@sig-net/midnight 0.0.5 → 0.0.7

package/src/circuits.compact

@@ -1,39 +1,38 @@
 pragma language_version >= 0.25;
 
-// Compiled export surface of the Signet and Schnorr modules.
+// Compiled export surface of the Signet module.
 //
-// Signet.compact / Schnorr.compact must stay module-only files (that is what
-// lets contracts import them), but a bare module compiles to nothing. This
-// contract-less program re-exports the modules' pure circuits so the compiler
-// emits them as pureCircuits in managed/contract/index.js — giving the
-// package an in-process, provable-logic-identical reference implementation:
-// unit tests exercise the REAL circuits, and off-chain code (path checks,
-// Schnorr challenges, attestation messages, notification packing) reuses them
+// Signet.compact must stay a module-only file (that is what lets contracts
+// import it), but a bare module compiles to nothing. This contract-less
+// program re-exports the module's pure circuits so the compiler emits them as
+// pureCircuits in managed/contract/index.js, giving the package an
+// in-process, provable-logic-identical reference implementation: unit tests
+// exercise the REAL circuits, and off-chain code (the attestation digest,
+// response verification, key-pin hashing, notification packing) reuses them
 // instead of hand-porting the algorithms. Off-chain code only ever DECODES a
-// SignBidirectionalNotification (fixed-offset byte reads), but tests build
-// fixtures with the compiled packer to pin the pack<->decode lockstep.
+// SignBidirectionalEventNotification (fixed-offset byte reads), but tests
+// build fixtures with the compiled packer to pin the pack<->decode lockstep.
 //
 // ONLY the non-generic circuits are exported here. The request circuits
-// (calculateRequestId, constructSignBidirectionalRequest) are generic over the
-// tx-params type, the compiler cannot export type-parameterized circuits from
-// the top level, and this package is client-agnostic — a capacity
-// instantiation is a CLIENT contract's choice and never belongs here.
-// constructSignBidirectionalRequest is contract-only, so it needs no off-chain
-// copy; calculateRequestId IS needed off-chain (clients recompute ledger map
-// keys), so it alone has a documented-deviation TS twin in signet-requests.ts,
-// kept honest by caller-contract's submitSignatureRequest round-trip test.
+// (calculateRequestId, constructSignBidirectionalEvent) are generic over the
+// tx-params type and schema lengths, the compiler cannot export
+// type-parameterized circuits from the top level, and this package is
+// client-agnostic: a capacity instantiation is a CLIENT contract's choice and
+// never belongs here. constructSignBidirectionalEvent is contract-only, so it
+// needs no off-chain copy. calculateRequestId IS needed off-chain (clients
+// recompute ledger map keys), so it alone has a documented-deviation TS twin
+// in signet-requests.ts, kept honest by caller-contract's
+// submitSignatureRequest round-trip test.
 //
 // Compile with --skip-zk only: pure circuits run in TS without proving keys.
+// The secp256k1 types require the --feature-zkir-v3 compiler flag.
 
 import CompactStandardLibrary;
 import "./Signet";
-import "./Schnorr";
 
 export {
-  signetAttestationMessage,
-  assertHexOf,
-  assertPathCommitment,
-  constructSignBidirectionalNotificationV1,
-  evmAddressAbiValue,
-  schnorrChallenge
+  signetAttestationDigest,
+  verifyRespondBidirectionalEvent,
+  signetKeyHash,
+  constructSignBidirectionalEventNotificationV1
 };

package/dist/schnorr.d.ts

@@ -1,100 +0,0 @@
-import { type JubjubPoint } from "@midnight-ntwrk/compact-runtime";
-export type { JubjubPoint } from "@midnight-ntwrk/compact-runtime";
-/** Jubjub curve scalar field order (group order of the generator). */
-export declare const JUBJUB_ORDER = 6554484396890773809930967563523245729705921265872317281365359162392183254199n;
-/** BLS12-381 scalar field order (the Compact `Field` type modulus). */
-export declare const BLS_ORDER = 52435875175126190479447740508185965837690552500527637822603658699938581184513n;
-/**
- * Convert little-endian bytes to a bigint. Matches Compact's
- * `Bytes<32> as Field` interpretation (and the MPC monitor's ABI-word
- * decoding convention).
- *
- * @param bytes - Little-endian byte array.
- * @returns The decoded non-negative integer.
- */
-export declare function bytesToBigint(bytes: Uint8Array): bigint;
-/**
- * Convert a bigint to exactly 32 little-endian bytes. Matches Compact's
- * `Field as Bytes<32>` encoding (the inverse of {@link bytesToBigint});
- * negative inputs are interpreted in the BLS scalar field.
- *
- * @param n - The integer to encode.
- * @returns The 32-byte little-endian encoding.
- */
-export declare function bigintToBytes32(n: bigint): Uint8Array;
-/** A Jubjub keypair: the secret scalar and its public curve point. */
-export interface JubjubKeypair {
-    /** Secret scalar in `[1, JUBJUB_ORDER - 1]`. */
-    sk: bigint;
-    /** Public key: `sk * G` on Jubjub. */
-    pk: JubjubPoint;
-}
-/**
- * Derive a Jubjub keypair from a seed — the same derivation the MPC server
- * performs on its root key, so this MUST stay bit-identical to it:
- * `sk = (persistentHash([pad32("jubjub:auth:"), seed]) mod (order - 1)) + 1`,
- * `pk = sk * G`.
- *
- * @param seed - Seed bytes (e.g. the 32-byte MPC root key).
- * @returns The derived {@link JubjubKeypair}.
- */
-export declare function deriveJubjubKeypair(seed: Uint8Array): JubjubKeypair;
-/**
- * A Schnorr signature (TS twin of CompactStandardLibrary's
- * `JubjubSchnorrSignature`).
- */
-export interface SchnorrSignature {
-    /** Nonce commitment R = k * G. */
-    announcement: JubjubPoint;
-    /** Signature scalar s = (k + c * sk) mod JUBJUB_ORDER. */
-    response: bigint;
-}
-/**
- * Computes the Schnorr challenge (the Poseidon transientHash output reduced
- * into Jubjub's scalar field, exactly as `jubjubSchnorrVerify` computes it).
- * ALWAYS inject the compiled circuit — signet-midnight's own
- * `pureCircuits.schnorrChallenge` — never a TS re-implementation; keeping it
- * injected keeps this signer decoupled from any one compiled artifact.
- */
-export type SchnorrChallengeFn = (annX: bigint, annY: bigint, pkX: bigint, pkY: bigint, msg: bigint[]) => bigint;
-/**
- * Sign a message with Schnorr on Jubjub, matching CompactStandardLibrary's
- * `jubjubSchnorrVerify`: `c = challenge` (already reduced into Jubjub's
- * scalar field by the compiled circuit), `s = (k + c * sk) mod JUBJUB_ORDER`.
- * For signet attestations the message is the compiled
- * `pureCircuits.signetAttestationMessage(requestId, outputData)`.
- *
- * @param sk - Jubjub private key scalar.
- * @param msg - Message field limbs.
- * @param schnorrChallenge - The compiled `pureCircuits.schnorrChallenge`.
- * @returns The signature (announcement R, response s).
- * @throws Error if `sk` reduces to zero mod the Jubjub order.
- */
-export declare function schnorrSign(sk: bigint, msg: bigint[], schnorrChallenge: SchnorrChallengeFn): SchnorrSignature;
-/**
- * Hash a Jubjub point exactly as the circuits do (`persistentHash<JubjubPoint>`)
- * — the form the signet contract seals as `mpcPubKeyHash`.
- *
- * @param point - The point to hash.
- * @returns The 32-byte hash.
- */
-export declare function hashJubjubPoint(point: JubjubPoint): Uint8Array;
-/**
- * Parse a Jubjub public key from its `"x,y"` config/env form (decimal or
- * 0x-hex field coordinates) — how deploys receive `MPC_JUBJUB_PK`.
- *
- * @param value - The `"x,y"` string.
- * @returns The parsed point.
- * @throws Error if the value is not two comma-separated field coordinates.
- */
-export declare function parseJubjubPublicKey(value: string): JubjubPoint;
-/**
- * Format a Jubjub public key as the `"x,y"` decimal config/env form that
- * {@link parseJubjubPublicKey} accepts — the round-trip inverse, for handing
- * a derived key to deploys as `MPC_JUBJUB_PK`.
- *
- * @param point - The point to format.
- * @returns The `"x,y"` string with decimal coordinates.
- */
-export declare function formatJubjubPublicKey(point: JubjubPoint): string;
-//# sourceMappingURL=schnorr.d.ts.map

package/dist/schnorr.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"schnorr.d.ts","sourceRoot":"","sources":["../src/schnorr.ts"],"names":[],"mappings":"AAiBA,OAAO,EAML,KAAK,WAAW,EACjB,MAAM,iCAAiC,CAAC;AAKzC,YAAY,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAEnE,sEAAsE;AACtE,eAAO,MAAM,YAAY,gFAAgF,CAAC;AAE1G,uEAAuE;AACvE,eAAO,MAAM,SAAS,iFAAiF,CAAC;AAKxG;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMvD;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAED,sEAAsE;AACtE,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,EAAE,EAAE,MAAM,CAAC;IACX,sCAAsC;IACtC,EAAE,EAAE,WAAW,CAAC;CACjB;AASD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,UAAU,GAAG,aAAa,CAKnE;AAID;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,kCAAkC;IAClC,YAAY,EAAE,WAAW,CAAC;IAC1B,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EAAE,KACV,MAAM,CAAC;AAEZ;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CACzB,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EAAE,EACb,gBAAgB,EAAE,kBAAkB,GACnC,gBAAgB,CAgBlB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,CAE9D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAU/D;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CAEhE"}

package/dist/schnorr.js

@@ -1,144 +0,0 @@
-// Jubjub Schnorr helpers — the TS side of the shared Schnorr.compact module:
-// key derivation, SIGNING (which needs the secret scalar, so it cannot be a
-// circuit), and key parsing/hashing. Everything provable stays in Compact:
-// the challenge is the COMPILED `pureCircuits.schnorrChallenge`, injected by
-// callers (see SchnorrChallengeFn), and the attestation message is the
-// compiled `pureCircuits.signetAttestationMessage` — this file never
-// re-implements either. Verification lives in circuits only
-// (CompactStandardLibrary's jubjubSchnorrVerify, run by the signet contract
-// at post time).
-//
-// This belongs in github.com/sig-net/signet.js as its Midnight adapter —
-// kept here until upstreamed. The math is Midnight-specific (Jubjub embedded
-// in BLS12-381 via @midnight-ntwrk/compact-runtime EC ops), which is exactly
-// why signet.js does not cover it today.
-import { randomBytes } from "node:crypto";
-import { CompactTypeBytes, CompactTypeJubjubPoint, CompactTypeVector, ecMulGenerator, persistentHash, } from "@midnight-ntwrk/compact-runtime";
-/** Jubjub curve scalar field order (group order of the generator). */
-export const JUBJUB_ORDER = 6554484396890773809930967563523245729705921265872317281365359162392183254199n;
-/** BLS12-381 scalar field order (the Compact `Field` type modulus). */
-export const BLS_ORDER = 52435875175126190479447740508185965837690552500527637822603658699938581184513n;
-const bytes32Type = new CompactTypeBytes(32);
-const vec2x32Type = new CompactTypeVector(2, bytes32Type);
-/**
- * Convert little-endian bytes to a bigint. Matches Compact's
- * `Bytes<32> as Field` interpretation (and the MPC monitor's ABI-word
- * decoding convention).
- *
- * @param bytes - Little-endian byte array.
- * @returns The decoded non-negative integer.
- */
-export function bytesToBigint(bytes) {
-    let result = 0n;
-    for (let i = bytes.length - 1; i >= 0; i--) {
-        result = (result << 8n) | BigInt(bytes[i]);
-    }
-    return result;
-}
-/**
- * Convert a bigint to exactly 32 little-endian bytes. Matches Compact's
- * `Field as Bytes<32>` encoding (the inverse of {@link bytesToBigint});
- * negative inputs are interpreted in the BLS scalar field.
- *
- * @param n - The integer to encode.
- * @returns The 32-byte little-endian encoding.
- */
-export function bigintToBytes32(n) {
-    const buf = new Uint8Array(32);
-    let v = n < 0n ? n + BLS_ORDER : n;
-    for (let i = 0; i < 32; i++) {
-        buf[i] = Number(v & 0xffn);
-        v >>= 8n;
-    }
-    return buf;
-}
-/** Zero-pad an ASCII domain tag to 32 bytes (Compact `pad(32, ...)`). */
-function pad32(tag) {
-    const padded = new Uint8Array(32);
-    new TextEncoder().encodeInto(tag, padded);
-    return padded;
-}
-/**
- * Derive a Jubjub keypair from a seed — the same derivation the MPC server
- * performs on its root key, so this MUST stay bit-identical to it:
- * `sk = (persistentHash([pad32("jubjub:auth:"), seed]) mod (order - 1)) + 1`,
- * `pk = sk * G`.
- *
- * @param seed - Seed bytes (e.g. the 32-byte MPC root key).
- * @returns The derived {@link JubjubKeypair}.
- */
-export function deriveJubjubKeypair(seed) {
-    const skBytes = persistentHash(vec2x32Type, [pad32("jubjub:auth:"), seed]);
-    const sk = (bytesToBigint(skBytes) % (JUBJUB_ORDER - 1n)) + 1n;
-    const pk = ecMulGenerator(sk);
-    return { sk, pk };
-}
-/**
- * Sign a message with Schnorr on Jubjub, matching CompactStandardLibrary's
- * `jubjubSchnorrVerify`: `c = challenge` (already reduced into Jubjub's
- * scalar field by the compiled circuit), `s = (k + c * sk) mod JUBJUB_ORDER`.
- * For signet attestations the message is the compiled
- * `pureCircuits.signetAttestationMessage(requestId, outputData)`.
- *
- * @param sk - Jubjub private key scalar.
- * @param msg - Message field limbs.
- * @param schnorrChallenge - The compiled `pureCircuits.schnorrChallenge`.
- * @returns The signature (announcement R, response s).
- * @throws Error if `sk` reduces to zero mod the Jubjub order.
- */
-export function schnorrSign(sk, msg, schnorrChallenge) {
-    const skReduced = ((sk % JUBJUB_ORDER) + JUBJUB_ORDER) % JUBJUB_ORDER;
-    if (skReduced === 0n) {
-        throw new Error("Private key must be non-zero mod JUBJUB_ORDER");
-    }
-    const pk = ecMulGenerator(skReduced);
-    const k = (bytesToBigint(randomBytes(32)) % JUBJUB_ORDER) || 1n;
-    const announcement = ecMulGenerator(k);
-    // schnorrChallenge returns the challenge already reduced into Jubjub's
-    // scalar field — use it as-is.
-    const c = schnorrChallenge(announcement.x, announcement.y, pk.x, pk.y, msg);
-    const response = (((k + c * skReduced) % JUBJUB_ORDER) + JUBJUB_ORDER) % JUBJUB_ORDER;
-    return { announcement, response };
-}
-/**
- * Hash a Jubjub point exactly as the circuits do (`persistentHash<JubjubPoint>`)
- * — the form the signet contract seals as `mpcPubKeyHash`.
- *
- * @param point - The point to hash.
- * @returns The 32-byte hash.
- */
-export function hashJubjubPoint(point) {
-    return persistentHash(CompactTypeJubjubPoint, point);
-}
-/**
- * Parse a Jubjub public key from its `"x,y"` config/env form (decimal or
- * 0x-hex field coordinates) — how deploys receive `MPC_JUBJUB_PK`.
- *
- * @param value - The `"x,y"` string.
- * @returns The parsed point.
- * @throws Error if the value is not two comma-separated field coordinates.
- */
-export function parseJubjubPublicKey(value) {
-    const parts = value.split(",").map((part) => part.trim());
-    if (parts.length !== 2 || parts.some((part) => part === "")) {
-        throw new Error(`expected a Jubjub public key as "x,y"; got "${value}"`);
-    }
-    try {
-        return { x: BigInt(parts[0]), y: BigInt(parts[1]) };
-    }
-    catch {
-        throw new Error(`Jubjub public key coordinates must be decimal or 0x-hex integers; got "${value}"`);
-    }
-}
-/**
- * Format a Jubjub public key as the `"x,y"` decimal config/env form that
- * {@link parseJubjubPublicKey} accepts — the round-trip inverse, for handing
- * a derived key to deploys as `MPC_JUBJUB_PK`.
- *
- * @param point - The point to format.
- * @returns The `"x,y"` string with decimal coordinates.
- */
-export function formatJubjubPublicKey(point) {
-    return `${point.x},${point.y}`;
-}
-//# sourceMappingURL=schnorr.js.map

package/dist/schnorr.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schnorr.js","sourceRoot":"","sources":["../src/schnorr.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,4EAA4E;AAC5E,2EAA2E;AAC3E,6EAA6E;AAC7E,uEAAuE;AACvE,qEAAqE;AACrE,4DAA4D;AAC5D,4EAA4E;AAC5E,iBAAiB;AACjB,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,6EAA6E;AAC7E,yCAAyC;AAEzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,cAAc,EACd,cAAc,GAEf,MAAM,iCAAiC,CAAC;AAOzC,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,6EAA6E,CAAC;AAE1G,uEAAuE;AACvE,MAAM,CAAC,MAAM,SAAS,GAAG,8EAA8E,CAAC;AAExG,MAAM,WAAW,GAAG,IAAI,gBAAgB,CAAC,EAAE,CAAC,CAAC;AAC7C,MAAM,WAAW,GAAG,IAAI,iBAAiB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD,yEAAyE;AACzE,SAAS,KAAK,CAAC,GAAW;IACxB,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAClC,IAAI,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAgB;IAClD,MAAM,OAAO,GAAG,cAAc,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAC3E,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC/D,MAAM,EAAE,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;IAC9B,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AACpB,CAAC;AA8BD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CACzB,EAAU,EACV,GAAa,EACb,gBAAoC;IAEpC,MAAM,SAAS,GAAG,CAAC,CAAC,EAAE,GAAG,YAAY,CAAC,GAAG,YAAY,CAAC,GAAG,YAAY,CAAC;IACtE,IAAI,SAAS,KAAK,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAEvC,uEAAuE;IACvE,+BAA+B;IAC/B,MAAM,CAAC,GAAG,gBAAgB,CAAC,YAAY,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAE5E,MAAM,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,YAAY,CAAC,GAAG,YAAY,CAAC;IACtF,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAkB;IAChD,OAAO,cAAc,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,GAAG,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,0EAA0E,KAAK,GAAG,CAAC,CAAC;IACtG,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAkB;IACtD,OAAO,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,CAAC;AACjC,CAAC"}

package/src/Schnorr.compact

@@ -1,63 +0,0 @@
-// ============================================================================
-// Schnorr — shared Compact library: the off-chain-callable challenge circuit
-// for Schnorr signatures on the Jubjub curve embedded in BLS12-381.
-// ============================================================================
-// Verification itself is CompactStandardLibrary's `jubjubSchnorrVerify`
-// (contracts call it directly). The standard library keeps its challenge
-// hashing internal, but off-chain SIGNERS need the same challenge value to
-// compute the response scalar, so this module exports it as a pure circuit
-// (compiled via circuits.compact) — never a TS re-implementation.
-//
-// `SchnorrHashInput` mirrors the standard library's internal
-// `JubjubSchnorrHashInput` field-for-field; the signet-midnight sign→verify
-// round-trip test (schnorrSign + contract-side jubjubSchnorrVerify) keeps the
-// two in agreement.
-//
-// The sig-net MPC attests remote EVM execution by Schnorr-signing a message
-// on Jubjub (see signetAttestationMessage in Signet.compact); contracts
-// verify that signature in-circuit — the signet contract at post time, the
-// requester again at settle time. The challenge is Poseidon (transientHash), so
-// off-chain signers MUST compute it through the COMPILED schnorrChallenge
-// pure circuit (re-exported via circuits.compact).
-//
-// Import from a contract (resolved through node_modules via COMPACT_PATH —
-// see the consuming package's compile script):
-//   import "@sig-net/midnight/src/Schnorr" prefix Schnorr_;
-//
-// This file must contain ONLY this module (plus comments) so the compiler
-// accepts it as an external module import.
-
-module Schnorr {
-  import CompactStandardLibrary;
-
-  // The tuple Poseidon-hashed into the challenge: both points' coordinates
-  // then the message limbs, in exactly this order — the wire format the MPC
-  // signs against (identical to the standard library's internal
-  // JubjubSchnorrHashInput). Never reorder.
-  struct SchnorrHashInput<#n> {
-    ann_x: Field;
-    ann_y: Field;
-    pk_x: Field;
-    pk_y: Field;
-    msg: Vector<n, Field>;
-  }
-
-  // The Schnorr challenge as `jubjubSchnorrVerify` computes it: the Poseidon
-  // transientHash of (R, pk, msg), reduced into Jubjub's scalar field (the
-  // `as JubjubScalar` cast reduces mod the Jubjub subgroup order; the cast
-  // back to Field is exact). Off-chain signers use the returned value
-  // directly: s = (k + c * sk) mod JUBJUB_ORDER.
-  export pure circuit schnorrChallenge(
-                        ann_x: Field,
-                        ann_y: Field,
-                        pk_x: Field,
-                        pk_y: Field,
-                        msg: Vector<4, Field>
-                        ): Field {
-    const cFull: Field =
-            transientHash<SchnorrHashInput<4>>(
-              SchnorrHashInput<4> { ann_x: ann_x, ann_y: ann_y, pk_x: pk_x, pk_y: pk_y, msg: msg }
-              );
-    return (cFull as JubjubScalar) as Field;
-  }
-}