@sig-net/midnight 0.0.1 → 0.0.3

package/src/schnorr.ts

@@ -1,210 +0,0 @@
-// Jubjub Schnorr helpers — the TS side of the shared Schnorr.compact module:
-// key derivation, SIGNING (which needs the secret scalar, so it cannot be a
-// circuit), and key parsing/hashing. Everything provable stays in Compact:
-// the challenge is the COMPILED `pureCircuits.schnorrChallenge`, injected by
-// callers (see SchnorrChallengeFn), and the attestation message is the
-// compiled `pureCircuits.signetAttestationMessage` — this file never
-// re-implements either. Verification lives in circuits only
-// (CompactStandardLibrary's jubjubSchnorrVerify, run by the signet contract
-// at post time).
-//
-// This belongs in github.com/sig-net/signet.js as its Midnight adapter —
-// kept here until upstreamed. The math is Midnight-specific (Jubjub embedded
-// in BLS12-381 via @midnight-ntwrk/compact-runtime EC ops), which is exactly
-// why signet.js does not cover it today.
-
-import { randomBytes } from "node:crypto";
-
-import {
-  CompactTypeBytes,
-  CompactTypeJubjubPoint,
-  CompactTypeVector,
-  ecMulGenerator,
-  persistentHash,
-  type JubjubPoint,
-} from "@midnight-ntwrk/compact-runtime";
-
-// Re-exported because it appears throughout this module's public signatures
-// (hashJubjubPoint, parse/formatJubjubPublicKey, JubjubKeypair.pk) — SDK
-// consumers shouldn't have to depend on compact-runtime just for the type.
-export type { JubjubPoint } from "@midnight-ntwrk/compact-runtime";
-
-/** Jubjub curve scalar field order (group order of the generator). */
-export const JUBJUB_ORDER = 6554484396890773809930967563523245729705921265872317281365359162392183254199n;
-
-/** BLS12-381 scalar field order (the Compact `Field` type modulus). */
-export const BLS_ORDER = 52435875175126190479447740508185965837690552500527637822603658699938581184513n;
-
-const bytes32Type = new CompactTypeBytes(32);
-const vec2x32Type = new CompactTypeVector(2, bytes32Type);
-
-/**
- * Convert little-endian bytes to a bigint. Matches Compact's
- * `Bytes<32> as Field` interpretation (and the MPC monitor's ABI-word
- * decoding convention).
- *
- * @param bytes - Little-endian byte array.
- * @returns The decoded non-negative integer.
- */
-export function bytesToBigint(bytes: Uint8Array): bigint {
-  let result = 0n;
-  for (let i = bytes.length - 1; i >= 0; i--) {
-    result = (result << 8n) | BigInt(bytes[i]);
-  }
-  return result;
-}
-
-/**
- * Convert a bigint to exactly 32 little-endian bytes. Matches Compact's
- * `Field as Bytes<32>` encoding (the inverse of {@link bytesToBigint});
- * negative inputs are interpreted in the BLS scalar field.
- *
- * @param n - The integer to encode.
- * @returns The 32-byte little-endian encoding.
- */
-export function bigintToBytes32(n: bigint): Uint8Array {
-  const buf = new Uint8Array(32);
-  let v = n < 0n ? n + BLS_ORDER : n;
-  for (let i = 0; i < 32; i++) {
-    buf[i] = Number(v & 0xffn);
-    v >>= 8n;
-  }
-  return buf;
-}
-
-/** A Jubjub keypair: the secret scalar and its public curve point. */
-export interface JubjubKeypair {
-  /** Secret scalar in `[1, JUBJUB_ORDER - 1]`. */
-  sk: bigint;
-  /** Public key: `sk * G` on Jubjub. */
-  pk: JubjubPoint;
-}
-
-/** Zero-pad an ASCII domain tag to 32 bytes (Compact `pad(32, ...)`). */
-function pad32(tag: string): Uint8Array {
-  const padded = new Uint8Array(32);
-  new TextEncoder().encodeInto(tag, padded);
-  return padded;
-}
-
-/**
- * Derive a Jubjub keypair from a seed — the same derivation the MPC server
- * performs on its root key, so this MUST stay bit-identical to it:
- * `sk = (persistentHash([pad32("jubjub:auth:"), seed]) mod (order - 1)) + 1`,
- * `pk = sk * G`.
- *
- * @param seed - Seed bytes (e.g. the 32-byte MPC root key).
- * @returns The derived {@link JubjubKeypair}.
- */
-export function deriveJubjubKeypair(seed: Uint8Array): JubjubKeypair {
-  const skBytes = persistentHash(vec2x32Type, [pad32("jubjub:auth:"), seed]);
-  const sk = (bytesToBigint(skBytes) % (JUBJUB_ORDER - 1n)) + 1n;
-  const pk = ecMulGenerator(sk);
-  return { sk, pk };
-}
-
-// ---- Schnorr signing ----
-
-/**
- * A Schnorr signature (TS twin of CompactStandardLibrary's
- * `JubjubSchnorrSignature`).
- */
-export interface SchnorrSignature {
-  /** Nonce commitment R = k * G. */
-  announcement: JubjubPoint;
-  /** Signature scalar s = (k + c * sk) mod JUBJUB_ORDER. */
-  response: bigint;
-}
-
-/**
- * Computes the Schnorr challenge (the Poseidon transientHash output reduced
- * into Jubjub's scalar field, exactly as `jubjubSchnorrVerify` computes it).
- * ALWAYS inject the compiled circuit — signet-midnight's own
- * `pureCircuits.schnorrChallenge` — never a TS re-implementation; keeping it
- * injected keeps this signer decoupled from any one compiled artifact.
- */
-export type SchnorrChallengeFn = (
-  annX: bigint,
-  annY: bigint,
-  pkX: bigint,
-  pkY: bigint,
-  msg: bigint[],
-) => bigint;
-
-/**
- * Sign a message with Schnorr on Jubjub, matching CompactStandardLibrary's
- * `jubjubSchnorrVerify`: `c = challenge` (already reduced into Jubjub's
- * scalar field by the compiled circuit), `s = (k + c * sk) mod JUBJUB_ORDER`.
- * For signet attestations the message is the compiled
- * `pureCircuits.signetAttestationMessage(requestId, outputData)`.
- *
- * @param sk - Jubjub private key scalar.
- * @param msg - Message field limbs.
- * @param schnorrChallenge - The compiled `pureCircuits.schnorrChallenge`.
- * @returns The signature (announcement R, response s).
- * @throws Error if `sk` reduces to zero mod the Jubjub order.
- */
-export function schnorrSign(
-  sk: bigint,
-  msg: bigint[],
-  schnorrChallenge: SchnorrChallengeFn,
-): SchnorrSignature {
-  const skReduced = ((sk % JUBJUB_ORDER) + JUBJUB_ORDER) % JUBJUB_ORDER;
-  if (skReduced === 0n) {
-    throw new Error("Private key must be non-zero mod JUBJUB_ORDER");
-  }
-
-  const pk = ecMulGenerator(skReduced);
-  const k = (bytesToBigint(randomBytes(32)) % JUBJUB_ORDER) || 1n;
-  const announcement = ecMulGenerator(k);
-
-  // schnorrChallenge returns the challenge already reduced into Jubjub's
-  // scalar field — use it as-is.
-  const c = schnorrChallenge(announcement.x, announcement.y, pk.x, pk.y, msg);
-
-  const response = (((k + c * skReduced) % JUBJUB_ORDER) + JUBJUB_ORDER) % JUBJUB_ORDER;
-  return { announcement, response };
-}
-
-/**
- * Hash a Jubjub point exactly as the circuits do (`persistentHash<JubjubPoint>`)
- * — the form the signet contract seals as `mpcPubKeyHash`.
- *
- * @param point - The point to hash.
- * @returns The 32-byte hash.
- */
-export function hashJubjubPoint(point: JubjubPoint): Uint8Array {
-  return persistentHash(CompactTypeJubjubPoint, point);
-}
-
-/**
- * Parse a Jubjub public key from its `"x,y"` config/env form (decimal or
- * 0x-hex field coordinates) — how deploys receive `MPC_JUBJUB_PK`.
- *
- * @param value - The `"x,y"` string.
- * @returns The parsed point.
- * @throws Error if the value is not two comma-separated field coordinates.
- */
-export function parseJubjubPublicKey(value: string): JubjubPoint {
-  const parts = value.split(",").map((part) => part.trim());
-  if (parts.length !== 2 || parts.some((part) => part === "")) {
-    throw new Error(`expected a Jubjub public key as "x,y"; got "${value}"`);
-  }
-  try {
-    return { x: BigInt(parts[0]), y: BigInt(parts[1]) };
-  } catch {
-    throw new Error(`Jubjub public key coordinates must be decimal or 0x-hex integers; got "${value}"`);
-  }
-}
-
-/**
- * Format a Jubjub public key as the `"x,y"` decimal config/env form that
- * {@link parseJubjubPublicKey} accepts — the round-trip inverse, for handing
- * a derived key to deploys as `MPC_JUBJUB_PK`.
- *
- * @param point - The point to format.
- * @returns The `"x,y"` string with decimal coordinates.
- */
-export function formatJubjubPublicKey(point: JubjubPoint): string {
-  return `${point.x},${point.y}`;
-}

package/src/signature-requests-state-reader.ts

@@ -1,223 +0,0 @@
-// MPC-style raw state reader for the signature-REQUESTS side: decode the signet
-// request ledger fields out of a contract's raw state WITHOUT the compiled
-// contract. This is how the MPC monitor consumes signet contracts — it has only
-// a contract address, queries raw state from the indexer
-// (queryContractState(address).data), and decodes by the signet layout
-// convention: the request index is ledger field 0, the request counter field 1.
-// The compiled contract's generated ledger() does exactly this walk internally;
-// the record descriptors themselves are the parameterized twins in
-// signet-requests.ts. The generic tree walk and shared base descriptors live
-// in signature-state-reading.ts.
-
-import type { CompactType } from "@midnight-ntwrk/compact-runtime";
-
-import {
-  requestIdHex,
-  signBidirectionalRequestDescriptor,
-  type RequestIdHex,
-  type SignBidirectionalRequest,
-  type SignBidirectionalRequestIndex,
-} from "./signet-requests.ts";
-
-/** The aligned-value cursor every descriptor's `fromValue` consumes. */
-type AlignedValue = Parameters<CompactType<unknown>["fromValue"]>[0];
-
-import {
-  requestIdType,
-  signetFieldNode,
-  u64,
-  type RawContractState,
-} from "./signature-state-reading.ts";
-
-/** Signet layout convention: the request index is ledger field 0. */
-export const SIGNET_REQUESTS_INDEX_FIELD = 0;
-
-/** Signet layout convention: the request counter (`SignetNonce`) is ledger field 1. */
-export const SIGNET_NONCE_FIELD = 1;
-
-/**
- * Aligned-value entry count of a request record EXCLUDING the capacity-scaled
- * vectors: requestNonce (1) + txParamType (1, enums are one atom whatever
- * their byte width) + the EVMType2TxParams fixed fields (to..value = 7,
- * accessListEntryCount = 1) + the calldata Maybe's is_some (1), selector (1)
- * and noWords (1) + the routing fields caip2Id..respondSerializationSchema (8).
- * A stored request cell therefore holds
- *   `REQUEST_FIXED_VALUE_ATOMS + maxCalldataWords
- *      + maxAccessListEntries·(2 + maxStorageKeysPerEntry)`
- * entries (each calldata word is one Bytes<32> atom; each access-list entry is
- * address + storageKeyCount + its keys).
- */
-export const REQUEST_FIXED_VALUE_ATOMS = 21;
-
-/**
- * Recover a record's capacity instantiation (maxCalldataWords,
- * maxAccessListEntries, maxStorageKeysPerEntry) from its aligned-value atom
- * count and decode it. Unlike the old single-vector layout, one atom count no
- * longer determines the capacities uniquely, so candidates are enumerated —
- * access-list-free first (today's only producer, the vault, is <2, 0, 0>) —
- * and validated by the decode itself: the descriptors' Bytes length checks
- * and the enum range check reject wrong splits, and a decode that leaves
- * atoms unconsumed is rejected here.
- *
- * @param atoms - The record cell's aligned value (a fresh copy per attempt).
- * @returns The decoded record.
- * @throws Error if no capacity split decodes the value cleanly.
- */
-function decodeSignBidirectionalRequest(
-  atoms: AlignedValue,
-): SignBidirectionalRequest {
-  const variable = atoms.length - REQUEST_FIXED_VALUE_ATOMS;
-  if (variable < 0) {
-    throw new Error(
-      `request record has ${atoms.length} value entries — fewer than the ` +
-        `${REQUEST_FIXED_VALUE_ATOMS} its fixed fields need`,
-    );
-  }
-  const attempt = (
-    maxWords: number,
-    maxEntries: number,
-    maxKeys: number,
-  ): SignBidirectionalRequest | undefined => {
-    const cursor = [...atoms] as AlignedValue;
-    try {
-      const record = signBidirectionalRequestDescriptor(
-        maxWords,
-        maxEntries,
-        maxKeys,
-      ).fromValue(cursor);
-      // A clean decode consumes the record exactly.
-      return cursor.length === 0 ? record : undefined;
-    } catch {
-      return undefined;
-    }
-  };
-  // No access list: variable atoms are calldata words alone (one atom each).
-  {
-    const record = attempt(variable, 0, 0);
-    if (record !== undefined) return record;
-  }
-  // With an access list: E entries of (2 + K) atoms, the rest words.
-  for (let entries = 1; entries * 2 <= variable; entries++) {
-    for (let keys = 0; entries * (2 + keys) <= variable; keys++) {
-      const words = variable - entries * (2 + keys);
-      const record = attempt(words, entries, keys);
-      if (record !== undefined) return record;
-    }
-  }
-  throw new Error(
-    `request record with ${atoms.length} value entries matches no ` +
-      `(calldata words, access-list entries, storage keys) capacity split`,
-  );
-}
-
-/**
- * The decoded signet ledger fields of a conforming contract — the complete
- * view the MPC needs: the request index (field 0) and the request counter
- * (field 1, Compact `SignetNonce`), whose value doubles as a cheap
- * change-detection signal (unchanged nonce ⇒ no new requests).
- */
-export interface SignetRequestsLedger {
-  /** The request counter (ledger field {@link SIGNET_NONCE_FIELD}). */
-  nonce: bigint;
-  /**
-   * The request index (ledger field {@link SIGNET_REQUESTS_INDEX_FIELD}),
-   * keyed by hex request id.
-   */
-  requestsIndex: SignBidirectionalRequestIndex;
-}
-
-/**
- * MPC-style read: parse the signet ledger fields out of raw contract state
- * by field position alone — no compiled contract, no generated `ledger()`,
- * only the signet layout convention and the canonical descriptors from
- * signet-requests.ts.
- *
- * @param raw - Raw contract state, e.g. `queryContractState(address).data`
- *   from the indexer or `ctx.currentQueryContext.state` from the simulator.
- * @returns The decoded {@link SignetRequestsLedger}.
- * @throws Error if a field is missing, has the wrong state-value shape, or a
- *   record matches no capacity split.
- */
-export function readSignetRequestsLedgerFromState(raw: RawContractState): SignetRequestsLedger {
-  const map = signetFieldNode(raw, SIGNET_REQUESTS_INDEX_FIELD).asMap();
-  if (map === undefined) {
-    throw new Error(`Ledger field ${SIGNET_REQUESTS_INDEX_FIELD} is not a Map`);
-  }
-  const requestsIndex: SignBidirectionalRequestIndex = new Map();
-  for (const key of map.keys()) {
-    // fromValue consumes its input, so hand each descriptor a copy.
-    const requestId = requestIdType.fromValue([...key.value]);
-    const cell = map.get(key)?.asCell();
-    if (cell === undefined) continue;
-    requestsIndex.set(
-      requestIdHex(requestId),
-      decodeSignBidirectionalRequest(cell.value),
-    );
-  }
-
-  const nonceCell = signetFieldNode(raw, SIGNET_NONCE_FIELD).asCell();
-  if (nonceCell === undefined) {
-    throw new Error(`Ledger field ${SIGNET_NONCE_FIELD} is not a Cell`);
-  }
-  const nonce = u64.fromValue([...nonceCell.value]);
-
-  return { nonce, requestsIndex };
-}
-
-/**
- * Look up ONE request by id in a contract's request index at an arbitrary
- * ledger field — the generalization of {@link readSignetRequestsLedgerFromState}
- * the event path needs: a `SignBidirectionalEvent` names both the requester
- * contract AND which field holds its index, so the field is no longer assumed
- * to be {@link SIGNET_REQUESTS_INDEX_FIELD}.
- *
- * This is the mandatory membership check of the event flow (see
- * signet-request-resolver.ts): `undefined` means the id is NOT a member of the
- * index at `fieldIndex` — the notification is forged, stale, points at the
- * wrong field, or the request is not yet indexed — and the caller MUST drop it.
- * Every non-membership case (field out of range, field is not a Map, id absent,
- * a cell that fails to decode) returns `undefined` rather than throwing, so a
- * malformed or adversarial event can never crash the reader.
- *
- * Only the matched record is decoded (not the whole index), and it is decoded
- * by the same {@link decodeSignBidirectionalRequest} the full reader uses, so
- * the result is `toEqual` to `readSignetRequestsLedgerFromState(raw)
- * .requestsIndex.get(requestId)` when `fieldIndex` is the index field.
- *
- * @param raw - Raw contract state, e.g. `queryContractState(address).data`.
- * @param fieldIndex - Ledger field position of the request index in `raw`.
- * @param requestId - The request id to look up.
- * @returns The stored request record, or `undefined` when it is not a member.
- */
-export function lookupSignetRequestAt(
-  raw: RawContractState,
-  fieldIndex: number,
-  requestId: RequestIdHex,
-): SignBidirectionalRequest | undefined {
-  let node;
-  try {
-    node = signetFieldNode(raw, fieldIndex);
-  } catch {
-    return undefined; // field position out of range for this contract
-  }
-  const map = node.asMap();
-  if (map === undefined) {
-    return undefined; // the named field is not a request index
-  }
-  for (const key of map.keys()) {
-    // fromValue consumes its input, so hand each descriptor a copy.
-    if (requestIdHex(requestIdType.fromValue([...key.value])) !== requestId) {
-      continue;
-    }
-    const cell = map.get(key)?.asCell();
-    if (cell === undefined) {
-      return undefined;
-    }
-    try {
-      return decodeSignBidirectionalRequest(cell.value);
-    } catch {
-      return undefined; // a cell that is not a decodable request record
-    }
-  }
-  return undefined; // id absent from the index
-}

package/src/signature-response-verification.ts

@@ -1,64 +0,0 @@
-// Client-side verification of MPC signature responses. Posting to the
-// signet contract's signature response log is UNAUTHENTICATED (see "Signet
-// Layout" in Signet.compact), so a poller must verify every posted response
-// before trusting it: rebuild the unsigned EVM transaction from the on-ledger
-// request record — assembled exactly as the MPC assembles it (sig-net/mpc
-// response server, managed/erc20-vault/signet/calldata-builder.ts) — and
-// check that the posted `{ bigR, s, recoveryId }` signature recovers to the
-// requester's derived EVM address over that transaction's signing hash.
-
-import { getAddress, recoverAddress } from "ethers";
-
-import {
-  signBidirectionalRequestToUnsignedEVMTransaction,
-  signatureResponseToSignature,
-  type SignBidirectionalRequest,
-} from "./signet-requests.ts";
-import type { SignatureResponse } from "./signet-contract-state-reader.ts";
-
-/**
- * Recover the EVM address that produced a response signature, over the
- * signing hash of the transaction the request describes.
- *
- * @param request - The on-ledger request record the response answers.
- * @param response - The posted signature record answering it.
- * @returns The checksummed recovered signer address.
- * @throws Error if the response is not a decodable signature or the request
- *   record is malformed (see
- *   {@link signBidirectionalRequestToUnsignedEVMTransaction}).
- */
-export function recoverSignatureResponseSigner(
-  request: SignBidirectionalRequest,
-  response: SignatureResponse,
-): string {
-  return recoverAddress(
-    signBidirectionalRequestToUnsignedEVMTransaction(request).unsignedHash,
-    signatureResponseToSignature(response),
-  );
-}
-
-/**
- * Verify a posted response against its request: does the signature recover
- * to `expectedSigner`? Never throws — a response that is malformed or signed
- * by anyone else is simply not valid, which is the expected state of affairs
- * on an unauthenticated log.
- *
- * @param request - The on-ledger request record the response answers.
- * @param response - The posted signature record answering it.
- * @param expectedSigner - The EVM address (any case, 0x hex) that must have signed.
- * @returns `true` iff the response is a valid signature by `expectedSigner`.
- */
-export function verifySignatureResponse(
-  request: SignBidirectionalRequest,
-  response: SignatureResponse,
-  expectedSigner: string,
-): boolean {
-  try {
-    return (
-      recoverSignatureResponseSigner(request, response) ===
-      getAddress(expectedSigner)
-    );
-  } catch {
-    return false;
-  }
-}

package/src/signature-state-reading.ts

@@ -1,87 +0,0 @@
-// Common signet raw-state reading, shared by the request and response readers
-// (signature-requests-state-reader.ts, signet-contract-state-reader.ts).
-// This is the MPC-/client-style path: decode a contract's ledger fields out of
-// its raw state WITHOUT the compiled contract, walking the state tree by field
-// position alone. Here live the generic tree walk (RawContractState,
-// signetFieldNode) and the base type descriptors both readers share; each
-// reader adds only the descriptors for its own layout.
-
-import {
-  CompactTypeBytes,
-  CompactTypeUnsignedInteger,
-  type CompactType,
-  type StateValue,
-} from "@midnight-ntwrk/compact-runtime";
-
-import { type RequestId } from "./signet-requests.ts";
-
-// ---- Shared base type descriptors ----
-// fromValue consumes the aligned value sequentially, so any width change here
-// is silent data corruption, not an error. These mirror the Compact base types
-// used across both signet layouts.
-
-/** Descriptor for a Compact `Uint<64>` (8-byte unsigned integer). */
-export const u64 = new CompactTypeUnsignedInteger(18446744073709551615n, 8);
-
-/** Descriptor for a Compact `Bytes<32>`. */
-export const bytes32 = new CompactTypeBytes(32);
-
-/**
- * Descriptor for a request id ledger key (Compact `RequestId`, a
- * nominal `Bytes<32>`). Use it to encode a {@link RequestId} into the
- * aligned form the state tree stores, or decode one back.
- */
-export const requestIdType: CompactType<RequestId> = bytes32;
-
-// ---- Raw state walk ----
-
-/**
- * What the indexer / simulator hands us: a bare `StateValue`, or anything
- * wrapping one under `.state` (e.g. `ChargedState`,
- * `queryContractState(address).data`).
- */
-export type RawContractState = StateValue | { state: StateValue };
-
-/**
- * Unwrap a {@link RawContractState} to the underlying `StateValue`.
- *
- * @param raw - Bare state value or a `.state`-carrying wrapper.
- * @returns The bare `StateValue`.
- */
-const unwrap = (raw: RawContractState): StateValue =>
-  "state" in raw ? raw.state : raw;
-
-/**
- * Resolve a flat ledger field index to its node in the raw state tree.
- *
- * The runtime stores ledger fields as a root array and chunks them one level
- * deep once the field count grows, so chunked roots are flattened before
- * indexing. Chunk detection assumes signet field 0 is a `Map`, never a
- * `List` (whose node is also array-typed) — guaranteed by the signet layout
- * convention.
- *
- * @param raw - Raw contract state from the indexer or simulator.
- * @param flatIndex - Zero-based ledger field position in declaration order.
- * @returns The `StateValue` node holding that field.
- * @throws Error if `flatIndex` is beyond the contract's field count.
- */
-export function signetFieldNode(
-  raw: RawContractState,
-  flatIndex: number,
-): StateValue {
-  const root = unwrap(raw);
-  if (root.type() !== "array") {
-    if (flatIndex === 0) return root;
-    throw new Error(`Field index ${flatIndex} out of range: root is a leaf`);
-  }
-  const nodes = root.asArray() ?? [];
-  const fields =
-    nodes[0]?.type() === "array"
-      ? nodes.flatMap((chunk) => chunk.asArray() ?? [])
-      : nodes;
-  const node = fields[flatIndex];
-  if (node === undefined) {
-    throw new Error(`Field index ${flatIndex} out of range`);
-  }
-  return node;
-}