expose hash to group

src/lib/hash.ts

@@ -1,5 +1,10 @@
-import { HashInput, ProvableExtended, Struct } from './circuit_value.js';
-import { Poseidon as Poseidon_, Field } from '../snarky.js';
+import {
+  HashInput,
+  provable,
+  ProvableExtended,
+  Struct,
+} from './circuit_value.js';
+import { Poseidon as Poseidon_, Field, Bool, Circuit } from '../snarky.js';
 import { inCheckedComputation } from './proof_system.js';
 import { createHashHelpers } from './hash-generic.js';
 
@@ -43,6 +48,34 @@ const Poseidon = {
     return Poseidon_.hash(input, isChecked);
   },
 
+  hashToGroup(input: Field[]) {
+    let isChecked = !input.every((x) => x.isConstant());
+    // y = sqrt(y^2)
+    let { x, y } = Poseidon_.hashToGroup(input, isChecked);
+
+    let { x0, x1 } = Circuit.witness(provable({ x0: Field, x1: Field }), () => {
+      // the even root of y^2 will become x0, so the APIs are uniform
+      let isEven = y.toBigInt() % 2n === 0n;
+
+      // r is the second root of sqrt(y^2)
+      let r = y.mul(-1);
+      // we just change the order so the even root is x0 and the odd x1
+      return isEven ? { x0: y, x1: r } : { x0: r, x1: y };
+    });
+
+    // we check that either x0 or x1 match the original root y
+    y.equals(x0).or(y.equals(x1)).assertTrue();
+
+    // and then we check that either x0 or x1 is the expected second root of y^2
+    let y_ = y.mul(-1);
+    y_.equals(x0).or(y_.equals(x1)).assertTrue();
+
+    return {
+      x,
+      y: { x0, x1 },
+    };
+  },
+
   update(state: [Field, Field, Field], input: Field[]) {
     let isChecked = !(
       state.every((x) => x.isConstant()) && input.every((x) => x.isConstant())

src/snarky.d.ts

@@ -1101,6 +1101,13 @@ declare const Poseidon: {
     input: Field[],
     isChecked: boolean
   ): [Field, Field, Field];
+  hashToGroup(
+    input: Field[],
+    isChecked: boolean
+  ): {
+    x: Field;
+    y: Field;
+  };
   prefixes: Record<
     | 'event'
     | 'events'