feat: rewrite in rust 🦀

.github/workflows/ci.yml

@@ -0,0 +1,99 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  lint:
+    name: fmt + clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - uses: Swatinem/rust-cache@v2
+      - run: cargo fmt --all --check
+      - run: cargo clippy --workspace --all-targets -- -D warnings
+
+  test:
+    name: test (${{ matrix.os }}, circom ${{ matrix.circom }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # Linux x86-64 exercises the C witness backend (needs nasm/gmp; circom
+          # C generator emits x86 assembly). The tags e2e circuit needs circom >= 2.2.0.
+          - { os: ubuntu-latest, circom: v2.2.3 }
+          - { os: ubuntu-latest, circom: v2.2.2 }
+          # macOS is arm64; no prebuilt circom, so build from source. The C
+          # witness backend is expected to error there (arch-gated test).
+          - { os: macos-latest, circom: v2.2.3 }
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+      - name: Install snarkjs (latest)
+        run: npm install -g snarkjs
+
+      # circom's C witness generator needs these; Linux x86-64 only.
+      - name: Install C witness toolchain (Linux)
+        if: runner.os == 'Linux'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y build-essential libgmp-dev nasm nlohmann-json3-dev libsodium-dev
+
+      - name: Cache circom binary
+        id: circom-cache
+        uses: actions/cache@v4
+        with:
+          path: ~/circom-bin
+          key: circom-${{ runner.os }}-${{ matrix.circom }}
+
+      - name: Install circom ${{ matrix.circom }}
+        if: steps.circom-cache.outputs.cache-hit != 'true'
+        run: |
+          mkdir -p ~/circom-bin
+          if [ "${{ runner.os }}" = "Linux" ]; then
+            curl -fsSL -o ~/circom-bin/circom \
+              "https://github.com/iden3/circom/releases/download/${{ matrix.circom }}/circom-linux-amd64"
+            chmod +x ~/circom-bin/circom
+          else
+            # No prebuilt arm64 asset — build from source.
+            git clone --depth 1 --branch "${{ matrix.circom }}" https://github.com/iden3/circom /tmp/circom
+            cargo build --release --manifest-path /tmp/circom/Cargo.toml
+            cp /tmp/circom/target/release/circom ~/circom-bin/circom
+          fi
+
+      - name: Add circom to PATH
+        run: echo "$HOME/circom-bin" >> "$GITHUB_PATH"
+
+      - name: Versions
+        run: |
+          circom --version
+          snarkjs --version || true
+
+      # Cache the downloaded test PTAU to avoid flaky network fetches.
+      - name: Cache test PTAU
+        uses: actions/cache@v4
+        with:
+          path: tests/ptau
+          key: ptau-${{ runner.os }}-powersOfTau28_hez_final_08
+
+      # `cargo test` (default-members) runs the full suite except the napi
+      # cdylib. On Linux x86-64 the C-witness e2e test builds and runs; on macOS
+      # arm64 it asserts the clean error path.
+      - name: Test
+        run: cargo test

.github/workflows/docs.yml

@@ -0,0 +1,44 @@
+name: Deploy Book
+
+on:
+  # Publish the book manually, or automatically when a release is published.
+  workflow_dispatch:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+# Allow one concurrent deployment.
+concurrency:
+  group: pages
+  cancel-in-progress: false
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    env:
+      MDBOOK_VERSION: "0.5.4"
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install mdBook
+        run: |
+          curl -sSL "https://github.com/rust-lang/mdBook/releases/download/v${MDBOOK_VERSION}/mdbook-v${MDBOOK_VERSION}-x86_64-unknown-linux-gnu.tar.gz" \
+            | tar -xz --directory=/usr/local/bin
+      - name: Build
+        run: mdbook build book
+      - uses: actions/upload-pages-artifact@v3
+        with:
+          path: book/book
+
+  deploy:
+    needs: build
+    runs-on: ubuntu-latest
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - id: deployment
+        uses: actions/deploy-pages@v4

.github/workflows/napi.yml

@@ -0,0 +1,162 @@
+name: Publish npm package
+
+# Builds the native addon AND the CLI binary for each desktop target, bundles
+# the CLI into the per-platform packages, and publishes `circomkit` to npm.
+#
+# Runs on a published GitHub release (and manual dispatch). Requires an
+# `NPM_TOKEN` repository secret.
+#
+# NOTE: napi multi-platform publishing is fiddly and cannot be validated in this
+# sandbox — verify the `napi` command incantations against `napi --help` and the
+# current napi-rs package template on a real run before relying on it.
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+env:
+  # Uses native runners per target — no cross-compilation.
+  DEBUG: napi:*
+
+defaults:
+  run:
+    working-directory: bindings/napi
+
+jobs:
+  build:
+    name: build ${{ matrix.target }}
+    runs-on: ${{ matrix.host }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - host: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            key: linux-x64-gnu
+            bin: circomkit
+          - host: ubuntu-24.04-arm
+            target: aarch64-unknown-linux-gnu
+            key: linux-arm64-gnu
+            bin: circomkit
+          - host: macos-13
+            target: x86_64-apple-darwin
+            key: darwin-x64
+            bin: circomkit
+          - host: macos-latest
+            target: aarch64-apple-darwin
+            key: darwin-arm64
+            bin: circomkit
+          - host: windows-latest
+            target: x86_64-pc-windows-msvc
+            key: win32-x64-msvc
+            bin: circomkit.exe
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Install deps
+        run: npm install
+
+      - name: Build addon
+        run: npx napi build --release --platform --target ${{ matrix.target }} --js binding.js --dts binding.d.ts
+
+      - name: Build CLI binary
+        working-directory: .
+        run: cargo build --release -p circomkit-cli --target ${{ matrix.target }}
+
+      - name: Upload addon
+        uses: actions/upload-artifact@v4
+        with:
+          name: addon-${{ matrix.key }}
+          path: bindings/napi/circomkit.*.node
+          if-no-files-found: error
+
+      - name: Upload CLI binary
+        uses: actions/upload-artifact@v4
+        with:
+          name: cli-${{ matrix.key }}
+          path: target/${{ matrix.target }}/release/${{ matrix.bin }}
+          if-no-files-found: error
+
+  publish:
+    name: publish to npm
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: "https://registry.npmjs.org"
+
+      - uses: dtolnay/rust-toolchain@stable
+      - uses: Swatinem/rust-cache@v2
+
+      - name: Install deps
+        run: npm install
+
+      # Generate the platform-agnostic root-package files that live in the main
+      # `circomkit` package: `binding.js`/`binding.d.ts` (napi loader) and
+      # `index.js`/`index.d.ts` (compiled TypeScript facade). The .node built
+      # here is discarded — per-platform .node files come from the build matrix.
+      - name: Build facade (binding + TS)
+        run: npm run build
+
+      - name: Scaffold platform packages
+        run: npx napi create-npm-dirs
+
+      - name: Download addon artifacts
+        uses: actions/download-artifact@v4
+        with:
+          pattern: addon-*
+          path: bindings/napi/artifacts
+          merge-multiple: true
+
+      - name: Move addons into platform packages
+        run: npx napi artifacts
+
+      - name: Download CLI binaries
+        uses: actions/download-artifact@v4
+        with:
+          pattern: cli-*
+          path: bindings/napi/cli-artifacts
+
+      - name: Bundle CLI binaries into platform packages
+        shell: bash
+        run: |
+          set -euo pipefail
+          for key in linux-x64-gnu linux-arm64-gnu darwin-x64 darwin-arm64 win32-x64-msvc; do
+            bin="cli-artifacts/cli-$key/circomkit"
+            [ "$key" = "win32-x64-msvc" ] && bin="cli-artifacts/cli-$key/circomkit.exe"
+            if [ -f "$bin" ]; then
+              node scripts/bundle-cli.mjs "$key" "$bin"
+            else
+              echo "::warning::missing CLI binary for $key ($bin)"
+            fi
+          done
+
+      - name: List packages
+        run: ls -R ./npm
+
+      - name: Publish
+        run: |
+          npm config set provenance true
+          npx napi prepublish -t npm
+          npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}