@zkthunder_/sdk 0.1.0 → 0.2.0

package/README.md

@@ -77,6 +77,23 @@ await new zk.Chain().verifyLineage(lin.proof, ctx);                 // LineageVe
 // record it: send zk.encodeSubmit(lin.proof, ctx) to zk.MAINNET.publicProofs
 ```
 
+## V2: full-coordinate verifiers on BN254
+
+The same constructions on the BN254 curve, where the EVM has built-in point
+addition and multiplication, so the V2 verifiers compute every scalar
+multiplication themselves and compare whole points instead of 160 bit
+addresses. Deployed on mainnet on 13 September 2026; the anchors and the gate
+still use the V1 verifiers until the audit has compared the two, so use V2 for
+your own verification and keep V1 for anything that feeds the live contracts.
+V1 and V2 proofs are not interchangeable.
+
+```js
+const rg = zk.proveRangeV2({ value: 1250n, threshold: 1000n, ctx: zk.context("my-app", "balance-check") });
+await new zk.Chain().verifyRangeV2(rg.proof, rg.ctx);      // true, checked on whole curve points
+const lin = zk.proveLineageV2("previous state", "new state", ctx);   // 17 words instead of 23
+await new zk.Chain().verifyLineageV2(lin.proof, ctx);
+```
+
 ## API
 
 | Function | Purpose |
@@ -85,9 +102,10 @@ await new zk.Chain().verifyLineage(lin.proof, ctx);                 // LineageVe
 | `proveLineage(prev, out, ctx)` / `verifyLineage(proof, ctx)` | 23 word bundle for LineageVerifier |
 | `proveRange({ value, threshold, ctx, blinding? })` / `verifyRange(proof, ctx)` | range proof for RangeVerifier |
 | `proveTrustless(prev, out, ctx)` / `verifyTrustless(proof, ctx, prev, out)` | 37 word bound bundle for TrustlessAnchor |
+| `commitV2`, `proveLineageV2` / `verifyLineageV2`, `proveRangeV2` / `verifyRangeV2`, `proveTrustlessV2` / `verifyTrustlessV2` | the same on BN254 for the V2 verifiers (17, 291 and 23 words) |
 | `context(...parts)`, `purposeId(name)`, `gateContext(gate, user, purpose)` | context words that bind proofs to their use |
 | `encodeVerify`, `encodeVerifyBound`, `encodeSubmit`, `encodeAttest`, `encodeGateProve`, `encodeIsEligible` | calldata for the deployed contracts |
-| `new Chain({ rpcUrl?, addresses? })` | `verifyLineage`, `verifyRange`, `verifyTrustless`, `isEligible`, `lineage`, `record`, `auditAnchor` |
+| `new Chain({ rpcUrl?, addresses? })` | `verifyLineage`, `verifyRange`, `verifyTrustless`, `verifyLineageV2`, `verifyRangeV2`, `verifyTrustlessV2`, `isEligible`, `lineage`, `record`, `auditAnchor` |
 | `MAINNET` | deployed addresses on chain 4663 |
 
 Sending transactions is left to whatever wallet library you already use: the
@@ -97,8 +115,9 @@ encoders return calldata, and `MAINNET` has the addresses.
 
 - Range proofs cover a 32 bit difference between value and threshold and cost
   about 1.9 million gas to verify on chain. Zero is not a valid threshold.
-- The on-chain verifiers compare 160 bit point addresses (the ecrecover trick);
-  a full coordinate check is on the roadmap.
+- The V1 verifiers, which the live anchors and the gate use, compare 160 bit
+  point addresses (the ecrecover trick). The V2 verifiers check whole points on
+  BN254 and are deployed; the anchors switch to them after the audit.
 - These proofs establish commitment structure and lineage linkage. They do not
   prove a state transition was computed correctly; that is the zkVM tier.
 

package/index.d.ts

@@ -5,6 +5,8 @@ export interface Addresses {
   proofAnchor: string; lineageVerifier: string; publicProofs: string; rangeVerifier: string; boundVerifier: string; trustlessAnchor: string;
   /** empty until PrivateGate is deployed */
   privateGate: string;
+  /** V2 verifiers on BN254 (full-coordinate checks), deployed 2026-09-13; not yet in the anchoring path */
+  lineageVerifierV2: string; boundVerifierV2: string; rangeVerifierV2: string;
 }
 export const MAINNET: Readonly<Addresses>;
 export const NBITS: number;
@@ -17,6 +19,15 @@ export function verifyRange(proof: string | Uint8Array | bigint[], ctx: Bytes32L
 export function proveTrustless(prevRoot: Bytes32Like, outRoot: Bytes32Like, ctx: Bytes32Like): { proof: string; words: bigint[]; ctx: string; commitments: { in: Point; out: Point }; verified: boolean };
 export function verifyTrustless(proof: string | Uint8Array | bigint[], ctx: Bytes32Like, prevRoot: Bytes32Like, outRoot: Bytes32Like): boolean;
 
+// V2: the same constructions on BN254 for the full-coordinate verifiers (17, 291 and 23 word bundles)
+export function commitV2(value: Bytes32Like, blinding?: bigint | string | number): { commitment: Point; blinding: string };
+export function proveLineageV2(prevRoot: Bytes32Like, outRoot: Bytes32Like, ctx: Bytes32Like): { proof: string; words: bigint[]; ctx: string; commitments: { in: Point; out: Point }; verified: boolean };
+export function verifyLineageV2(proof: string | Uint8Array | bigint[], ctx: Bytes32Like): boolean;
+export function proveRangeV2(args: { value: bigint | number | string; threshold: bigint | number | string; ctx: Bytes32Like; blinding?: bigint | string }): { proof: string; words: bigint[]; ctx: string; commitment: Point; blinding: string; threshold: string; bits: number; verified: boolean };
+export function verifyRangeV2(proof: string | Uint8Array | bigint[], ctx: Bytes32Like): boolean;
+export function proveTrustlessV2(prevRoot: Bytes32Like, outRoot: Bytes32Like, ctx: Bytes32Like): { proof: string; words: bigint[]; ctx: string; commitments: { in: Point; out: Point }; verified: boolean };
+export function verifyTrustlessV2(proof: string | Uint8Array | bigint[], ctx: Bytes32Like, prevRoot: Bytes32Like, outRoot: Bytes32Like): boolean;
+
 export function context(...parts: Array<string | Uint8Array>): Uint8Array;
 export function purposeId(name: string): Uint8Array;
 export function gateContext(gate: string, user: string, purpose: string): Uint8Array;
@@ -41,6 +52,9 @@ export class Chain {
   verifyLineage(proof: string | Uint8Array | bigint[], ctx: Bytes32Like): Promise<boolean>;
   verifyRange(proof: string | Uint8Array | bigint[], ctx: Bytes32Like): Promise<boolean>;
   verifyTrustless(proof: string | Uint8Array | bigint[], ctx: Bytes32Like, prevRoot: Bytes32Like, outRoot: Bytes32Like): Promise<boolean>;
+  verifyLineageV2(proof: string | Uint8Array | bigint[], ctx: Bytes32Like): Promise<boolean>;
+  verifyRangeV2(proof: string | Uint8Array | bigint[], ctx: Bytes32Like): Promise<boolean>;
+  verifyTrustlessV2(proof: string | Uint8Array | bigint[], ctx: Bytes32Like, prevRoot: Bytes32Like, outRoot: Bytes32Like): Promise<boolean>;
   isEligible(gate: string, user: string, purpose: string, minThreshold: bigint | number | string, maxAge?: number): Promise<boolean>;
   lineage(): Promise<{ contract: string; lastSeq: number; lastEndBlock: number; lastRoot: string; latestBlock: number }>;
   record(seq: number): Promise<TrustlessRecord>;

package/index.js

@@ -9,8 +9,11 @@ const S = require("./lib/sigma.js");
 const { proveBundle, verifyBundleJS } = require("./lib/prove.js");
 const R = require("./lib/range.js");
 const T = require("./lib/trustless.js");
+const B2 = require("./lib/bn254.js");
+const P2 = require("./lib/prove-v2.js");
+const R2 = require("./lib/range-v2.js");
 
-/** Deployed addresses on Robinhood Chain mainnet (chain id 4663), all with verified source. */
+/** Deployed addresses on Robinhood Chain mainnet (chain id 4663). V1 contracts have verified source; the V2 verifiers were deployed on 2026-09-13 and their verification is in progress. */
 const MAINNET = Object.freeze({
   chainId: 4663,
   rpcUrl: "https://rpc.mainnet.chain.robinhood.com",
@@ -23,6 +26,10 @@ const MAINNET = Object.freeze({
   trustlessAnchor: "0x6DF5BcE4799EdF35C98b5727aa25a7F2b67479a4",
   /** PrivateGate permissioning contract (deployed 2026-09-13); pass your own gate via new Chain({ addresses: { privateGate } }) */
   privateGate: "0xEc773A186532aC6080C258Edf883B726b13e2638",
+  /** V2 verifiers on BN254 (full-coordinate checks, EVM precompiles), deployed 2026-09-13. Not yet in the anchoring path: the anchors and the gate still use the verifiers above. */
+  lineageVerifierV2: "0xf11AB9C95eFDBDE842D9fe59008C1F74709f93e0",
+  boundVerifierV2: "0xA8De92742Bc88a746121866D0c2509027159ec54",
+  rangeVerifierV2: "0x24f35F760A499EEeF1E39B6FF8c34703102c6E21",
 });
 
 /* ------------------------------------------------------------ bytes */
@@ -104,6 +111,46 @@ function proveTrustless(prevRoot, outRoot, ctx) {
 /** Exact mirror of BoundLineageVerifier.verifyBound. */
 const verifyTrustless = (proof, ctx, prevRoot, outRoot) => T.verifyTrustlessJS(proofWords(proof), toBytes32(ctx), toBytes32(prevRoot), toBytes32(outRoot));
 
+/* ------------------------------------------------------------ V2: BN254, full-coordinate verifiers */
+/** Pedersen commitment on BN254, for the V2 verifiers. Same shape as commit(). */
+function commitV2(value, blinding) {
+  const c = B2.commit(toBytes32(value), blinding === undefined ? undefined : big(blinding));
+  return { commitment: point(c.C), blinding: "0x" + c.r.toString(16).padStart(64, "0") };
+}
+/** V2 lineage bundle (17 words, 544 bytes) for LineageVerifierV2: no helper points, whole-point checks on chain. */
+function proveLineageV2(prevRoot, outRoot, ctx) {
+  const c = toBytes32(ctx);
+  const b = P2.proveBundleV2(toBytes32(prevRoot), toBytes32(outRoot), c);
+  return { proof: b.hex, words: b.words, ctx: hex(c), commitments: { in: point(b.commitments.C_in), out: point(b.commitments.C_out) }, verified: P2.verifyBundleV2JS(b.words, c) };
+}
+/** Exact mirror of LineageVerifierV2.verify. */
+const verifyLineageV2 = (proof, ctx) => P2.verifyBundleV2JS(proofWords(proof), toBytes32(ctx));
+
+/** V2 range proof (291 words) for RangeVerifierV2. Same rules as proveRange; the commitment lives on BN254. */
+function proveRangeV2({ value, threshold, ctx, blinding }) {
+  const v = big(value), x = big(threshold);
+  if (v < 0n || x < 0n) throw new Error("value and threshold must be non-negative");
+  if (x === 0n) throw new Error("threshold must be at least 1: every number is at least 0, so there is nothing to prove");
+  if (v < x) throw new Error("value is below the threshold: no valid proof exists");
+  if (v - x >= 1n << BigInt(R2.NBITS)) throw new Error(`value minus threshold must fit in ${R2.NBITS} bits`);
+  const r = blinding === undefined ? B2.randScalar() : big(blinding);
+  const C = B2.ecAdd(B2.ecMul(v, B2.G), B2.ecMul(r, B2.H));
+  const c = toBytes32(ctx);
+  const p = R2.proveRangeV2(C, v, r, x, c);
+  return { proof: hex(wordsToBytes(p.words)), words: p.words, ctx: hex(c), commitment: point(C), blinding: "0x" + r.toString(16).padStart(64, "0"), threshold: x.toString(), bits: R2.NBITS, verified: R2.verifyRangeV2JS(p.words, c) };
+}
+/** Exact mirror of RangeVerifierV2.verify. */
+const verifyRangeV2 = (proof, ctx) => R2.verifyRangeV2JS(proofWords(proof), toBytes32(ctx));
+
+/** V2 bound bundle (23 words) for BoundLineageVerifierV2: v*G is computed on chain from the caller's roots. */
+function proveTrustlessV2(prevRoot, outRoot, ctx) {
+  const c = toBytes32(ctx), a = toBytes32(prevRoot), o = toBytes32(outRoot);
+  const t = P2.proveTrustlessV2(a, o, c);
+  return { proof: t.hex, words: t.words, ctx: hex(c), commitments: { in: point(t.commitments.C_in), out: point(t.commitments.C_out) }, verified: P2.verifyTrustlessV2JS(t.words, c, a, o) };
+}
+/** Exact mirror of BoundLineageVerifierV2.verifyBound. */
+const verifyTrustlessV2 = (proof, ctx, prevRoot, outRoot) => P2.verifyTrustlessV2JS(proofWords(proof), toBytes32(ctx), toBytes32(prevRoot), toBytes32(outRoot));
+
 /* ------------------------------------------------------------ calldata */
 const sel = (sig) => S.hex(S.keccak256(S.utf8(sig))).slice(0, 8);
 const dyn = (u8) => { const padded = Math.ceil(u8.length / 32) * 32; const b = new Uint8Array(padded); b.set(u8); return pad32(u8.length) + S.hex(b); };
@@ -146,6 +193,12 @@ class Chain {
   verifyRange(proof, ctx) { return this.isTrue(this.addresses.rangeVerifier, encodeVerify(proof, ctx)); }
   /** Does the deployed BoundLineageVerifier accept this bound bundle for these public roots? */
   verifyTrustless(proof, ctx, prevRoot, outRoot) { return this.isTrue(this.addresses.boundVerifier, encodeVerifyBound(proof, ctx, prevRoot, outRoot)); }
+  /** V2: does LineageVerifierV2 (BN254, whole-point checks) accept this 17 word bundle? */
+  verifyLineageV2(proof, ctx) { return this.isTrue(this.addresses.lineageVerifierV2, encodeVerify(proof, ctx)); }
+  /** V2: does RangeVerifierV2 accept this 291 word range proof? */
+  verifyRangeV2(proof, ctx) { return this.isTrue(this.addresses.rangeVerifierV2, encodeVerify(proof, ctx)); }
+  /** V2: does BoundLineageVerifierV2 accept this 23 word bound bundle for these public roots? */
+  verifyTrustlessV2(proof, ctx, prevRoot, outRoot) { return this.isTrue(this.addresses.boundVerifierV2, encodeVerifyBound(proof, ctx, prevRoot, outRoot)); }
   /** Is `user` eligible on a PrivateGate? */
   isEligible(gate, user, purpose, minThreshold, maxAge = 0) { return this.isTrue(gate, encodeIsEligible(user, purpose, minThreshold, maxAge)); }
 
@@ -179,6 +232,7 @@ class Chain {
 module.exports = {
   MAINNET, Chain,
   commit, proveLineage, verifyLineage, proveRange, verifyRange, proveTrustless, verifyTrustless,
+  commitV2, proveLineageV2, verifyLineageV2, proveRangeV2, verifyRangeV2, proveTrustlessV2, verifyTrustlessV2,
   context, purposeId, gateContext, toBytes32,
   encodeVerify, encodeVerifyBound, encodeSubmit, encodeAttest, encodeGateProve, encodeIsEligible,
   NBITS: R.NBITS, keccak256: S.keccak256, hex, fromHex,

package/lib/bn254.js

@@ -0,0 +1,197 @@
+// GENERATED COPY of zk/bn254.js from the zkThunder protocol. Do not edit here; run "npm run sync" in sdk/.
+// zkThunder sigma layer, V2: the constructions of zk/sigma.js on the BN254
+// curve (alt_bn128), where the EVM has precompiles for point addition (0x06)
+// and scalar multiplication (0x07). A verifier on this curve computes every
+// scalar multiplication itself and compares whole points, which removes the
+// 160-bit address comparison the secp256k1 verifiers rely on (the ecrecover
+// trick). Nothing here is deployed until the audit has looked at it.
+//
+// Zero dependencies. Mirrors sigma.js function for function: Pedersen
+// commitments, Okamoto proofs of opening, Chaum-Pedersen equality, opening to
+// a public value. Domain tags carry "bn254" so a proof can never be replayed
+// across the two curves. Responses are canonical (below the group order) and
+// the verifier rejects anything else, so every proof has one encoding.
+//
+// Scope, stated plainly: identical to V1. Privacy of the committed roots and
+// integrity of the commitment structure, not transition correctness.
+"use strict";
+const S = require("./sigma.js");
+const { keccak256, utf8, bigTo32, bytesToBig, hex } = S;
+
+/* ---------------- BN254 (alt_bn128) G1: y^2 = x^3 + 3 over F_p ---------------- */
+const P = 21888242871839275222246405745257275088696311157297823662689037894645226208583n;
+const N = 21888242871839275222246405745257275088548364400416034343698204186575808495617n;
+const G = { x: 1n, y: 2n };
+const O = null; // point at infinity; serialised as (0, 0), exactly as the precompiles do
+
+const mod = (a, m) => ((a % m) + m) % m;
+function powmod(b, e, m) { let r = 1n; b = mod(b, m); while (e > 0n) { if (e & 1n) r = (r * b) % m; b = (b * b) % m; e >>= 1n; } return r; }
+const inv = (a, m) => powmod(mod(a, m), m - 2n, m);
+
+function onCurve(Q) {
+  if (Q === O) return true;
+  if (Q.x < 0n || Q.x >= P || Q.y < 0n || Q.y >= P) return false;
+  return mod(Q.y * Q.y - (Q.x * Q.x * Q.x + 3n), P) === 0n;
+}
+/* the group has prime order N and cofactor 1, so every curve point is in the group */
+function ecAdd(A, B) {
+  if (A === O) return B; if (B === O) return A;
+  if (A.x === B.x) {
+    if (mod(A.y + B.y, P) === 0n) return O;
+    const l = mod(3n * A.x * A.x * inv(2n * A.y, P), P);
+    const x = mod(l * l - 2n * A.x, P);
+    return { x, y: mod(l * (A.x - x) - A.y, P) };
+  }
+  const l = mod((B.y - A.y) * inv(B.x - A.x, P), P);
+  const x = mod(l * l - A.x - B.x, P);
+  return { x, y: mod(l * (A.x - x) - A.y, P) };
+}
+/* Jacobian doubling and addition for a = 0 curves (same formulas as sigma.js) */
+function jDouble(X, Y, Z) {
+  if (Y === 0n) return [0n, 1n, 0n];
+  const A = mod(X * X, P), B = mod(Y * Y, P), C = mod(B * B, P);
+  const D = mod(2n * (mod((X + B) * (X + B), P) - A - C), P);
+  const E = mod(3n * A, P), F = mod(E * E, P);
+  const X3 = mod(F - 2n * D, P);
+  return [X3, mod(E * (D - X3) - 8n * C, P), mod(2n * Y * Z, P)];
+}
+function jAdd(X1, Y1, Z1, X2, Y2, Z2) {
+  if (Z1 === 0n) return [X2, Y2, Z2]; if (Z2 === 0n) return [X1, Y1, Z1];
+  const Z1Z1 = mod(Z1 * Z1, P), Z2Z2 = mod(Z2 * Z2, P);
+  const U1 = mod(X1 * Z2Z2, P), U2 = mod(X2 * Z1Z1, P);
+  const S1 = mod(Y1 * Z2 * Z2Z2, P), S2 = mod(Y2 * Z1 * Z1Z1, P);
+  const Hh = mod(U2 - U1, P), r = mod(S2 - S1, P);
+  if (Hh === 0n) { return r === 0n ? jDouble(X1, Y1, Z1) : [0n, 1n, 0n]; }
+  const HH = mod(Hh * Hh, P), HHH = mod(HH * Hh, P), V = mod(U1 * HH, P);
+  const X3 = mod(r * r - HHH - 2n * V, P);
+  return [X3, mod(r * (V - X3) - S1 * HHH, P), mod(Z1 * Z2 * Hh, P)];
+}
+function ecMul(k, Q) {
+  k = mod(k, N); if (Q === O || k === 0n) return O;
+  let R = [0n, 1n, 0n], T = [Q.x, Q.y, 1n];
+  while (k > 0n) { if (k & 1n) R = jAdd(R[0], R[1], R[2], T[0], T[1], T[2]); T = jDouble(T[0], T[1], T[2]); k >>= 1n; }
+  if (R[2] === 0n) return O;
+  const zi = inv(R[2], P), zi2 = mod(zi * zi, P);
+  return { x: mod(R[0] * zi2, P), y: mod(R[1] * zi2 * zi, P) };
+}
+function ecNeg(Q) { return Q === O ? O : { x: Q.x, y: Q.y === 0n ? 0n : P - Q.y }; }
+const ecEq = (A, B) => (A === O || B === O) ? A === B : (A.x === B.x && A.y === B.y);
+/* coordinates as the precompiles see them: infinity is (0, 0) */
+const xy = Q => Q === O ? { x: 0n, y: 0n } : Q;
+
+/* ---------------- H: second generator, nothing-up-my-sleeve ----------------
+   Try-and-increment from a fixed tag; discrete log of H wrt G unknown. */
+function deriveH() {
+  if (P % 4n !== 3n) throw new Error("sqrt shortcut needs p = 3 mod 4");
+  for (let i = 0; ; i++) {
+    const x = mod(bytesToBig(keccak256(utf8("zkThunder/bn254/H/v1/" + i))), P);
+    const y2 = mod(x * x * x + 3n, P);
+    const y = powmod(y2, (P + 1n) / 4n, P);
+    if (mod(y * y, P) === y2) return { x, y: (y & 1n) ? P - y : y }; // even y
+  }
+}
+const H = deriveH();
+
+/* ---------------- randomness (Node or browser) ---------------- */
+function randomBytes32() {
+  const g = typeof globalThis !== "undefined" ? globalThis.crypto : undefined;
+  if (g && typeof g.getRandomValues === "function") { const u = new Uint8Array(32); g.getRandomValues(u); return u; }
+  return new Uint8Array(require("crypto").randomBytes(32));
+}
+function randScalar() {
+  while (true) { const r = mod(bytesToBig(randomBytes32()), N); if (r > 0n) return r; }
+}
+
+/* ---------------- Fiat-Shamir challenge ----------------
+   keccak(tag | x1 | y1 | ... | extras) mod n, the byte layout the contract
+   reproduces with abi.encodePacked. Infinity is packed as (0, 0). */
+function challenge(tag, points, extra32s) {
+  const parts = [utf8(tag)];
+  for (const Q of points) { const q = xy(Q); parts.push(bigTo32(q.x), bigTo32(q.y)); }
+  for (const e of (extra32s || [])) parts.push(e);
+  const total = parts.reduce((s, p2) => s + p2.length, 0);
+  const buf = new Uint8Array(total); let o = 0;
+  for (const p2 of parts) { buf.set(p2, o); o += p2.length; }
+  return mod(bytesToBig(keccak256(buf)), N);
+}
+const canonical = z => typeof z === "bigint" && z >= 0n && z < N;
+
+/* ---------------- Pedersen commitment: C = x*G + r*H ---------------- */
+function commit(value32, r) {
+  const x = mod(bytesToBig(value32), N);
+  r = r === undefined ? randScalar() : r;
+  return { C: ecAdd(ecMul(x, G), ecMul(r, H)), x, r };
+}
+
+/* ---------------- NIZK: proof of opening (Okamoto) ---------------- */
+const TAG_OPEN = "zkThunder/bn254/open/v1";
+function proveOpening(C, x, r, ctx32) {
+  const a = randScalar(), b = randScalar();
+  const A = ecAdd(ecMul(a, G), ecMul(b, H));
+  const c = challenge(TAG_OPEN, [C, A], [ctx32]);
+  return { A, z1: mod(a + c * x, N), z2: mod(b + c * r, N) };
+}
+function verifyOpening(C, prf, ctx32) {
+  if (C === O || prf.A === O || !onCurve(C) || !onCurve(prf.A)) return false;
+  if (!canonical(prf.z1) || !canonical(prf.z2)) return false;
+  const c = challenge(TAG_OPEN, [C, prf.A], [ctx32]);
+  const L = ecAdd(ecMul(prf.z1, G), ecMul(prf.z2, H));
+  const R = ecAdd(prf.A, ecMul(c, C));
+  return ecEq(L, R);
+}
+
+/* ---------------- NIZK: equality of committed values ----------------
+   D = C1 - C2 = (r1 - r2) H; Schnorr proof of knowledge of the dlog base H. */
+const TAG_EQ = "zkThunder/bn254/eq/v1";
+function proveEquality(C1, r1, C2, r2, ctx32) {
+  const rho = mod(r1 - r2, N);
+  const k = randScalar();
+  const A = ecMul(k, H);
+  const c = challenge(TAG_EQ, [C1, C2, A], [ctx32]);
+  return { A, z: mod(k + c * rho, N) };
+}
+function verifyEquality(C1, C2, prf, ctx32) {
+  if (C1 === O || C2 === O || prf.A === O || !onCurve(C1) || !onCurve(C2) || !onCurve(prf.A)) return false;
+  if (!canonical(prf.z)) return false;
+  const D = ecAdd(C1, ecNeg(C2));
+  if (D === O) return false;                  // identical commitments: reject
+  const c = challenge(TAG_EQ, [C1, C2, prf.A], [ctx32]);
+  const L = ecMul(prf.z, H);
+  const R = ecAdd(prf.A, ecMul(c, D));
+  return ecEq(L, R);
+}
+
+/* ---------------- NIZK: opening to a PUBLIC value ----------------
+   C = v*G + r*H for a public v: knowledge of r with C - v*G = r*H. The
+   verifier computes v*G itself; the prover supplies nothing about it. */
+const TAG_PUB = "zkThunder/bn254/pub/v1";
+function proveOpeningToPublic(C, v32, r, ctx32) {
+  const vG = ecMul(mod(bytesToBig(v32), N), G);
+  const k = randScalar();
+  const A = ecMul(k, H);
+  const c = challenge(TAG_PUB, [C, vG, A], [ctx32]);
+  return { A, z: mod(k + c * r, N) };
+}
+function verifyOpeningToPublic(C, v32, prf, ctx32) {
+  if (C === O || prf.A === O || !onCurve(C) || !onCurve(prf.A) || !canonical(prf.z)) return false;
+  const vG = ecMul(mod(bytesToBig(v32), N), G);
+  const D = ecAdd(C, ecNeg(vG)); if (D === O) return false;
+  const c = challenge(TAG_PUB, [C, vG, prf.A], [ctx32]);
+  const L = ecMul(prf.z, H);
+  const R = ecAdd(prf.A, ecMul(c, D));
+  return ecEq(L, R);
+}
+
+/* ---------------- serialization ---------------- */
+function pt(Q) { const q = xy(Q); return { x: "0x" + q.x.toString(16).padStart(64, "0"), y: "0x" + q.y.toString(16).padStart(64, "0") }; }
+function sc(s) { return "0x" + s.toString(16).padStart(64, "0"); }
+function wordsToHex(words) { const buf = new Uint8Array(words.length * 32); words.forEach((v, i) => buf.set(bigTo32(BigInt(v)), i * 32)); return "0x" + hex(buf); }
+function hexToWords(h) { const s = (h || "").replace(/^0x/, ""); if (s.length % 64) throw new Error("not a word array"); const out = []; for (let i = 0; i < s.length; i += 64) out.push(BigInt("0x" + s.slice(i, i + 64))); return out; }
+
+module.exports = { keccak256, utf8, hex, bigTo32, bytesToBig,
+  P, N, G, H, O, mod, inv, powmod, onCurve, ecAdd, ecMul, ecNeg, ecEq, xy, canonical,
+  randScalar, challenge, commit,
+  proveOpening, verifyOpening, proveEquality, verifyEquality,
+  proveOpeningToPublic, verifyOpeningToPublic,
+  pt, sc, wordsToHex, hexToWords, deriveH,
+  TAG_OPEN, TAG_EQ, TAG_PUB };

package/lib/prove-v2.js

@@ -0,0 +1,95 @@
+// GENERATED COPY of zk/prove-v2.js from the zkThunder protocol. Do not edit here; run "npm run sync" in sdk/.
+// zkThunder lineage bundles, V2 (BN254). Bare node, no deps.
+//
+//   node zk/prove-v2.js <stateRootPrevHex32> <stateRootOutHex32> <ctxHex32>
+//
+// The V2 verifier computes every scalar multiplication itself through the
+// EVM precompiles, so the bundle carries no helper points: 17 words instead
+// of 23 for the lineage bundle, 23 instead of 37 for the bound bundle.
+//
+// Lineage bundle (LineageVerifierV2.verify), 17 words:
+//   [0..1] C_in  [2..3] C_out  [4..5] prevCout
+//   [6..7] openIn.A  [8] z1 [9] z2
+//   [10..11] openOut.A [12] z1 [13] z2
+//   [14..15] eq.A [16] z
+// Bound bundle (BoundLineageVerifierV2.verifyBound), 23 words:
+//   [0..16] lineage bundle
+//   [17..18] pubOut.A [19] z      C_out opens to the header state root
+//   [20..21] pubIn.A  [22] z      C_in opens to the previous stored root
+//
+// verifyBundleV2JS / verifyTrustlessV2JS are exact mirrors of the Solidity
+// checks (same challenges, same canonical-scalar rules, whole-point equality).
+"use strict";
+const B = require("./bn254.js");
+const { mod, N, G, H, O, ecAdd, ecMul, ecNeg, ecEq, onCurve, canonical, commit, challenge,
+        randScalar, keccak256, utf8, hex, wordsToHex, bytesToBig } = B;
+
+const ptAt = (w, i) => ({ x: w[i], y: w[i + 1] });
+const validPt = Q => Q.x !== 0n || Q.y !== 0n ? onCurve(Q) : false;   // (0,0) is infinity: rejected as input
+
+/** Build the 17-word lineage bundle. Keeps the blindings so the bound bundle can extend it. */
+function buildLineage(rootPrev32, rootOut32, ctx32) {
+  const prev = commit(rootPrev32);
+  const cin = commit(rootPrev32);        // same value, fresh blinding
+  const cout = commit(rootOut32);
+  const oi = B.proveOpening(cin.C, cin.x, cin.r, ctx32);
+  const oo = B.proveOpening(cout.C, cout.x, cout.r, ctx32);
+  const eq = B.proveEquality(prev.C, prev.r, cin.C, cin.r, ctx32);
+  const words = [
+    cin.C.x, cin.C.y, cout.C.x, cout.C.y, prev.C.x, prev.C.y,
+    oi.A.x, oi.A.y, oi.z1, oi.z2,
+    oo.A.x, oo.A.y, oo.z1, oo.z2,
+    eq.A.x, eq.A.y, eq.z,
+  ];
+  return { words, prev, cin, cout };
+}
+
+function proveBundleV2(rootPrev32, rootOut32, ctx32) {
+  const b = buildLineage(rootPrev32, rootOut32, ctx32);
+  return { words: b.words, hex: wordsToHex(b.words),
+           commitments: { prevCout: b.prev.C, C_in: b.cin.C, C_out: b.cout.C } };
+}
+
+/** Exact mirror of LineageVerifierV2.verifyBundle. */
+function verifyBundleV2JS(words, ctx32) {
+  if (words.length !== 17) return false;
+  const Cin = ptAt(words, 0), Cout = ptAt(words, 2), Prev = ptAt(words, 4);
+  if (!validPt(Cin) || !validPt(Cout) || !validPt(Prev)) return false;
+  if (!B.verifyOpening(Cin, { A: ptAt(words, 6), z1: words[8], z2: words[9] }, ctx32)) return false;
+  if (!B.verifyOpening(Cout, { A: ptAt(words, 10), z1: words[12], z2: words[13] }, ctx32)) return false;
+  return B.verifyEquality(Prev, Cin, { A: ptAt(words, 14), z: words[16] }, ctx32);
+}
+
+/** Bound bundle: lineage bundle plus openings of C_out and C_in to public roots. */
+function proveTrustlessV2(rootPrev32, rootOut32, ctx32) {
+  const b = buildLineage(rootPrev32, rootOut32, ctx32);
+  const pubOut = B.proveOpeningToPublic(b.cout.C, rootOut32, b.cout.r, ctx32);
+  const pubIn = B.proveOpeningToPublic(b.cin.C, rootPrev32, b.cin.r, ctx32);
+  const words = [...b.words, pubOut.A.x, pubOut.A.y, pubOut.z, pubIn.A.x, pubIn.A.y, pubIn.z];
+  return { words, hex: wordsToHex(words),
+           commitments: { prevCout: b.prev.C, C_in: b.cin.C, C_out: b.cout.C } };
+}
+
+/** Exact mirror of BoundLineageVerifierV2.verifyBound. */
+function verifyTrustlessV2JS(words, ctx32, rootPrev32, rootOut32) {
+  if (words.length !== 23) return false;
+  if (!verifyBundleV2JS(words.slice(0, 17), ctx32)) return false;
+  if (!B.verifyOpeningToPublic(ptAt(words, 2), rootOut32, { A: ptAt(words, 17), z: words[19] }, ctx32)) return false;
+  return B.verifyOpeningToPublic(ptAt(words, 0), rootPrev32, { A: ptAt(words, 20), z: words[22] }, ctx32);
+}
+
+module.exports = { proveBundleV2, verifyBundleV2JS, proveTrustlessV2, verifyTrustlessV2JS, buildLineage };
+
+if (require.main === module) {
+  const [, , prevHex, outHex, ctxHex] = process.argv;
+  const h2b = h => Uint8Array.from((h || "").replace(/^0x/, "").padStart(64, "0").match(/../g).map(x => parseInt(x, 16)));
+  const rootPrev = prevHex ? h2b(prevHex) : keccak256(utf8("demo-root-prev"));
+  const rootOut = outHex ? h2b(outHex) : keccak256(utf8("demo-root-out"));
+  const ctx = ctxHex ? h2b(ctxHex) : keccak256(utf8("demo-ctx"));
+  const b = proveTrustlessV2(rootPrev, rootOut, ctx);
+  console.log(JSON.stringify({
+    ctx: "0x" + hex(ctx), rootPrev: "0x" + hex(rootPrev), rootOut: "0x" + hex(rootOut),
+    bundle: b.hex, words: b.words.length,
+    verifies_locally: verifyTrustlessV2JS(b.words, ctx, rootPrev, rootOut),
+  }, null, 2));
+}

package/lib/range-v2.js

@@ -0,0 +1,82 @@
+// GENERATED COPY of zk/range-v2.js from the zkThunder protocol. Do not edit here; run "npm run sync" in sdk/.
+// zkThunder range proofs, V2 (BN254): prove a committed value satisfies
+// v >= X without revealing v. Same construction as zk/range.js (bit
+// decomposition of v - X over NBITS bits, one CDS OR-proof per bit, a
+// homomorphic sum check), but the verifier multiplies points itself through
+// the EVM precompiles, so no helper points travel with the proof and every
+// equation is checked on whole points.
+//
+// Layout (all uint256 words):
+//   [0..1] C   [2] threshold
+//   then per bit i (0..NBITS-1), 9 words:
+//     B.x B.y  A0.x A0.y  A1.x A1.y  c0  z0  z1
+// 3 + 9*32 = 291 words (483 in V1).
+"use strict";
+const B = require("./bn254.js");
+const { mod, N, G, H, O, ecAdd, ecMul, ecNeg, ecEq, onCurve, canonical, challenge, randScalar, powmod } = B;
+
+const NBITS = 32;
+const TAG_BIT = "zkThunder/bn254/range/bit/v1";
+const bitChallenge = (Bp, A0, A1, ctx32) => challenge(TAG_BIT, [Bp, A0, A1], [ctx32]);
+const validPt = Q => (Q.x !== 0n || Q.y !== 0n) && onCurve(Q);
+
+/** Prove v >= threshold for C = v*G + r*H. */
+function proveRangeV2(C, v, r, threshold, ctx32, nbits = NBITS) {
+  const d = v - threshold;
+  if (d < 0n) throw new Error("value is below the threshold; cannot prove");
+  if (d >= (1n << BigInt(nbits))) throw new Error("difference exceeds range");
+  const blind = [];
+  let acc = 0n;
+  for (let i = 0; i < nbits - 1; i++) { blind.push(randScalar()); acc = mod(acc + (blind[i] << BigInt(i)), N); }
+  blind.push(mod((r - acc) * powmod(1n << BigInt(nbits - 1), N - 2n, N), N)); // sum(2^i r_i) == r
+
+  const words = [C.x, C.y, threshold];
+  for (let i = 0; i < nbits; i++) {
+    const b = (d >> BigInt(i)) & 1n;
+    const Bp = ecAdd(b ? G : O, ecMul(blind[i], H));
+    const BmG = ecAdd(Bp, ecNeg(G));
+    let A0, A1, c0, c1, z0, z1;
+    const k = randScalar();
+    if (b === 0n) {                                   // real branch 0, simulated branch 1
+      c1 = randScalar(); z1 = randScalar();
+      A1 = ecAdd(ecMul(z1, H), ecNeg(ecMul(c1, BmG)));
+      A0 = ecMul(k, H);
+      const c = bitChallenge(Bp, A0, A1, ctx32);
+      c0 = mod(c - c1, N); z0 = mod(k + c0 * blind[i], N);
+    } else {                                          // real branch 1, simulated branch 0
+      c0 = randScalar(); z0 = randScalar();
+      A0 = ecAdd(ecMul(z0, H), ecNeg(ecMul(c0, Bp)));
+      A1 = ecMul(k, H);
+      const c = bitChallenge(Bp, A0, A1, ctx32);
+      c1 = mod(c - c0, N); z1 = mod(k + c1 * blind[i], N);
+    }
+    words.push(Bp.x, Bp.y, A0.x, A0.y, A1.x, A1.y, c0, z0, z1);
+  }
+  return { words, nbits };
+}
+
+/** Exact mirror of RangeVerifierV2.verify (Horner sum, whole-point equality). */
+function verifyRangeV2JS(words, ctx32, nbits = NBITS) {
+  if (words.length !== 3 + 9 * nbits) return false;
+  const pt = i => ({ x: words[i], y: words[i + 1] });
+  const C = pt(0), threshold = words[2];
+  if (!validPt(C)) return false;
+  let sum = O;
+  for (let j = 0; j < nbits; j++) {
+    const i = nbits - 1 - j, o = 3 + 9 * i;
+    const Bp = pt(o), A0 = pt(o + 2), A1 = pt(o + 4), c0 = words[o + 6], z0 = words[o + 7], z1 = words[o + 8];
+    if (![Bp, A0, A1].every(validPt)) return false;
+    if (![c0, z0, z1].every(canonical)) return false;
+    const c = bitChallenge(Bp, A0, A1, ctx32);
+    const c1 = mod(c - c0, N);
+    const BmG = ecAdd(Bp, ecNeg(G));
+    if (BmG === O) return false;
+    if (!ecEq(ecMul(z0, H), ecAdd(A0, ecMul(c0, Bp)))) return false;    // z0 H == A0 + c0 B
+    if (!ecEq(ecMul(z1, H), ecAdd(A1, ecMul(c1, BmG)))) return false;   // z1 H == A1 + c1 (B - G)
+    sum = j === 0 ? Bp : ecAdd(ecAdd(sum, sum), Bp);                     // Horner: sum = 2*sum + B_i
+  }
+  const Cp = ecAdd(C, ecNeg(ecMul(threshold, G)));                       // C - threshold*G
+  return ecEq(sum, Cp);
+}
+
+module.exports = { proveRangeV2, verifyRangeV2JS, NBITS, bitChallenge, TAG_BIT };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zkthunder_/sdk",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Zero-knowledge proofs for Robinhood Chain: lineage bundles, range proofs and trustless anchors, generated locally with no dependencies, plus a tiny client for the deployed zkThunder contracts.",
   "main": "index.js",
   "types": "index.d.ts",
@@ -9,7 +9,7 @@
     "test": "node test.js",
     "sync": "node sync.js"
   },
-  "keywords": ["zero-knowledge", "pedersen", "range-proof", "robinhood-chain", "zkthunder", "secp256k1"],
+  "keywords": ["zero-knowledge", "pedersen", "range-proof", "robinhood-chain", "zkthunder", "secp256k1", "bn254"],
   "license": "Apache-2.0",
   "engines": { "node": ">=18" }
 }