@chainflip/processor 2.1.0-alpha.3 → 2.1.0-alpha.4

package/dist/node_modules/.pnpm/@noble_curves@1.9.7/node_modules/@noble/curves/esm/abstract/curve.cjs

@@ -0,0 +1,324 @@
+const require_utils = require('../utils.cjs');
+const require_modular = require('./modular.cjs');
+
+//#region ../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/esm/abstract/curve.js
+/**
+* Methods for elliptic curve multiplication by scalars.
+* Contains wNAF, pippenger.
+* @module
+*/
+/*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
+const _0n = BigInt(0);
+const _1n = BigInt(1);
+function negateCt(condition, item) {
+	const neg = item.negate();
+	return condition ? neg : item;
+}
+/**
+* Takes a bunch of Projective Points but executes only one
+* inversion on all of them. Inversion is very slow operation,
+* so this improves performance massively.
+* Optimization: converts a list of projective points to a list of identical points with Z=1.
+*/
+function normalizeZ(c, points) {
+	const invertedZs = require_modular.FpInvertBatch(c.Fp, points.map((p) => p.Z));
+	return points.map((p, i) => c.fromAffine(p.toAffine(invertedZs[i])));
+}
+function validateW(W, bits) {
+	if (!Number.isSafeInteger(W) || W <= 0 || W > bits) throw new Error("invalid window size, expected [1.." + bits + "], got W=" + W);
+}
+function calcWOpts(W, scalarBits) {
+	validateW(W, scalarBits);
+	const windows = Math.ceil(scalarBits / W) + 1;
+	const windowSize = 2 ** (W - 1);
+	const maxNumber = 2 ** W;
+	return {
+		windows,
+		windowSize,
+		mask: require_utils.bitMask(W),
+		maxNumber,
+		shiftBy: BigInt(W)
+	};
+}
+function calcOffsets(n, window, wOpts) {
+	const { windowSize, mask, maxNumber, shiftBy } = wOpts;
+	let wbits = Number(n & mask);
+	let nextN = n >> shiftBy;
+	if (wbits > windowSize) {
+		wbits -= maxNumber;
+		nextN += _1n;
+	}
+	const offsetStart = window * windowSize;
+	const offset = offsetStart + Math.abs(wbits) - 1;
+	const isZero = wbits === 0;
+	const isNeg = wbits < 0;
+	const isNegF = window % 2 !== 0;
+	return {
+		nextN,
+		offset,
+		isZero,
+		isNeg,
+		isNegF,
+		offsetF: offsetStart
+	};
+}
+function validateMSMPoints(points, c) {
+	if (!Array.isArray(points)) throw new Error("array expected");
+	points.forEach((p, i) => {
+		if (!(p instanceof c)) throw new Error("invalid point at index " + i);
+	});
+}
+function validateMSMScalars(scalars, field) {
+	if (!Array.isArray(scalars)) throw new Error("array of scalars expected");
+	scalars.forEach((s, i) => {
+		if (!field.isValid(s)) throw new Error("invalid scalar at index " + i);
+	});
+}
+const pointPrecomputes = /* @__PURE__ */ new WeakMap();
+const pointWindowSizes = /* @__PURE__ */ new WeakMap();
+function getW(P) {
+	return pointWindowSizes.get(P) || 1;
+}
+function assert0(n) {
+	if (n !== _0n) throw new Error("invalid wNAF");
+}
+/**
+* Elliptic curve multiplication of Point by scalar. Fragile.
+* Table generation takes **30MB of ram and 10ms on high-end CPU**,
+* but may take much longer on slow devices. Actual generation will happen on
+* first call of `multiply()`. By default, `BASE` point is precomputed.
+*
+* Scalars should always be less than curve order: this should be checked inside of a curve itself.
+* Creates precomputation tables for fast multiplication:
+* - private scalar is split by fixed size windows of W bits
+* - every window point is collected from window's table & added to accumulator
+* - since windows are different, same point inside tables won't be accessed more than once per calc
+* - each multiplication is 'Math.ceil(CURVE_ORDER / 𝑊) + 1' point additions (fixed for any scalar)
+* - +1 window is neccessary for wNAF
+* - wNAF reduces table size: 2x less memory + 2x faster generation, but 10% slower multiplication
+*
+* @todo Research returning 2d JS array of windows, instead of a single window.
+* This would allow windows to be in different memory locations
+*/
+var wNAF = class {
+	constructor(Point, bits) {
+		this.BASE = Point.BASE;
+		this.ZERO = Point.ZERO;
+		this.Fn = Point.Fn;
+		this.bits = bits;
+	}
+	_unsafeLadder(elm, n, p = this.ZERO) {
+		let d = elm;
+		while (n > _0n) {
+			if (n & _1n) p = p.add(d);
+			d = d.double();
+			n >>= _1n;
+		}
+		return p;
+	}
+	/**
+	* Creates a wNAF precomputation window. Used for caching.
+	* Default window size is set by `utils.precompute()` and is equal to 8.
+	* Number of precomputed points depends on the curve size:
+	* 2^(𝑊−1) * (Math.ceil(𝑛 / 𝑊) + 1), where:
+	* - 𝑊 is the window size
+	* - 𝑛 is the bitlength of the curve order.
+	* For a 256-bit curve and window size 8, the number of precomputed points is 128 * 33 = 4224.
+	* @param point Point instance
+	* @param W window size
+	* @returns precomputed point tables flattened to a single array
+	*/
+	precomputeWindow(point, W) {
+		const { windows, windowSize } = calcWOpts(W, this.bits);
+		const points = [];
+		let p = point;
+		let base = p;
+		for (let window = 0; window < windows; window++) {
+			base = p;
+			points.push(base);
+			for (let i = 1; i < windowSize; i++) {
+				base = base.add(p);
+				points.push(base);
+			}
+			p = base.double();
+		}
+		return points;
+	}
+	/**
+	* Implements ec multiplication using precomputed tables and w-ary non-adjacent form.
+	* More compact implementation:
+	* https://github.com/paulmillr/noble-secp256k1/blob/47cb1669b6e506ad66b35fe7d76132ae97465da2/index.ts#L502-L541
+	* @returns real and fake (for const-time) points
+	*/
+	wNAF(W, precomputes, n) {
+		if (!this.Fn.isValid(n)) throw new Error("invalid scalar");
+		let p = this.ZERO;
+		let f = this.BASE;
+		const wo = calcWOpts(W, this.bits);
+		for (let window = 0; window < wo.windows; window++) {
+			const { nextN, offset, isZero, isNeg, isNegF, offsetF } = calcOffsets(n, window, wo);
+			n = nextN;
+			if (isZero) f = f.add(negateCt(isNegF, precomputes[offsetF]));
+			else p = p.add(negateCt(isNeg, precomputes[offset]));
+		}
+		assert0(n);
+		return {
+			p,
+			f
+		};
+	}
+	/**
+	* Implements ec unsafe (non const-time) multiplication using precomputed tables and w-ary non-adjacent form.
+	* @param acc accumulator point to add result of multiplication
+	* @returns point
+	*/
+	wNAFUnsafe(W, precomputes, n, acc = this.ZERO) {
+		const wo = calcWOpts(W, this.bits);
+		for (let window = 0; window < wo.windows; window++) {
+			if (n === _0n) break;
+			const { nextN, offset, isZero, isNeg } = calcOffsets(n, window, wo);
+			n = nextN;
+			if (isZero) continue;
+			else {
+				const item = precomputes[offset];
+				acc = acc.add(isNeg ? item.negate() : item);
+			}
+		}
+		assert0(n);
+		return acc;
+	}
+	getPrecomputes(W, point, transform) {
+		let comp = pointPrecomputes.get(point);
+		if (!comp) {
+			comp = this.precomputeWindow(point, W);
+			if (W !== 1) {
+				if (typeof transform === "function") comp = transform(comp);
+				pointPrecomputes.set(point, comp);
+			}
+		}
+		return comp;
+	}
+	cached(point, scalar, transform) {
+		const W = getW(point);
+		return this.wNAF(W, this.getPrecomputes(W, point, transform), scalar);
+	}
+	unsafe(point, scalar, transform, prev) {
+		const W = getW(point);
+		if (W === 1) return this._unsafeLadder(point, scalar, prev);
+		return this.wNAFUnsafe(W, this.getPrecomputes(W, point, transform), scalar, prev);
+	}
+	createCache(P, W) {
+		validateW(W, this.bits);
+		pointWindowSizes.set(P, W);
+		pointPrecomputes.delete(P);
+	}
+	hasCache(elm) {
+		return getW(elm) !== 1;
+	}
+};
+/**
+* Endomorphism-specific multiplication for Koblitz curves.
+* Cost: 128 dbl, 0-256 adds.
+*/
+function mulEndoUnsafe(Point, point, k1, k2) {
+	let acc = point;
+	let p1 = Point.ZERO;
+	let p2 = Point.ZERO;
+	while (k1 > _0n || k2 > _0n) {
+		if (k1 & _1n) p1 = p1.add(acc);
+		if (k2 & _1n) p2 = p2.add(acc);
+		acc = acc.double();
+		k1 >>= _1n;
+		k2 >>= _1n;
+	}
+	return {
+		p1,
+		p2
+	};
+}
+/**
+* Pippenger algorithm for multi-scalar multiplication (MSM, Pa + Qb + Rc + ...).
+* 30x faster vs naive addition on L=4096, 10x faster than precomputes.
+* For N=254bit, L=1, it does: 1024 ADD + 254 DBL. For L=5: 1536 ADD + 254 DBL.
+* Algorithmically constant-time (for same L), even when 1 point + scalar, or when scalar = 0.
+* @param c Curve Point constructor
+* @param fieldN field over CURVE.N - important that it's not over CURVE.P
+* @param points array of L curve points
+* @param scalars array of L scalars (aka secret keys / bigints)
+*/
+function pippenger(c, fieldN, points, scalars) {
+	validateMSMPoints(points, c);
+	validateMSMScalars(scalars, fieldN);
+	const plength = points.length;
+	const slength = scalars.length;
+	if (plength !== slength) throw new Error("arrays of points and scalars must have equal length");
+	const zero = c.ZERO;
+	const wbits = require_utils.bitLen(BigInt(plength));
+	let windowSize = 1;
+	if (wbits > 12) windowSize = wbits - 3;
+	else if (wbits > 4) windowSize = wbits - 2;
+	else if (wbits > 0) windowSize = 2;
+	const MASK = require_utils.bitMask(windowSize);
+	const buckets = new Array(Number(MASK) + 1).fill(zero);
+	const lastBits = Math.floor((fieldN.BITS - 1) / windowSize) * windowSize;
+	let sum = zero;
+	for (let i = lastBits; i >= 0; i -= windowSize) {
+		buckets.fill(zero);
+		for (let j = 0; j < slength; j++) {
+			const scalar = scalars[j];
+			const wbits = Number(scalar >> BigInt(i) & MASK);
+			buckets[wbits] = buckets[wbits].add(points[j]);
+		}
+		let resI = zero;
+		for (let j = buckets.length - 1, sumI = zero; j > 0; j--) {
+			sumI = sumI.add(buckets[j]);
+			resI = resI.add(sumI);
+		}
+		sum = sum.add(resI);
+		if (i !== 0) for (let j = 0; j < windowSize; j++) sum = sum.double();
+	}
+	return sum;
+}
+function createField(order, field, isLE) {
+	if (field) {
+		if (field.ORDER !== order) throw new Error("Field.ORDER must match order: Fp == p, Fn == n");
+		require_modular.validateField(field);
+		return field;
+	} else return require_modular.Field(order, { isLE });
+}
+/** Validates CURVE opts and creates fields */
+function _createCurveFields(type, CURVE, curveOpts = {}, FpFnLE) {
+	if (FpFnLE === void 0) FpFnLE = type === "edwards";
+	if (!CURVE || typeof CURVE !== "object") throw new Error(`expected valid ${type} CURVE object`);
+	for (const p of [
+		"p",
+		"n",
+		"h"
+	]) {
+		const val = CURVE[p];
+		if (!(typeof val === "bigint" && val > _0n)) throw new Error(`CURVE.${p} must be positive bigint`);
+	}
+	const Fp = createField(CURVE.p, curveOpts.Fp, FpFnLE);
+	const Fn = createField(CURVE.n, curveOpts.Fn, FpFnLE);
+	const params = [
+		"Gx",
+		"Gy",
+		"a",
+		type === "weierstrass" ? "b" : "d"
+	];
+	for (const p of params) if (!Fp.isValid(CURVE[p])) throw new Error(`CURVE.${p} must be valid field element of CURVE.Fp`);
+	CURVE = Object.freeze(Object.assign({}, CURVE));
+	return {
+		CURVE,
+		Fp,
+		Fn
+	};
+}
+
+//#endregion
+exports._createCurveFields = _createCurveFields;
+exports.mulEndoUnsafe = mulEndoUnsafe;
+exports.negateCt = negateCt;
+exports.normalizeZ = normalizeZ;
+exports.pippenger = pippenger;
+exports.wNAF = wNAF;

package/dist/node_modules/.pnpm/@noble_curves@1.9.7/node_modules/@noble/curves/esm/abstract/hash-to-curve.cjs

@@ -0,0 +1,167 @@
+const require_utils = require('../../../../../../@noble_hashes@1.8.0/node_modules/@noble/hashes/esm/utils.cjs');
+const require_utils$1 = require('../utils.cjs');
+const require_modular = require('./modular.cjs');
+
+//#region ../../node_modules/.pnpm/@noble+curves@1.9.7/node_modules/@noble/curves/esm/abstract/hash-to-curve.js
+const os2ip = require_utils$1.bytesToNumberBE;
+function i2osp(value, length) {
+	anum(value);
+	anum(length);
+	if (value < 0 || value >= 1 << 8 * length) throw new Error("invalid I2OSP input: " + value);
+	const res = Array.from({ length }).fill(0);
+	for (let i = length - 1; i >= 0; i--) {
+		res[i] = value & 255;
+		value >>>= 8;
+	}
+	return new Uint8Array(res);
+}
+function strxor(a, b) {
+	const arr = new Uint8Array(a.length);
+	for (let i = 0; i < a.length; i++) arr[i] = a[i] ^ b[i];
+	return arr;
+}
+function anum(item) {
+	if (!Number.isSafeInteger(item)) throw new Error("number expected");
+}
+function normDST(DST) {
+	if (!require_utils.isBytes(DST) && typeof DST !== "string") throw new Error("DST must be Uint8Array or string");
+	return typeof DST === "string" ? require_utils.utf8ToBytes(DST) : DST;
+}
+/**
+* Produces a uniformly random byte string using a cryptographic hash function H that outputs b bits.
+* [RFC 9380 5.3.1](https://www.rfc-editor.org/rfc/rfc9380#section-5.3.1).
+*/
+function expand_message_xmd(msg, DST, lenInBytes, H) {
+	require_utils.abytes(msg);
+	anum(lenInBytes);
+	DST = normDST(DST);
+	if (DST.length > 255) DST = H(require_utils.concatBytes(require_utils.utf8ToBytes("H2C-OVERSIZE-DST-"), DST));
+	const { outputLen: b_in_bytes, blockLen: r_in_bytes } = H;
+	const ell = Math.ceil(lenInBytes / b_in_bytes);
+	if (lenInBytes > 65535 || ell > 255) throw new Error("expand_message_xmd: invalid lenInBytes");
+	const DST_prime = require_utils.concatBytes(DST, i2osp(DST.length, 1));
+	const Z_pad = i2osp(0, r_in_bytes);
+	const l_i_b_str = i2osp(lenInBytes, 2);
+	const b = new Array(ell);
+	const b_0 = H(require_utils.concatBytes(Z_pad, msg, l_i_b_str, i2osp(0, 1), DST_prime));
+	b[0] = H(require_utils.concatBytes(b_0, i2osp(1, 1), DST_prime));
+	for (let i = 1; i <= ell; i++) b[i] = H(require_utils.concatBytes(...[
+		strxor(b_0, b[i - 1]),
+		i2osp(i + 1, 1),
+		DST_prime
+	]));
+	return require_utils.concatBytes(...b).slice(0, lenInBytes);
+}
+/**
+* Produces a uniformly random byte string using an extendable-output function (XOF) H.
+* 1. The collision resistance of H MUST be at least k bits.
+* 2. H MUST be an XOF that has been proved indifferentiable from
+*    a random oracle under a reasonable cryptographic assumption.
+* [RFC 9380 5.3.2](https://www.rfc-editor.org/rfc/rfc9380#section-5.3.2).
+*/
+function expand_message_xof(msg, DST, lenInBytes, k, H) {
+	require_utils.abytes(msg);
+	anum(lenInBytes);
+	DST = normDST(DST);
+	if (DST.length > 255) {
+		const dkLen = Math.ceil(2 * k / 8);
+		DST = H.create({ dkLen }).update(require_utils.utf8ToBytes("H2C-OVERSIZE-DST-")).update(DST).digest();
+	}
+	if (lenInBytes > 65535 || DST.length > 255) throw new Error("expand_message_xof: invalid lenInBytes");
+	return H.create({ dkLen: lenInBytes }).update(msg).update(i2osp(lenInBytes, 2)).update(DST).update(i2osp(DST.length, 1)).digest();
+}
+/**
+* Hashes arbitrary-length byte strings to a list of one or more elements of a finite field F.
+* [RFC 9380 5.2](https://www.rfc-editor.org/rfc/rfc9380#section-5.2).
+* @param msg a byte string containing the message to hash
+* @param count the number of elements of F to output
+* @param options `{DST: string, p: bigint, m: number, k: number, expand: 'xmd' | 'xof', hash: H}`, see above
+* @returns [u_0, ..., u_(count - 1)], a list of field elements.
+*/
+function hash_to_field(msg, count, options) {
+	require_utils$1._validateObject(options, {
+		p: "bigint",
+		m: "number",
+		k: "number",
+		hash: "function"
+	});
+	const { p, k, m, hash, expand, DST } = options;
+	if (!require_utils$1.isHash(options.hash)) throw new Error("expected valid hash");
+	require_utils.abytes(msg);
+	anum(count);
+	const log2p = p.toString(2).length;
+	const L = Math.ceil((log2p + k) / 8);
+	const len_in_bytes = count * m * L;
+	let prb;
+	if (expand === "xmd") prb = expand_message_xmd(msg, DST, len_in_bytes, hash);
+	else if (expand === "xof") prb = expand_message_xof(msg, DST, len_in_bytes, k, hash);
+	else if (expand === "_internal_pass") prb = msg;
+	else throw new Error("expand must be \"xmd\" or \"xof\"");
+	const u = new Array(count);
+	for (let i = 0; i < count; i++) {
+		const e = new Array(m);
+		for (let j = 0; j < m; j++) {
+			const elm_offset = L * (j + i * m);
+			e[j] = require_modular.mod(os2ip(prb.subarray(elm_offset, elm_offset + L)), p);
+		}
+		u[i] = e;
+	}
+	return u;
+}
+function isogenyMap(field, map) {
+	const coeff = map.map((i) => Array.from(i).reverse());
+	return (x, y) => {
+		const [xn, xd, yn, yd] = coeff.map((val) => val.reduce((acc, i) => field.add(field.mul(acc, x), i)));
+		const [xd_inv, yd_inv] = require_modular.FpInvertBatch(field, [xd, yd], true);
+		x = field.mul(xn, xd_inv);
+		y = field.mul(y, field.mul(yn, yd_inv));
+		return {
+			x,
+			y
+		};
+	};
+}
+const _DST_scalar = require_utils.utf8ToBytes("HashToScalar-");
+/** Creates hash-to-curve methods from EC Point and mapToCurve function. See {@link H2CHasher}. */
+function createHasher(Point, mapToCurve, defaults) {
+	if (typeof mapToCurve !== "function") throw new Error("mapToCurve() must be defined");
+	function map(num) {
+		return Point.fromAffine(mapToCurve(num));
+	}
+	function clear(initial) {
+		const P = initial.clearCofactor();
+		if (P.equals(Point.ZERO)) return Point.ZERO;
+		P.assertValidity();
+		return P;
+	}
+	return {
+		defaults,
+		hashToCurve(msg, options) {
+			const u = hash_to_field(msg, 2, Object.assign({}, defaults, options));
+			const u0 = map(u[0]);
+			const u1 = map(u[1]);
+			return clear(u0.add(u1));
+		},
+		encodeToCurve(msg, options) {
+			const optsDst = defaults.encodeDST ? { DST: defaults.encodeDST } : {};
+			return clear(map(hash_to_field(msg, 1, Object.assign({}, defaults, optsDst, options))[0]));
+		},
+		mapToCurve(scalars) {
+			if (!Array.isArray(scalars)) throw new Error("expected array of bigints");
+			for (const i of scalars) if (typeof i !== "bigint") throw new Error("expected array of bigints");
+			return clear(map(scalars));
+		},
+		hashToScalar(msg, options) {
+			const N = Point.Fn.ORDER;
+			return hash_to_field(msg, 1, Object.assign({}, defaults, {
+				p: N,
+				m: 1,
+				DST: _DST_scalar
+			}, options))[0][0];
+		}
+	};
+}
+
+//#endregion
+exports.createHasher = createHasher;
+exports.isogenyMap = isogenyMap;