@voter-protocol/noir-prover 0.1.4 → 0.2.0

package/dist/index.cjs

@@ -2352,116 +2352,316 @@ ieee754.write = function (buffer, value, offset, isLE, mLen, nBytes) {
 	} 
 } (buffer));
 
-const noir_version = "1.0.0-beta.16+2d46fca7203545cbbfb31a0d0328de6c10a8db95";
-const hash = "7475465969754700296";
-const abi = {
+const DEFAULT_CIRCUIT_DEPTH = 20;
+const PUBLIC_INPUT_COUNT = 5;
+function validateAuthorityLevel(level) {
+  if (level < 1 || level > 5 || !Number.isInteger(level)) {
+    throw new Error(`Invalid authority level: ${level}. Must be integer 1-5.`);
+  }
+  return level;
+}
+const DISTRICT_SLOT_COUNT = 24;
+const TWO_TREE_PUBLIC_INPUT_COUNT = 29;
+
+const circuitLoaders = {
+  18: async () => {
+    const module = await Promise.resolve().then(() => require('./district_membership_18-DSj7IJGE.cjs'));
+    return module.default;
+  },
+  20: async () => {
+    const module = await Promise.resolve().then(() => require('./district_membership_20-DKRyEvX4.cjs'));
+    return module.default;
+  },
+  22: async () => {
+    const module = await Promise.resolve().then(() => require('./district_membership_22-pal861Dz.cjs'));
+    return module.default;
+  },
+  24: async () => {
+    const module = await Promise.resolve().then(() => require('./district_membership_24-BAJ-CEhq.cjs'));
+    return module.default;
+  }
+};
+function detectThreads$1() {
+  const hasSharedArrayBuffer = typeof SharedArrayBuffer !== "undefined";
+  if (!hasSharedArrayBuffer) {
+    console.log("[NoirProver] SharedArrayBuffer unavailable - using single-threaded mode");
+    return 1;
+  }
+  const cores = typeof navigator !== "undefined" ? navigator.hardwareConcurrency || 4 : 4;
+  return Math.min(cores, 8);
+}
+class NoirProver {
+  backend = null;
+  noir = null;
+  config;
+  threads;
+  depth;
+  constructor(config = {}) {
+    this.config = {
+      circuitName: "district_membership",
+      ...config
+    };
+    this.threads = config.threads ?? detectThreads$1();
+    this.depth = config.depth ?? DEFAULT_CIRCUIT_DEPTH;
+  }
+  /**
+   * Initialize the prover (must be called before generating proofs)
+   * Lazily loads the circuit for the configured depth
+   */
+  async init() {
+    if (this.backend && this.noir) return;
+    console.log(`[NoirProver] Initializing depth=${this.depth} with ${this.threads} thread(s)...`);
+    const start = Date.now();
+    const loader = circuitLoaders[this.depth];
+    if (!loader) {
+      throw new Error(`Unsupported circuit depth: ${this.depth}. Must be 18, 20, 22, or 24.`);
+    }
+    const circuit = await loader();
+    this.noir = new noir_js.Noir(circuit);
+    this.backend = new bb_js.UltraHonkBackend(circuit.bytecode, { threads: this.threads });
+    console.log(`[NoirProver] Initialized depth=${this.depth} in ${Date.now() - start}ms (${this.threads} threads)`);
+  }
+  /**
+   * Get the circuit depth for this prover instance
+   */
+  getDepth() {
+    return this.depth;
+  }
+  /**
+   * Pre-warm the prover by initializing backend
+   * Call this on app load to hide latency from user
+   */
+  async warmup() {
+    await this.init();
+    console.log("[NoirProver] Warmup complete (backend initialized)");
+  }
+  /** Maximum allowed Merkle depth (prevents DoS via oversized arrays) */
+  static MAX_MERKLE_DEPTH = 24;
+  /**
+   * Generate a ZK proof for district membership
+   *
+   * The new secure circuit computes leaf and nullifier internally:
+   * - leaf = hash(userSecret, districtId, authorityLevel, registrationSalt)
+   * - nullifier = hash(userSecret, actionDomain)
+   *
+   * This prevents attackers from submitting arbitrary leaves or nullifiers.
+   */
+  async prove(inputs) {
+    await this.init();
+    if (!Array.isArray(inputs.merklePath)) {
+      throw new Error("merklePath must be an array");
+    }
+    if (inputs.merklePath.length > NoirProver.MAX_MERKLE_DEPTH) {
+      throw new Error(
+        `merklePath exceeds maximum allowed depth: ${inputs.merklePath.length} > ${NoirProver.MAX_MERKLE_DEPTH}`
+      );
+    }
+    if (inputs.merklePath.length !== this.depth) {
+      throw new Error(
+        `merklePath length mismatch: expected ${this.depth}, got ${inputs.merklePath.length}. Did you initialize the prover with the wrong depth?`
+      );
+    }
+    validateAuthorityLevel(inputs.authorityLevel);
+    console.log("[NoirProver] Generating witness...");
+    const witnessStart = Date.now();
+    const noirInputs = {
+      // Public inputs (contract-controlled)
+      merkle_root: inputs.merkleRoot,
+      action_domain: inputs.actionDomain,
+      // Private inputs (user secrets - never revealed)
+      user_secret: inputs.userSecret,
+      district_id: inputs.districtId,
+      authority_level: inputs.authorityLevel.toString(),
+      registration_salt: inputs.registrationSalt,
+      // Merkle proof data
+      merkle_path: inputs.merklePath,
+      leaf_index: inputs.leafIndex
+    };
+    const { witness } = await this.noir.execute(noirInputs);
+    console.log(`[NoirProver] Witness generated in ${Date.now() - witnessStart}ms`);
+    console.log("[NoirProver] Generating proof...");
+    const proofStart = Date.now();
+    const { proof, publicInputs } = await this.backend.generateProof(witness);
+    console.log(`[NoirProver] Proof generated in ${Date.now() - proofStart}ms`);
+    if (publicInputs.length !== PUBLIC_INPUT_COUNT) {
+      throw new Error(
+        `Expected ${PUBLIC_INPUT_COUNT} public inputs from circuit, got ${publicInputs.length}`
+      );
+    }
+    const rawAuthorityLevel = parseInt(publicInputs[2], 16) || parseInt(publicInputs[2], 10);
+    return {
+      proof,
+      publicInputs: {
+        merkleRoot: publicInputs[0],
+        nullifier: publicInputs[1],
+        authorityLevel: validateAuthorityLevel(rawAuthorityLevel),
+        actionDomain: publicInputs[3],
+        districtId: publicInputs[4]
+      }
+    };
+  }
+  /**
+   * Verify a proof
+   */
+  async verify(proof, publicInputs) {
+    await this.init();
+    return this.backend.verifyProof({ proof, publicInputs });
+  }
+  /**
+   * Clean up resources
+   */
+  async destroy() {
+    if (this.backend) {
+      await this.backend.destroy();
+      this.backend = null;
+      this.noir = null;
+    }
+  }
+}
+const proverInstances = /* @__PURE__ */ new Map();
+const initializationPromises = /* @__PURE__ */ new Map();
+async function getProverForDepth(depth = DEFAULT_CIRCUIT_DEPTH, config) {
+  const existingInstance = proverInstances.get(depth);
+  if (existingInstance) {
+    return existingInstance;
+  }
+  const existingPromise = initializationPromises.get(depth);
+  if (existingPromise) {
+    return existingPromise;
+  }
+  let resolveInit;
+  let rejectInit;
+  const initPromise = new Promise((resolve, reject) => {
+    resolveInit = resolve;
+    rejectInit = reject;
+  });
+  initializationPromises.set(depth, initPromise);
+  (async () => {
+    try {
+      const prover = new NoirProver({ ...config, depth });
+      await prover.init();
+      proverInstances.set(depth, prover);
+      initializationPromises.delete(depth);
+      resolveInit(prover);
+    } catch (err) {
+      initializationPromises.delete(depth);
+      rejectInit(err instanceof Error ? err : new Error(String(err)));
+    }
+  })();
+  return initPromise;
+}
+async function getProver(config) {
+  const depth = config?.depth ?? DEFAULT_CIRCUIT_DEPTH;
+  return getProverForDepth(depth, config);
+}
+async function resetProverSingleton() {
+  const destroyPromises = Array.from(proverInstances.values()).map(
+    (prover) => prover.destroy()
+  );
+  await Promise.all(destroyPromises);
+  proverInstances.clear();
+  initializationPromises.clear();
+}
+async function resetProverForDepth(depth) {
+  const prover = proverInstances.get(depth);
+  if (prover) {
+    await prover.destroy();
+    proverInstances.delete(depth);
+  }
+  initializationPromises.delete(depth);
+}
+
+const noir_version$1 = "1.0.0-beta.16+2d46fca7203545cbbfb31a0d0328de6c10a8db95";
+const hash$1 = "571519090691839533";
+const abi$1 = {
 	parameters: [
 		{
-			name: "merkle_root",
-			type: {
-				kind: "field"
-			},
-			visibility: "private"
-		},
-		{
-			name: "nullifier",
-			type: {
-				kind: "field"
-			},
-			visibility: "private"
-		},
-		{
-			name: "authority_hash",
-			type: {
-				kind: "field"
-			},
-			visibility: "private"
-		},
-		{
-			name: "epoch_id",
-			type: {
-				kind: "field"
-			},
-			visibility: "private"
-		},
-		{
-			name: "campaign_id",
-			type: {
-				kind: "field"
-			},
-			visibility: "private"
-		},
-		{
-			name: "leaf",
-			type: {
-				kind: "field"
-			},
-			visibility: "private"
-		},
-		{
-			name: "merkle_path",
+			name: "inputs",
 			type: {
 				kind: "array",
-				length: 14,
+				length: 4,
 				type: {
 					kind: "field"
 				}
 			},
 			visibility: "private"
+		}
+	],
+	return_type: {
+		abi_type: {
+			kind: "field"
 		},
+		visibility: "public"
+	},
+	error_types: {
+	}
+};
+const bytecode$1 = "H4sIAAAAAAAA/42PPQ5AQBCFd/0XDqGkI44gEpUoNQqJRkFEp3QEcQGnEI6jU2r0JrErY6t9yZeX3XmZH0peacybsm4tcIW9KWCjOkXOUZirKKcDBmACFvmL93aIlKiGsn6V9keweFsWr+OYF254JsPeTdFxzxebK9n325WgO1ThT8xxPV5UJ+c4AQAA";
+const debug_symbols$1 = "jZDRCoQgEEX/ZZ590C1h61eWJcymEETFNFiif1+LbOsh2Kdx5nruDHeGDts4NMr0doT6NUPrldZqaLSVIihr0nReCOS2CR4xjeCkJ8oJjyZAbaLWBCah4/ZpdMJsNQifVEoATZdqMuyVxvW1kB9N71FG2Q6zojhwzi48u+fLJ+O7Qfnkj8OBVX9fUFT5gpJfLninTkjlL5kBhXpdMwmvRKtxz7GPRp5iDR+XlRy881ZiFz2udpuWFnwB";
+const file_map$1 = {
+	"19": {
+		source: "// Exposed only for usage in `std::meta`\npub(crate) mod poseidon2;\n\nuse crate::default::Default;\nuse crate::embedded_curve_ops::{\n    EmbeddedCurvePoint, EmbeddedCurveScalar, multi_scalar_mul, multi_scalar_mul_array_return,\n};\nuse crate::meta::derive_via;\n\n#[foreign(sha256_compression)]\n// docs:start:sha256_compression\npub fn sha256_compression(input: [u32; 16], state: [u32; 8]) -> [u32; 8] {}\n// docs:end:sha256_compression\n\n#[foreign(keccakf1600)]\n// docs:start:keccakf1600\npub fn keccakf1600(input: [u64; 25]) -> [u64; 25] {}\n// docs:end:keccakf1600\n\npub mod keccak {\n    #[deprecated(\"This function has been moved to std::hash::keccakf1600\")]\n    pub fn keccakf1600(input: [u64; 25]) -> [u64; 25] {\n        super::keccakf1600(input)\n    }\n}\n\n#[foreign(blake2s)]\n// docs:start:blake2s\npub fn blake2s<let N: u32>(input: [u8; N]) -> [u8; 32]\n// docs:end:blake2s\n{}\n\n// docs:start:blake3\npub fn blake3<let N: u32>(input: [u8; N]) -> [u8; 32]\n// docs:end:blake3\n{\n    if crate::runtime::is_unconstrained() {\n        // Temporary measure while Barretenberg is main proving system.\n        // Please open an issue if you're working on another proving system and running into problems due to this.\n        crate::static_assert(\n            N <= 1024,\n            \"Barretenberg cannot prove blake3 hashes with inputs larger than 1024 bytes\",\n        );\n    }\n    __blake3(input)\n}\n\n#[foreign(blake3)]\nfn __blake3<let N: u32>(input: [u8; N]) -> [u8; 32] {}\n\n// docs:start:pedersen_commitment\npub fn pedersen_commitment<let N: u32>(input: [Field; N]) -> EmbeddedCurvePoint {\n    // docs:end:pedersen_commitment\n    pedersen_commitment_with_separator(input, 0)\n}\n\n#[inline_always]\npub fn pedersen_commitment_with_separator<let N: u32>(\n    input: [Field; N],\n    separator: u32,\n) -> EmbeddedCurvePoint {\n    let mut points = [EmbeddedCurveScalar { lo: 0, hi: 0 }; N];\n    for i in 0..N {\n        // we use the unsafe version because the multi_scalar_mul will constrain the scalars.\n        points[i] = from_field_unsafe(input[i]);\n    }\n    let generators = derive_generators(\"DEFAULT_DOMAIN_SEPARATOR\".as_bytes(), separator);\n    multi_scalar_mul(generators, points)\n}\n\n// docs:start:pedersen_hash\npub fn pedersen_hash<let N: u32>(input: [Field; N]) -> Field\n// docs:end:pedersen_hash\n{\n    pedersen_hash_with_separator(input, 0)\n}\n\n#[no_predicates]\npub fn pedersen_hash_with_separator<let N: u32>(input: [Field; N], separator: u32) -> Field {\n    let mut scalars: [EmbeddedCurveScalar; N + 1] = [EmbeddedCurveScalar { lo: 0, hi: 0 }; N + 1];\n    let mut generators: [EmbeddedCurvePoint; N + 1] =\n        [EmbeddedCurvePoint::point_at_infinity(); N + 1];\n    let domain_generators: [EmbeddedCurvePoint; N] =\n        derive_generators(\"DEFAULT_DOMAIN_SEPARATOR\".as_bytes(), separator);\n\n    for i in 0..N {\n        scalars[i] = from_field_unsafe(input[i]);\n        generators[i] = domain_generators[i];\n    }\n    scalars[N] = EmbeddedCurveScalar { lo: N as Field, hi: 0 as Field };\n\n    let length_generator: [EmbeddedCurvePoint; 1] =\n        derive_generators(\"pedersen_hash_length\".as_bytes(), 0);\n    generators[N] = length_generator[0];\n    multi_scalar_mul_array_return(generators, scalars, true)[0].x\n}\n\n#[field(bn254)]\n#[inline_always]\npub fn derive_generators<let N: u32, let M: u32>(\n    domain_separator_bytes: [u8; M],\n    starting_index: u32,\n) -> [EmbeddedCurvePoint; N] {\n    crate::assert_constant(domain_separator_bytes);\n    // TODO(https://github.com/noir-lang/noir/issues/5672): Add back assert_constant on starting_index\n    __derive_generators(domain_separator_bytes, starting_index)\n}\n\n#[builtin(derive_pedersen_generators)]\n#[field(bn254)]\nfn __derive_generators<let N: u32, let M: u32>(\n    domain_separator_bytes: [u8; M],\n    starting_index: u32,\n) -> [EmbeddedCurvePoint; N] {}\n\n#[field(bn254)]\n// Decompose the input 'bn254 scalar' into two 128 bits limbs.\n// It is called 'unsafe' because it does not assert the limbs are 128 bits\n// Assuming the limbs are 128 bits:\n// Assert the decomposition does not overflow the field size.\nfn from_field_unsafe(scalar: Field) -> EmbeddedCurveScalar {\n    // Safety: xlo and xhi decomposition is checked below\n    let (xlo, xhi) = unsafe { crate::field::bn254::decompose_hint(scalar) };\n    // Check that the decomposition is correct\n    assert_eq(scalar, xlo + crate::field::bn254::TWO_POW_128 * xhi);\n    // Check that the decomposition does not overflow the field size\n    let (a, b) = if xhi == crate::field::bn254::PHI {\n        (xlo, crate::field::bn254::PLO)\n    } else {\n        (xhi, crate::field::bn254::PHI)\n    };\n    crate::field::bn254::assert_lt(a, b);\n\n    EmbeddedCurveScalar { lo: xlo, hi: xhi }\n}\n\npub fn poseidon2_permutation<let N: u32>(input: [Field; N], state_len: u32) -> [Field; N] {\n    assert_eq(input.len(), state_len);\n    poseidon2_permutation_internal(input)\n}\n\n#[foreign(poseidon2_permutation)]\nfn poseidon2_permutation_internal<let N: u32>(input: [Field; N]) -> [Field; N] {}\n\n// Generic hashing support.\n// Partially ported and impacted by rust.\n\n// Hash trait shall be implemented per type.\n#[derive_via(derive_hash)]\npub trait Hash {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher;\n}\n\n// docs:start:derive_hash\ncomptime fn derive_hash(s: TypeDefinition) -> Quoted {\n    let name = quote { $crate::hash::Hash };\n    let signature = quote { fn hash<H>(_self: Self, _state: &mut H) where H: $crate::hash::Hasher };\n    let for_each_field = |name| quote { _self.$name.hash(_state); };\n    crate::meta::make_trait_impl(\n        s,\n        name,\n        signature,\n        for_each_field,\n        quote {},\n        |fields| fields,\n    )\n}\n// docs:end:derive_hash\n\n// Hasher trait shall be implemented by algorithms to provide hash-agnostic means.\n// TODO: consider making the types generic here ([u8], [Field], etc.)\npub trait Hasher {\n    fn finish(self) -> Field;\n\n    fn write(&mut self, input: Field);\n}\n\n// BuildHasher is a factory trait, responsible for production of specific Hasher.\npub trait BuildHasher {\n    type H: Hasher;\n\n    fn build_hasher(self) -> H;\n}\n\npub struct BuildHasherDefault<H>;\n\nimpl<H> BuildHasher for BuildHasherDefault<H>\nwhere\n    H: Hasher + Default,\n{\n    type H = H;\n\n    fn build_hasher(_self: Self) -> H {\n        H::default()\n    }\n}\n\nimpl<H> Default for BuildHasherDefault<H>\nwhere\n    H: Hasher + Default,\n{\n    fn default() -> Self {\n        BuildHasherDefault {}\n    }\n}\n\nimpl Hash for Field {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self);\n    }\n}\n\nimpl Hash for u1 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for u8 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for u16 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for u32 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for u64 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for u128 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for i8 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as u8 as Field);\n    }\n}\n\nimpl Hash for i16 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as u16 as Field);\n    }\n}\n\nimpl Hash for i32 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as u32 as Field);\n    }\n}\n\nimpl Hash for i64 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as u64 as Field);\n    }\n}\n\nimpl Hash for bool {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for () {\n    fn hash<H>(_self: Self, _state: &mut H)\n    where\n        H: Hasher,\n    {}\n}\n\nimpl<T, let N: u32> Hash for [T; N]\nwhere\n    T: Hash,\n{\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        for elem in self {\n            elem.hash(state);\n        }\n    }\n}\n\nimpl<T> Hash for [T]\nwhere\n    T: Hash,\n{\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        self.len().hash(state);\n        for elem in self {\n            elem.hash(state);\n        }\n    }\n}\n\nimpl<A, B> Hash for (A, B)\nwhere\n    A: Hash,\n    B: Hash,\n{\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        self.0.hash(state);\n        self.1.hash(state);\n    }\n}\n\nimpl<A, B, C> Hash for (A, B, C)\nwhere\n    A: Hash,\n    B: Hash,\n    C: Hash,\n{\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        self.0.hash(state);\n        self.1.hash(state);\n        self.2.hash(state);\n    }\n}\n\nimpl<A, B, C, D> Hash for (A, B, C, D)\nwhere\n    A: Hash,\n    B: Hash,\n    C: Hash,\n    D: Hash,\n{\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        self.0.hash(state);\n        self.1.hash(state);\n        self.2.hash(state);\n        self.3.hash(state);\n    }\n}\n\nimpl<A, B, C, D, E> Hash for (A, B, C, D, E)\nwhere\n    A: Hash,\n    B: Hash,\n    C: Hash,\n    D: Hash,\n    E: Hash,\n{\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        self.0.hash(state);\n        self.1.hash(state);\n        self.2.hash(state);\n        self.3.hash(state);\n        self.4.hash(state);\n    }\n}\n\n// Some test vectors for Pedersen hash and Pedersen Commitment.\n// They have been generated using the same functions so the tests are for now useless\n// but they will be useful when we switch to Noir implementation.\n#[test]\nfn assert_pedersen() {\n    assert_eq(\n        pedersen_hash_with_separator([1], 1),\n        0x1b3f4b1a83092a13d8d1a59f7acb62aba15e7002f4440f2275edb99ebbc2305f,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1], 1),\n        EmbeddedCurvePoint {\n            x: 0x054aa86a73cb8a34525e5bbed6e43ba1198e860f5f3950268f71df4591bde402,\n            y: 0x209dcfbf2cfb57f9f6046f44d71ac6faf87254afc7407c04eb621a6287cac126,\n            is_infinite: false,\n        },\n    );\n\n    assert_eq(\n        pedersen_hash_with_separator([1, 2], 2),\n        0x26691c129448e9ace0c66d11f0a16d9014a9e8498ee78f4d69f0083168188255,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2], 2),\n        EmbeddedCurvePoint {\n            x: 0x2e2b3b191e49541fe468ec6877721d445dcaffe41728df0a0eafeb15e87b0753,\n            y: 0x2ff4482400ad3a6228be17a2af33e2bcdf41be04795f9782bd96efe7e24f8778,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3], 3),\n        0x0bc694b7a1f8d10d2d8987d07433f26bd616a2d351bc79a3c540d85b6206dbe4,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3], 3),\n        EmbeddedCurvePoint {\n            x: 0x1fee4e8cf8d2f527caa2684236b07c4b1bad7342c01b0f75e9a877a71827dc85,\n            y: 0x2f9fedb9a090697ab69bf04c8bc15f7385b3e4b68c849c1536e5ae15ff138fd1,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4], 4),\n        0xdae10fb32a8408521803905981a2b300d6a35e40e798743e9322b223a5eddc,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4], 4),\n        EmbeddedCurvePoint {\n            x: 0x07ae3e202811e1fca39c2d81eabe6f79183978e6f12be0d3b8eda095b79bdbc9,\n            y: 0x0afc6f892593db6fbba60f2da558517e279e0ae04f95758587760ba193145014,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4, 5], 5),\n        0xfc375b062c4f4f0150f7100dfb8d9b72a6d28582dd9512390b0497cdad9c22,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4, 5], 5),\n        EmbeddedCurvePoint {\n            x: 0x1754b12bd475a6984a1094b5109eeca9838f4f81ac89c5f0a41dbce53189bb29,\n            y: 0x2da030e3cfcdc7ddad80eaf2599df6692cae0717d4e9f7bfbee8d073d5d278f7,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4, 5, 6], 6),\n        0x1696ed13dc2730062a98ac9d8f9de0661bb98829c7582f699d0273b18c86a572,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4, 5, 6], 6),\n        EmbeddedCurvePoint {\n            x: 0x190f6c0e97ad83e1e28da22a98aae156da083c5a4100e929b77e750d3106a697,\n            y: 0x1f4b60f34ef91221a0b49756fa0705da93311a61af73d37a0c458877706616fb,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4, 5, 6, 7], 7),\n        0x128c0ff144fc66b6cb60eeac8a38e23da52992fc427b92397a7dffd71c45ede3,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4, 5, 6, 7], 7),\n        EmbeddedCurvePoint {\n            x: 0x015441e9d29491b06563fac16fc76abf7a9534c715421d0de85d20dbe2965939,\n            y: 0x1d2575b0276f4e9087e6e07c2cb75aa1baafad127af4be5918ef8a2ef2fea8fc,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4, 5, 6, 7, 8], 8),\n        0x2f960e117482044dfc99d12fece2ef6862fba9242be4846c7c9a3e854325a55c,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4, 5, 6, 7, 8], 8),\n        EmbeddedCurvePoint {\n            x: 0x1657737676968887fceb6dd516382ea13b3a2c557f509811cd86d5d1199bc443,\n            y: 0x1f39f0cb569040105fa1e2f156521e8b8e08261e635a2b210bdc94e8d6d65f77,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4, 5, 6, 7, 8, 9], 9),\n        0x0c96db0790602dcb166cc4699e2d306c479a76926b81c2cb2aaa92d249ec7be7,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4, 5, 6, 7, 8, 9], 9),\n        EmbeddedCurvePoint {\n            x: 0x0a3ceae42d14914a432aa60ec7fded4af7dad7dd4acdbf2908452675ec67e06d,\n            y: 0xfc19761eaaf621ad4aec9a8b2e84a4eceffdba78f60f8b9391b0bd9345a2f2,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4, 5, 6, 7, 8, 9, 10], 10),\n        0x2cd37505871bc460a62ea1e63c7fe51149df5d0801302cf1cbc48beb8dff7e94,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4, 5, 6, 7, 8, 9, 10], 10),\n        EmbeddedCurvePoint {\n            x: 0x2fb3f8b3d41ddde007c8c3c62550f9a9380ee546fcc639ffbb3fd30c8d8de30c,\n            y: 0x300783be23c446b11a4c0fabf6c91af148937cea15fcf5fb054abf7f752ee245,\n            is_infinite: false,\n        },\n    );\n}\n",
+		path: "std/hash/mod.nr"
+	},
+	"51": {
+		source: "use dep::std::hash::poseidon2_permutation;\n\nfn main(inputs: [Field; 4]) -> pub Field {\n    let out = poseidon2_permutation(inputs, 4);\n    out[0]\n}\n",
+		path: "/Users/noot/Documents/voter-protocol/packages/crypto/noir/fixtures/src/main.nr"
+	}
+};
+const expression_width$1 = {
+	Bounded: {
+		width: 4
+	}
+};
+const fixturesCircuit = {
+	noir_version: noir_version$1,
+	hash: hash$1,
+	abi: abi$1,
+	bytecode: bytecode$1,
+	debug_symbols: debug_symbols$1,
+	file_map: file_map$1,
+	expression_width: expression_width$1
+};
+
+const noir_version = "1.0.0-beta.16+2d46fca7203545cbbfb31a0d0328de6c10a8db95";
+const hash = "17841920136822657451";
+const abi = {
+	parameters: [
 		{
-			name: "leaf_index",
-			type: {
-				kind: "integer",
-				sign: "unsigned",
-				width: 32
-			},
-			visibility: "private"
-		},
-		{
-			name: "user_secret",
+			name: "inputs",
 			type: {
-				kind: "field"
+				kind: "array",
+				length: 4,
+				type: {
+					kind: "field"
+				}
 			},
 			visibility: "private"
 		}
 	],
 	return_type: {
 		abi_type: {
-			kind: "tuple",
-			fields: [
-				{
-					kind: "field"
-				},
-				{
-					kind: "field"
-				},
-				{
-					kind: "field"
-				},
-				{
-					kind: "field"
-				},
-				{
-					kind: "field"
-				}
-			]
+			kind: "array",
+			length: 4,
+			type: {
+				kind: "field"
+			}
 		},
 		visibility: "public"
 	},
 	error_types: {
 	}
 };
-const bytecode = "H4sIAAAAAAAA/9Vcf5RVVRX+3jCjCFhkgz/4MTytSEEEMioUgRILRNCiAhEkkQFHfijTgPywgkIRrEhHEazIUAQrKhQBi2oQwYoKRbCiQkaopDLpj9aqtdRx78O53vMO9zp733vfc72z1mavuefc7/vO++4738C8IYfjo9L2GdfVzTxG/bf26xxVG9urqfLO2gqcOHK25yEauWrh2paWpsjrebTOwX+4WrvY3jWYDTbYNQKwjZzIwLkb6jt5VH1zvwfO23rVZZsXLRo74dwLXxo274mb77q0+b9304uc6yJb23gsRlvU8F8o35DWeFxNrY2340GIG3nZsgpXazfba4wChA8CT3T3rtUg3FQwivRwNL7S0tLSDXLTaqAzLYcT9wLoTatRaHT5uqch5JsrvPtaI++u4MgrcJPuIQ/9OzMv5ygkVPKcDTkPY3dAeBLw1yfZXmX72U4P1p1D9R6q91K9LwanysOLwulB9X6qc6nOQ/mfSD1t72UUIDx9eMI/kXqhtCdST8gfol5yDZma1hOlN+1823sbBQgN4gnftN5Ib5rUCDbtfMhN6w2daVnFSG+FRpfvgjSEfLM2Ri5QcPRR4CbdQx/oj/c+cg4z/NeoNV287hyFHl7XIwFPDwVHXzluZBSdbHtfxEdRP6oPUF1I9cEYnL4eXhROf6oPUX2Y6iMoy0irdLUOsP0iowDhScgTNd41XuRvtIiR9toAyB+ii+QaMjVtAEpiWkGkXWz7QKMAoUE84UfaQKSPNKkRHGkXQ27aQOhMyyrSBio0unyXpCHkm7WRdomCY5ACN+keBkEfaYPkHGZoo4Yjs59CD6/vn4Cnv4JjsBw3Mora2j4Y8VE0hOqjVB+jujQGZ7CHF4UzlOoyqo9TfQJlGWltXa3DbB9uFCA8CXmim3dtOMLTMBhFjLT/D4P8IRou15CpacNQEtMKIu1y20cYBQgN4gk/0kYgfaRJjeBIuxxy00ZAZ1pWkTZCodHluyINId+sjbQrFBwjFbhJ9zAS+kgbKecwQxs1HJlDFHp4/dAEPEMVHKPkuJFRdIrtoxAfRVdSXUX1SapPxeCM8vCicEZTfZrqM1SfRVlGWkdX6xjbxxoFCE9CnujqXeNFlR5aESPtP2Mgf4jGyjVkatoYlMS0gki72vZxRgFCg3jCj7RxSB9pUiM40q6G3LRx0JmWVaSNU2h0+a5JQ8g3ayPtGgXHeAVu0j2Mhz7Sxss5zNBGDUfmlQo9vH50Ap7RCo4JctzIKGpn+wTER9G1VBOpPkd1XQzOBA8vCmcS1fVUk6lqUZaRlne1TrF9qlGA8CTkiS7eNV5U5aEVMdKap0D+EE2Va8jUtCkoiWkFkXaD7XVGAUKDeMKPtDqkjzSpERxpN0BuWh10pmUVaXUKjS7fjWkI+WZtpN2o4JimwE26h2nQR9o0OYcZ2qjhyLxWoYfXT0rAM0nBMV2OGxlF7W2fjvgomkE1k+omqptjcKZ7eFE4s6jqqT5P1YCyjLQhrtbZts8xChCehDzR2bvGi07y0IoYadtnQ/4QzZFryNS02SiJaQWRdovtc40ChAbxhB9pc5E+0qRGcKTdArlpc6EzLatIm6vQ6PLNS0PIN2sjbZ6CY74CN+ke5kMfafPlHGZoo4Yjc4ZCD6+flYBnloJjgRw3Moo62L4A8VF0K9UXqL5I9aUYnAUeXhTOQqpFVF+m+grKMtIWuloX236bUYDwJOSJs7xrvOhkD62IkbZoMeQP0W1yDZmathglMa0g0m63fYlRgNAgnvAjbQnSR5rUCI602yE3bQl0pmUVaUsUGl2+O9IQ8s3aSLtDwbFUgZt0D0uhj7Slcg4ztFHDkXmrQg+vX5iAZ6GCY5kcNzKKTrV9GeKj6E6qr1J9jerrMTjLPLwonOVU36C6i+pulGOk5Qq0Ntp+z/Gp8CTkiTO9a7yorQdXxEjLNUL+EN0j15CpaY0ohWmFkXav7SuMAoQG8YQfaSuQPtKkRnCk3Qu5aSugMy2rSFuh0Ojy3ZeGkG/WRtp9Co6VCtyke1gJfaStlHOYoY0ajsw7FXp4/fIEPMsVHKvkuJFR9A7bVyE+iu6n+ibVt6i+HYOzysOLwllN9R2qB6i+i3KMtIoCrWtsf9AoQHgS8sQZ3jVedIoHV7xIez23BvKH6EG5hkxNW4NSmFYYaQ/ZvtYoQGgQT/iRthbpI01qBEfaQ5CbthY607KKtLUKjS7fw2kI+WZtpD2s4FinwE26h3XQR9o6OYcZ2qjhyLxfoYfXr07As1rBsV6OGxlF77R9PeKj6BGq71F9n+oHMTjrPbwonA1UP6T6EdWPUY6RVlmgdaPtjxoFCE9Cnjjdu8aL2nlwxYu0V3MbIX+IHpVryNS0jSiFaYWR9pjtm4wChAbxhB9pm5A+0qRGcKQ9Brlpm6AzLatI26TQ6PI9noaQb9ZG2uMKjs0K3KR72Ax9pG2Wc5ihjRqOzEcUenj9hgQ8GxQcW+S4kVHU0fYtiI+irVRPUP2E6qcxOFs8vCicbVQ/o/o51S9QjpHWtkBrk+3bjQKEJyFPdPKu8aL2HlzxIu1/uSbIH6Ltcg2ZmtaEUphWGGlP2r7DKEBoEE/4kbYD6SOtCfJIexJy03ZAZ1pWkbZDodHleyoNId+sjbSnFBw7FbhJ97AT+kjbKecwQxs1HJlbFXp4/bYEPNsUHLvkuJFR9C7bdyE+ip6m+iXVr6h+HYOzy8OLwtlN9Rsc//8bf4dyjLSOBVr32P6MUYDwJOSJau8aL+rgwRUv0o7l9kD+ED0j15CpaXtQCtMKI+1Z2/caBQgN4gk/0vYifaRJjeBIexZy0/ZCZ1pWkbZXodHley4NId+sjbTnFBz7FLhJ97AP+kjbJ+cwQxs1HJlPK/Tw+t0JeHYrOPbLcSOj6DTb9yM+ip6n+j3VH6j+GIOz38OLwjlA9SeqP1P9BeUYafkCrQdtf8EoQHgS8sS7vWu86FQPrniRdih3EPKH6AW5hkxNO4hSmFYYaYdsbzYKEBrEE36kNSN9pEmN4Eg7BLlpzdCZllWkNSs0unwvpiHkm7WR9qKC47ACN+keDkMfaYflHGZoo4Yj83mFHl5/IAHPAQXHETluZBQFJ+8RxEfRX6n+RvV3qpdicI54eFE4R6n+QfVPqn/Za9rX5rDVE6yXPBNHoX8/uGtb03QU6TwI/o0yOHgqEB6swbqXqf5N9QrVMQ9Tu7cc5Ht7Wb42lSZ3bWuaTkdpNGlepzNQGk0VkGs6E6XR1AZyTWehNJoqIdfUWb7W/Ij8zRutruB9yv+TAv/qKf+uDn+4mT8Nxj8+55838Huev6Plj8/x5w34BzT8L1r8VwA+M/m71U4OdpXDx88We8mvXWdnTfCaBNcm19XXXt9QN6d2Yt3MhtqptfUTZ82+qaGudmZD8FHroLdzdqBwryK4v32y+0/4xVxXi4v7JqHtlRH35WK+rvD6W631r7vXOkTMBZin2e7qDfbR0XbXjTm19Q3BZwOD17CTw6d5BwX3Vye7P9ID98kLcAMe93XMQzeCb/+rIuZ8b9t4vEHP6flzcTqi/A68rHauBa/HG1KywaYoaAAA";
-const debug_symbols = "tVfLbqNAEPwXzj5Q8+jp2V9ZrSLHIZEly7YcO9Iqyr8vTFc7yQEU2doLNYZ0QRVVEN67p+Hx8vKw3T8fXrtfv9+7x9N2t9u+POwOm/V5e9iPe98/Vp3/fDifhmHc1X05Pk4d16dhf+5+7S+73ap7W+8u7Y9ej+t9w/P6NB7tV92wfxpxJHze7oZp9bH6nO7nR5Fr4TQklStBxjcGzDOUUElQ8i3zKn75qumW+ezn1xpvmK9wA2rELfP5Oq+z+mV+PmrkfJzXvzCfenA+xTA3rwvziuwEmj8ZUH98BVGdIN1yB+tnBPswHyHc6eESwY9MRLzbxcVruNNGFdegRebmlx4Fcm0iRPUWhhL8ElBqP6thIY2AuI8IC7ei/leKXPxWSF/nCALuj8PCNciVQQJuuRnaeymg8Xug/oy/1pvt6dvbqMOoadWFto1tm9o2j7VaddK2pW21besobtWhN4DBOD6KQjQYCTDtzVOmRhRiISqxNsLQG8AgGMRGHJJBNpDGH4qB2mlCNbrYE0EMxNgYYzIwXdGExdKIoxqYttQ3/gSDYKdJ0ehSIlJdorpkJiVzKZm2bNqy2ZSDgWnLqfHnbCB2mkyTMk3KVCdUJ2aTmE1i2sS0idkkYmDaRBu/1Aalt9MUmlRoUqG6QnXFbCq8/6atmLZiNqlFQE2bWgTUIqCMgNIkpUlKdUp1ajZVs6matmraqtlULQLVtFWLQLUIVEag0iT0vS/gi+ALswp9ImaiEAuDrUQGHZYGAETmAaBlQPKFB/6aeJhxgBJNL5h5BO9PIEaiZQMhE5kOBO9Q8BJ5/OH5RzQbEQORytkARLMSUYhUHpUtrqwxs4LkZiY308sAbwMS7Uy0k3UA+4BEOzMfHKwEMh8dmc+OfH14uJnZzfRqwLuBTDuFdrIcYDsgtFMSkcrFUgQpROYI4mYWN9OLAm8KCu0stJNVAbuCQjsLg8S6QBkkZZDUg6RuprqZXht4b6C0U2kniwM2B5V2VgaJ5UFlkCqDVD1IU4Om/4ExdSiEaTFShumN8bY+bdePu4EfK8+X/ebLt8v579GP+NfN8XTYDE+X0zC9Wdqx8V3zDw==";
+const bytecode = "H4sIAAAAAAAA/72SPQqDQBCFZ/2J0c0hUiZdQo4QAqlCyjQpAmlSJAQ7S48gXsBTiB7HztLG3lkdZQWLXQQHHo9lhjcfu8ugK4v8+/r8OLpNZ4baSH0meS+D3JTm1igX5aE4jMsg34JSMUuaPbxvfnFM9tn9kobh47k7ldcg/0fnoo4r2quYO4vJ1mByYRmmlQaTB8swORpMXD13+GftEuIyJ/rCxVuJu3EmchrXOnNwAAMAAA==";
+const debug_symbols = "dZDRDoMgDEX/pc88iNHM+SvLYhCrISFAEJYshn9fNTL1wafSXs5tehcYsI9Tp8xoZ2hfC/Reaa2mTlspgrKGpktikNsueEQawUknygmPJkBrotYMPkLH7dPshNlqEJ7UggGagSoZjkrj+krsoIt7tKwyXD7KP17zC8/v+arh9W5QNfXhwJ8pvakTUvnLzVDQqrQaeiV6jXsOYzTyFEv4uqzk4Jy3EofocbXbNFrwAw==";
 const file_map = {
 	"19": {
 		source: "// Exposed only for usage in `std::meta`\npub(crate) mod poseidon2;\n\nuse crate::default::Default;\nuse crate::embedded_curve_ops::{\n    EmbeddedCurvePoint, EmbeddedCurveScalar, multi_scalar_mul, multi_scalar_mul_array_return,\n};\nuse crate::meta::derive_via;\n\n#[foreign(sha256_compression)]\n// docs:start:sha256_compression\npub fn sha256_compression(input: [u32; 16], state: [u32; 8]) -> [u32; 8] {}\n// docs:end:sha256_compression\n\n#[foreign(keccakf1600)]\n// docs:start:keccakf1600\npub fn keccakf1600(input: [u64; 25]) -> [u64; 25] {}\n// docs:end:keccakf1600\n\npub mod keccak {\n    #[deprecated(\"This function has been moved to std::hash::keccakf1600\")]\n    pub fn keccakf1600(input: [u64; 25]) -> [u64; 25] {\n        super::keccakf1600(input)\n    }\n}\n\n#[foreign(blake2s)]\n// docs:start:blake2s\npub fn blake2s<let N: u32>(input: [u8; N]) -> [u8; 32]\n// docs:end:blake2s\n{}\n\n// docs:start:blake3\npub fn blake3<let N: u32>(input: [u8; N]) -> [u8; 32]\n// docs:end:blake3\n{\n    if crate::runtime::is_unconstrained() {\n        // Temporary measure while Barretenberg is main proving system.\n        // Please open an issue if you're working on another proving system and running into problems due to this.\n        crate::static_assert(\n            N <= 1024,\n            \"Barretenberg cannot prove blake3 hashes with inputs larger than 1024 bytes\",\n        );\n    }\n    __blake3(input)\n}\n\n#[foreign(blake3)]\nfn __blake3<let N: u32>(input: [u8; N]) -> [u8; 32] {}\n\n// docs:start:pedersen_commitment\npub fn pedersen_commitment<let N: u32>(input: [Field; N]) -> EmbeddedCurvePoint {\n    // docs:end:pedersen_commitment\n    pedersen_commitment_with_separator(input, 0)\n}\n\n#[inline_always]\npub fn pedersen_commitment_with_separator<let N: u32>(\n    input: [Field; N],\n    separator: u32,\n) -> EmbeddedCurvePoint {\n    let mut points = [EmbeddedCurveScalar { lo: 0, hi: 0 }; N];\n    for i in 0..N {\n        // we use the unsafe version because the multi_scalar_mul will constrain the scalars.\n        points[i] = from_field_unsafe(input[i]);\n    }\n    let generators = derive_generators(\"DEFAULT_DOMAIN_SEPARATOR\".as_bytes(), separator);\n    multi_scalar_mul(generators, points)\n}\n\n// docs:start:pedersen_hash\npub fn pedersen_hash<let N: u32>(input: [Field; N]) -> Field\n// docs:end:pedersen_hash\n{\n    pedersen_hash_with_separator(input, 0)\n}\n\n#[no_predicates]\npub fn pedersen_hash_with_separator<let N: u32>(input: [Field; N], separator: u32) -> Field {\n    let mut scalars: [EmbeddedCurveScalar; N + 1] = [EmbeddedCurveScalar { lo: 0, hi: 0 }; N + 1];\n    let mut generators: [EmbeddedCurvePoint; N + 1] =\n        [EmbeddedCurvePoint::point_at_infinity(); N + 1];\n    let domain_generators: [EmbeddedCurvePoint; N] =\n        derive_generators(\"DEFAULT_DOMAIN_SEPARATOR\".as_bytes(), separator);\n\n    for i in 0..N {\n        scalars[i] = from_field_unsafe(input[i]);\n        generators[i] = domain_generators[i];\n    }\n    scalars[N] = EmbeddedCurveScalar { lo: N as Field, hi: 0 as Field };\n\n    let length_generator: [EmbeddedCurvePoint; 1] =\n        derive_generators(\"pedersen_hash_length\".as_bytes(), 0);\n    generators[N] = length_generator[0];\n    multi_scalar_mul_array_return(generators, scalars, true)[0].x\n}\n\n#[field(bn254)]\n#[inline_always]\npub fn derive_generators<let N: u32, let M: u32>(\n    domain_separator_bytes: [u8; M],\n    starting_index: u32,\n) -> [EmbeddedCurvePoint; N] {\n    crate::assert_constant(domain_separator_bytes);\n    // TODO(https://github.com/noir-lang/noir/issues/5672): Add back assert_constant on starting_index\n    __derive_generators(domain_separator_bytes, starting_index)\n}\n\n#[builtin(derive_pedersen_generators)]\n#[field(bn254)]\nfn __derive_generators<let N: u32, let M: u32>(\n    domain_separator_bytes: [u8; M],\n    starting_index: u32,\n) -> [EmbeddedCurvePoint; N] {}\n\n#[field(bn254)]\n// Decompose the input 'bn254 scalar' into two 128 bits limbs.\n// It is called 'unsafe' because it does not assert the limbs are 128 bits\n// Assuming the limbs are 128 bits:\n// Assert the decomposition does not overflow the field size.\nfn from_field_unsafe(scalar: Field) -> EmbeddedCurveScalar {\n    // Safety: xlo and xhi decomposition is checked below\n    let (xlo, xhi) = unsafe { crate::field::bn254::decompose_hint(scalar) };\n    // Check that the decomposition is correct\n    assert_eq(scalar, xlo + crate::field::bn254::TWO_POW_128 * xhi);\n    // Check that the decomposition does not overflow the field size\n    let (a, b) = if xhi == crate::field::bn254::PHI {\n        (xlo, crate::field::bn254::PLO)\n    } else {\n        (xhi, crate::field::bn254::PHI)\n    };\n    crate::field::bn254::assert_lt(a, b);\n\n    EmbeddedCurveScalar { lo: xlo, hi: xhi }\n}\n\npub fn poseidon2_permutation<let N: u32>(input: [Field; N], state_len: u32) -> [Field; N] {\n    assert_eq(input.len(), state_len);\n    poseidon2_permutation_internal(input)\n}\n\n#[foreign(poseidon2_permutation)]\nfn poseidon2_permutation_internal<let N: u32>(input: [Field; N]) -> [Field; N] {}\n\n// Generic hashing support.\n// Partially ported and impacted by rust.\n\n// Hash trait shall be implemented per type.\n#[derive_via(derive_hash)]\npub trait Hash {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher;\n}\n\n// docs:start:derive_hash\ncomptime fn derive_hash(s: TypeDefinition) -> Quoted {\n    let name = quote { $crate::hash::Hash };\n    let signature = quote { fn hash<H>(_self: Self, _state: &mut H) where H: $crate::hash::Hasher };\n    let for_each_field = |name| quote { _self.$name.hash(_state); };\n    crate::meta::make_trait_impl(\n        s,\n        name,\n        signature,\n        for_each_field,\n        quote {},\n        |fields| fields,\n    )\n}\n// docs:end:derive_hash\n\n// Hasher trait shall be implemented by algorithms to provide hash-agnostic means.\n// TODO: consider making the types generic here ([u8], [Field], etc.)\npub trait Hasher {\n    fn finish(self) -> Field;\n\n    fn write(&mut self, input: Field);\n}\n\n// BuildHasher is a factory trait, responsible for production of specific Hasher.\npub trait BuildHasher {\n    type H: Hasher;\n\n    fn build_hasher(self) -> H;\n}\n\npub struct BuildHasherDefault<H>;\n\nimpl<H> BuildHasher for BuildHasherDefault<H>\nwhere\n    H: Hasher + Default,\n{\n    type H = H;\n\n    fn build_hasher(_self: Self) -> H {\n        H::default()\n    }\n}\n\nimpl<H> Default for BuildHasherDefault<H>\nwhere\n    H: Hasher + Default,\n{\n    fn default() -> Self {\n        BuildHasherDefault {}\n    }\n}\n\nimpl Hash for Field {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self);\n    }\n}\n\nimpl Hash for u1 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for u8 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for u16 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for u32 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for u64 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for u128 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for i8 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as u8 as Field);\n    }\n}\n\nimpl Hash for i16 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as u16 as Field);\n    }\n}\n\nimpl Hash for i32 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as u32 as Field);\n    }\n}\n\nimpl Hash for i64 {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as u64 as Field);\n    }\n}\n\nimpl Hash for bool {\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        H::write(state, self as Field);\n    }\n}\n\nimpl Hash for () {\n    fn hash<H>(_self: Self, _state: &mut H)\n    where\n        H: Hasher,\n    {}\n}\n\nimpl<T, let N: u32> Hash for [T; N]\nwhere\n    T: Hash,\n{\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        for elem in self {\n            elem.hash(state);\n        }\n    }\n}\n\nimpl<T> Hash for [T]\nwhere\n    T: Hash,\n{\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        self.len().hash(state);\n        for elem in self {\n            elem.hash(state);\n        }\n    }\n}\n\nimpl<A, B> Hash for (A, B)\nwhere\n    A: Hash,\n    B: Hash,\n{\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        self.0.hash(state);\n        self.1.hash(state);\n    }\n}\n\nimpl<A, B, C> Hash for (A, B, C)\nwhere\n    A: Hash,\n    B: Hash,\n    C: Hash,\n{\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        self.0.hash(state);\n        self.1.hash(state);\n        self.2.hash(state);\n    }\n}\n\nimpl<A, B, C, D> Hash for (A, B, C, D)\nwhere\n    A: Hash,\n    B: Hash,\n    C: Hash,\n    D: Hash,\n{\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        self.0.hash(state);\n        self.1.hash(state);\n        self.2.hash(state);\n        self.3.hash(state);\n    }\n}\n\nimpl<A, B, C, D, E> Hash for (A, B, C, D, E)\nwhere\n    A: Hash,\n    B: Hash,\n    C: Hash,\n    D: Hash,\n    E: Hash,\n{\n    fn hash<H>(self, state: &mut H)\n    where\n        H: Hasher,\n    {\n        self.0.hash(state);\n        self.1.hash(state);\n        self.2.hash(state);\n        self.3.hash(state);\n        self.4.hash(state);\n    }\n}\n\n// Some test vectors for Pedersen hash and Pedersen Commitment.\n// They have been generated using the same functions so the tests are for now useless\n// but they will be useful when we switch to Noir implementation.\n#[test]\nfn assert_pedersen() {\n    assert_eq(\n        pedersen_hash_with_separator([1], 1),\n        0x1b3f4b1a83092a13d8d1a59f7acb62aba15e7002f4440f2275edb99ebbc2305f,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1], 1),\n        EmbeddedCurvePoint {\n            x: 0x054aa86a73cb8a34525e5bbed6e43ba1198e860f5f3950268f71df4591bde402,\n            y: 0x209dcfbf2cfb57f9f6046f44d71ac6faf87254afc7407c04eb621a6287cac126,\n            is_infinite: false,\n        },\n    );\n\n    assert_eq(\n        pedersen_hash_with_separator([1, 2], 2),\n        0x26691c129448e9ace0c66d11f0a16d9014a9e8498ee78f4d69f0083168188255,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2], 2),\n        EmbeddedCurvePoint {\n            x: 0x2e2b3b191e49541fe468ec6877721d445dcaffe41728df0a0eafeb15e87b0753,\n            y: 0x2ff4482400ad3a6228be17a2af33e2bcdf41be04795f9782bd96efe7e24f8778,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3], 3),\n        0x0bc694b7a1f8d10d2d8987d07433f26bd616a2d351bc79a3c540d85b6206dbe4,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3], 3),\n        EmbeddedCurvePoint {\n            x: 0x1fee4e8cf8d2f527caa2684236b07c4b1bad7342c01b0f75e9a877a71827dc85,\n            y: 0x2f9fedb9a090697ab69bf04c8bc15f7385b3e4b68c849c1536e5ae15ff138fd1,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4], 4),\n        0xdae10fb32a8408521803905981a2b300d6a35e40e798743e9322b223a5eddc,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4], 4),\n        EmbeddedCurvePoint {\n            x: 0x07ae3e202811e1fca39c2d81eabe6f79183978e6f12be0d3b8eda095b79bdbc9,\n            y: 0x0afc6f892593db6fbba60f2da558517e279e0ae04f95758587760ba193145014,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4, 5], 5),\n        0xfc375b062c4f4f0150f7100dfb8d9b72a6d28582dd9512390b0497cdad9c22,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4, 5], 5),\n        EmbeddedCurvePoint {\n            x: 0x1754b12bd475a6984a1094b5109eeca9838f4f81ac89c5f0a41dbce53189bb29,\n            y: 0x2da030e3cfcdc7ddad80eaf2599df6692cae0717d4e9f7bfbee8d073d5d278f7,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4, 5, 6], 6),\n        0x1696ed13dc2730062a98ac9d8f9de0661bb98829c7582f699d0273b18c86a572,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4, 5, 6], 6),\n        EmbeddedCurvePoint {\n            x: 0x190f6c0e97ad83e1e28da22a98aae156da083c5a4100e929b77e750d3106a697,\n            y: 0x1f4b60f34ef91221a0b49756fa0705da93311a61af73d37a0c458877706616fb,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4, 5, 6, 7], 7),\n        0x128c0ff144fc66b6cb60eeac8a38e23da52992fc427b92397a7dffd71c45ede3,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4, 5, 6, 7], 7),\n        EmbeddedCurvePoint {\n            x: 0x015441e9d29491b06563fac16fc76abf7a9534c715421d0de85d20dbe2965939,\n            y: 0x1d2575b0276f4e9087e6e07c2cb75aa1baafad127af4be5918ef8a2ef2fea8fc,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4, 5, 6, 7, 8], 8),\n        0x2f960e117482044dfc99d12fece2ef6862fba9242be4846c7c9a3e854325a55c,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4, 5, 6, 7, 8], 8),\n        EmbeddedCurvePoint {\n            x: 0x1657737676968887fceb6dd516382ea13b3a2c557f509811cd86d5d1199bc443,\n            y: 0x1f39f0cb569040105fa1e2f156521e8b8e08261e635a2b210bdc94e8d6d65f77,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4, 5, 6, 7, 8, 9], 9),\n        0x0c96db0790602dcb166cc4699e2d306c479a76926b81c2cb2aaa92d249ec7be7,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4, 5, 6, 7, 8, 9], 9),\n        EmbeddedCurvePoint {\n            x: 0x0a3ceae42d14914a432aa60ec7fded4af7dad7dd4acdbf2908452675ec67e06d,\n            y: 0xfc19761eaaf621ad4aec9a8b2e84a4eceffdba78f60f8b9391b0bd9345a2f2,\n            is_infinite: false,\n        },\n    );\n    assert_eq(\n        pedersen_hash_with_separator([1, 2, 3, 4, 5, 6, 7, 8, 9, 10], 10),\n        0x2cd37505871bc460a62ea1e63c7fe51149df5d0801302cf1cbc48beb8dff7e94,\n    );\n    assert_eq(\n        pedersen_commitment_with_separator([1, 2, 3, 4, 5, 6, 7, 8, 9, 10], 10),\n        EmbeddedCurvePoint {\n            x: 0x2fb3f8b3d41ddde007c8c3c62550f9a9380ee546fcc639ffbb3fd30c8d8de30c,\n            y: 0x300783be23c446b11a4c0fabf6c91af148937cea15fcf5fb054abf7f752ee245,\n            is_infinite: false,\n        },\n    );\n}\n",
 		path: "std/hash/mod.nr"
 	},
 	"51": {
-		source: "// District membership circuit (Barretenberg / Noir)\n// Mirrors Halo2 semantics with Poseidon hashing and domain-separated nullifier.\n\nuse dep::std::hash::poseidon2_permutation;\n\n// Default depth; build pipeline rewrites this per-class (14 / 20 / 22).\nglobal DEPTH: u32 = 14;\n\nfn poseidon2_hash2(left: Field, right: Field) -> Field {\n    let mut state: [Field; 4] = [left, right, 0, 0];\n    let out = poseidon2_permutation(state, 4);\n    out[0]\n}\n\nfn poseidon2_hash4(a: Field, b: Field, c: Field, d: Field) -> Field {\n    let mut state: [Field; 4] = [a, b, c, d];\n    let out = poseidon2_permutation(state, 4);\n    out[0]\n}\n\nfn compute_merkle_root(leaf: Field, merkle_path: [Field; DEPTH], leaf_index: u32) -> Field {\n    assert(leaf_index < (1u32 << DEPTH)); // range-constrain index\n\n    let mut node = leaf;\n    for i in 0..DEPTH {\n        let bit: bool = ((leaf_index >> i) & 1u32) == 1u32;\n        let sibling = merkle_path[i];\n        node = if bit { poseidon2_hash2(sibling, node) } else { poseidon2_hash2(node, sibling) };\n    }\n    node\n}\n\nfn compute_nullifier(user_secret: Field, campaign_id: Field, authority_hash: Field, epoch_id: Field) -> Field {\n    poseidon2_hash4(user_secret, campaign_id, authority_hash, epoch_id)\n}\n\n// Public inputs are marked `pub`; private witnesses remain secret.\nfn main(\n    merkle_root: Field,\n    nullifier: Field,\n    authority_hash: Field,\n    epoch_id: Field,\n    campaign_id: Field,\n    leaf: Field,\n    merkle_path: [Field; DEPTH],\n    leaf_index: u32,\n    user_secret: Field,\n) -> pub (Field, Field, Field, Field, Field) {\n    let computed_root = compute_merkle_root(leaf, merkle_path, leaf_index);\n    assert(computed_root == merkle_root);\n\n    let computed_nullifier = compute_nullifier(user_secret, campaign_id, authority_hash, epoch_id);\n    assert(computed_nullifier == nullifier);\n\n    (merkle_root, nullifier, authority_hash, epoch_id, campaign_id)\n}\n",
-		path: "/Users/noot/Documents/voter-protocol/packages/crypto/noir/district_membership/src/main.nr"
+		source: "use dep::std::hash::poseidon2_permutation;\n\n// Returns all 4 elements of the permutation state (not just state[0])\n// This is needed for implementing the sponge construction in TypeScript\nfn main(inputs: [Field; 4]) -> pub [Field; 4] {\n    poseidon2_permutation(inputs, 4)\n}\n",
+		path: "/Users/noot/Documents/voter-protocol/packages/crypto/noir/sponge_helper/src/main.nr"
 	}
 };
 const expression_width = {
@@ -2469,7 +2669,7 @@ const expression_width = {
 		width: 4
 	}
 };
-const circuitJson = {
+const spongeHelperCircuit = {
 	noir_version: noir_version,
 	hash: hash,
 	abi: abi,
@@ -2479,91 +2679,749 @@ const circuitJson = {
 	expression_width: expression_width
 };
 
+const ZERO_PAD = "0x" + "00".repeat(32);
+const DOMAIN_HASH2 = "0x" + 4731469 .toString(16).padStart(64, "0");
+const DOMAIN_HASH1 = "0x" + 4731213 .toString(16).padStart(64, "0");
+const DOMAIN_HASH3 = "0x" + 4731725 .toString(16).padStart(64, "0");
+const DOMAIN_HASH4 = "0x" + 4731981 .toString(16).padStart(64, "0");
+const DOMAIN_SPONGE_24 = "0x" + 0x534f4e47455f24n.toString(16).padStart(64, "0");
+const DEFAULT_BATCH_SIZE = 64;
+class Poseidon2Hasher {
+  static instance = null;
+  static initPromise = null;
+  // BN254 scalar field modulus (exported for validation in dependent packages)
+  static BN254_MODULUS = BigInt("21888242871839275222246405745257275088548364400416034343698204186575808495617");
+  noir;
+  spongeHelperNoir;
+  initialized = false;
+  /**
+   * Private constructor - use getInstance() instead
+   */
+  constructor(noir, spongeHelperNoir) {
+    this.noir = noir;
+    this.spongeHelperNoir = spongeHelperNoir;
+  }
+  /**
+   * Get singleton instance (thread-safe initialization)
+   *
+   * First call initializes the Noir circuit, subsequent calls return cached instance.
+   * Uses promise-based locking to prevent double initialization.
+   */
+  static async getInstance() {
+    if (Poseidon2Hasher.instance?.initialized) {
+      return Poseidon2Hasher.instance;
+    }
+    if (!Poseidon2Hasher.initPromise) {
+      Poseidon2Hasher.initPromise = Poseidon2Hasher.initialize().catch((err) => {
+        Poseidon2Hasher.initPromise = null;
+        throw err;
+      });
+    }
+    return Poseidon2Hasher.initPromise;
+  }
+  /**
+   * Initialize the Noir circuits (called once per process)
+   */
+  static async initialize() {
+    const circuit = fixturesCircuit;
+    const noir = new noir_js.Noir(circuit);
+    const spongeCircuit = spongeHelperCircuit;
+    const spongeHelperNoir = new noir_js.Noir(spongeCircuit);
+    const instance = new Poseidon2Hasher(noir, spongeHelperNoir);
+    instance.initialized = true;
+    Poseidon2Hasher.instance = instance;
+    return instance;
+  }
+  /**
+   * Reset singleton (for testing only)
+   */
+  static resetInstance() {
+    Poseidon2Hasher.instance = null;
+    Poseidon2Hasher.initPromise = null;
+  }
+  /**
+   * Hash two field elements: Poseidon2(left, right, DOMAIN_HASH2, 0)
+   *
+   * Matches the circuit: poseidon2_permutation([left, right, 0x48324d, 0], 4)[0]
+   * BA-003: Third state element carries the "H2M" domain separation tag to
+   * distinguish pair-hashing from single/quad modes in the Noir circuit.
+   *
+   * @param left - Left input (bigint or hex string)
+   * @param right - Right input (bigint or hex string)
+   * @returns Poseidon2 hash as bigint
+   */
+  async hashPair(left, right) {
+    const inputs = [
+      this.toHex(left),
+      this.toHex(right),
+      DOMAIN_HASH2,
+      // BA-003: Domain separation tag matching circuit
+      ZERO_PAD
+    ];
+    const result = await this.noir.execute({ inputs });
+    const returnValue = result.returnValue ?? result.return_value;
+    if (!returnValue) {
+      throw new Error("Noir circuit returned no value");
+    }
+    return BigInt(returnValue);
+  }
+  /**
+   * Hash a single field element: Poseidon2(value, DOMAIN_HASH1, 0, 0)
+   *
+   * SA-007 FIX: Now includes DOMAIN_HASH1 in slot 1 for domain separation.
+   * This prevents collision with hash4(value, 0, 0, 0).
+   *
+   * @param value - Input value (bigint or hex string)
+   * @returns Poseidon2 hash as bigint
+   */
+  async hashSingle(value) {
+    const inputs = [
+      this.toHex(value),
+      DOMAIN_HASH1,
+      // SA-007: Domain tag in slot 1 to prevent collision with hash4
+      ZERO_PAD,
+      ZERO_PAD
+    ];
+    const result = await this.noir.execute({ inputs });
+    const returnValue = result.returnValue ?? result.return_value;
+    if (!returnValue) {
+      throw new Error("Noir circuit returned no value");
+    }
+    return BigInt(returnValue);
+  }
+  /**
+   * Hash three field elements: Poseidon2(a, b, c, DOMAIN_HASH3)
+   *
+   * Two-tree architecture: Used for user leaf computation
+   * user_leaf = hash3(user_secret, cell_id, registration_salt)
+   *
+   * Domain separation: DOMAIN_HASH3 (0x48334d = "H3M") in slot 3 prevents
+   * collision with hash4(a, b, c, 0).
+   *
+   * @param a - First input
+   * @param b - Second input
+   * @param c - Third input
+   * @returns Poseidon2 hash as bigint
+   */
+  async hash3(a, b, c) {
+    const inputs = [
+      this.toHex(a),
+      this.toHex(b),
+      this.toHex(c),
+      DOMAIN_HASH3
+      // Domain tag in slot 3 to prevent collision with hash4
+    ];
+    const result = await this.noir.execute({ inputs });
+    const returnValue = result.returnValue ?? result.return_value;
+    if (!returnValue) {
+      throw new Error("Noir circuit returned no value");
+    }
+    return BigInt(returnValue);
+  }
+  /**
+   * Hash four field elements using 2-round Poseidon2 sponge (BR5-001).
+   *
+   * Matches Noir circuit poseidon2_hash4:
+   *   Round 1: state = permute([DOMAIN_HASH4, a, b, c])
+   *   Round 2: state[1] += d, state = permute(state), return state[0]
+   *
+   * Used for user leaf: hash4(user_secret, cell_id, registration_salt, authority_level)
+   *
+   * @param a - First input (user_secret)
+   * @param b - Second input (cell_id)
+   * @param c - Third input (registration_salt)
+   * @param d - Fourth input (authority_level)
+   * @returns Poseidon2 hash as bigint
+   */
+  async hash4(a, b, c, d) {
+    const round1Inputs = [
+      DOMAIN_HASH4,
+      this.toHex(a),
+      this.toHex(b),
+      this.toHex(c)
+    ];
+    const r1 = await this.spongeHelperNoir.execute({ inputs: round1Inputs });
+    const r1State = r1.returnValue ?? r1.return_value;
+    if (!r1State || !Array.isArray(r1State) || r1State.length !== 4) {
+      throw new Error("Sponge helper circuit returned invalid state array");
+    }
+    const s1PlusD = (BigInt(r1State[1]) + BigInt(this.toHex(d))) % Poseidon2Hasher.BN254_MODULUS;
+    const round2Inputs = [
+      r1State[0],
+      this.toHex(s1PlusD),
+      r1State[2],
+      r1State[3]
+    ];
+    const r2 = await this.noir.execute({ inputs: round2Inputs });
+    const returnValue = r2.returnValue ?? r2.return_value;
+    if (!returnValue) {
+      throw new Error("Noir circuit returned no value");
+    }
+    return BigInt(returnValue);
+  }
+  /**
+   * Batch hash multiple pairs with controlled concurrency
+   *
+   * PARALLELISM STRATEGY:
+   * - Divides pairs into batches of size `batchSize`
+   * - Each batch runs concurrently with Promise.all()
+   * - Batches run sequentially to prevent memory pressure
+   *
+   * @param pairs - Array of [left, right] pairs to hash
+   * @param batchSize - Max concurrent operations (default: 64)
+   * @returns Array of hashes in same order as input pairs
+   */
+  async hashPairsBatch(pairs, batchSize = DEFAULT_BATCH_SIZE) {
+    const results = new Array(pairs.length);
+    for (let i = 0; i < pairs.length; i += batchSize) {
+      const batch = pairs.slice(i, Math.min(i + batchSize, pairs.length));
+      const batchResults = await Promise.all(batch.map(([left, right]) => this.hashPair(left, right)));
+      for (let j = 0; j < batchResults.length; j++) {
+        results[i + j] = batchResults[j];
+      }
+    }
+    return results;
+  }
+  /**
+   * Batch hash multiple single values with controlled concurrency
+   *
+   * @param values - Array of values to hash
+   * @param batchSize - Max concurrent operations (default: 64)
+   * @returns Array of hashes in same order as input values
+   */
+  async hashSinglesBatch(values, batchSize = DEFAULT_BATCH_SIZE) {
+    const results = new Array(values.length);
+    for (let i = 0; i < values.length; i += batchSize) {
+      const batch = values.slice(i, Math.min(i + batchSize, values.length));
+      const batchResults = await Promise.all(batch.map((value) => this.hashSingle(value)));
+      for (let j = 0; j < batchResults.length; j++) {
+        results[i + j] = batchResults[j];
+      }
+    }
+    return results;
+  }
+  /**
+   * Poseidon2 sponge construction for absorbing 24 field elements.
+   * Rate = 3 (absorb 3 fields per round), Capacity = 1.
+   * State width = 4 (matches Poseidon2 permutation width).
+   *
+   * CRITICAL: State elements are ADDED TO, not overwritten.
+   * The spec (v0.1) had a bug that overwrote state — this is the correct version.
+   *
+   * ALGORITHM:
+   * 1. Initialize state with domain tag in capacity element: [DOMAIN_SPONGE_24, 0, 0, 0]
+   * 2. For each chunk of 3 inputs:
+   *    - ADD inputs to rate elements (state[1], state[2], state[3])
+   *    - Apply full Poseidon2 permutation
+   * 3. Handle remaining inputs (if not multiple of 3) by padding with zeros
+   * 4. Squeeze: return state[0] as output
+   *
+   * SECURITY NOTE: Adding to state (not overwriting) ensures proper chaining between
+   * rounds. Overwriting would discard the cryptographic state and create collision
+   * vulnerabilities (see TWO-TREE-AGENT-REVIEW-SUMMARY.md BLOCKER-3).
+   *
+   * @param inputs - Array of exactly 24 field elements (district IDs)
+   * @param domainTag - Domain separation tag (default: DOMAIN_SPONGE_24)
+   * @returns Poseidon2 sponge output as bigint (district commitment)
+   */
+  async poseidon2Sponge(inputs, domainTag = BigInt(DOMAIN_SPONGE_24)) {
+    if (inputs.length !== 24) {
+      throw new Error(`poseidon2Sponge expects 24 inputs, got ${inputs.length}`);
+    }
+    for (let i = 0; i < inputs.length; i++) {
+      if (inputs[i] < 0n) {
+        throw new Error(`Input ${i} is negative: ${inputs[i]}`);
+      }
+      if (inputs[i] >= Poseidon2Hasher.BN254_MODULUS) {
+        throw new Error(`Input ${i} exceeds BN254 field modulus: ${inputs[i]}`);
+      }
+    }
+    let state = [
+      domainTag % Poseidon2Hasher.BN254_MODULUS,
+      0n,
+      0n,
+      0n
+    ];
+    for (let i = 0; i < 8; i++) {
+      state[1] = (state[1] + inputs[i * 3]) % Poseidon2Hasher.BN254_MODULUS;
+      state[2] = (state[2] + inputs[i * 3 + 1]) % Poseidon2Hasher.BN254_MODULUS;
+      state[3] = (state[3] + inputs[i * 3 + 2]) % Poseidon2Hasher.BN254_MODULUS;
+      const stateHex = state.map((x) => this.toHex(x));
+      const result = await this.spongeHelperNoir.execute({ inputs: stateHex });
+      const returnValue = result.returnValue ?? result.return_value;
+      if (!returnValue || !Array.isArray(returnValue) || returnValue.length !== 4) {
+        throw new Error("Sponge helper circuit returned invalid state array");
+      }
+      state = returnValue.map((x) => BigInt(x));
+    }
+    return state[0];
+  }
+  /**
+   * Hash a string to BN254 field element
+   *
+   * Chunking strategy:
+   * - UTF-8 encode string
+   * - Split into 31-byte chunks (safe for 254-bit BN254 field)
+   * - Commit to byte length first, then fold in chunks iteratively:
+   *     hash = hashSingle(length)
+   *     hash = hashPair(hash, chunk[0])
+   *     hash = hashPair(hash, chunk[1])
+   *     ...
+   *
+   * LENGTH PREFIX (BA-022 fix):
+   * Without a length commitment, "" and "\x00" both reduce to hashSingle(0n).
+   * More generally, any two strings whose chunk representations share a common
+   * suffix (due to trailing zero bytes) could collide. Hashing the byte length
+   * as the first element makes every distinct string length a separate domain,
+   * eliminating this class of collision.
+   *
+   * @param str - String to hash
+   * @returns Poseidon2 hash as bigint
+   */
+  async hashString(str) {
+    const bytes = Buffer.from(str, "utf-8");
+    const chunks = [];
+    for (let i = 0; i < bytes.length; i += 31) {
+      const chunk = bytes.subarray(i, Math.min(i + 31, bytes.length));
+      chunks.push(BigInt("0x" + chunk.toString("hex")));
+    }
+    let hash = await this.hashSingle(BigInt(bytes.length));
+    for (const chunk of chunks) {
+      hash = await this.hashPair(hash, chunk);
+    }
+    return hash;
+  }
+  /**
+   * Batch hash multiple strings with controlled concurrency
+   *
+   * @param strings - Array of strings to hash
+   * @param batchSize - Max concurrent operations (default: 64)
+   * @returns Array of hashes in same order as input strings
+   */
+  async hashStringsBatch(strings, batchSize = DEFAULT_BATCH_SIZE) {
+    const results = new Array(strings.length);
+    for (let i = 0; i < strings.length; i += batchSize) {
+      const batch = strings.slice(i, Math.min(i + batchSize, strings.length));
+      const batchResults = await Promise.all(batch.map((str) => this.hashString(str)));
+      for (let j = 0; j < batchResults.length; j++) {
+        results[i + j] = batchResults[j];
+      }
+    }
+    return results;
+  }
+  /**
+   * Convert value to 0x-prefixed 64-char hex string.
+   * BA-016: Validates hex characters, rejects negative bigints,
+   * and enforces BN254 field modulus bound.
+   */
+  toHex(value) {
+    if (typeof value === "bigint") {
+      if (value < 0n) {
+        throw new Error(`Negative bigint not allowed: ${value}`);
+      }
+      if (value >= Poseidon2Hasher.BN254_MODULUS) {
+        throw new Error(`Value exceeds BN254 field modulus: ${value}`);
+      }
+      return "0x" + value.toString(16).padStart(64, "0");
+    }
+    const hex = value.startsWith("0x") ? value.slice(2) : value;
+    if (!/^[0-9a-fA-F]*$/.test(hex)) {
+      throw new Error(`Invalid hex string: ${value}`);
+    }
+    const padded = hex.padStart(64, "0");
+    const asBigInt = BigInt("0x" + padded);
+    if (asBigInt >= Poseidon2Hasher.BN254_MODULUS) {
+      throw new Error(`Value exceeds BN254 field modulus: 0x${padded}`);
+    }
+    return "0x" + padded;
+  }
+}
+
+/**
+ * VOTER Protocol Crypto SDK
+ *
+ * Cryptography library providing:
+ * - Poseidon2 hashing (Noir stdlib compatibility for ZK circuits)
+ * - District resolution services
+ * - Geocoding services
+ *
+ * @packageDocumentation
+ */
+// Export BN254_MODULUS for field validation in dependent packages (BR3-003 fix)
+const BN254_MODULUS = Poseidon2Hasher.BN254_MODULUS;
+
+const twoTreeCircuitLoaders = {
+  18: async () => {
+    const module = await Promise.resolve().then(() => require('./two_tree_membership_18-Dfr1mYE-.cjs'));
+    return module.default;
+  },
+  20: async () => {
+    const module = await Promise.resolve().then(() => require('./two_tree_membership_20-jDMJJKIC.cjs'));
+    return module.default;
+  },
+  22: async () => {
+    const module = await Promise.resolve().then(() => require('./two_tree_membership_22-CjwYhC_e.cjs'));
+    return module.default;
+  },
+  24: async () => {
+    const module = await Promise.resolve().then(() => require('./two_tree_membership_24-Br8I-xLQ.cjs'));
+    return module.default;
+  }
+};
 function detectThreads() {
   const hasSharedArrayBuffer = typeof SharedArrayBuffer !== "undefined";
   if (!hasSharedArrayBuffer) {
-    console.log("[NoirProver] SharedArrayBuffer unavailable - using single-threaded mode");
+    console.log("[TwoTreeNoirProver] SharedArrayBuffer unavailable - using single-threaded mode");
     return 1;
   }
   const cores = typeof navigator !== "undefined" ? navigator.hardwareConcurrency || 4 : 4;
   return Math.min(cores, 8);
 }
-class NoirProver {
+function parsePublicInput(hex, label) {
+  if (typeof hex !== "string" || !/^0x[0-9a-fA-F]+$/.test(hex)) {
+    throw new Error(
+      `BR5-006: Invalid public input format for ${label}: expected 0x-prefixed hex string, got ${typeof hex === "string" ? `"${hex.slice(0, 20)}"` : typeof hex}`
+    );
+  }
+  const val = BigInt(hex);
+  if (val >= BN254_MODULUS) {
+    throw new Error(
+      `BR5-006: Public input ${label} (${val}) exceeds BN254 scalar field modulus. Possible field aliasing attack.`
+    );
+  }
+  return val;
+}
+function toHex(value) {
+  if (value < 0n) {
+    throw new Error("Field element cannot be negative");
+  }
+  if (value >= BN254_MODULUS) {
+    throw new Error(`Field element ${value} exceeds BN254 scalar field modulus`);
+  }
+  return "0x" + value.toString(16).padStart(64, "0");
+}
+class TwoTreeNoirProver {
   backend = null;
   noir = null;
-  config;
   threads;
+  depth;
   constructor(config = {}) {
-    this.config = {
-      circuitName: "district_membership",
-      ...config
-    };
     this.threads = config.threads ?? detectThreads();
+    this.depth = config.depth ?? DEFAULT_CIRCUIT_DEPTH;
   }
+  // ========================================================================
+  // Initialization
+  // ========================================================================
   /**
-   * Initialize the prover (must be called before generating proofs)
+   * Initialize the prover (must be called before generating proofs).
+   * Lazily loads the circuit for the configured depth.
    */
   async init() {
     if (this.backend && this.noir) return;
-    console.log(`[NoirProver] Initializing with ${this.threads} thread(s)...`);
+    console.log(`[TwoTreeNoirProver] Initializing depth=${this.depth} with ${this.threads} thread(s)...`);
     const start = Date.now();
-    const circuit = circuitJson;
+    const loader = twoTreeCircuitLoaders[this.depth];
+    if (!loader) {
+      throw new Error(`Unsupported circuit depth: ${this.depth}. Must be 18, 20, 22, or 24.`);
+    }
+    const circuit = await loader();
     this.noir = new noir_js.Noir(circuit);
     this.backend = new bb_js.UltraHonkBackend(circuit.bytecode, { threads: this.threads });
-    console.log(`[NoirProver] Initialized in ${Date.now() - start}ms (${this.threads} threads)`);
+    console.log(`[TwoTreeNoirProver] Initialized depth=${this.depth} in ${Date.now() - start}ms (${this.threads} threads)`);
   }
   /**
-   * Pre-warm the prover by initializing backend
-   * Call this on app load to hide latency from user
+   * Get the circuit depth for this prover instance.
+   */
+  getDepth() {
+    return this.depth;
+  }
+  /**
+   * Pre-warm the prover by initializing backend.
+   * Call this on app load to hide latency from user.
    */
   async warmup() {
     await this.init();
-    console.log("[NoirProver] Warmup complete (backend initialized)");
+    console.log("[TwoTreeNoirProver] Warmup complete (backend initialized)");
   }
+  // ========================================================================
+  // Input Validation
+  // ========================================================================
+  /** Maximum allowed Merkle depth (prevents DoS via oversized arrays) */
+  static MAX_MERKLE_DEPTH = 24;
   /**
-   * Generate a ZK proof for district membership
+   * Validate all inputs before circuit execution.
+   * Throws descriptive errors for any invalid input.
    */
-  async prove(inputs) {
+  validateInputs(inputs) {
+    if (inputs.userSecret === 0n) {
+      throw new Error(
+        "user_secret cannot be zero (SA-011). A zero secret produces predictable nullifiers."
+      );
+    }
+    if (inputs.cellId === 0n) {
+      throw new Error(
+        "cell_id cannot be zero. A zero cell ID produces a degenerate cell map leaf."
+      );
+    }
+    if (inputs.actionDomain === 0n) {
+      throw new Error(
+        "action_domain cannot be zero. A zero action domain produces a universal nullifier that would be consumed across ALL elections, permanently blocking the user."
+      );
+    }
+    if (inputs.registrationSalt === 0n) {
+      throw new Error(
+        "registration_salt cannot be zero. A zero salt reduces leaf preimage entropy."
+      );
+    }
+    if (inputs.identityCommitment === 0n) {
+      throw new Error(
+        "identity_commitment cannot be zero. NUL-001 requires a verified identity commitment from self.xyz/didit to prevent Sybil attacks via re-registration."
+      );
+    }
+    validateAuthorityLevel(inputs.authorityLevel);
+    if (!Array.isArray(inputs.districts) || inputs.districts.length !== DISTRICT_SLOT_COUNT) {
+      throw new Error(
+        `districts array must have exactly ${DISTRICT_SLOT_COUNT} elements, got ${inputs.districts?.length ?? "non-array"}`
+      );
+    }
+    const nonZeroDistricts = /* @__PURE__ */ new Set();
+    for (let i = 0; i < inputs.districts.length; i++) {
+      const d = inputs.districts[i];
+      if (d < 0n) {
+        throw new Error(`districts[${i}] cannot be negative`);
+      }
+      if (d >= BN254_MODULUS) {
+        throw new Error(`districts[${i}] exceeds BN254 scalar field modulus`);
+      }
+      if (d !== 0n) {
+        if (nonZeroDistricts.has(d)) {
+          throw new Error(
+            `BR5-017: Duplicate district ID at slot ${i}: 0x${d.toString(16)}. Each non-zero district must appear in exactly one positional slot.`
+          );
+        }
+        nonZeroDistricts.add(d);
+      }
+    }
+    const fieldChecks = [
+      [inputs.userRoot, "userRoot"],
+      [inputs.cellMapRoot, "cellMapRoot"],
+      [inputs.nullifier, "nullifier"],
+      [inputs.actionDomain, "actionDomain"],
+      [inputs.userSecret, "userSecret"],
+      [inputs.cellId, "cellId"],
+      [inputs.registrationSalt, "registrationSalt"],
+      [inputs.identityCommitment, "identityCommitment"]
+    ];
+    for (const [val, name] of fieldChecks) {
+      if (val < 0n) {
+        throw new Error(`${name} cannot be negative`);
+      }
+      if (val >= BN254_MODULUS) {
+        throw new Error(`${name} exceeds BN254 scalar field modulus`);
+      }
+    }
+    if (!Array.isArray(inputs.userPath)) {
+      throw new Error("userPath must be an array");
+    }
+    if (inputs.userPath.length > TwoTreeNoirProver.MAX_MERKLE_DEPTH) {
+      throw new Error(
+        `userPath exceeds maximum allowed depth: ${inputs.userPath.length} > ${TwoTreeNoirProver.MAX_MERKLE_DEPTH}`
+      );
+    }
+    if (inputs.userPath.length !== this.depth) {
+      throw new Error(
+        `userPath length mismatch: expected ${this.depth}, got ${inputs.userPath.length}. Did you initialize the prover with the wrong depth?`
+      );
+    }
+    if (!Array.isArray(inputs.cellMapPath)) {
+      throw new Error("cellMapPath must be an array");
+    }
+    if (inputs.cellMapPath.length !== this.depth) {
+      throw new Error(
+        `cellMapPath length mismatch: expected ${this.depth}, got ${inputs.cellMapPath.length}`
+      );
+    }
+    if (!Array.isArray(inputs.cellMapPathBits)) {
+      throw new Error("cellMapPathBits must be an array");
+    }
+    if (inputs.cellMapPathBits.length !== this.depth) {
+      throw new Error(
+        `cellMapPathBits length mismatch: expected ${this.depth}, got ${inputs.cellMapPathBits.length}`
+      );
+    }
+    for (let i = 0; i < inputs.cellMapPathBits.length; i++) {
+      if (inputs.cellMapPathBits[i] !== 0 && inputs.cellMapPathBits[i] !== 1) {
+        throw new Error(
+          `cellMapPathBits[${i}] must be 0 or 1, got ${inputs.cellMapPathBits[i]}`
+        );
+      }
+    }
+    if (inputs.userIndex < 0 || inputs.userIndex >= 2 ** this.depth) {
+      throw new Error(
+        `userIndex out of range: must be 0 to ${2 ** this.depth - 1}, got ${inputs.userIndex}`
+      );
+    }
+    for (let i = 0; i < inputs.userPath.length; i++) {
+      if (inputs.userPath[i] < 0n || inputs.userPath[i] >= BN254_MODULUS) {
+        throw new Error(`userPath[${i}] outside BN254 scalar field`);
+      }
+    }
+    for (let i = 0; i < inputs.cellMapPath.length; i++) {
+      if (inputs.cellMapPath[i] < 0n || inputs.cellMapPath[i] >= BN254_MODULUS) {
+        throw new Error(`cellMapPath[${i}] outside BN254 scalar field`);
+      }
+    }
+  }
+  // ========================================================================
+  // Input Formatting
+  // ========================================================================
+  /**
+   * Format TypeScript inputs into the Noir circuit's expected parameter names
+   * and types (snake_case, hex strings, integer arrays).
+   *
+   * This is exposed as a method for testing purposes.
+   */
+  formatInputs(inputs) {
+    return {
+      // Public inputs
+      user_root: toHex(inputs.userRoot),
+      cell_map_root: toHex(inputs.cellMapRoot),
+      districts: inputs.districts.map(toHex),
+      nullifier: toHex(inputs.nullifier),
+      action_domain: toHex(inputs.actionDomain),
+      authority_level: toHex(BigInt(inputs.authorityLevel)),
+      // Private inputs (witnesses)
+      user_secret: toHex(inputs.userSecret),
+      cell_id: toHex(inputs.cellId),
+      registration_salt: toHex(inputs.registrationSalt),
+      identity_commitment: toHex(inputs.identityCommitment),
+      // Tree 1: Standard Merkle proof
+      user_path: inputs.userPath.map(toHex),
+      user_index: inputs.userIndex,
+      // Tree 2: SMT proof
+      cell_map_path: inputs.cellMapPath.map(toHex),
+      cell_map_path_bits: inputs.cellMapPathBits
+    };
+  }
+  // ========================================================================
+  // Proof Generation
+  // ========================================================================
+  /**
+   * Generate a ZK proof for two-tree membership.
+   *
+   * The circuit internally verifies:
+   * 1. User leaf in Tree 1: hash4(user_secret, cell_id, registration_salt, authority_level)
+   * 2. District commitment: poseidon2_sponge_24(districts)
+   * 3. Cell map leaf in Tree 2: hash2(cell_id, district_commitment)
+   * 4. Nullifier: hash2(identity_commitment, action_domain) (NUL-001)
+   * 5. Authority level in [1, 5]
+   *
+   * @param inputs - All public and private inputs for the circuit
+   * @returns Proof bytes and public inputs as hex strings
+   */
+  async generateProof(inputs) {
+    this.validateInputs(inputs);
     await this.init();
-    console.log("[NoirProver] Generating witness...");
+    console.log("[TwoTreeNoirProver] Generating witness...");
     const witnessStart = Date.now();
-    const noirInputs = {
-      merkle_root: inputs.merkleRoot,
-      nullifier: inputs.nullifier,
-      authority_hash: inputs.authorityHash,
-      epoch_id: inputs.epochId,
-      campaign_id: inputs.campaignId,
-      leaf: inputs.leaf,
-      merkle_path: inputs.merklePath,
-      leaf_index: inputs.leafIndex,
-      user_secret: inputs.userSecret
-    };
+    const noirInputs = this.formatInputs(inputs);
     const { witness } = await this.noir.execute(noirInputs);
-    console.log(`[NoirProver] Witness generated in ${Date.now() - witnessStart}ms`);
-    console.log("[NoirProver] Generating proof...");
+    console.log(`[TwoTreeNoirProver] Witness generated in ${Date.now() - witnessStart}ms`);
+    console.log("[TwoTreeNoirProver] Generating proof...");
     const proofStart = Date.now();
     const { proof, publicInputs } = await this.backend.generateProof(witness);
-    console.log(`[NoirProver] Proof generated in ${Date.now() - proofStart}ms`);
+    console.log(`[TwoTreeNoirProver] Proof generated in ${Date.now() - proofStart}ms`);
+    if (publicInputs.length !== TWO_TREE_PUBLIC_INPUT_COUNT) {
+      throw new Error(
+        `Unexpected public input count: expected ${TWO_TREE_PUBLIC_INPUT_COUNT}, got ${publicInputs.length}`
+      );
+    }
     return {
       proof,
-      publicInputs: {
-        merkleRoot: publicInputs[0] ?? inputs.merkleRoot,
-        nullifier: publicInputs[1] ?? inputs.nullifier,
-        authorityHash: publicInputs[2] ?? inputs.authorityHash,
-        epochId: publicInputs[3] ?? inputs.epochId,
-        campaignId: publicInputs[4] ?? inputs.campaignId
-      }
+      publicInputs
     };
   }
+  // ========================================================================
+  // Proof Verification
+  // ========================================================================
   /**
-   * Verify a proof
+   * Verify a two-tree membership proof.
+   *
+   * BR5-006: Validates public input count before backend verification.
+   * For full public input binding (matching proof outputs to expected values),
+   * use verifyProofWithExpectedInputs().
+   *
+   * @param proofResult - The proof result from generateProof()
+   * @returns true if the proof is valid
    */
-  async verify(proof, publicInputs) {
+  async verifyProof(proofResult) {
+    if (proofResult.publicInputs.length !== TWO_TREE_PUBLIC_INPUT_COUNT) {
+      throw new Error(
+        `BR5-006: Public input count mismatch: expected ${TWO_TREE_PUBLIC_INPUT_COUNT}, got ${proofResult.publicInputs.length}. Possible proof tampering.`
+      );
+    }
     await this.init();
-    return this.backend.verifyProof({ proof, publicInputs });
+    return this.backend.verifyProof({
+      proof: proofResult.proof,
+      publicInputs: proofResult.publicInputs
+    });
   }
   /**
-   * Clean up resources
+   * Verify a proof AND validate that public inputs match expected values.
+   *
+   * BR5-006 FIX: The base verifyProof() only checks that the proof is
+   * cryptographically valid for its public inputs. It does NOT verify that
+   * those inputs match what the caller intended. An attacker could substitute
+   * a valid proof generated for different inputs (e.g., different districts
+   * or a different authority level).
+   *
+   * This method binds the proof to the caller's expected values by checking:
+   * - user_root matches
+   * - cell_map_root matches
+   * - All 24 districts match
+   * - nullifier matches
+   * - action_domain matches
+   * - authority_level matches
+   *
+   * @param proofResult - The proof from generateProof()
+   * @param expectedInputs - The original inputs used for proof generation
+   * @returns true if proof is valid AND public inputs match expectations
+   */
+  async verifyProofWithExpectedInputs(proofResult, expectedInputs) {
+    const valid = await this.verifyProof(proofResult);
+    if (!valid) return false;
+    const pi = proofResult.publicInputs;
+    const checks = [
+      [0, expectedInputs.userRoot, "user_root"],
+      [1, expectedInputs.cellMapRoot, "cell_map_root"],
+      [26, expectedInputs.nullifier, "nullifier"],
+      [27, expectedInputs.actionDomain, "action_domain"],
+      [28, BigInt(expectedInputs.authorityLevel), "authority_level"]
+    ];
+    for (const [idx, expected, name] of checks) {
+      const actual = parsePublicInput(pi[idx], `${name}[${idx}]`);
+      if (actual !== expected) {
+        throw new Error(
+          `BR5-006: Public input mismatch at index ${idx} (${name}): expected ${expected}, got ${actual}`
+        );
+      }
+    }
+    for (let i = 0; i < DISTRICT_SLOT_COUNT; i++) {
+      const actual = parsePublicInput(pi[2 + i], `district[${i}]`);
+      const expected = expectedInputs.districts[i];
+      if (actual !== expected) {
+        throw new Error(
+          `BR5-006: District mismatch at slot ${i} (public input index ${2 + i}): expected ${expected}, got ${actual}`
+        );
+      }
+    }
+    return true;
+  }
+  // ========================================================================
+  // Lifecycle
+  // ========================================================================
+  /**
+   * Clean up resources (WASM memory, web workers).
    */
   async destroy() {
     if (this.backend) {
@@ -2573,6 +3431,54 @@ class NoirProver {
     }
   }
 }
+const twoTreeProverInstances = /* @__PURE__ */ new Map();
+const twoTreeInitPromises = /* @__PURE__ */ new Map();
+async function getTwoTreeProverForDepth(depth = DEFAULT_CIRCUIT_DEPTH, config) {
+  const existing = twoTreeProverInstances.get(depth);
+  if (existing) {
+    return existing;
+  }
+  const existingPromise = twoTreeInitPromises.get(depth);
+  if (existingPromise) {
+    return existingPromise;
+  }
+  let resolveInit;
+  let rejectInit;
+  const initPromise = new Promise((resolve, reject) => {
+    resolveInit = resolve;
+    rejectInit = reject;
+  });
+  twoTreeInitPromises.set(depth, initPromise);
+  (async () => {
+    try {
+      const prover = new TwoTreeNoirProver({ ...config, depth });
+      await prover.init();
+      twoTreeProverInstances.set(depth, prover);
+      twoTreeInitPromises.delete(depth);
+      resolveInit(prover);
+    } catch (err) {
+      twoTreeInitPromises.delete(depth);
+      rejectInit(err instanceof Error ? err : new Error(String(err)));
+    }
+  })();
+  return initPromise;
+}
+async function resetTwoTreeProverSingleton() {
+  const destroyPromises = Array.from(twoTreeProverInstances.values()).map(
+    (prover) => prover.destroy()
+  );
+  await Promise.all(destroyPromises);
+  twoTreeProverInstances.clear();
+  twoTreeInitPromises.clear();
+}
+async function resetTwoTreeProverForDepth(depth) {
+  const prover = twoTreeProverInstances.get(depth);
+  if (prover) {
+    await prover.destroy();
+    twoTreeProverInstances.delete(depth);
+  }
+  twoTreeInitPromises.delete(depth);
+}
 
 function checkCrossOriginIsolation() {
   const isolated = typeof crossOriginIsolated !== "undefined" && crossOriginIsolated;
@@ -2628,6 +3534,18 @@ if (typeof globalThis !== "undefined" && !globalThis.Buffer) {
   globalThis.Buffer = buffer.Buffer;
 }
 
+exports.DEFAULT_CIRCUIT_DEPTH = DEFAULT_CIRCUIT_DEPTH;
+exports.DISTRICT_SLOT_COUNT = DISTRICT_SLOT_COUNT;
 exports.NoirProver = NoirProver;
+exports.TWO_TREE_PUBLIC_INPUT_COUNT = TWO_TREE_PUBLIC_INPUT_COUNT;
+exports.TwoTreeNoirProver = TwoTreeNoirProver;
 exports.checkCrossOriginIsolation = checkCrossOriginIsolation;
+exports.getProver = getProver;
+exports.getProverForDepth = getProverForDepth;
+exports.getTwoTreeProverForDepth = getTwoTreeProverForDepth;
 exports.requireCrossOriginIsolation = requireCrossOriginIsolation;
+exports.resetProverForDepth = resetProverForDepth;
+exports.resetProverSingleton = resetProverSingleton;
+exports.resetTwoTreeProverForDepth = resetTwoTreeProverForDepth;
+exports.resetTwoTreeProverSingleton = resetTwoTreeProverSingleton;
+exports.validateAuthorityLevel = validateAuthorityLevel;