@nuggetslife/vc 0.0.29 → 0.1.0

package/Cargo.toml

@@ -27,3 +27,14 @@ napi-build = "2.0.1"
 [profile.release]
 lto = true
 strip = "symbols"
+
+
+# Mirrors the patch in vc/rs/Cargo.toml — when napi-rs builds vc/js, it
+# needs the same patched vendored crates so the v2 path uses the forks.
+[patch.crates-io]
+json-ld = { path = "../../vendor/json-ld" }
+json-ld-core = { path = "../../vendor/json-ld-core" }
+json-ld-context-processing = { path = "../../vendor/json-ld-context-processing" }
+json-ld-expansion = { path = "../../vendor/json-ld-expansion" }
+json-ld-compaction = { path = "../../vendor/json-ld-compaction" }
+json-ld-syntax = { path = "../../vendor/json-ld-syntax" }

package/W3C_CONFORMANCE.md

@@ -0,0 +1,48 @@
+# W3C Conformance Gate
+
+The CI runs the W3C JSON-LD 1.1 API and RDF Dataset Canonicalization (RDFC-1.0)
+test suites against the v2 JSON-LD path (`CLIENTFFI_JSONLD_V2=1`) via
+`test_w3c_conformance.mjs`. The job fails only when a test that **previously
+passed** starts failing — never on tests that were already failing in the
+committed baseline.
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| `test_w3c_conformance.mjs` | Runner. Modes: `--check`, `--update`, `--verbose`, `--only <algo>`. |
+| `w3c-baseline.json` | Committed baseline. The "passing" set per algo is what CI gates against. |
+| `w3c-denylist.json` | Tests skipped because they trigger Rust-level deadlocks in clientffi. Each entry is a real bug — remove as fixed. |
+| `scripts/fetch-w3c-tests.sh` | Clones the W3C test suites at pinned SHAs into `tmp-w3c-tests/` (gitignored). |
+
+## Local usage
+
+```bash
+# Fetch test fixtures (one-off, ~50 MB)
+yarn fetch:w3c-tests
+
+# Verify nothing has regressed vs baseline
+CLIENTFFI_JSONLD_V2=1 yarn test:w3c
+
+# Re-run the suite and overwrite the baseline. Add `--runs 3` for
+# fast algos (canonize, fromRdf) to take the intersection of 3 runs
+# and filter out flaky tests.
+CLIENTFFI_JSONLD_V2=1 yarn test:w3c:update
+```
+
+## Adding a denylist entry
+
+If a new clientffi-side bug causes the runner to hang on a particular test,
+add the test ID to the relevant `algo` array in `w3c-denylist.json` and open
+an issue for the underlying bug.
+
+## Coverage caveats
+
+- `flatten` and `toRdf` algos are **not yet** in the gated baseline. Each has
+  multiple deep deadlocks in clientffi that the JS-level per-test timeout
+  cannot unblock. They will be added once the underlying issues are mapped
+  (or after the migration to a mature JSON-LD crate).
+- `expand` and `compact` use single-run baselines because intersection-of-3
+  runs exhausts the NAPI worker pool on these large suites. Minor flakes
+  (1-3 tests) may produce false regressions; rerun the CI job once before
+  investigating.

package/bench/frame_compare.mjs

@@ -0,0 +1,203 @@
+// Head-to-head frame() bench: jsonld.js (Digital Bazaar reference) vs.
+// the three Rust backends behind the NAPI binding.
+//
+// Usage:
+//   node vc/js/bench/frame_compare.mjs                # default 30w + 30t
+//   node vc/js/bench/frame_compare.mjs --warm 20 --timed 100
+//   node vc/js/bench/frame_compare.mjs --json
+//
+// Each backend runs in its own measurement loop. The Rust backends are
+// selected via env flags inspected by the NAPI binding (vc/js/src/jsonld.rs):
+//   CLIENTFFI_JSONLD_V2=1 CLIENTFFI_FRAME_NATIVE=1 → frame_native
+//   CLIENTFFI_JSONLD_V2=1 CLIENTFFI_FRAME_FAST=1   → frame_v2_fast
+//   CLIENTFFI_JSONLD_V2=1                           → frame_v2 (V1-algo full)
+//
+// Caveat: the env flags are read by `frame_native::use_native()` (cached
+// via OnceLock) and inline `std::env::var` in the binding. We can't toggle
+// them within a single Node process, so this script spawns a fresh child
+// process per backend.
+
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve, dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { performance } from 'node:perf_hooks';
+import { spawnSync } from 'node:child_process';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(__dirname, '../../..');
+
+const args = process.argv.slice(2);
+const flag = (n) => args.includes(n);
+const valOf = (n) => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : null; };
+const jsonOut = flag('--json');
+const warmCount = Number(valOf('--warm') ?? 30);
+const timedCount = Number(valOf('--timed') ?? 30);
+
+const idv2Json = process.env.IDV2_JSON ?? '/Users/aml/conductor/workspaces/nuggets-v1/montpellier-v1/packages/bbs-signatures/src/__test__/identity-verifiable-credential-v2.json';
+if (!existsSync(idv2Json)) {
+  console.error(`IDv2 fixture not found: ${idv2Json}`);
+  process.exit(1);
+}
+
+// Backend selection lives in env. Re-exec ourselves with the right flags
+// so OnceLock-cached choices in Rust are bound to the right path.
+const backend = process.env.BENCH_BACKEND;
+
+if (!backend) {
+  // Driver mode: spawn a child process per backend, each with the same
+  // bench protocol, collect their JSON outputs, print a comparison.
+  const protocols = [
+    {
+      label: 'jsonld.js',
+      env: { BENCH_BACKEND: 'jsonld_js' },
+    },
+    {
+      label: 'frame_v2',
+      env: { BENCH_BACKEND: 'rust', CLIENTFFI_JSONLD_V2: '1' },
+    },
+    {
+      label: 'frame_v2_fast',
+      env: { BENCH_BACKEND: 'rust', CLIENTFFI_JSONLD_V2: '1', CLIENTFFI_FRAME_FAST: '1' },
+    },
+    {
+      label: 'frame_native',
+      env: { BENCH_BACKEND: 'rust', CLIENTFFI_JSONLD_V2: '1', CLIENTFFI_FRAME_NATIVE: '1' },
+    },
+  ];
+
+  const allResults = [];
+  for (const p of protocols) {
+    process.stderr.write(`running ${p.label} (${warmCount}w + ${timedCount}t)…\n`);
+    const child = spawnSync(process.execPath, [
+      fileURLToPath(import.meta.url),
+      '--warm', String(warmCount),
+      '--timed', String(timedCount),
+      '--json',
+    ], {
+      env: { ...process.env, ...p.env, IDV2_JSON: idv2Json },
+      encoding: 'utf8',
+      maxBuffer: 4 * 1024 * 1024,
+    });
+    if (child.status !== 0) {
+      process.stderr.write(child.stderr);
+      console.error(`${p.label} failed (exit ${child.status})`);
+      continue;
+    }
+    try {
+      const result = JSON.parse(child.stdout);
+      result.label = p.label;
+      allResults.push(result);
+    } catch (e) {
+      console.error(`${p.label} produced unparseable output:`);
+      process.stderr.write(child.stdout);
+      throw e;
+    }
+  }
+
+  if (jsonOut) {
+    process.stdout.write(JSON.stringify(allResults, null, 2) + '\n');
+  } else {
+    const fastest = Math.min(...allResults.map(r => r.p50));
+    console.log(
+      `\n--- frame() on ${(allResults[0]?.fixtureBytes / 1024).toFixed(0) ?? '?'} KB IDv2, ${warmCount}w + ${timedCount}t ---`,
+    );
+    console.log(
+      'backend         p50      p95      min      max      vs fastest',
+    );
+    for (const r of allResults) {
+      const factor = (r.p50 / fastest).toFixed(2);
+      console.log(
+        `${r.label.padEnd(15)} ${r.p50.toFixed(2).padStart(6)}ms ${r.p95.toFixed(2).padStart(6)}ms ${r.min.toFixed(2).padStart(6)}ms ${r.max.toFixed(2).padStart(6)}ms   ${factor}x`,
+      );
+    }
+  }
+  process.exit(0);
+}
+
+// Worker mode: actually run the bench for one backend.
+const big = JSON.parse(readFileSync(idv2Json, 'utf8'));
+delete big.proof;
+const ctx = big['@context'];
+
+// Match the Rust profile_frame harness: simple type frame.
+const primaryType = Array.isArray(big.type) ? big.type[0] : big.type;
+const frameDoc = { '@context': ctx, '@type': primaryType };
+
+let frameFn;
+if (backend === 'jsonld_js') {
+  const jsonld = (await import(join(repoRoot, 'vc/js/node_modules/jsonld/lib/index.js'))).default;
+
+  // Wire jsonld.js to the same bundled contexts as the Rust DocumentLoader.
+  // Each `vc/rs/src/document_loader/context/*.rs` defines a single
+  // `pub const NAME: &str = r#"<json>"#;` — extract the JSON literal.
+  const contextDir = join(repoRoot, 'vc/rs/src/document_loader/context');
+  const urlToFile = {
+    'https://www.w3.org/2018/credentials/v1': 'credentials.rs',
+    'https://schemas.nuggets.life/identity.json': 'identity.rs',
+    'https://schemas.nuggets.life/identityV2.json': 'identity_v2.rs',
+    'https://schemas.nuggets.life/identityV3.json': 'identity_v3.rs',
+    'https://schemas.nuggets.life/bbsBoundv1.json': 'bbs_bound_v1.rs',
+    'https://w3id.org/security/bbs/v1': 'bbs.rs',
+    'https://w3id.org/security/v1': 'security_v1.rs',
+    'https://w3id.org/security/v2': 'security_v2.rs',
+    'https://w3id.org/security/suites/secp256k1-2019/v1': 'secp256k1.rs',
+    'https://w3id.org/security/suites/jws-2020/v1': 'jws.rs',
+    'https://www.w3.org/ns/did/v1': 'did.rs',
+    'https://schema.org': 'schema_dot_org.rs',
+    'https://w3id.org/citizenship/v1': 'citizenship.rs',
+  };
+  const docs = {};
+  for (const [url, file] of Object.entries(urlToFile)) {
+    try {
+      const src = readFileSync(join(contextDir, file), 'utf8');
+      const m = src.match(/r#"\s*([\s\S]*?)\s*"#/);
+      if (!m) continue;
+      docs[url] = JSON.parse(m[1]);
+    } catch {
+      // Some context files may be absent on this branch; skip silently.
+    }
+  }
+  const customLoader = async (url) => {
+    if (docs[url]) {
+      return { contextUrl: null, document: docs[url], documentUrl: url };
+    }
+    throw new Error(`bench: no bundled context for ${url}`);
+  };
+  frameFn = () => jsonld.frame(big, frameDoc, { documentLoader: customLoader });
+} else if (backend === 'rust') {
+  const { JsonLd } = await import(join(repoRoot, 'vc/js/index.js'));
+  const proc = new JsonLd();
+  frameFn = () => proc.frame(big, frameDoc);
+} else {
+  console.error(`unknown BENCH_BACKEND=${backend}`);
+  process.exit(1);
+}
+
+function pct(arr, p) {
+  const sorted = [...arr].sort((a, b) => a - b);
+  return sorted[Math.min(sorted.length - 1, Math.floor(sorted.length * p))];
+}
+
+// Warm-up
+for (let i = 0; i < warmCount; i++) await frameFn();
+
+const samples = [];
+for (let i = 0; i < timedCount; i++) {
+  const t = performance.now();
+  await frameFn();
+  samples.push(performance.now() - t);
+}
+
+const result = {
+  backend,
+  fixtureBytes: JSON.stringify(big).length,
+  warm: warmCount,
+  timed: timedCount,
+  p50: pct(samples, 0.5),
+  p95: pct(samples, 0.95),
+  min: Math.min(...samples),
+  max: Math.max(...samples),
+  samples: samples.length,
+};
+
+process.stdout.write(JSON.stringify(result));

package/bench/v2_internals.mjs

@@ -0,0 +1,115 @@
+// Sprint 2 stable bench harness for V2 JSON-LD primitive operations on the
+// 166 KB IDv2 credential fixture. 30 warm + 30 timed samples per op.
+//
+// Usage:
+//   node vc/js/bench/v2_internals.mjs                       # V1 (default jsonld pipeline)
+//   CLIENTFFI_JSONLD_V2=1 node vc/js/bench/v2_internals.mjs # V2 (vendored crate pipeline)
+//   node vc/js/bench/v2_internals.mjs --json                # machine-readable output
+//   node vc/js/bench/v2_internals.mjs --only compact        # restrict to one op
+//
+// Compares before/after numbers across Sprint 2 patches.
+
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve, dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { performance } from 'node:perf_hooks';
+import { execSync } from 'node:child_process';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(__dirname, '../../..');
+
+const args = process.argv.slice(2);
+const flag = (n) => args.includes(n);
+const valOf = (n) => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : null; };
+const jsonOut = flag('--json');
+const onlyArg = valOf('--only');
+const warmCount = Number(valOf('--warm') ?? 30);
+const timedCount = Number(valOf('--timed') ?? 30);
+
+// Default fixture: prefer in-repo Rust test fixture, fall back to montpellier-v1
+// IDv2 source JSON. The Rust fixture is N-Quads only; for expand/compact/flatten
+// we need the JSON document.
+const idv2Json = process.env.IDV2_JSON ?? '/Users/aml/conductor/workspaces/nuggets-v1/montpellier-v1/packages/bbs-signatures/src/__test__/identity-verifiable-credential-v2.json';
+if (!existsSync(idv2Json)) {
+  console.error(`IDv2 fixture not found: ${idv2Json}\nSet IDV2_JSON to override.`);
+  process.exit(1);
+}
+
+const { JsonLd } = await import(join(repoRoot, 'vc/js/index.js'));
+const proc = new JsonLd();
+
+const big = JSON.parse(readFileSync(idv2Json, 'utf8'));
+delete big.proof;
+const ctx = big['@context'];
+
+let gitSha = 'unknown';
+try { gitSha = execSync('git rev-parse --short HEAD', { cwd: repoRoot }).toString().trim(); } catch {}
+
+function pct(arr, p) {
+  const sorted = [...arr].sort((a, b) => a - b);
+  return sorted[Math.min(sorted.length - 1, Math.floor(sorted.length * p))];
+}
+
+async function bench(label, fn) {
+  for (let i = 0; i < warmCount; i++) await fn();
+  const samples = [];
+  for (let i = 0; i < timedCount; i++) {
+    const t = performance.now();
+    await fn();
+    samples.push(performance.now() - t);
+  }
+  return {
+    label,
+    p50: pct(samples, 0.5),
+    p95: pct(samples, 0.95),
+    min: Math.min(...samples),
+    max: Math.max(...samples),
+    samples: samples.length,
+  };
+}
+
+const ops = {
+  expand: () => proc.expand(big),
+  compact: async () => {
+    const expanded = await proc.expand(big);
+    return proc.compact(expanded, ctx);
+  },
+  flatten_nocompact: () => proc.flatten(big, null),
+  flatten_compact: () => proc.flatten(big, ctx),
+};
+
+const selected = onlyArg ? { [onlyArg]: ops[onlyArg] } : ops;
+if (onlyArg && !ops[onlyArg]) {
+  console.error(`Unknown op: ${onlyArg}. Pick one of: ${Object.keys(ops).join(', ')}`);
+  process.exit(1);
+}
+
+const variant = process.env.CLIENTFFI_JSONLD_V2 ? 'V2' : 'V1';
+const results = {
+  meta: {
+    variant,
+    commit: gitSha,
+    fixture: idv2Json,
+    fixtureBytes: JSON.stringify(big).length,
+    warm: warmCount,
+    timed: timedCount,
+    timestamp: new Date().toISOString(),
+  },
+  ops: {},
+};
+
+for (const [name, fn] of Object.entries(selected)) {
+  const r = await bench(name, fn);
+  results.ops[name] = r;
+}
+
+if (jsonOut) {
+  process.stdout.write(JSON.stringify(results, null, 2) + '\n');
+} else {
+  console.log(`--- ${variant} on ${(results.meta.fixtureBytes / 1024).toFixed(0)} KB IDv2 (commit ${gitSha}, ${warmCount}w + ${timedCount}t) ---`);
+  for (const r of Object.values(results.ops)) {
+    console.log(
+      `${r.label.padEnd(10)} p50=${r.p50.toFixed(2).padStart(7)}ms  p95=${r.p95.toFixed(2).padStart(7)}ms  min=${r.min.toFixed(2)}ms  max=${r.max.toFixed(2)}ms`
+    );
+  }
+}

package/bench/vc_ops.mjs

@@ -0,0 +1,308 @@
+// End-to-end BBS+ verifiable credential ops bench.
+//
+// Times the full sign → verify → derive_proof → verify_derived flow for two
+// fixtures, across three pipeline configurations. Spawns one Node child
+// process per config so the OnceLock-cached env flags in Rust pick up the
+// right path.
+//
+//   v1               : default (V1 jsonld pipeline)
+//   v2               : CLIENTFFI_JSONLD_V2=1 (V2 pipeline, frame_v2)
+//   v2_native        : CLIENTFFI_JSONLD_V2=1 + CLIENTFFI_FRAME_NATIVE=1
+//
+// Usage:
+//   node vc/js/bench/vc_ops.mjs
+//   node vc/js/bench/vc_ops.mjs --fixture idv2     # IDv2 166 KB instead of small
+//   node vc/js/bench/vc_ops.mjs --warm 5 --timed 20
+
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve, dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { performance } from 'node:perf_hooks';
+import { spawnSync } from 'node:child_process';
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const repoRoot = resolve(__dirname, '../../..');
+const dataDir = resolve(__dirname, '../test-data');
+
+const args = process.argv.slice(2);
+const flag = (n) => args.includes(n);
+const valOf = (n) => { const i = args.indexOf(n); return i >= 0 ? args[i + 1] : null; };
+const jsonOut = flag('--json');
+const fixtureArg = valOf('--fixture') ?? 'small';
+const warmCount = Number(valOf('--warm') ?? 5);
+const timedCount = Number(valOf('--timed') ?? 20);
+
+const backend = process.env.BENCH_BACKEND;
+
+if (!backend) {
+  // Driver: spawn child per pipeline config.
+  const configs = [
+    { label: 'js_ref',    env: { BENCH_PIPELINE: 'js' } },
+    { label: 'v1',        env: {} },
+    { label: 'v2',        env: { CLIENTFFI_JSONLD_V2: '1' } },
+    { label: 'v2_native', env: { CLIENTFFI_JSONLD_V2: '1', CLIENTFFI_FRAME_NATIVE: '1' } },
+  ];
+
+  const allResults = [];
+  for (const c of configs) {
+    process.stderr.write(`running ${c.label} (${warmCount}w + ${timedCount}t, fixture=${fixtureArg})…\n`);
+    const child = spawnSync(process.execPath, [
+      fileURLToPath(import.meta.url),
+      '--warm', String(warmCount),
+      '--timed', String(timedCount),
+      '--fixture', fixtureArg,
+      '--json',
+    ], {
+      env: { ...process.env, ...c.env, BENCH_BACKEND: 'inproc' },
+      encoding: 'utf8',
+      maxBuffer: 8 * 1024 * 1024,
+    });
+    if (child.status !== 0) {
+      process.stderr.write(child.stderr);
+      console.error(`${c.label} failed (exit ${child.status})`);
+      continue;
+    }
+    try {
+      const result = JSON.parse(child.stdout);
+      result.label = c.label;
+      allResults.push(result);
+    } catch (e) {
+      process.stderr.write(child.stdout);
+      throw e;
+    }
+  }
+
+  if (jsonOut) {
+    process.stdout.write(JSON.stringify(allResults, null, 2) + '\n');
+  } else {
+    const ops = ['sign', 'verify', 'derive_proof', 'verify_derived', 'roundtrip'];
+    console.log(`\n--- VC ops on ${fixtureArg} fixture, ${warmCount}w + ${timedCount}t ---`);
+    const labels = allResults.map(r => r.label);
+    const header = ['op'.padEnd(16), ...labels.map(l => l.padStart(11))].join(' ');
+    console.log(header);
+    for (const op of ops) {
+      const cells = allResults.map(r => {
+        const m = r.ops[op];
+        return m ? `${m.p50.toFixed(2).padStart(7)}ms` : '—'.padStart(11);
+      });
+      console.log([op.padEnd(16), ...cells.map(c => c.padStart(11))].join(' '));
+    }
+    // Δ row vs leftmost (v1) — useful summary
+    if (allResults.length >= 2) {
+      console.log();
+      console.log('Δ vs v1 (negative = faster):');
+      const v1 = allResults[0];
+      for (const op of ops) {
+        const base = v1.ops[op]?.p50;
+        if (!base) continue;
+        const cells = allResults.map(r => {
+          const m = r.ops[op];
+          if (!m) return '—'.padStart(11);
+          const delta = m.p50 - base;
+          const pct = (delta / base) * 100;
+          return `${delta >= 0 ? '+' : ''}${delta.toFixed(2)}ms (${pct >= 0 ? '+' : ''}${pct.toFixed(0)}%)`.padStart(11);
+        });
+        console.log([op.padEnd(16), ...cells.map(c => c.padStart(20))].join(' '));
+      }
+    }
+  }
+  process.exit(0);
+}
+
+// ---- Worker mode: actually run the bench ----
+
+const pipeline = process.env.BENCH_PIPELINE ?? 'rust';
+
+let signFn, verifyFn, deriveFn;
+
+if (pipeline === 'rust') {
+  const { ldSign, ldVerify, ldDeriveProof } = await import(join(repoRoot, 'vc/js/index.js'));
+  signFn = (document, keyPair, contexts) => ldSign({ document, keyPair, contexts });
+  verifyFn = (document, contexts) => ldVerify({ document, contexts });
+  deriveFn = (document, revealDocument, contexts) =>
+    ldDeriveProof({ document, revealDocument, contexts });
+} else if (pipeline === 'js') {
+  const { createRequire } = await import('node:module');
+  const require = createRequire(import.meta.url);
+  const jsigs = require('jsonld-signatures');
+  const {
+    BbsBlsSignature2020,
+    BbsBlsSignatureProof2020,
+    Bls12381G2KeyPair,
+    deriveProof,
+  } = require('@mattrglobal/jsonld-signatures-bbs');
+  const { extendContextLoader } = jsigs;
+
+  // Build a static documentLoader from the same contexts the Rust path uses.
+  const buildLoader = (contextMap) => extendContextLoader((url) => {
+    const document = contextMap[url];
+    if (document) return { contextUrl: null, document, documentUrl: url };
+    throw new Error(`bench: no bundled context for ${url}`);
+  });
+
+  signFn = async (document, keyPair, contexts) => {
+    const key = await Bls12381G2KeyPair.from({
+      id: keyPair.id,
+      controller: keyPair.controller,
+      privateKeyBase58: keyPair.privateKeyBase58,
+      publicKeyBase58: keyPair.publicKeyBase58,
+      type: 'Bls12381G2Key2020',
+    });
+    return jsigs.sign(document, {
+      suite: new BbsBlsSignature2020({ key }),
+      purpose: new jsigs.purposes.AssertionProofPurpose(),
+      documentLoader: buildLoader(contexts),
+    });
+  };
+
+  verifyFn = async (document, contexts) => {
+    // jsigs.verify accepts an array of suites and dispatches based on
+    // proof.type. Passing a single (wrong) suite would cause derived
+    // proofs (BbsBlsSignatureProof2020) to fail immediately without
+    // running the actual ZKP check — that produced spuriously fast
+    // numbers in earlier runs of this bench.
+    const suite = [new BbsBlsSignature2020(), new BbsBlsSignatureProof2020()];
+    return jsigs.verify(document, {
+      suite,
+      purpose: new jsigs.purposes.AssertionProofPurpose(),
+      documentLoader: buildLoader(contexts),
+    });
+  };
+
+  deriveFn = async (document, revealDocument, contexts) =>
+    deriveProof(document, revealDocument, {
+      suite: new BbsBlsSignatureProof2020(),
+      documentLoader: buildLoader(contexts),
+    });
+} else {
+  console.error(`unknown BENCH_PIPELINE=${pipeline}`);
+  process.exit(1);
+}
+
+const loadJson = (p) => JSON.parse(readFileSync(p, 'utf8'));
+
+let inputDocument, revealDocument;
+const keyPair = loadJson(resolve(dataDir, 'keyPair.json'));
+const controllerDocument = loadJson(resolve(dataDir, 'controllerDocument.json'));
+const citizenVocab = loadJson(resolve(dataDir, 'citizenVocab.json'));
+
+if (fixtureArg === 'small') {
+  inputDocument = loadJson(resolve(dataDir, 'inputDocument.json'));
+  revealDocument = loadJson(resolve(dataDir, 'deriveProofFrame.json'));
+} else if (fixtureArg === 'idv2') {
+  const idv2Path = process.env.IDV2_JSON
+    ?? '/Users/aml/conductor/workspaces/nuggets-v1/montpellier-v1/packages/bbs-signatures/src/__test__/identity-verifiable-credential-v2.json';
+  if (!existsSync(idv2Path)) {
+    console.error(`IDv2 fixture missing: ${idv2Path}`);
+    process.exit(1);
+  }
+  inputDocument = JSON.parse(readFileSync(idv2Path, 'utf8'));
+  delete inputDocument.proof;
+  // Re-issue the credential under our test issuer so signing works with
+  // the static keyPair. Reveal frame: just reveal @type (minimal frame).
+  inputDocument.issuer = keyPair.controller;
+  const ctxArr = Array.isArray(inputDocument['@context'])
+    ? inputDocument['@context']
+    : [inputDocument['@context']];
+  if (!ctxArr.includes('https://w3id.org/security/bbs/v1')) {
+    inputDocument['@context'] = [...ctxArr, 'https://w3id.org/security/bbs/v1'];
+  }
+  revealDocument = {
+    '@context': inputDocument['@context'],
+    type: inputDocument.type,
+  };
+} else {
+  console.error(`unknown fixture: ${fixtureArg}`);
+  process.exit(1);
+}
+
+const contexts = {
+  [keyPair.id]: keyPair,
+  [keyPair.controller]: controllerDocument,
+  'https://w3id.org/citizenship/v1': citizenVocab,
+};
+
+// For the JS reference path (no built-in nuggets context cache), pull in
+// the same bundled JSON-LD contexts that vc/rs/src/document_loader/nuggets.rs
+// embeds. The Rust pipeline gets these for free; the JS pipeline needs them
+// in its documentLoader to load the IDv2 fixture without HTTP.
+if (pipeline === 'js') {
+  const ctxDir = resolve(__dirname, '../../rs/src/document_loader/context');
+  const urlToFile = {
+    'https://www.w3.org/2018/credentials/v1': 'credentials.rs',
+    'https://schemas.nuggets.life/identity.json': 'identity.rs',
+    'https://schemas.nuggets.life/identityV2.json': 'identity_v2.rs',
+    'https://schemas.nuggets.life/identityV3.json': 'identity_v3.rs',
+    'https://schemas.nuggets.life/bbsBoundv1.json': 'bbs_bound_v1.rs',
+    'https://w3id.org/security/bbs/v1': 'bbs.rs',
+    'https://w3id.org/security/v1': 'security_v1.rs',
+    'https://w3id.org/security/v2': 'security_v2.rs',
+    'https://w3id.org/security/suites/secp256k1-2019/v1': 'secp256k1.rs',
+    'https://w3id.org/security/suites/jws-2020/v1': 'jws.rs',
+    'https://www.w3.org/ns/did/v1': 'did.rs',
+    'https://schema.org': 'schema_dot_org.rs',
+  };
+  for (const [url, file] of Object.entries(urlToFile)) {
+    try {
+      const src = readFileSync(resolve(ctxDir, file), 'utf8');
+      const m = src.match(/r#"\s*([\s\S]*?)\s*"#/);
+      if (m && !contexts[url]) contexts[url] = JSON.parse(m[1]);
+    } catch {
+      // ignore missing files
+    }
+  }
+}
+
+function pct(arr, p) {
+  const sorted = [...arr].sort((a, b) => a - b);
+  return sorted[Math.min(sorted.length - 1, Math.floor(sorted.length * p))];
+}
+
+async function bench(fn) {
+  for (let i = 0; i < warmCount; i++) await fn();
+  const samples = [];
+  for (let i = 0; i < timedCount; i++) {
+    const t = performance.now();
+    await fn();
+    samples.push(performance.now() - t);
+  }
+  return {
+    p50: pct(samples, 0.5),
+    p95: pct(samples, 0.95),
+    min: Math.min(...samples),
+    max: Math.max(...samples),
+    samples: samples.length,
+  };
+}
+
+const ops = {};
+
+// sign: produces a signed document
+ops.sign = await bench(() => signFn(inputDocument, keyPair, contexts));
+
+// One-time signed doc for downstream ops
+const signed = await signFn(inputDocument, keyPair, contexts);
+
+ops.verify = await bench(() => verifyFn(signed, contexts));
+
+ops.derive_proof = await bench(() => deriveFn(signed, revealDocument, contexts));
+
+const derived = await deriveFn(signed, revealDocument, contexts);
+ops.verify_derived = await bench(() => verifyFn(derived, contexts));
+
+// roundtrip = sign + verify + derive + verify_derived
+ops.roundtrip = await bench(async () => {
+  const s = await signFn(inputDocument, keyPair, contexts);
+  await verifyFn(s, contexts);
+  const d = await deriveFn(s, revealDocument, contexts);
+  await verifyFn(d, contexts);
+});
+
+const result = {
+  fixture: fixtureArg,
+  fixtureBytes: JSON.stringify(inputDocument).length,
+  warm: warmCount,
+  timed: timedCount,
+  ops,
+};
+process.stdout.write(JSON.stringify(result));