@meteora-ag/cp-amm-sdk 1.0.0 → 1.0.1-1.rc-0

package/node_modules/{@solana/web3.js/node_modules/@noble → @noble}/curves/src/bls12-381.ts

@@ -28,12 +28,12 @@
  * 3. Curve security level is about 120 bits as per [Barbulescu-Duquesne 2017](https://hal.science/hal-01534101/file/main.pdf)
  * 4. Compatible with specs:
  *    [cfrg-pairing-friendly-curves-11](https://tools.ietf.org/html/draft-irtf-cfrg-pairing-friendly-curves-11),
- *    [cfrg-bls-signature-05](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-bls-signature-05),
- *    [RFC 9380](https://www.rfc-editor.org/rfc/rfc9380).
+ *    [cfrg-bls-signature-05](https://www.rfc-editor.org/rfc/draft-irtf-cfrg-bls-signature-05),
+ *    RFC 9380.
  *
  * ### Params
  * To verify curve parameters, see
- * [pairing-friendly-curves spec](https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-pairing-friendly-curves-11).
+ * [pairing-friendly-curves spec](https://www.rfc-editor.org/rfc/draft-irtf-cfrg-pairing-friendly-curves-11).
  * Basic math is done over finite fields over p.
  * More complicated math is done over polynominal extension fields.
  * To simplify calculations in Fp12, we construct extension tower:
@@ -59,10 +59,10 @@
  * @module
  */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-import { sha256 } from '@noble/hashes/sha256';
+import { sha256 } from '@noble/hashes/sha2';
 import { randomBytes } from '@noble/hashes/utils';
-import { bls, type CurveFn } from './abstract/bls.js';
-import * as mod from './abstract/modular.js';
+import { bls, type CurveFn } from './abstract/bls.ts';
+import { Field } from './abstract/modular.ts';
 import {
   bitGet,
   bitLen,
@@ -70,18 +70,18 @@ import {
   bytesToNumberBE,
   concatBytes as concatB,
   ensureBytes,
-  type Hex,
   numberToBytesBE,
-} from './abstract/utils.js';
+  type Hex,
+} from './abstract/utils.ts';
 // Types
-import { isogenyMap } from './abstract/hash-to-curve.js';
-import type { Fp, Fp12, Fp2, Fp6 } from './abstract/tower.js';
-import { psiFrobenius, tower12 } from './abstract/tower.js';
+import { isogenyMap } from './abstract/hash-to-curve.ts';
+import type { Fp, Fp12, Fp2, Fp6 } from './abstract/tower.ts';
+import { psiFrobenius, tower12 } from './abstract/tower.ts';
 import {
-  type AffinePoint,
   mapToCurveSimpleSWU,
+  type AffinePoint,
   type ProjPointType,
-} from './abstract/weierstrass.js';
+} from './abstract/weierstrass.ts';
 
 // Be friendly to bad ECMAScript parsers by not using bigint literals
 // prettier-ignore
@@ -164,7 +164,7 @@ const { Fp, Fp2, Fp6, Fp4Square, Fp12 } = tower12({
 
 // Finite field over r.
 // This particular field is not used anywhere in bls12-381, but it is still useful.
-const Fr = mod.Field(BigInt('0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001'));
+const Fr = Field(BigInt('0x73eda753299d7d483339d80809a1d80553bda402fffe5bfeffffffff00000001'));
 
 // END OF CURVE FIELDS
 
@@ -337,8 +337,7 @@ const G1_SWU = mapToCurveSimpleSWU(Fp, {
   Z: Fp.create(BigInt(11)),
 });
 
-// Endomorphisms (for fast cofactor clearing)
-// Ψ(P) endomorphism
+// GLV endomorphism Ψ(P), for fast cofactor clearing
 const { G2psi, G2psi2 } = psiFrobenius(Fp, Fp2, Fp2.div(Fp2.ONE, Fp2.NONRESIDUE)); // 1/(u+1)
 
 // Default hash_to_field options are for hash to G2.
@@ -476,28 +475,15 @@ export const bls12_381: CurveFn = bls({
     // It returns false for shitty points.
     // https://eprint.iacr.org/2021/1130.pdf
     isTorsionFree: (c, point): boolean => {
-      // φ endomorphism
-      const cubicRootOfUnityModP = BigInt(
+      // GLV endomorphism ψ(P)
+      const beta = BigInt(
         '0x5f19672fdf76ce51ba69c6076a0f77eaddb3a93be6f89688de17d813620a00022e01fffffffefffe'
       );
-      const phi = new c(Fp.mul(point.px, cubicRootOfUnityModP), point.py, point.pz);
-
-      // todo: unroll
+      const phi = new c(Fp.mul(point.px, beta), point.py, point.pz);
+      // TODO: unroll
       const xP = point.multiplyUnsafe(BLS_X).negate(); // [x]P
       const u2P = xP.multiplyUnsafe(BLS_X); // [u2]P
       return u2P.equals(phi);
-
-      // https://eprint.iacr.org/2019/814.pdf
-      // (z² − 1)/3
-      // const c1 = BigInt('0x396c8c005555e1560000000055555555');
-      // const P = this;
-      // const S = P.sigma();
-      // const Q = S.double();
-      // const S2 = S.sigma();
-      // // [(z² − 1)/3](2σ(P) − P − σ²(P)) − σ²(P) = O
-      // const left = Q.subtract(P).subtract(S2).multiplyUnsafe(c1);
-      // const C = left.subtract(S2);
-      // return C.isZero();
     },
     // Clear cofactor of G1
     // https://eprint.iacr.org/2019/403
@@ -627,14 +613,12 @@ export const bls12_381: CurveFn = bls({
     // point.isTorsionFree() should return true for valid points
     // It returns false for shitty points.
     // https://eprint.iacr.org/2021/1130.pdf
+    // Older version: https://eprint.iacr.org/2019/814.pdf
     isTorsionFree: (c, P): boolean => {
       return P.multiplyUnsafe(BLS_X).negate().equals(G2psi(c, P)); // ψ(P) == [u](P)
-      // Older version: https://eprint.iacr.org/2019/814.pdf
-      // Ψ²(P) => Ψ³(P) => [z]Ψ³(P) where z = -x => [z]Ψ³(P) - Ψ²(P) + P == O
-      // return P.psi2().psi().mulNegX().subtract(psi2).add(P).isZero();
     },
     // Maps the point into the prime-order subgroup G2.
-    // clear_cofactor_bls12381_g2 from cfrg-hash-to-curve-11
+    // clear_cofactor_bls12381_g2 from RFC 9380.
     // https://eprint.iacr.org/2017/419.pdf
     // prettier-ignore
     clearCofactor: (c, P) => {

package/node_modules/{@solana/web3.js/node_modules/@noble → @noble}/curves/src/bn254.ts

@@ -13,6 +13,15 @@ There are huge compatibility issues in the ecosystem:
    https://github.com/scipr-lab/libff/blob/a44f482e18b8ac04d034c193bd9d7df7817ad73f/libff/algebra/curves/bn128/bn128_init.cpp#L166-L169
 3. halo2curves bn256 is also incompatible and returns different outputs
 
+We don't implement Point methods toHex / toRawBytes.
+To work around this limitation, has to initialize points on their own from BigInts.
+Reason it's not implemented is because [there is no standard](https://github.com/privacy-scaling-explorations/halo2curves/issues/109).
+Points of divergence:
+
+- Endianness: LE vs BE (byte-swapped)
+- Flags as first hex bits (similar to BLS) vs no-flags
+- Imaginary part last in G2 vs first (c0, c1 vs c1, c0)
+
 The goal of our implementation is to support "Ethereum" variant of the curve,
 because it at least has specs:
 
@@ -45,20 +54,20 @@ Ate loop size: 6x+2
  * @module
  */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-import { sha256 } from '@noble/hashes/sha256';
+import { sha256 } from '@noble/hashes/sha2';
 import { randomBytes } from '@noble/hashes/utils';
-import { getHash } from './_shortw_utils.js';
+import { getHash } from './_shortw_utils.ts';
 import {
   bls,
   type CurveFn as BLSCurveFn,
   type PostPrecomputeFn,
   type PostPrecomputePointAddFn,
-} from './abstract/bls.js';
-import { Field } from './abstract/modular.js';
-import type { Fp, Fp12, Fp2, Fp6 } from './abstract/tower.js';
-import { psiFrobenius, tower12 } from './abstract/tower.js';
-import { bitGet, bitLen, notImplemented } from './abstract/utils.js';
-import { type CurveFn, weierstrass } from './abstract/weierstrass.js';
+} from './abstract/bls.ts';
+import { Field } from './abstract/modular.ts';
+import type { Fp, Fp12, Fp2, Fp6 } from './abstract/tower.ts';
+import { psiFrobenius, tower12 } from './abstract/tower.ts';
+import { bitGet, bitLen, notImplemented } from './abstract/utils.ts';
+import { type CurveFn, weierstrass } from './abstract/weierstrass.ts';
 // prettier-ignore
 const _1n = BigInt(1), _2n = BigInt(2), _3n = BigInt(3);
 const _6n = BigInt(6);
@@ -239,6 +248,7 @@ export const bn254: BLSCurveFn = bls({
  * bn254 weierstrass curve with ECDSA.
  * This is very rare and probably not used anywhere.
  * Instead, you should use G1 / G2, defined above.
+ * @deprecated
  */
 export const bn254_weierstrass: CurveFn = weierstrass({
   a: BigInt(0),

package/node_modules/{@solana/web3.js/node_modules/@noble → @noble}/curves/src/ed25519.ts

@@ -6,18 +6,19 @@
  * @module
  */
 /*! noble-curves - MIT License (c) 2022 Paul Miller (paulmillr.com) */
-import { sha512 } from '@noble/hashes/sha512';
+import { sha512 } from '@noble/hashes/sha2';
 import { concatBytes, randomBytes, utf8ToBytes } from '@noble/hashes/utils';
-import { type AffinePoint, type Group, pippenger } from './abstract/curve.js';
-import { type CurveFn, type ExtPointType, twistedEdwards } from './abstract/edwards.js';
+import { type AffinePoint, type Group, pippenger } from './abstract/curve.ts';
+import { type CurveFn, type ExtPointType, twistedEdwards } from './abstract/edwards.ts';
 import {
   createHasher,
   expand_message_xmd,
+  type Hasher,
   type htfBasicOpts,
   type HTFMethod,
-} from './abstract/hash-to-curve.js';
-import { Field, FpSqrtEven, isNegativeLE, mod, pow2 } from './abstract/modular.js';
-import { montgomery, type CurveFn as XCurveFn } from './abstract/montgomery.js';
+} from './abstract/hash-to-curve.ts';
+import { Field, FpInvertBatch, FpSqrtEven, isNegativeLE, mod, pow2 } from './abstract/modular.ts';
+import { montgomery, type CurveFn as XCurveFn } from './abstract/montgomery.ts';
 import {
   bytesToHex,
   bytesToNumberLE,
@@ -25,12 +26,14 @@ import {
   equalBytes,
   type Hex,
   numberToBytesLE,
-} from './abstract/utils.js';
+} from './abstract/utils.ts';
 
+// 2n**255n - 19n
 const ED25519_P = BigInt(
   '57896044618658097711785492504343953926634992332820282019728792003956564819949'
 );
 // √(-1) aka √(a) aka 2^((p-1)/4)
+// Fp.sqrt(Fp.neg(1))
 const ED25519_SQRT_M1 = /* @__PURE__ */ BigInt(
   '19681161376707505956807079304988542015446066515923890162744021073123829784752'
 );
@@ -91,7 +94,7 @@ function uvRatio(u: bigint, v: bigint): { isValid: boolean; value: bigint } {
   return { isValid: useRoot1 || useRoot2, value: x };
 }
 
-// Just in case
+/** Weird / bogus points, useful for debugging. */
 export const ED25519_TORSION_SUBGROUP: string[] = [
   '0100000000000000000000000000000000000000000000000000000000000000',
   'c7176a703d4dd84fba3c0b760d10670f2a2053fa2c39ccc64ec7fd7792ac037a',
@@ -107,19 +110,15 @@ const Fp = /* @__PURE__ */ (() => Field(ED25519_P, undefined, true))();
 
 const ed25519Defaults = /* @__PURE__ */ (() =>
   ({
-    // Param: a
-    a: BigInt(-1), // Fp.create(-1) is proper; our way still works and is faster
-    // d is equal to -121665/121666 over finite field.
-    // Negative number is P - number, and division is invert(number, P)
+    // Removing Fp.create() will still work, and is 10% faster on sign
+    a: Fp.create(BigInt(-1)),
+    // d is -121665/121666 a.k.a. Fp.neg(121665 * Fp.inv(121666))
     d: BigInt('37095705934669439343138083508754565189542113879843219016388785533085940283555'),
-    // Finite field 𝔽p over which we'll do calculations; 2n**255n - 19n
+    // Finite field 2n**255n - 19n
     Fp,
-    // Subgroup order: how many points curve has
-    // 2n**252n + 27742317777372353535851937790883648493n;
+    // Subgroup order 2n**252n + 27742317777372353535851937790883648493n;
     n: BigInt('7237005577332262213973186563042994240857116359379907606001950938285454250989'),
-    // Cofactor
     h: _8n,
-    // Base point (x, y) aka generator point
     Gx: BigInt('15112221349535400772501151409588531511454012693041857206046113283949847762202'),
     Gy: BigInt('46316835694926478169428394003475163141307993866256225615783033603165251855960'),
     hash: sha512,
@@ -180,10 +179,7 @@ export const ed25519ph: CurveFn = /* @__PURE__ */ (() =>
 export const x25519: XCurveFn = /* @__PURE__ */ (() =>
   montgomery({
     P: ED25519_P,
-    a: BigInt(486662),
-    montgomeryBits: 255, // n is 253 bits
-    nByteLength: 32,
-    Gu: BigInt(9),
+    type: 'x25519',
     powPminus2: (x: bigint): bigint => {
       const P = ED25519_P;
       // x^(p-2) aka x^(2^255-21)
@@ -291,12 +287,11 @@ function map_to_curve_elligator2_edwards25519(u: bigint) {
   xd = Fp.cmov(xd, Fp.ONE, e); //  10. xd = CMOV(xd, 1, e)
   yn = Fp.cmov(yn, Fp.ONE, e); //  11. yn = CMOV(yn, 1, e)
   yd = Fp.cmov(yd, Fp.ONE, e); //  12. yd = CMOV(yd, 1, e)
-
-  const inv = Fp.invertBatch([xd, yd]); // batch division
-  return { x: Fp.mul(xn, inv[0]), y: Fp.mul(yn, inv[1]) }; //  13. return (xn, xd, yn, yd)
+  const [xd_inv, yd_inv] = FpInvertBatch(Fp, [xd, yd], true); // batch division
+  return { x: Fp.mul(xn, xd_inv), y: Fp.mul(yn, yd_inv) }; //  13. return (xn, xd, yn, yd)
 }
 
-const htf = /* @__PURE__ */ (() =>
+export const ed25519_hasher: Hasher<bigint> = /* @__PURE__ */ (() =>
   createHasher(
     ed25519.ExtendedPoint,
     (scalars: bigint[]) => map_to_curve_elligator2_edwards25519(scalars[0]),
@@ -310,10 +305,11 @@ const htf = /* @__PURE__ */ (() =>
       hash: sha512,
     }
   ))();
-export const hashToCurve: HTFMethod<bigint> = /* @__PURE__ */ (() => htf.hashToCurve)();
-export const encodeToCurve: HTFMethod<bigint> = /* @__PURE__ */ (() => htf.encodeToCurve)();
+export const hashToCurve: HTFMethod<bigint> = /* @__PURE__ */ (() => ed25519_hasher.hashToCurve)();
+export const encodeToCurve: HTFMethod<bigint> = /* @__PURE__ */ (() =>
+  ed25519_hasher.encodeToCurve)();
 
-function assertRstPoint(other: unknown) {
+function aristp(other: unknown) {
   if (!(other instanceof RistPoint)) throw new Error('RistrettoPoint expected');
 }
 
@@ -346,8 +342,11 @@ const bytes255ToNumberLE = (bytes: Uint8Array) =>
 
 type ExtendedPoint = ExtPointType;
 
-// Computes Elligator map for Ristretto
-// https://ristretto.group/formulas/elligator.html
+/**
+ * Computes Elligator map for Ristretto255.
+ * Described in [RFC9380](https://www.rfc-editor.org/rfc/rfc9380#appendix-B) and on
+ * the [website](https://ristretto.group/formulas/elligator.html).
+ */
 function calcElligatorRistrettoMap(r0: bigint): ExtendedPoint {
   const { d } = ed25519.CURVE;
   const P = ed25519.CURVE.Fp.ORDER;
@@ -375,14 +374,17 @@ function calcElligatorRistrettoMap(r0: bigint): ExtendedPoint {
  * a source of bugs for protocols like ring signatures. Ristretto was created to solve this.
  * Ristretto point operates in X:Y:Z:T extended coordinates like ExtendedPoint,
  * but it should work in its own namespace: do not combine those two.
- * https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-ristretto255-decaf448
+ * See [RFC9496](https://www.rfc-editor.org/rfc/rfc9496).
  */
 class RistPoint implements Group<RistPoint> {
   static BASE: RistPoint;
   static ZERO: RistPoint;
+  private readonly ep: ExtendedPoint;
   // Private property to discourage combining ExtendedPoint + RistrettoPoint
   // Always use Ristretto encoding/decoding instead.
-  constructor(private readonly ep: ExtendedPoint) {}
+  constructor(ep: ExtendedPoint) {
+    this.ep = ep;
+  }
 
   static fromAffine(ap: AffinePoint<bigint>): RistPoint {
     return new RistPoint(ed25519.ExtendedPoint.fromAffine(ap));
@@ -392,7 +394,8 @@ class RistPoint implements Group<RistPoint> {
    * Takes uniform output of 64-byte hash function like sha512 and converts it to `RistrettoPoint`.
    * The hash-to-group operation applies Elligator twice and adds the results.
    * **Note:** this is one-way map, there is no conversion from point to hash.
-   * https://ristretto.group/formulas/elligator.html
+   * Described in [RFC9380](https://www.rfc-editor.org/rfc/rfc9380#appendix-B) and on
+   * the [website](https://ristretto.group/formulas/elligator.html).
    * @param hex 64-byte output of a hash function
    */
   static hashToCurve(hex: Hex): RistPoint {
@@ -406,7 +409,7 @@ class RistPoint implements Group<RistPoint> {
 
   /**
    * Converts ristretto-encoded string to ristretto point.
-   * https://ristretto.group/formulas/decoding.html
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-decode).
    * @param hex Ristretto-encoded 32 bytes. Not every 32-byte string is valid ristretto encoding
    */
   static fromHex(hex: Hex): RistPoint {
@@ -443,7 +446,7 @@ class RistPoint implements Group<RistPoint> {
 
   /**
    * Encodes ristretto point to Uint8Array.
-   * https://ristretto.group/formulas/encoding.html
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-encode).
    */
   toRawBytes(): Uint8Array {
     let { ex: x, ey: y, ez: z, et: t } = this.ep;
@@ -481,9 +484,12 @@ class RistPoint implements Group<RistPoint> {
     return this.toHex();
   }
 
-  // Compare one point to another.
+  /**
+   * Compares two Ristretto points.
+   * Described in [RFC9496](https://www.rfc-editor.org/rfc/rfc9496#name-equals).
+   */
   equals(other: RistPoint): boolean {
-    assertRstPoint(other);
+    aristp(other);
     const { ex: X1, ey: Y1 } = this.ep;
     const { ex: X2, ey: Y2 } = other.ep;
     const mod = ed25519.CURVE.Fp.create;
@@ -494,12 +500,12 @@ class RistPoint implements Group<RistPoint> {
   }
 
   add(other: RistPoint): RistPoint {
-    assertRstPoint(other);
+    aristp(other);
     return new RistPoint(this.ep.add(other.ep));
   }
 
   subtract(other: RistPoint): RistPoint {
-    assertRstPoint(other);
+    aristp(other);
     return new RistPoint(this.ep.subtract(other.ep));
   }
 
@@ -519,13 +525,21 @@ class RistPoint implements Group<RistPoint> {
     return new RistPoint(this.ep.negate());
   }
 }
+
+/**
+ * Wrapper over Edwards Point for ristretto255 from
+ * [RFC9496](https://www.rfc-editor.org/rfc/rfc9496).
+ */
 export const RistrettoPoint: typeof RistPoint = /* @__PURE__ */ (() => {
   if (!RistPoint.BASE) RistPoint.BASE = new RistPoint(ed25519.ExtendedPoint.BASE);
   if (!RistPoint.ZERO) RistPoint.ZERO = new RistPoint(ed25519.ExtendedPoint.ZERO);
   return RistPoint;
 })();
 
-// Hashing to ristretto255. https://www.rfc-editor.org/rfc/rfc9380#appendix-B
+/**
+ * hash-to-curve for ristretto255.
+ * Described in [RFC9380](https://www.rfc-editor.org/rfc/rfc9380#appendix-B).
+ */
 export const hashToRistretto255 = (msg: Uint8Array, options: htfBasicOpts): RistPoint => {
   const d = options.DST;
   const DST = typeof d === 'string' ? utf8ToBytes(d) : d;
@@ -533,5 +547,6 @@ export const hashToRistretto255 = (msg: Uint8Array, options: htfBasicOpts): Rist
   const P = RistPoint.hashToCurve(uniform_bytes);
   return P;
 };
+/** @deprecated */
 export const hash_to_ristretto255: (msg: Uint8Array, options: htfBasicOpts) => RistPoint =
   hashToRistretto255; // legacy