@sig-net/midnight 0.0.5 → 0.0.7

package/README.md

@@ -15,6 +15,14 @@ The client-agnostic [Sig Network](https://sig.network) protocol library for the
 
 Where signet.js already covers something (for example EVM transaction preparation or address derivation), import it from there; only what is Midnight-specific lives here.
 
+## Derived keys
+
+Every key the MPC signs with is scoped by the requesting contract:
+
+`derivedSigningKey = f(mpcRootKey[keyVersion], contractAddress, path)`
+
+The path is 32 opaque bytes of the contract's choosing (a fixed literal for a contract-owned account, a hash of a caller's secret for per-user accounts). There are no format requirements. The contract address is always part of the derivation, so no contract can reach another contract's derived keys.
+
 ## Install
 
 ```sh

package/dist/constants.d.ts

@@ -1,18 +1,10 @@
-/** Width of `SignBidirectionalRequest.caip2Id` (`Bytes<32>`). */
+/** Width of `SignBidirectionalEvent.caip2Id` (`Bytes<32>`). */
 export declare const CAIP2_ID_BYTES = 32;
-/** Width of `SignBidirectionalRequest.algo` (`Bytes<32>`). */
-export declare const ALGO_BYTES = 32;
-/** Width of `SignBidirectionalRequest.dest` (`Bytes<32>`). */
-export declare const DEST_BYTES = 32;
-/** Width of `SignBidirectionalRequest.params` (`Bytes<64>`). */
+/** Width of `SignBidirectionalEvent.params` (`Bytes<64>`). */
 export declare const MPC_PARAMS_BYTES = 64;
-/** Width of `SignBidirectionalRequest.outputDeserializationSchema` (`Bytes<128>`). */
-export declare const OUTPUT_DESERIALIZATION_SCHEMA_BYTES = 128;
-/** Width of `SignBidirectionalRequest.respondSerializationSchema` (`Bytes<128>`). */
-export declare const RESPOND_SERIALIZATION_SCHEMA_BYTES = 128;
 /** Width of `EVMCalldata.selector` (`Bytes<4>`) — the literal first 4 calldata bytes. */
 export declare const SELECTOR_BYTES = 4;
-/** Width of `RespondBidirectional.serializedOutput` (`Bytes<128>`). */
+/** Width of `RespondBidirectionalEvent.serializedOutput` (`Bytes<128>`). */
 export declare const SERIALIZED_OUTPUT_BYTES = 128;
 /**
  * The MPC's error sentinel: `serializedOutput` beginning with these four
@@ -38,14 +30,10 @@ export declare function executionSucceeded(serializedOutput: Uint8Array): boolea
  * @returns `true` when the MPC reported an execution error.
  */
 export declare function isExecutionError(serializedOutput: Uint8Array): boolean;
-/** Signature algorithm the MPC uses for EVM chains (`algo` field value). */
-export declare const SIGNET_ALGO_ECDSA = "ecdsa";
-/** Destination chain family for EVM requests (`dest` field value). */
-export declare const SIGNET_DEST_ETHEREUM = "ethereum";
 /**
  * Default MPC key version (`keyVersion` field value). Version 0 is the
  * unsupported legacy format — the canonical MPC (and
- * `constructSignBidirectionalRequest`) requires `keyVersion >= 1`.
+ * `constructSignBidirectionalEvent`) requires `keyVersion >= 1`.
  */
 export declare const SIGNET_DEFAULT_KEY_VERSION = 1n;
 /**

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAUA,iEAAiE;AACjE,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,8DAA8D;AAC9D,eAAO,MAAM,UAAU,KAAK,CAAC;AAE7B,8DAA8D;AAC9D,eAAO,MAAM,UAAU,KAAK,CAAC;AAE7B,gEAAgE;AAChE,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,sFAAsF;AACtF,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,qFAAqF;AACrF,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAEtD,yFAAyF;AACzF,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAA2C,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAExE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAEtE;AAED,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAQpE"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAUA,+DAA+D;AAC/D,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,yFAAyF;AACzF,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAA2C,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAExE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAEtE;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAQpE"}

package/dist/constants.js

@@ -7,21 +7,13 @@
 //
 // The routing constants belong in github.com/sig-net/signet.js — kept here
 // until upstreamed.
-/** Width of `SignBidirectionalRequest.caip2Id` (`Bytes<32>`). */
+/** Width of `SignBidirectionalEvent.caip2Id` (`Bytes<32>`). */
 export const CAIP2_ID_BYTES = 32;
-/** Width of `SignBidirectionalRequest.algo` (`Bytes<32>`). */
-export const ALGO_BYTES = 32;
-/** Width of `SignBidirectionalRequest.dest` (`Bytes<32>`). */
-export const DEST_BYTES = 32;
-/** Width of `SignBidirectionalRequest.params` (`Bytes<64>`). */
+/** Width of `SignBidirectionalEvent.params` (`Bytes<64>`). */
 export const MPC_PARAMS_BYTES = 64;
-/** Width of `SignBidirectionalRequest.outputDeserializationSchema` (`Bytes<128>`). */
-export const OUTPUT_DESERIALIZATION_SCHEMA_BYTES = 128;
-/** Width of `SignBidirectionalRequest.respondSerializationSchema` (`Bytes<128>`). */
-export const RESPOND_SERIALIZATION_SCHEMA_BYTES = 128;
 /** Width of `EVMCalldata.selector` (`Bytes<4>`) — the literal first 4 calldata bytes. */
 export const SELECTOR_BYTES = 4;
-/** Width of `RespondBidirectional.serializedOutput` (`Bytes<128>`). */
+/** Width of `RespondBidirectionalEvent.serializedOutput` (`Bytes<128>`). */
 export const SERIALIZED_OUTPUT_BYTES = 128;
 /**
  * The MPC's error sentinel: `serializedOutput` beginning with these four
@@ -51,14 +43,10 @@ export function executionSucceeded(serializedOutput) {
 export function isExecutionError(serializedOutput) {
     return MPC_ERROR_SENTINEL.every((byte, index) => serializedOutput[index] === byte);
 }
-/** Signature algorithm the MPC uses for EVM chains (`algo` field value). */
-export const SIGNET_ALGO_ECDSA = "ecdsa";
-/** Destination chain family for EVM requests (`dest` field value). */
-export const SIGNET_DEST_ETHEREUM = "ethereum";
 /**
  * Default MPC key version (`keyVersion` field value). Version 0 is the
  * unsupported legacy format — the canonical MPC (and
- * `constructSignBidirectionalRequest`) requires `keyVersion >= 1`.
+ * `constructSignBidirectionalEvent`) requires `keyVersion >= 1`.
  */
 export const SIGNET_DEFAULT_KEY_VERSION = 1n;
 /**

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,kEAAkE;AAClE,EAAE;AACF,2EAA2E;AAC3E,oBAAoB;AAEpB,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAE7B,8DAA8D;AAC9D,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAE7B,gEAAgE;AAChE,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,sFAAsF;AACtF,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAEvD,qFAAqF;AACrF,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAEtD,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,gBAA4B;IAC7D,OAAO,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,gBAA4B;IAC3D,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,QAAQ,OAAO,CAAC,MAAM,6BAA6B,MAAM,aAAa,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,kEAAkE;AAClE,EAAE;AACF,2EAA2E;AAC3E,oBAAoB;AAEpB,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,gBAA4B;IAC7D,OAAO,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,gBAA4B;IAC3D,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,QAAQ,OAAO,CAAC,MAAM,6BAA6B,MAAM,aAAa,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/ecdsa-attestation.d.ts

@@ -0,0 +1,79 @@
+import type { Secp256k1Point } from "@midnight-ntwrk/compact-runtime";
+export type { Secp256k1Point } from "@midnight-ntwrk/compact-runtime";
+/** secp256k1 curve (group) order n. */
+export declare const SECP256K1_ORDER: bigint;
+/** BLS12-381 scalar field order (the Compact `Field` type modulus). */
+export declare const BLS_ORDER = 52435875175126190479447740508185965837690552500527637822603658699938581184513n;
+/**
+ * Convert little-endian bytes to a bigint. Matches Compact's
+ * `Bytes<32> as Field` / `Bytes<32> as Secp256k1Scalar` interpretation (both
+ * casts are little-endian).
+ *
+ * @param bytes - Little-endian byte array.
+ * @returns The decoded non-negative integer.
+ */
+export declare function bytesToBigint(bytes: Uint8Array): bigint;
+/**
+ * Convert a bigint to exactly 32 little-endian bytes. Matches Compact's
+ * `Field as Bytes<32>` / `Secp256k1Scalar as Bytes<32>` encoding (the inverse
+ * of {@link bytesToBigint}); negative inputs are interpreted in the BLS
+ * scalar field.
+ *
+ * @param n - The integer to encode.
+ * @returns The 32-byte little-endian encoding.
+ */
+export declare function bigintToBytes32(n: bigint): Uint8Array;
+/**
+ * An ECDSA signature over the attestation digest, in the MPC's canonical
+ * `Signature { big_r, s, recovery_id }` spirit with `r` already reduced to
+ * the scalar `big_r.x mod n` — the form Compact's `Secp256k1EcdsaSignature`
+ * takes.
+ */
+export interface EcdsaSignature {
+    /** Signature scalar r (= R.x mod n). */
+    r: bigint;
+    /** Signature scalar s (low-s normalised by the signer). */
+    s: bigint;
+    /** Recovery id (parity of R.y): 0 or 1. */
+    recoveryId: number;
+}
+/**
+ * ECDSA-sign a 32-byte digest with a secp256k1 secret key, exactly as the
+ * MPC signs the attestation digest: RFC 6979 deterministic, low-s, the digest
+ * interpreted big-endian with NO extra hashing (`prehash: false`) — the same
+ * convention `secp256k1EcdsaVerify` checks in-circuit.
+ *
+ * @param digest - The 32-byte digest to sign (e.g. the compiled
+ *   `pureCircuits.signetAttestationDigest` output).
+ * @param secretKey - The 32-byte secp256k1 secret key.
+ * @returns The signature with its recovery id.
+ */
+export declare function signAttestationDigest(digest: Uint8Array, secretKey: Uint8Array): EcdsaSignature;
+/**
+ * Parse a secp256k1 public key from SEC1 hex (compressed or uncompressed,
+ * optional `0x` prefix) into the Compact runtime's `Secp256k1Point` shape —
+ * how deploys receive the MPC response key to pin.
+ *
+ * @param value - The SEC1 hex public key.
+ * @returns The parsed point.
+ * @throws Error if the value is not a valid secp256k1 public key.
+ */
+export declare function parseSecp256k1PublicKey(value: string): Secp256k1Point;
+/**
+ * Format a secp256k1 public key point as uncompressed SEC1 hex (with `0x`
+ * prefix) — the round-trip inverse of {@link parseSecp256k1PublicKey}, for
+ * handing a response key to deploys via env/config.
+ *
+ * @param point - The point to format.
+ * @returns The `0x04…` uncompressed SEC1 hex string.
+ */
+export declare function formatSecp256k1PublicKey(point: Secp256k1Point): string;
+/**
+ * Derive the `Secp256k1Point` of a secret key — convenience for tests and
+ * signers that hold key material as raw bytes.
+ *
+ * @param secretKey - The 32-byte secp256k1 secret key.
+ * @returns The public key point.
+ */
+export declare function secp256k1PublicKeyOf(secretKey: Uint8Array): Secp256k1Point;
+//# sourceMappingURL=ecdsa-attestation.d.ts.map

package/dist/ecdsa-attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecdsa-attestation.d.ts","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAItE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,uCAAuC;AACvC,eAAO,MAAM,eAAe,QAA2B,CAAC;AAExD,uEAAuE;AACvE,eAAO,MAAM,SAAS,iFAAiF,CAAC;AAExG;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAWD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,2DAA2D;IAC3D,CAAC,EAAE,MAAM,CAAC;IACV,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,UAAU,GACpB,cAAc,CAiBhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAcrE;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,cAAc,CAO1E"}

package/dist/ecdsa-attestation.js

@@ -0,0 +1,140 @@
+// secp256k1 ECDSA helpers: the TS side of the respond-bidirectional
+// attestation flow in Signet.compact — SIGNING (which needs the secret
+// scalar, so it cannot be a circuit), key parsing/formatting, and the
+// byte-order conversions between noble's bigints and the ledger-stored
+// little-endian scalar bytes. Everything provable stays in Compact: the
+// attestation digest is the COMPILED `pureCircuits.signetAttestationDigest`,
+// verification is `pureCircuits.verifyRespondBidirectionalEvent` (the same
+// check client contracts run in-circuit), and the deploy-time key pin is
+// `pureCircuits.signetKeyHash` — this file never re-implements any of them.
+//
+// This belongs in github.com/sig-net/signet.js as its Midnight adapter —
+// kept here until upstreamed.
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+/** secp256k1 curve (group) order n. */
+export const SECP256K1_ORDER = secp256k1.Point.Fn.ORDER;
+/** BLS12-381 scalar field order (the Compact `Field` type modulus). */
+export const BLS_ORDER = 52435875175126190479447740508185965837690552500527637822603658699938581184513n;
+/**
+ * Convert little-endian bytes to a bigint. Matches Compact's
+ * `Bytes<32> as Field` / `Bytes<32> as Secp256k1Scalar` interpretation (both
+ * casts are little-endian).
+ *
+ * @param bytes - Little-endian byte array.
+ * @returns The decoded non-negative integer.
+ */
+export function bytesToBigint(bytes) {
+    let result = 0n;
+    for (let i = bytes.length - 1; i >= 0; i--) {
+        result = (result << 8n) | BigInt(bytes[i]);
+    }
+    return result;
+}
+/**
+ * Convert a bigint to exactly 32 little-endian bytes. Matches Compact's
+ * `Field as Bytes<32>` / `Secp256k1Scalar as Bytes<32>` encoding (the inverse
+ * of {@link bytesToBigint}); negative inputs are interpreted in the BLS
+ * scalar field.
+ *
+ * @param n - The integer to encode.
+ * @returns The 32-byte little-endian encoding.
+ */
+export function bigintToBytes32(n) {
+    const buf = new Uint8Array(32);
+    let v = n < 0n ? n + BLS_ORDER : n;
+    for (let i = 0; i < 32; i++) {
+        buf[i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    return buf;
+}
+/** Convert big-endian bytes to a bigint (SEC1 coordinate order). */
+function bytesToBigintBE(bytes) {
+    let value = 0n;
+    for (const byte of bytes) {
+        value = (value << 8n) | BigInt(byte);
+    }
+    return value;
+}
+/**
+ * ECDSA-sign a 32-byte digest with a secp256k1 secret key, exactly as the
+ * MPC signs the attestation digest: RFC 6979 deterministic, low-s, the digest
+ * interpreted big-endian with NO extra hashing (`prehash: false`) — the same
+ * convention `secp256k1EcdsaVerify` checks in-circuit.
+ *
+ * @param digest - The 32-byte digest to sign (e.g. the compiled
+ *   `pureCircuits.signetAttestationDigest` output).
+ * @param secretKey - The 32-byte secp256k1 secret key.
+ * @returns The signature with its recovery id.
+ */
+export function signAttestationDigest(digest, secretKey) {
+    const sigBytes = secp256k1.sign(digest, secretKey, { prehash: false });
+    const sig = secp256k1.Signature.fromBytes(sigBytes, "compact");
+    // Recover the id by trying both parities against the actual public key.
+    const pk = secp256k1.getPublicKey(secretKey, false);
+    const pkHex = Buffer.from(pk).toString("hex");
+    for (const recoveryId of [0, 1]) {
+        const recovered = sig
+            .addRecoveryBit(recoveryId)
+            .recoverPublicKey(digest)
+            .toHex(false);
+        if (recovered === pkHex) {
+            return { r: sig.r, s: sig.s, recoveryId };
+        }
+    }
+    /* v8 ignore next: unreachable for a signature this function just produced */
+    throw new Error("signature does not recover to its own public key");
+}
+/**
+ * Parse a secp256k1 public key from SEC1 hex (compressed or uncompressed,
+ * optional `0x` prefix) into the Compact runtime's `Secp256k1Point` shape —
+ * how deploys receive the MPC response key to pin.
+ *
+ * @param value - The SEC1 hex public key.
+ * @returns The parsed point.
+ * @throws Error if the value is not a valid secp256k1 public key.
+ */
+export function parseSecp256k1PublicKey(value) {
+    const hex = value.startsWith("0x") || value.startsWith("0X") ? value.slice(2) : value;
+    let point;
+    try {
+        point = secp256k1.Point.fromHex(hex);
+    }
+    catch (error) {
+        throw new Error(`not a secp256k1 public key in SEC1 hex: "${value}" (${String(error)})`);
+    }
+    const uncompressed = point.toBytes(false); // 0x04 || x || y
+    return {
+        x: bytesToBigintBE(uncompressed.slice(1, 33)),
+        y: bytesToBigintBE(uncompressed.slice(33, 65)),
+        identity: false,
+    };
+}
+/**
+ * Format a secp256k1 public key point as uncompressed SEC1 hex (with `0x`
+ * prefix) — the round-trip inverse of {@link parseSecp256k1PublicKey}, for
+ * handing a response key to deploys via env/config.
+ *
+ * @param point - The point to format.
+ * @returns The `0x04…` uncompressed SEC1 hex string.
+ */
+export function formatSecp256k1PublicKey(point) {
+    const toBE32 = (v) => v.toString(16).padStart(64, "0");
+    return `0x04${toBE32(point.x)}${toBE32(point.y)}`;
+}
+/**
+ * Derive the `Secp256k1Point` of a secret key — convenience for tests and
+ * signers that hold key material as raw bytes.
+ *
+ * @param secretKey - The 32-byte secp256k1 secret key.
+ * @returns The public key point.
+ */
+export function secp256k1PublicKeyOf(secretKey) {
+    const uncompressed = secp256k1.getPublicKey(secretKey, false);
+    return {
+        x: bytesToBigintBE(uncompressed.slice(1, 33)),
+        y: bytesToBigintBE(uncompressed.slice(33, 65)),
+        identity: false,
+    };
+}
+//# sourceMappingURL=ecdsa-attestation.js.map

package/dist/ecdsa-attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecdsa-attestation.js","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,6EAA6E;AAC7E,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,yEAAyE;AACzE,8BAA8B;AAE9B,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAOvD,uCAAuC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAExD,uEAAuE;AACvE,MAAM,CAAC,MAAM,SAAS,GAAG,8EAA8E,CAAC;AAExG;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAiBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,SAAqB;IAErB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/D,wEAAwE;IACxE,MAAM,EAAE,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,MAAM,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,GAAG;aAClB,cAAc,CAAC,UAAU,CAAC;aAC1B,gBAAgB,CAAC,MAAM,CAAC;aACxB,KAAK,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtF,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;IAC5D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAqB;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAqB;IACxD,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC"}

package/dist/epsilon-derivation.d.ts

@@ -1,3 +1,4 @@
+import { type Secp256k1Point } from "./ecdsa-attestation.ts";
 /**
  * Domain prefix of the sig-net v1.0.0 epsilon derivation scheme, as used by
  * the live response server. The full derivation string is
@@ -9,6 +10,24 @@ export declare const EPSILON_DERIVATION_PREFIX = "sig.network v1.0.0 epsilon der
  * from Midnight contracts.
  */
 export declare const MIDNIGHT_TESTNET_CHAIN_ID = "midnight:testnet";
+/**
+ * The FIXED derivation path of the MPC's respond-bidirectional RESPONSE key
+ * for Midnight client contracts (mirrors the MPC's per-chain
+ * `<chain> response key` convention, sig-net/mpc
+ * chain-signatures/node/src/respond_bidirectional.rs). The response key is
+ * derived from (the SIGNET SINGLETON contract address, this path): it is not
+ * the MPC root key and not the key that signs the requested transaction.
+ * Client contracts pin its hash at deploy time and verify
+ * RespondBidirectionalEvents against it.
+ *
+ * Why the SIGNET address and not the client contract's own address: the pin
+ * is sealed in the client's CONSTRUCTOR, and a Midnight contract address is
+ * a hash over the deploy (constructor arguments included), so a key derived
+ * from the client's own address could never be known at the moment it must
+ * be sealed. The signet singleton deploys first, so its address is available
+ * to every client deploy, and the key stays scoped per signet deployment.
+ */
+export declare const MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH = "midnight response key";
 /**
  * Derive the EVM address the MPC network signs from for a given Midnight
  * contract and derivation path, using the sig-net v1.0.0 epsilon scheme:
@@ -29,4 +48,45 @@ export declare const MIDNIGHT_TESTNET_CHAIN_ID = "midnight:testnet";
  * @returns The derived EVM address as a 0x-prefixed EIP-55 checksummed string.
  */
 export declare function deriveEvmAddress(mpcSecp256k1PubkeyHex: string, contractAddress: string, path: string, chainId?: string): string;
+/**
+ * The epsilon scalar of the sig-net v1.0.0 derivation scheme:
+ * `keccak256("<prefix>,<chainId>,<requester>,<path>")` reduced mod the
+ * secp256k1 curve order. Child keys are `root + epsilon` (secret side) and
+ * `rootPubKey + epsilon * G` (public side).
+ *
+ * @param requester - The requester component of the derivation string,
+ *   verbatim (no normalisation: callers must agree on the exact rendering).
+ * @param path - The derivation path string.
+ * @param chainId - CAIP-2 chain id component of the derivation string.
+ * @returns The epsilon scalar, in `[0, n)`.
+ */
+export declare function deriveEpsilon(requester: string, path: string, chainId?: string): bigint;
+/**
+ * Derive the MPC's respond-bidirectional RESPONSE key for a signet
+ * deployment, public side: what client-contract deploys pin
+ * (`MPC_RESPONSE_KEY`) and what response verification checks against. See
+ * {@link MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH} for the scheme and why the
+ * requester is the signet singleton's address.
+ *
+ * @param mpcSecp256k1PubkeyHex - The MPC root secp256k1 public key as 0x-hex
+ *   (compressed or uncompressed).
+ * @param signetContractAddress - The signet singleton's Midnight contract
+ *   address (`0x` prefix optional, case-insensitive).
+ * @returns The response public key as a Compact-runtime `Secp256k1Point`.
+ */
+export declare function deriveMidnightResponseKey(mpcSecp256k1PubkeyHex: string, signetContractAddress: string): Secp256k1Point;
+/**
+ * Derive the MPC's respond-bidirectional RESPONSE key for a signet
+ * deployment, secret side: `(rootSecret + epsilon) mod n`. MPC-side only
+ * (the fakenet signer, test harnesses): a real client never holds the root
+ * key. The result feeds `signAttestationDigest` directly.
+ *
+ * @param mpcRootSecretKey - The 32-byte MPC root secret key (big-endian, the
+ *   standard secp256k1 encoding).
+ * @param signetContractAddress - The signet singleton's Midnight contract
+ *   address (`0x` prefix optional, case-insensitive).
+ * @returns The 32-byte response secret key (big-endian).
+ * @throws Error if the root key is not 32 bytes or the derived scalar is 0.
+ */
+export declare function deriveMidnightResponseSecretKey(mpcRootSecretKey: Uint8Array, signetContractAddress: string): Uint8Array;
 //# sourceMappingURL=epsilon-derivation.d.ts.map

package/dist/epsilon-derivation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"epsilon-derivation.d.ts","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,0CAA0C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,EAC7B,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CASR"}
+{"version":3,"file":"epsilon-derivation.d.ts","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAeA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,0CAA0C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,mCAAmC,0BAA0B,CAAC;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,EAC7B,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAGR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAKR;AA6BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CACvC,qBAAqB,EAAE,MAAM,EAC7B,qBAAqB,EAAE,MAAM,GAC5B,cAAc,CAQhB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,UAAU,EAC5B,qBAAqB,EAAE,MAAM,GAC5B,UAAU,CAwBZ"}

package/dist/epsilon-derivation.js

@@ -11,6 +11,7 @@
 // matches the server.
 import { secp256k1 } from "@noble/curves/secp256k1.js";
 import { computeAddress, keccak256, SigningKey, toUtf8Bytes } from "ethers";
+import { SECP256K1_ORDER } from "./ecdsa-attestation.js";
 /**
  * Domain prefix of the sig-net v1.0.0 epsilon derivation scheme, as used by
  * the live response server. The full derivation string is
@@ -22,6 +23,24 @@ export const EPSILON_DERIVATION_PREFIX = "sig.network v1.0.0 epsilon derivation"
  * from Midnight contracts.
  */
 export const MIDNIGHT_TESTNET_CHAIN_ID = "midnight:testnet";
+/**
+ * The FIXED derivation path of the MPC's respond-bidirectional RESPONSE key
+ * for Midnight client contracts (mirrors the MPC's per-chain
+ * `<chain> response key` convention, sig-net/mpc
+ * chain-signatures/node/src/respond_bidirectional.rs). The response key is
+ * derived from (the SIGNET SINGLETON contract address, this path): it is not
+ * the MPC root key and not the key that signs the requested transaction.
+ * Client contracts pin its hash at deploy time and verify
+ * RespondBidirectionalEvents against it.
+ *
+ * Why the SIGNET address and not the client contract's own address: the pin
+ * is sealed in the client's CONSTRUCTOR, and a Midnight contract address is
+ * a hash over the deploy (constructor arguments included), so a key derived
+ * from the client's own address could never be known at the moment it must
+ * be sealed. The signet singleton deploys first, so its address is available
+ * to every client deploy, and the key stays scoped per signet deployment.
+ */
+export const MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH = "midnight response key";
 /**
  * Derive the EVM address the MPC network signs from for a given Midnight
  * contract and derivation path, using the sig-net v1.0.0 epsilon scheme:
@@ -42,13 +61,95 @@ export const MIDNIGHT_TESTNET_CHAIN_ID = "midnight:testnet";
  * @returns The derived EVM address as a 0x-prefixed EIP-55 checksummed string.
  */
 export function deriveEvmAddress(mpcSecp256k1PubkeyHex, contractAddress, path, chainId = MIDNIGHT_TESTNET_CHAIN_ID) {
-    const fullPath = `${EPSILON_DERIVATION_PREFIX},${chainId},${contractAddress},${path}`;
-    // Reduce mod n before multiplying: noble throws on scalars >= n, whereas the
+    const derivedPoint = deriveChildPoint(mpcSecp256k1PubkeyHex, contractAddress, path, chainId);
+    return computeAddress(`0x${derivedPoint.toHex(false)}`);
+}
+/**
+ * The epsilon scalar of the sig-net v1.0.0 derivation scheme:
+ * `keccak256("<prefix>,<chainId>,<requester>,<path>")` reduced mod the
+ * secp256k1 curve order. Child keys are `root + epsilon` (secret side) and
+ * `rootPubKey + epsilon * G` (public side).
+ *
+ * @param requester - The requester component of the derivation string,
+ *   verbatim (no normalisation: callers must agree on the exact rendering).
+ * @param path - The derivation path string.
+ * @param chainId - CAIP-2 chain id component of the derivation string.
+ * @returns The epsilon scalar, in `[0, n)`.
+ */
+export function deriveEpsilon(requester, path, chainId = MIDNIGHT_TESTNET_CHAIN_ID) {
+    const fullPath = `${EPSILON_DERIVATION_PREFIX},${chainId},${requester},${path}`;
+    // Reduce mod n before using: noble throws on scalars >= n, whereas the
     // server's scalar arithmetic reduces implicitly.
-    const epsilon = BigInt(keccak256(toUtf8Bytes(fullPath))) % secp256k1.Point.Fn.ORDER;
+    return BigInt(keccak256(toUtf8Bytes(fullPath))) % SECP256K1_ORDER;
+}
+/** Derive the child public key as a noble curve point (internal shape). */
+function deriveChildPoint(mpcSecp256k1PubkeyHex, requester, path, chainId) {
+    const epsilon = deriveEpsilon(requester, path, chainId);
     const rootPubKeyHex = SigningKey.computePublicKey(mpcSecp256k1PubkeyHex, false);
     const rootPoint = secp256k1.Point.fromHex(rootPubKeyHex.slice(2));
-    const derivedPoint = epsilon === 0n ? rootPoint : rootPoint.add(secp256k1.Point.BASE.multiply(epsilon));
-    return computeAddress(`0x${derivedPoint.toHex(false)}`);
+    return epsilon === 0n ? rootPoint : rootPoint.add(secp256k1.Point.BASE.multiply(epsilon));
+}
+/**
+ * Normalise a Midnight contract address for use as the requester component
+ * of the derivation string: strip an optional `0x` prefix and lowercase.
+ * Both sides of the protocol (the deploy pinning a key and the MPC signing
+ * with it) derive through this, so the rendering always agrees.
+ */
+function normaliseRequesterAddress(contractAddress) {
+    const hex = contractAddress.startsWith("0x") || contractAddress.startsWith("0X")
+        ? contractAddress.slice(2)
+        : contractAddress;
+    return hex.toLowerCase();
+}
+/**
+ * Derive the MPC's respond-bidirectional RESPONSE key for a signet
+ * deployment, public side: what client-contract deploys pin
+ * (`MPC_RESPONSE_KEY`) and what response verification checks against. See
+ * {@link MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH} for the scheme and why the
+ * requester is the signet singleton's address.
+ *
+ * @param mpcSecp256k1PubkeyHex - The MPC root secp256k1 public key as 0x-hex
+ *   (compressed or uncompressed).
+ * @param signetContractAddress - The signet singleton's Midnight contract
+ *   address (`0x` prefix optional, case-insensitive).
+ * @returns The response public key as a Compact-runtime `Secp256k1Point`.
+ */
+export function deriveMidnightResponseKey(mpcSecp256k1PubkeyHex, signetContractAddress) {
+    const point = deriveChildPoint(mpcSecp256k1PubkeyHex, normaliseRequesterAddress(signetContractAddress), MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH, MIDNIGHT_TESTNET_CHAIN_ID);
+    return { x: point.x, y: point.y, identity: false };
+}
+/**
+ * Derive the MPC's respond-bidirectional RESPONSE key for a signet
+ * deployment, secret side: `(rootSecret + epsilon) mod n`. MPC-side only
+ * (the fakenet signer, test harnesses): a real client never holds the root
+ * key. The result feeds `signAttestationDigest` directly.
+ *
+ * @param mpcRootSecretKey - The 32-byte MPC root secret key (big-endian, the
+ *   standard secp256k1 encoding).
+ * @param signetContractAddress - The signet singleton's Midnight contract
+ *   address (`0x` prefix optional, case-insensitive).
+ * @returns The 32-byte response secret key (big-endian).
+ * @throws Error if the root key is not 32 bytes or the derived scalar is 0.
+ */
+export function deriveMidnightResponseSecretKey(mpcRootSecretKey, signetContractAddress) {
+    if (mpcRootSecretKey.length !== 32) {
+        throw new Error(`MPC root secret key must be 32 bytes, got ${mpcRootSecretKey.length}`);
+    }
+    let root = 0n;
+    for (const byte of mpcRootSecretKey) {
+        root = (root << 8n) | BigInt(byte);
+    }
+    const epsilon = deriveEpsilon(normaliseRequesterAddress(signetContractAddress), MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH, MIDNIGHT_TESTNET_CHAIN_ID);
+    const child = (root + epsilon) % SECP256K1_ORDER;
+    if (child === 0n) {
+        throw new Error("derived response secret key is zero (invalid scalar)");
+    }
+    const out = new Uint8Array(32);
+    let value = child;
+    for (let i = 31; i >= 0; i--) {
+        out[i] = Number(value & 0xffn);
+        value >>= 8n;
+    }
+    return out;
 }
 //# sourceMappingURL=epsilon-derivation.js.map

package/dist/epsilon-derivation.js.map

@@ -1 +1 @@
-{"version":3,"file":"epsilon-derivation.js","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,uDAAuD;AACvD,0EAA0E;AAC1E,uEAAuE;AACvE,oDAAoD;AACpD,4EAA4E;AAC5E,yEAAyE;AACzE,sBAAsB;AAEtB,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAE5E;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,uCAAuC,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,qBAA6B,EAC7B,eAAuB,EACvB,IAAY,EACZ,UAAkB,yBAAyB;IAE3C,MAAM,QAAQ,GAAG,GAAG,yBAAyB,IAAI,OAAO,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;IACtF,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;IACpF,MAAM,aAAa,GAAG,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACxG,OAAO,cAAc,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"epsilon-derivation.js","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,uDAAuD;AACvD,0EAA0E;AAC1E,uEAAuE;AACvE,oDAAoD;AACpD,4EAA4E;AAC5E,yEAAyE;AACzE,sBAAsB;AAEtB,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAuB,MAAM,wBAAwB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,uCAAuC,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAE5D;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,uBAAuB,CAAC;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,qBAA6B,EAC7B,eAAuB,EACvB,IAAY,EACZ,UAAkB,yBAAyB;IAE3C,MAAM,YAAY,GAAG,gBAAgB,CAAC,qBAAqB,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7F,OAAO,cAAc,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,IAAY,EACZ,UAAkB,yBAAyB;IAE3C,MAAM,QAAQ,GAAG,GAAG,yBAAyB,IAAI,OAAO,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;IAChF,uEAAuE;IACvE,iDAAiD;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC;AACpE,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CACvB,qBAA6B,EAC7B,SAAiB,EACjB,IAAY,EACZ,OAAe;IAEf,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,eAAuB;IACxD,MAAM,GAAG,GACP,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC;QAClE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,eAAe,CAAC;IACtB,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,yBAAyB,CACvC,qBAA6B,EAC7B,qBAA6B;IAE7B,MAAM,KAAK,GAAG,gBAAgB,CAC5B,qBAAqB,EACrB,yBAAyB,CAAC,qBAAqB,CAAC,EAChD,mCAAmC,EACnC,yBAAyB,CAC1B,CAAC;IACF,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAC7C,gBAA4B,EAC5B,qBAA6B;IAE7B,IAAI,gBAAgB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAC3B,yBAAyB,CAAC,qBAAqB,CAAC,EAChD,mCAAmC,EACnC,yBAAyB,CAC1B,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,eAAe,CAAC;IACjD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;QAC/B,KAAK,KAAK,EAAE,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/index.d.ts

@@ -8,16 +8,18 @@ export * from "./signet-request-resolver.ts";
 export * from "./signet-request-feed.ts";
 export * from "./constants.ts";
 export * from "./epsilon-derivation.ts";
-export * from "./schnorr.ts";
+export * from "./ecdsa-attestation.ts";
 /**
  * Compiled pure circuits of Signet.compact (run `yarn compile` first): the
  * executable reference implementation of the client-agnostic circuits —
- * path<->identity checks, the attestation message, the notification packer
- * (`constructSignBidirectionalNotificationV1`), and the Schnorr challenge.
- * Off-chain code MUST use these instead of re-porting the algorithms — they
- * are the same compiled logic the contracts prove. The generic request
- * circuits cannot be compiled here (type-parameterized): request construction
- * is contract-only, and request-id hashing has a documented-deviation TS twin
+ * the attestation digest (`signetAttestationDigest`), response verification
+ * (`verifyRespondBidirectionalEvent`), the deploy-time key pin
+ * (`signetKeyHash`), and the notification packer
+ * (`constructSignBidirectionalEventNotificationV1`). Off-chain code MUST use
+ * these instead of re-porting the algorithms — they are the same compiled
+ * logic the contracts prove. The generic request circuits cannot be compiled
+ * here (type-parameterized): request construction is contract-only, and
+ * request-id hashing has a documented-deviation TS twin
  * (`calculateRequestId` in signet-requests.ts).
  */
 export { pureCircuits, type PureCircuits } from "./managed/contract/index.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,cAAc,CAAC;AAE7B;;;;;;;;;;GAUG;AACH,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AAEvC;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,6BAA6B,CAAC"}

package/dist/index.js

@@ -11,16 +11,18 @@ export * from "./signet-request-resolver.js";
 export * from "./signet-request-feed.js";
 export * from "./constants.js";
 export * from "./epsilon-derivation.js";
-export * from "./schnorr.js";
+export * from "./ecdsa-attestation.js";
 /**
  * Compiled pure circuits of Signet.compact (run `yarn compile` first): the
  * executable reference implementation of the client-agnostic circuits —
- * path<->identity checks, the attestation message, the notification packer
- * (`constructSignBidirectionalNotificationV1`), and the Schnorr challenge.
- * Off-chain code MUST use these instead of re-porting the algorithms — they
- * are the same compiled logic the contracts prove. The generic request
- * circuits cannot be compiled here (type-parameterized): request construction
- * is contract-only, and request-id hashing has a documented-deviation TS twin
+ * the attestation digest (`signetAttestationDigest`), response verification
+ * (`verifyRespondBidirectionalEvent`), the deploy-time key pin
+ * (`signetKeyHash`), and the notification packer
+ * (`constructSignBidirectionalEventNotificationV1`). Off-chain code MUST use
+ * these instead of re-porting the algorithms — they are the same compiled
+ * logic the contracts prove. The generic request circuits cannot be compiled
+ * here (type-parameterized): request construction is contract-only, and
+ * request-id hashing has a documented-deviation TS twin
  * (`calculateRequestId` in signet-requests.ts).
  */
 export { pureCircuits } from "./managed/contract/index.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,4EAA4E;AAC5E,2DAA2D;AAE3D,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,cAAc,CAAC;AAE7B;;;;;;;;;;GAUG;AACH,OAAO,EAAE,YAAY,EAAqB,MAAM,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,4EAA4E;AAC5E,2DAA2D;AAE3D,cAAc,sBAAsB,CAAC;AACrC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sCAAsC,CAAC;AACrD,cAAc,mCAAmC,CAAC;AAClD,cAAc,sCAAsC,CAAC;AACrD,cAAc,qCAAqC,CAAC;AACpD,cAAc,8BAA8B,CAAC;AAC7C,cAAc,0BAA0B,CAAC;AACzC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AAEvC;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,YAAY,EAAqB,MAAM,6BAA6B,CAAC"}