@tangle-network/starter-foundry 0.5.3 → 0.7.0

package/registry/layers/capability/stripe-metered/manifest.json

@@ -0,0 +1,35 @@
+{
+  "id": "stripe-metered",
+  "description": "Stripe usage-based billing via Billing Meters — report events as they happen, Stripe aggregates and bills on your cadence. For AI products (tokens consumed), API businesses (requests), storage/compute products (GB-hours).",
+  "appliesTo": [
+    "nextjs-ts",
+    "fullstack-ts",
+    "api-service",
+    "bun-http",
+    "deno-edge"
+  ],
+  "files": [
+    {
+      "source": "files/metered.ts",
+      "target": "lib/stripe-metered.ts"
+    }
+  ],
+  "packageDeps": {
+    "dependencies": {
+      "stripe": "^17.0.0"
+    }
+  },
+  "keywords": [
+    "stripe metered",
+    "usage-based billing",
+    "per-token billing",
+    "per-request billing",
+    "billing meters",
+    "pay-as-you-go",
+    "consumption billing",
+    "metered usage"
+  ],
+  "buildHints": {
+    "whenToUse": "Attach for products that bill on consumption rather than flat tiers. Report events via stripe.billing.meterEvents.create — Stripe aggregates and bills on the cycle you configured in the meter definition."
+  }
+}

package/registry/layers/capability/tailwind/manifest.json

@@ -12,8 +12,20 @@
     "frontend-static",
     "browser-extension-ts",
     "electron-desktop-ts",
-    "tauri-desktop"
+    "tauri-desktop",
+    "electron-native-os",
+    "multimodal-agent",
+    "vision-first-agent",
+    "voice-first-agent",
+    "realtime-audio-ts",
+    "astro-static"
   ],
+  "packageDeps": {
+    "dependencies": {
+      "@tailwindcss/vite": "^4.0.0",
+      "tailwindcss": "^4.0.0"
+    }
+  },
   "files": [
     {
       "source": "files/tailwind-config.json",

package/registry/layers/capability/tangle-gpu-provider/files/gpu-config.json

@@ -0,0 +1,14 @@
+{
+  "required": {
+    "minVramGb": 16,
+    "minComputeCapability": "7.5",
+    "minGpuCount": 1,
+    "preferred": ["A100", "H100", "L40S", "A10"],
+    "fallbackAllowed": true
+  },
+  "notes": [
+    "Compute capability 7.5 = Turing (T4, RTX 20). 8.0+ = Ampere+ (A100, A10).",
+    "For bfloat16 models, require compute capability >= 8.0.",
+    "For fp8 training/inference, require H100/H200 (9.0+)."
+  ]
+}

package/registry/layers/capability/tangle-gpu-provider/manifest.json

@@ -0,0 +1,34 @@
+{
+  "id": "tangle-gpu-provider",
+  "description": "GPU blueprint capability — operators declare GPU resource requirements (CUDA compute capability, VRAM, count). Jobs run on GPU-enabled operators; non-GPU operators skip the job. Apply to tangle-blueprint for ML-inference, 3D rendering, video encoding, and scientific-compute blueprints.",
+  "appliesTo": ["tangle-blueprint"],
+  "files": [
+    {
+      "source": "files/gpu-config.json",
+      "target": "gpu-config.json"
+    }
+  ],
+  "keywords": [
+    "gpu blueprint",
+    "gpu operator",
+    "gpu-accelerated",
+    "gpu accelerated",
+    "cuda",
+    "h100",
+    "a100",
+    "l40s",
+    "ml inference",
+    "gpu job",
+    "hardware-accelerated",
+    "video encoding",
+    "rendering blueprint"
+  ],
+  "buildHints": {
+    "whenToUse": "Attach when the job requires GPU acceleration — inference serving, video encoding, rendering, physics simulation, scientific workloads.",
+    "firstSteps": [
+      "Declare required compute capability + VRAM in gpu-config.json",
+      "Operators advertise GPU capacity via their operator registration",
+      "Your job's execution matches on capacity at dispatch time"
+    ]
+  }
+}

package/registry/layers/capability/tangle-mpp/files/mpp-config.json

@@ -0,0 +1,18 @@
+{
+  "budget": {
+    "principalAddressEnv": "MPP_PRINCIPAL_ADDRESS",
+    "maxPerCallUsdCents": 25,
+    "maxPerDelegationUsdCents": 1000,
+    "delegationTtlSeconds": 3600
+  },
+  "delegation": {
+    "tokenScheme": "signed-jwt",
+    "publicKeyEnv": "MPP_PRINCIPAL_PUBLIC_KEY"
+  },
+  "attestation": {
+    "includeInResponse": true,
+    "fields": ["principal", "delegate", "amountUsdCents", "timestamp", "signature"]
+  },
+  "settlementChain": "base",
+  "stablecoin": "USDC"
+}

package/registry/layers/capability/tangle-mpp/manifest.json

@@ -0,0 +1,30 @@
+{
+  "id": "tangle-mpp",
+  "description": "MPP (Machine Payments Protocol) capability for tangle-blueprint — agent-to-agent payment rails with delegation, budget caps, and spend attestations. For blueprints that autonomous agents call on each other's behalf, enabling agent economies.",
+  "appliesTo": ["tangle-blueprint", "x402-service", "agent-service-ts", "agent-service-py", "agent-service-rust", "agent-swarm-ts"],
+  "files": [
+    {
+      "source": "files/mpp-config.json",
+      "target": "mpp-config.json"
+    }
+  ],
+  "keywords": [
+    "mpp",
+    "machine payments protocol",
+    "agent-to-agent payments",
+    "a2a payments",
+    "agent delegation payments",
+    "budget cap",
+    "agent wallet",
+    "autonomous agent economy",
+    "spend attestation"
+  ],
+  "buildHints": {
+    "whenToUse": "Attach when blueprints or agents pay OTHER agents. MPP adds delegation (agent A authorizes agent B to spend up to $X), budget caps, and spend attestations so the caller can prove what was spent on their behalf.",
+    "firstSteps": [
+      "Configure the budget cap schedule in mpp-config.json",
+      "Delegation tokens are minted at delegate-time (signed by the principal)",
+      "Each call burns a portion of the budget; the attestation is returned in the response"
+    ]
+  }
+}

package/registry/layers/capability/tangle-remote-provider/files/remote-config.json

@@ -0,0 +1,28 @@
+{
+  "providers": [
+    {
+      "id": "openai",
+      "baseUrl": "https://api.openai.com/v1",
+      "credentialKey": "OPENAI_API_KEY",
+      "rateLimit": { "rpm": 500, "tpm": 90000 }
+    },
+    {
+      "id": "anthropic",
+      "baseUrl": "https://api.anthropic.com/v1",
+      "credentialKey": "ANTHROPIC_API_KEY",
+      "rateLimit": { "rpm": 4000, "tpm": 400000 }
+    },
+    {
+      "id": "router-tangle",
+      "baseUrl": "https://router.tangle.tools",
+      "credentialKey": "TANGLE_ROUTER_API_KEY",
+      "note": "Tangle's own router — prefer this so billing + observability stays inside the platform."
+    }
+  ],
+  "retry": {
+    "maxAttempts": 3,
+    "backoffMs": 500,
+    "backoffFactor": 2,
+    "jitterMs": 100
+  }
+}

package/registry/layers/capability/tangle-remote-provider/manifest.json

@@ -0,0 +1,29 @@
+{
+  "id": "tangle-remote-provider",
+  "description": "Remote provider blueprint capability — the blueprint calls out to external services (LLM providers, RPC endpoints, SaaS APIs) with credential injection + rate-limit handling. Apply when the operator's job is effectively a thin wrapper around a third-party API.",
+  "appliesTo": ["tangle-blueprint"],
+  "files": [
+    {
+      "source": "files/remote-config.json",
+      "target": "remote-config.json"
+    }
+  ],
+  "keywords": [
+    "remote provider",
+    "external api blueprint",
+    "llm provider",
+    "saas blueprint",
+    "third-party api job",
+    "api proxy blueprint",
+    "openai blueprint",
+    "anthropic blueprint"
+  ],
+  "buildHints": {
+    "whenToUse": "Attach when the job's body is a single outbound HTTP request. Operators inject their own credentials and rate-limit state; Tangle handles scheduling + billing.",
+    "firstSteps": [
+      "Declare the endpoint + method in remote-config.json",
+      "Secrets pulled from the operator's keystore at dispatch (never in the blueprint source)",
+      "Wrap the call in a retry/backoff helper — network errors are the dominant failure mode"
+    ]
+  }
+}

package/registry/layers/capability/tangle-tee/files/tee-config.json

@@ -0,0 +1,20 @@
+{
+  "backend": "phala-dstack",
+  "backends": {
+    "intel-tdx": {
+      "docs": "https://www.intel.com/content/www/us/en/developer/tools/trust-domain-extensions/overview.html",
+      "attestation": "DCAP quote",
+      "verifier": "intel-trust-authority or local DCAP verifier"
+    },
+    "aws-nitro": {
+      "docs": "https://docs.aws.amazon.com/enclaves/latest/user/",
+      "attestation": "NSM attestation document (signed COSE)",
+      "verifier": "AWS root CA chain"
+    },
+    "phala-dstack": {
+      "docs": "https://docs.phala.network/dstack",
+      "attestation": "dstack-guest-agent quote",
+      "verifier": "dstack-attestation-verifier"
+    }
+  }
+}

package/registry/layers/capability/tangle-tee/manifest.json

@@ -0,0 +1,31 @@
+{
+  "id": "tangle-tee",
+  "description": "TEE (Trusted Execution Environment) blueprint capability — operators run jobs inside an enclave (Intel TDX / AWS Nitro / Phala dStack) and produce a remote-attestation-backed proof. Apply to tangle-blueprint for private-compute, confidential data processing, or regulated workload jobs.",
+  "appliesTo": ["tangle-blueprint"],
+  "files": [
+    {
+      "source": "files/tee-config.json",
+      "target": "tee-config.json"
+    }
+  ],
+  "keywords": [
+    "tee",
+    "trusted execution environment",
+    "enclave",
+    "intel tdx",
+    "aws nitro enclave",
+    "phala dstack",
+    "confidential compute",
+    "remote attestation",
+    "private compute blueprint",
+    "confidential job"
+  ],
+  "buildHints": {
+    "whenToUse": "Attach when the blueprint must run in an enclave — handling private keys, regulated PII, or producing attested outputs for downstream trust.",
+    "firstSteps": [
+      "Pick a backend in tee-config.json (intel-tdx | aws-nitro | phala-dstack)",
+      "Wire the attestation verifier in your job's verify_result.rs",
+      "Emit the RA quote alongside the job output"
+    ]
+  }
+}

package/registry/layers/capability/tangle-x402/files/x402-config.json

@@ -0,0 +1,11 @@
+{
+  "pricing": {
+    "perCallUsdCents": 5,
+    "currency": "USDC",
+    "settlementChain": "base"
+  },
+  "acceptedStablecoins": ["USDC", "USDT"],
+  "discoveryHeader": "X-Payment-Accepted",
+  "paymentHeader": "X-Payment",
+  "docs": "https://x402.org/"
+}

package/registry/layers/capability/tangle-x402/manifest.json

@@ -0,0 +1,24 @@
+{
+  "id": "tangle-x402",
+  "description": "x402 payments capability for tangle-blueprint — each job dispatch carries an x402 payment, operators verify signature + amount before executing. For pay-per-execution blueprints where the caller (agent or human) pays per job.",
+  "appliesTo": ["tangle-blueprint", "x402-service"],
+  "files": [
+    {
+      "source": "files/x402-config.json",
+      "target": "x402-config.json"
+    }
+  ],
+  "keywords": [
+    "x402",
+    "x402 payment",
+    "pay per execution",
+    "paid blueprint",
+    "per-call payment blueprint",
+    "agent payment",
+    "402 payment required",
+    "micropayment blueprint"
+  ],
+  "buildHints": {
+    "whenToUse": "Attach when the blueprint's service is directly priced per-call. Caller signs an x402 payment; the operator verifies before entering the job body."
+  }
+}

package/registry/layers/capability/webhook-processor/manifest.json

@@ -44,24 +44,20 @@
       "/api/webhooks",
       "/api/webhooks/[provider]"
     ],
-    "architecture": [
-      "webhook-handler.ts → verifySignature(provider, payload, signature, secret) with timing-safe HMAC comparison",
-      "webhook-router.ts → createWebhookRouter({ providers }) returns async (req) => response, matches provider by signature header presence",
-      "webhook-queue.ts → createWebhookQueue() for idempotent dedup + retry with exponential backoff"
-    ],
-    "supportedProviders": [
-      "Stripe (t=/v1= timestamp+signature format)",
-      "GitHub (sha256= prefixed HMAC)",
-      "Generic (raw hex HMAC-SHA256)"
-    ],
     "dataModels": [
       "WebhookEvent { id, provider, type, payload, receivedAt }",
       "QueuedEvent { id, payload, state, attempts, lastError }"
     ],
-    "productionNotes": [
-      "webhook-queue uses in-memory Map — replace with Redis/BullMQ for durable processing",
-      "Add persistent event log (Postgres/DynamoDB) for audit trail",
-      "webhook-config.json secrets should come from environment variables, not the config file"
+    "architectureNotes": [
+      "architecture: webhook-handler.ts \u2192 verifySignature(provider, payload, signature, secret) with timing-safe HMAC comparison",
+      "architecture: webhook-router.ts \u2192 createWebhookRouter({ providers }) returns async (req) => response, matches provider by signature header presence",
+      "architecture: webhook-queue.ts \u2192 createWebhookQueue() for idempotent dedup + retry with exponential backoff",
+      "supportedProviders: Stripe (t=/v1= timestamp+signature format)",
+      "supportedProviders: GitHub (sha256= prefixed HMAC)",
+      "supportedProviders: Generic (raw hex HMAC-SHA256)",
+      "productionNotes: webhook-queue uses in-memory Map \u2014 replace with Redis/BullMQ for durable processing",
+      "productionNotes: Add persistent event log (Postgres/DynamoDB) for audit trail",
+      "productionNotes: webhook-config.json secrets should come from environment variables, not the config file"
     ]
   }
 }

package/registry/layers/capability/webrtc/manifest.json

@@ -2,23 +2,67 @@
   "id": "webrtc",
   "description": "Adds WebRTC video/voice calling with room management, screen sharing, and participant grid.",
   "group": "capability",
-  "appliesTo": ["nextjs-ts", "react-vite-ts", "fullstack-ts", "remix-ts"],
-  "keywords": ["webrtc", "video call", "voice call", "video chat", "screen sharing", "video conference", "peer to peer", "livekit", "daily", "huddle", "zoom clone", "google meet"],
+  "appliesTo": [
+    "nextjs-ts",
+    "react-vite-ts",
+    "fullstack-ts",
+    "remix-ts"
+  ],
+  "keywords": [
+    "webrtc",
+    "video call",
+    "voice call",
+    "video chat",
+    "screen sharing",
+    "video conference",
+    "peer to peer",
+    "livekit",
+    "daily",
+    "huddle",
+    "zoom clone",
+    "google meet"
+  ],
   "files": [
-    { "source": "files/webrtc-config.json", "target": "webrtc-config.json" },
-    { "source": "files/video-room.tsx", "target": "src/components/webrtc/video-room.tsx" },
-    { "source": "files/participant-tile.tsx", "target": "src/components/webrtc/participant-tile.tsx" },
-    { "source": "files/call-controls.tsx", "target": "src/components/webrtc/call-controls.tsx" }
+    {
+      "source": "files/webrtc-config.json",
+      "target": "webrtc-config.json"
+    },
+    {
+      "source": "files/video-room.tsx",
+      "target": "src/components/webrtc/video-room.tsx"
+    },
+    {
+      "source": "files/participant-tile.tsx",
+      "target": "src/components/webrtc/participant-tile.tsx"
+    },
+    {
+      "source": "files/call-controls.tsx",
+      "target": "src/components/webrtc/call-controls.tsx"
+    }
   ],
   "defaults": {
     "signalingUrl": "ws://localhost:7880",
     "maxParticipants": 12
   },
   "buildHints": {
-    "pages": ["/room", "/room/[id]"],
-    "apiRoutes": ["/api/room/create", "/api/room/token"],
-    "components": ["VideoRoom", "ParticipantTile", "CallControls", "ScreenShareView"],
-    "integrations": ["LiveKit or Daily.co for SFU signaling", "STUN/TURN for NAT traversal"],
+    "pages": [
+      "/room",
+      "/room/[id]"
+    ],
+    "apiRoutes": [
+      "/api/room/create",
+      "/api/room/token"
+    ],
+    "components": [
+      "VideoRoom",
+      "ParticipantTile",
+      "CallControls",
+      "ScreenShareView"
+    ],
+    "integrations": [
+      "LiveKit or Daily.co for SFU signaling",
+      "STUN/TURN for NAT traversal"
+    ],
     "architectureNotes": [
       "VideoRoom manages local/remote media streams and participant grid layout.",
       "CallControls provides mute/unmute, camera toggle, screen share, and leave buttons.",
@@ -26,5 +70,30 @@
       "Wire /api/room/token to generate room access tokens from your signaling provider.",
       "For production, use LiveKit Cloud or self-hosted LiveKit server."
     ]
+  },
+  "tieredKeywords": {
+    "archetypes": [
+      "video consultation",
+      "video consultations",
+      "video rooms",
+      "video room",
+      "video call",
+      "video calls",
+      "video updates",
+      "video conferencing",
+      "video conference",
+      "virtual co-working",
+      "virtual coworking",
+      "low-latency audio",
+      "persistent video",
+      "video tutoring",
+      "async video",
+      "screen sharing",
+      "shared whiteboard",
+      "telehealth",
+      "livekit",
+      "peer-to-peer",
+      "jam session"
+    ]
   }
 }

package/registry/layers/capability/zk-browser/files/mixer-deposit-panel.tsx

@@ -0,0 +1,64 @@
+import { useState } from 'react'
+import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
+import { Button } from '@/components/ui/button'
+import { Input } from '@/components/ui/input'
+import { Download, Shield, Loader2 } from 'lucide-react'
+import { downloadNote, generateNote, type MixerNote } from '@/lib/mixer-note'
+
+export function MixerDepositPanel({ onDeposit }: { onDeposit?: (note: MixerNote) => Promise<void> | void }) {
+  const [amount, setAmount] = useState('0.1')
+  const [note, setNote] = useState<MixerNote | null>(null)
+  const [busy, setBusy] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  const handleDeposit = async () => {
+    setError(null)
+    setBusy(true)
+    try {
+      const fresh = await generateNote()
+      setNote(fresh)
+      if (onDeposit) await onDeposit(fresh)
+    } catch (err) {
+      setError(err instanceof Error ? err.message : 'deposit failed')
+    } finally {
+      setBusy(false)
+    }
+  }
+
+  return (
+    <Card className="w-full max-w-md">
+      <CardHeader>
+        <CardTitle className="flex items-center gap-2 text-lg">
+          <Shield className="h-5 w-5" />
+          Deposit
+        </CardTitle>
+      </CardHeader>
+      <CardContent className="space-y-4">
+        <div className="space-y-1.5">
+          <label className="text-xs text-muted-foreground">Amount</label>
+          <Input type="number" value={amount} onChange={(e) => setAmount(e.target.value)} placeholder="0.1" />
+        </div>
+        <Button onClick={handleDeposit} disabled={busy} className="w-full">
+          {busy ? <Loader2 className="mr-2 h-4 w-4 animate-spin" /> : null}
+          {busy ? 'Generating commitment…' : 'Generate commitment + deposit'}
+        </Button>
+        {error ? <p className="text-sm text-destructive">{error}</p> : null}
+        {note ? (
+          <div className="space-y-2 rounded-lg border p-3 text-xs">
+            <div className="font-medium">Note ready — save it to withdraw later</div>
+            <div className="break-all">
+              <span className="text-muted-foreground">commitment:</span> {note.commitment.slice(0, 16)}…
+            </div>
+            <div className="break-all">
+              <span className="text-muted-foreground">nullifier hash:</span> {note.nullifierHash.slice(0, 16)}…
+            </div>
+            <Button size="sm" variant="outline" onClick={() => downloadNote(note)} className="w-full">
+              <Download className="mr-2 h-3.5 w-3.5" />
+              Download note ({amount})
+            </Button>
+          </div>
+        ) : null}
+      </CardContent>
+    </Card>
+  )
+}

package/registry/layers/capability/zk-browser/files/mixer-merkle-panel.tsx

@@ -0,0 +1,41 @@
+import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
+import { GitBranch } from 'lucide-react'
+
+export function MixerMerklePanel({
+  root,
+  treeSize,
+  height,
+}: {
+  root?: string
+  treeSize?: number
+  height?: number
+}) {
+  return (
+    <Card className="w-full max-w-md">
+      <CardHeader>
+        <CardTitle className="flex items-center gap-2 text-lg">
+          <GitBranch className="h-5 w-5" />
+          Merkle State
+        </CardTitle>
+      </CardHeader>
+      <CardContent className="space-y-3 text-sm">
+        <div className="space-y-1">
+          <div className="text-xs text-muted-foreground">Root</div>
+          <div className="break-all rounded border bg-muted/30 p-2 font-mono text-xs">
+            {root ?? '— (no deposits yet)'}
+          </div>
+        </div>
+        <div className="grid grid-cols-2 gap-4">
+          <div>
+            <div className="text-xs text-muted-foreground">Deposits</div>
+            <div className="text-lg font-medium">{treeSize ?? 0}</div>
+          </div>
+          <div>
+            <div className="text-xs text-muted-foreground">Height</div>
+            <div className="text-lg font-medium">{height ?? 20}</div>
+          </div>
+        </div>
+      </CardContent>
+    </Card>
+  )
+}

package/registry/layers/capability/zk-browser/files/mixer-note.ts

@@ -0,0 +1,90 @@
+// Mixer note helpers — serialize a (commitment, nullifier, secret) tuple
+// into a downloadable JSON blob the user saves after deposit and re-uploads
+// at withdraw. Commitment + nullifier hash go on-chain; the nullifier
+// preimage + secret stay in the user's possession as the "note".
+
+import { poseidonHash } from './zkproof'
+
+export interface MixerNote {
+  version: 1
+  nullifier: string
+  secret: string
+  commitment: string
+  nullifierHash: string
+  createdAt: number
+}
+
+/**
+ * Generate a fresh note. The caller deposits `commitment` on-chain and keeps
+ * `nullifier + secret` private. At withdraw time, the user supplies the
+ * note back to the circuit which proves knowledge of (nullifier, secret)
+ * such that Poseidon(nullifier, secret) === commitment.
+ */
+export async function generateNote(): Promise<MixerNote> {
+  const nullifier = randomFieldElement()
+  const secret = randomFieldElement()
+  const commitment = (await poseidonHash([BigInt(nullifier), BigInt(secret)])).toString()
+  const nullifierHash = (await poseidonHash([BigInt(nullifier)])).toString()
+  return {
+    version: 1,
+    nullifier,
+    secret,
+    commitment,
+    nullifierHash,
+    createdAt: Date.now(),
+  }
+}
+
+/** Recompute commitment from a note and verify it matches. */
+export async function verifyNote(note: MixerNote): Promise<boolean> {
+  if (note.version !== 1) return false
+  try {
+    const commitment = (await poseidonHash([BigInt(note.nullifier), BigInt(note.secret)])).toString()
+    const nullifierHash = (await poseidonHash([BigInt(note.nullifier)])).toString()
+    return commitment === note.commitment && nullifierHash === note.nullifierHash
+  } catch {
+    return false
+  }
+}
+
+export function serializeNote(note: MixerNote): string {
+  return JSON.stringify(note, null, 2)
+}
+
+export function parseNote(raw: string): MixerNote | null {
+  try {
+    const parsed = JSON.parse(raw)
+    if (typeof parsed?.nullifier !== 'string' || typeof parsed?.secret !== 'string') return null
+    if (typeof parsed?.commitment !== 'string') return null
+    return parsed as MixerNote
+  } catch {
+    return null
+  }
+}
+
+export function downloadNote(note: MixerNote, filename = `mixer-note-${note.createdAt}.json`): void {
+  const blob = new Blob([serializeNote(note)], { type: 'application/json' })
+  const url = URL.createObjectURL(blob)
+  const link = document.createElement('a')
+  link.href = url
+  link.download = filename
+  document.body.appendChild(link)
+  link.click()
+  document.body.removeChild(link)
+  URL.revokeObjectURL(url)
+}
+
+// Cryptographically random 254-bit field element (< BN254 prime). Values
+// above the prime are rejected and retried — a rare branch (<6% probability).
+const BN254_PRIME = BigInt('21888242871839275222246405745257275088548364400416034343698204186575808495617')
+
+function randomFieldElement(): string {
+  const bytes = new Uint8Array(32)
+  for (;;) {
+    crypto.getRandomValues(bytes)
+    bytes[0] &= 0x3f
+    let value = 0n
+    for (const byte of bytes) value = (value << 8n) | BigInt(byte)
+    if (value < BN254_PRIME) return value.toString()
+  }
+}