@pinionengineering/prover-client 0.1.0

package/dist/bn254.js

@@ -0,0 +1,186 @@
+/**
+ * BN254 (alt_bn128 / Ethereum) curve operations using noble/curves.
+ *
+ * Curve parameters (Ethereum EIP-197 / gnark-crypto):
+ *   p = 0x30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47
+ *   q = 21888242871839275222246405745257275088548364400416034343698204186575808495617
+ *   y² = x³ + 3 over Fp
+ *
+ * Wire formats (gnark-crypto RawBytes / EIP-197):
+ *   G1: 64 bytes  = X_BE(32) || Y_BE(32)
+ *   G2: 128 bytes = X.A1(32) || X.A0(32) || Y.A1(32) || Y.A0(32)
+ *                   (gnark-crypto A0=real, A1=imaginary; noble c0=real, c1=imaginary)
+ *
+ * hashToG1 implements RFC 9380 hash-to-curve using the SVDW map with DST
+ * "sw-pub-v1-BN254G1_XMD:SHA-256_SVDW_RO_", matching gnark-crypto HashToG1
+ * in storage-proofs/por/sw/pub.go.
+ *
+ * noble/curves v1.9.7 has SVDW for BN254 G1 marked notImplemented, so the
+ * map is implemented here directly from RFC 9380 §6.6.2 using BigInt arithmetic.
+ * Constants are from gnark-crypto ecc/bn254/hash_to_g1.go, converted from
+ * Montgomery form.
+ */
+import { bn254 } from '@noble/curves/bn254';
+import { hash_to_field } from '@noble/curves/abstract/hash-to-curve';
+import { sha256 } from '@noble/hashes/sha256';
+// ---------------------------------------------------------------------------
+// Base points
+// ---------------------------------------------------------------------------
+export const G1_BASE = bn254.G1.ProjectivePoint.BASE;
+export const G2_BASE = bn254.G2.ProjectivePoint.BASE;
+// ---------------------------------------------------------------------------
+// Utility
+// ---------------------------------------------------------------------------
+/** Convert big-endian bytes to a bigint. */
+export function bytesToBigInt(bytes) {
+    let result = 0n;
+    for (let i = 0; i < bytes.length; i++)
+        result = (result << 8n) | BigInt(bytes[i] ?? 0);
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Wire format parsing
+// ---------------------------------------------------------------------------
+/** Deserialize a G1 point from 64 bytes (gnark-crypto RawBytes / EIP-197 format). */
+export function g1FromBytes(bytes) {
+    if (bytes.length !== 64)
+        throw new Error(`BN254 G1: expected 64 bytes, got ${bytes.length}`);
+    const x = bytesToBigInt(bytes.subarray(0, 32));
+    const y = bytesToBigInt(bytes.subarray(32, 64));
+    return bn254.G1.ProjectivePoint.fromAffine({ x, y });
+}
+/**
+ * Deserialize a G2 point from 128 bytes (gnark-crypto RawBytes / EIP-197 format).
+ *
+ * gnark-crypto G2Affine.RawBytes() layout:
+ *   bytes[ 0: 32] = X.A1 (imaginary)
+ *   bytes[32: 64] = X.A0 (real)
+ *   bytes[64: 96] = Y.A1 (imaginary)
+ *   bytes[96:128] = Y.A0 (real)
+ *
+ * noble/curves Fp2 uses { c0: real, c1: imaginary }.
+ */
+export function g2FromBytes(bytes) {
+    if (bytes.length !== 128)
+        throw new Error(`BN254 G2: expected 128 bytes, got ${bytes.length}`);
+    const xIm = bytesToBigInt(bytes.subarray(0, 32));
+    const xRe = bytesToBigInt(bytes.subarray(32, 64));
+    const yIm = bytesToBigInt(bytes.subarray(64, 96));
+    const yRe = bytesToBigInt(bytes.subarray(96, 128));
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const Fp2 = bn254.fields.Fp2;
+    return bn254.G2.ProjectivePoint.fromAffine({
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        x: Fp2.fromBigTuple([xRe, xIm]),
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        y: Fp2.fromBigTuple([yRe, yIm]),
+    });
+}
+// ---------------------------------------------------------------------------
+// G1 arithmetic
+// ---------------------------------------------------------------------------
+/** Scalar-multiply a G1 point: returns k·P. */
+export function g1ScalarMult(P, k) {
+    return P.multiply(k);
+}
+/** Add two G1 points. */
+export function g1Add(A, B) {
+    return A.add(B);
+}
+// ---------------------------------------------------------------------------
+// Pairing
+// ---------------------------------------------------------------------------
+/** Compute the BN254 Ate pairing e(P, Q) → Fp12. */
+export function atePairing(P, Q) {
+    return bn254.pairing(P, Q);
+}
+/** Check equality of two Fp12 elements. */
+export function fp12Equal(a, b) {
+    return bn254.fields.Fp12.eql(a, b);
+}
+// ---------------------------------------------------------------------------
+// RFC 9380 SVDW hash-to-G1 for BN254
+// ---------------------------------------------------------------------------
+const FP_P = 0x30644e72e131a029b85045b68181585d97816a916871ca8d3c208c16d87cfd47n;
+const FP_B = 3n; // BN254: y² = x³ + 3
+// SVDW precomputed constants for Z = 1 (from gnark-crypto, converted from Montgomery form)
+const C1 = 4n; // g(Z) = Z³ + B = 1 + 3 = 4
+const C2 = 0x183227397098d014dc2822db40c0ac2ecbc0b548b438e5469e10460b6c3e7ea3n; // -Z/2 mod p
+const C3 = 0x16789af3a83522eb353c98fc6b36d713d5d8d1cc5dffffffan; // sqrt(-g(Z)·3Z²) mod p
+const C4 = 0x10216f7ba065e00de81ac1e7808072c9dd2b2385cd7b438469602eb24829a9bdn; // -4g(Z)/(3Z²) mod p
+const Z = 1n;
+const SQRT_EXP = (FP_P + 1n) >> 2n; // (p+1)/4, valid since p ≡ 3 mod 4
+const LEG_EXP = (FP_P - 1n) >> 1n; // (p-1)/2
+function fpAdd(a, b) { return (a + b) % FP_P; }
+function fpSub(a, b) { return ((a - b) % FP_P + FP_P) % FP_P; }
+function fpMul(a, b) { return (a * b) % FP_P; }
+function fpSqr(a) { return (a * a) % FP_P; }
+function fpNeg(a) { return a === 0n ? 0n : FP_P - a; }
+function fpPow(base, exp) {
+    let r = 1n;
+    let b = base % FP_P;
+    let e = exp;
+    while (e > 0n) {
+        if (e & 1n)
+            r = (r * b) % FP_P;
+        e >>= 1n;
+        b = (b * b) % FP_P;
+    }
+    return r;
+}
+function fpSqrt(a) { return fpPow(a, SQRT_EXP); }
+function fpInv0(a) { return a === 0n ? 0n : fpPow(a, FP_P - 2n); }
+function isSquare(a) { return fpPow(a, LEG_EXP) !== FP_P - 1n; }
+function sgn0(a) { return a & 1n; }
+function cmov(a, b, cond) { return cond ? b : a; }
+/**
+ * RFC 9380 §6.6.2 straightline SVDW map-to-curve for BN254 G1 (A=0, B=3, Z=1).
+ * Matches gnark-crypto ecc/bn254/hash_to_g1.go MapToCurve1 exactly.
+ *
+ * Steps 22-26 compute x3 = (tv2² · tv3)² · c4 + Z, which is the RFC 9380
+ * straightline form — NOT the non-straightline form tv4²+c4.
+ */
+function svdwMapToCurve(u) {
+    const tv1 = fpMul(fpSqr(u), C1); // 1-2:  u²·c1
+    const tv2 = fpAdd(1n, tv1); // 3:    1 + tv1
+    const tv1b = fpSub(1n, tv1); // 4:    1 - tv1
+    const tv3 = fpInv0(fpMul(tv1b, tv2)); // 5-6:  inv0(tv1b·tv2)
+    const tv4 = fpMul(fpMul(fpMul(u, tv1b), tv3), C3); // 7-9:  u·tv1b·tv3·c3
+    const x1 = fpSub(C2, tv4); // 10:   c2 - tv4
+    const gx1 = fpAdd(fpMul(fpSqr(x1), x1), FP_B); // 11-14: x1³+B
+    const e1 = isSquare(gx1); // 15
+    const x2 = fpAdd(C2, tv4); // 16:   c2 + tv4
+    const gx2 = fpAdd(fpMul(fpSqr(x2), x2), FP_B); // 17-20: x2³+B
+    const e2 = isSquare(gx2) && !e1; // 21
+    const x3 = fpAdd(fpMul(fpSqr(fpMul(fpSqr(tv2), tv3)), C4), Z); // 22-26: (tv2²·tv3)²·c4+Z
+    const x = cmov(cmov(x3, x2, e2), x1, e1); // 27-28
+    const gx = fpAdd(fpMul(fpSqr(x), x), FP_B); // 29-32: x³+B
+    const y = fpSqrt(gx); // 33
+    const e3 = sgn0(u) === sgn0(y); // 34
+    return { x, y: cmov(fpNeg(y), y, e3) }; // 35
+}
+/** RFC 9380 hash-to-G1 DST matching gnark-crypto storage-proofs/por/sw/pub.go. */
+const SW_PUB_DST = 'sw-pub-v1-BN254G1_XMD:SHA-256_SVDW_RO_';
+const HTF_OPTS = {
+    DST: SW_PUB_DST,
+    p: FP_P,
+    m: 1, // G1 lives in Fp (not an extension field)
+    k: 128, // 128 bits of security → L = 48 bytes per element
+    expand: 'xmd',
+    hash: sha256,
+};
+/**
+ * Hash bytes to a G1 point using RFC 9380 SVDW with the SW-Pub DST.
+ *
+ * Matches gnark-crypto HashToG1(msg, pubHashDST) in storage-proofs/por/sw/pub.go.
+ */
+export function hashToG1(msg) {
+    // hash_to_field returns [[u0], [u1]] for count=2, m=1
+    const fields = hash_to_field(msg, 2, HTF_OPTS);
+    const u0 = fields[0][0];
+    const u1 = fields[1][0];
+    const Q0 = bn254.G1.ProjectivePoint.fromAffine(svdwMapToCurve(u0));
+    const Q1 = bn254.G1.ProjectivePoint.fromAffine(svdwMapToCurve(u1));
+    return Q0.add(Q1);
+}
+//# sourceMappingURL=bn254.js.map

package/dist/bn254.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bn254.js","sourceRoot":"","sources":["../src/bn254.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,sCAAsC,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAU9C,8EAA8E;AAC9E,cAAc;AACd,8EAA8E;AAE9E,MAAM,CAAC,MAAM,OAAO,GAAY,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;AAC9D,MAAM,CAAC,MAAM,OAAO,GAAY,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;AAE9D,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,qFAAqF;AACrF,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;QACtB,MAAM,IAAI,KAAK,CAAC,qCAAqC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACnD,8DAA8D;IAC9D,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAU,CAAC;IACpC,OAAO,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC;QACzC,8DAA8D;QAC9D,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAQ;QACtC,8DAA8D;QAC9D,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAQ;KACvC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,gBAAgB;AAChB,8EAA8E;AAE9E,+CAA+C;AAC/C,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,CAAS;IAChD,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,KAAK,CAAC,CAAU,EAAE,CAAU;IAC1C,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,oDAAoD;AACpD,MAAM,UAAU,UAAU,CAAC,CAAU,EAAE,CAAU;IAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,SAAS,CAAC,CAAW,EAAE,CAAW;IAChD,OAAO,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,qCAAqC;AACrC,8EAA8E;AAE9E,MAAM,IAAI,GAAG,mEAAmE,CAAC;AACjF,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,qBAAqB;AAEtC,2FAA2F;AAC3F,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,4BAA4B;AAC3C,MAAM,EAAE,GAAG,mEAAmE,CAAC,CAAC,aAAa;AAC7F,MAAM,EAAE,GAAG,oDAAoD,CAAC,CAAe,wBAAwB;AACvG,MAAM,EAAE,GAAG,mEAAmE,CAAC,CAAC,qBAAqB;AACrG,MAAM,CAAC,GAAI,EAAE,CAAC;AAEd,MAAM,QAAQ,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,mCAAmC;AACvE,MAAM,OAAO,GAAI,CAAC,IAAI,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,UAAU;AAE9C,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS,IAAY,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACvE,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS,IAAY,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACvF,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS,IAAY,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACvE,SAAS,KAAK,CAAC,CAAS,IAAuB,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AACvE,SAAS,KAAK,CAAC,CAAS,IAAuB,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;AAEjF,SAAS,KAAK,CAAC,IAAY,EAAE,GAAW;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACpB,IAAI,CAAC,GAAG,GAAG,CAAC;IACZ,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QACd,IAAI,CAAC,GAAG,EAAE;YAAE,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;QAC/B,CAAC,KAAK,EAAE,CAAC;QACT,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM,CAAC,CAAS,IAAe,OAAO,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;AACpE,SAAS,MAAM,CAAC,CAAS,IAAe,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;AACrF,SAAS,QAAQ,CAAC,CAAS,IAAa,OAAO,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;AACjF,SAAS,IAAI,CAAC,CAAS,IAAiB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AACxD,SAAS,IAAI,CAAC,CAAS,EAAE,CAAS,EAAE,IAAa,IAAY,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEnF;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAA+B,cAAc;IAC7E,MAAM,GAAG,GAAG,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAqC,gBAAgB;IAChF,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAoC,gBAAgB;IAChF,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAA2B,uBAAuB;IACvF,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAa,sBAAsB;IACrF,MAAM,EAAE,GAAI,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAqC,iBAAiB;IACjF,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAiB,eAAe;IAC9E,MAAM,EAAE,GAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAsC,KAAK;IACrE,MAAM,EAAE,GAAI,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAqC,iBAAiB;IACjF,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAiB,eAAe;IAC9E,MAAM,EAAE,GAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAA+B,KAAK;IACrE,MAAM,EAAE,GAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,0BAA0B;IAC1F,MAAM,CAAC,GAAK,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAoB,QAAQ;IACvE,MAAM,EAAE,GAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAmB,cAAc;IAC7E,MAAM,CAAC,GAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAyC,KAAK;IACrE,MAAM,EAAE,GAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAgC,KAAK;IACrE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAwB,KAAK;AACtE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,GAAG,wCAAwC,CAAC;AAE5D,MAAM,QAAQ,GAAG;IACf,GAAG,EAAE,UAAU;IACf,CAAC,EAAE,IAAI;IACP,CAAC,EAAE,CAAC,EAAO,0CAA0C;IACrD,CAAC,EAAE,GAAG,EAAK,kDAAkD;IAC7D,MAAM,EAAE,KAAc;IACtB,IAAI,EAAE,MAAM;CACb,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAe;IACtC,sDAAsD;IACtD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC,CAAE,CAAC;IAC1B,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC;IACnE,OAAO,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AACpB,CAAC"}

package/dist/bn256.d.ts

@@ -0,0 +1,68 @@
+/**
+ * BN256 curve operations matching cloudflare/bn256 used by pinion-prover.
+ *
+ * WARNING: This is NOT the Ethereum alt_bn128 / BN254 curve (p ≈ 2^254).
+ * cloudflare/bn256 uses a DIFFERENT 256-bit prime (p ≈ 2^256), giving a
+ * different field, different generator point, and different group order.
+ * The two curves are incompatible; libraries that call themselves "bn256"
+ * but mean "alt_bn128" (e.g. noble/curves/bn254) will not work here.
+ *
+ * Curve parameters (from cloudflare/bn256 constants.go):
+ *   BN parameter u   = 6518589491078791937
+ *   Field prime p    = 36u⁴+36u³+24u²+6u+1 (256 bits)
+ *   Group order n    = 36u⁴+36u³+18u²+6u+1 (256 bits)
+ *   Curve equation   = y² = x³ + 3 over Fp
+ *   G1 generator     = (1, p-2)   [y = -2 mod p]
+ *   G2 twist         = D-type,  y² = x³ + 3/ξ over Fp², ξ = 3+i (FP2_NONRESIDUE=[3,1])
+ *   Ate loop size    = 6u + 2
+ *
+ * Wire formats (cloudflare Marshal):
+ *   G1: 64 bytes = x_BE(32) || y_BE(32)
+ *   G2: 128 bytes = X_im(32) || X_re(32) || Y_im(32) || Y_re(32)
+ *   (cloudflare gfP2 stores {x=imaginary, y=real}; noble Fp2 uses {c0=real, c1=imaginary})
+ *
+ * G2 coordinate mapping from cloudflare wire → noble Fp2:
+ *   noble X = { c0: bytes[32:64], c1: bytes[0:32] }
+ *   noble Y = { c0: bytes[96:128], c1: bytes[64:96] }
+ */
+export declare const bn256: import("@noble/curves/abstract/bls").CurveFn;
+export type G1Point = ReturnType<typeof bn256.G1.ProjectivePoint.fromAffine>;
+export type G2Point = ReturnType<typeof bn256.G2.ProjectivePoint.fromAffine>;
+export type Fp12Elem = ReturnType<typeof bn256.pairing>;
+/** G1 generator. */
+export declare const G1_BASE: G1Point;
+/** G2 generator. */
+export declare const G2_BASE: G2Point;
+/**
+ * Deserialize a cloudflare/bn256 G1 point from 64 bytes.
+ * Format: x_BE(32) || y_BE(32) — no uncompressed prefix.
+ */
+export declare function g1FromBytes(bytes: Uint8Array): G1Point;
+/**
+ * Deserialize a cloudflare/bn256 G2 point.
+ *
+ * cloudflare G2.Marshal() returns EITHER:
+ *   1 byte  — [0x00] for the point at infinity
+ *   129 bytes — [0x01] || X_im(32) || X_re(32) || Y_im(32) || Y_re(32)
+ *
+ * cloudflare gfP2 stores {x=imaginary, y=real}, so:
+ *   bytes[1:33]   = X_imaginary (noble X.c1)
+ *   bytes[33:65]  = X_real      (noble X.c0)
+ *   bytes[65:97]  = Y_imaginary (noble Y.c1)
+ *   bytes[97:129] = Y_real      (noble Y.c0)
+ */
+export declare function g2FromBytes(bytes: Uint8Array): G2Point;
+/** Scalar-multiply a G1 point: returns k·P. */
+export declare function g1ScalarMult(P: G1Point, k: bigint): G1Point;
+/** Add two G1 points. */
+export declare function g1Add(A: G1Point, B: G1Point): G1Point;
+/**
+ * Compute the BN256 Ate pairing e(P, Q) → Fp12.
+ * Matches bn256.Pair() in Go.
+ */
+export declare function atePairing(P: G1Point, Q: G2Point): Fp12Elem;
+/** Check equality of two Fp12 elements. */
+export declare function fp12Equal(a: Fp12Elem, b: Fp12Elem): boolean;
+/** Convert big-endian bytes to a bigint. */
+export declare function bytesToBigInt(bytes: Uint8Array): bigint;
+//# sourceMappingURL=bn256.d.ts.map

package/dist/bn256.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bn256.d.ts","sourceRoot":"","sources":["../src/bn256.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAiGH,eAAO,MAAM,KAAK,8CAqDT,CAAC;AAMV,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;AAC7E,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC;AAC7E,MAAM,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC;AAExD,oBAAoB;AACpB,eAAO,MAAM,OAAO,EAAE,OAAuC,CAAC;AAC9D,oBAAoB;AACpB,eAAO,MAAM,OAAO,EAAE,OAAuC,CAAC;AAE9D;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAMtD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CActD;AAED,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAE3D;AAED,yBAAyB;AACzB,wBAAgB,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAErD;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,QAAQ,CAE3D;AAED,2CAA2C;AAC3C,wBAAgB,SAAS,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,GAAG,OAAO,CAE3D;AAED,4CAA4C;AAC5C,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMvD"}

package/dist/bn256.js

@@ -0,0 +1,231 @@
+/**
+ * BN256 curve operations matching cloudflare/bn256 used by pinion-prover.
+ *
+ * WARNING: This is NOT the Ethereum alt_bn128 / BN254 curve (p ≈ 2^254).
+ * cloudflare/bn256 uses a DIFFERENT 256-bit prime (p ≈ 2^256), giving a
+ * different field, different generator point, and different group order.
+ * The two curves are incompatible; libraries that call themselves "bn256"
+ * but mean "alt_bn128" (e.g. noble/curves/bn254) will not work here.
+ *
+ * Curve parameters (from cloudflare/bn256 constants.go):
+ *   BN parameter u   = 6518589491078791937
+ *   Field prime p    = 36u⁴+36u³+24u²+6u+1 (256 bits)
+ *   Group order n    = 36u⁴+36u³+18u²+6u+1 (256 bits)
+ *   Curve equation   = y² = x³ + 3 over Fp
+ *   G1 generator     = (1, p-2)   [y = -2 mod p]
+ *   G2 twist         = D-type,  y² = x³ + 3/ξ over Fp², ξ = 3+i (FP2_NONRESIDUE=[3,1])
+ *   Ate loop size    = 6u + 2
+ *
+ * Wire formats (cloudflare Marshal):
+ *   G1: 64 bytes = x_BE(32) || y_BE(32)
+ *   G2: 128 bytes = X_im(32) || X_re(32) || Y_im(32) || Y_re(32)
+ *   (cloudflare gfP2 stores {x=imaginary, y=real}; noble Fp2 uses {c0=real, c1=imaginary})
+ *
+ * G2 coordinate mapping from cloudflare wire → noble Fp2:
+ *   noble X = { c0: bytes[32:64], c1: bytes[0:32] }
+ *   noble Y = { c0: bytes[96:128], c1: bytes[64:96] }
+ */
+import { Field } from '@noble/curves/abstract/modular';
+import { tower12 } from '@noble/curves/abstract/tower';
+import { bls } from '@noble/curves/abstract/bls';
+import { sha256 } from '@noble/hashes/sha256';
+// ---------------------------------------------------------------------------
+// BN256 field parameters
+// ---------------------------------------------------------------------------
+const BN_X = 6518589491078791937n; // cloudflare BN256 parameter u
+const BN_X_LEN = 63; // bitLen(u)
+const _0n = 0n, _1n = 1n, _2n = 2n, _3n = 3n, _6n = 6n;
+const SIX_X_SQUARED = _6n * BN_X ** _2n;
+const BN256_P = 65000549695646603732796438742359905742825358107623003571877145026864184071783n;
+const BN256_ORDER = 65000549695646603732796438742359905742570406053903786389881062969044166799969n;
+// ---------------------------------------------------------------------------
+// Twist b = 3/(3+i) in Fp2 (computed via Go helper: 9·10⁻¹ mod p, -3·10⁻¹ mod p)
+// ---------------------------------------------------------------------------
+const Fp2B_BN256 = {
+    c0: 45500384786952622612957507119651934019977750675336102500314001518804928850249n,
+    c1: 6500054969564660373279643874235990574282535810762300357187714502686418407178n,
+};
+// ---------------------------------------------------------------------------
+// Build the field tower
+// ---------------------------------------------------------------------------
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+const { Fp, Fp2, Fp6, Fp12 } = tower12({
+    ORDER: BN256_P,
+    X_LEN: BN_X_LEN,
+    // ξ = 3+i  →  FP2_NONRESIDUE = [c0=3, c1=1]  (cloudflare uses ξ = i+3 = 3+i)
+    FP2_NONRESIDUE: [_3n, _1n],
+    // Multiply a Fp2 element by the G2 b coefficient (3/ξ).
+    Fp2mulByB: (num) => Fp2.mul(num, Fp2B_BN256),
+    // Final exponentiation using BN256's u = BN_X.
+    // Algorithm from Scott et al. "On the Final Exponentiation for Calculating
+    // Pairings on Ordinary Elliptic Curves" — same structure as BN254, just
+    // a different u value.
+    Fp12finalExponentiate: (num) => {
+        const powMinusX = (n) => Fp12.conjugate(Fp12._cyclotomicExp(n, BN_X));
+        const r0 = Fp12.mul(Fp12.conjugate(num), Fp12.inv(num));
+        const r = Fp12.mul(Fp12.frobeniusMap(r0, 2), r0);
+        const y1 = Fp12._cyclotomicSquare(powMinusX(r));
+        const y2 = Fp12.mul(Fp12._cyclotomicSquare(y1), y1);
+        const y4 = powMinusX(y2);
+        const y6 = powMinusX(Fp12._cyclotomicSquare(y4));
+        const y8 = Fp12.mul(Fp12.mul(Fp12.conjugate(y6), y4), Fp12.conjugate(y2));
+        const y9 = Fp12.mul(y8, y1);
+        return Fp12.mul(Fp12.frobeniusMap(Fp12.mul(Fp12.conjugate(r), y9), 3), Fp12.mul(Fp12.frobeniusMap(y8, 2), Fp12.mul(Fp12.frobeniusMap(y9, 1), Fp12.mul(Fp12.mul(y8, y4), r))));
+    },
+});
+// ---------------------------------------------------------------------------
+// Frobenius endomorphism for G2 (needed for postPrecompute in Miller loop)
+// ---------------------------------------------------------------------------
+import { psiFrobenius } from '@noble/curves/abstract/tower';
+const { G2psi, psi } = psiFrobenius(Fp, Fp2, Fp2.NONRESIDUE);
+// ---------------------------------------------------------------------------
+// G2 generator coordinates (decoded from cloudflare's String() output)
+// cloudflare prints (im, re) for each coord; noble Fp2 uses {c0=real, c1=imag}
+// ---------------------------------------------------------------------------
+const BN256_G2_CURVE = {
+    p: Fp2.ORDER,
+    n: BN256_ORDER,
+    h: 21n, // cofactor for BN256 G2 (= (6u^2 + 1))
+    a: Fp2.ZERO,
+    b: Fp2B_BN256,
+    Gx: Fp2.fromBigTuple([
+        64746500191241794695844075326670126197795977525365406531717464316923369116492n, // c0 = real
+        21167961636542580255011770066570541300993051739349375019639421053990175267184n, // c1 = imaginary
+    ]),
+    Gy: Fp2.fromBigTuple([
+        17778617556404439934652658462602675281523610326338642107814333856843981424549n, // c0 = real
+        20666913350058776956210519119118544732556678129809273996262322366050359951122n, // c1 = imaginary
+    ]),
+};
+// ---------------------------------------------------------------------------
+// Assemble the BN256 pairing instance using noble's bls() combinator
+// ---------------------------------------------------------------------------
+const notImpl = (..._args) => {
+    throw new Error('bn256: not implemented');
+};
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export const bn256 = bls({
+    fields: { Fp, Fp2, Fp6, Fp12, Fr: Field(BN256_ORDER) },
+    G1: {
+        p: BN256_P,
+        n: BN256_ORDER,
+        h: _1n,
+        a: _0n,
+        b: _3n,
+        Gx: _1n,
+        Gy: BN256_P - _2n,
+        Fp,
+        htfDefaults: { DST: '', encodeDST: '', p: BN256_P, m: 1, k: 128, expand: 'xmd', hash: sha256 },
+        wrapPrivateKey: true,
+        allowInfinityPoint: true,
+        mapToCurve: notImpl,
+        fromBytes: notImpl,
+        toBytes: notImpl,
+        ShortSignature: { fromBytes: notImpl, fromHex: notImpl, toBytes: notImpl, toRawBytes: notImpl, toHex: notImpl },
+    },
+    G2: {
+        ...BN256_G2_CURVE,
+        Fp: Fp2,
+        hEff: 1n,
+        htfDefaults: { DST: '', encodeDST: '', p: BN256_P, m: 2, k: 128, expand: 'xmd', hash: sha256 },
+        wrapPrivateKey: true,
+        allowInfinityPoint: true,
+        // [6u²]P = ψ(P) is the BN curve G2 torsion-freeness check.
+        // The cast is necessary because noble's internal G2 type is not yet resolved
+        // at the point where bls() is called (circular reference).
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        isTorsionFree: (c, P) => P.multiplyUnsafe(SIX_X_SQUARED).equals(G2psi(c, P)),
+        mapToCurve: notImpl,
+        fromBytes: notImpl,
+        toBytes: notImpl,
+        Signature: { fromBytes: notImpl, fromHex: notImpl, toBytes: notImpl, toRawBytes: notImpl, toHex: notImpl },
+    },
+    params: {
+        ateLoopSize: BN_X * _6n + _2n,
+        r: BN256_ORDER,
+        xNegative: false,
+        twistType: 'divisive',
+    },
+    htfDefaults: { DST: '', encodeDST: '', p: BN256_P, m: 1, k: 128, expand: 'xmd', hash: sha256 },
+    hash: sha256,
+    // Frobenius correction after the Miller loop (same as bn254.ts _postPrecompute).
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    postPrecompute: (Rx, Ry, Rz, Qx, Qy, pointAdd) => {
+        const q = psi(Qx, Qy);
+        ({ Rx, Ry, Rz } = pointAdd(Rx, Ry, Rz, q[0], q[1]));
+        const q2 = psi(q[0], q[1]);
+        pointAdd(Rx, Ry, Rz, q2[0], Fp2.neg(q2[1]));
+    },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+});
+/** G1 generator. */
+export const G1_BASE = bn256.G1.ProjectivePoint.BASE;
+/** G2 generator. */
+export const G2_BASE = bn256.G2.ProjectivePoint.BASE;
+/**
+ * Deserialize a cloudflare/bn256 G1 point from 64 bytes.
+ * Format: x_BE(32) || y_BE(32) — no uncompressed prefix.
+ */
+export function g1FromBytes(bytes) {
+    if (bytes.length !== 64)
+        throw new Error(`BN256 G1: expected 64 bytes, got ${bytes.length}`);
+    const x = bytesToBigInt(bytes.subarray(0, 32));
+    const y = bytesToBigInt(bytes.subarray(32, 64));
+    return bn256.G1.ProjectivePoint.fromAffine({ x, y });
+}
+/**
+ * Deserialize a cloudflare/bn256 G2 point.
+ *
+ * cloudflare G2.Marshal() returns EITHER:
+ *   1 byte  — [0x00] for the point at infinity
+ *   129 bytes — [0x01] || X_im(32) || X_re(32) || Y_im(32) || Y_re(32)
+ *
+ * cloudflare gfP2 stores {x=imaginary, y=real}, so:
+ *   bytes[1:33]   = X_imaginary (noble X.c1)
+ *   bytes[33:65]  = X_real      (noble X.c0)
+ *   bytes[65:97]  = Y_imaginary (noble Y.c1)
+ *   bytes[97:129] = Y_real      (noble Y.c0)
+ */
+export function g2FromBytes(bytes) {
+    if (bytes.length === 1 && bytes[0] === 0x00) {
+        return bn256.G2.ProjectivePoint.ZERO;
+    }
+    if (bytes.length !== 129 || bytes[0] !== 0x01)
+        throw new Error(`BN256 G2: expected 129 bytes (0x01 prefix), got ${bytes.length}`);
+    const xIm = bytesToBigInt(bytes.subarray(1, 33));
+    const xRe = bytesToBigInt(bytes.subarray(33, 65));
+    const yIm = bytesToBigInt(bytes.subarray(65, 97));
+    const yRe = bytesToBigInt(bytes.subarray(97, 129));
+    return bn256.G2.ProjectivePoint.fromAffine({
+        x: Fp2.fromBigTuple([xRe, xIm]),
+        y: Fp2.fromBigTuple([yRe, yIm]),
+    });
+}
+/** Scalar-multiply a G1 point: returns k·P. */
+export function g1ScalarMult(P, k) {
+    return P.multiply(k);
+}
+/** Add two G1 points. */
+export function g1Add(A, B) {
+    return A.add(B);
+}
+/**
+ * Compute the BN256 Ate pairing e(P, Q) → Fp12.
+ * Matches bn256.Pair() in Go.
+ */
+export function atePairing(P, Q) {
+    return bn256.pairing(P, Q);
+}
+/** Check equality of two Fp12 elements. */
+export function fp12Equal(a, b) {
+    return Fp12.eql(a, b);
+}
+/** Convert big-endian bytes to a bigint. */
+export function bytesToBigInt(bytes) {
+    let result = 0n;
+    for (let i = 0; i < bytes.length; i++) {
+        result = (result << 8n) | BigInt(bytes[i] ?? 0);
+    }
+    return result;
+}
+//# sourceMappingURL=bn256.js.map

package/dist/bn256.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bn256.js","sourceRoot":"","sources":["../src/bn256.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,gCAAgC,CAAC;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,4BAA4B,CAAC;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAC9E,MAAM,IAAI,GAAG,oBAAoB,CAAC,CAAG,+BAA+B;AACpE,MAAM,QAAQ,GAAG,EAAE,CAAC,CAAkB,YAAY;AAClD,MAAM,GAAG,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,CAAC;AAEvD,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,IAAI,GAAG,CAAC;AAExC,MAAM,OAAO,GAAG,8EAA8E,CAAC;AAC/F,MAAM,WAAW,GAAG,8EAA8E,CAAC;AAEnG,8EAA8E;AAC9E,iFAAiF;AACjF,8EAA8E;AAC9E,MAAM,UAAU,GAAG;IACjB,EAAE,EAAE,8EAA8E;IAClF,EAAE,EAAE,6EAA6E;CAClF,CAAC;AAEF,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAC9E,8DAA8D;AAC9D,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACrC,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,QAAQ;IACf,6EAA6E;IAC7E,cAAc,EAAE,CAAC,GAAG,EAAE,GAAG,CAAqB;IAC9C,wDAAwD;IACxD,SAAS,EAAE,CAAC,GAAwC,EAAE,EAAE,CACtD,GAAG,CAAC,GAAG,CAAC,GAAoC,EAAE,UAAU,CAAC;IAC3D,+CAA+C;IAC/C,2EAA2E;IAC3E,wEAAwE;IACxE,uBAAuB;IACvB,qBAAqB,EAAE,CAAC,GAAmC,EAAE,EAAE;QAC7D,MAAM,SAAS,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;QAClF,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,GAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClD,MAAM,EAAE,GAAG,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACzB,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;QACjD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,GAAG,CACb,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,EACrD,IAAI,CAAC,GAAG,CACN,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,EACxB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAClE,CACF,CAAC;IACJ,CAAC;CAC+B,CAAC,CAAC;AAEpC,8EAA8E;AAC9E,2EAA2E;AAC3E,8EAA8E;AAC9E,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAC5D,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;AAE7D,8EAA8E;AAC9E,uEAAuE;AACvE,+EAA+E;AAC/E,8EAA8E;AAC9E,MAAM,cAAc,GAAG;IACrB,CAAC,EAAE,GAAG,CAAC,KAAK;IACZ,CAAC,EAAE,WAAW;IACd,CAAC,EAAE,GAAG,EAAE,uCAAuC;IAC/C,CAAC,EAAE,GAAG,CAAC,IAAI;IACX,CAAC,EAAE,UAAU;IACb,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC;QACnB,8EAA8E,EAAE,YAAY;QAC5F,8EAA8E,EAAE,iBAAiB;KAClG,CAAC;IACF,EAAE,EAAE,GAAG,CAAC,YAAY,CAAC;QACnB,8EAA8E,EAAE,YAAY;QAC5F,8EAA8E,EAAE,iBAAiB;KAClG,CAAC;CACH,CAAC;AAEF,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAC9E,MAAM,OAAO,GAAG,CAAC,GAAG,KAAgB,EAAS,EAAE;IAC7C,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,8DAA8D;AAC9D,MAAM,CAAC,MAAM,KAAK,GAAG,GAAG,CAAC;IACvB,MAAM,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE;IACtD,EAAE,EAAE;QACF,CAAC,EAAE,OAAO;QACV,CAAC,EAAE,WAAW;QACd,CAAC,EAAE,GAAG;QACN,CAAC,EAAE,GAAG;QACN,CAAC,EAAE,GAAG;QACN,EAAE,EAAE,GAAG;QACP,EAAE,EAAE,OAAO,GAAG,GAAG;QACjB,EAAE;QACF,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;QAC9F,cAAc,EAAE,IAAI;QACpB,kBAAkB,EAAE,IAAI;QACxB,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,OAAO;QAClB,OAAO,EAAE,OAAO;QAChB,cAAc,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;KAChH;IACD,EAAE,EAAE;QACF,GAAG,cAAc;QACjB,EAAE,EAAE,GAAG;QACP,IAAI,EAAE,EAAE;QACR,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;QAC9F,cAAc,EAAE,IAAI;QACpB,kBAAkB,EAAE,IAAI;QACxB,2DAA2D;QAC3D,6EAA6E;QAC7E,2DAA2D;QAC3D,8DAA8D;QAC9D,aAAa,EAAE,CAAC,CAAM,EAAE,CAAM,EAAE,EAAE,CAAE,CAAC,CAAC,cAAc,CAAC,aAAa,CAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/F,UAAU,EAAE,OAAO;QACnB,SAAS,EAAE,OAAO;QAClB,OAAO,EAAE,OAAO;QAChB,SAAS,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;KAC3G;IACD,MAAM,EAAE;QACN,WAAW,EAAE,IAAI,GAAG,GAAG,GAAG,GAAG;QAC7B,CAAC,EAAE,WAAW;QACd,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,UAAU;KACtB;IACD,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE;IAC9F,IAAI,EAAE,MAAM;IACZ,iFAAiF;IACjF,8DAA8D;IAC9D,cAAc,EAAE,CAAC,EAAO,EAAE,EAAO,EAAE,EAAO,EAAE,EAAO,EAAE,EAAO,EAAE,QAAa,EAAE,EAAE;QAC7E,MAAM,CAAC,GAAG,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACtB,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,QAAQ,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,8DAA8D;CACxD,CAAC,CAAC;AAUV,oBAAoB;AACpB,MAAM,CAAC,MAAM,OAAO,GAAY,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;AAC9D,oBAAoB;AACpB,MAAM,CAAC,MAAM,OAAO,GAAY,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;AAE9D;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QACrB,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;IACvC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAC3C,MAAM,IAAI,KAAK,CAAC,mDAAmD,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACrF,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;IACnD,OAAO,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,UAAU,CAAC;QACzC,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;KAChC,CAAC,CAAC;AACL,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,YAAY,CAAC,CAAU,EAAE,CAAS;IAChD,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACvB,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,KAAK,CAAC,CAAU,EAAE,CAAU;IAC1C,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,CAAU,EAAE,CAAU;IAC/C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,SAAS,CAAC,CAAW,EAAE,CAAW;IAChD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxB,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/challenge.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Challenge construction and deterministic derivation.
+ *
+ * Ports two Go functions exactly:
+ *
+ *   DeriveChallenge()   storage-proofs/line/chalderive.go
+ *   blockHashG1()       storage-proofs/por/sw/pub.go
+ *
+ * Any deviation from these implementations will produce challenges or
+ * verification paths that disagree with the server.
+ */
+import { type G1Point } from './bn254.js';
+/**
+ * BN254 (alt_bn128 / Ethereum) subgroup order q.
+ * = 21888242871839275222246405745257275088548364400416034343698204186575808495617
+ */
+export declare const BN254_ORDER = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+/** Encode bytes to base64. */
+export declare function uint8ToBase64(bytes: Uint8Array): string;
+/** Decode a base64 string to bytes. */
+export declare function base64ToBytes(b64: string): Uint8Array;
+/**
+ * Build a SW-Pub challenge for POST /prove.
+ *
+ * Returns a base64-encoded JSON string matching wireChal in
+ * storage-proofs/line/swpub/adapter.go:
+ *   { suite_id, seed, c, n }
+ *
+ * @param challengeSize  Number of blocks to sample (≤ totalBlocks).
+ * @param totalBlocks    Total blocks in the challenged store.
+ */
+export declare function buildChallenge(challengeSize: number, totalBlocks: number): string;
+/**
+ * Re-derive the challenge indices and blinding coefficients from a seed.
+ *
+ * Exact port of DeriveChallenge() in storage-proofs/line/chalderive.go (SuiteV1):
+ *
+ *   idxKey   = HMAC-SHA256(seed, "indices")
+ *   coeffKey = HMAC-SHA256(seed, "coeffs")
+ *   rank[i]  = HMAC-SHA256(idxKey, ids[i])   → sort asc → first c positions
+ *   coeff[t] = HMAC-SHA256(coeffKey, BE64(t)) mod BN254_ORDER
+ *
+ * Both challenger (browser) and prover (server) independently call this with
+ * the same (seed, ids) to agree on which blocks to challenge without any
+ * extra round-trip.
+ */
+export declare function deriveIndicesAndCoeffs(seed: Uint8Array, ids: Uint8Array[], c: number): {
+    indices: number[];
+    coeffs: bigint[];
+};
+/**
+ * H(λ‖id) = HashToG1(λ‖id) using RFC 9380 SVDW.
+ *
+ * Exact port of blockHashG1() in storage-proofs/por/sw/pub.go.
+ * λ is the 16-byte file name from WireClientSetup.name; id is CID.Bytes().
+ * Uses DST "sw-pub-v1-BN254G1_XMD:SHA-256_SVDW_RO_" internally.
+ */
+export declare function blockHashG1(name: Uint8Array, id: Uint8Array): G1Point;
+//# sourceMappingURL=challenge.d.ts.map

package/dist/challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../src/challenge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAA2B,KAAK,OAAO,EAAE,MAAM,YAAY,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,WAAW,iFACwD,CAAC;AAMjF,8BAA8B;AAC9B,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIvD;AAED,uCAAuC;AACvC,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAKrD;AAMD;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CASjF;AAMD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,UAAU,EAChB,GAAG,EAAE,UAAU,EAAE,EACjB,CAAC,EAAE,MAAM,GACR;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAoBzC;AAMD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,GAAG,OAAO,CAKrE"}