functionalscript 0.43.1 → 0.45.0

package/fjs/crypto/pow/module.f.mjs

@@ -0,0 +1,93 @@
+/**
+ * Bitcoin-style proof-of-work: compact **nBits** target decoding and
+ * hash-vs-target verification using an injected SHA-2 hash.
+ *
+ * @module
+ *
+ * @import { Vec } from '../../types/bit_vec/types.ts'
+ * @import { Nullable } from '../../types/nullable/types.ts'
+ * @import { Sha2 } from '../sha2/types.ts'
+ * @import { Pow } from './types.ts'
+ */
+
+import { mask } from '../../types/bigint/module.f.mjs'
+import { uint } from '../../types/bit_vec/module.f.mjs'
+import { computeSync, sha256 } from '../sha2/module.f.mjs'
+
+const nBitsMantissa = mask(24n)
+const mantissaSign = 0x00800000n
+const mantissaBody = 0x007fffffn
+const exponentShift = 24n
+const uint256Mask = mask(256n)
+
+/** Genesis-block compact target (`0x1d00ffff`). */
+export const genesisNBits = 0x1d00ffffn
+
+/** Genesis-block uint256 target decoded from {@link genesisNBits}. */
+export const genesisTarget =
+    0x00000000ffff0000000000000000000000000000000000000000000000000000n
+
+/** @type {(exponent: bigint) => bigint} */
+const decodeShift = exponent => 8n * (exponent - 3n)
+
+/** @type {(exponent: bigint) => (mantissa: bigint) => bigint} */
+const compactTarget = exponent => mantissa => {
+    const shift = decodeShift(exponent)
+    return shift >= 0n ? mantissa << shift : mantissa >> -shift
+}
+
+/** @type {(mantissa: bigint) => boolean} */
+const negativeNBits = mantissa =>
+    mantissa !== 0n && (mantissa & mantissaSign) !== 0n
+
+/** @type {(exponent: bigint) => (mantissa: bigint) => (target: bigint) => boolean} */
+const overflowNBits = exponent => mantissa => target =>
+    target !== 0n &&
+    (exponent > 34n || (mantissa !== 0n && (mantissa & mantissaBody) === 0n))
+
+/**
+ * Decodes compact **nBits** (32-bit block-header "bits") to a uint256 target:
+ *
+ * - `exponent = nBits >> 24`
+ * - `mantissa = nBits & 0xffffff`
+ * - `target = mantissa × 2^(8 × (exponent − 3))`
+ *
+ * Returns `null` for malformed encodings per Bitcoin `SetCompact` rules (negative
+ * sign bit, overflow, target wider than 256 bits).
+ *
+ * @param {bigint} nBits Compact target encoding.
+ * @returns {Nullable<bigint>} Decoded target, or `null` when **nBits** is invalid.
+ */
+export const targetFromNBits = nBits => {
+    const exponent = nBits >> exponentShift
+    const mantissa = nBits & nBitsMantissa
+    if (negativeNBits(mantissa)) { return null }
+    const target = compactTarget(exponent)(mantissa)
+    if (overflowNBits(exponent)(mantissa)(target)) { return null }
+    if (target > uint256Mask) { return null }
+    return target
+}
+
+/**
+ * Builds PoW helpers for a hash function (typical consumer: {@link sha256}).
+ *
+ * @param {Sha2} hash SHA-2 configuration whose digest is compared as uint256.
+ * @returns {Pow}
+ */
+export const pow = hash => {
+    const c = computeSync(hash)
+    /** @type {(data: Vec) => bigint} */
+    const hashInt = data => uint(c([data]))
+    /** @type {(nBits: bigint) => (data: Vec) => boolean} */
+    const meets = nBits => data => {
+        const target = targetFromNBits(nBits)
+        return target !== null && hashInt(data) <= target
+    }
+    return { hashInt, meets }
+}
+
+/** SHA-256 proof-of-work (`pow(sha256)`). */
+export const sha256Pow = pow(sha256)
+
+/** Bitcoin block-header PoW; same as {@link sha256Pow}. */
+export const bitcoinPow = sha256Pow

package/fjs/crypto/pow/proof.f.mjs

@@ -0,0 +1,121 @@
+import { utf8 } from '../../text/module.f.mjs'
+import { empty, uint } from '../../types/bit_vec/module.f.mjs'
+import { computeSync, sha224, sha256 } from '../sha2/module.f.mjs'
+import { bitcoinPow, genesisNBits, genesisTarget, pow, sha256Pow, targetFromNBits } from './module.f.mjs'
+import { assert, assertEq, assertNotNullish } from '../../asserts/module.f.mjs'
+
+const p256 = sha256Pow
+const p224 = pow(sha224)
+const sample = utf8('functionalscript pow proof')
+const emptyData = empty
+
+/** Target large enough for {@link sample} under SHA-256 (`0x207fffff`). */
+const easyNBits = 0x207fffffn
+
+/** Compact encoding for target `1` (`0x03000001`). */
+const hardNBits = 0x03000001n
+
+/** SHA-256 of the empty message (NIST / Bitcoin block merkle uses this primitive). */
+const sha256EmptyHash =
+    0xe3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855n
+
+/** Bitcoin block #0 header hash as big-endian uint256. */
+const block0Hash =
+    0x000000000019d6689c085ae165831e934ff763ae46a2a6cffb388491c27dc990n
+
+/** @type {(nBits: bigint) => void} */
+const expectNull = nBits => {
+    assertEq(targetFromNBits(nBits), null, nBits)
+}
+
+export const proof = {
+    targetFromNBits: {
+        genesis: () => {
+            assertEq(targetFromNBits(genesisNBits), genesisTarget, 'genesis target')
+        },
+        block0HashWithinGenesisTarget: () => {
+            assert(!(block0Hash > genesisTarget), 'block0 hash exceeds genesis target')
+        },
+        exponent3: () => {
+            assertEq(targetFromNBits(0x030000ffn), 0xffn, 'exponent 3')
+        },
+        exponent2: () => {
+            assertEq(targetFromNBits(0x02008000n), 0x80n, 'exponent 2')
+        },
+        hardTargetOne: () => {
+            assertEq(targetFromNBits(hardNBits), 1n, 'hard target')
+        },
+        zero: () => {
+            assertEq(targetFromNBits(0n), 0n, 'zero nBits')
+        },
+        negative: () => {
+            expectNull(0x01800001n)
+        },
+        negativeHighMantissa: () => {
+            expectNull(0x22ffffffn)
+        },
+        overflowExponent: () => {
+            expectNull(0x23000001n)
+        },
+        exceeds256: () => {
+            expectNull(0x227fffffn)
+        },
+    },
+    meets: {
+        easy: () => {
+            assert(p256.meets(easyNBits)(sample), 'easy nBits should pass')
+        },
+        hard: () => {
+            assert(!(p256.meets(hardNBits)(sample)), 'target 1 should fail')
+        },
+        genesisFailsSample: () => {
+            assert(!(p256.meets(genesisNBits)(sample)), 'genesis target too hard for sample')
+        },
+        zeroTargetRejectsSample: () => {
+            assert(!(p256.meets(0n)(sample)), 'non-zero hash vs zero target')
+        },
+        invalidNBits: () => {
+            assert(!(p256.meets(0x01800001n)(sample)), 'invalid nBits should not pass')
+        },
+        hashLeqTarget: () => {
+            const h = p256.hashInt(sample)
+            const target = assertNotNullish(targetFromNBits(easyNBits), 'easy nBits decode')
+            assert(!(h > target), 'hash above easy target')
+            assert(h <= target, 'hash <= target')
+        },
+    },
+    hashInt: {
+        sha256Sample: () => {
+            const digest = computeSync(sha256)([sample])
+            assertEq(p256.hashInt(sample), uint(digest), 'sha256 sample')
+        },
+        sha256Empty: () => {
+            assertEq(p256.hashInt(emptyData), sha256EmptyHash, 'sha256 empty constant')
+            const digest = computeSync(sha256)([emptyData])
+            assertEq(p256.hashInt(emptyData), uint(digest), 'sha256 empty')
+        },
+        sha224: () => {
+            const digest = computeSync(sha224)([sample])
+            assertEq(p224.hashInt(sample), uint(digest), 'sha224')
+        },
+        stable: () => {
+            assertEq(p256.hashInt(sample), p256.hashInt(sample), 'stable')
+        },
+    },
+    pow: {
+        sha256Pow: () => {
+            const built = pow(sha256)
+            assertEq(sha256Pow.hashInt(sample), built.hashInt(sample), 'hashInt')
+            assertEq(sha256Pow.meets(easyNBits)(sample), built.meets(easyNBits)(sample), 'meets')
+        },
+        bitcoinPow: () => {
+            assertEq(bitcoinPow.hashInt(sample), sha256Pow.hashInt(sample), 'bitcoinPow')
+        },
+        independentInstances: () => {
+            const a = pow(sha256)
+            const b = pow(sha256)
+            assertEq(a.hashInt(sample), b.hashInt(sample), 'hashInt')
+            assertEq(a.meets(easyNBits)(sample), b.meets(easyNBits)(sample), 'meets')
+        },
+    },
+}

package/fjs/crypto/pow/types.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Types for Bitcoin-style proof-of-work verification.
+ *
+ * @module
+ */
+import type { Vec } from '../../types/bit_vec/types.ts';
+/**
+ * @property hashInt
+ *
+ * Hash `data` with the configured `Sha2`; digest as big-endian uint256.
+ *
+ * @property meets
+ *
+ * Whether `hashInt(data) <= targetFromNBits(nBits)`; `false` when **nBits** is invalid.
+ */
+export type Pow = {
+    readonly hashInt: (data: Vec) => bigint;
+    readonly meets: (nBits: bigint) => (data: Vec) => boolean;
+};

package/fjs/crypto/secp/module.f.d.mts

@@ -0,0 +1,61 @@
+/**
+ * Short Weierstrass elliptic-curve arithmetic over a prime field: `curve`
+ * builds point negation, addition, and scalar multiplication for any
+ * `secp`-family curve from its `(p, a, g, n)` parameters.
+ *
+ * @module
+ *
+ * @import { Equal, Reduce } from '../../types/function/operator/types.ts'
+ * @import { Curve, Init, Point } from './types.ts'
+ */
+import type { Equal } from '../../types/function/operator/types.ts';
+import type { Curve, Init, Point } from './types.ts';
+/**
+ * Constructs an elliptic curve with the given initialization parameters.
+ *
+ * @param {Init} _
+ * @returns {Curve}
+ *
+ * @example
+ *
+ * ```js
+ * const curveParams = {
+ *     p: 23n,
+ *     a: [0n, 1n],
+ *     g: [1n, 1n],
+ *     n: 19n
+ * };
+ * const curveInstance = curve(curveParams);
+ *
+ * // Access curve operations
+ * const point = curveInstance.add([1n, 1n])([2n, 5n]); // Add two points
+ * const negPoint = curveInstance.neg([1n, 1n]); // Negate a point
+ * const mulPoint = curveInstance.mul([1n, 1n])(3n); // Multiply a point by 3
+ * ```
+ */
+export declare const curve: ({ p, a: [a0, a1], n, g }: Init) => Curve;
+/** @type {Equal<Point>} */
+export declare const eq: Equal<Point>;
+/**
+ * https://neuromancer.sk/std/secg/secp192r1
+ * NIST P-192
+ */
+export declare const secp192r1: Curve;
+/**
+ * https://en.bitcoin.it/wiki/Secp256k1
+ * https://neuromancer.sk/std/secg/secp256k1
+ */
+export declare const secp256k1: Curve;
+/**
+ * https://neuromancer.sk/std/secg/secp256r1
+ * NIST P-256
+ */
+export declare const secp256r1: Curve;
+/**
+ * https://neuromancer.sk/std/secg/secp384r1
+ */
+export declare const secp384r1: Curve;
+/**
+ * https://neuromancer.sk/std/secg/secp521r1
+ */
+export declare const secp521r1: Curve;

package/fjs/crypto/secp/module.f.mjs

@@ -0,0 +1,204 @@
+/**
+ * Short Weierstrass elliptic-curve arithmetic over a prime field: `curve`
+ * builds point negation, addition, and scalar multiplication for any
+ * `secp`-family curve from its `(p, a, g, n)` parameters.
+ *
+ * @module
+ *
+ * @import { Equal, Reduce } from '../../types/function/operator/types.ts'
+ * @import { Curve, Init, Point } from './types.ts'
+ */
+
+import { prime_field, sqrt } from '../../types/prime_field/module.f.mjs'
+import { repeat } from '../../common/monoid/module.f.mjs'
+
+/**
+ * Constructs an elliptic curve with the given initialization parameters.
+ *
+ * @param {Init} _
+ * @returns {Curve}
+ *
+ * @example
+ *
+ * ```js
+ * const curveParams = {
+ *     p: 23n,
+ *     a: [0n, 1n],
+ *     g: [1n, 1n],
+ *     n: 19n
+ * };
+ * const curveInstance = curve(curveParams);
+ *
+ * // Access curve operations
+ * const point = curveInstance.add([1n, 1n])([2n, 5n]); // Add two points
+ * const negPoint = curveInstance.neg([1n, 1n]); // Negate a point
+ * const mulPoint = curveInstance.mul([1n, 1n])(3n); // Multiply a point by 3
+ * ```
+ */
+export const curve = ({ p, a: [a0, a1], n, g }) => {
+    const pf = prime_field(p)
+    const { pow2, pow3, sub, add, mul, neg, div } = pf
+    const mul3 = mul(3n)
+    const mul2 = mul(2n)
+    const addA1 = add(a1)
+    const mulA1 = mul(a1)
+    const addA0 = add(a0)
+
+    /**
+     * y**2 = a1*x**3 + a0
+     *
+     * @type {(x: bigint) => bigint}
+     */
+    const y2 = x => addA0(add(pow3(x))(mulA1(x)))
+
+    /** @type {Reduce<Point>} */
+    const addPoint = p => q => {
+        if (p === null) {
+            return q
+        }
+        if (q === null) {
+            return p
+        }
+        const [px, py] = p
+        const [qx, qy] = q
+        const md = px === qx
+            // (3 * px ** 2 + a1) / (2 * py)
+            ? py !== qy || py === 0n ? null : [addA1(mul3(pow2(px))), mul2(py)]
+            // (py - qy) / (px - qx)
+            : [sub(py)(qy), sub(px)(qx)]
+        if (md === null) {
+            return null
+        }
+        const [ma, mb] = md
+        const m = div(ma)(mb)
+        // m ** 2 - px - qx
+        const rx = sub(pow2(m))(add(px)(qx))
+        // [rx, m * (px - rx) - py]
+        return [rx, sub(mul(m)(sub(px)(rx)))(py)]
+    }
+    const sqrt_p = sqrt(pf)
+    return {
+        pf,
+        nf: prime_field(n),
+        g,
+        y2,
+        y: x => sqrt_p(y2(x)),
+        neg: p => {
+            if (p === null) {
+                return null
+            }
+            const [x, y] = p
+            return [x, neg(y)]
+        },
+        add: addPoint,
+        mul: repeat({ identity: null, operation: addPoint })
+    }
+}
+
+/** @type {Equal<Point>} */
+export const eq = a => b => {
+    if (a === null || b === null) {
+        return a === b
+    }
+    const [ax, ay] = a
+    const [bx, by] = b
+    return ax === bx && ay === by
+}
+
+/**
+ * https://neuromancer.sk/std/secg/secp192r1
+ * NIST P-192
+ */
+export const secp192r1 = curve({
+    p: 0xffffffff_ffffffff_ffffffff_fffffffe_ffffffff_ffffffffn,
+    a: [
+        0x64210519_e59c80e7_0fa7e9ab_72243049_feb8deec_c146b9b1n,
+        0xffffffff_ffffffff_ffffffff_fffffffe_ffffffff_fffffffcn
+    ],
+    g: [
+        0x188da80e_b03090f6_7cbf20eb_43a18800_f4ff0afd_82ff1012n,
+        0x07192b95_ffc8da78_631011ed_6b24cdd5_73f977a1_1e794811n
+    ],
+    n: 0xffffffff_ffffffff_ffffffff_99def836_146bc9b1_b4d22831n,
+})
+
+// The curve doesn't have a simple square root function.
+// /**
+//  * https://std.neuromancer.sk/nist/P-224
+//  * NIST P-224
+//  */
+// export const secp224r1: Curve = curve({
+//     p: 0xffffffff_ffffffff_ffffffff_ffffffff_00000000_00000000_00000001n,
+//     a: [
+//         0xb4050a85_0c04b3ab_f5413256_5044b0b7_d7bfd8ba_270b3943_2355ffb4n,
+//         0xffffffff_ffffffff_ffffffff_fffffffe_ffffffff_ffffffff_fffffffen,
+//     ],
+//     g: [
+//         0xb70e0cbd_6bb4bf7f_321390b9_4a03c1d3_56c21122_343280d6_115c1d21n,
+//         0xbd376388_b5f723fb_4c22dfe6_cd4375a0_5a074764_44d58199_85007e34n,
+//     ],
+//     n: 0xffffffff_ffffffff_ffffffff_ffff16a2_e0b8f03e_13dd2945_5c5c2a3dn,
+// })
+
+/**
+ * https://en.bitcoin.it/wiki/Secp256k1
+ * https://neuromancer.sk/std/secg/secp256k1
+ */
+export const secp256k1 = curve({
+    p: 0xffffffff_ffffffff_ffffffff_ffffffff_ffffffff_ffffffff_fffffffe_fffffc2fn,
+    a: [7n, 0n],
+    g: [
+        0x79be667e_f9dcbbac_55a06295_ce870b07_029bfcdb_2dce28d9_59f2815b_16f81798n,
+        0x483ada77_26a3c465_5da4fbfc_0e1108a8_fd17b448_a6855419_9c47d08f_fb10d4b8n
+    ],
+    n: 0xffffffff_ffffffff_ffffffff_fffffffe_baaedce6_af48a03b_bfd25e8c_d0364141n,
+})
+
+/**
+ * https://neuromancer.sk/std/secg/secp256r1
+ * NIST P-256
+ */
+export const secp256r1 = curve({
+    p: 0xffffffff_00000001_00000000_00000000_00000000_ffffffff_ffffffff_ffffffffn,
+    a: [
+        0x5ac635d8_aa3a93e7_b3ebbd55_769886bc_651d06b0_cc53b0f6_3bce3c3e_27d2604bn, //< b
+        0xffffffff_00000001_00000000_00000000_00000000_ffffffff_ffffffff_fffffffcn, //< a
+    ],
+    g: [
+        0x6b17d1f2_e12c4247_f8bce6e5_63a440f2_77037d81_2deb33a0_f4a13945_d898c296n, //< x
+        0x4fe342e2_fe1a7f9b_8ee7eb4a_7c0f9e16_2bce3357_6b315ece_cbb64068_37bf51f5n, //< y
+    ],
+    n: 0xffffffff_00000000_ffffffff_ffffffff_bce6faad_a7179e84_f3b9cac2_fc632551n,
+})
+
+/**
+ * https://neuromancer.sk/std/secg/secp384r1
+ */
+export const secp384r1 = curve({
+    p: 0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000ffffffffn,
+    a: [
+        0xb3312fa7e23ee7e4988e056be3f82d19181d9c6efe8141120314088f5013875ac656398d8a2ed19d2a85c8edd3ec2aefn, //< b
+        0xfffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffeffffffff0000000000000000fffffffcn, //< a
+    ],
+    g: [
+        0xaa87ca22be8b05378eb1c71ef320ad746e1d3b628ba79b9859f741e082542a385502f25dbf55296c3a545e3872760ab7n, //< x
+        0x3617de4a96262c6f5d9e98bf9292dc29f8f41dbd289a147ce9da3113b5f0b8c00a60b1ce1d7e819d7a431d7c90ea0e5fn, //< y
+    ],
+    n: 0xffffffffffffffffffffffffffffffffffffffffffffffffc7634d81f4372ddf581a0db248b0a77aecec196accc52973n,
+})
+
+/**
+ * https://neuromancer.sk/std/secg/secp521r1
+ */
+export const secp521r1 = curve({
+    p: 0x01ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffn,
+    a: [
+        0x0051953eb9618e1c9a1f929a21a0b68540eea2da725b99b315f3b8b489918ef109e156193951ec7e937b1652c0bd3bb1bf073573df883d2c34f1ef451fd46b503f00n, //< b
+        0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffcn, //< a
+    ],
+    g: [
+        0x00c6858e06b70404e9cd9e3ecb662395b4429c648139053fb521f828af606b4d3dbaa14b5e77efe75928fe1dc127a2ffa8de3348b3c1856a429bf97e7e31c2e5bd66n,
+        0x011839296a789a3bc0045c8a5fb42c7d1bd998f54449579b446817afbd17273e662c97ee72995ef42640c550b9013fad0761353c7086a272c24088be94769fd16650n,
+    ],
+    n: 0x01fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa51868783bf2f966b7fcc0148f709a5d03bb5c9b8899c47aebb6fb71e91386409n
+})

package/fjs/crypto/secp/proof.f.d.mts

@@ -0,0 +1,11 @@
+/**
+ * @import { Point, Curve, Init } from './types.ts'
+ */
+export declare const proof: {
+    example: () => void;
+    test: () => void;
+    poker: () => {
+        [k: string]: () => void;
+    };
+    nullPointOps: () => void;
+};

package/fjs/crypto/secp/proof.f.mjs

@@ -0,0 +1,139 @@
+/**
+ * @import { Point, Curve, Init } from './types.ts'
+ */
+
+import { assert, assertEq, assertNotNullish } from '../../asserts/module.f.mjs'
+import { prime_field } from '../../types/prime_field/module.f.mjs'
+import { curve, secp256k1, secp192r1, secp256r1, eq, secp384r1, secp521r1 } from './module.f.mjs'
+
+/** @type {(param: Curve) => () => void} */
+const poker = param => () => {
+    // (c ^ x) ^ y = c ^ (x * y)
+    // c ^ ((x * y) * (1/x * 1/y)) = c
+    // const { g, n } = param
+    const { mul, y, nf: { p: n } } = param
+    /** @type {(m: bigint) => (pList: readonly Point[]) => readonly Point[]} */
+    const f = m => pList => pList.map(mul(m))
+    //
+    const pf = prime_field(n)
+    //           0        1        2        3        4        5        6        7
+    const sA = 0x01234567_89ABCDEF_01234567_89ABCDEF_01234567_89ABCDEF_01234567_89ABCDEFn % n
+    const sB = 0xFEDCBA98_FEDCBA98_FEDCBA98_FEDCBA98_FEDCBA98_FEDCBA98_FEDCBA98_FEDCBA98n % n
+    // "22d3ad011aec6aabdb3d3d47636f3e2859de02298c87a496"
+    // "2b359de5cfb5937a5610d565dceaef2a760ceeaec96e68140757f0c8371534e0"
+    // "1359162ede91207ccaea1de94afc63c1db5a967c1e6e21f91ef9f077f20a46b6"
+    const rA = pf.reciprocal(sA)
+    // "e1e768c7427cf5bafd58756df9b54b9ec2558201f129f4ab"
+    // "edaf7ede285c3da723c54fcdaa3b631f626681f884d8f41fae55c4f552bb551e"
+    // "6ca248e88c124478975b57c4c3ca682bd8be0f0d9f11593d01273d9ceebdb735"
+    const rB = pf.reciprocal(sB)
+    //
+    /** @type {readonly Point[]} */
+    let d = []
+    for (let i = 0n; i < 52n; ++i) {
+        let nonce = 0n // can be a random number in a range [`0`, `p >> 6n`).
+        let x = 0n
+        /** @type {bigint | null} */
+        let yi
+        while (true) {
+            x = i | (nonce << 6n)
+            yi = y(x)
+            if (yi !== null) {
+                break
+            }
+            ++nonce
+        }
+        d = [...d, [x, yi]]
+    }
+    //
+    const dA = f(sA)(d)
+    const dAB = f(sB)(dA)
+    const dB = f(rA)(dAB)
+    const dN = f(rB)(dB)
+    //
+    let m = 0n
+    for (const p of dN) {
+        assert(p !== null, 'null')
+        const x = p[0] & 0x3Fn
+        assertEq(x, m, [p[0], x, m])
+        ++m
+    }
+}
+
+export const proof = {
+    example: () => {
+        /** @type {Init} */
+        const curveParams = {
+            p: 23n,
+            a: [0n, 1n],
+            g: [1n, 1n],
+            n: 19n
+        }
+        const c = curve(curveParams)
+        // Access curve operations
+        const point = c.add([1n, 1n])([2n, 5n]); // Add two points
+        const negPoint = c.neg([1n, 1n]); // Negate a point
+        const mulPoint = c.mul(3n)([1n, 1n]); // Multiply a point by 3
+    },
+    test: () => {
+        /** @type {(c: Curve) => void} */
+        const test_curve = c => {
+            const { mul, neg, pf: { abs }, y: yf, nf: { p: n }, g } = c
+            /** @type {(p: Point) => void} */
+            const point_check = p => {
+                assert(p !== null, 'p === null')
+                const [x, y] = p
+                const ye = assertNotNullish(yf(x), 'ye === null')
+                assertEq(abs(ye), abs(y), 'ye')
+            }
+            point_check(g)
+            point_check(neg(g))
+            /** @type {(p: Point) => void} */
+            const test_mul = p => {
+                assertEq(mul(0n)(p), null, 'O')
+                assertEq(mul(1n)(p), p, 'p')
+                assertEq(mul(n)(p), null, 'n')
+                const pn = neg(p)
+                assert(eq(mul(n - 1n)(p))(pn), 'n - 1')
+                /** @type {(s: bigint) => void} */
+                const f = s => {
+                    const r = mul(s)(p)
+                    point_check(r)
+                    const rn = mul(s)(pn)
+                    point_check(rn)
+                    assert(eq(r)(neg(rn)), 'r != -rn')
+                }
+                f(2n)
+                f(3n)
+                f(4n << 128n)
+                f((5n << 128n) + 6n)
+                f(7n << 128n)
+                f((8n << 128n) + 9n)
+            }
+            test_mul(g)
+            test_mul(neg(g))
+        }
+        test_curve(secp256k1)
+        test_curve(secp192r1)
+        test_curve(secp256r1)
+        test_curve(secp384r1)
+        test_curve(secp521r1)
+    },
+    poker: () => {
+        const c = {
+            secp192r1,
+            //secp256k1,
+            //secp256r1,
+        }
+        return Object.fromEntries(Object.entries(c).map(([k, v]) => [k, poker(v)]))
+    },
+    // Cover null (point at infinity) branches in neg, add, and eq.
+    nullPointOps: () => {
+        const c = secp256k1
+        assertEq(c.neg(null), null)
+        assert(eq(null)(null))
+        assert(!eq(null)(c.g))
+        assert(!eq(c.g)(null))
+        assert(eq(c.add(c.g)(null))(c.g))
+    }
+}

package/fjs/crypto/secp/types.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Types for short Weierstrass elliptic-curve arithmetic over a prime field.
+ *
+ * @module
+ */
+import type { Fold, Reduce } from '../../types/function/operator/types.ts';
+import type { PrimeField } from '../../types/prime_field/types.ts';
+/** A 2D point represented as a pair of `bigint` values `[x, y]`. */
+export type Point2D = readonly [bigint, bigint];
+/**
+ * A 2D point on an elliptic curve, represented as a pair of `bigint` values.
+ * `null` represents the point at infinity (`O`).
+ */
+export type Point = Point2D | null;
+/**
+ * Initialization parameters for an elliptic curve.
+ */
+export type Init = {
+    readonly p: bigint;
+    readonly a: readonly [bigint, bigint];
+    readonly g: readonly [bigint, bigint];
+    readonly n: bigint;
+};
+/**
+ * Represents an elliptic curve and its associated operations.
+ */
+export type Curve = {
+    readonly pf: PrimeField;
+    readonly nf: PrimeField;
+    readonly g: Point;
+    readonly y2: (x: bigint) => bigint;
+    readonly y: (x: bigint) => bigint | null;
+    readonly neg: (a: Point) => Point;
+    readonly add: Reduce<Point>;
+    readonly mul: Fold<bigint, Point>;
+};