@supercuts-walrus/backend 0.0.0-stage → 0.1.0

package/dist/procurement.d.ts

@@ -0,0 +1,8 @@
+export interface NegotiationBounds {
+    buyerOffer: bigint;
+    buyerMaximum: bigint;
+    sellerMinimum: bigint;
+}
+/** Amounts are backend-owned; the model can only choose whether to continue with this result. */
+export declare function deterministicCounteroffer(bounds: NegotiationBounds): bigint;
+export declare function settlementRailForPrivacy(privacy: "public" | "confidential", supported: ReadonlyArray<"x402" | "shielded">): "x402" | "shielded";

package/dist/procurement.js

@@ -0,0 +1,19 @@
+import { fail } from "./errors.js";
+/** Amounts are backend-owned; the model can only choose whether to continue with this result. */
+export function deterministicCounteroffer(bounds) {
+    const { buyerOffer, buyerMaximum, sellerMinimum } = bounds;
+    if (buyerOffer < 0n || buyerMaximum <= 0n || sellerMinimum <= 0n || buyerOffer > buyerMaximum)
+        fail("NEGOTIATION_BOUNDS_INVALID", "negotiation amounts are invalid");
+    if (sellerMinimum > buyerMaximum)
+        fail("NEGOTIATION_NO_OVERLAP", "seller minimum exceeds buyer maximum");
+    if (buyerOffer >= sellerMinimum)
+        return buyerOffer;
+    const midpoint = buyerOffer + (sellerMinimum - buyerOffer + 1n) / 2n;
+    return midpoint < sellerMinimum ? sellerMinimum : midpoint > buyerMaximum ? buyerMaximum : midpoint;
+}
+export function settlementRailForPrivacy(privacy, supported) {
+    const wanted = privacy === "confidential" ? "shielded" : "x402";
+    if (!supported.includes(wanted))
+        fail("RAIL_UNAVAILABLE", `${wanted} is required by deterministic privacy policy but is unavailable`);
+    return wanted;
+}

package/dist/protocol-engine.d.ts

@@ -0,0 +1,121 @@
+export declare const TREE_DEPTH = 20;
+export interface ProtocolDeployment {
+    deploymentDomain: string;
+    poolId: string;
+    coinTypeHash: string;
+    verifierVersion: number;
+    initialRoot: string;
+}
+export interface ProtocolIdentity {
+    seed: Uint8Array;
+    publicKey: [bigint, bigint];
+}
+export interface NoteOpeningData {
+    deployment: bigint;
+    amount: bigint;
+    ownerAx: bigint;
+    ownerAy: bigint;
+    spendSecret: bigint;
+    salt: bigint;
+    commitment: bigint;
+    leafIndex: bigint;
+}
+export interface AcceptedAgreement {
+    dealId: bigint;
+    revision: bigint;
+    transcriptRootLo: bigint;
+    transcriptRootHi: bigint;
+    serviceDigestLo: bigint;
+    serviceDigestHi: bigint;
+    settlementNonceLo: bigint;
+    settlementNonceHi: bigint;
+    paymentAmount: bigint;
+    blinding: bigint;
+    expiry: bigint;
+    buyer: ProtocolIdentity;
+    sellerPublicKey: [bigint, bigint];
+    sellerSignature: {
+        R8x: bigint;
+        R8y: bigint;
+        S: bigint;
+    };
+    recipientSpendTag: bigint;
+}
+export interface DepositWitness {
+    input: Record<string, unknown>;
+    opening: NoteOpeningData;
+    newRoot: bigint;
+    newIndex: bigint;
+    statement: Buffer;
+}
+export interface TransferWitness {
+    input: Record<string, unknown>;
+    statement: Buffer;
+    newRoot: bigint;
+    newIndex: bigint;
+    dealCommitment: bigint;
+    dealNullifier: bigint;
+    inputNullifier: bigint;
+    paymentCommitment: bigint;
+    changeCommitment: bigint;
+    paymentSalt: bigint;
+    changeOpening: NoteOpeningData;
+}
+export interface WithdrawWitness {
+    input: Record<string, unknown>;
+    statement: Buffer;
+    noteNullifier: bigint;
+}
+export interface WithdrawV2Witness extends WithdrawWitness {
+    newRoot: bigint;
+    newIndex: bigint;
+    changeOpening: NoteOpeningData;
+    exactExit: boolean;
+    amount: bigint;
+}
+export interface AgreementValues {
+    paymentSalt: bigint;
+    dealCommitment: bigint;
+    dealNullifier: bigint;
+}
+export declare class PoseidonTree {
+    readonly leaves: bigint[];
+    private readonly poseidon;
+    readonly zeroes: bigint[];
+    constructor(leaves: bigint[], poseidon: (values: bigint[]) => bigint);
+    path(selectedIndex: number): {
+        root: bigint;
+        siblings: bigint[];
+    };
+    get root(): bigint;
+    appendPath(): bigint[];
+}
+export declare class ProtocolEngine {
+    readonly deployment: ProtocolDeployment;
+    readonly deploymentField: bigint;
+    private readonly eddsa;
+    private readonly poseidonHash;
+    private constructor();
+    static create(deployment: ProtocolDeployment): Promise<ProtocolEngine>;
+    identity(seed?: Uint8Array): ProtocolIdentity;
+    randomScalar(): bigint;
+    spendTag(secret: bigint): bigint;
+    noteCommitment(amount: bigint, owner: [bigint, bigint], spendSecret: bigint, salt: bigint): bigint;
+    sign(identity: ProtocolIdentity, domain: 2004n | 2005n, agreement: bigint): {
+        R8x: bigint;
+        R8y: bigint;
+        S: bigint;
+    };
+    verify(publicKey: [bigint, bigint], domain: 2004n | 2005n, agreement: bigint, signature: {
+        R8x: bigint;
+        R8y: bigint;
+        S: bigint;
+    }): boolean;
+    private header;
+    tree(leaves: bigint[]): PoseidonTree;
+    buildDeposit(leaves: bigint[], owner: ProtocolIdentity, amount: bigint, spendSecret?: bigint, salt?: bigint): DepositWitness;
+    agreementValues(agreement: Omit<AcceptedAgreement, "sellerSignature">): AgreementValues;
+    buildTransfer(leaves: bigint[], inputNote: NoteOpeningData, agreement: AcceptedAgreement, changeSpendSecret?: bigint, changeSalt?: bigint): TransferWitness;
+    buildWithdraw(leaves: bigint[], note: NoteOpeningData, recipient: string): WithdrawWitness;
+    buildWithdrawV2(leaves: bigint[], note: NoteOpeningData, recipient: string, amount: bigint, exactExit?: boolean, changeSpendSecret?: bigint, changeSalt?: bigint): WithdrawV2Witness;
+}

package/dist/protocol-engine.js

@@ -0,0 +1,149 @@
+import { createHash, randomBytes } from "node:crypto";
+import { buildEddsa } from "circomlibjs";
+import { fail } from "./errors.js";
+export const TREE_DEPTH = 20;
+const FIELD_MODULUS = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+const asStrings = (value) => JSON.parse(JSON.stringify(value, (_key, item) => typeof item === "bigint" ? item.toString() : item));
+const fieldBytes = (value) => Buffer.from(value.toString(16).padStart(64, "0"), "hex");
+const u32 = (value) => { const out = Buffer.alloc(4); out.writeUInt32BE(value); return out; };
+const u64 = (value) => { const out = Buffer.alloc(8); out.writeBigUInt64BE(value); return out; };
+const limbs = (value) => [BigInt(`0x${value.subarray(0, 16).toString("hex")}`), BigInt(`0x${value.subarray(16).toString("hex")}`)];
+const digestInputs = (statement) => { const digest = createHash("sha256").update(statement).digest(); return { digestHigh: BigInt(`0x${digest.subarray(0, 16).toString("hex")}`), digestLow: BigInt(`0x${digest.subarray(16).toString("hex")}`) }; };
+const scalar = (bytes = 31) => { for (;;) {
+    const value = BigInt(`0x${randomBytes(bytes).toString("hex")}`);
+    if (value > 0n && value < FIELD_MODULUS)
+        return value;
+} };
+export class PoseidonTree {
+    leaves;
+    poseidon;
+    zeroes;
+    constructor(leaves, poseidon) {
+        this.leaves = leaves;
+        this.poseidon = poseidon;
+        if (leaves.length >= 2 ** TREE_DEPTH)
+            fail("TREE_EXHAUSTED", "protocol tree is full");
+        this.zeroes = [0n];
+        for (let level = 0; level < TREE_DEPTH; level++)
+            this.zeroes.push(poseidon([this.zeroes[level], this.zeroes[level]]));
+    }
+    path(selectedIndex) {
+        if (!Number.isSafeInteger(selectedIndex) || selectedIndex < 0 || selectedIndex >= 2 ** TREE_DEPTH)
+            fail("TREE_INDEX_INVALID", "tree index is outside the protocol range");
+        let nodes = new Map(this.leaves.map((leaf, index) => [index, leaf]));
+        let index = selectedIndex;
+        const siblings = [];
+        for (let level = 0; level < TREE_DEPTH; level++) {
+            siblings.push(nodes.get(index ^ 1) ?? this.zeroes[level]);
+            const parents = new Map();
+            for (const position of nodes.keys()) {
+                const parent = Math.floor(position / 2);
+                if (!parents.has(parent))
+                    parents.set(parent, this.poseidon([nodes.get(parent * 2) ?? this.zeroes[level], nodes.get(parent * 2 + 1) ?? this.zeroes[level]]));
+            }
+            nodes = parents;
+            index = Math.floor(index / 2);
+        }
+        return { root: nodes.get(0) ?? this.zeroes[TREE_DEPTH], siblings };
+    }
+    get root() { return this.path(0).root; }
+    appendPath() { return this.path(this.leaves.length).siblings; }
+}
+export class ProtocolEngine {
+    deployment;
+    deploymentField;
+    eddsa;
+    poseidonHash;
+    constructor(deployment, deploymentField, eddsa, poseidonHash) {
+        this.deployment = deployment;
+        this.deploymentField = deploymentField;
+        this.eddsa = eddsa;
+        this.poseidonHash = poseidonHash;
+    }
+    static async create(deployment) {
+        const domain = Buffer.from(deployment.deploymentDomain.replace(/^0x/, ""), "hex"), pool = Buffer.from(deployment.poolId.replace(/^0x/, ""), "hex"), coin = Buffer.from(deployment.coinTypeHash.replace(/^0x/, ""), "hex");
+        if ([domain, pool, coin].some((value) => value.length !== 32) || !Number.isSafeInteger(deployment.verifierVersion) || deployment.verifierVersion < 1)
+            fail("CONFIG_INVALID", "protocol deployment fields are invalid");
+        const eddsa = await buildEddsa();
+        const F = eddsa.babyJub.F;
+        const poseidon = (values) => F.toObject(eddsa.poseidon(values));
+        const [domainHi, domainLo] = limbs(domain), [poolHi, poolLo] = limbs(pool), [coinHi, coinLo] = limbs(coin);
+        return new ProtocolEngine(deployment, poseidon([2100n, domainHi, domainLo, poolHi, poolLo, coinHi, coinLo, BigInt(deployment.verifierVersion)]), eddsa, poseidon);
+    }
+    identity(seed = randomBytes(32)) { if (seed.length !== 32)
+        fail("IDENTITY_INVALID", "BabyJub identity seed must contain 32 bytes"); const F = this.eddsa.babyJub.F; return { seed: Uint8Array.from(seed), publicKey: this.eddsa.prv2pub(seed).map((value) => F.toObject(value)) }; }
+    randomScalar() { return scalar(); }
+    spendTag(secret) { return this.poseidonHash([2006n, secret]); }
+    noteCommitment(amount, owner, spendSecret, salt) { return this.poseidonHash([2010n, this.deploymentField, amount, owner[0], owner[1], this.spendTag(spendSecret), salt]); }
+    sign(identity, domain, agreement) { const F = this.eddsa.babyJub.F; const signature = this.eddsa.signPoseidon(identity.seed, F.e(this.poseidonHash([domain, this.deploymentField, agreement]))); return { R8x: F.toObject(signature.R8[0]), R8y: F.toObject(signature.R8[1]), S: signature.S }; }
+    verify(publicKey, domain, agreement, signature) { const F = this.eddsa.babyJub.F; return this.eddsa.verifyPoseidon(F.e(this.poseidonHash([domain, this.deploymentField, agreement])), { R8: [F.e(signature.R8x), F.e(signature.R8y)], S: signature.S }, [F.e(publicKey[0]), F.e(publicKey[1])]); }
+    header(kind) { return Buffer.concat([Buffer.from("SCUT"), Buffer.from([this.deployment.verifierVersion === 2 ? 2 : 1, kind]), Buffer.from(this.deployment.deploymentDomain.replace(/^0x/, ""), "hex"), Buffer.from(this.deployment.poolId.replace(/^0x/, ""), "hex"), Buffer.from(this.deployment.coinTypeHash.replace(/^0x/, ""), "hex"), u32(this.deployment.verifierVersion)]); }
+    tree(leaves) { return new PoseidonTree(leaves, this.poseidonHash); }
+    buildDeposit(leaves, owner, amount, spendSecret = scalar(), salt = scalar()) {
+        if (amount <= 0n || amount >= 1n << 64n)
+            fail("AMOUNT_INVALID", "deposit amount must be a positive u64");
+        if (this.deployment.verifierVersion === 2 && amount !== 10000000n && amount !== 100000000n)
+            fail("AMOUNT_INVALID", "v2 deposits must be 10,000,000 or 100,000,000 MIST");
+        const tree = this.tree(leaves), oldRoot = tree.root, leafIndex = BigInt(leaves.length), commitment = this.noteCommitment(amount, owner.publicKey, spendSecret, salt), nextTree = this.tree([...leaves, commitment]), newRoot = nextTree.root, newIndex = leafIndex + 1n;
+        const expectedInitial = BigInt(`0x${this.deployment.initialRoot.replace(/^0x/, "")}`);
+        if (!leaves.length && oldRoot !== expectedInitial)
+            fail("INITIAL_ROOT_MISMATCH", "circuit zero tree differs from the pinned initial root");
+        const statement = Buffer.concat([this.header(1), u64(amount), fieldBytes(commitment), fieldBytes(oldRoot), u64(leafIndex), fieldBytes(newRoot), u64(newIndex)]);
+        const input = asStrings({ statement: [...statement], ...digestInputs(statement), ownerAx: owner.publicKey[0], ownerAy: owner.publicKey[1], spendSecret, salt, appendSiblings: tree.appendPath() });
+        return { input, opening: { deployment: this.deploymentField, amount, ownerAx: owner.publicKey[0], ownerAy: owner.publicKey[1], spendSecret, salt, commitment, leafIndex }, newRoot, newIndex, statement };
+    }
+    agreementValues(agreement) {
+        const buyer = agreement.buyer.publicKey, seller = agreement.sellerPublicKey, paymentSalt = this.poseidonHash([2009n, this.deploymentField, agreement.settlementNonceLo, agreement.settlementNonceHi]);
+        const termsA = this.poseidonHash([2001n, this.deploymentField, agreement.dealId, agreement.revision, agreement.transcriptRootLo, agreement.transcriptRootHi]);
+        const termsB = this.poseidonHash([agreement.serviceDigestLo, agreement.serviceDigestHi, agreement.settlementNonceLo, agreement.settlementNonceHi, agreement.paymentAmount, agreement.expiry]);
+        const termsC = this.poseidonHash([buyer[0], buyer[1], seller[0], seller[1], agreement.recipientSpendTag, paymentSalt]);
+        return { paymentSalt, dealCommitment: this.poseidonHash([2002n, termsA, termsB, termsC, agreement.blinding, agreement.expiry]), dealNullifier: this.poseidonHash([2003n, this.deploymentField, buyer[0], buyer[1], agreement.settlementNonceLo, agreement.settlementNonceHi]) };
+    }
+    buildTransfer(leaves, inputNote, agreement, changeSpendSecret = scalar(), changeSalt = scalar()) {
+        if (agreement.paymentAmount <= 0n || agreement.paymentAmount >= inputNote.amount || agreement.expiry <= BigInt(Date.now()))
+            fail("AGREEMENT_INVALID", "agreement amount must leave positive change and expiry must be in the future");
+        const buyer = agreement.buyer.publicKey, seller = agreement.sellerPublicKey, { paymentSalt, dealCommitment, dealNullifier } = this.agreementValues(agreement);
+        const buyerSignature = this.sign(agreement.buyer, 2004n, dealCommitment);
+        const inputCommitment = this.noteCommitment(inputNote.amount, buyer, inputNote.spendSecret, inputNote.salt);
+        if (inputCommitment !== inputNote.commitment || leaves[Number(inputNote.leafIndex)] !== inputCommitment)
+            fail("INPUT_NOTE_MISMATCH", "input note opening does not match indexed leaf");
+        const inputNullifier = this.poseidonHash([2011n, this.deploymentField, inputNote.spendSecret, inputCommitment]);
+        const paymentCommitment = this.poseidonHash([2010n, this.deploymentField, agreement.paymentAmount, seller[0], seller[1], agreement.recipientSpendTag, paymentSalt]);
+        const changeAmount = inputNote.amount - agreement.paymentAmount, changeCommitment = this.noteCommitment(changeAmount, buyer, changeSpendSecret, changeSalt);
+        const oldTree = this.tree(leaves), oldRoot = oldTree.root, oldIndex = BigInt(leaves.length), afterPayment = this.tree([...leaves, paymentCommitment]), finalTree = this.tree([...leaves, paymentCommitment, changeCommitment]), newRoot = finalTree.root, newIndex = oldIndex + 2n;
+        const statement = Buffer.concat([this.header(2), fieldBytes(dealCommitment), fieldBytes(dealNullifier), fieldBytes(inputNullifier), fieldBytes(paymentCommitment), fieldBytes(changeCommitment), u64(agreement.expiry), fieldBytes(oldRoot), u64(oldIndex), fieldBytes(newRoot), u64(newIndex)]);
+        const input = asStrings({ statement: [...statement], ...digestInputs(statement), dealId: agreement.dealId, revision: agreement.revision, transcriptRootLo: agreement.transcriptRootLo, transcriptRootHi: agreement.transcriptRootHi, serviceDigestLo: agreement.serviceDigestLo, serviceDigestHi: agreement.serviceDigestHi, settlementNonceLo: agreement.settlementNonceLo, settlementNonceHi: agreement.settlementNonceHi, paymentAmount: agreement.paymentAmount, blinding: agreement.blinding, buyerAx: buyer[0], buyerAy: buyer[1], sellerAx: seller[0], sellerAy: seller[1], recipientSpendTag: agreement.recipientSpendTag, buyerR8x: buyerSignature.R8x, buyerR8y: buyerSignature.R8y, buyerS: buyerSignature.S, sellerR8x: agreement.sellerSignature.R8x, sellerR8y: agreement.sellerSignature.R8y, sellerS: agreement.sellerSignature.S, inputAmount: inputNote.amount, inputSalt: inputNote.salt, inputSpendSecret: inputNote.spendSecret, inputLeafIndex: inputNote.leafIndex, inputPath: oldTree.path(Number(inputNote.leafIndex)).siblings, changeAmount, changeSpendSecret, changeSalt, paymentAppendPath: oldTree.appendPath(), changeAppendPath: afterPayment.appendPath() });
+        return { input, statement, newRoot, newIndex, dealCommitment, dealNullifier, inputNullifier, paymentCommitment, changeCommitment, paymentSalt, changeOpening: { deployment: this.deploymentField, amount: changeAmount, ownerAx: buyer[0], ownerAy: buyer[1], spendSecret: changeSpendSecret, salt: changeSalt, commitment: changeCommitment, leafIndex: oldIndex + 1n } };
+    }
+    buildWithdraw(leaves, note, recipient) {
+        const address = Buffer.from(recipient.replace(/^0x/, ""), "hex");
+        if (address.length !== 32)
+            fail("RECIPIENT_INVALID", "withdrawal recipient must be a 32-byte Sui address");
+        const tree = this.tree(leaves), commitment = this.noteCommitment(note.amount, [note.ownerAx, note.ownerAy], note.spendSecret, note.salt);
+        if (commitment !== note.commitment || leaves[Number(note.leafIndex)] !== commitment)
+            fail("NOTE_RECOVERY_MISMATCH", "withdrawal opening does not match indexed leaf");
+        const noteNullifier = this.poseidonHash([2011n, this.deploymentField, note.spendSecret, commitment]);
+        const statement = Buffer.concat([this.header(3), fieldBytes(tree.root), fieldBytes(noteNullifier), address, u64(note.amount)]);
+        const input = asStrings({ statement: [...statement], ...digestInputs(statement), ownerAx: note.ownerAx, ownerAy: note.ownerAy, spendSecret: note.spendSecret, salt: note.salt, leafIndex: note.leafIndex, pathElements: tree.path(Number(note.leafIndex)).siblings });
+        return { input, statement, noteNullifier };
+    }
+    buildWithdrawV2(leaves, note, recipient, amount, exactExit = false, changeSpendSecret = scalar(), changeSalt = scalar()) {
+        if (this.deployment.verifierVersion !== 2)
+            fail("POOL_VERSION_INVALID", "v2 withdrawals require a v2 deployment");
+        if (amount <= 0n || amount > note.amount || (!exactExit && amount !== 1000000n))
+            fail("AMOUNT_INVALID", "standard exit is 1,000,000 MIST; an exact exit may reveal another amount");
+        if (!/^0x[0-9a-f]{64}$/i.test(recipient))
+            fail("RECIPIENT_INVALID", "withdrawal recipient must be a 32-byte Sui address");
+        const tree = this.tree(leaves), commitment = this.noteCommitment(note.amount, [note.ownerAx, note.ownerAy], note.spendSecret, note.salt);
+        if (commitment !== note.commitment || leaves[Number(note.leafIndex)] !== commitment)
+            fail("NOTE_RECOVERY_MISMATCH", "withdrawal opening does not match indexed leaf");
+        const changeAmount = note.amount - amount, leafIndex = BigInt(leaves.length);
+        const changeCommitment = this.noteCommitment(changeAmount, [note.ownerAx, note.ownerAy], changeSpendSecret, changeSalt);
+        const nextTree = this.tree([...leaves, changeCommitment]), newRoot = nextTree.root, newIndex = leafIndex + 1n;
+        const noteNullifier = this.poseidonHash([2011n, this.deploymentField, note.spendSecret, commitment]);
+        const address = Buffer.from(recipient.slice(2), "hex");
+        const statement = Buffer.concat([this.header(3), fieldBytes(tree.root), fieldBytes(noteNullifier), address, u64(amount), Buffer.from([Number(exactExit)]), fieldBytes(changeCommitment), u64(leafIndex), fieldBytes(newRoot), u64(newIndex)]);
+        const input = asStrings({ statement: [...statement], ...digestInputs(statement), ownerAx: note.ownerAx, ownerAy: note.ownerAy, inputAmount: note.amount, spendSecret: note.spendSecret, salt: note.salt, leafIndex: note.leafIndex, pathElements: tree.path(Number(note.leafIndex)).siblings, changeAmount, changeSpendSecret, changeSalt, appendSiblings: tree.appendPath() });
+        return { input, statement, noteNullifier, newRoot, newIndex, changeOpening: { deployment: this.deploymentField, amount: changeAmount, ownerAx: note.ownerAx, ownerAy: note.ownerAy, spendSecret: changeSpendSecret, salt: changeSalt, commitment: changeCommitment, leafIndex }, exactExit, amount };
+    }
+}

package/dist/prover.d.ts

@@ -0,0 +1,28 @@
+export type CircuitName = "deposit" | "transfer" | "withdraw";
+export interface ProverConfig {
+    artifactRoot: string;
+    snarkjsPath: string;
+    converterPath: string;
+    rapidsnarkPath?: string;
+    version?: 2;
+    expected: Record<CircuitName, {
+        zkeySha256: string;
+        verifyingKeySha256: string;
+    }>;
+}
+export interface ProofResult {
+    proof: Buffer;
+    publicInputs: Buffer;
+    engine: "rapidsnark" | "snarkjs";
+    proveMs: number;
+}
+export declare class Groth16Prover {
+    private readonly config;
+    constructor(config: ProverConfig);
+    private artifactName;
+    doctor(): {
+        rapidSnark: boolean;
+        artifacts: Record<CircuitName, string>;
+    };
+    prove(name: CircuitName, input: Record<string, unknown>): Promise<ProofResult>;
+}

package/dist/prover.js

@@ -0,0 +1,70 @@
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { accessSync, constants, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { promisify } from "node:util";
+import { fail } from "./errors.js";
+const run = promisify(execFile);
+const sha256 = (path) => createHash("sha256").update(readFileSync(path)).digest("hex");
+function executable(path) { try {
+    accessSync(path, constants.X_OK);
+    return true;
+}
+catch {
+    return false;
+} }
+export class Groth16Prover {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    artifactName(name) { return `${name}${this.config.version === 2 ? "_v2" : ""}`; }
+    doctor() {
+        const artifacts = {};
+        for (const name of ["deposit", "transfer", "withdraw"]) {
+            const artifact = this.artifactName(name);
+            const zkey = resolve(this.config.artifactRoot, `proofs/${artifact}/${artifact}.zkey`), vk = resolve(this.config.artifactRoot, `proofs/${artifact}/verifying-key.bin`), expected = this.config.expected[name];
+            if (!existsSync(zkey) || !existsSync(vk))
+                fail("PROVING_ARTIFACT_MISSING", `pinned ${name} artifacts are missing`);
+            if (sha256(zkey) !== expected.zkeySha256 || sha256(vk) !== expected.verifyingKeySha256)
+                fail("ARTIFACT_HASH_MISMATCH", `${name} artifact hash differs from deployment configuration`);
+            artifacts[name] = expected.zkeySha256;
+        }
+        if (!executable(this.config.snarkjsPath) || !executable(this.config.converterPath))
+            fail("PROVER_TOOL_MISSING", "SnarkJS or the Arkworks converter is not executable");
+        return { rapidSnark: Boolean(this.config.rapidsnarkPath && executable(this.config.rapidsnarkPath)), artifacts };
+    }
+    async prove(name, input) {
+        this.doctor();
+        const directory = mkdtempSync(join(tmpdir(), `supercuts-${name}-`));
+        try {
+            const artifact = this.artifactName(name);
+            const inputPath = join(directory, "input.json"), witness = join(directory, "witness.wtns"), proofJson = join(directory, "proof.json"), publicJson = join(directory, "public.json"), converted = join(directory, "converted");
+            writeFileSync(inputPath, JSON.stringify(input), { mode: 0o600 });
+            mkdirSync(converted, { mode: 0o700 });
+            const generator = resolve(this.config.artifactRoot, `${artifact}_js/generate_witness.js`), wasm = resolve(this.config.artifactRoot, `${artifact}_js/${artifact}.wasm`), zkey = resolve(this.config.artifactRoot, `proofs/${artifact}/${artifact}.zkey`), verificationKey = resolve(this.config.artifactRoot, `proofs/${artifact}/verification-key.json`);
+            if (![generator, wasm, verificationKey].every(existsSync))
+                fail("PROVING_ARTIFACT_MISSING", `${name} witness or verification artifacts are missing`);
+            await run(process.execPath, [generator, wasm, inputPath, witness], { timeout: 10 * 60_000, maxBuffer: 4 * 1024 * 1024 });
+            const useRapid = Boolean(this.config.rapidsnarkPath && executable(this.config.rapidsnarkPath)), started = Date.now();
+            if (useRapid)
+                await run(this.config.rapidsnarkPath, [zkey, witness, proofJson, publicJson], { timeout: 10 * 60_000, maxBuffer: 4 * 1024 * 1024 });
+            else
+                await run(this.config.snarkjsPath, ["groth16", "prove", zkey, witness, proofJson, publicJson], { timeout: 20 * 60_000, maxBuffer: 4 * 1024 * 1024 });
+            const proveMs = Date.now() - started;
+            await run(this.config.snarkjsPath, ["groth16", "verify", verificationKey, publicJson, proofJson], { timeout: 2 * 60_000, maxBuffer: 4 * 1024 * 1024 });
+            await run(this.config.converterPath, [name, verificationKey, proofJson, publicJson, converted], { timeout: 2 * 60_000, maxBuffer: 4 * 1024 * 1024 });
+            const preparedVk = join(converted, "verifying-key.bin");
+            if (sha256(preparedVk) !== this.config.expected[name].verifyingKeySha256)
+                fail("ARTIFACT_HASH_MISMATCH", "converter produced an unexpected verifying key");
+            const proof = readFileSync(join(converted, "proof.bin")), publicInputs = readFileSync(join(converted, "public-inputs.bin"));
+            if (!proof.length || publicInputs.length !== 64)
+                fail("PROOF_INVALID", "converted proof or public inputs have an invalid size");
+            return { proof, publicInputs, engine: useRapid ? "rapidsnark" : "snarkjs", proveMs };
+        }
+        finally {
+            rmSync(directory, { recursive: true, force: true });
+        }
+    }
+}

package/dist/relayer.d.ts

@@ -0,0 +1,32 @@
+import { RoleStore } from "./store.js";
+export interface RelayRequest {
+    operationId: string;
+    expiresAt: number;
+    nonce: string;
+    buyerAddress: string;
+    challengeSignature: string;
+    packageId: string;
+    poolId: string;
+    coinType: string;
+    functionName: "transfer_private";
+    publicStatement: Uint8Array;
+    proof: Uint8Array;
+    verifierVersion: number;
+}
+export interface RelayPin {
+    packageId: string;
+    poolId: string;
+    coinType: string;
+    verifierVersion: number;
+}
+export type ChallengeVerifier = (address: string, challenge: Uint8Array, signature: string) => Promise<boolean>;
+export type ProofVerifier = (statement: Uint8Array, proof: Uint8Array) => Promise<boolean>;
+export declare function relayChallenge(request: Omit<RelayRequest, "challengeSignature">): Uint8Array;
+export declare class RelayAdmission {
+    private readonly store;
+    private readonly pin;
+    private readonly verifyChallenge;
+    private readonly verifyProof;
+    constructor(store: RoleStore, pin: RelayPin, verifyChallenge: ChallengeVerifier, verifyProof: ProofVerifier);
+    admit(request: RelayRequest, now?: number): Promise<void>;
+}

package/dist/relayer.js

@@ -0,0 +1,43 @@
+import { createHash } from "node:crypto";
+import { fail } from "./errors.js";
+export function relayChallenge(request) {
+    const lengths = Buffer.alloc(8);
+    lengths.writeUInt32BE(request.publicStatement.length);
+    lengths.writeUInt32BE(request.proof.length, 4);
+    return Buffer.from(JSON.stringify({
+        domain: "supercuts-relay-v1", operationId: request.operationId, expiresAt: request.expiresAt, nonce: request.nonce,
+        buyerAddress: request.buyerAddress, packageId: request.packageId, poolId: request.poolId, coinType: request.coinType,
+        functionName: request.functionName, verifierVersion: request.verifierVersion,
+        payloadHash: createHash("sha256").update(lengths).update(request.publicStatement).update(request.proof).digest("hex"),
+    }));
+}
+export class RelayAdmission {
+    store;
+    pin;
+    verifyChallenge;
+    verifyProof;
+    constructor(store, pin, verifyChallenge, verifyProof) {
+        this.store = store;
+        this.pin = pin;
+        this.verifyChallenge = verifyChallenge;
+        this.verifyProof = verifyProof;
+    }
+    async admit(request, now = Date.now()) {
+        if (!request.operationId || !request.nonce || !request.buyerAddress || request.operationId.length > 256 || request.nonce.length > 256)
+            fail("RELAY_CHALLENGE_INVALID", "relay challenge identity is missing or too long");
+        if (!Number.isSafeInteger(request.expiresAt) || request.expiresAt - now > 10 * 60_000)
+            fail("RELAY_CHALLENGE_INVALID", "relay challenge expiry is invalid or too far in the future");
+        if (!request.publicStatement.length || request.publicStatement.length > 4096 || !request.proof.length || request.proof.length > 4096)
+            fail("RELAY_PAYLOAD_INVALID", "relay proof or statement size is invalid");
+        if (request.expiresAt <= now)
+            fail("RELAY_CHALLENGE_EXPIRED", "relay challenge has expired");
+        if (request.packageId !== this.pin.packageId || request.poolId !== this.pin.poolId || request.coinType !== this.pin.coinType || request.verifierVersion !== this.pin.verifierVersion || request.functionName !== "transfer_private")
+            fail("RELAY_TARGET_REJECTED", "relay request does not target the pinned pool function and verifier");
+        if (!(await this.verifyChallenge(request.buyerAddress, relayChallenge(request), request.challengeSignature)))
+            fail("RELAY_SIGNATURE_INVALID", "relay challenge signature is invalid");
+        if (!(await this.verifyProof(request.publicStatement, request.proof)))
+            fail("RELAY_PROOF_INVALID", "proof does not verify against its public statement");
+        if (!this.store.claimOnce("relay-nonce", `${request.buyerAddress}:${request.nonce}`, request.operationId))
+            fail("RELAY_REPLAY", "relay challenge nonce was already consumed");
+    }
+}

package/dist/remote-buyer.d.ts

@@ -0,0 +1,67 @@
+import { type CapabilityManifest } from "./capability.js";
+import { type AgentMandate } from "./mandate.js";
+import type { Phase3App } from "./phase3.js";
+interface Entry {
+    manifest: CapabilityManifest;
+    blobId: string;
+    signature: string;
+    transportPublicKey: string;
+    preview: Record<string, unknown>;
+}
+export declare class RemoteBuyer {
+    #private;
+    private readonly app;
+    private readonly mandate;
+    private readonly http;
+    constructor(app: Phase3App, mandate: AgentMandate, origin: string, http?: typeof fetch);
+    private request;
+    catalog(): Promise<{
+        capabilities: Entry[];
+    }>;
+    rankBriefs(input: {
+        budget: string;
+        topic: string;
+    }): Promise<Record<string, unknown>>;
+    negotiate(input: {
+        capabilityId: string;
+        sessionId: string;
+        runId: string;
+        task: string;
+        opening: string;
+        maximum: string;
+        briefHash?: string;
+    }): Promise<Record<string, unknown>>;
+    quote(input: {
+        capabilityId: string;
+        operationId: string;
+        requestId: string;
+        runId: string;
+        task: string;
+        briefHash?: string;
+    }): Promise<Record<string, unknown>>;
+    purchaseBrief(input: {
+        capabilityId: string;
+        operationId: string;
+        requestId: string;
+        runId: string;
+        task: string;
+        budget: string;
+    }): Promise<Record<string, unknown>>;
+    agreement(input: {
+        capabilityId: string;
+        operationId: string;
+        sessionId: string;
+        runId: string;
+        briefHash: string;
+    }): Promise<Record<string, unknown>>;
+    settleAnalysis(input: {
+        sessionId: string;
+        operationId: string;
+    }): Promise<Record<string, unknown>>;
+    delivery(input: {
+        sessionId: string;
+        operationId: string;
+    }): Promise<Record<string, unknown>>;
+    events(runId: string): Promise<Record<string, unknown>>;
+}
+export {};