@openzeppelin/miden-multisig-client 0.13.1 → 0.13.3

package/src/procedures.ts

@@ -1,37 +1,61 @@
-import type { SignatureScheme } from '@openzeppelin/psm-client';
-
-export const PROCEDURE_ROOTS_FALCON = {
-  update_signers: '0x53d0ad381a193de0cf6af3730141e498274103dfc3b8c8e7367bd49d4a66c72b',
-  auth_tx: '0x474c613b38001cc36d68557e9d881495d6a461a9027033445c7672c586509026',
-  update_psm: '0xb103236807e5bf09c27efc2c5287ca8b03ab9efc1d852b62ebd31f5f1927ec26',
-  verify_psm: '0x30727fc23c6105a678fea8b4c1920f35fa85c03f16a0cf98372c8f56701f8a87',
+/**
+ * Static mapping of procedure names to their deterministic roots.
+ *
+ * These values use the Miden SDK `Word.toHex()` / `Word.fromHex()` encoding, which is the
+ * representation used by the TypeScript client when writing and reading storage map keys.
+ *
+ * Source of truth:
+ * `cargo run --quiet --example procedure_roots -p miden-multisig-client -- --json`
+ *
+ * Note: the Rust example also prints `rust_hex` values for `procedures.rs`. Those are a different
+ * human-readable encoding and should not be copied into this table.
+ */
+export const PROCEDURE_ROOTS = {
+  update_signers: '0xafdea9abee19b02620520b11a165267b266403fa408f7eebc91fc83c33b507ca',
+  update_procedure_threshold: '0xd6616423eebe012655a9db925363cc6751b94109a938e9bc5f488b52f75b7d1c',
+  auth_tx: '0x611abcd570631ad98842cb6f0ef891fe8f9ee508b3245c55a5531d5a8f7fdca9',
+  update_guardian: '0xcda1f9120a3ab2948d5cdc6b4b2982571c04e3f6af787a6d6b2f88eeedd872d7',
+  verify_guardian: '0xe4be6069ba56570afecab5ae2ff77165d5230b703ba2cff1cafe06b92aa19e56',
   send_asset: '0x0e406b067ed2bcd7de745ca6517f519fd1a9be245f913347ac673ca1db30c1d6',
   receive_asset: '0x6f4bdbdc4b13d7ed933d590d88ac9dfb98020c9e917697845b5e169395b76a01',
 } as const;
 
-export const PROCEDURE_ROOTS_ECDSA = {
-  update_signers: '0x930f9ea86d33c7b3b2d23c4e9ac2492add461359344ed25b1acd38f3713dd79c',
-  auth_tx: '0x2bc7664a9dd47b36e7c8b8c3df03412798e4410173f36acfe03d191a38add053',
-  update_psm: '0x26ec27195f1fd3eb622b851dfc9eab038bca87522cfc7ec209bfe507682303b1',
-  verify_psm: '0xbeb9e08a83eca030968f2f137b5673136f21bc16c82fd408c2ce2495ccbdcd15',
-  send_asset: '0xd6c130dba13c67ac4733915f24bea9d19f517f51a65c74ded7bcd27e066b400e',
-  receive_asset: '0x016ab79593165e5b849776919e0c0298fb9dac880d593d93edd7134bdcdb4b6f',
-} as const;
-
-export const PROCEDURE_ROOTS = PROCEDURE_ROOTS_FALCON;
-
-export type ProcedureName = keyof typeof PROCEDURE_ROOTS_FALCON;
+/**
+ * Valid procedure names that can be used for threshold overrides.
+ */
+export type ProcedureName = keyof typeof PROCEDURE_ROOTS;
 
-export function getProcedureRoot(name: ProcedureName, scheme: SignatureScheme = 'falcon'): string {
-  const roots = scheme === 'ecdsa' ? PROCEDURE_ROOTS_ECDSA : PROCEDURE_ROOTS_FALCON;
-  return roots[name];
+/**
+ * Get the procedure root for a given procedure name.
+ *
+ * @param name - The procedure name
+ * @returns The procedure root as a hex string in SDK `Word.toHex()` format
+ *
+ * @example
+ * ```typescript
+ * const root = getProcedureRoot('send_asset');
+ * // '0x0e406b067ed2bcd7de745ca6517f519fd1a9be245f913347ac673ca1db30c1d6'
+ * ```
+ */
+export function getProcedureRoot(name: ProcedureName): string {
+  return PROCEDURE_ROOTS[name];
 }
 
+/**
+ * Check if a string is a valid procedure name.
+ *
+ * @param name - The string to check
+ * @returns true if the string is a valid procedure name
+ */
 export function isProcedureName(name: string): name is ProcedureName {
-  return name in PROCEDURE_ROOTS_FALCON;
+  return name in PROCEDURE_ROOTS;
 }
 
-export function getProcedureNames(scheme: SignatureScheme = 'falcon'): ProcedureName[] {
-  const roots = scheme === 'ecdsa' ? PROCEDURE_ROOTS_ECDSA : PROCEDURE_ROOTS_FALCON;
-  return Object.keys(roots) as ProcedureName[];
+/**
+ * Get all available procedure names.
+ *
+ * @returns Array of all valid procedure names
+ */
+export function getProcedureNames(): ProcedureName[] {
+  return Object.keys(PROCEDURE_ROOTS) as ProcedureName[];
 }

package/src/proposal/factory.ts

@@ -0,0 +1,171 @@
+import type { DeltaObject, DeltaStatus } from '@openzeppelin/guardian-client';
+import type {
+  ExportedProposal,
+  Proposal,
+  ProposalMetadata,
+  ProposalSignatureEntry,
+  ProposalStatus,
+  ProposalType,
+} from '../types.js';
+import { computeCommitmentFromTxSummary } from '../multisig/helpers.js';
+import { normalizeHexWord } from '../utils/encoding.js';
+import { ProposalMetadataCodec } from './metadata.js';
+import { ProposalSignatures } from './signatures.js';
+
+interface ProposalFactoryOptions {
+  accountId: string;
+  signerCommitments: string[];
+  resolveRequiredSignatures: (proposalType: ProposalType) => number;
+}
+
+export class ProposalFactory {
+  constructor(private readonly options: ProposalFactoryOptions) {}
+
+  assertAccountId(accountId: string): void {
+    if (accountId.toLowerCase() === this.options.accountId.toLowerCase()) {
+      return;
+    }
+
+    throw new Error(`Proposal is for a different account: ${accountId}`);
+  }
+
+  assertCommitmentMatchesTxSummary(
+    commitment: string,
+    txSummaryBase64: string,
+    context: string,
+  ): string {
+    const expectedCommitment = normalizeHexWord(computeCommitmentFromTxSummary(txSummaryBase64));
+    const actualCommitment = normalizeHexWord(commitment);
+
+    if (actualCommitment !== expectedCommitment) {
+      throw new Error(
+        `${context}: commitment ${actualCommitment} does not match tx_summary ${expectedCommitment}`,
+      );
+    }
+
+    return expectedCommitment;
+  }
+
+  fromDelta(
+    delta: DeltaObject,
+    proposalId: string,
+    metadata?: ProposalMetadata,
+    existingSignatures: ProposalSignatureEntry[] = [],
+  ): Proposal {
+    this.assertAccountId(delta.accountId);
+    const normalizedProposalId = this.assertCommitmentMatchesTxSummary(
+      proposalId,
+      delta.deltaPayload.txSummary.data,
+      'Invalid proposal',
+    );
+
+    const resolvedMetadata = ProposalMetadataCodec.validate(
+      metadata ?? ProposalMetadataCodec.fromGuardian(delta.deltaPayload.metadata),
+    );
+
+    const localSignatures = new ProposalSignatures(
+      existingSignatures,
+      this.options.signerCommitments,
+      `Invalid local proposal signatures for ${normalizedProposalId}`,
+    ).entries();
+
+    const serverSignatures =
+      delta.status.status === 'pending'
+        ? new ProposalSignatures(
+            delta.status.cosignerSigs.map((signature) => ({
+              signerId: signature.signerId,
+              signature: signature.signature,
+              timestamp: signature.timestamp,
+            })),
+            this.options.signerCommitments,
+            `Invalid server proposal signatures for ${normalizedProposalId}`,
+          ).entries()
+        : [];
+
+    const signatures = ProposalSignatures.mergeEntries([localSignatures, serverSignatures]);
+
+    return {
+      id: normalizedProposalId,
+      accountId: delta.accountId,
+      nonce: delta.nonce,
+      status: this.toStatus(delta.status, resolvedMetadata.proposalType, signatures),
+      txSummary: delta.deltaPayload.txSummary.data,
+      signatures,
+      metadata: resolvedMetadata,
+    };
+  }
+
+  fromExported(exported: ExportedProposal): Proposal {
+    if (typeof exported.nonce !== 'number' || !Number.isInteger(exported.nonce) || exported.nonce < 0) {
+      throw new Error('Invalid proposal JSON: nonce is required');
+    }
+
+    this.assertAccountId(exported.accountId);
+
+    const normalizedCommitment = this.assertCommitmentMatchesTxSummary(
+      exported.commitment,
+      exported.txSummaryBase64,
+      'Invalid proposal',
+    );
+
+    const metadata = ProposalMetadataCodec.validate(exported.metadata);
+    const signatures = new ProposalSignatures(
+      exported.signatures.map((signature) => {
+        const scheme = signature.scheme ?? 'falcon';
+        if (scheme === 'ecdsa' && !signature.publicKey) {
+          throw new Error(
+            `Invalid imported proposal signatures: ECDSA signature for ${signature.commitment} is missing publicKey`,
+          );
+        }
+
+        return {
+          signerId: signature.commitment,
+          signature:
+            scheme === 'ecdsa'
+              ? {
+                  scheme,
+                  signature: signature.signatureHex,
+                  publicKey: signature.publicKey,
+                }
+              : {
+                  scheme,
+                  signature: signature.signatureHex,
+                },
+          timestamp: signature.timestamp ?? new Date().toISOString(),
+        };
+      }),
+      this.options.signerCommitments,
+      'Invalid imported proposal signatures',
+    ).entries();
+
+    const signaturesRequired = this.options.resolveRequiredSignatures(metadata.proposalType);
+
+    return {
+      id: normalizedCommitment,
+      accountId: exported.accountId,
+      nonce: exported.nonce,
+      status: signatures.length >= signaturesRequired ? 'ready' : 'pending',
+      txSummary: exported.txSummaryBase64,
+      signatures,
+      metadata,
+    };
+  }
+
+  private toStatus(
+    status: DeltaStatus,
+    proposalType: ProposalType,
+    signatures: ProposalSignatureEntry[],
+  ): ProposalStatus {
+    switch (status.status) {
+      case 'pending': {
+        const signaturesRequired = this.options.resolveRequiredSignatures(proposalType);
+        return signatures.length >= signaturesRequired ? 'ready' : 'pending';
+      }
+      case 'candidate':
+        return 'ready';
+      case 'canonical':
+      case 'discarded':
+        return 'finalized';
+    }
+  }
+}

package/src/proposal/metadata.ts

@@ -0,0 +1,165 @@
+import type { ProposalMetadata as GuardianProposalMetadata } from '@openzeppelin/guardian-client';
+import type { ProposalMetadata } from '../types.js';
+import { isProcedureName } from '../procedures.js';
+
+export class ProposalMetadataCodec {
+  static toGuardian(metadata: ProposalMetadata): GuardianProposalMetadata {
+    const base: GuardianProposalMetadata = {
+      proposalType: metadata.proposalType,
+      description: metadata.description,
+      salt: metadata.saltHex,
+      requiredSignatures: metadata.requiredSignatures,
+    };
+
+    switch (metadata.proposalType) {
+      case 'consume_notes':
+        return {
+          ...base,
+          noteIds: metadata.noteIds,
+        };
+      case 'p2id':
+        return {
+          ...base,
+          recipientId: metadata.recipientId,
+          faucetId: metadata.faucetId,
+          amount: metadata.amount,
+        };
+      case 'switch_guardian':
+        return {
+          ...base,
+          targetThreshold: metadata.targetThreshold,
+          signerCommitments: metadata.targetSignerCommitments,
+          newGuardianPubkey: metadata.newGuardianPubkey,
+          newGuardianEndpoint: metadata.newGuardianEndpoint,
+        };
+      case 'update_procedure_threshold':
+        return {
+          ...base,
+          targetThreshold: metadata.targetThreshold,
+          targetProcedure: metadata.targetProcedure,
+        };
+      case 'add_signer':
+      case 'remove_signer':
+      case 'change_threshold':
+        return {
+          ...base,
+          targetThreshold: metadata.targetThreshold,
+          signerCommitments: metadata.targetSignerCommitments,
+        };
+      case 'unknown':
+        return base;
+    }
+  }
+
+  static fromGuardian(guardian?: GuardianProposalMetadata): ProposalMetadata {
+    if (!guardian?.proposalType) {
+      throw new Error('Missing proposal metadata.proposalType');
+    }
+
+    const base = {
+      description: guardian.description ?? '',
+      saltHex: guardian.salt,
+      requiredSignatures: guardian.requiredSignatures,
+    };
+
+    switch (guardian.proposalType) {
+      case 'p2id':
+        if (!guardian.recipientId || !guardian.faucetId || !guardian.amount) {
+          throw new Error('p2id proposal is missing required metadata fields');
+        }
+        return {
+          ...base,
+          proposalType: 'p2id',
+          recipientId: guardian.recipientId,
+          faucetId: guardian.faucetId,
+          amount: guardian.amount,
+        };
+      case 'consume_notes':
+        if (!guardian.noteIds || guardian.noteIds.length === 0) {
+          throw new Error('consume_notes proposal is missing noteIds');
+        }
+        return {
+          ...base,
+          proposalType: 'consume_notes',
+          noteIds: guardian.noteIds,
+        };
+      case 'switch_guardian':
+        if (!guardian.newGuardianPubkey || !guardian.newGuardianEndpoint) {
+          throw new Error('switch_guardian proposal is missing required metadata fields');
+        }
+        return {
+          ...base,
+          proposalType: 'switch_guardian',
+          newGuardianPubkey: guardian.newGuardianPubkey,
+          newGuardianEndpoint: guardian.newGuardianEndpoint,
+          targetThreshold: guardian.targetThreshold,
+          targetSignerCommitments: guardian.signerCommitments,
+        };
+      case 'update_procedure_threshold':
+        if (guardian.targetThreshold === undefined || !guardian.targetProcedure) {
+          throw new Error('update_procedure_threshold proposal is missing required metadata fields');
+        }
+        if (!isProcedureName(guardian.targetProcedure)) {
+          throw new Error(`unknown target procedure: ${guardian.targetProcedure}`);
+        }
+        return {
+          ...base,
+          proposalType: 'update_procedure_threshold',
+          targetProcedure: guardian.targetProcedure,
+          targetThreshold: guardian.targetThreshold,
+        };
+      case 'add_signer':
+      case 'remove_signer':
+      case 'change_threshold':
+        if (guardian.targetThreshold === undefined || !guardian.signerCommitments || guardian.signerCommitments.length === 0) {
+          throw new Error(`${guardian.proposalType} proposal is missing required metadata fields`);
+        }
+        return {
+          ...base,
+          proposalType: guardian.proposalType,
+          targetThreshold: guardian.targetThreshold,
+          targetSignerCommitments: guardian.signerCommitments,
+        };
+      default:
+        throw new Error(`Unsupported proposal type: ${guardian.proposalType as string}`);
+    }
+  }
+
+  static validate(metadata: ProposalMetadata): ProposalMetadata {
+    switch (metadata.proposalType) {
+      case 'add_signer':
+      case 'remove_signer':
+      case 'change_threshold':
+        if (
+          metadata.targetThreshold === undefined ||
+          !metadata.targetSignerCommitments ||
+          metadata.targetSignerCommitments.length === 0
+        ) {
+          throw new Error(`${metadata.proposalType} proposal metadata is incomplete`);
+        }
+        return metadata;
+      case 'switch_guardian':
+        if (!metadata.newGuardianPubkey || !metadata.newGuardianEndpoint) {
+          throw new Error('switch_guardian proposal metadata is incomplete');
+        }
+        return metadata;
+      case 'update_procedure_threshold':
+        if (!metadata.targetProcedure || metadata.targetThreshold === undefined) {
+          throw new Error('update_procedure_threshold proposal metadata is incomplete');
+        }
+        return metadata;
+      case 'consume_notes':
+        if (!metadata.noteIds || metadata.noteIds.length === 0) {
+          throw new Error('consume_notes proposal metadata is incomplete');
+        }
+        return metadata;
+      case 'p2id':
+        if (!metadata.recipientId || !metadata.faucetId || !metadata.amount) {
+          throw new Error('p2id proposal metadata is incomplete');
+        }
+        return metadata;
+      case 'unknown':
+        throw new Error('unknown proposal type is not supported');
+    }
+  }
+}

package/src/proposal/signatures.ts

@@ -0,0 +1,68 @@
+import type { ProposalSignatureEntry } from '../types.js';
+import { canonicalizeSignature, normalizeSignerCommitment } from '../utils/signature.js';
+
+export class ProposalSignatures {
+  private readonly signatures: ProposalSignatureEntry[];
+
+  constructor(
+    signatures: ProposalSignatureEntry[],
+    signerCommitments: string[],
+    context: string,
+  ) {
+    const expectedSigners = new Set<string>();
+    for (const signerCommitment of signerCommitments) {
+      let normalizedCommitment: string;
+      try {
+        normalizedCommitment = normalizeSignerCommitment(signerCommitment);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`${context}: ${message}`);
+      }
+      expectedSigners.add(normalizedCommitment);
+    }
+
+    const signaturesBySigner = new Map<string, ProposalSignatureEntry>();
+    for (const signature of signatures) {
+      let canonicalized: ProposalSignatureEntry;
+      try {
+        canonicalized = canonicalizeSignature(signature, expectedSigners);
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        throw new Error(`${context}: ${message}`);
+      }
+
+      if (signaturesBySigner.has(canonicalized.signerId)) {
+        throw new Error(`${context}: duplicate signatures for signer ${canonicalized.signerId}`);
+      }
+
+      signaturesBySigner.set(canonicalized.signerId, canonicalized);
+    }
+
+    this.signatures = Array.from(signaturesBySigner.values());
+  }
+
+  entries(): ProposalSignatureEntry[] {
+    return [...this.signatures];
+  }
+
+  count(): number {
+    return this.signatures.length;
+  }
+
+  hasSigner(signerId: string): boolean {
+    const normalizedSigner = normalizeSignerCommitment(signerId);
+    return this.signatures.some((signature) => signature.signerId === normalizedSigner);
+  }
+
+  static mergeEntries(entryGroups: ProposalSignatureEntry[][]): ProposalSignatureEntry[] {
+    const signaturesBySigner = new Map<string, ProposalSignatureEntry>();
+
+    for (const group of entryGroups) {
+      for (const signature of group) {
+        signaturesBySigner.set(signature.signerId, signature);
+      }
+    }
+
+    return Array.from(signaturesBySigner.values());
+  }
+}

package/src/signer.ts

@@ -1,2 +1,4 @@
 export { FalconSigner } from './signers/falcon.js';
 export { EcdsaSigner } from './signers/ecdsa.js';
+export { ParaSigner, type ParaSigningContext } from './signers/para.js';
+export { MidenWalletSigner, type WalletSigningContext } from './signers/miden-wallet.js';

package/src/signers/ecdsa.test.ts

@@ -0,0 +1,80 @@
+import { describe, expect, it, vi, beforeEach } from 'vitest';
+import { EcdsaSigner } from './ecdsa.js';
+
+vi.mock('@miden-sdk/miden-sdk', () => {
+  const mockSignature = {
+    serialize: () => new Uint8Array([0, 1, 2, 3, 4, 5]),
+  };
+
+  const mockPublicKey = {
+    toCommitment: () => ({
+      toHex: () => '0x' + 'a'.repeat(64),
+    }),
+    serialize: () => new Uint8Array([0, 1, 2, 3, 4, 5, 6, 7, 8, 9]),
+  };
+
+  const mockSecretKey = {
+    publicKey: vi.fn().mockReturnValue(mockPublicKey),
+    sign: vi.fn().mockReturnValue(mockSignature),
+  };
+
+  return {
+    AuthSecretKey: vi.fn(),
+    Word: {
+      fromHex: vi.fn((hex: string) => ({
+        toHex: () => hex,
+        toFelts: () => [1, 2, 3, 4],
+      })),
+    },
+    AccountId: {
+      fromHex: vi.fn(() => ({
+        prefix: () => ({ asInt: () => BigInt(1) }),
+        suffix: () => ({ asInt: () => BigInt(2) }),
+      })),
+    },
+    Felt: vi.fn().mockImplementation((value: bigint) => ({ value })),
+    FeltArray: vi.fn().mockImplementation((elements: unknown[]) => elements),
+    Rpo256: {
+      hashElements: vi.fn().mockReturnValue({
+        toHex: () => '0x' + 'b'.repeat(64),
+        toFelts: () => [1, 2, 3, 4],
+      }),
+    },
+  };
+});
+
+describe('EcdsaSigner', () => {
+  let mockSecretKey: {
+    publicKey: ReturnType<typeof vi.fn>;
+    sign: ReturnType<typeof vi.fn>;
+  };
+  let signer: EcdsaSigner;
+
+  beforeEach(async () => {
+    vi.clearAllMocks();
+    mockSecretKey = {
+      publicKey: vi.fn().mockReturnValue({
+        toCommitment: () => ({ toHex: () => '0x' + 'a'.repeat(64) }),
+        serialize: () => new Uint8Array([0, 1, 2, 3, 4, 5, 6, 7, 8, 9]),
+      }),
+      sign: vi.fn().mockReturnValue({
+        serialize: () => new Uint8Array([0, 1, 2, 3, 4, 5]),
+      }),
+    };
+    signer = new EcdsaSigner(mockSecretKey as never);
+  });
+
+  it('signs request-bound auth messages for ECDSA', async () => {
+    const { Rpo256 } = await import('@miden-sdk/miden-sdk');
+
+    const signature = await signer.signRequest(
+      '0x' + 'a'.repeat(30),
+      1700000000,
+      { toBytes: () => new Uint8Array([1, 2, 3, 4]) } as never,
+    );
+
+    expect(signature).toBe('0x0102030405');
+    expect(mockSecretKey.sign).toHaveBeenCalled();
+    expect(Rpo256.hashElements).toHaveBeenCalledTimes(2);
+  });
+});

package/src/signers/ecdsa.ts

@@ -1,3 +1,4 @@
+import type { RequestAuthPayload } from '@openzeppelin/guardian-client';
 import { AuthSecretKey } from '@miden-sdk/miden-sdk';
 import type { Signer, SignatureScheme } from '../types.js';
 import { bytesToHex, normalizeHexWord } from '../utils/encoding.js';
@@ -19,14 +20,24 @@ export class EcdsaSigner implements Signer {
 
   async signAccountIdWithTimestamp(accountId: string, timestamp: number): Promise<string> {
     const digest = AuthDigest.fromAccountIdWithTimestamp(accountId, timestamp);
-    const signature = this.secretKey.sign(digest);
-    const signatureBytes = signature.serialize();
-    const ecdsaSignature = signatureBytes.slice(1);
-    return bytesToHex(ecdsaSignature);
+    return this.signWord(digest);
+  }
+
+  async signRequest(
+    accountId: string,
+    timestamp: number,
+    requestPayload: RequestAuthPayload,
+  ): Promise<string> {
+    const digest = AuthDigest.fromRequest(accountId, timestamp, requestPayload);
+    return this.signWord(digest);
   }
 
   async signCommitment(commitmentHex: string): Promise<string> {
     const word = AuthDigest.fromCommitmentHex(commitmentHex);
+    return this.signWord(word);
+  }
+
+  private signWord(word: ReturnType<typeof AuthDigest.fromCommitmentHex>): string {
     const signature = this.secretKey.sign(word);
     const signatureBytes = signature.serialize();
     const ecdsaSignature = signatureBytes.slice(1);

package/src/signers/falcon.test.ts

@@ -39,6 +39,7 @@ vi.mock('@miden-sdk/miden-sdk', () => {
     Rpo256: {
       hashElements: vi.fn().mockReturnValue({
         toHex: () => '0x' + 'b'.repeat(64),
+        toFelts: () => [1, 2, 3, 4],
       }),
     },
   };
@@ -102,6 +103,24 @@ describe('FalconSigner', () => {
     });
   });
 
+  describe('signRequest', () => {
+    it('signs account ID, timestamp, and request payload for Falcon auth', async () => {
+      const { Rpo256 } = await import('@miden-sdk/miden-sdk');
+
+      const signature = await signer.signRequest(
+        '0x' + 'a'.repeat(30),
+        1700000000,
+        {
+          toBytes: () => new Uint8Array([1, 2, 3, 4]),
+        } as any,
+      );
+
+      expect(signature).toBe('0x010203040506070809');
+      expect(mockSecretKey.sign).toHaveBeenCalled();
+      expect(Rpo256.hashElements).toHaveBeenCalledTimes(2);
+    });
+  });
+
   describe('signCommitment', () => {
     it('handles commitment with 0x prefix', async () => {
       const signature = await signer.signCommitment('0x' + 'c'.repeat(64));

package/src/signers/falcon.ts

@@ -1,4 +1,5 @@
-import { AuthSecretKey } from '@miden-sdk/miden-sdk';
+import type { RequestAuthPayload } from '@openzeppelin/guardian-client';
+import { AuthSecretKey, type Word } from '@miden-sdk/miden-sdk';
 import type { Signer, SignatureScheme } from '../types.js';
 import { bytesToHex } from '../utils/encoding.js';
 import { AuthDigest } from '../utils/digest.js';
@@ -20,14 +21,24 @@ export class FalconSigner implements Signer {
 
   async signAccountIdWithTimestamp(accountId: string, timestamp: number): Promise<string> {
     const digest = AuthDigest.fromAccountIdWithTimestamp(accountId, timestamp);
-    const signature = this.secretKey.sign(digest);
-    const signatureBytes = signature.serialize();
-    const falconSignature = signatureBytes.slice(1);
-    return bytesToHex(falconSignature);
+    return this.signWord(digest);
+  }
+
+  async signRequest(
+    accountId: string,
+    timestamp: number,
+    requestPayload: RequestAuthPayload,
+  ): Promise<string> {
+    const digest = AuthDigest.fromRequest(accountId, timestamp, requestPayload);
+    return this.signWord(digest);
   }
 
   async signCommitment(commitmentHex: string): Promise<string> {
     const word = AuthDigest.fromCommitmentHex(commitmentHex);
+    return this.signWord(word);
+  }
+
+  private signWord(word: Word): string {
     const signature = this.secretKey.sign(word);
     const signatureBytes = signature.serialize();
     const falconSignature = signatureBytes.slice(1);