Add Elixir NIFs

.gitignore

@@ -6,4 +6,13 @@ _build/
 deps/
 .vscode/
 .idea/
-profile.*
+profile.*
+
+# Elixir / mix
+*.ez
+erl_crash.dump
+/cover/
+/doc/
+
+# rustler NIF build artifact (compiled into priv/native at `mix compile`)
+*.so

Cargo.toml

@@ -2,6 +2,7 @@
 resolver = "2"
 members = [
   "arm",
+  "arm_nif",
   "arm_tests/arm_test_witness",
   "arm_tests/arm_test_app",
   "arm_gadgets",

arm_nif/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "arm_nif"
+version = "0.1.0"
+edition = { workspace = true }
+license = { workspace = true }
+repository = { workspace = true }
+
+[lib]
+name = "arm_nif"
+path = "src/lib.rs"
+crate-type = ["cdylib"]
+
+[dependencies]
+# Verifier-only: drop the default `prove` feature so the prover toolchain is not
+# linked into the NIF .so. `transaction` pulls in the Transaction/Action API and
+# the host-side `verify` path.
+anoma-rm-risc0 = { path = "../arm", default-features = false, features = ["transaction"] }
+rustler = "0.31"
+# Match the arm crate's serialization (bincode 1.x, serde built in).
+bincode = "1.3.3"
+thiserror = "2.0.6"

arm_nif/src/error.rs

@@ -0,0 +1,25 @@
+//! Error type bridging arm-risc0 / bincode failures to Erlang terms.
+
+use anoma_rm_risc0::error::ArmError;
+use rustler::{Encoder, Env, Term};
+use thiserror::Error;
+
+#[derive(Debug, Error)]
+pub enum ArmNifError {
+    #[error("bincode decode error: {0}")]
+    BincodeDecode(#[from] bincode::Error),
+    #[error("ARM error: {0}")]
+    Arm(#[from] ArmError),
+}
+
+impl Encoder for ArmNifError {
+    fn encode<'a>(&self, env: Env<'a>) -> Term<'a> {
+        self.to_string().encode(env)
+    }
+}
+
+impl From<ArmNifError> for rustler::Error {
+    fn from(e: ArmNifError) -> Self {
+        rustler::Error::Term(Box::new(e))
+    }
+}

arm_nif/src/lib.rs

@@ -0,0 +1,13 @@
+mod error;
+mod verifier;
+
+rustler::init!(
+    "Elixir.ArmRisc0.Verifier",
+    [
+        verifier::verify_transaction,
+        verifier::verify_and_extract,
+        verifier::transaction_nullifiers,
+        verifier::transaction_commitments,
+        verifier::transaction_roots,
+    ]
+);

arm_nif/src/verifier.rs

@@ -0,0 +1,163 @@
+//! NIFs verifying and reading arm-risc0 resource machine transactions.
+//!
+//! Every entry point takes a bincode-encoded `anoma_rm_risc0::transaction::Transaction`
+//! as an opaque binary
+
+use crate::error::ArmNifError;
+use anoma_rm_risc0::{
+    Digest,
+    action::Action,
+    compliance::ComplianceInstance,
+    error::ArmError,
+    logic_instance::{AppData, ExpirableBlob},
+    transaction::Transaction,
+};
+use bincode::Options;
+use rustler::{Binary, Env, NifResult, OwnedBinary};
+use std::collections::BTreeSet;
+
+/// Upper bound on a decoded transaction
+const MAX_TX_BYTES: u64 = 128 * 1024 * 1024; // 128 MiB
+
+/// Decode a bincode-encoded `Transaction`
+fn decode_tx(tx_bytes: &[u8]) -> Result<Transaction, ArmNifError> {
+    Ok(bincode::options()
+        .with_fixint_encoding()
+        .with_little_endian()
+        .with_limit(MAX_TX_BYTES)
+        .deserialize(tx_bytes)?)
+}
+
+/// Copy bytes into a freshly-allocated Erlang binary
+fn to_bin<'a>(env: Env<'a>, bytes: &[u8]) -> Binary<'a> {
+    let mut bin = OwnedBinary::new(bytes.len()).expect("OwnedBinary allocation failed");
+    bin.as_mut_slice().copy_from_slice(bytes);
+    bin.release(env)
+}
+
+/// A risc0 `Digest` as a fixed 32-byte array
+fn digest32(d: &Digest) -> [u8; 32] {
+    d.as_bytes()
+        .try_into()
+        .expect("a risc0 Digest is always 32 bytes")
+}
+
+/// Decode the transaction and collect every action's compliance instance
+fn instances(tx_bytes: &[u8]) -> Result<Vec<ComplianceInstance>, ArmNifError> {
+    decode_tx(tx_bytes)?
+        .actions
+        .iter()
+        .map(|a| a.compliance_unit.get_instance().map_err(ArmNifError::from))
+        .collect()
+}
+
+/// The four payload categories (resource, discovery, external, application) as
+/// `(blob_words, deletion_criterion)` lists
+type AppDataBlobs = (
+    Vec<(Vec<u32>, u32)>,
+    Vec<(Vec<u32>, u32)>,
+    Vec<(Vec<u32>, u32)>,
+    Vec<(Vec<u32>, u32)>,
+);
+
+fn app_data_blobs(ad: &AppData) -> AppDataBlobs {
+    let conv = |bs: &[ExpirableBlob]| -> Vec<(Vec<u32>, u32)> {
+        bs.iter()
+            .map(|b| (b.blob.clone(), b.deletion_criterion))
+            .collect()
+    };
+    (
+        conv(&ad.resource_payload),
+        conv(&ad.discovery_payload),
+        conv(&ad.external_payload),
+        conv(&ad.application_payload),
+    )
+}
+
+fn app_data_for_tag(action: &Action, tag: &Digest) -> Result<AppDataBlobs, ArmNifError> {
+    let input = action
+        .logic_verifier_inputs
+        .iter()
+        .find(|i| &i.tag == tag)
+        .ok_or(ArmError::TagNotFound)?;
+    Ok(app_data_blobs(&input.app_data))
+}
+
+#[rustler::nif(schedule = "DirtyCpu")]
+fn verify_transaction(tx_bytes: Binary) -> NifResult<bool> {
+    Ok(decode_tx(tx_bytes.as_slice())?.verify().is_ok())
+}
+
+/// Decode + verify a transaction in one pass and return the effects needed for
+/// global checks and storage
+#[rustler::nif(schedule = "DirtyCpu")]
+fn verify_and_extract<'a>(
+    env: Env<'a>,
+    tx_bytes: Binary<'a>,
+) -> NifResult<(
+    Vec<(Binary<'a>, AppDataBlobs)>,
+    Vec<(Binary<'a>, AppDataBlobs)>,
+    Vec<Binary<'a>>,
+)> {
+    let tx = decode_tx(tx_bytes.as_slice())?;
+    let mut consumed = Vec::new();
+    let mut created = Vec::new();
+    let mut roots: BTreeSet<[u8; 32]> = BTreeSet::new();
+    for action in &tx.actions {
+        let ci = action
+            .compliance_unit
+            .get_instance()
+            .map_err(ArmNifError::from)?;
+        for c in &ci.consumed_publics {
+            let ad = app_data_for_tag(action, &c.resource_nullifier)?;
+            consumed.push((to_bin(env, c.resource_nullifier.as_bytes()), ad));
+            roots.insert(digest32(&c.commitment_tree_root));
+        }
+        for c in &ci.created_publics {
+            let ad = app_data_for_tag(action, &c.resource_commitment)?;
+            created.push((to_bin(env, c.resource_commitment.as_bytes()), ad));
+        }
+    }
+
+    tx.verify().map_err(ArmNifError::from)?;
+
+    let roots = roots.iter().map(|r| to_bin(env, r)).collect();
+    Ok((consumed, created, roots))
+}
+
+#[rustler::nif(schedule = "DirtyCpu")]
+fn transaction_nullifiers<'a>(env: Env<'a>, tx_bytes: Binary<'a>) -> NifResult<Vec<Binary<'a>>> {
+    Ok(instances(tx_bytes.as_slice())?
+        .iter()
+        .flat_map(|ci| {
+            ci.consumed_publics
+                .iter()
+                .map(|c| to_bin(env, c.resource_nullifier.as_bytes()))
+        })
+        .collect())
+}
+
+#[rustler::nif(schedule = "DirtyCpu")]
+fn transaction_commitments<'a>(env: Env<'a>, tx_bytes: Binary<'a>) -> NifResult<Vec<Binary<'a>>> {
+    Ok(instances(tx_bytes.as_slice())?
+        .iter()
+        .flat_map(|ci| {
+            ci.created_publics
+                .iter()
+                .map(|c| to_bin(env, c.resource_commitment.as_bytes()))
+        })
+        .collect())
+}
+
+#[rustler::nif(schedule = "DirtyCpu")]
+fn transaction_roots<'a>(env: Env<'a>, tx_bytes: Binary<'a>) -> NifResult<Vec<Binary<'a>>> {
+    let roots: BTreeSet<[u8; 32]> = instances(tx_bytes.as_slice())?
+        .iter()
+        .flat_map(|ci| {
+            ci.consumed_publics
+                .iter()
+                .map(|c| digest32(&c.commitment_tree_root))
+        })
+        .collect();
+    Ok(roots.iter().map(|r| to_bin(env, r)).collect())
+}