@sig-net/midnight-contract 0.0.1

package/src/signet-contract.compact

@@ -0,0 +1,135 @@
+pragma language_version >= 0.25;
+
+import CompactStandardLibrary;
+
+// Shared signet library: request/response structs, request-id hashing,
+// path<->identity binding, and the attestation message. See the module header
+// in Signet.compact and https://docs.sig.network/ for the protocol.
+import "@sig-net/midnight/src/Signet";
+
+// The CENTRAL signet contract: the MPC delivers all its responses here, and
+// clients poll it — there is deliberately no push/websocket channel. Ledger
+// layout per "Signet Contract Ledger Layout" in Signet.compact, so pollers
+// need only this contract's address.
+export ledger signatureResponseCounterIndex: SignatureResponseCounterIndex;
+
+export ledger signatureResponseIndex: SignatureResponseIndex;
+
+export ledger respondBidirectionalIndex: RespondBidirectionalIndex;
+
+// The MPC attestation key, pinned at deploy time: postRespondBidirectional
+// accepts only responses signed by this key.
+export sealed ledger mpcPubKeyHash: Bytes<32>;
+
+constructor(mpcPk: JubjubPoint) {
+    mpcPubKeyHash = disclose(persistentHash<JubjubPoint>(mpcPk));
+}
+
+// emitSignBidirectionalEvent should be called by clients after (or within) a
+// transaction that writes a SignBidirectionalRequest to their canonical
+// SignBidirectionalRequestIndex state map.
+export circuit emitSignBidirectionalEvent(signBidirectionalEvent: SignBidirectionalEvent): [] {
+    emit(Misc {
+        name: pad(32, "SignBidirectionalEvent"),
+        payload: serialize<SignBidirectionalEvent, 256>(disclose(signBidirectionalEvent)),
+    });
+}
+
+// postSignatureResponse appends a signature response for requestId and
+// emits a SignatureRespondedEvent so the requesting client learns a post
+// landed. Unauthenticated by NECESSITY (secp256k1 ECDSA cannot be verified
+// in-circuit): anyone may post, and nothing is ever overwritten — each post
+// lands under the next (requestId, count) key. Callers verify the posted
+// signatures off-chain to pick out the genuine one.
+export circuit postSignatureResponse(requestId: RequestId, signatureResponse: SignatureResponse): [] {
+    // Everything stored here is public by construction.
+    const disclosedRequestId = disclose(requestId);
+
+    // Ensure the request's counter exists (a fresh Counter reads 0).
+    if (!signatureResponseCounterIndex.member(disclosedRequestId)) {
+        signatureResponseCounterIndex.insertDefault(disclosedRequestId);
+    }
+
+    // Posts so far == this post's 0-based count. Read ONCE into a local so
+    // the stored key, the counter update, and the emitted event cannot
+    // disagree.
+    const count = signatureResponseCounterIndex.lookup(disclosedRequestId).read();
+    signatureResponseCounterIndex.lookup(disclosedRequestId).increment(1);
+
+    // Store the response under (requestId, count).
+    signatureResponseIndex.insert(
+        SignetResponseKey{
+            requestId: disclosedRequestId,
+            count: count,
+        },
+        disclose(signatureResponse),
+    );
+
+    // Notify the requesting client which post just landed. A ping only —
+    // clients read the post back from the log and verify it off-chain.
+    emit(Misc {
+        name: pad(32, "SignatureRespondedEvent"),
+        payload: serialize<SignatureRespondedEvent, 256>(SignatureRespondedEvent {
+            requestId: disclosedRequestId as Bytes<32>,
+            count: count,
+        }),
+    });
+}
+
+// postRespondBidirectional records the MPC's attestation of requestId's
+// remote execution. Anyone may POST, but nothing unauthentic can LAND: the
+// Schnorr signature over (requestId, hash(serializedOutput, outputLen)) is
+// verified in-circuit against the sealed MPC key, so the stored record is
+// authentic by construction and one slot per request suffices — clients read
+// it without re-verifying.
+export circuit postRespondBidirectional(
+    requestId: RequestId,
+    respondBidirectional: RespondBidirectional
+): [] {
+    // Everything stored here is public by construction.
+    const disclosedRequestId = disclose(requestId);
+    const disclosedResponse = disclose(respondBidirectional);
+
+    // Only the pinned MPC key may attest.
+    assert(
+        persistentHash<JubjubPoint>(disclosedResponse.pk) == mpcPubKeyHash,
+        "unauthorized: attestation pk is not the MPC key"
+    );
+
+    // The attestation must sign THIS request and THIS output.
+    assert(
+        jubjubSchnorrVerify<4>(
+            signetAttestationMessage(
+                disclosedRequestId,
+                disclosedResponse.serializedOutput,
+                disclosedResponse.outputLen
+            ),
+            JubjubSchnorrSignature {
+                announcement: disclosedResponse.announcement,
+                response: disclosedResponse.response,
+            },
+            disclosedResponse.pk
+        ),
+        "Invalid attestation signature"
+    );
+
+    // First valid write wins. A re-post is a no-op, never an overwrite —
+    // Schnorr is randomized, so even the MPC re-signing the same output
+    // yields bytewise-different records; asserting equality would misfire.
+    // The no-op also emits nothing: the event fires at most once per request,
+    // exactly when the one authenticated slot is filled.
+    if (respondBidirectionalIndex.member(disclosedRequestId)) {
+        return [];
+    }
+    respondBidirectionalIndex.insert(disclosedRequestId, disclosedResponse);
+
+    // Notify the requesting client the attestation landed. A ping only —
+    // clients read the record back from the index; no off-chain verification
+    // follows, the in-circuit checks above already authenticated it.
+    emit(Misc {
+        name: pad(32, "RespondBidirectionalEvent"),
+        payload: serialize<RespondBidirectionalEvent, 256>(RespondBidirectionalEvent {
+            requestId: disclosedRequestId as Bytes<32>,
+        }),
+    });
+}

package/src/witnesses.ts

@@ -0,0 +1,22 @@
+// The signet contract has no witnesses: Schnorr verification is
+// CompactStandardLibrary's `jubjubSchnorrVerify` (fully in-circuit), and
+// there is no private state — posting carries no caller secrets.
+
+import type { Witnesses } from "./managed/contract/index.js";
+
+/** Private state carried through signet-contract circuit calls: none. */
+export type SignetContractPrivateState = Record<string, never>;
+
+/**
+ * Build the contract's (empty) private state.
+ *
+ * @returns A fresh, empty private state.
+ */
+export const createSignetContractPrivateState =
+  (): SignetContractPrivateState => ({});
+
+/**
+ * Witness implementations, typed against the generated `Witnesses` shape:
+ * the contract declares none.
+ */
+export const witnesses: Witnesses<SignetContractPrivateState> = {};