@sig-net/midnight 0.0.6 → 0.0.8

package/README.md

@@ -8,13 +8,21 @@ The client-agnostic [Sig Network](https://sig.network) protocol library for the
   ```compact
   import "@sig-net/midnight/src/Signet";
   ```
-- **Compiled pure circuits** (`pureCircuits`): the executable reference implementation of the client-agnostic circuits (path/identity checks, the attestation-message digest, the sign-bidirectional notification packer). Off-chain code calls these compiled artefacts instead of re-porting the algorithms, so it always agrees with what the contracts prove.
+- **Compiled pure circuits** (`pureCircuits`): the executable reference implementation of the client-agnostic circuits (path/identity checks, the attestation message, the sign-bidirectional notification packer, the Schnorr challenge). Off-chain code calls these compiled artefacts instead of re-porting the algorithms, so it always agrees with what the contracts prove.
 - **TypeScript twins of the wire structs** and signet request-id computation.
 - **State readers, request feed and resolver**: poll the signet contract for pending requests and their signature / remote-execution responses.
-- **Crypto helpers**: epsilon derivation and secp256k1 ECDSA attestation signing/verification.
+- **Crypto helpers**: epsilon derivation and Jubjub Schnorr response verification.
 
 Where signet.js already covers something (for example EVM transaction preparation or address derivation), import it from there; only what is Midnight-specific lives here.
 
+## Derived keys
+
+Every key the MPC signs with is scoped by the requesting contract:
+
+`derivedSigningKey = f(mpcRootKey[keyVersion], contractAddress, path)`
+
+The path is 32 opaque bytes of the contract's choosing (a fixed literal for a contract-owned account, a hash of a caller's secret for per-user accounts). There are no format requirements. The contract address is always part of the derivation, so no contract can reach another contract's derived keys.
+
 ## Install
 
 ```sh
@@ -28,7 +36,7 @@ A signet-compliant client contract does four things:
 1. **Stores requests in a public index**: a `SignBidirectionalRequestIndex` map in its ledger. The index can sit at ANY ledger field: each notification the contract registers names the field position holding it, and the MPC reads the authenticated request from there. A contract-local `SignetNonce` counter is a convenient source of request nonces (identical requests must hash to distinct ids); nothing off-chain reads it.
 2. **Pins its counterparties at deploy time**: the central signet contract it notifies, and the MPC attestation key its verify circuit accepts.
 3. **Submits signature requests**: builds the transaction decomposition in-circuit, constructs the canonical request record, stores it in its own index under the request id, and registers a notification in the central registry (which the MPC polls; the MPC then reads the authenticated request back from the ledger field the notification names).
-4. **Verifies the execution response**: checks the attestation key, verifies the MPC's secp256k1 ECDSA attestation in-circuit over the digest of (request id, output), and consumes the request.
+4. **Verifies the execution response**: checks the attestation key, verifies the MPC's Schnorr attestation in-circuit over (request id, output), and consumes the request.
 
 ```compact
 pragma language_version >= 0.25;
@@ -49,8 +57,8 @@ export ledger signetNonce: SignetNonce;
 export sealed ledger mpcPubKeyHash: Bytes<32>;
 sealed ledger signetNotifier: SignetNotifier;
 
-constructor(mpcPk: Secp256k1Point, signetContract: SignetNotifier) {
-  mpcPubKeyHash = disclose(persistentHash<Secp256k1Point>(mpcPk));
+constructor(mpcPk: JubjubPoint, signetContract: SignetNotifier) {
+  mpcPubKeyHash = disclose(persistentHash<JubjubPoint>(mpcPk));
   signetNotifier = disclose(signetContract);
 }
 
@@ -103,27 +111,22 @@ export circuit submitSignatureRequest(evmNonce: Uint<64>, keyVersion: Uint<32>):
     constructSignBidirectionalNotificationV1(kernel.self(), requestId as Bytes<32>, 0 as Uint<8>));
 }
 
-// (4) Verify the MPC's secp256k1 ECDSA-signed attestation of the remote
-// execution and consume the request (double-verify protection). The signing
-// public key is passed alongside the record and pinned by hash.
-export circuit verifyResponse(
-  requestId: RequestId,
-  respondBidirectional: RespondBidirectional,
-  pk: Secp256k1Point
-): [] {
+// (4) Verify the MPC's Schnorr-signed attestation of the remote execution
+// and consume the request (double-verify protection).
+export circuit verifyResponse(requestId: RequestId, respondBidirectional: RespondBidirectional): [] {
   const rid = disclose(requestId);
   assert(
-    persistentHash<Secp256k1Point>(pk) == mpcPubKeyHash,
+    persistentHash<JubjubPoint>(respondBidirectional.pk) == mpcPubKeyHash,
     "Unauthorized: attestation pk is not the MPC key"
   );
   assert(
-    secp256k1EcdsaVerify(
+    jubjubSchnorrVerify<4>(
       signetAttestationMessage(rid, respondBidirectional.serializedOutput, respondBidirectional.outputLen),
-      Secp256k1EcdsaSignature {
-        r: respondBidirectional.sigR as Secp256k1Scalar,
-        s: respondBidirectional.sigS as Secp256k1Scalar,
+      JubjubSchnorrSignature {
+        announcement: respondBidirectional.announcement,
+        response: respondBidirectional.response,
       },
-      pk
+      respondBidirectional.pk
     ),
     "Invalid attestation signature"
   );
@@ -132,7 +135,7 @@ export circuit verifyResponse(
 }
 ```
 
-Between the two circuits sit the off-chain steps, which this package also covers: poll the central signet contract with `SignetRequestResponseReader` (configured with both contract addresses and the ledger field position of your request index) to collect and verify the MPC's secp256k1 signature (then broadcast the signed transaction to the destination chain), and later the ECDSA-attested execution output to feed back into `verifyResponse`.
+Between the two circuits sit the off-chain steps, which this package also covers: poll the central signet contract with `SignetRequestResponseReader` (configured with both contract addresses and the ledger field position of your request index) to collect and verify the MPC's secp256k1 signature (then broadcast the signed transaction to the destination chain), and later the Schnorr-attested execution output to feed back into `verifyResponse`.
 
 The [signet-caller contract](https://github.com/sig-net/midnight-integration/blob/main/packages/caller-contract/src/signet-caller.compact) is the complete, runnable version of this skeleton, exercised end to end by the repository's integration suite; a fuller application (an ERC20 cross-chain vault) lives in [sig-net/midnight-examples](https://github.com/sig-net/midnight-examples).
 

package/dist/constants.d.ts

@@ -1,18 +1,10 @@
-/** Width of `SignBidirectionalRequest.caip2Id` (`Bytes<32>`). */
+/** Width of `SignBidirectionalEvent.caip2Id` (`Bytes<32>`). */
 export declare const CAIP2_ID_BYTES = 32;
-/** Width of `SignBidirectionalRequest.algo` (`Bytes<32>`). */
-export declare const ALGO_BYTES = 32;
-/** Width of `SignBidirectionalRequest.dest` (`Bytes<32>`). */
-export declare const DEST_BYTES = 32;
-/** Width of `SignBidirectionalRequest.params` (`Bytes<64>`). */
+/** Width of `SignBidirectionalEvent.params` (`Bytes<64>`). */
 export declare const MPC_PARAMS_BYTES = 64;
-/** Width of `SignBidirectionalRequest.outputDeserializationSchema` (`Bytes<128>`). */
-export declare const OUTPUT_DESERIALIZATION_SCHEMA_BYTES = 128;
-/** Width of `SignBidirectionalRequest.respondSerializationSchema` (`Bytes<128>`). */
-export declare const RESPOND_SERIALIZATION_SCHEMA_BYTES = 128;
 /** Width of `EVMCalldata.selector` (`Bytes<4>`) — the literal first 4 calldata bytes. */
 export declare const SELECTOR_BYTES = 4;
-/** Width of `RespondBidirectional.serializedOutput` (`Bytes<128>`). */
+/** Width of `RespondBidirectionalEvent.serializedOutput` (`Bytes<128>`). */
 export declare const SERIALIZED_OUTPUT_BYTES = 128;
 /**
  * The MPC's error sentinel: `serializedOutput` beginning with these four
@@ -38,14 +30,10 @@ export declare function executionSucceeded(serializedOutput: Uint8Array): boolea
  * @returns `true` when the MPC reported an execution error.
  */
 export declare function isExecutionError(serializedOutput: Uint8Array): boolean;
-/** Signature algorithm the MPC uses for EVM chains (`algo` field value). */
-export declare const SIGNET_ALGO_ECDSA = "ecdsa";
-/** Destination chain family for EVM requests (`dest` field value). */
-export declare const SIGNET_DEST_ETHEREUM = "ethereum";
 /**
  * Default MPC key version (`keyVersion` field value). Version 0 is the
  * unsupported legacy format — the canonical MPC (and
- * `constructSignBidirectionalRequest`) requires `keyVersion >= 1`.
+ * `constructSignBidirectionalEvent`) requires `keyVersion >= 1`.
  */
 export declare const SIGNET_DEFAULT_KEY_VERSION = 1n;
 /**

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAUA,iEAAiE;AACjE,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,8DAA8D;AAC9D,eAAO,MAAM,UAAU,KAAK,CAAC;AAE7B,8DAA8D;AAC9D,eAAO,MAAM,UAAU,KAAK,CAAC;AAE7B,gEAAgE;AAChE,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,sFAAsF;AACtF,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,qFAAqF;AACrF,eAAO,MAAM,kCAAkC,MAAM,CAAC;AAEtD,yFAAyF;AACzF,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC,uEAAuE;AACvE,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAA2C,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAExE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAEtE;AAED,4EAA4E;AAC5E,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC,sEAAsE;AACtE,eAAO,MAAM,oBAAoB,aAAa,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAQpE"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAUA,+DAA+D;AAC/D,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,yFAAyF;AACzF,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAA2C,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAExE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAEtE;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAQpE"}

package/dist/constants.js

@@ -7,21 +7,13 @@
 //
 // The routing constants belong in github.com/sig-net/signet.js — kept here
 // until upstreamed.
-/** Width of `SignBidirectionalRequest.caip2Id` (`Bytes<32>`). */
+/** Width of `SignBidirectionalEvent.caip2Id` (`Bytes<32>`). */
 export const CAIP2_ID_BYTES = 32;
-/** Width of `SignBidirectionalRequest.algo` (`Bytes<32>`). */
-export const ALGO_BYTES = 32;
-/** Width of `SignBidirectionalRequest.dest` (`Bytes<32>`). */
-export const DEST_BYTES = 32;
-/** Width of `SignBidirectionalRequest.params` (`Bytes<64>`). */
+/** Width of `SignBidirectionalEvent.params` (`Bytes<64>`). */
 export const MPC_PARAMS_BYTES = 64;
-/** Width of `SignBidirectionalRequest.outputDeserializationSchema` (`Bytes<128>`). */
-export const OUTPUT_DESERIALIZATION_SCHEMA_BYTES = 128;
-/** Width of `SignBidirectionalRequest.respondSerializationSchema` (`Bytes<128>`). */
-export const RESPOND_SERIALIZATION_SCHEMA_BYTES = 128;
 /** Width of `EVMCalldata.selector` (`Bytes<4>`) — the literal first 4 calldata bytes. */
 export const SELECTOR_BYTES = 4;
-/** Width of `RespondBidirectional.serializedOutput` (`Bytes<128>`). */
+/** Width of `RespondBidirectionalEvent.serializedOutput` (`Bytes<128>`). */
 export const SERIALIZED_OUTPUT_BYTES = 128;
 /**
  * The MPC's error sentinel: `serializedOutput` beginning with these four
@@ -51,14 +43,10 @@ export function executionSucceeded(serializedOutput) {
 export function isExecutionError(serializedOutput) {
     return MPC_ERROR_SENTINEL.every((byte, index) => serializedOutput[index] === byte);
 }
-/** Signature algorithm the MPC uses for EVM chains (`algo` field value). */
-export const SIGNET_ALGO_ECDSA = "ecdsa";
-/** Destination chain family for EVM requests (`dest` field value). */
-export const SIGNET_DEST_ETHEREUM = "ethereum";
 /**
  * Default MPC key version (`keyVersion` field value). Version 0 is the
  * unsupported legacy format — the canonical MPC (and
- * `constructSignBidirectionalRequest`) requires `keyVersion >= 1`.
+ * `constructSignBidirectionalEvent`) requires `keyVersion >= 1`.
  */
 export const SIGNET_DEFAULT_KEY_VERSION = 1n;
 /**

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,kEAAkE;AAClE,EAAE;AACF,2EAA2E;AAC3E,oBAAoB;AAEpB,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAE7B,8DAA8D;AAC9D,MAAM,CAAC,MAAM,UAAU,GAAG,EAAE,CAAC;AAE7B,gEAAgE;AAChE,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,sFAAsF;AACtF,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAEvD,qFAAqF;AACrF,MAAM,CAAC,MAAM,kCAAkC,GAAG,GAAG,CAAC;AAEtD,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC,uEAAuE;AACvE,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,gBAA4B;IAC7D,OAAO,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,gBAA4B;IAC3D,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC,sEAAsE;AACtE,MAAM,CAAC,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,QAAQ,OAAO,CAAC,MAAM,6BAA6B,MAAM,aAAa,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,kEAAkE;AAClE,EAAE;AACF,2EAA2E;AAC3E,oBAAoB;AAEpB,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,gBAA4B;IAC7D,OAAO,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,gBAA4B;IAC3D,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,QAAQ,OAAO,CAAC,MAAM,6BAA6B,MAAM,aAAa,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/ecdsa-attestation.d.ts

@@ -0,0 +1,79 @@
+import type { Secp256k1Point } from "@midnight-ntwrk/compact-runtime";
+export type { Secp256k1Point } from "@midnight-ntwrk/compact-runtime";
+/** secp256k1 curve (group) order n. */
+export declare const SECP256K1_ORDER: bigint;
+/** BLS12-381 scalar field order (the Compact `Field` type modulus). */
+export declare const BLS_ORDER = 52435875175126190479447740508185965837690552500527637822603658699938581184513n;
+/**
+ * Convert little-endian bytes to a bigint. Matches Compact's
+ * `Bytes<32> as Field` / `Bytes<32> as Secp256k1Scalar` interpretation (both
+ * casts are little-endian).
+ *
+ * @param bytes - Little-endian byte array.
+ * @returns The decoded non-negative integer.
+ */
+export declare function bytesToBigint(bytes: Uint8Array): bigint;
+/**
+ * Convert a bigint to exactly 32 little-endian bytes. Matches Compact's
+ * `Field as Bytes<32>` / `Secp256k1Scalar as Bytes<32>` encoding (the inverse
+ * of {@link bytesToBigint}); negative inputs are interpreted in the BLS
+ * scalar field.
+ *
+ * @param n - The integer to encode.
+ * @returns The 32-byte little-endian encoding.
+ */
+export declare function bigintToBytes32(n: bigint): Uint8Array;
+/**
+ * An ECDSA signature over the attestation digest, in the MPC's canonical
+ * `Signature { big_r, s, recovery_id }` spirit with `r` already reduced to
+ * the scalar `big_r.x mod n` — the form Compact's `Secp256k1EcdsaSignature`
+ * takes.
+ */
+export interface EcdsaSignature {
+    /** Signature scalar r (= R.x mod n). */
+    r: bigint;
+    /** Signature scalar s (low-s normalised by the signer). */
+    s: bigint;
+    /** Recovery id (parity of R.y): 0 or 1. */
+    recoveryId: number;
+}
+/**
+ * ECDSA-sign a 32-byte digest with a secp256k1 secret key, exactly as the
+ * MPC signs the attestation digest: RFC 6979 deterministic, low-s, the digest
+ * interpreted big-endian with NO extra hashing (`prehash: false`) — the same
+ * convention `secp256k1EcdsaVerify` checks in-circuit.
+ *
+ * @param digest - The 32-byte digest to sign (e.g. the compiled
+ *   `pureCircuits.signetAttestationDigest` output).
+ * @param secretKey - The 32-byte secp256k1 secret key.
+ * @returns The signature with its recovery id.
+ */
+export declare function signAttestationDigest(digest: Uint8Array, secretKey: Uint8Array): EcdsaSignature;
+/**
+ * Parse a secp256k1 public key from SEC1 hex (compressed or uncompressed,
+ * optional `0x` prefix) into the Compact runtime's `Secp256k1Point` shape —
+ * how deploys receive the MPC response key to pin.
+ *
+ * @param value - The SEC1 hex public key.
+ * @returns The parsed point.
+ * @throws Error if the value is not a valid secp256k1 public key.
+ */
+export declare function parseSecp256k1PublicKey(value: string): Secp256k1Point;
+/**
+ * Format a secp256k1 public key point as uncompressed SEC1 hex (with `0x`
+ * prefix) — the round-trip inverse of {@link parseSecp256k1PublicKey}, for
+ * handing a response key to deploys via env/config.
+ *
+ * @param point - The point to format.
+ * @returns The `0x04…` uncompressed SEC1 hex string.
+ */
+export declare function formatSecp256k1PublicKey(point: Secp256k1Point): string;
+/**
+ * Derive the `Secp256k1Point` of a secret key — convenience for tests and
+ * signers that hold key material as raw bytes.
+ *
+ * @param secretKey - The 32-byte secp256k1 secret key.
+ * @returns The public key point.
+ */
+export declare function secp256k1PublicKeyOf(secretKey: Uint8Array): Secp256k1Point;
+//# sourceMappingURL=ecdsa-attestation.d.ts.map

package/dist/ecdsa-attestation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecdsa-attestation.d.ts","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAItE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,uCAAuC;AACvC,eAAO,MAAM,eAAe,QAA2B,CAAC;AAExD,uEAAuE;AACvE,eAAO,MAAM,SAAS,iFAAiF,CAAC;AAExG;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAWD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,2DAA2D;IAC3D,CAAC,EAAE,MAAM,CAAC;IACV,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,UAAU,GACpB,cAAc,CAiBhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAcrE;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,cAAc,CAO1E"}

package/dist/ecdsa-attestation.js

@@ -0,0 +1,140 @@
+// secp256k1 ECDSA helpers: the TS side of the respond-bidirectional
+// attestation flow in Signet.compact — SIGNING (which needs the secret
+// scalar, so it cannot be a circuit), key parsing/formatting, and the
+// byte-order conversions between noble's bigints and the ledger-stored
+// little-endian scalar bytes. Everything provable stays in Compact: the
+// attestation digest is the COMPILED `pureCircuits.signetAttestationDigest`,
+// verification is `pureCircuits.verifyRespondBidirectionalEvent` (the same
+// check client contracts run in-circuit), and the deploy-time key pin is
+// `pureCircuits.signetKeyHash` — this file never re-implements any of them.
+//
+// This belongs in github.com/sig-net/signet.js as its Midnight adapter —
+// kept here until upstreamed.
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+/** secp256k1 curve (group) order n. */
+export const SECP256K1_ORDER = secp256k1.Point.Fn.ORDER;
+/** BLS12-381 scalar field order (the Compact `Field` type modulus). */
+export const BLS_ORDER = 52435875175126190479447740508185965837690552500527637822603658699938581184513n;
+/**
+ * Convert little-endian bytes to a bigint. Matches Compact's
+ * `Bytes<32> as Field` / `Bytes<32> as Secp256k1Scalar` interpretation (both
+ * casts are little-endian).
+ *
+ * @param bytes - Little-endian byte array.
+ * @returns The decoded non-negative integer.
+ */
+export function bytesToBigint(bytes) {
+    let result = 0n;
+    for (let i = bytes.length - 1; i >= 0; i--) {
+        result = (result << 8n) | BigInt(bytes[i]);
+    }
+    return result;
+}
+/**
+ * Convert a bigint to exactly 32 little-endian bytes. Matches Compact's
+ * `Field as Bytes<32>` / `Secp256k1Scalar as Bytes<32>` encoding (the inverse
+ * of {@link bytesToBigint}); negative inputs are interpreted in the BLS
+ * scalar field.
+ *
+ * @param n - The integer to encode.
+ * @returns The 32-byte little-endian encoding.
+ */
+export function bigintToBytes32(n) {
+    const buf = new Uint8Array(32);
+    let v = n < 0n ? n + BLS_ORDER : n;
+    for (let i = 0; i < 32; i++) {
+        buf[i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    return buf;
+}
+/** Convert big-endian bytes to a bigint (SEC1 coordinate order). */
+function bytesToBigintBE(bytes) {
+    let value = 0n;
+    for (const byte of bytes) {
+        value = (value << 8n) | BigInt(byte);
+    }
+    return value;
+}
+/**
+ * ECDSA-sign a 32-byte digest with a secp256k1 secret key, exactly as the
+ * MPC signs the attestation digest: RFC 6979 deterministic, low-s, the digest
+ * interpreted big-endian with NO extra hashing (`prehash: false`) — the same
+ * convention `secp256k1EcdsaVerify` checks in-circuit.
+ *
+ * @param digest - The 32-byte digest to sign (e.g. the compiled
+ *   `pureCircuits.signetAttestationDigest` output).
+ * @param secretKey - The 32-byte secp256k1 secret key.
+ * @returns The signature with its recovery id.
+ */
+export function signAttestationDigest(digest, secretKey) {
+    const sigBytes = secp256k1.sign(digest, secretKey, { prehash: false });
+    const sig = secp256k1.Signature.fromBytes(sigBytes, "compact");
+    // Recover the id by trying both parities against the actual public key.
+    const pk = secp256k1.getPublicKey(secretKey, false);
+    const pkHex = Buffer.from(pk).toString("hex");
+    for (const recoveryId of [0, 1]) {
+        const recovered = sig
+            .addRecoveryBit(recoveryId)
+            .recoverPublicKey(digest)
+            .toHex(false);
+        if (recovered === pkHex) {
+            return { r: sig.r, s: sig.s, recoveryId };
+        }
+    }
+    /* v8 ignore next: unreachable for a signature this function just produced */
+    throw new Error("signature does not recover to its own public key");
+}
+/**
+ * Parse a secp256k1 public key from SEC1 hex (compressed or uncompressed,
+ * optional `0x` prefix) into the Compact runtime's `Secp256k1Point` shape —
+ * how deploys receive the MPC response key to pin.
+ *
+ * @param value - The SEC1 hex public key.
+ * @returns The parsed point.
+ * @throws Error if the value is not a valid secp256k1 public key.
+ */
+export function parseSecp256k1PublicKey(value) {
+    const hex = value.startsWith("0x") || value.startsWith("0X") ? value.slice(2) : value;
+    let point;
+    try {
+        point = secp256k1.Point.fromHex(hex);
+    }
+    catch (error) {
+        throw new Error(`not a secp256k1 public key in SEC1 hex: "${value}" (${String(error)})`);
+    }
+    const uncompressed = point.toBytes(false); // 0x04 || x || y
+    return {
+        x: bytesToBigintBE(uncompressed.slice(1, 33)),
+        y: bytesToBigintBE(uncompressed.slice(33, 65)),
+        identity: false,
+    };
+}
+/**
+ * Format a secp256k1 public key point as uncompressed SEC1 hex (with `0x`
+ * prefix) — the round-trip inverse of {@link parseSecp256k1PublicKey}, for
+ * handing a response key to deploys via env/config.
+ *
+ * @param point - The point to format.
+ * @returns The `0x04…` uncompressed SEC1 hex string.
+ */
+export function formatSecp256k1PublicKey(point) {
+    const toBE32 = (v) => v.toString(16).padStart(64, "0");
+    return `0x04${toBE32(point.x)}${toBE32(point.y)}`;
+}
+/**
+ * Derive the `Secp256k1Point` of a secret key — convenience for tests and
+ * signers that hold key material as raw bytes.
+ *
+ * @param secretKey - The 32-byte secp256k1 secret key.
+ * @returns The public key point.
+ */
+export function secp256k1PublicKeyOf(secretKey) {
+    const uncompressed = secp256k1.getPublicKey(secretKey, false);
+    return {
+        x: bytesToBigintBE(uncompressed.slice(1, 33)),
+        y: bytesToBigintBE(uncompressed.slice(33, 65)),
+        identity: false,
+    };
+}
+//# sourceMappingURL=ecdsa-attestation.js.map

package/dist/ecdsa-attestation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecdsa-attestation.js","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,6EAA6E;AAC7E,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,yEAAyE;AACzE,8BAA8B;AAE9B,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAOvD,uCAAuC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAExD,uEAAuE;AACvE,MAAM,CAAC,MAAM,SAAS,GAAG,8EAA8E,CAAC;AAExG;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAiBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,SAAqB;IAErB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/D,wEAAwE;IACxE,MAAM,EAAE,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,MAAM,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,GAAG;aAClB,cAAc,CAAC,UAAU,CAAC;aAC1B,gBAAgB,CAAC,MAAM,CAAC;aACxB,KAAK,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtF,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;IAC5D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAqB;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAqB;IACxD,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC"}

package/dist/epsilon-derivation.d.ts

@@ -1,3 +1,4 @@
+import { type Secp256k1Point } from "./ecdsa-attestation.ts";
 /**
  * Domain prefix of the sig-net v1.0.0 epsilon derivation scheme, as used by
  * the live response server. The full derivation string is
@@ -9,6 +10,23 @@ export declare const EPSILON_DERIVATION_PREFIX = "sig.network v1.0.0 epsilon der
  * from Midnight contracts.
  */
 export declare const MIDNIGHT_TESTNET_CHAIN_ID = "midnight:testnet";
+/**
+ * The FIXED derivation path of the MPC's respond-bidirectional RESPONSE key
+ * for Midnight client contracts, mirroring the real MPC's per-chain
+ * `<chain> response key` convention (sig-net/mpc
+ * chain-signatures/node/src/respond_bidirectional.rs, where the epsilon
+ * requester is the requesting tx's SENDER). The response key is derived PER
+ * CLIENT CONTRACT from (the client contract's own address, this path): it is
+ * not the MPC root key and not the key that signs the requested transaction.
+ *
+ * The key depends on the client contract's address, and a Midnight contract
+ * address is a hash over the deploy (constructor arguments included), so the
+ * key cannot exist before the deploy transaction is built. Client contracts
+ * therefore pin its hash with a one-shot `initialise` circuit right after
+ * deploy (never a constructor seal) and verify RespondBidirectionalEvents
+ * against the pin.
+ */
+export declare const MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH = "midnight response key";
 /**
  * Derive the EVM address the MPC network signs from for a given Midnight
  * contract and derivation path, using the sig-net v1.0.0 epsilon scheme:
@@ -29,4 +47,46 @@ export declare const MIDNIGHT_TESTNET_CHAIN_ID = "midnight:testnet";
  * @returns The derived EVM address as a 0x-prefixed EIP-55 checksummed string.
  */
 export declare function deriveEvmAddress(mpcSecp256k1PubkeyHex: string, contractAddress: string, path: string, chainId?: string): string;
+/**
+ * The epsilon scalar of the sig-net v1.0.0 derivation scheme:
+ * `keccak256("<prefix>,<chainId>,<requester>,<path>")` reduced mod the
+ * secp256k1 curve order. Child keys are `root + epsilon` (secret side) and
+ * `rootPubKey + epsilon * G` (public side).
+ *
+ * @param requester - The requester component of the derivation string,
+ *   verbatim (no normalisation: callers must agree on the exact rendering).
+ * @param path - The derivation path string.
+ * @param chainId - CAIP-2 chain id component of the derivation string.
+ * @returns The epsilon scalar, in `[0, n)`.
+ */
+export declare function deriveEpsilon(requester: string, path: string, chainId?: string): bigint;
+/**
+ * Derive the MPC's respond-bidirectional RESPONSE key for one client
+ * contract, public side: what the client pins via its `initialise` circuit
+ * (`MPC_RESPONSE_KEY`) and what response verification checks against. See
+ * {@link MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH} for the scheme (the requester
+ * is the client contract's own address, mirroring the real MPC's
+ * sender-scoped derivation).
+ *
+ * @param mpcSecp256k1PubkeyHex - The MPC root secp256k1 public key as 0x-hex
+ *   (compressed or uncompressed).
+ * @param clientContractAddress - The client contract's Midnight address
+ *   (`0x` prefix optional, case-insensitive).
+ * @returns The response public key as a Compact-runtime `Secp256k1Point`.
+ */
+export declare function deriveMidnightResponseKey(mpcSecp256k1PubkeyHex: string, clientContractAddress: string): Secp256k1Point;
+/**
+ * Derive the MPC's respond-bidirectional RESPONSE key for one client
+ * contract, secret side: `(rootSecret + epsilon) mod n`. MPC-side only
+ * (the fakenet signer, test harnesses): a real client never holds the root
+ * key. The result feeds `signAttestationDigest` directly.
+ *
+ * @param mpcRootSecretKey - The 32-byte MPC root secret key (big-endian, the
+ *   standard secp256k1 encoding).
+ * @param clientContractAddress - The client contract's Midnight address
+ *   (`0x` prefix optional, case-insensitive).
+ * @returns The 32-byte response secret key (big-endian).
+ * @throws Error if the root key is not 32 bytes or the derived scalar is 0.
+ */
+export declare function deriveMidnightResponseSecretKey(mpcRootSecretKey: Uint8Array, clientContractAddress: string): Uint8Array;
 //# sourceMappingURL=epsilon-derivation.d.ts.map

package/dist/epsilon-derivation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"epsilon-derivation.d.ts","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAeA;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,0CAA0C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,EAC7B,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CASR"}
+{"version":3,"file":"epsilon-derivation.d.ts","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAeA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,0CAA0C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mCAAmC,0BAA0B,CAAC;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,EAC7B,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAGR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAKR;AA6BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,qBAAqB,EAAE,MAAM,EAC7B,qBAAqB,EAAE,MAAM,GAC5B,cAAc,CAQhB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,UAAU,EAC5B,qBAAqB,EAAE,MAAM,GAC5B,UAAU,CAwBZ"}

package/dist/epsilon-derivation.js

@@ -11,6 +11,7 @@
 // matches the server.
 import { secp256k1 } from "@noble/curves/secp256k1.js";
 import { computeAddress, keccak256, SigningKey, toUtf8Bytes } from "ethers";
+import { SECP256K1_ORDER } from "./ecdsa-attestation.js";
 /**
  * Domain prefix of the sig-net v1.0.0 epsilon derivation scheme, as used by
  * the live response server. The full derivation string is
@@ -22,6 +23,23 @@ export const EPSILON_DERIVATION_PREFIX = "sig.network v1.0.0 epsilon derivation"
  * from Midnight contracts.
  */
 export const MIDNIGHT_TESTNET_CHAIN_ID = "midnight:testnet";
+/**
+ * The FIXED derivation path of the MPC's respond-bidirectional RESPONSE key
+ * for Midnight client contracts, mirroring the real MPC's per-chain
+ * `<chain> response key` convention (sig-net/mpc
+ * chain-signatures/node/src/respond_bidirectional.rs, where the epsilon
+ * requester is the requesting tx's SENDER). The response key is derived PER
+ * CLIENT CONTRACT from (the client contract's own address, this path): it is
+ * not the MPC root key and not the key that signs the requested transaction.
+ *
+ * The key depends on the client contract's address, and a Midnight contract
+ * address is a hash over the deploy (constructor arguments included), so the
+ * key cannot exist before the deploy transaction is built. Client contracts
+ * therefore pin its hash with a one-shot `initialise` circuit right after
+ * deploy (never a constructor seal) and verify RespondBidirectionalEvents
+ * against the pin.
+ */
+export const MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH = "midnight response key";
 /**
  * Derive the EVM address the MPC network signs from for a given Midnight
  * contract and derivation path, using the sig-net v1.0.0 epsilon scheme:
@@ -42,13 +60,96 @@ export const MIDNIGHT_TESTNET_CHAIN_ID = "midnight:testnet";
  * @returns The derived EVM address as a 0x-prefixed EIP-55 checksummed string.
  */
 export function deriveEvmAddress(mpcSecp256k1PubkeyHex, contractAddress, path, chainId = MIDNIGHT_TESTNET_CHAIN_ID) {
-    const fullPath = `${EPSILON_DERIVATION_PREFIX},${chainId},${contractAddress},${path}`;
-    // Reduce mod n before multiplying: noble throws on scalars >= n, whereas the
+    const derivedPoint = deriveChildPoint(mpcSecp256k1PubkeyHex, contractAddress, path, chainId);
+    return computeAddress(`0x${derivedPoint.toHex(false)}`);
+}
+/**
+ * The epsilon scalar of the sig-net v1.0.0 derivation scheme:
+ * `keccak256("<prefix>,<chainId>,<requester>,<path>")` reduced mod the
+ * secp256k1 curve order. Child keys are `root + epsilon` (secret side) and
+ * `rootPubKey + epsilon * G` (public side).
+ *
+ * @param requester - The requester component of the derivation string,
+ *   verbatim (no normalisation: callers must agree on the exact rendering).
+ * @param path - The derivation path string.
+ * @param chainId - CAIP-2 chain id component of the derivation string.
+ * @returns The epsilon scalar, in `[0, n)`.
+ */
+export function deriveEpsilon(requester, path, chainId = MIDNIGHT_TESTNET_CHAIN_ID) {
+    const fullPath = `${EPSILON_DERIVATION_PREFIX},${chainId},${requester},${path}`;
+    // Reduce mod n before using: noble throws on scalars >= n, whereas the
     // server's scalar arithmetic reduces implicitly.
-    const epsilon = BigInt(keccak256(toUtf8Bytes(fullPath))) % secp256k1.Point.Fn.ORDER;
+    return BigInt(keccak256(toUtf8Bytes(fullPath))) % SECP256K1_ORDER;
+}
+/** Derive the child public key as a noble curve point (internal shape). */
+function deriveChildPoint(mpcSecp256k1PubkeyHex, requester, path, chainId) {
+    const epsilon = deriveEpsilon(requester, path, chainId);
     const rootPubKeyHex = SigningKey.computePublicKey(mpcSecp256k1PubkeyHex, false);
     const rootPoint = secp256k1.Point.fromHex(rootPubKeyHex.slice(2));
-    const derivedPoint = epsilon === 0n ? rootPoint : rootPoint.add(secp256k1.Point.BASE.multiply(epsilon));
-    return computeAddress(`0x${derivedPoint.toHex(false)}`);
+    return epsilon === 0n ? rootPoint : rootPoint.add(secp256k1.Point.BASE.multiply(epsilon));
+}
+/**
+ * Normalise a Midnight contract address for use as the requester component
+ * of the derivation string: strip an optional `0x` prefix and lowercase.
+ * Both sides of the protocol (the deploy pinning a key and the MPC signing
+ * with it) derive through this, so the rendering always agrees.
+ */
+function normaliseRequesterAddress(contractAddress) {
+    const hex = contractAddress.startsWith("0x") || contractAddress.startsWith("0X")
+        ? contractAddress.slice(2)
+        : contractAddress;
+    return hex.toLowerCase();
+}
+/**
+ * Derive the MPC's respond-bidirectional RESPONSE key for one client
+ * contract, public side: what the client pins via its `initialise` circuit
+ * (`MPC_RESPONSE_KEY`) and what response verification checks against. See
+ * {@link MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH} for the scheme (the requester
+ * is the client contract's own address, mirroring the real MPC's
+ * sender-scoped derivation).
+ *
+ * @param mpcSecp256k1PubkeyHex - The MPC root secp256k1 public key as 0x-hex
+ *   (compressed or uncompressed).
+ * @param clientContractAddress - The client contract's Midnight address
+ *   (`0x` prefix optional, case-insensitive).
+ * @returns The response public key as a Compact-runtime `Secp256k1Point`.
+ */
+export function deriveMidnightResponseKey(mpcSecp256k1PubkeyHex, clientContractAddress) {
+    const point = deriveChildPoint(mpcSecp256k1PubkeyHex, normaliseRequesterAddress(clientContractAddress), MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH, MIDNIGHT_TESTNET_CHAIN_ID);
+    return { x: point.x, y: point.y, identity: false };
+}
+/**
+ * Derive the MPC's respond-bidirectional RESPONSE key for one client
+ * contract, secret side: `(rootSecret + epsilon) mod n`. MPC-side only
+ * (the fakenet signer, test harnesses): a real client never holds the root
+ * key. The result feeds `signAttestationDigest` directly.
+ *
+ * @param mpcRootSecretKey - The 32-byte MPC root secret key (big-endian, the
+ *   standard secp256k1 encoding).
+ * @param clientContractAddress - The client contract's Midnight address
+ *   (`0x` prefix optional, case-insensitive).
+ * @returns The 32-byte response secret key (big-endian).
+ * @throws Error if the root key is not 32 bytes or the derived scalar is 0.
+ */
+export function deriveMidnightResponseSecretKey(mpcRootSecretKey, clientContractAddress) {
+    if (mpcRootSecretKey.length !== 32) {
+        throw new Error(`MPC root secret key must be 32 bytes, got ${mpcRootSecretKey.length}`);
+    }
+    let root = 0n;
+    for (const byte of mpcRootSecretKey) {
+        root = (root << 8n) | BigInt(byte);
+    }
+    const epsilon = deriveEpsilon(normaliseRequesterAddress(clientContractAddress), MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH, MIDNIGHT_TESTNET_CHAIN_ID);
+    const child = (root + epsilon) % SECP256K1_ORDER;
+    if (child === 0n) {
+        throw new Error("derived response secret key is zero (invalid scalar)");
+    }
+    const out = new Uint8Array(32);
+    let value = child;
+    for (let i = 31; i >= 0; i--) {
+        out[i] = Number(value & 0xffn);
+        value >>= 8n;
+    }
+    return out;
 }
 //# sourceMappingURL=epsilon-derivation.js.map