))();
+const ed25519Defaults = /* @__PURE__ */ (() => ({
     // Param: a
     a: BigInt(-1), // Fp.create(-1) is proper; our way still works and is faster
     // d is equal to -121665/121666 over finite field.
@@ -3657,7 +3726,7 @@ const ed25519Defaults = {
     // 2n**252n + 27742317777372353535851937790883648493n;
     n: BigInt('7237005577332262213973186563042994240857116359379907606001950938285454250989'),
     // Cofactor
-    h: BigInt(8),
+    h: _8n$1,
     // Base point (x, y) aka generator point
     Gx: BigInt('15112221349535400772501151409588531511454012693041857206046113283949847762202'),
     Gy: BigInt('46316835694926478169428394003475163141307993866256225615783033603165251855960'),
@@ -3668,26 +3737,11 @@ const ed25519Defaults = {
     // Ratio of u to v. Allows us to combine inversion and square root. Uses algo from RFC8032 5.1.3.
     // Constant-time, u/√v
     uvRatio,
-};
-const ed25519 = /* @__PURE__ */ twistedEdwards(ed25519Defaults);
-// Hash To Curve Elligator2 Map (NOTE: different from ristretto255 elligator)
-// NOTE: very important part is usage of FpSqrtEven for ELL2_C1_EDWARDS, since
-// SageMath returns different root first and everything falls apart
-const ELL2_C1 = (Fp$3.ORDER + BigInt(3)) / BigInt(8); // 1. c1 = (q + 3) / 8       # Integer arithmetic
-Fp$3.pow(_2n$6, ELL2_C1); // 2. c2 = 2^c1
-Fp$3.sqrt(Fp$3.neg(Fp$3.ONE)); // 3. c3 = sqrt(-1)
-(Fp$3.ORDER - BigInt(5)) / BigInt(8); // 4. c4 = (q - 5) / 8       # Integer arithmetic
-BigInt(486662);
-FpSqrtEven(Fp$3, Fp$3.neg(BigInt(486664))); // sgn0(c1) MUST equal 0
-// √(ad - 1)
-BigInt('25063068953384623474111414158702152701244531502492656460079210482610430750235');
-// 1 / √(a-d)
-BigInt('54469307008909316920995813868745141605393597292927456921205312896311721017578');
-// 1-d²
-BigInt('1159843021668779879193775521855586647937357759715417654439879720876111806838');
-// (d-1)²
-BigInt('40440834346308536858101042469323190826248399146238708352240133220865137265952');
-BigInt('0x7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff');
+}))();
+/**
+ * ed25519 curve with EdDSA signatures.
+ */
+const ed25519 = /* @__PURE__ */ (() => twistedEdwards(ed25519Defaults))();
 
 /**
  * Provider for Ed25519 keys
@@ -3880,8 +3934,89 @@ let SHA256$1 = class SHA256 extends HashMD {
  */
 const sha256$3 = /* @__PURE__ */ wrapConstructor$1(() => new SHA256$1());
 
+// HMAC (RFC 2104)
+let HMAC$1 = class HMAC extends Hash$1 {
+    constructor(hash, _key) {
+        super();
+        this.finished = false;
+        this.destroyed = false;
+        hash$1(hash);
+        const key = toBytes$1(_key);
+        this.iHash = hash.create();
+        if (typeof this.iHash.update !== 'function')
+            throw new Error('Expected instance of class which extends utils.Hash');
+        this.blockLen = this.iHash.blockLen;
+        this.outputLen = this.iHash.outputLen;
+        const blockLen = this.blockLen;
+        const pad = new Uint8Array(blockLen);
+        // blockLen can be bigger than outputLen
+        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
+        for (let i = 0; i < pad.length; i++)
+            pad[i] ^= 0x36;
+        this.iHash.update(pad);
+        // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone
+        this.oHash = hash.create();
+        // Undo internal XOR && apply outer XOR
+        for (let i = 0; i < pad.length; i++)
+            pad[i] ^= 0x36 ^ 0x5c;
+        this.oHash.update(pad);
+        pad.fill(0);
+    }
+    update(buf) {
+        exists$1(this);
+        this.iHash.update(buf);
+        return this;
+    }
+    digestInto(out) {
+        exists$1(this);
+        bytes$1(out, this.outputLen);
+        this.finished = true;
+        this.iHash.digestInto(out);
+        this.oHash.update(out);
+        this.oHash.digestInto(out);
+        this.destroy();
+    }
+    digest() {
+        const out = new Uint8Array(this.oHash.outputLen);
+        this.digestInto(out);
+        return out;
+    }
+    _cloneInto(to) {
+        // Create new instance without calling constructor since key already in state and we don't know it.
+        to || (to = Object.create(Object.getPrototypeOf(this), {}));
+        const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
+        to = to;
+        to.finished = finished;
+        to.destroyed = destroyed;
+        to.blockLen = blockLen;
+        to.outputLen = outputLen;
+        to.oHash = oHash._cloneInto(to.oHash);
+        to.iHash = iHash._cloneInto(to.iHash);
+        return to;
+    }
+    destroy() {
+        this.destroyed = true;
+        this.oHash.destroy();
+        this.iHash.destroy();
+    }
+};
+/**
+ * HMAC: RFC2104 message authentication code.
+ * @param hash - function that would be used e.g. sha256
+ * @param key - message key
+ * @param message - message data
+ */
+const hmac$1 = (hash, key, message) => new HMAC$1(hash, key).update(message).digest();
+hmac$1.create = (hash, key) => new HMAC$1(hash, key);
+
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 // Short Weierstrass curve. The formula is: y² = x³ + ax + b
+function validateSigVerOpts(opts) {
+    if (opts.lowS !== undefined)
+        abool('lowS', opts.lowS);
+    if (opts.prehash !== undefined)
+        abool('prehash', opts.prehash);
+}
 function validatePointOpts$1(curve) {
     const opts = validateBasic$1(curve);
     validateObject$1(opts, {
@@ -4006,16 +4141,12 @@ function weierstrassPoints$1(opts) {
         throw new Error('bad generator point: equation left != right');
     // Valid group elements reside in range 1..n-1
     function isWithinCurveOrder(num) {
-        return typeof num === 'bigint' && _0n$6 < num && num < CURVE.n;
-    }
-    function assertGE(num) {
-        if (!isWithinCurveOrder(num))
-            throw new Error('Expected valid bigint: 0 < bigint < curve.n');
+        return inRange(num, _1n$8, CURVE.n);
     }
     // Validates if priv key is valid and converts it to bigint.
     // Supports options allowedPrivateKeyLengths and wrapPrivateKey.
     function normPrivateKeyToScalar(key) {
-        const { allowedPrivateKeyLengths: lengths, nByteLength, wrapPrivateKey, n } = CURVE;
+        const { allowedPrivateKeyLengths: lengths, nByteLength, wrapPrivateKey, n: N } = CURVE;
         if (lengths && typeof key !== 'bigint') {
             if (isBytes$1(key))
                 key = bytesToHex$2(key);
@@ -4035,15 +4166,61 @@ function weierstrassPoints$1(opts) {
             throw new Error(`private key must be ${nByteLength} bytes, hex or bigint, not ${typeof key}`);
         }
         if (wrapPrivateKey)
-            num = mod$1(num, n); // disabled by default, enabled for BLS
-        assertGE(num); // num in range [1..N-1]
+            num = mod$1(num, N); // disabled by default, enabled for BLS
+        aInRange('private key', num, _1n$8, N); // num in range [1..N-1]
         return num;
     }
-    const pointPrecomputes = new Map();
     function assertPrjPoint(other) {
         if (!(other instanceof Point))
             throw new Error('ProjectivePoint expected');
     }
+    // Memoized toAffine / validity check. They are heavy. Points are immutable.
+    // Converts Projective point to affine (x, y) coordinates.
+    // Can accept precomputed Z^-1 - for example, from invertBatch.
+    // (x, y, z) ∋ (x=x/z, y=y/z)
+    const toAffineMemo = memoized((p, iz) => {
+        const { px: x, py: y, pz: z } = p;
+        // Fast-path for normalized points
+        if (Fp.eql(z, Fp.ONE))
+            return { x, y };
+        const is0 = p.is0();
+        // If invZ was 0, we return zero point. However we still want to execute
+        // all operations, so we replace invZ with a random number, 1.
+        if (iz == null)
+            iz = is0 ? Fp.ONE : Fp.inv(z);
+        const ax = Fp.mul(x, iz);
+        const ay = Fp.mul(y, iz);
+        const zz = Fp.mul(z, iz);
+        if (is0)
+            return { x: Fp.ZERO, y: Fp.ZERO };
+        if (!Fp.eql(zz, Fp.ONE))
+            throw new Error('invZ was invalid');
+        return { x: ax, y: ay };
+    });
+    // NOTE: on exception this will crash 'cached' and no value will be set.
+    // Otherwise true will be return
+    const assertValidMemo = memoized((p) => {
+        if (p.is0()) {
+            // (0, 1, 0) aka ZERO is invalid in most contexts.
+            // In BLS, ZERO can be serialized, so we allow it.
+            // (0, 0, 0) is wrong representation of ZERO and is always invalid.
+            if (CURVE.allowInfinityPoint && !Fp.is0(p.py))
+                return;
+            throw new Error('bad point: ZERO');
+        }
+        // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`
+        const { x, y } = p.toAffine();
+        // Check if x, y are valid field elements
+        if (!Fp.isValid(x) || !Fp.isValid(y))
+            throw new Error('bad point: x or y not FE');
+        const left = Fp.sqr(y); // y²
+        const right = weierstrassEquation(x); // x³ + ax + b
+        if (!Fp.eql(left, right))
+            throw new Error('bad point: equation left != right');
+        if (!p.isTorsionFree())
+            throw new Error('bad point: not in prime-order subgroup');
+        return true;
+    });
     /**
      * Projective Point works in 3d / projective (homogeneous) coordinates: (x, y, z) ∋ (x=x/z, y=y/z)
      * Default Point works in 2d / affine coordinates: (x, y)
@@ -4060,6 +4237,7 @@ function weierstrassPoints$1(opts) {
                 throw new Error('y required');
             if (pz == null || !Fp.isValid(pz))
                 throw new Error('z required');
+            Object.freeze(this);
         }
         // Does not validate if the point is on-curve.
         // Use fromHex instead, or call assertValidity() later.
@@ -4106,30 +4284,11 @@ function weierstrassPoints$1(opts) {
         }
         // "Private method", don't use it directly
         _setWindowSize(windowSize) {
-            this._WINDOW_SIZE = windowSize;
-            pointPrecomputes.delete(this);
+            wnaf.setWindowSize(this, windowSize);
         }
         // A point on curve is valid if it conforms to equation.
         assertValidity() {
-            if (this.is0()) {
-                // (0, 1, 0) aka ZERO is invalid in most contexts.
-                // In BLS, ZERO can be serialized, so we allow it.
-                // (0, 0, 0) is wrong representation of ZERO and is always invalid.
-                if (CURVE.allowInfinityPoint && !Fp.is0(this.py))
-                    return;
-                throw new Error('bad point: ZERO');
-            }
-            // Some 3rd-party test vectors require different wording between here & `fromCompressedHex`
-            const { x, y } = this.toAffine();
-            // Check if x, y are valid field elements
-            if (!Fp.isValid(x) || !Fp.isValid(y))
-                throw new Error('bad point: x or y not FE');
-            const left = Fp.sqr(y); // y²
-            const right = weierstrassEquation(x); // x³ + ax + b
-            if (!Fp.eql(left, right))
-                throw new Error('bad point: equation left != right');
-            if (!this.isTorsionFree())
-                throw new Error('bad point: not in prime-order subgroup');
+            assertValidMemo(this);
         }
         hasEvenY() {
             const { y } = this.toAffine();
@@ -4256,28 +4415,25 @@ function weierstrassPoints$1(opts) {
             return this.equals(Point.ZERO);
         }
         wNAF(n) {
-            return wnaf.wNAFCached(this, pointPrecomputes, n, (comp) => {
-                const toInv = Fp.invertBatch(comp.map((p) => p.pz));
-                return comp.map((p, i) => p.toAffine(toInv[i])).map(Point.fromAffine);
-            });
+            return wnaf.wNAFCached(this, n, Point.normalizeZ);
         }
         /**
          * Non-constant-time multiplication. Uses double-and-add algorithm.
          * It's faster, but should only be used when you don't care about
          * an exposed private key e.g. sig verification, which works over *public* keys.
          */
-        multiplyUnsafe(n) {
+        multiplyUnsafe(sc) {
+            aInRange('scalar', sc, _0n$6, CURVE.n);
             const I = Point.ZERO;
-            if (n === _0n$6)
+            if (sc === _0n$6)
                 return I;
-            assertGE(n); // Will throw on 0
-            if (n === _1n$8)
+            if (sc === _1n$8)
                 return this;
             const { endo } = CURVE;
             if (!endo)
-                return wnaf.unsafeLadder(this, n);
+                return wnaf.unsafeLadder(this, sc);
             // Apply endomorphism
-            let { k1neg, k1, k2neg, k2 } = endo.splitScalar(n);
+            let { k1neg, k1, k2neg, k2 } = endo.splitScalar(sc);
             let k1p = I;
             let k2p = I;
             let d = this;
@@ -4307,12 +4463,11 @@ function weierstrassPoints$1(opts) {
          * @returns New point
          */
         multiply(scalar) {
-            assertGE(scalar);
-            let n = scalar;
+            const { endo, n: N } = CURVE;
+            aInRange('scalar', scalar, _1n$8, N);
             let point, fake; // Fake point is used to const-time mult
-            const { endo } = CURVE;
             if (endo) {
-                const { k1neg, k1, k2neg, k2 } = endo.splitScalar(n);
+                const { k1neg, k1, k2neg, k2 } = endo.splitScalar(scalar);
                 let { p: k1p, f: f1p } = this.wNAF(k1);
                 let { p: k2p, f: f2p } = this.wNAF(k2);
                 k1p = wnaf.constTimeNegate(k1neg, k1p);
@@ -4322,7 +4477,7 @@ function weierstrassPoints$1(opts) {
                 fake = f1p.add(f2p);
             }
             else {
-                const { p, f } = this.wNAF(n);
+                const { p, f } = this.wNAF(scalar);
                 point = p;
                 fake = f;
             }
@@ -4346,20 +4501,7 @@ function weierstrassPoints$1(opts) {
         // Can accept precomputed Z^-1 - for example, from invertBatch.
         // (x, y, z) ∋ (x=x/z, y=y/z)
         toAffine(iz) {
-            const { px: x, py: y, pz: z } = this;
-            const is0 = this.is0();
-            // If invZ was 0, we return zero point. However we still want to execute
-            // all operations, so we replace invZ with a random number, 1.
-            if (iz == null)
-                iz = is0 ? Fp.ONE : Fp.inv(z);
-            const ax = Fp.mul(x, iz);
-            const ay = Fp.mul(y, iz);
-            const zz = Fp.mul(z, iz);
-            if (is0)
-                return { x: Fp.ZERO, y: Fp.ZERO };
-            if (!Fp.eql(zz, Fp.ONE))
-                throw new Error('invZ was invalid');
-            return { x: ax, y: ay };
+            return toAffineMemo(this, iz);
         }
         isTorsionFree() {
             const { h: cofactor, isTorsionFree } = CURVE;
@@ -4378,10 +4520,12 @@ function weierstrassPoints$1(opts) {
             return this.multiplyUnsafe(CURVE.h);
         }
         toRawBytes(isCompressed = true) {
+            abool('isCompressed', isCompressed);
             this.assertValidity();
             return toBytes(Point, this, isCompressed);
         }
         toHex(isCompressed = true) {
+            abool('isCompressed', isCompressed);
             return bytesToHex$2(this.toRawBytes(isCompressed));
         }
     }
@@ -4411,14 +4555,18 @@ function validateOpts$1(curve) {
     });
     return Object.freeze({ lowS: true, ...opts });
 }
+/**
+ * Creates short weierstrass curve and ECDSA signature methods for it.
+ * @example
+ * import { Field } from '@noble/curves/abstract/modular';
+ * // Before that, define BigInt-s: a, b, p, n, Gx, Gy
+ * const curve = weierstrass({ a, b, Fp: Field(p), n, Gx, Gy, h: 1n })
+ */
 function weierstrass$1(curveDef) {
     const CURVE = validateOpts$1(curveDef);
     const { Fp, n: CURVE_ORDER } = CURVE;
     const compressedLen = Fp.BYTES + 1; // e.g. 33 for 32
     const uncompressedLen = 2 * Fp.BYTES + 1; // e.g. 65 for 32
-    function isValidFieldElement(num) {
-        return _0n$6 < num && num < Fp.ORDER; // 0 is banned since it's not invertible FE
-    }
     function modN(a) {
         return mod$1(a, CURVE_ORDER);
     }
@@ -4431,6 +4579,7 @@ function weierstrass$1(curveDef) {
             const a = point.toAffine();
             const x = Fp.toBytes(a.x);
             const cat = concatBytes$2;
+            abool('isCompressed', isCompressed);
             if (isCompressed) {
                 return cat(Uint8Array.from([point.hasEvenY() ? 0x02 : 0x03]), x);
             }
@@ -4445,7 +4594,7 @@ function weierstrass$1(curveDef) {
             // this.assertValidity() is done inside of fromHex
             if (len === compressedLen && (head === 0x02 || head === 0x03)) {
                 const x = bytesToNumberBE$1(tail);
-                if (!isValidFieldElement(x))
+                if (!inRange(x, _1n$8, Fp.ORDER))
                     throw new Error('Point is not on curve');
                 const y2 = weierstrassEquation(x); // y² = x³ + ax + b
                 let y;
@@ -4506,11 +4655,8 @@ function weierstrass$1(curveDef) {
             return new Signature(r, s);
         }
         assertValidity() {
-            // can use assertGE here
-            if (!isWithinCurveOrder(this.r))
-                throw new Error('r must be 0 < r < CURVE.n');
-            if (!isWithinCurveOrder(this.s))
-                throw new Error('s must be 0 < s < CURVE.n');
+            aInRange('r', this.r, _1n$8, CURVE_ORDER); // r in [1..N]
+            aInRange('s', this.s, _1n$8, CURVE_ORDER); // s in [1..N]
         }
         addRecoveryBit(recovery) {
             return new Signature(this.r, this.s, recovery);
@@ -4653,10 +4799,7 @@ function weierstrass$1(curveDef) {
      * Converts to bytes. Checks if num in `[0..ORDER_MASK-1]` e.g.: `[0..2^256-1]`.
      */
     function int2octets(num) {
-        if (typeof num !== 'bigint')
-            throw new Error('bigint expected');
-        if (!(_0n$6 <= num && num < ORDER_MASK))
-            throw new Error(`bigint expected < 2^${CURVE.nBitLength}`);
+        aInRange(`num < 2^${CURVE.nBitLength}`, num, _0n$6, ORDER_MASK);
         // works with order, can have different size than numToField!
         return numberToBytesBE$1(num, CURVE.nByteLength);
     }
@@ -4673,6 +4816,7 @@ function weierstrass$1(curveDef) {
         if (lowS == null)
             lowS = true; // RFC6979 3.2: we skip step A, because we already provide hash
         msgHash = ensureBytes$1('msgHash', msgHash);
+        validateSigVerOpts(opts);
         if (prehash)
             msgHash = ensureBytes$1('prehashed msgHash', hash(msgHash));
         // We can't later call bits2octets, since nested bits2int is broken for curves
@@ -4759,6 +4903,7 @@ function weierstrass$1(curveDef) {
         publicKey = ensureBytes$1('publicKey', publicKey);
         if ('strict' in opts)
             throw new Error('options.strict was renamed to lowS');
+        validateSigVerOpts(opts);
         const { lowS, prehash } = opts;
         let _sig = undefined;
         let P;
@@ -4816,81 +4961,6 @@ function weierstrass$1(curveDef) {
     };
 }
 
-// HMAC (RFC 2104)
-let HMAC$1 = class HMAC extends Hash$1 {
-    constructor(hash, _key) {
-        super();
-        this.finished = false;
-        this.destroyed = false;
-        hash$1(hash);
-        const key = toBytes$1(_key);
-        this.iHash = hash.create();
-        if (typeof this.iHash.update !== 'function')
-            throw new Error('Expected instance of class which extends utils.Hash');
-        this.blockLen = this.iHash.blockLen;
-        this.outputLen = this.iHash.outputLen;
-        const blockLen = this.blockLen;
-        const pad = new Uint8Array(blockLen);
-        // blockLen can be bigger than outputLen
-        pad.set(key.length > blockLen ? hash.create().update(key).digest() : key);
-        for (let i = 0; i < pad.length; i++)
-            pad[i] ^= 0x36;
-        this.iHash.update(pad);
-        // By doing update (processing of first block) of outer hash here we can re-use it between multiple calls via clone
-        this.oHash = hash.create();
-        // Undo internal XOR && apply outer XOR
-        for (let i = 0; i < pad.length; i++)
-            pad[i] ^= 0x36 ^ 0x5c;
-        this.oHash.update(pad);
-        pad.fill(0);
-    }
-    update(buf) {
-        exists$1(this);
-        this.iHash.update(buf);
-        return this;
-    }
-    digestInto(out) {
-        exists$1(this);
-        bytes$1(out, this.outputLen);
-        this.finished = true;
-        this.iHash.digestInto(out);
-        this.oHash.update(out);
-        this.oHash.digestInto(out);
-        this.destroy();
-    }
-    digest() {
-        const out = new Uint8Array(this.oHash.outputLen);
-        this.digestInto(out);
-        return out;
-    }
-    _cloneInto(to) {
-        // Create new instance without calling constructor since key already in state and we don't know it.
-        to || (to = Object.create(Object.getPrototypeOf(this), {}));
-        const { oHash, iHash, finished, destroyed, blockLen, outputLen } = this;
-        to = to;
-        to.finished = finished;
-        to.destroyed = destroyed;
-        to.blockLen = blockLen;
-        to.outputLen = outputLen;
-        to.oHash = oHash._cloneInto(to.oHash);
-        to.iHash = iHash._cloneInto(to.iHash);
-        return to;
-    }
-    destroy() {
-        this.destroyed = true;
-        this.oHash.destroy();
-        this.iHash.destroy();
-    }
-};
-/**
- * HMAC: RFC2104 message authentication code.
- * @param hash - function that would be used e.g. sha256
- * @param key - message key
- * @param message - message data
- */
-const hmac$1 = (hash, key, message) => new HMAC$1(hash, key).update(message).digest();
-hmac$1.create = (hash, key) => new HMAC$1(hash, key);
-
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
 // connects noble-curves to noble-hashes
 function getHash$1(hash) {
@@ -4940,6 +5010,9 @@ function sqrtMod$1(y) {
     return root;
 }
 const Fp$2 = Field$1(secp256k1P$1, undefined, undefined, { sqrt: sqrtMod$1 });
+/**
+ * secp256k1 short weierstrass curve and ECDSA signatures over it.
+ */
 const secp256k1$1 = createCurve$1({
     a: BigInt(0), // equation params: a, b
     b: BigInt(7), // Seem to be rigid: bitcointalk.org/index.php?topic=289795.msg3183975#msg3183975
@@ -6995,11 +7068,6 @@ function hexToBytes$1(s, minLength) {
     input = `0${input}`;
   }
 
-  if (minLength) {
-    const paddedLength = Math.max(input.length, minLength * 2);
-    input = input.padStart(paddedLength, '00');
-  }
-
   return u8a$2.fromString(input.toLowerCase(), 'base16');
 }
 function decodeBase64url(s) {
@@ -7629,11 +7697,11 @@ class Iden3SparseMerkleTreeProof {
             const notEmpties = ne instanceof Uint8Array ? ne : new Uint8Array(Object.values(ne));
             const siblingsHashes = obj?.mtp?.siblings.map((h) => Hash$2.fromString(JSON.stringify(h)));
             const allSiblings = Proof.buildAllSiblings(obj?.mtp?.depth, notEmpties, siblingsHashes);
-            let nodeAux = undefined;
-            if (obj.mtp.nodeAux) {
+            let nodeAux = obj.mtp.nodeAux || obj.mtp.node_aux;
+            if (nodeAux) {
                 nodeAux = {
-                    key: Hash$2.fromString(JSON.stringify(obj.mtp.nodeAux.key)),
-                    value: Hash$2.fromString(JSON.stringify(obj.mtp.nodeAux.value))
+                    key: Hash$2.fromString(JSON.stringify(nodeAux.key)),
+                    value: Hash$2.fromString(JSON.stringify(nodeAux.value))
                 };
             }
             mtp = new Proof({ existence: obj?.mtp.existence, nodeAux: nodeAux, siblings: allSiblings });
@@ -19655,7 +19723,7 @@ class W3CCredential {
     }
     static fromJSON(obj) {
         const w = new W3CCredential();
-        Object.assign(w, obj);
+        Object.assign(w, structuredClone(obj));
         w.proof = Array.isArray(w.proof)
             ? w.proof.map(W3CCredential.proofFromJSON)
             : W3CCredential.proofFromJSON(w.proof);
@@ -20496,16 +20564,6 @@ function v4(options, buf, offset) {
   rnds[6] = rnds[6] & 0x0f | 0x40;
   rnds[8] = rnds[8] & 0x3f | 0x80; // Copy bytes to buffer, if provided
 
-  if (buf) {
-    offset = offset || 0;
-
-    for (let i = 0; i < 16; ++i) {
-      buf[offset + i] = rnds[i];
-    }
-
-    return buf;
-  }
-
   return unsafeStringify(rnds);
 }
 
@@ -30040,7 +30098,7 @@ const cacheLoader = (opts) => {
 /**
  *  The current version of Ethers.
  */
-const version = "6.13.1";
+const version = "6.13.2";
 
 /**
  *  Property helper functions.
@@ -30265,7 +30323,7 @@ function assertArgumentCount(count, expectedCount, message) {
         expectedCount: expectedCount
     });
 }
-const _normalizeForms = ["NFD", "NFC", "NFKD", "NFKC"].reduce((accum, form) => {
+["NFD", "NFC", "NFKD", "NFKC"].reduce((accum, form) => {
     try {
         // General test for normalize
         /* c8 ignore start */
@@ -30287,14 +30345,6 @@ const _normalizeForms = ["NFD", "NFC", "NFKD", "NFKC"].reduce((accum, form) => {
     catch (error) { }
     return accum;
 }, []);
-/**
- *  Throws if the normalization %%form%% is not supported.
- */
-function assertNormalize(form) {
-    assert(_normalizeForms.indexOf(form) >= 0, "platform missing String.prototype.normalize", "UNSUPPORTED_OPERATION", {
-        operation: "String.prototype.normalize", info: { form }
-    });
-}
 /**
  *  Many classes use file-scoped values to guard the constructor,
  *  making it effectively private. This facilitates that pattern
@@ -30939,10 +30989,6 @@ function getUtf8CodePoints(_bytes, onError) {
  */
 function toUtf8Bytes(str, form) {
     assertArgument(typeof (str) === "string", "invalid string value", "str", str);
-    if (form != null) {
-        assertNormalize(form);
-        str = str.normalize(form);
-    }
     let result = [];
     for (let i = 0; i < str.length; i++) {
         const c = str.charCodeAt(i);
@@ -37990,7 +38036,6 @@ function consume_emoji_reversed(cps, eaten) {
 		let {V} = node;
 		if (V) { // this is a valid emoji (so far)
 			emoji = V;
-			if (eaten) eaten.push(...cps.slice(pos).reverse()); // (optional) copy input, used for ens_tokenize()
 			cps.length = pos; // truncate
 		}
 	}
@@ -38057,7 +38102,7 @@ function namehash(name) {
  *  as the wildcard resolution.
  */
 function dnsEncode(name, _maxLength) {
-    const length = (_maxLength != null) ? _maxLength : 63;
+    const length = _maxLength ;
     assertArgument(length <= 255, "DNS encoded label cannot exceed 255", "length", length);
     return hexlify(concat(ensNameSplit(name).map((comp) => {
         assertArgument(comp.length <= length, `label ${JSON.stringify(name)} exceeds ${length} bytes`, "name", name);
@@ -48052,7 +48097,7 @@ class JsonRpcSigner extends AbstractSigner {
                     // If the network changed: calling again will also fail
                     // If unsupported: likely destroyed
                     if (isError(error, "CANCELLED") || isError(error, "BAD_DATA") ||
-                        isError(error, "NETWORK_ERROR" )) {
+                        isError(error, "NETWORK_ERROR")) {
                         if (error.info == null) {
                             error.info = {};
                         }
@@ -53030,18 +53075,12 @@ class OnChainRevocationStorage {
         let nodeAux = undefined;
         const siblings = mtp.siblings?.map((s) => s.toString());
         if (mtp.auxExistence) {
-            const auxIndex = BigInt(mtp.auxIndex.toString());
-            const auxValue = BigInt(mtp.auxValue.toString());
             nodeAux = {
-                key: auxIndex.toString(),
-                value: auxValue.toString()
+                key: mtp.auxIndex.toString(),
+                value: mtp.auxValue.toString()
             };
         }
-        return Proof.fromJSON({
-            existence: mtp.existence,
-            nodeAux,
-            siblings
-        });
+        return Proof.fromJSON({ existence: mtp.existence, node_aux: nodeAux, siblings });
     }
 }
 
@@ -54130,13 +54169,8 @@ class IssuerResolver {
  * @returns {RevocationStatus} RevocationStatus
  */
 const toRevocationStatus = ({ issuer, mtp }) => {
-    const p = Proof.fromJSON({
-        nodeAux: mtp.node_aux,
-        existence: mtp.existence,
-        siblings: mtp.siblings
-    });
     return {
-        mtp: p,
+        mtp: Proof.fromJSON(mtp),
         issuer
     };
 };