@sig-net/midnight 0.0.5 → 0.0.6

package/README.md

@@ -8,10 +8,10 @@ The client-agnostic [Sig Network](https://sig.network) protocol library for the
   ```compact
   import "@sig-net/midnight/src/Signet";
   ```
-- **Compiled pure circuits** (`pureCircuits`): the executable reference implementation of the client-agnostic circuits (path/identity checks, the attestation message, the sign-bidirectional notification packer, the Schnorr challenge). Off-chain code calls these compiled artefacts instead of re-porting the algorithms, so it always agrees with what the contracts prove.
+- **Compiled pure circuits** (`pureCircuits`): the executable reference implementation of the client-agnostic circuits (path/identity checks, the attestation-message digest, the sign-bidirectional notification packer). Off-chain code calls these compiled artefacts instead of re-porting the algorithms, so it always agrees with what the contracts prove.
 - **TypeScript twins of the wire structs** and signet request-id computation.
 - **State readers, request feed and resolver**: poll the signet contract for pending requests and their signature / remote-execution responses.
-- **Crypto helpers**: epsilon derivation and Jubjub Schnorr response verification.
+- **Crypto helpers**: epsilon derivation and secp256k1 ECDSA attestation signing/verification.
 
 Where signet.js already covers something (for example EVM transaction preparation or address derivation), import it from there; only what is Midnight-specific lives here.
 
@@ -28,7 +28,7 @@ A signet-compliant client contract does four things:
 1. **Stores requests in a public index**: a `SignBidirectionalRequestIndex` map in its ledger. The index can sit at ANY ledger field: each notification the contract registers names the field position holding it, and the MPC reads the authenticated request from there. A contract-local `SignetNonce` counter is a convenient source of request nonces (identical requests must hash to distinct ids); nothing off-chain reads it.
 2. **Pins its counterparties at deploy time**: the central signet contract it notifies, and the MPC attestation key its verify circuit accepts.
 3. **Submits signature requests**: builds the transaction decomposition in-circuit, constructs the canonical request record, stores it in its own index under the request id, and registers a notification in the central registry (which the MPC polls; the MPC then reads the authenticated request back from the ledger field the notification names).
-4. **Verifies the execution response**: checks the attestation key, verifies the MPC's Schnorr attestation in-circuit over (request id, output), and consumes the request.
+4. **Verifies the execution response**: checks the attestation key, verifies the MPC's secp256k1 ECDSA attestation in-circuit over the digest of (request id, output), and consumes the request.
 
 ```compact
 pragma language_version >= 0.25;
@@ -49,8 +49,8 @@ export ledger signetNonce: SignetNonce;
 export sealed ledger mpcPubKeyHash: Bytes<32>;
 sealed ledger signetNotifier: SignetNotifier;
 
-constructor(mpcPk: JubjubPoint, signetContract: SignetNotifier) {
-  mpcPubKeyHash = disclose(persistentHash<JubjubPoint>(mpcPk));
+constructor(mpcPk: Secp256k1Point, signetContract: SignetNotifier) {
+  mpcPubKeyHash = disclose(persistentHash<Secp256k1Point>(mpcPk));
   signetNotifier = disclose(signetContract);
 }
 
@@ -103,22 +103,27 @@ export circuit submitSignatureRequest(evmNonce: Uint<64>, keyVersion: Uint<32>):
     constructSignBidirectionalNotificationV1(kernel.self(), requestId as Bytes<32>, 0 as Uint<8>));
 }
 
-// (4) Verify the MPC's Schnorr-signed attestation of the remote execution
-// and consume the request (double-verify protection).
-export circuit verifyResponse(requestId: RequestId, respondBidirectional: RespondBidirectional): [] {
+// (4) Verify the MPC's secp256k1 ECDSA-signed attestation of the remote
+// execution and consume the request (double-verify protection). The signing
+// public key is passed alongside the record and pinned by hash.
+export circuit verifyResponse(
+  requestId: RequestId,
+  respondBidirectional: RespondBidirectional,
+  pk: Secp256k1Point
+): [] {
   const rid = disclose(requestId);
   assert(
-    persistentHash<JubjubPoint>(respondBidirectional.pk) == mpcPubKeyHash,
+    persistentHash<Secp256k1Point>(pk) == mpcPubKeyHash,
     "Unauthorized: attestation pk is not the MPC key"
   );
   assert(
-    jubjubSchnorrVerify<4>(
+    secp256k1EcdsaVerify(
       signetAttestationMessage(rid, respondBidirectional.serializedOutput, respondBidirectional.outputLen),
-      JubjubSchnorrSignature {
-        announcement: respondBidirectional.announcement,
-        response: respondBidirectional.response,
+      Secp256k1EcdsaSignature {
+        r: respondBidirectional.sigR as Secp256k1Scalar,
+        s: respondBidirectional.sigS as Secp256k1Scalar,
       },
-      respondBidirectional.pk
+      pk
     ),
     "Invalid attestation signature"
   );
@@ -127,7 +132,7 @@ export circuit verifyResponse(requestId: RequestId, respondBidirectional: Respon
 }
 ```
 
-Between the two circuits sit the off-chain steps, which this package also covers: poll the central signet contract with `SignetRequestResponseReader` (configured with both contract addresses and the ledger field position of your request index) to collect and verify the MPC's secp256k1 signature (then broadcast the signed transaction to the destination chain), and later the Schnorr-attested execution output to feed back into `verifyResponse`.
+Between the two circuits sit the off-chain steps, which this package also covers: poll the central signet contract with `SignetRequestResponseReader` (configured with both contract addresses and the ledger field position of your request index) to collect and verify the MPC's secp256k1 signature (then broadcast the signed transaction to the destination chain), and later the ECDSA-attested execution output to feed back into `verifyResponse`.
 
 The [signet-caller contract](https://github.com/sig-net/midnight-integration/blob/main/packages/caller-contract/src/signet-caller.compact) is the complete, runnable version of this skeleton, exercised end to end by the repository's integration suite; a fuller application (an ERC20 cross-chain vault) lives in [sig-net/midnight-examples](https://github.com/sig-net/midnight-examples).
 

package/dist/ecdsa.d.ts

@@ -0,0 +1,114 @@
+import { type Secp256k1Point } from "@midnight-ntwrk/compact-runtime";
+export type { Secp256k1Point } from "@midnight-ntwrk/compact-runtime";
+/** secp256k1 curve (group) order n — the scalar field the signature r, s live in. */
+export declare const SECP256K1_ORDER: bigint;
+/**
+ * BLS12-381 scalar field order (the Compact `Field` type modulus). Retained
+ * because {@link bigintToBytes32} interprets negative `Field` values in it and
+ * signet-requests.ts imports the byte helpers below.
+ */
+export declare const BLS_ORDER = 52435875175126190479447740508185965837690552500527637822603658699938581184513n;
+/**
+ * Convert little-endian bytes to a bigint. Matches Compact's
+ * `Bytes<32> as Field` / `Bytes<32> as Secp256k1Scalar` interpretation (and
+ * the MPC monitor's ABI-word decoding convention).
+ *
+ * @param bytes - Little-endian byte array.
+ * @returns The decoded non-negative integer.
+ */
+export declare function bytesToBigint(bytes: Uint8Array): bigint;
+/**
+ * Convert a bigint to exactly 32 little-endian bytes. Matches Compact's
+ * `Field as Bytes<32>` / `Secp256k1Scalar as Bytes<32>` encoding (the inverse
+ * of {@link bytesToBigint}); negative inputs are interpreted in the BLS scalar
+ * field.
+ *
+ * @param n - The integer to encode.
+ * @returns The 32-byte little-endian encoding.
+ */
+export declare function bigintToBytes32(n: bigint): Uint8Array;
+/**
+ * An ECDSA signature over the attestation digest (TS twin of
+ * CompactStandardLibrary's `Secp256k1EcdsaSignature`). Both scalars are plain
+ * bigints mod {@link SECP256K1_ORDER}; convert to the ledger form with
+ * {@link ecdsaSignatureToLeBytes}.
+ */
+export interface EcdsaSignature {
+    /** Signature scalar r. */
+    r: bigint;
+    /** Signature scalar s (low-s normalized by {@link signAttestation}). */
+    s: bigint;
+}
+/**
+ * The little-endian 32-byte scalar encoding of an {@link EcdsaSignature} — the
+ * exact `sigR`/`sigS` bytes the Compact `RespondBidirectional` struct stores
+ * (the byte order the `Secp256k1Scalar as Bytes<32>` cast produces).
+ */
+export interface EcdsaSignatureBytes {
+    /** Signature scalar r as 32 little-endian bytes. */
+    sigR: Uint8Array;
+    /** Signature scalar s as 32 little-endian bytes. */
+    sigS: Uint8Array;
+}
+/**
+ * Sign a 32-byte attestation digest with secp256k1 ECDSA, matching
+ * CompactStandardLibrary's `secp256k1EcdsaVerify`: the digest IS the message
+ * hash (interpreted big-endian, RFC 6979), so signing is `prehash: false` —
+ * noble must not re-hash it. The digest is the compiled
+ * `pureCircuits.signetAttestationMessage(requestId, serializedOutput,
+ * outputLen)`. noble normalizes to low-s by default; the verifier accepts
+ * either s, so this is a convention, not a requirement.
+ *
+ * @param digest - The 32-byte attestation digest to sign.
+ * @param secretKey - The 32-byte secp256k1 private key (the MPC root key).
+ * @returns The signature `{ r, s }`.
+ */
+export declare function signAttestation(digest: Uint8Array, secretKey: Uint8Array): EcdsaSignature;
+/**
+ * Encode an {@link EcdsaSignature}'s scalars as the little-endian 32-byte
+ * `sigR`/`sigS` the Compact `RespondBidirectional` struct stores — the form
+ * the verifying circuits cast back with `as Secp256k1Scalar`.
+ *
+ * @param signature - The signature to encode.
+ * @returns The `{ sigR, sigS }` little-endian scalar bytes.
+ */
+export declare function ecdsaSignatureToLeBytes(signature: EcdsaSignature): EcdsaSignatureBytes;
+/**
+ * Derive the secp256k1 public key point from a private key — the MPC
+ * attestation key, which is the MPC root key used directly as the secp256k1
+ * private key (the same key the EVM signing accounts epsilon-derive from).
+ *
+ * @param secretKey - The 32-byte secp256k1 private key (the MPC root key).
+ * @returns The public key as a {@link Secp256k1Point}.
+ */
+export declare function secp256k1PublicKeyFromSecretKey(secretKey: Uint8Array): Secp256k1Point;
+/**
+ * Parse a secp256k1 public key from its 0x-hex config/env form (compressed
+ * 33-byte or uncompressed 65-byte) into the runtime's point shape — how
+ * deploys receive `MPC_SECP256K1_PUBKEY`.
+ *
+ * @param value - The 0x-hex public key (0x prefix optional).
+ * @returns The parsed point.
+ * @throws Error if the value is not a valid secp256k1 point encoding.
+ */
+export declare function parseSecp256k1PublicKey(value: string): Secp256k1Point;
+/**
+ * Format a secp256k1 public key as the compressed 0x-hex config/env form that
+ * {@link parseSecp256k1PublicKey} accepts — the round-trip inverse, for
+ * handing a derived key to deploys as `MPC_SECP256K1_PUBKEY`.
+ *
+ * @param point - The point to format.
+ * @returns The compressed public key as 0x-prefixed hex.
+ * @throws Error if the point is the identity (has no compressed encoding).
+ */
+export declare function formatSecp256k1PublicKey(point: Secp256k1Point): string;
+/**
+ * Hash a secp256k1 point exactly as the circuits do
+ * (`persistentHash<Secp256k1Point>`) — the form the signet contract and caller
+ * seal as `mpcPubKeyHash`.
+ *
+ * @param point - The point to hash.
+ * @returns The 32-byte hash.
+ */
+export declare function hashSecp256k1Point(point: Secp256k1Point): Uint8Array;
+//# sourceMappingURL=ecdsa.d.ts.map

package/dist/ecdsa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecdsa.d.ts","sourceRoot":"","sources":["../src/ecdsa.ts"],"names":[],"mappings":"AAgBA,OAAO,EAGL,KAAK,cAAc,EACpB,MAAM,iCAAiC,CAAC;AAKzC,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,qFAAqF;AACrF,eAAO,MAAM,eAAe,QAA2B,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,SAAS,iFAAiF,CAAC;AAExG;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,0BAA0B;IAC1B,CAAC,EAAE,MAAM,CAAC;IACV,wEAAwE;IACxE,CAAC,EAAE,MAAM,CAAC;CACX;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,oDAAoD;IACpD,IAAI,EAAE,UAAU,CAAC;IACjB,oDAAoD;IACpD,IAAI,EAAE,UAAU,CAAC;CAClB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,UAAU,GACpB,cAAc,CAMhB;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,cAAc,GACxB,mBAAmB,CAKrB;AAED;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,SAAS,EAAE,UAAU,GACpB,cAAc,CAGhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAUrE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAKtE;AAED;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,cAAc,GAAG,UAAU,CAEpE"}

package/dist/ecdsa.js

@@ -0,0 +1,145 @@
+// secp256k1 ECDSA helpers — the TS side of the shared attestation flow:
+// SIGNING (which needs the secret scalar, so it cannot be a circuit), key
+// parsing/formatting/hashing, and the little-endian scalar-byte plumbing the
+// ledger struct stores. Everything provable stays in Compact: the attestation
+// message is the COMPILED `pureCircuits.signetAttestationMessage` (this file
+// never re-implements it) and verification is CompactStandardLibrary's
+// `secp256k1EcdsaVerify`, run by the signet contract at post time and by the
+// caller at settle time.
+//
+// This belongs in github.com/sig-net/signet.js as its Midnight adapter —
+// kept here until upstreamed. It is Midnight-specific only in the point-hash
+// form (`persistentHash<Secp256k1Point>` via @midnight-ntwrk/compact-runtime),
+// which is exactly the deploy-time key pin the contracts seal.
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { CompactTypeSecp256k1Point, persistentHash, } from "@midnight-ntwrk/compact-runtime";
+/** secp256k1 curve (group) order n — the scalar field the signature r, s live in. */
+export const SECP256K1_ORDER = secp256k1.Point.Fn.ORDER;
+/**
+ * BLS12-381 scalar field order (the Compact `Field` type modulus). Retained
+ * because {@link bigintToBytes32} interprets negative `Field` values in it and
+ * signet-requests.ts imports the byte helpers below.
+ */
+export const BLS_ORDER = 52435875175126190479447740508185965837690552500527637822603658699938581184513n;
+/**
+ * Convert little-endian bytes to a bigint. Matches Compact's
+ * `Bytes<32> as Field` / `Bytes<32> as Secp256k1Scalar` interpretation (and
+ * the MPC monitor's ABI-word decoding convention).
+ *
+ * @param bytes - Little-endian byte array.
+ * @returns The decoded non-negative integer.
+ */
+export function bytesToBigint(bytes) {
+    let result = 0n;
+    for (let i = bytes.length - 1; i >= 0; i--) {
+        result = (result << 8n) | BigInt(bytes[i]);
+    }
+    return result;
+}
+/**
+ * Convert a bigint to exactly 32 little-endian bytes. Matches Compact's
+ * `Field as Bytes<32>` / `Secp256k1Scalar as Bytes<32>` encoding (the inverse
+ * of {@link bytesToBigint}); negative inputs are interpreted in the BLS scalar
+ * field.
+ *
+ * @param n - The integer to encode.
+ * @returns The 32-byte little-endian encoding.
+ */
+export function bigintToBytes32(n) {
+    const buf = new Uint8Array(32);
+    let v = n < 0n ? n + BLS_ORDER : n;
+    for (let i = 0; i < 32; i++) {
+        buf[i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    return buf;
+}
+/**
+ * Sign a 32-byte attestation digest with secp256k1 ECDSA, matching
+ * CompactStandardLibrary's `secp256k1EcdsaVerify`: the digest IS the message
+ * hash (interpreted big-endian, RFC 6979), so signing is `prehash: false` —
+ * noble must not re-hash it. The digest is the compiled
+ * `pureCircuits.signetAttestationMessage(requestId, serializedOutput,
+ * outputLen)`. noble normalizes to low-s by default; the verifier accepts
+ * either s, so this is a convention, not a requirement.
+ *
+ * @param digest - The 32-byte attestation digest to sign.
+ * @param secretKey - The 32-byte secp256k1 private key (the MPC root key).
+ * @returns The signature `{ r, s }`.
+ */
+export function signAttestation(digest, secretKey) {
+    const signature = secp256k1.Signature.fromBytes(secp256k1.sign(digest, secretKey, { prehash: false }), "compact");
+    return { r: signature.r, s: signature.s };
+}
+/**
+ * Encode an {@link EcdsaSignature}'s scalars as the little-endian 32-byte
+ * `sigR`/`sigS` the Compact `RespondBidirectional` struct stores — the form
+ * the verifying circuits cast back with `as Secp256k1Scalar`.
+ *
+ * @param signature - The signature to encode.
+ * @returns The `{ sigR, sigS }` little-endian scalar bytes.
+ */
+export function ecdsaSignatureToLeBytes(signature) {
+    return {
+        sigR: bigintToBytes32(signature.r),
+        sigS: bigintToBytes32(signature.s),
+    };
+}
+/**
+ * Derive the secp256k1 public key point from a private key — the MPC
+ * attestation key, which is the MPC root key used directly as the secp256k1
+ * private key (the same key the EVM signing accounts epsilon-derive from).
+ *
+ * @param secretKey - The 32-byte secp256k1 private key (the MPC root key).
+ * @returns The public key as a {@link Secp256k1Point}.
+ */
+export function secp256k1PublicKeyFromSecretKey(secretKey) {
+    const point = secp256k1.Point.fromBytes(secp256k1.getPublicKey(secretKey, false));
+    return { x: point.x, y: point.y, identity: false };
+}
+/**
+ * Parse a secp256k1 public key from its 0x-hex config/env form (compressed
+ * 33-byte or uncompressed 65-byte) into the runtime's point shape — how
+ * deploys receive `MPC_SECP256K1_PUBKEY`.
+ *
+ * @param value - The 0x-hex public key (0x prefix optional).
+ * @returns The parsed point.
+ * @throws Error if the value is not a valid secp256k1 point encoding.
+ */
+export function parseSecp256k1PublicKey(value) {
+    const hex = value.startsWith("0x") ? value.slice(2) : value;
+    try {
+        const point = secp256k1.Point.fromHex(hex);
+        return { x: point.x, y: point.y, identity: false };
+    }
+    catch {
+        throw new Error(`expected a secp256k1 public key as compressed/uncompressed 0x-hex; got "${value}"`);
+    }
+}
+/**
+ * Format a secp256k1 public key as the compressed 0x-hex config/env form that
+ * {@link parseSecp256k1PublicKey} accepts — the round-trip inverse, for
+ * handing a derived key to deploys as `MPC_SECP256K1_PUBKEY`.
+ *
+ * @param point - The point to format.
+ * @returns The compressed public key as 0x-prefixed hex.
+ * @throws Error if the point is the identity (has no compressed encoding).
+ */
+export function formatSecp256k1PublicKey(point) {
+    if (point.identity) {
+        throw new Error("cannot format the identity point as a public key");
+    }
+    return `0x${secp256k1.Point.fromAffine({ x: point.x, y: point.y }).toHex(true)}`;
+}
+/**
+ * Hash a secp256k1 point exactly as the circuits do
+ * (`persistentHash<Secp256k1Point>`) — the form the signet contract and caller
+ * seal as `mpcPubKeyHash`.
+ *
+ * @param point - The point to hash.
+ * @returns The 32-byte hash.
+ */
+export function hashSecp256k1Point(point) {
+    return persistentHash(CompactTypeSecp256k1Point, point);
+}
+//# sourceMappingURL=ecdsa.js.map

package/dist/ecdsa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecdsa.js","sourceRoot":"","sources":["../src/ecdsa.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,0EAA0E;AAC1E,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,yBAAyB;AACzB,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,+EAA+E;AAC/E,+DAA+D;AAE/D,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAEvD,OAAO,EACL,yBAAyB,EACzB,cAAc,GAEf,MAAM,iCAAiC,CAAC;AAOzC,qFAAqF;AACrF,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,8EAA8E,CAAC;AAExG;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AA2BD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAkB,EAClB,SAAqB;IAErB,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CAC7C,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EACrD,SAAS,CACV,CAAC;IACF,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAyB;IAEzB,OAAO;QACL,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAClC,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;KACnC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAC7C,SAAqB;IAErB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAClF,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3C,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,2EAA2E,KAAK,GAAG,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAqB;IAC5D,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,KAAK,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;AACnF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAqB;IACtD,OAAO,cAAc,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/dist/index.d.ts

@@ -8,12 +8,12 @@ export * from "./signet-request-resolver.ts";
 export * from "./signet-request-feed.ts";
 export * from "./constants.ts";
 export * from "./epsilon-derivation.ts";
-export * from "./schnorr.ts";
+export * from "./ecdsa.ts";
 /**
  * Compiled pure circuits of Signet.compact (run `yarn compile` first): the
  * executable reference implementation of the client-agnostic circuits —
- * path<->identity checks, the attestation message, the notification packer
- * (`constructSignBidirectionalNotificationV1`), and the Schnorr challenge.
+ * path<->identity checks, the attestation message digest, and the
+ * notification packer (`constructSignBidirectionalNotificationV1`).
  * Off-chain code MUST use these instead of re-porting the algorithms — they
  * are the same compiled logic the contracts prove. The generic request
  * circuits cannot be compiled here (type-parameterized): request construction

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,cAAc,CAAC;AAE7B;;;;;;;;;;GAUG;AACH,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAE3B;;;;;;;;;;GAUG;AACH,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -11,12 +11,12 @@ export * from "./signet-request-resolver.js";
 export * from "./signet-request-feed.js";
 export * from "./constants.js";
 export * from "./epsilon-derivation.js";
-export * from "./schnorr.js";
+export * from "./ecdsa.js";
 /**
  * Compiled pure circuits of Signet.compact (run `yarn compile` first): the
  * executable reference implementation of the client-agnostic circuits —
- * path<->identity checks, the attestation message, the notification packer
- * (`constructSignBidirectionalNotificationV1`), and the Schnorr challenge.
+ * path<->identity checks, the attestation message digest, and the
+ * notification packer (`constructSignBidirectionalNotificationV1`).
  * Off-chain code MUST use these instead of re-porting the algorithms — they
  * are the same compiled logic the contracts prove. The generic request
  * circuits cannot be compiled here (type-parameterized): request construction

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,4EAA4E;AAC5E,2DAA2D;AAE3D,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,cAAc,CAAC;AAE7B;;;;;;;;;;GAUG;AACH,OAAO,EAAE,YAAY,EAAqB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,4EAA4E;AAC5E,2DAA2D;AAE3D,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAE3B;;;;;;;;;;GAUG;AACH,OAAO,EAAE,YAAY,EAAqB,MAAM,6BAA6B,CAAC"}

package/dist/managed/compiler/contract-info.json

@@ -109,11 +109,8 @@
         }
       ],
       "result-type": {
-        "type-name": "Vector",
-        "length": 4,
-        "type": {
-          "type-name": "Field"
-        }
+        "type-name": "Bytes",
+        "length": 32
       }
     },
     {
@@ -167,50 +164,6 @@
         "types": [
         ]
       }
-    },
-    {
-      "name": "schnorrChallenge",
-      "pure": true,
-      "proof": false,
-      "arguments": [
-        {
-          "name": "ann_x",
-          "type": {
-            "type-name": "Field"
-          }
-        },
-        {
-          "name": "ann_y",
-          "type": {
-            "type-name": "Field"
-          }
-        },
-        {
-          "name": "pk_x",
-          "type": {
-            "type-name": "Field"
-          }
-        },
-        {
-          "name": "pk_y",
-          "type": {
-            "type-name": "Field"
-          }
-        },
-        {
-          "name": "msg",
-          "type": {
-            "type-name": "Vector",
-            "length": 4,
-            "type": {
-              "type-name": "Field"
-            }
-          }
-        }
-      ],
-      "result-type": {
-        "type-name": "Field"
-      }
     }
   ],
   "witnesses": [

package/dist/managed/compiler/contract-manifest.json

@@ -7,26 +7,26 @@
     "type": "directory",
     "contract-info.json": {
       "type": "file",
-      "size": 4406,
-      "hash": "1318a883cafbc6340a7aa9623524eb941d37b5b4080ea79dff8948a63e092e47"
+      "size": 3509,
+      "hash": "1f0bcfc80cd800e4cbbe6cc61d59c4355978b67f75303486c10bfb98f77254a4"
     }
   },
   "contract": {
     "type": "directory",
     "index.d.ts": {
       "type": "file",
-      "size": 3842,
-      "hash": "4edb5966c4b41a810691af9a12abcd359a517d95dcf6bb91faedef4da2d23019"
+      "size": 3361,
+      "hash": "5537a3d8d3d415797bb278f1a0c579026bb24a22c4ad8183ad9d58575e567c17"
     },
     "index.js": {
       "type": "file",
-      "size": 42552,
-      "hash": "729bf0bd029c64471406cef2c9da38eaa62c4a88808c9a5d80f566f457c06a6c"
+      "size": 37016,
+      "hash": "6bbd1abf0a9071b2dbf0b739e2fcb9db361477036cc3b605791c81e44a4450c7"
     },
     "index.js.map": {
       "type": "file",
-      "size": 3115,
-      "hash": "2bc6ceb4c0492981f7bf539948c96408f98134c967e04e7c83d9289437481d43"
+      "size": 2658,
+      "hash": "516e4a7123f87bd04a313a069d5077b43acf5be0c8440cfb89685a8f07d70ed4"
     }
   }
 }

package/dist/managed/contract/index.d.ts

@@ -19,14 +19,9 @@ export type PureCircuits = {
   evmAddressAbiValue(addr_0: Uint8Array): bigint;
   signetAttestationMessage(requestId_0: Uint8Array,
                            serializedOutput_0: Uint8Array,
-                           outputLen_0: bigint): bigint[];
+                           outputLen_0: bigint): Uint8Array;
   assertHexOf(commitment_0: Uint8Array, hexStr_0: Uint8Array): [];
   assertPathCommitment(commitment_0: Uint8Array, path_0: Uint8Array): [];
-  schnorrChallenge(ann_x_0: bigint,
-                   ann_y_0: bigint,
-                   pk_x_0: bigint,
-                   pk_y_0: bigint,
-                   msg_0: bigint[]): bigint;
 }
 
 export type Circuits<PS> = {
@@ -42,19 +37,13 @@ export type Circuits<PS> = {
   signetAttestationMessage(context: __compactRuntime.CircuitContext<PS>,
                            requestId_0: Uint8Array,
                            serializedOutput_0: Uint8Array,
-                           outputLen_0: bigint): Promise<__compactRuntime.CircuitResults<PS, bigint[]>>;
+                           outputLen_0: bigint): Promise<__compactRuntime.CircuitResults<PS, Uint8Array>>;
   assertHexOf(context: __compactRuntime.CircuitContext<PS>,
               commitment_0: Uint8Array,
               hexStr_0: Uint8Array): Promise<__compactRuntime.CircuitResults<PS, []>>;
   assertPathCommitment(context: __compactRuntime.CircuitContext<PS>,
                        commitment_0: Uint8Array,
                        path_0: Uint8Array): Promise<__compactRuntime.CircuitResults<PS, []>>;
-  schnorrChallenge(context: __compactRuntime.CircuitContext<PS>,
-                   ann_x_0: bigint,
-                   ann_y_0: bigint,
-                   pk_x_0: bigint,
-                   pk_y_0: bigint,
-                   msg_0: bigint[]): Promise<__compactRuntime.CircuitResults<PS, bigint>>;
 }
 
 export type Ledger = {