{"version":3,"sources":["../src/core/hash/poseidon-bn254.ts","../src/core/hash/poseidon-bls.ts","../src/core/hash/poseidon31-constants.ts","../src/core/hash/poseidon31-perm.ts","../src/core/hash/poseidon31.ts","../src/core/hash/poseidon-m31.ts","../src/core/hash/index.ts","../src/core/tree.ts"],"names":["modM31"],"mappings":";;;AAmBA,IAAI,QAAA,GAA8B,IAAA;AAElC,eAAe,IAAA,GAA4B;AACzC,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,MAAM,EAAE,aAAA,EAAc,GAAI,MAAM,OAAO,aAAa,CAAA;AACpD,IAAA,QAAA,GAAW,MAAM,aAAA,EAAc;AAAA,EACjC;AACA,EAAA,OAAO,QAAA;AACT;AAKO,IAAM,iBAAA,GAAoB;AAE1B,IAAM,gBAAN,MAA6C;AAAA,EACzC,IAAA,GAAO,gBAAA;AAAA,EACP,UAAA,GAAa,iBAAA;AAAA,EACb,YAAA,GAAe,GAAA;AAAA,EAExB,MAAM,KAAA,CAAM,IAAA,EAAc,KAAA,EAAgC;AACxD,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAC,IAAA,EAAM,KAAK,CAAC,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,MAAM,MAAA,EAAmC;AAC7C,IAAA,MAAM,UAAA,GAAa,MAAM,IAAA,EAAK;AAC9B,IAAA,MAAM,IAAA,GAAO,WAAW,MAAM,CAAA;AAC9B,IAAA,OAAO,UAAA,CAAW,CAAA,CAAE,QAAA,CAAS,IAAI,CAAA;AAAA,EACnC;AACF;;;AC5BO,IAAM,qBAAA,GAAwB;AAE9B,IAAM,mBAAN,MAAgD;AAAA,EAC5C,IAAA,GAAO,oBAAA;AAAA,EACP,UAAA,GAAa,qBAAA;AAAA,EACb,YAAA,GAAe,GAAA;AAAA,EAExB,MAAM,KAAA,CAAM,IAAA,EAAc,KAAA,EAAgC;AACxD,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,CAAC,IAAA,EAAM,KAAK,CAAC,CAAA;AAAA,EACjC;AAAA,EAEA,MAAM,MAAM,MAAA,EAAmC;AAG7C,IAAA,MAAM,GAAA,GAAM,MAAM,OAAO,mBAAmB,CAAA;AAC5C,IAAA,MAAM,OAAA,GAAU,CAAA,QAAA,EAAW,MAAA,CAAO,MAAM,CAAA,CAAA;AACxC,IAAA,MAAM,EAAA,GAAK,IAAI,OAAO,CAAA;AACtB,IAAA,IAAI,OAAO,OAAO,UAAA,EAAY;AAC5B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0CAAA,EAA6C,MAAA,CAAO,MAAM,CAAA,SAAA,CAAW,CAAA;AAAA,IACvF;AACA,IAAA,OAAQ,GAAoC,MAAM,CAAA;AAAA,EACpD;AACF;;;ACrBO,IAAM,KAAA,GAAQ,EAAA;AAGd,IAAM,IAAA,GAAO,CAAA;AAMb,IAAM,WAAA,GAAc;AAGpB,IAAM,qBAAA,GAAwB,CAAA;AAG9B,IAAM,sBAAA,GAAyB,CAAA;AAG/B,IAAM,gBAAA,GAAmB,EAAA;AAGzB,IAAM,YAAA,GAAe;AAMrB,IAAM,oBAAA,GAA0C;AAAA,EACrD,CAAA;AAAA,EAAG,CAAA;AAAA,EAAG,CAAA;AAAA,EAAG,CAAA;AAAA,EAAG,CAAA;AAAA,EAAG,CAAA;AAAA,EAAG,CAAA;AAAA,EAAG,CAAA;AAAA,EAAG,CAAA;AAAA,EAAG,EAAA;AAAA,EAAI,EAAA;AAAA,EAAI,EAAA;AAAA,EAAI,EAAA;AAAA,EAAI,EAAA;AAAA,EAAI;AACjD,CAAA;AAGO,IAAM,mBAAA,GAAsD;AAAA,EACjE;AAAA,IACE,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa;AAAA,GACzC;AAAA,EACA;AAAA,IACE,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa;AAAA,GACzC;AAAA,EACA;AAAA,IACE,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa;AAAA,GACzC;AAAA,EACA;AAAA,IACE,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa;AAAA;AAE3C,CAAA;AAGO,IAAM,WAAA,GAAiC;AAAA,EAC5C,WAAA;AAAA,EAAa,WAAA;AAAA,EAAa,WAAA;AAAA,EAAa,WAAA;AAAA,EACvC,WAAA;AAAA,EAAa,WAAA;AAAA,EAAa,WAAA;AAAA,EAAa,WAAA;AAAA,EACvC,WAAA;AAAA,EAAa,WAAA;AAAA,EAAa,WAAA;AAAA,EAAa,WAAA;AAAA,EACvC,WAAA;AAAA,EAAa;AACf,CAAA;AAGO,IAAM,oBAAA,GAAuD;AAAA,EAClE;AAAA,IACE,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa;AAAA,GACzC;AAAA,EACA;AAAA,IACE,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa;AAAA,GACzC;AAAA,EACA;AAAA,IACE,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa;AAAA,GACzC;AAAA,EACA;AAAA,IACE,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IACvC,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa,WAAA;AAAA,IAAa;AAAA;AAE3C,CAAA;;;ACnFO,IAAM,SAAA,GAAA,CAAa,MAAM,GAAA,IAAO,EAAA;AAGvC,SAAS,OAAO,CAAA,EAAmB;AACjC,EAAA,MAAM,IAAI,CAAA,GAAI,SAAA;AACd,EAAA,OAAO,CAAA,GAAI,EAAA,GAAK,CAAA,GAAI,SAAA,GAAY,CAAA;AAClC;AAEA,SAAS,GAAA,CAAI,GAAW,CAAA,EAAmB;AACzC,EAAA,OAAO,MAAA,CAAO,IAAI,CAAC,CAAA;AACrB;AAEA,SAAS,GAAA,CAAI,GAAW,CAAA,EAAmB;AACzC,EAAA,OAAO,MAAA,CAAO,IAAI,CAAC,CAAA;AACrB;AAEA,SAAS,GAAA,CAAI,GAAW,CAAA,EAAmB;AACzC,EAAA,OAAO,MAAA,CAAO,IAAI,CAAC,CAAA;AACrB;AAEA,SAAS,OAAO,CAAA,EAAmB;AACjC,EAAA,OAAO,GAAA,CAAI,GAAG,CAAC,CAAA;AACjB;AAGA,SAAS,KAAK,CAAA,EAAmB;AAC/B,EAAA,MAAM,EAAA,GAAK,GAAA,CAAI,CAAA,EAAG,CAAC,CAAA;AACnB,EAAA,MAAM,EAAA,GAAK,GAAA,CAAI,EAAA,EAAI,EAAE,CAAA;AACrB,EAAA,OAAO,GAAA,CAAI,IAAI,CAAC,CAAA;AAClB;AAYA,SAAS,UAAU,CAAA,EAAmB;AACpC,EAAA,MAAM,EAAA,GAAK,EAAE,CAAC,CAAA;AACd,EAAA,MAAM,EAAA,GAAK,EAAE,CAAC,CAAA;AACd,EAAA,MAAM,EAAA,GAAK,EAAE,CAAC,CAAA;AACd,EAAA,MAAM,EAAA,GAAK,EAAE,CAAC,CAAA;AAEd,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,EAAA,EAAI,EAAE,CAAA;AACtB,EAAA,MAAM,GAAA,GAAM,GAAA,CAAI,EAAA,EAAI,EAAE,CAAA;AACtB,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,GAAA,EAAK,GAAG,CAAA;AAC1B,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,KAAA,EAAO,EAAE,CAAA;AAC5B,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,KAAA,EAAO,EAAE,CAAA;AAG5B,EAAA,CAAA,CAAE,CAAC,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,MAAA,CAAO,EAAE,CAAC,CAAA;AAE7B,EAAA,CAAA,CAAE,CAAC,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,MAAA,CAAO,EAAE,CAAC,CAAA;AAE7B,EAAA,CAAA,CAAE,CAAC,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,GAAG,CAAA;AAEtB,EAAA,CAAA,CAAE,CAAC,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,GAAG,CAAA;AACxB;AAQA,SAAS,oBAAoB,KAAA,EAAuB;AAClD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,KAAK,CAAA,EAAG;AACjC,IAAA,MAAM,QAAQ,CAAC,KAAA,CAAM,CAAC,CAAA,EAAI,MAAM,CAAA,GAAI,CAAC,CAAA,EAAI,KAAA,CAAM,IAAI,CAAC,CAAA,EAAI,KAAA,CAAM,CAAA,GAAI,CAAC,CAAE,CAAA;AACrE,IAAA,SAAA,CAAU,KAAK,CAAA;AACf,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA;AAClB,IAAA,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA;AACtB,IAAA,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA;AACtB,IAAA,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,GAAI,KAAA,CAAM,CAAC,CAAA;AAAA,EACxB;AAEA,EAAA,MAAM,IAAA,GAAiB,CAAC,EAAA,EAAI,EAAA,EAAI,IAAI,EAAE,CAAA;AACtC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK;AAC1B,IAAA,IAAA,CAAK,CAAC,IAAI,GAAA,CAAI,GAAA,CAAI,MAAM,CAAC,CAAA,EAAI,MAAM,CAAA,GAAI,CAAC,CAAE,CAAA,EAAG,GAAA,CAAI,MAAM,CAAA,GAAI,CAAC,GAAI,KAAA,CAAM,CAAA,GAAI,EAAE,CAAE,CAAC,CAAA;AAAA,EACjF;AAEA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK;AAC9B,IAAA,KAAA,CAAM,CAAC,IAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAA,EAAI,IAAA,CAAK,CAAA,GAAI,CAAC,CAAE,CAAA;AAAA,EACxC;AACF;AAGA,SAAS,SAAA,CAAU,GAAW,KAAA,EAAuB;AACnD,EAAA,IAAI,GAAA,GAAM,CAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK;AAC9B,IAAA,GAAA,GAAM,OAAO,GAAG,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,GAAA;AACT;AASA,SAAS,oBAAoB,KAAA,EAAuB;AAClD,EAAA,IAAI,OAAA,GAAU,EAAA;AACd,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK;AAC9B,IAAA,OAAA,GAAU,GAAA,CAAI,OAAA,EAAS,KAAA,CAAM,CAAC,CAAE,CAAA;AAAA,EAClC;AAEA,EAAA,KAAA,CAAM,CAAC,IAAI,GAAA,CAAI,OAAA,EAAS,OAAO,KAAA,CAAM,CAAC,CAAE,CAAC,CAAA;AACzC,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK;AAC9B,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,GAAA,CAAI,OAAA,EAAS,SAAA,CAAU,KAAA,CAAM,CAAC,CAAA,EAAI,oBAAA,CAAqB,CAAA,GAAI,CAAC,CAAE,CAAC,CAAA;AAAA,EAC5E;AACF;AAGA,SAAS,aAAA,CAAc,OAAiB,EAAA,EAA6B;AACnE,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK;AAC9B,IAAA,KAAA,CAAM,CAAC,IAAI,GAAA,CAAI,KAAA,CAAM,CAAC,CAAA,EAAI,EAAA,CAAG,CAAC,CAAE,CAAA;AAAA,EAClC;AACA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,EAAO,CAAA,EAAA,EAAK;AAC9B,IAAA,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAE,CAAA;AAAA,EAC3B;AACA,EAAA,mBAAA,CAAoB,KAAK,CAAA;AAC3B;AAGA,SAAS,aAAA,CAAc,OAAiB,EAAA,EAAkB;AACxD,EAAA,KAAA,CAAM,CAAC,CAAA,GAAI,GAAA,CAAI,KAAA,CAAM,CAAC,GAAI,EAAE,CAAA;AAC5B,EAAA,KAAA,CAAM,CAAC,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,CAAC,CAAE,CAAA;AACzB,EAAA,mBAAA,CAAoB,KAAK,CAAA;AAC3B;AAcO,SAAS,QAAQ,KAAA,EAAuB;AAC7C,EAAA,IAAI,KAAA,CAAM,WAAW,KAAA,EAAO;AAC1B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6CAAA,EAAgD,KAAK,CAAA,MAAA,EAAS,KAAA,CAAM,MAAM,CAAA,CAAE,CAAA;AAAA,EAC9F;AAEA,EAAA,mBAAA,CAAoB,KAAK,CAAA;AAEzB,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,qBAAA,EAAuB,CAAA,EAAA,EAAK;AAC9C,IAAA,aAAA,CAAc,KAAA,EAAO,mBAAA,CAAoB,CAAC,CAAE,CAAA;AAAA,EAC9C;AACA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,gBAAA,EAAkB,CAAA,EAAA,EAAK;AACzC,IAAA,aAAA,CAAc,KAAA,EAAO,WAAA,CAAY,CAAC,CAAE,CAAA;AAAA,EACtC;AACA,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,sBAAA,EAAwB,CAAA,EAAA,EAAK;AAC/C,IAAA,aAAA,CAAc,KAAA,EAAO,oBAAA,CAAqB,CAAC,CAAE,CAAA;AAAA,EAC/C;AACF;;;ACvKA,SAASA,QAAO,CAAA,EAAmB;AACjC,EAAA,MAAM,IAAI,CAAA,GAAI,SAAA;AACd,EAAA,OAAO,CAAA,GAAI,EAAA,GAAK,CAAA,GAAI,SAAA,GAAY,CAAA;AAClC;AAQO,SAAS,QAAQ,MAAA,EAA4B;AAClD,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,IAAA,MAAM,CAAA,GAAI,OAAO,CAAC,CAAA;AAClB,IAAA,IAAI,CAAA,GAAI,EAAA,IAAM,CAAA,IAAK,SAAA,EAAW;AAC5B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,CAAC,CAAA,IAAA,EAAO,CAAC,CAAA,sBAAA,CAAwB,CAAA;AAAA,IACrE;AAAA,EACF;AAIA,EAAA,MAAM,QAAkB,IAAI,KAAA,CAAM,KAAK,CAAA,CAAE,KAAK,EAAE,CAAA;AAChD,EAAA,KAAA,CAAM,IAAI,CAAA,GAAI,MAAA,CAAO,MAAA,CAAO,MAAM,CAAA;AAElC,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,MAAA,EAAQ,KAAK,IAAA,EAAM;AAC5C,IAAA,MAAM,MAAM,IAAA,CAAK,GAAA,CAAI,CAAA,GAAI,IAAA,EAAM,OAAO,MAAM,CAAA;AAC5C,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,GAAM,GAAG,CAAA,EAAA,EAAK;AAChC,MAAA,KAAA,CAAM,CAAC,IAAIA,OAAAA,CAAO,KAAA,CAAM,CAAC,CAAA,GAAK,MAAA,CAAO,CAAA,GAAI,CAAC,CAAE,CAAA;AAAA,IAC9C;AACA,IAAA,OAAA,CAAQ,KAAK,CAAA;AAAA,EACf;AAEA,EAAA,OAAO,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,WAAW,CAAA;AACnC;AAMO,SAAS,OAAA,CAAQ,MAAc,KAAA,EAAuB;AAC3D,EAAA,OAAO,QAAQ,CAAC,IAAA,EAAM,KAAK,CAAC,EAAE,CAAC,CAAA;AACjC;AAOO,SAAS,iBAAiB,WAAA,EAAiC;AAChE,EAAA,IAAI,WAAA,CAAY,WAAW,YAAA,EAAc;AACvC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,2BAAA,EAA8B,YAAY,CAAA,YAAA,EAAe,WAAA,CAAY,MAAM,CAAA;AAAA,KAC7E;AAAA,EACF;AACA,EAAA,OAAO,QAAQ,WAAW,CAAA;AAC5B;AAOO,SAAS,iBAAA,CACd,MAAA,EACA,SAAA,EACA,QAAA,EACA,QACA,KAAA,EACU;AACV,EAAA,IAAI,SAAA,CAAU,WAAW,WAAA,EAAa;AACpC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,uCAAA,EAA0C,WAAW,CAAA,YAAA,EAAe,SAAA,CAAU,MAAM,CAAA;AAAA,KACtF;AAAA,EACF;AACA,EAAA,OAAO,OAAA,CAAQ;AAAA,IACb,MAAA;AAAA,IACA,UAAU,CAAC,CAAA;AAAA,IACX,UAAU,CAAC,CAAA;AAAA,IACX,UAAU,CAAC,CAAA;AAAA,IACX,UAAU,CAAC,CAAA;AAAA,IACX,QAAA;AAAA,IACA,MAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAOO,SAAS,gBAAA,CACd,WAAA,EACA,SAAA,EACA,UAAA,EACU;AACV,EAAA,IAAI,WAAA,CAAY,WAAW,YAAA,EAAc;AACvC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,wCAAA,EAA2C,YAAY,CAAA,YAAA,EAAe,WAAA,CAAY,MAAM,CAAA;AAAA,KAC1F;AAAA,EACF;AACA,EAAA,IAAI,UAAA,CAAW,WAAW,WAAA,EAAa;AACrC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,uCAAA,EAA0C,WAAW,CAAA,YAAA,EAAe,UAAA,CAAW,MAAM,CAAA;AAAA,KACvF;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAmB;AAAA,IACvB,GAAG,WAAA;AAAA,IACH,SAAA;AAAA,IACA,GAAG;AAAA,GACL;AACA,EAAA,OAAO,QAAQ,MAAM,CAAA;AACvB;AASO,SAAS,gBAAA,CACd,IAAA,EACA,YAAA,EACA,WAAA,EACQ;AACR,EAAA,IAAI,YAAA,CAAa,MAAA,KAAW,WAAA,CAAY,MAAA,EAAQ;AAC9C,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,gCAAA,EAAmC,YAAA,CAAa,MAAM,CAAA,kBAAA,EAAqB,YAAY,MAAM,CAAA,iBAAA;AAAA,KAC/F;AAAA,EACF;AACA,EAAA,IAAI,OAAA,GAAU,IAAA;AACd,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,YAAA,CAAa,QAAQ,CAAA,EAAA,EAAK;AAC5C,IAAA,MAAM,OAAA,GAAU,aAAa,CAAC,CAAA;AAC9B,IAAA,MAAM,KAAA,GAAQ,YAAY,CAAC,CAAA;AAC3B,IAAA,IAAI,IAAA;AACJ,IAAA,IAAI,KAAA;AACJ,IAAA,IAAI,UAAU,EAAA,EAAI;AAChB,MAAA,IAAA,GAAO,OAAA;AACP,MAAA,KAAA,GAAQ,OAAA;AAAA,IACV,CAAA,MAAO;AACL,MAAA,IAAA,GAAO,OAAA;AACP,MAAA,KAAA,GAAQ,OAAA;AAAA,IACV;AACA,IAAA,OAAA,GAAU,OAAA,CAAQ,MAAM,KAAK,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,OAAA;AACT;;;ACvJO,IAAM,eAAA,GAAkB;AAExB,IAAM,cAAN,MAA2C;AAAA,EACvC,IAAA,GAAO,cAAA;AAAA,EACP,UAAA,GAAa,eAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKb,YAAA,GAAe,EAAA;AAAA,EAExB,MAAM,KAAA,CAAM,IAAA,EAAc,KAAA,EAAgC;AACxD,IAAA,OAAO,OAAA,CAAQ,MAAM,KAAK,CAAA;AAAA,EAC5B;AAAA,EAEA,MAAM,MAAM,MAAA,EAAmC;AAC7C,IAAA,OAAO,OAAA,CAAQ,MAAM,CAAA,CAAE,CAAC,CAAA;AAAA,EAC1B;AACF;;;ACbO,SAAS,sBAAA,GAAyB;AACvC,EAAA,OAAO,IAAI,gBAAA,EAAiB;AAC9B;;;AChBO,IAAM,kBAAA,GAAqB;AAK3B,IAAM,cAAA,GAAiB;AAWvB,IAAM,aAAN,MAAiB;AAAA,EACd,SAAmB,EAAC;AAAA,EACpB,KAAA,uBAAiC,GAAA,EAAI;AAAA,EACrC,UAAA,GAA4B,IAAA;AAAA,EAC3B,QAAA;AAAA,EACA,MAAA;AAAA,EAET,WAAA,CAAY,QAAA,GAAmB,kBAAA,EAAoB,MAAA,EAAwB;AACzE,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,MAAA,GAAS,UAAU,sBAAA,EAAuB;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,IAAA,EAAsB;AAC3B,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,MAAM,IAAI,MAAM,qBAAqB,CAAA;AAAA,IACvC;AACA,IAAA,MAAM,KAAA,GAAQ,KAAK,MAAA,CAAO,MAAA;AAC1B,IAAA,IAAA,CAAK,MAAA,CAAO,KAAK,IAAI,CAAA;AACrB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAClB,IAAA,IAAA,CAAK,MAAM,KAAA,EAAM;AACjB,IAAA,OAAO,KAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,IAAA,GAAe;AACjB,IAAA,OAAO,KAAK,MAAA,CAAO,MAAA;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,KAAA,GAAgB;AAClB,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,MAAA,IAAU,CAAA,EAAG,OAAO,CAAA;AACpC,IAAA,OAAO,KAAK,IAAA,CAAK,IAAA,CAAK,KAAK,IAAA,CAAK,MAAA,CAAO,MAAM,CAAC,CAAA;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,IAAA,EAAuB;AACzB,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,QAAA,CAAS,IAAI,CAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA,EAKA,QAAQ,IAAA,EAAsB;AAC5B,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,IAAI,CAAA;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,GAA2B;AAC/B,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG;AAC5B,MAAA,OAAO,EAAA;AAAA,IACT;AACA,IAAA,IAAI,IAAA,CAAK,eAAe,IAAA,EAAM;AAC5B,MAAA,OAAO,IAAA,CAAK,UAAA;AAAA,IACd;AACA,IAAA,IAAA,CAAK,UAAA,GAAa,MAAM,IAAA,CAAK,WAAA,EAAY;AACzC,IAAA,OAAO,IAAA,CAAK,UAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAS,KAAA,EAAqC;AAClD,IAAA,IAAI,KAAA,GAAQ,CAAA,IAAK,KAAA,IAAS,IAAA,CAAK,OAAO,MAAA,EAAQ;AAC5C,MAAA,MAAM,IAAI,MAAM,CAAA,WAAA,EAAc,KAAK,yBAAyB,IAAA,CAAK,MAAA,CAAO,MAAM,CAAA,CAAA,CAAG,CAAA;AAAA,IACnF;AAEA,IAAA,MAAM,eAAyB,EAAC;AAChC,IAAA,MAAM,cAAwB,EAAC;AAC/B,IAAA,MAAM,YAAY,IAAA,CAAK,KAAA;AAEvB,IAAA,IAAI,YAAA,GAAe,KAAA;AAEnB,IAAA,KAAA,IAAS,KAAA,GAAQ,CAAA,EAAG,KAAA,GAAQ,SAAA,EAAW,KAAA,EAAA,EAAS;AAC9C,MAAA,MAAM,eAAe,YAAA,GAAe,CAAA;AACpC,MAAA,MAAM,MAAA,GAAS,eAAe,CAAA,KAAM,CAAA;AAEpC,MAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,WAAA,CAAY,OAAO,YAAY,CAAA;AAC1D,MAAA,YAAA,CAAa,KAAK,OAAO,CAAA;AACzB,MAAA,WAAA,CAAY,IAAA,CAAK,MAAA,GAAS,CAAA,GAAI,CAAC,CAAA;AAE/B,MAAA,YAAA,GAAe,IAAA,CAAK,KAAA,CAAM,YAAA,GAAe,CAAC,CAAA;AAAA,IAC5C;AAEA,IAAA,OAAO;AAAA,MACL,YAAA;AAAA,MACA,WAAA;AAAA,MACA,SAAA,EAAW,KAAA;AAAA,MACX,IAAA,EAAM,MAAM,IAAA,CAAK,OAAA;AAAQ,KAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,WAAA,CAAY,KAAA,EAAe,KAAA,EAAgC;AACvE,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,KAAK,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA;AAC7B,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA,EAAG;AACvB,MAAA,OAAO,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAAA,IAC3B;AAEA,IAAA,IAAI,IAAA;AAEJ,IAAA,IAAI,UAAU,CAAA,EAAG;AACf,MAAA,IAAA,GAAO,QAAQ,IAAA,CAAK,MAAA,CAAO,SAAS,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA,GAAK,EAAA;AAAA,IAC5D,CAAA,MAAO;AACL,MAAA,MAAM,YAAY,MAAM,IAAA,CAAK,YAAY,KAAA,GAAQ,CAAA,EAAG,QAAQ,CAAC,CAAA;AAC7D,MAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,WAAA,CAAY,QAAQ,CAAA,EAAG,KAAA,GAAQ,IAAI,CAAC,CAAA;AAElE,MAAA,IAAI,SAAA,KAAc,EAAA,IAAM,UAAA,KAAe,EAAA,EAAI;AACzC,QAAA,IAAA,GAAO,EAAA;AAAA,MACT,CAAA,MAAA,IAAW,eAAe,EAAA,EAAI;AAE5B,QAAA,IAAA,GAAO,SAAA;AAAA,MACT,CAAA,MAAO;AACL,QAAA,IAAA,GAAO,MAAM,IAAA,CAAK,MAAA,CAAO,KAAA,CAAM,WAAW,UAAU,CAAA;AAAA,MACtD;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AACxB,IAAA,OAAO,IAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,WAAA,GAA+B;AAC3C,IAAA,IAAI,IAAA,CAAK,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,EAAA;AACrC,IAAA,IAAI,KAAK,MAAA,CAAO,MAAA,KAAW,GAAG,OAAO,IAAA,CAAK,OAAO,CAAC,CAAA;AAClD,IAAA,MAAM,YAAY,IAAA,CAAK,KAAA;AACvB,IAAA,OAAO,MAAM,IAAA,CAAK,WAAA,CAAY,SAAA,EAAW,CAAC,CAAA;AAAA,EAC5C;AACF;AAKO,SAAS,eAAA,CAAgB,MAAA,EAAkB,QAAA,EAAmB,MAAA,EAAoC;AACvG,EAAA,MAAM,IAAA,GAAO,IAAI,UAAA,CAAW,QAAA,EAAU,MAAM,CAAA;AAC5C,EAAA,KAAA,MAAW,QAAQ,MAAA,EAAQ;AACzB,IAAA,IAAA,CAAK,OAAO,IAAI,CAAA;AAAA,EAClB;AACA,EAAA,OAAO,IAAA;AACT;AAMA,eAAsB,iBAAA,CACpB,IAAA,EACA,KAAA,EACA,MAAA,EACkB;AAClB,EAAA,MAAM,IAAA,GAAO,UAAU,sBAAA,EAAuB;AAC9C,EAAA,IAAI,OAAA,GAAU,IAAA;AAEd,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,YAAA,CAAa,QAAQ,CAAA,EAAA,EAAK;AAClD,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,YAAA,CAAa,CAAC,CAAA;AACpC,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,WAAA,CAAY,CAAC,CAAA,KAAM,CAAA;AAExC,IAAA,IAAI,YAAY,EAAA,EAAI;AAClB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,OAAA,GAAU,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,EAAS,OAAO,CAAA;AAAA,IAC7C,CAAA,MAAO;AACL,MAAA,OAAA,GAAU,MAAM,IAAA,CAAK,KAAA,CAAM,OAAA,EAAS,OAAO,CAAA;AAAA,IAC7C;AAAA,EACF;AAEA,EAAA,OAAO,YAAY,KAAA,CAAM,IAAA;AAC3B","file":"chunk-SDMQYYQ4.cjs","sourcesContent":["/**\n * Poseidon Hash over BN254\n *\n * ~100-bit security (post Kim-Barbulescu 2016).\n * Uses circomlibjs for compatibility with Circom circuits compiled for BN254.\n *\n * Use PoseidonBLS12381 for 128-bit security (institutional/audit requirements).\n */\n\nimport type { IHashFunction } from './interface.js'\n\n// circomlibjs types\ntype PoseidonFn = {\n (inputs: bigint[]): Uint8Array\n F: {\n toObject: (val: Uint8Array) => bigint\n }\n}\n\nlet instance: PoseidonFn | null = null\n\nasync function init(): Promise {\n if (!instance) {\n const { buildPoseidon } = await import('circomlibjs')\n instance = await buildPoseidon() as PoseidonFn\n }\n return instance!\n}\n\n/**\n * BN254 field prime (used by Ethereum precompiles, Circom default)\n */\nexport const BN254_FIELD_PRIME = 21888242871839275222246405745257275088548364400416034343698204186575808495617n\n\nexport class PoseidonBN254 implements IHashFunction {\n readonly name = 'Poseidon-BN254'\n readonly fieldPrime = BN254_FIELD_PRIME\n readonly securityBits = 100\n\n async hash2(left: bigint, right: bigint): Promise {\n return this.hashN([left, right])\n }\n\n async hashN(inputs: bigint[]): Promise {\n const poseidonFn = await init()\n const hash = poseidonFn(inputs)\n return poseidonFn.F.toObject(hash)\n }\n}\n","/**\n * Poseidon Hash over BLS12-381\n *\n * 128-bit security — meets institutional audit requirements.\n * Uses the poseidon-bls12381 npm package with constants derived from\n * the official Poseidon reference implementation.\n *\n * This is the DEFAULT hash function for the UPC SDK.\n *\n * Compatible with:\n * - Circom circuits compiled with `--prime bls12381`\n * - poseidon-bls12381-circom Circom templates\n * - EIP-2537 on-chain verification (Pectra, live since May 2025)\n */\n\nimport type { IHashFunction } from './interface.js'\n\n/**\n * BLS12-381 scalar field prime\n */\nexport const BLS12_381_FIELD_PRIME = 52435875175126190479447740508185965837690552500527637822603658699938581184513n\n\nexport class PoseidonBLS12381 implements IHashFunction {\n readonly name = 'Poseidon-BLS12-381'\n readonly fieldPrime = BLS12_381_FIELD_PRIME\n readonly securityBits = 128\n\n async hash2(left: bigint, right: bigint): Promise {\n return this.hashN([left, right])\n }\n\n async hashN(inputs: bigint[]): Promise {\n // poseidon-bls12381 exports poseidon1, poseidon2, ..., poseidon16\n // We dynamically import the right arity function\n const mod = await import('poseidon-bls12381')\n const arityFn = `poseidon${inputs.length}` as keyof typeof mod\n const fn = mod[arityFn]\n if (typeof fn !== 'function') {\n throw new Error(`Poseidon-BLS12-381 does not support arity ${inputs.length} (max 16)`)\n }\n return (fn as (inputs: bigint[]) => bigint)(inputs)\n }\n}\n","/**\n * Poseidon2-Mersenne31 (width 16) round constants.\n *\n * Mirror of [poseidon31_constants.rs](https://github.com/permissionless-technologies/universal-private-pool/blob/main/stwo-prover/src/poseidon31_constants.rs)\n * — these are the Plonky3 v0.5.2 `default_mersenne31_poseidon2_16()`\n * constants reduced into M31. The Rust file is the single source of truth;\n * this TS table was generated by running its\n * `print_canonical_constants` test (with `--nocapture`) and is verified\n * round-by-round against the canonical hash test vectors.\n *\n * Configuration (frozen 2026-04-30):\n * - WIDTH = 16\n * - 4 initial full rounds + 14 partial rounds + 4 terminal full rounds\n * - S-box = x^5\n * - Internal diagonal V_16 = [-2, 1, 2, 4, 8, 16, 32, 64, 128, 256,\n * 1024, 4096, 8192, 16384, 32768, 65536]\n * encoded as left-shifts [0,1,2,3,4,5,6,7,8,10,12,13,14,15,16] for\n * indices 1..16.\n */\n\n/** Permutation width. */\nexport const WIDTH = 16\n\n/** Sponge rate. */\nexport const RATE = 8\n\n/** Sponge capacity. */\nexport const CAPACITY = WIDTH - RATE\n\n/** Digest size in M31 elements. */\nexport const DIGEST_SIZE = 4\n\n/** Number of full rounds at the start. */\nexport const N_FULL_ROUNDS_INITIAL = 4\n\n/** Number of full rounds at the end. */\nexport const N_FULL_ROUNDS_TERMINAL = 4\n\n/** Number of partial (internal) rounds. */\nexport const N_PARTIAL_ROUNDS = 14\n\n/** Owner secret limb count. Matches the Rust `SECRET_LIMBS = 8`. */\nexport const SECRET_LIMBS = 8\n\n/**\n * Internal diffusion shifts. The diagonal of (1 + diag(V_16)) is given by\n * V[0] = -2, V[i] = 2^DIAG_SHIFTS[i-1] for i in 1..16.\n */\nexport const INTERNAL_DIAG_SHIFTS: readonly number[] = [\n 0, 1, 2, 3, 4, 5, 6, 7, 8, 10, 12, 13, 14, 15, 16,\n]\n\n/** Initial full-round constants — [round][state_index]. */\nexport const RC_EXTERNAL_INITIAL: readonly (readonly bigint[])[] = [\n [\n 0x768bab52n, 0x70e0ab7dn, 0x3d266c8an, 0x6da42045n,\n 0x600fef22n, 0x41dace6bn, 0x64f9bdd4n, 0x5d42d4fen,\n 0x76b1516dn, 0x6fc9a717n, 0x70ac4fb6n, 0x00194ef6n,\n 0x22b644e2n, 0x1f7916d5n, 0x47581be2n, 0x2710a123n,\n ],\n [\n 0x6284e867n, 0x018d3afen, 0x5df99ef3n, 0x4c1e467bn,\n 0x566f6abcn, 0x2994e427n, 0x538a6d42n, 0x5d7bf2cfn,\n 0x7fda2dabn, 0x0fd854c4n, 0x46922fcan, 0x3d7763a1n,\n 0x19fd05can, 0x0a4bbb43n, 0x15075851n, 0x3d903d76n,\n ],\n [\n 0x2d290ff7n, 0x40809fa0n, 0x59dac6ecn, 0x127927a2n,\n 0x6bbf0ea0n, 0x0294140fn, 0x24742976n, 0x6e84c081n,\n 0x22484f4an, 0x354cae59n, 0x0453ffe1n, 0x3f47a3ccn,\n 0x0088204en, 0x6066e109n, 0x3b7c4b80n, 0x6b55665dn,\n ],\n [\n 0x3bc4b897n, 0x735bf378n, 0x508daf42n, 0x1884fc2bn,\n 0x7214f24cn, 0x7498be0an, 0x1a60e640n, 0x3303f928n,\n 0x29b46376n, 0x5c96bb68n, 0x65d097a5n, 0x1d358e9fn,\n 0x4a9a9017n, 0x4724cf76n, 0x347af70fn, 0x1e77e59an,\n ],\n] as const\n\n/** Internal (partial) round constants — added to state[0] only. */\nexport const RC_INTERNAL: readonly bigint[] = [\n 0x7f7ec4bfn, 0x0421926fn, 0x5198e669n, 0x34db3148n,\n 0x4368bafdn, 0x66685c7fn, 0x78d3249an, 0x60187881n,\n 0x76dad67an, 0x0690b437n, 0x1ea95311n, 0x40e5369an,\n 0x38f103fcn, 0x1d226a21n,\n] as const\n\n/** Terminal full-round constants — [round][state_index]. */\nexport const RC_EXTERNAL_TERMINAL: readonly (readonly bigint[])[] = [\n [\n 0x57090613n, 0x1fa42108n, 0x17bbef50n, 0x1ff7e11cn,\n 0x047b24can, 0x4e140275n, 0x4fa086f5n, 0x079b309cn,\n 0x1159bd47n, 0x6d37e4e5n, 0x075d8dcen, 0x12121ca0n,\n 0x7f6a7c40n, 0x68e182ban, 0x5493201bn, 0x0444a80en,\n ],\n [\n 0x0064f4c6n, 0x6467abe6n, 0x66975762n, 0x2af68f9bn,\n 0x345b33ben, 0x1b70d47fn, 0x053db717n, 0x381189cbn,\n 0x43b915f8n, 0x20df3694n, 0x0f459d26n, 0x77a0e97bn,\n 0x2f73e739n, 0x1876c2f9n, 0x65a0e29an, 0x4cabefben,\n ],\n [\n 0x5abd1268n, 0x4d34a760n, 0x12771799n, 0x69a0c9acn,\n 0x39091e55n, 0x7f611cd0n, 0x3af055dan, 0x7ac0bbdfn,\n 0x6e0f3a24n, 0x41e3b6f7n, 0x49b3756dn, 0x568bc538n,\n 0x20c079d8n, 0x1701c72cn, 0x7670dc6cn, 0x5a439035n,\n ],\n [\n 0x7c93e00en, 0x561fbb4dn, 0x1178907bn, 0x02737406n,\n 0x32fb24f1n, 0x6323b60an, 0x6ab12418n, 0x42c99cean,\n 0x155a0b97n, 0x53d1c6aan, 0x2bd20347n, 0x279b3d73n,\n 0x4f5f3c70n, 0x0245af6cn, 0x238359d3n, 0x49966a59n,\n ],\n] as const\n","/**\n * Poseidon2-Mersenne31 (width 16) permutation — pure-BigInt M31 arithmetic.\n *\n * Line-by-line port of [poseidon31_perm.rs](https://github.com/permissionless-technologies/universal-private-pool/blob/main/stwo-prover/src/poseidon31_perm.rs)\n * — the in-circuit AIR follows the same algorithm, so this implementation\n * exists as the canonical off-circuit reference for the JS side.\n *\n * Cross-validated against the Plonky3 canonical test vector for\n * `permute([0..16])` and against the Rust port's\n * `print_canonical_test_vectors` outputs (see the test suite).\n *\n * # Field representation\n *\n * M31 elements are stored as `bigint` in canonical form `[0, P)` where\n * `P = 2^31 - 1`. Multiplication uses BigInt arithmetic to avoid\n * 53-bit-safe-integer overflow; addition and subtraction stay within\n * 32-bit range and are reduced once at the end.\n */\n\nimport {\n RC_EXTERNAL_INITIAL,\n RC_EXTERNAL_TERMINAL,\n RC_INTERNAL,\n INTERNAL_DIAG_SHIFTS,\n N_FULL_ROUNDS_INITIAL,\n N_FULL_ROUNDS_TERMINAL,\n N_PARTIAL_ROUNDS,\n WIDTH,\n} from './poseidon31-constants.js'\n\n/** Mersenne31 prime: 2^31 - 1. */\nexport const M31_PRIME = (1n << 31n) - 1n\n\n/** Reduce a non-negative bigint to canonical M31 representation. */\nfunction modM31(x: bigint): bigint {\n const r = x % M31_PRIME\n return r < 0n ? r + M31_PRIME : r\n}\n\nfunction add(a: bigint, b: bigint): bigint {\n return modM31(a + b)\n}\n\nfunction sub(a: bigint, b: bigint): bigint {\n return modM31(a - b)\n}\n\nfunction mul(a: bigint, b: bigint): bigint {\n return modM31(a * b)\n}\n\nfunction double(a: bigint): bigint {\n return add(a, a)\n}\n\n/** S-box: x^5 over M31. */\nfunction sbox(x: bigint): bigint {\n const x2 = mul(x, x)\n const x4 = mul(x2, x2)\n return mul(x4, x)\n}\n\n/**\n * Apply the 4×4 MDS matrix\n *\n * [ 2 3 1 1 ]\n * [ 1 2 3 1 ]\n * [ 1 1 2 3 ]\n * [ 3 1 1 2 ]\n *\n * in place (mutates the array).\n */\nfunction applyMat4(x: bigint[]): void {\n const x0 = x[0]!\n const x1 = x[1]!\n const x2 = x[2]!\n const x3 = x[3]!\n\n const t01 = add(x0, x1)\n const t23 = add(x2, x3)\n const t0123 = add(t01, t23)\n const t01123 = add(t0123, x1)\n const t01233 = add(t0123, x3)\n\n // x[3] = 3*x[0] + x[1] + x[2] + 2*x[3]\n x[3] = add(t01233, double(x0))\n // x[1] = x[0] + 2*x[1] + 3*x[2] + x[3] (read x[2] before overwriting)\n x[1] = add(t01123, double(x2))\n // x[0] = 2*x[0] + 3*x[1] + x[2] + x[3]\n x[0] = add(t01123, t01)\n // x[2] = x[0] + x[1] + 2*x[2] + 3*x[3]\n x[2] = add(t01233, t23)\n}\n\n/**\n * Light external linear layer for WIDTH=16:\n * 1. apply_mat4 to each consecutive 4-element chunk\n * 2. cross-chunk sums sums[k] = state[k] + state[k+4] + state[k+8] + state[k+12]\n * 3. state[i] += sums[i % 4]\n */\nfunction mdsLightPermutation(state: bigint[]): void {\n for (let c = 0; c < WIDTH; c += 4) {\n const chunk = [state[c]!, state[c + 1]!, state[c + 2]!, state[c + 3]!]\n applyMat4(chunk)\n state[c] = chunk[0]!\n state[c + 1] = chunk[1]!\n state[c + 2] = chunk[2]!\n state[c + 3] = chunk[3]!\n }\n\n const sums: bigint[] = [0n, 0n, 0n, 0n]\n for (let k = 0; k < 4; k++) {\n sums[k] = add(add(state[k]!, state[k + 4]!), add(state[k + 8]!, state[k + 12]!))\n }\n\n for (let i = 0; i < WIDTH; i++) {\n state[i] = add(state[i]!, sums[i % 4]!)\n }\n}\n\n/** Multiply x by 2^shift over M31 via repeated doubling. */\nfunction mulPowTwo(x: bigint, shift: number): bigint {\n let acc = x\n for (let i = 0; i < shift; i++) {\n acc = double(acc)\n }\n return acc\n}\n\n/**\n * Internal diffusion = (1 + diag(V_16)).\n *\n * full_sum = sum(state)\n * state[0] = full_sum - 2*state[0]\n * state[i] = full_sum + 2^DIAG_SHIFTS[i-1] * state[i] for i in 1..16\n */\nfunction internalLinearLayer(state: bigint[]): void {\n let fullSum = 0n\n for (let i = 0; i < WIDTH; i++) {\n fullSum = add(fullSum, state[i]!)\n }\n\n state[0] = sub(fullSum, double(state[0]!))\n for (let i = 1; i < WIDTH; i++) {\n state[i] = add(fullSum, mulPowTwo(state[i]!, INTERNAL_DIAG_SHIFTS[i - 1]!))\n }\n}\n\n/** One full external round: add round constants, S-box, mdsLightPermutation. */\nfunction externalRound(state: bigint[], rc: readonly bigint[]): void {\n for (let i = 0; i < WIDTH; i++) {\n state[i] = add(state[i]!, rc[i]!)\n }\n for (let i = 0; i < WIDTH; i++) {\n state[i] = sbox(state[i]!)\n }\n mdsLightPermutation(state)\n}\n\n/** One partial round: add constant + S-box on state[0], then internal diffusion. */\nfunction internalRound(state: bigint[], rc: bigint): void {\n state[0] = add(state[0]!, rc)\n state[0] = sbox(state[0]!)\n internalLinearLayer(state)\n}\n\n/**\n * Apply the full Poseidon2 width-16 Mersenne31 permutation in place.\n *\n * Order:\n * 1. Initial mdsLightPermutation (no constants, no S-box).\n * 2. 4 initial full rounds.\n * 3. 14 partial rounds.\n * 4. 4 terminal full rounds.\n *\n * Mutates `state` in place; expects `state.length === 16` with each\n * element in canonical M31 form.\n */\nexport function permute(state: bigint[]): void {\n if (state.length !== WIDTH) {\n throw new Error(`Poseidon31 permute: expected state of length ${WIDTH}, got ${state.length}`)\n }\n\n mdsLightPermutation(state)\n\n for (let r = 0; r < N_FULL_ROUNDS_INITIAL; r++) {\n externalRound(state, RC_EXTERNAL_INITIAL[r]!)\n }\n for (let r = 0; r < N_PARTIAL_ROUNDS; r++) {\n internalRound(state, RC_INTERNAL[r]!)\n }\n for (let r = 0; r < N_FULL_ROUNDS_TERMINAL; r++) {\n externalRound(state, RC_EXTERNAL_TERMINAL[r]!)\n }\n}\n","/**\n * Poseidon2-Mersenne31 sponge — off-circuit reference for the STARK side.\n *\n * Mirror of [poseidon31.rs](https://github.com/permissionless-technologies/universal-private-pool/blob/main/stwo-prover/src/poseidon31.rs)\n * — the in-circuit Poseidon31 AIR consumes the same round constants and\n * sponge convention. Outputs match the Rust reference byte-for-byte.\n *\n * Sponge construction (8-rate / 8-capacity):\n * - state[0..8] = absorbed elements (added to previous state, mod M31)\n * - state[8..16] = capacity, with `state[8]` initialised to the input\n * length to domain-separate variable-length inputs\n * - On absorb, add the input chunk to the rate portion and apply the perm.\n * - Squeeze: take the first DIGEST_SIZE elements after the final perm.\n */\n\nimport {\n CAPACITY,\n DIGEST_SIZE,\n RATE,\n SECRET_LIMBS,\n WIDTH,\n} from './poseidon31-constants.js'\nimport { M31_PRIME, permute } from './poseidon31-perm.js'\n\nexport { CAPACITY, DIGEST_SIZE, RATE, SECRET_LIMBS, WIDTH, M31_PRIME }\n\n/** Reduce a non-negative bigint to canonical M31. */\nfunction modM31(x: bigint): bigint {\n const r = x % M31_PRIME\n return r < 0n ? r + M31_PRIME : r\n}\n\n/**\n * Hash an arbitrary number of M31 elements, returning a 4-element digest.\n *\n * Inputs must already be in canonical M31 form (non-negative `bigint < 2^31 - 1`).\n * Throws if any input is out of range.\n */\nexport function hashM31(inputs: bigint[]): bigint[] {\n for (let i = 0; i < inputs.length; i++) {\n const v = inputs[i]!\n if (v < 0n || v >= M31_PRIME) {\n throw new Error(`hashM31: input[${i}] = ${v} not in [0, M31_PRIME)`)\n }\n }\n\n // Start from zero state, encode input length in capacity[0] for domain\n // separation.\n const state: bigint[] = new Array(WIDTH).fill(0n)\n state[RATE] = BigInt(inputs.length)\n\n for (let i = 0; i < inputs.length; i += RATE) {\n const end = Math.min(i + RATE, inputs.length)\n for (let j = 0; j < end - i; j++) {\n state[j] = modM31(state[j]! + inputs[i + j]!)\n }\n permute(state)\n }\n\n return state.slice(0, DIGEST_SIZE)\n}\n\n/**\n * Hash exactly two M31 elements and return only the first digest element.\n * Used for Merkle tree internal nodes.\n */\nexport function hashTwo(left: bigint, right: bigint): bigint {\n return hashM31([left, right])[0]!\n}\n\n/**\n * Compute the spender's owner_hash from an 8-limb owner_secret.\n *\n * owner_hash = Poseidon31(owner_secret[0..8])\n */\nexport function computeOwnerHash(ownerSecret: bigint[]): bigint[] {\n if (ownerSecret.length !== SECRET_LIMBS) {\n throw new Error(\n `computeOwnerHash: expected ${SECRET_LIMBS} limbs, got ${ownerSecret.length}`\n )\n }\n return hashM31(ownerSecret)\n}\n\n/**\n * Compute a note commitment.\n *\n * commitment = Poseidon31(amount, owner_hash[0..4], blinding, origin, token)\n */\nexport function computeCommitment(\n amount: bigint,\n ownerHash: bigint[],\n blinding: bigint,\n origin: bigint,\n token: bigint\n): bigint[] {\n if (ownerHash.length !== DIGEST_SIZE) {\n throw new Error(\n `computeCommitment: ownerHash must have ${DIGEST_SIZE} limbs, got ${ownerHash.length}`\n )\n }\n return hashM31([\n amount,\n ownerHash[0]!,\n ownerHash[1]!,\n ownerHash[2]!,\n ownerHash[3]!,\n blinding,\n origin,\n token,\n ])\n}\n\n/**\n * Compute a nullifier.\n *\n * nullifier = Poseidon31(owner_secret[0..8], leaf_index, commitment[0..4])\n */\nexport function computeNullifier(\n ownerSecret: bigint[],\n leafIndex: bigint,\n commitment: bigint[]\n): bigint[] {\n if (ownerSecret.length !== SECRET_LIMBS) {\n throw new Error(\n `computeNullifier: ownerSecret must have ${SECRET_LIMBS} limbs, got ${ownerSecret.length}`\n )\n }\n if (commitment.length !== DIGEST_SIZE) {\n throw new Error(\n `computeNullifier: commitment must have ${DIGEST_SIZE} limbs, got ${commitment.length}`\n )\n }\n const inputs: bigint[] = [\n ...ownerSecret,\n leafIndex,\n ...commitment,\n ]\n return hashM31(inputs)\n}\n\n/**\n * Verify a Poseidon31 Merkle proof path. Returns the computed root.\n *\n * Single-element chain: each level produces one M31 (the first element of\n * the 4-element digest). Matches the in-trace AIR's\n * `state_merkle_perm.state[N_ROUNDS][0]` chain.\n */\nexport function verifyMerklePath(\n leaf: bigint,\n pathElements: bigint[],\n pathIndices: bigint[]\n): bigint {\n if (pathElements.length !== pathIndices.length) {\n throw new Error(\n `verifyMerklePath: pathElements (${pathElements.length}) vs pathIndices (${pathIndices.length}) length mismatch`\n )\n }\n let current = leaf\n for (let i = 0; i < pathElements.length; i++) {\n const sibling = pathElements[i]!\n const index = pathIndices[i]!\n let left: bigint\n let right: bigint\n if (index === 0n) {\n left = current\n right = sibling\n } else {\n left = sibling\n right = current\n }\n current = hashTwo(left, right)\n }\n return current\n}\n","/**\n * Poseidon2-Mersenne31 hash adapter — IHashFunction over M31.\n *\n * Field: Mersenne31 prime, P = 2^31 - 1.\n * Output: a single M31 element (first limb of the 4-element Poseidon31\n * digest, matching the in-trace AIR convention).\n *\n * Used by the STARK side of the dual-root ASP service to maintain a\n * Merkle tree whose root binds 1:1 with the on-chain `pub_asp_root` that\n * the Poseidon31 STARK AIR consumes.\n *\n * Security: the digest is truncated to 31 bits, so collision security is\n * ~2^15.5 by birthday bound. This matches the original Keccak-M31 STARK\n * design's per-element collision resistance and the in-trace AIR's\n * single-limb Merkle chain. Higher-security applications should use\n * `PoseidonBLS12381` instead — Poseidon31 here is specifically for\n * STARK-side Merkle trees that the Poseidon31 AIR can verify.\n */\n\nimport type { IHashFunction } from './interface.js'\nimport { hashM31, hashTwo, M31_PRIME } from './poseidon31.js'\n\n/** Mersenne31 prime: 2^31 - 1. */\nexport const M31_FIELD_PRIME = M31_PRIME\n\nexport class PoseidonM31 implements IHashFunction {\n readonly name = 'Poseidon-M31'\n readonly fieldPrime = M31_FIELD_PRIME\n /**\n * Effective collision security for the truncated single-limb digest.\n * Higher-security paths should use Poseidon-BLS12-381.\n */\n readonly securityBits = 16\n\n async hash2(left: bigint, right: bigint): Promise {\n return hashTwo(left, right)\n }\n\n async hashN(inputs: bigint[]): Promise {\n return hashM31(inputs)[0]!\n }\n}\n","/**\n * Hash module — pluggable ZK-friendly hash functions\n *\n * Default: PoseidonBLS12381 (128-bit security)\n * Alternative: PoseidonBN254 (100-bit security, Circom/Ethereum legacy)\n */\n\nexport type { IHashFunction } from './interface.js'\nexport { PoseidonBN254, BN254_FIELD_PRIME } from './poseidon-bn254.js'\nexport { PoseidonBLS12381, BLS12_381_FIELD_PRIME } from './poseidon-bls.js'\nexport { PoseidonM31, M31_FIELD_PRIME } from './poseidon-m31.js'\nexport {\n hashM31,\n hashTwo,\n computeOwnerHash,\n computeCommitment,\n computeNullifier,\n verifyMerklePath,\n DIGEST_SIZE as POSEIDON31_DIGEST_SIZE,\n SECRET_LIMBS as POSEIDON31_SECRET_LIMBS,\n} from './poseidon31.js'\n\nimport { PoseidonBLS12381 } from './poseidon-bls.js'\n\n/**\n * The default hash function for the UPC SDK.\n * BLS12-381 Poseidon — 128-bit security.\n */\nexport function getDefaultHashFunction() {\n return new PoseidonBLS12381()\n}\n","/**\n * Merkle Tree\n *\n * LeanIMT-compatible Merkle tree with pluggable hash function.\n * Default hash: Poseidon over BLS12-381 (128-bit security).\n */\n\nimport type { IHashFunction } from './hash/interface.js'\nimport { getDefaultHashFunction } from './hash/index.js'\nimport type { MerkleProof } from './types.js'\n\n/**\n * Default tree depth (supports ~1M members)\n */\nexport const DEFAULT_TREE_DEPTH = 20\n\n/**\n * Maximum tree depth\n */\nexport const MAX_TREE_DEPTH = 32\n\n/**\n * LeanIMT-compatible Merkle Tree\n *\n * Features:\n * - Dynamic depth (grows as needed up to maxDepth)\n * - Single-child optimization (LeanIMT: when sibling is 0, propagate current)\n * - Pluggable hash function (default: Poseidon-BLS12-381, 128-bit security)\n * - Async hash operations\n */\nexport class MerkleTree {\n private leaves: bigint[] = []\n private nodes: Map = new Map()\n private cachedRoot: bigint | null = null\n readonly maxDepth: number\n readonly hashFn: IHashFunction\n\n constructor(maxDepth: number = DEFAULT_TREE_DEPTH, hashFn?: IHashFunction) {\n this.maxDepth = maxDepth\n this.hashFn = hashFn ?? getDefaultHashFunction()\n }\n\n /**\n * Insert a leaf into the tree\n */\n insert(leaf: bigint): number {\n if (leaf === 0n) {\n throw new Error('Leaf cannot be zero')\n }\n const index = this.leaves.length\n this.leaves.push(leaf)\n this.cachedRoot = null\n this.nodes.clear()\n return index\n }\n\n /**\n * Get the number of leaves in the tree\n */\n get size(): number {\n return this.leaves.length\n }\n\n /**\n * Get the current depth of the tree\n */\n get depth(): number {\n if (this.leaves.length <= 1) return 0\n return Math.ceil(Math.log2(this.leaves.length))\n }\n\n /**\n * Check if a leaf exists in the tree\n */\n has(leaf: bigint): boolean {\n return this.leaves.includes(leaf)\n }\n\n /**\n * Get the index of a leaf\n */\n indexOf(leaf: bigint): number {\n return this.leaves.indexOf(leaf)\n }\n\n /**\n * Get the current root (async because hash is async)\n */\n async getRoot(): Promise {\n if (this.leaves.length === 0) {\n return 0n\n }\n if (this.cachedRoot !== null) {\n return this.cachedRoot\n }\n this.cachedRoot = await this.computeRoot()\n return this.cachedRoot\n }\n\n /**\n * Get a Merkle proof for a leaf at index\n */\n async getProof(index: number): Promise {\n if (index < 0 || index >= this.leaves.length) {\n throw new Error(`Leaf index ${index} out of bounds (size: ${this.leaves.length})`)\n }\n\n const pathElements: bigint[] = []\n const pathIndices: number[] = []\n const treeDepth = this.depth\n\n let currentIndex = index\n\n for (let level = 0; level < treeDepth; level++) {\n const siblingIndex = currentIndex ^ 1\n const isLeft = currentIndex % 2 === 0\n\n const sibling = await this.getNodeHash(level, siblingIndex)\n pathElements.push(sibling)\n pathIndices.push(isLeft ? 0 : 1)\n\n currentIndex = Math.floor(currentIndex / 2)\n }\n\n return {\n pathElements,\n pathIndices,\n leafIndex: index,\n root: await this.getRoot(),\n }\n }\n\n /**\n * Get the hash of a node at (level, index)\n */\n private async getNodeHash(level: number, index: number): Promise {\n const key = `${level}:${index}`\n if (this.nodes.has(key)) {\n return this.nodes.get(key)!\n }\n\n let hash: bigint\n\n if (level === 0) {\n hash = index < this.leaves.length ? this.leaves[index]! : 0n\n } else {\n const leftChild = await this.getNodeHash(level - 1, index * 2)\n const rightChild = await this.getNodeHash(level - 1, index * 2 + 1)\n\n if (leftChild === 0n && rightChild === 0n) {\n hash = 0n\n } else if (rightChild === 0n) {\n // LeanIMT optimization: single child propagation\n hash = leftChild\n } else {\n hash = await this.hashFn.hash2(leftChild, rightChild)\n }\n }\n\n this.nodes.set(key, hash)\n return hash\n }\n\n /**\n * Compute the root hash\n */\n private async computeRoot(): Promise {\n if (this.leaves.length === 0) return 0n\n if (this.leaves.length === 1) return this.leaves[0]!\n const treeDepth = this.depth\n return await this.getNodeHash(treeDepth, 0)\n }\n}\n\n/**\n * Build a Merkle tree from an array of leaves\n */\nexport function buildMerkleTree(leaves: bigint[], maxDepth?: number, hashFn?: IHashFunction): MerkleTree {\n const tree = new MerkleTree(maxDepth, hashFn)\n for (const leaf of leaves) {\n tree.insert(leaf)\n }\n return tree\n}\n\n/**\n * Verify a Merkle proof using the specified hash function.\n * Defaults to BLS12-381 Poseidon (128-bit security).\n */\nexport async function verifyMerkleProof(\n leaf: bigint,\n proof: MerkleProof,\n hashFn?: IHashFunction\n): Promise {\n const hash = hashFn ?? getDefaultHashFunction()\n let current = leaf\n\n for (let i = 0; i < proof.pathElements.length; i++) {\n const sibling = proof.pathElements[i]!\n const isLeft = proof.pathIndices[i] === 0\n\n if (sibling === 0n) {\n continue // LeanIMT: missing sibling means propagation\n }\n\n if (isLeft) {\n current = await hash.hash2(current, sibling)\n } else {\n current = await hash.hash2(sibling, current)\n }\n }\n\n return current === proof.root\n}\n"]}