@openzeppelin/compact-contracts 0.4.0-alpha.1 → 0.4.0-alpha.3

package/utils/EvmAbi.compact

@@ -0,0 +1,134 @@
+// SPDX-License-Identifier: MIT
+// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (utils/EvmAbi.compact)
+
+pragma language_version >= 0.26.0;
+
+/**
+ * @module EvmAbi
+ * @description Ethereum ABI word encoding, for messages that must hash
+ * identically in Compact and on the EVM.
+ *
+ * A contract verifying signatures produced by EVM signing infrastructure has
+ * to hash the exact bytes the signer hashed. `keccak256<T>(value)` hashes
+ * Compact's binary representation of `T`, which coincides with
+ * `abi.encode` for some types and diverges for others:
+ *
+ * - `Bytes<n>` is emitted as exactly `n` bytes. So `Bytes<32>` already *is* an
+ *   EVM ABI word, and `keccak256<Vector<n, Bytes<32>>>(words)` is byte-identical
+ *   to Solidity's `keccak256(abi.encode(word0, ..., wordN))`. Narrower types
+ *   are emitted at their own width rather than padded to 32, which is what
+ *   makes `abi.encodePacked`-style layouts expressible too.
+ * - Integers cast with `as Bytes<n>` are emitted **little-endian**, and a
+ *   `Uint<64>` occupies 8 bytes rather than a full word. `abi.encode(uint256)`
+ *   is a big-endian 32-byte word, so an integer cast directly into a message
+ *   will not match what an EVM signer produced.
+ * - `Boolean` is emitted as a single byte, where `abi.encode(bool)` is a full
+ *   word holding 0 or 1 in its least significant byte.
+ *
+ * This module supplies the conversions that diverge, so a message can be
+ * assembled as a `Vector<n, Bytes<32>>` of EVM ABI words and hashed with
+ * `keccak256` to reproduce an EVM digest exactly.
+ *
+ * @notice These are encoding primitives only. The choice of signing envelope
+ * (a raw digest, EIP-191, or EIP-712 typed data) belongs to the contract that
+ * owns the message.
+ *
+ * @notice The module itself needs no `keccak256`, so it compiles on either
+ * ZKIR backend and `compile:utils` can keep emitting v2. Every `@constraints`
+ * below is a v3 figure, and tagged as such.
+ */
+module EvmAbi {
+  import CompactStandardLibrary;
+
+  /**
+   * @description Encodes a `Uint<8>` as an `abi.encode(uint8)` word: the
+   * value in the least significant byte, zero elsewhere.
+   *
+   * @dev No reversal or decomposition is needed -- a `Uint<8>` is already a
+   * single byte so this is the cheapest of the integer encoders. It is
+   * also how a Compact `enum` should reach a digest, matching Solidity,
+   * where an enum ABI-encodes as its `uint8` ordinal: `uint8Word(kind as Uint<8>)`.
+   *
+   * @constraints k=6, rows=55 (zkir-v3)
+   *
+   * @param {Uint<8>} value - The value to encode.
+   * @returns {Bytes<32>} The value as an EVM ABI word.
+   */
+  export pure circuit uint8Word(value: Uint<8>): Bytes<32> {
+    const word: Vector<32, Uint<8>> = [
+      0, 0, 0, 0, 0, 0, 0, 0,
+      0, 0, 0, 0, 0, 0, 0, 0,
+      0, 0, 0, 0, 0, 0, 0, 0,
+      0, 0, 0, 0, 0, 0, 0, value
+    ];
+
+    return word as Bytes<32>;
+  }
+
+  /**
+   * @description Encodes a `Uint<64>` as an `abi.encode(uint256)` word: the
+   * value big-endian in the low 8 bytes, zero-padded on the left.
+   *
+   * @dev The `Uint<64> as Bytes<8>` cast yields the value little-endian, so
+   * the bytes are reversed into place. Only 8 bytes are decomposed rather
+   * than 32; the wider cast costs roughly four times as many constraints for
+   * an identical result.
+   *
+   * @constraints k=11, rows=1348 (zkir-v3)
+   *
+   * @param {Uint<64>} value - The value to encode.
+   * @returns {Bytes<32>} The value as a big-endian EVM ABI word.
+   */
+  export pure circuit uint64Word(value: Uint<64>): Bytes<32> {
+    const le = (value as Bytes<8>) as Vector<8, Uint<8>>;
+
+    const word: Vector<32, Uint<8>> = [
+      0, 0, 0, 0, 0, 0, 0, 0,
+      0, 0, 0, 0, 0, 0, 0, 0,
+      0, 0, 0, 0, 0, 0, 0, 0,
+      le[7], le[6], le[5], le[4], le[3], le[2], le[1], le[0]
+    ];
+
+    return word as Bytes<32>;
+  }
+
+  /**
+   * @description Encodes a `Uint<128>` as an `abi.encode(uint256)` word: the
+   * value big-endian in the low 16 bytes, zero-padded on the left.
+   *
+   * @dev Decomposes 16 bytes rather than 32, for the reason given on
+   * `uint64Word`. Costs roughly twice `uint64Word`, so prefer the narrower
+   * encoder when the value genuinely fits in 64 bits. The width here is
+   * the value's, not the word's.
+   *
+   * @constraints k=12, rows=2503 (zkir-v3)
+   *
+   * @param {Uint<128>} value - The value to encode.
+   * @returns {Bytes<32>} The value as a big-endian EVM ABI word.
+   */
+  export pure circuit uint128Word(value: Uint<128>): Bytes<32> {
+    const le = (value as Bytes<16>) as Vector<16, Uint<8>>;
+
+    const word: Vector<32, Uint<8>> = [
+      0, 0, 0, 0, 0, 0, 0, 0,
+      0, 0, 0, 0, 0, 0, 0, 0,
+      le[15], le[14], le[13], le[12], le[11], le[10], le[9], le[8],
+      le[7], le[6], le[5], le[4], le[3], le[2], le[1], le[0]
+    ];
+
+    return word as Bytes<32>;
+  }
+
+  /**
+   * @description Encodes a `Boolean` as an `abi.encode(bool)` word: zero
+   * everywhere except the least significant byte, which is 1 for true.
+   *
+   * @constraints k=6, rows=54 (zkir-v3)
+   *
+   * @param {Boolean} value - The value to encode.
+   * @returns {Bytes<32>} The value as an EVM ABI word.
+   */
+  export pure circuit boolWord(value: Boolean): Bytes<32> {
+    return uint8Word(value ? 1 as Uint<8> : 0 as Uint<8>);
+  }
+}

package/utils/Utils.compact

@@ -1,5 +1,5 @@
 // SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.1 (utils/Utils.compact)
+// OpenZeppelin Compact Contracts v0.4.0-alpha.3 (utils/Utils.compact)
 
 pragma language_version >= 0.26.0;
 
@@ -150,6 +150,16 @@ module Utils {
    * ## ID Derivation
    * `accountId = persistentHash(secretKey)`
    *
+   * @dev The absence of a domain-separation tag is DELIBERATE. This identifier
+   * is global by design: the same key material yields the same identity in
+   * every module deriving one, so a user who wishes to carry one identity
+   * across modules can. Modules wanting a per-deployment, unlinkable identity
+   * should not use this circuit.
+   *
+   * @dev NOT FOR PRIVATE DERIVATION. This returns an identifier, not a secret,
+   * and the construction is untagged. A circuit deriving a PRIVATE value from a
+   * secret MUST use its own domain-separation tag.
+   *
    * @param {Bytes<32>} secretKey - A 32-byte cryptographically secure random value.
    *
    * @returns {Bytes<32>} accountId - The computed account identifier.

package/multisig/presets/ShieldedMultiSig.compact

@@ -1,227 +0,0 @@
-// SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.1 (multisig/presets/ShieldedMultiSig.compact)
-
-pragma language_version >= 0.26.0;
-
-/**
- * @module ShieldedMultiSig
- * @description A shielded multisig preset composing `Signer`,
- * `ProposalManager`, and `ShieldedTreasury`. Signers approve proposals that
- * transfer shielded tokens out of the treasury once the configured threshold
- * is met.
- *
- * @notice Signer identity uses `Either<ZswapCoinPublicKey, ContractAddress>`
- * in state for forward compatibility. In the current protocol, only
- * `left(ZswapCoinPublicKey)` callers can authenticate — `getCaller()` resolves
- * via `ownPublicKey()` and has no way to produce a right-variant today.
- * Registering contract-address signers is permitted but those signers cannot
- * exercise governance (create/approve/revoke) until contract-to-contract calls
- * are supported. Choose your signer set accordingly.
- *
- * @notice The state shape is deliberately kept broad so that, once
- * contract-to-contract calls are supported, `getCaller()` can be swapped via
- * a CMA (Contract Maintenance Authorities) circuit upgrade without a state
- * migration. Existing deployments would then gain working contract-signer
- * authentication.
- */
-
-import CompactStandardLibrary;
-
-import "../ProposalManager" prefix Proposal_;
-import "../ShieldedTreasury" prefix Treasury_;
-import "../Signer"<Either<ZswapCoinPublicKey, ContractAddress>> prefix Signer_;
-
-// ─── State ───────────────────────────────────────────────────────────────
-
-export ledger _proposalApprovals: Map<Uint<64>, Map<Either<ZswapCoinPublicKey, ContractAddress>, Boolean>>;
-export ledger _approvalCount: Map<Uint<64>, Uint<8>>;
-
-// ─── Constructor ─────────────────────────────────────────────────────────
-
-constructor(
-  signers: Vector<3, Either<ZswapCoinPublicKey, ContractAddress>>,
-  thresh: Uint<8>
-) {
-  Signer_initialize<3>(signers, thresh);
-}
-
-// ─── Deposit ─────────────────────────────────────────────────────────────
-
-export circuit deposit(coin: ShieldedCoinInfo): [] {
-  Treasury__deposit(coin);
-}
-
-// ─── Proposals ───────────────────────────────────────────────────────────
-
-export circuit createShieldedProposal(
-  to: Proposal_Recipient,
-  color: Bytes<32>,
-  amount: Uint<128>
-): Uint<64> {
-  const callerPK = getCaller();
-  Signer_assertSigner(callerPK);
-
-  assert(
-    to.kind == Proposal_RecipientKind.ShieldedUser
-      || to.kind == Proposal_RecipientKind.Contract,
-    "ShieldedMultiSig: recipient must be a shielded user or contract"
-  );
-
-  return Proposal__createProposal(to, color, amount);
-}
-
-export circuit approveProposal(id: Uint<64>): [] {
-  // Check if active
-  Proposal_assertProposalActive(id);
-
-  // Check signer
-  const callerPK = getCaller();
-  Signer_assertSigner(callerPK);
-
-  // Check if already approved
-  assert(!isProposalApprovedBySigner(id, callerPK), "Multisig: already approved");
-
-  // Approve
-  _approveProposal(id, callerPK);
-}
-
-export circuit revokeApproval(id: Uint<64>): [] {
-  // Check if active
-  Proposal_assertProposalActive(id);
-
-  // Check signer
-  const callerPK = getCaller();
-  Signer_assertSigner(callerPK);
-
-  // Check has approved
-  assert(isProposalApprovedBySigner(id, callerPK), "Multisig: not approved");
-
-  // Revoke
-  _revokeApproval(id, callerPK);
-}
-
-export circuit executeShieldedProposal(
-  id: Uint<64>,
-): ShieldedSendResult {
-  // Check if active
-  Proposal_assertProposalActive(id);
-
-  // Check threshold
-  const approvalCount = getApprovalCount(id);
-  Signer_assertThresholdMet(approvalCount);
-
-  // Transfer
-  const { to, color, amount } = Proposal_getProposal(id);
-  const result = Treasury__send(
-    Proposal_toShieldedRecipient(to),
-    color,
-    amount,
-  );
-
-  // Finish lifecycle
-  Proposal__markExecuted(id);
-  return result;
-}
-
-// ─── Internal ───────────────────────────────────────────────────────────
-
-circuit _approveProposal(id: Uint<64>, signer: Either<ZswapCoinPublicKey, ContractAddress>): [] {
-  if (!_proposalApprovals.member(disclose(id))) {
-    _proposalApprovals.insert(disclose(id), default<Map<Either<ZswapCoinPublicKey, ContractAddress>, Boolean>>);
-  }
-
-  _proposalApprovals.lookup(disclose(id)).insert(disclose(signer), disclose(true));
-
-  const newCount = getApprovalCount(id) + 1 as Uint<8>;
-  _approvalCount.insert(disclose(id), disclose(newCount));
-}
-
-circuit _revokeApproval(id: Uint<64>, signer: Either<ZswapCoinPublicKey, ContractAddress>): [] {
-  _proposalApprovals.lookup(disclose(id)).remove(disclose(signer));
-
-  const newCount = getApprovalCount(id) - 1 as Uint<8>;
-  _approvalCount.insert(disclose(id), disclose(newCount));
-}
-
-/**
- * @description Returns the caller identity used for signer authentication.
- *
- * @warning Currently resolves callers via `ownPublicKey()` only, so any signer
- * registered as a `right(ContractAddress)` variant cannot authenticate through
- * this circuit today. Ledger fields keep the `Either<ZswapCoinPublicKey, ContractAddress>`
- * shape so that, once contract-to-contract calls are supported, `getCaller()`
- * can be replaced via a CMA (Contract Maintenance Authorities) circuit upgrade
- * to detect the contract-call context and return the appropriate variant —
- * without a state migration.
- *
- * @returns {Either<ZswapCoinPublicKey, ContractAddress>} The caller wrapped as a left-variant.
- */
-circuit getCaller(): Either<ZswapCoinPublicKey, ContractAddress> {
-  return left<ZswapCoinPublicKey, ContractAddress>(ownPublicKey());
-}
-
-// ─── View ───────────────────────────────────────────────────────────────
-
-export circuit isProposalApprovedBySigner(
-  id: Uint<64>,
-  signer: Either<ZswapCoinPublicKey, ContractAddress>
-): Boolean {
-  if (!_proposalApprovals.member(disclose(id)) || !_proposalApprovals.lookup(disclose(id)).member(disclose(signer))) {
-    return false;
-  }
-
-  return _proposalApprovals.lookup(disclose(id)).lookup(disclose(signer));
-}
-
-export circuit getApprovalCount(id: Uint<64>): Uint<8> {
-  if (!_approvalCount.member(disclose(id))) {
-    return 0;
-  }
-
-  return _approvalCount.lookup(disclose(id));
-}
-
-// IProposalManager
-
-export circuit getProposal(id: Uint<64>): Proposal_Proposal {
-  return Proposal_getProposal(id);
-}
-
-// NOTE: the per-field proposal getters (getProposalRecipient / getProposalAmount
-// / getProposalColor) and getReceivedMinusSent were dropped to bring the deploy
-// transaction under the block-weight limit (the full 19-circuit deploy is
-// rejected with "Transaction would exhaust the block limits"). They are all
-// redundant: read the proposal fields via `getProposal(id).to / .amount / .color`,
-// and the net balance via `getReceivedTotal(color) - getSentTotal(color)`.
-
-export circuit getProposalStatus(id: Uint<64>): Proposal_ProposalStatus {
-  return Proposal_getProposalStatus(id);
-}
-
-// IShieldedTreasury
-
-export circuit getTokenBalance(color: Bytes<32>): Uint<128> {
-  return Treasury_getTokenBalance(color);
-}
-
-export circuit getReceivedTotal(color: Bytes<32>): Uint<128> {
-  return Treasury_getReceivedTotal(color);
-}
-
-export circuit getSentTotal(color: Bytes<32>): Uint<128> {
-  return Treasury_getSentTotal(color);
-}
-
-// ISigner
-
-export circuit getSignerCount(): Uint<8> {
-  return Signer_getSignerCount();
-}
-
-export circuit getThreshold(): Uint<8> {
-  return Signer_getThreshold();
-}
-
-export circuit isSigner(account: Either<ZswapCoinPublicKey, ContractAddress>): Boolean {
-  return Signer_isSigner(account);
-}

package/multisig/presets/ShieldedMultiSigV3.compact

@@ -1,311 +0,0 @@
-// SPDX-License-Identifier: MIT
-// OpenZeppelin Compact Contracts v0.4.0-alpha.1 (multisig/presets/ShieldedMultiSigV3.compact)
-
-pragma language_version >= 0.26.0;
-
-/**
- * @title ShieldedMultiSigV3
- * @description Privacy-preserving multisig token contract for tokenised
- * deposits. Both minting and burning require threshold ECDSA
- * authorization. No single party can unilaterally create or destroy tokens.
- *
- * Designed with the following features:
- * - Supply only enters through authorized mint (no open deposit)
- * - Supply only exits through authorized burn (no arbitrary transfers)
- * - Non-transferability enforced by absence of transfer/execute circuits
- * - Change coins from partial burns handled by the transaction layer
- * - Operator discovers coins via ZswapOutput events from the indexer
- *
- * Uses Midnight's native shielded token primitives:
- *
- * - `mint` creates a new UTXO via `mintShieldedToken`, addressed to the
- *   contract. No external coin input; supply is produced on-chain.
- * - `burn` consumes a UTXO via `sendShielded` to `shieldedBurnAddress()`. Only
- *   coins of this contract's token type can be burned. Change is handled
- *   automatically by the transaction layer.
- *
- * Signer identities are stored as commitments: hashes of ECDSA public keys
- * combined with an instance salt and domain separator. A counter
- * provides replay protection, and also feeds `evolveNonce` to produce
- * unique coin nonces on each mint.
- *
- * Operation domain prefixes ("multisig:mint:" / "multisig:burn:") in the message
- * hash prevent signatures for one operation type from being replayed as
- * the other.
- *
- * @notice Threshold authorization is enforced with secp256k1 ECDSA
- * (`secp256k1EcdsaVerifyLowS`) over `persistentHash` digests, via
- * `EcdsaSignerManager`, so a high-s signature is rejected. The approval
- * vectors are fixed at `Vector<2, ...>`, so this contract is 2-of-3 only.
- *
- * TODO: switch every digest to `keccak256` to match the custodian's HSM
- * signing format (#827).
- */
-
-import CompactStandardLibrary;
-
-import "../EcdsaSignerManager" prefix EcdsaSignerManager_;
-import "../../utils/Utils" prefix Utils_;
-// For testing
-export { ZswapCoinPublicKey };
-
-// ─── State ──────────────────────────────────────────────────────
-
-export ledger _counter: Counter;
-export ledger _coinNonce: Bytes<32>;
-export sealed ledger _tokenDomain: Bytes<32>;
-
-// ─── Constructor ────────────────────────────────────────────────
-
-/**
- * @description Deploys the contract with 3 signer commitments and
- * a threshold of 2.
- *
- * Each commitment is `persistentHash(pkX, pkY, instanceSalt,
- * "multisig:signer:")`. Use the exported `_calculateSignerId` circuit to
- * derive them consistently with in-circuit verification.
- *
- * `tokenDomain` is used with `kernel.self()` to derive the token color
- * via `tokenType(_tokenDomain, kernel.self())`. Only coins of this color
- * can be burned through this contract.
- *
- * `initCoinNonce` seeds the `evolveNonce` chain used to produce unique
- * mint nonces. It must be cryptographically random.
- *
- * Requirements:
- *
- * - `signerCommitments` must not contain duplicates.
- * - `instanceSalt` and `initCoinNonce` should be cryptographically random.
- *
- * @param {Bytes<32>} instanceSalt - Random salt for signer commitment derivation.
- * @param {Bytes<32>} initCoinNonce - Initial coin nonce seed.
- * @param {Bytes<32>} tokenDomain - Domain string used to derive this contract's token color.
- * @param {Vector<3, Bytes<32>>} signerCommitments - Hashed signer identities.
- */
-constructor(
-  instanceSalt: Bytes<32>,
-  initCoinNonce: Bytes<32>,
-  tokenDomain: Bytes<32>,
-  signerCommitments: Vector<3, Bytes<32>>,
-) {
-  _coinNonce = disclose(initCoinNonce);
-  _tokenDomain = disclose(tokenDomain);
-  EcdsaSignerManager_initialize<3>(instanceSalt, signerCommitments, 2);
-}
-
-// ─── Mint ───────────────────────────────────────────────────────
-
-/**
- * @description Mints a new shielded coin addressed to the specified
- * recipient, authorized by threshold signatures.
- *
- * Creates a new UTXO of this contract's token type via `mintShieldedToken`,
- * addressed to the provided recipient. No external coin input is required;
- * supply is produced on-chain.
- *
- * The message hash commits to:
- *   - operation domain ("multisig:mint:" for burn op replay protection)
- *   - contract address (cross-instance replay protection)
- *   - recipient (redirection protection)
- *   - counter value (replay protection)
- *   - amount
- *
- * Coin nonce uniqueness is guaranteed by `evolveNonce(_counter, _coinNonce)`
- * after the counter has been incremented, binding each mint's nonce to a
- * distinct counter value.
- *
- * @circuitInfo k=17, rows=84506
- *
- * Requirements:
- *
- * - Both public keys must hash to registered signer commitments.
- * - Both signatures must be valid over the mint message hash.
- * - Signers must not be duplicates.
- * - Threshold must be met.
- *
- * @param {Uint<64>} amount - The token amount to mint.
- * @param {Either<ZswapCoinPublicKey, ContractAddress>} recipient - The address to receive the minted tokens.
- * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
- * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the mint hash.
- */
-export circuit mint(
-  amount: Uint<64>,
-  recipient: Either<ZswapCoinPublicKey, ContractAddress>,
-  pubkeys: Vector<2, Secp256k1Point>,
-  signatures: Vector<2, Secp256k1EcdsaSignature>
-): [] {
-  const opNonce = _counter;
-  _counter.increment(1);
-
-  // Canonicalize recipient to ensure garbage values don't sully the hash
-  const canonRecipient = Utils_canonicalize<ZswapCoinPublicKey, ContractAddress>(recipient);
-  const recipientHash = persistentHash<Either<ZswapCoinPublicKey, ContractAddress>>(canonRecipient);
-
-  const msgHash = persistentHash<Vector<5, Bytes<32>>>([
-    pad(32, "multisig:mint:"),
-    kernel.self().bytes,
-    recipientHash,
-    opNonce as Bytes<32>,
-    amount as Bytes<32>
-  ]);
-
-  EcdsaSignerManager_assertApprovals(msgHash, pubkeys, signatures);
-
-  _coinNonce = evolveNonce(_counter, _coinNonce);
-  mintShieldedToken(_tokenDomain, disclose(amount), _coinNonce, disclose(canonRecipient));
-}
-
-// ─── Burn ───────────────────────────────────────────────────────
-
-/**
- * @description Burns a shielded coin of this contract's token type,
- * authorized by threshold signatures.
- *
- * Sends the specified amount of the supplied coin to `shieldedBurnAddress()` via
- * `sendShielded`. The nullifier is submitted on-chain, permanently marking
- * the UTXO as spent.
- *
- * Change handling is automatic: if `amount < coin.value`, the transaction
- * layer creates a change output addressed back to the contract. The operator
- * discovers this change coin via `nextZswapLocalState.outputs` in the
- * transaction's private result, then discovers its mt_index from the
- * indexer events using the standard flow. No contract-level change logic
- * is required.
- *
- * Only coins of this contract's token type can be burned. The operator
- * supplies the `QualifiedShieldedCoinInfo` from the off-chain UTXO pool.
- *
- * The "multisig:burn:" domain prefix ensures burn signatures cannot be replayed
- * as mint operations for the same parameters.
- *
- * @circuitInfo k=17, rows=92170
- *
- * Requirements:
- *
- * - Both public keys must hash to registered signer commitments.
- * - Both signatures must be valid over the burn message hash.
- * - Signers must not be duplicates.
- * - Threshold must be met.
- * - coin.color must equal tokenType(_tokenDomain, kernel.self()).
- * - coin.value must be >= amount.
- *
- * @param {QualifiedShieldedCoinInfo} coin - The coin to burn (from operator's UTXO pool).
- * @param {Uint<64>} amount - The token amount to burn.
- * @param {Vector<2, Secp256k1Point>} pubkeys - Public keys of approving signers.
- * @param {Vector<2, Secp256k1EcdsaSignature>} signatures - ECDSA signatures over the burn hash.
- */
-export circuit burn(
-  coin: QualifiedShieldedCoinInfo,
-  amount: Uint<64>,
-  pubkeys: Vector<2, Secp256k1Point>,
-  signatures: Vector<2, Secp256k1EcdsaSignature>
-): [] {
-  const opNonce = _counter;
-  _counter.increment(1);
-
-  const msgHash = persistentHash<Vector<4, Bytes<32>>>([
-    pad(32, "multisig:burn:"),
-    kernel.self().bytes,
-    opNonce as Bytes<32>,
-    amount as Bytes<32>
-  ]);
-
-  EcdsaSignerManager_assertApprovals(msgHash, pubkeys, signatures);
-
-  assert(coin.color == tokenType(_tokenDomain, kernel.self()), "Multisig: coin not from this contract");
-  assert(coin.value >= amount, "Multisig: insufficient coin value");
-
-  sendShielded(disclose(coin), shieldedBurnAddress(), disclose(amount));
-}
-
-// ─── Commitments ────────────────────────────────────────────────
-
-/**
- * @description Computes a signer commitment from a secp256k1 public key,
- * as `persistentHash(pkX, pkY, salt, "multisig:signer:")`.
- *
- * Pure, so the deployer can derive constructor commitments off-chain.
- *
- * Requirements:
- *
- * - `pk` must not be the secp256k1 identity point, which has no coordinates.
- *
- * @param {Secp256k1Point} pk - The secp256k1 public key.
- * @param {Bytes<32>} salt - The instance salt.
- * @returns {Bytes<32>} The signer commitment.
- */
-export pure circuit _calculateSignerId(
-  pk: Secp256k1Point,
-  salt: Bytes<32>
-): Bytes<32> {
-  return EcdsaSignerManager_calculateSignerId(pk, salt);
-}
-
-// ─── View ───────────────────────────────────────────────────────
-
-/**
- * @description Returns the counter the next mint or burn digest will bind to.
- *
- * @circuitInfo k=6, rows=34
- *
- * @returns {Uint<64>} The current counter.
- */
-export circuit getNonce(): Uint<64> {
-  return _counter;
-}
-
-/**
- * @description Returns the domain separator this contract's token type derives from.
- *
- * @circuitInfo k=6, rows=57
- *
- * @returns {Bytes<32>} The token domain.
- */
-export circuit getTokenDomain(): Bytes<32> {
-  return _tokenDomain;
-}
-
-/**
- * @description Returns this contract's token type.
- *
- * @circuitInfo k=13, rows=3836
- *
- * @returns {Bytes<32>} The token type.
- */
-export circuit getTokenType(): Bytes<32> {
-  return tokenType(_tokenDomain, kernel.self());
-}
-
-/**
- * @description Returns the number of registered signers.
- *
- * @circuitInfo k=6, rows=34
- *
- * @returns {Uint<8>} The signer count.
- */
-export circuit getSignerCount(): Uint<8> {
-  return EcdsaSignerManager_getSignerCount();
-}
-
-/**
- * @description Returns the approval threshold.
- *
- * @circuitInfo k=6, rows=34
- *
- * @returns {Uint<8>} The threshold.
- */
-export circuit getThreshold(): Uint<8> {
-  return EcdsaSignerManager_getThreshold();
-}
-
-/**
- * @description Returns whether the given commitment is a registered signer.
- *
- * @circuitInfo k=8, rows=129
- *
- * @param {Bytes<32>} commitment - The signer commitment to check.
- * @returns {Boolean} True if registered.
- */
-export circuit isSigner(commitment: Bytes<32>): Boolean {
-  return EcdsaSignerManager_isSigner(commitment);
-}