@sig-net/midnight 0.10.0 → 0.11.0

package/README.md

@@ -88,7 +88,7 @@ Set up your contract for integration with the Sig Network MPC's sign bidirection
    // Configured and sized here for an EVM Type 2 transaction with
    // <1 calldata word, 0 access-list entries, 0 storage keys> and
    // 34-byte serialisation schemas.
-   export ledger signBidirectionalEventMap: SignBidirectionalEventMap<EVMType2TxParams<1, 0, 0>, 34, 34>;
+   export ledger signBidirectionalEventMap: SignBidirectionalEventMap<EvmType2TxParams<1, 0, 0>, 34, 34>;
 
    // Required: The Signet singleton signer interface, set at deploy.
    // Used to notify the MPC of events you add to your signBidirectionalEventMap.
@@ -176,8 +176,8 @@ const expectedSigner = deriveEvmAddress(mpcRootPublicKey, myContractAddress, "my
 
    ```compact
    // Construct SignBidirectionalEvent signature request and calculate its RequestId
-   const request = constructSignBidirectionalEvent<EVMType2TxParams<1, 0, 0>, 34, 34>(/* ... */);
-   const requestId = disclose(calculateRequestId<EVMType2TxParams<1, 0, 0>, 34, 34>(request));
+   const request = constructSignBidirectionalEvent<EvmType2TxParams<1, 0, 0>, 34, 34>(/* ... */);
+   const requestId = disclose(calculateRequestId<EvmType2TxParams<1, 0, 0>, 34, 34>(request));
 
    // Store the signature request in your signBidirectionalEventMap for MPC to discover
    signetRequestNonce.increment(1);
@@ -185,7 +185,7 @@ const expectedSigner = deriveEvmAddress(mpcRootPublicKey, myContractAddress, "my
 
    // Notify the MPC of the SignBidirectionalEvent and the location of your signBidirectionalEventMap.
    // The location is 0 here based on the position of the declaration in Setup step 2.
-   signetSigner.signBidirectionalEvent(
+   signetSigner.signBidirectional(
       requestId,
       constructSignBidirectionalEventNotificationV1(kernel.self(), 0 as Uint<8>),
    );
@@ -205,7 +205,7 @@ const expectedSigner = deriveEvmAddress(mpcRootPublicKey, myContractAddress, "my
    ```ts
    import { JsonRpcProvider } from "ethers";
 
-   const signedTx = await reader.getSignedEVMTransaction(requestId, expectedSigner);
+   const signedTx = await reader.getSignedEvmTransaction(requestId, expectedSigner);
    await new JsonRpcProvider(foreignChainRpcUrl).broadcastTransaction(signedTx.serialized);
    ```
 
@@ -228,7 +228,7 @@ const expectedSigner = deriveEvmAddress(mpcRootPublicKey, myContractAddress, "my
 
 ## EVM Type 2 transactions and ABI calldata words
 
-An `EVMType2TxParams` request decomposes the EVM transaction into typed fields your contract can enforce field by field in-circuit. Its optional `calldata` is an `EVMCalldata<maxWords>`: the 4-byte function selector plus a list of 32-byte ABI words, per the [Solidity ABI spec](https://docs.soliditylang.org/en/latest/abi-spec.html). Slots past `noWords` are unused capacity and never reach the transaction.
+An `EvmType2TxParams` request decomposes the EVM transaction into typed fields your contract can enforce field by field in-circuit. Its optional `calldata` is an `EvmCalldata<maxWords>`: the 4-byte function selector plus a list of 32-byte ABI words, per the [Solidity ABI spec](https://docs.soliditylang.org/en/latest/abi-spec.html). Slots past `noWords` are unused capacity and never reach the transaction.
 
 Every word must be stored in canonical ABI form (big-endian). The MPC signs a transaction whose calldata is exactly `selector || words[0..noWords]`, byte for byte, so a word stored in any other form becomes a signed transaction calling the foreign contract with garbage arguments. Compact's integer casts are little-endian, so do not hand-roll the byte order: build every word with the module's helper circuits, and read words back with the matching readers.
 
@@ -243,7 +243,7 @@ Every word must be stored in canonical ABI form (big-endian). The MPC signs a tr
 `transfer(address,uint256)`, selector `0xa9059cbb`, takes an address word and a numeric word:
 
 ```compact
-const calldata = EVMCalldata<2> {
+const calldata = EvmCalldata<2> {
   selector: Bytes[0xa9, 0x05, 0x9c, 0xbb],
   noWords: 2 as Uint<16>,
   words: [
@@ -258,7 +258,7 @@ const calldata = EVMCalldata<2> {
 `setApprovalForAll(address,bool)`, selector `0xa22cb465`:
 
 ```compact
-const calldata = EVMCalldata<2> {
+const calldata = EvmCalldata<2> {
   selector: Bytes[0xa2, 0x2c, 0xb4, 0x65],
   noWords: 2 as Uint<16>,
   words: [

package/dist/constants.d.ts

@@ -2,7 +2,7 @@
 export declare const CAIP2_ID_BYTES = 32;
 /** Width of `SignBidirectionalEvent.params` (`Bytes<64>`). */
 export declare const MPC_PARAMS_BYTES = 64;
-/** Width of `EVMCalldata.selector` (`Bytes<4>`) — the literal first 4 calldata bytes. */
+/** Width of `EvmCalldata.selector` (`Bytes<4>`) — the literal first 4 calldata bytes. */
 export declare const SELECTOR_BYTES = 4;
 /** Width of `RespondBidirectionalEvent.serializedOutput` (`Bytes<128>`). */
 export declare const SERIALIZED_OUTPUT_BYTES = 128;

package/dist/constants.js

@@ -11,7 +11,7 @@
 export const CAIP2_ID_BYTES = 32;
 /** Width of `SignBidirectionalEvent.params` (`Bytes<64>`). */
 export const MPC_PARAMS_BYTES = 64;
-/** Width of `EVMCalldata.selector` (`Bytes<4>`) — the literal first 4 calldata bytes. */
+/** Width of `EvmCalldata.selector` (`Bytes<4>`) — the literal first 4 calldata bytes. */
 export const SELECTOR_BYTES = 4;
 /** Width of `RespondBidirectionalEvent.serializedOutput` (`Bytes<128>`). */
 export const SERIALIZED_OUTPUT_BYTES = 128;

package/dist/ecdsa-attestation.d.ts

@@ -1,4 +1,5 @@
 import type { Secp256k1Point } from "@midnight-ntwrk/compact-runtime";
+import type { MpcSignature } from "./signet-contract-state-reader.ts";
 export type { Secp256k1Point } from "@midnight-ntwrk/compact-runtime";
 /** secp256k1 curve (group) order n. */
 export declare const SECP256K1_ORDER: bigint;
@@ -23,11 +24,30 @@ export declare function bytesToBigint(bytes: Uint8Array): bigint;
  * @returns The 32-byte little-endian encoding.
  */
 export declare function bigintToBytes32(n: bigint): Uint8Array;
+/**
+ * Convert big-endian bytes to a bigint (SEC1 coordinate order, the byte
+ * order the respond events' stored signature uses).
+ *
+ * @param bytes - Big-endian byte array.
+ * @returns The decoded non-negative integer.
+ */
+export declare function bytesToBigintBE(bytes: Uint8Array): bigint;
+/**
+ * Convert a bigint to exactly 32 BIG-endian bytes (SEC1 scalar/coordinate
+ * order, also the ABI word encoding) — the big-endian counterpart of
+ * {@link bigintToBytes32} and the inverse of {@link bytesToBigintBE}.
+ *
+ * @param value - The non-negative integer to encode.
+ * @returns The 32-byte big-endian encoding.
+ * @throws Error if the value is negative or does not fit 32 bytes.
+ */
+export declare function bigintToBytes32BE(value: bigint): Uint8Array;
 /**
  * An ECDSA signature over the attestation digest, in the MPC's canonical
  * `Signature { big_r, s, recovery_id }` spirit with `r` already reduced to
  * the scalar `big_r.x mod n` — the form Compact's `Secp256k1EcdsaSignature`
- * takes.
+ * takes. Build the stored form for posting in a respond event with
+ * {@link ecdsaSignatureToMpcSignature}.
  */
 export interface EcdsaSignature {
     /** Signature scalar r (= R.x mod n). */
@@ -49,6 +69,38 @@ export interface EcdsaSignature {
  * @returns The signature with its recovery id.
  */
 export declare function signAttestationDigest(digest: Uint8Array, secretKey: Uint8Array): EcdsaSignature;
+/**
+ * Build the stored-form signature both respond events carry from a
+ * scalar-form one: R is reconstructed by decompressing the curve point with
+ * x = `r` and the parity `recoveryId` names — undoing the compression an
+ * `r || s || v` signature performs. For MPC-side posters (the fakenet
+ * signer, tests). The negligible caveat: an R.x that overflowed the curve
+ * order cannot be told apart from its reduced twin, so reconstruction picks
+ * the x equal to `r` itself.
+ *
+ * @param signature - The scalar-form signature (the signer's output shape).
+ * @returns The stored-form signature: R as a full point, big-endian bytes.
+ * @throws Error if the recovery id is not 0 or 1, or `r` is not the x
+ *   coordinate of a secp256k1 point.
+ */
+export declare function ecdsaSignatureToMpcSignature(signature: EcdsaSignature): MpcSignature;
+/**
+ * Read a stored-form signature back into scalar form — the inverse of
+ * {@link ecdsaSignatureToMpcSignature}, for off-chain consumers building a
+ * transaction from the response. In-circuit verification does not need this:
+ * `verifyRespondBidirectionalEvent` takes the stored record as-is. `r` comes
+ * out as `bigR.x` reduced mod the curve order. Rejects records that do not
+ * even hold the shape, since posts are unauthenticated and a malformed
+ * record is garbage, not a signature. `bigR.y` is NOT checked against the
+ * curve or the recovery id: signature verification is the authority, not
+ * this decoder.
+ *
+ * @param signature - The stored-form signature as posted.
+ * @returns The scalar-form signature.
+ * @throws Error if a component has the wrong byte length or the recovery id
+ *   is not 0 or 1.
+ */
+export declare function mpcSignatureToEcdsaSignature(signature: MpcSignature): EcdsaSignature;
 /**
  * Parse a secp256k1 public key from SEC1 hex (compressed or uncompressed,
  * optional `0x` prefix) into the Compact runtime's `Secp256k1Point` shape —

package/dist/ecdsa-attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ecdsa-attestation.d.ts","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAItE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,uCAAuC;AACvC,eAAO,MAAM,eAAe,QAA2B,CAAC;AAExD,uEAAuE;AACvE,eAAO,MAAM,SAAS,iFAAiF,CAAC;AAExG;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAWD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,2DAA2D;IAC3D,CAAC,EAAE,MAAM,CAAC;IACV,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,UAAU,GACpB,cAAc,CAiBhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAcrE;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,cAAc,CAO1E"}
+{"version":3,"file":"ecdsa-attestation.d.ts","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAItE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,uCAAuC;AACvC,eAAO,MAAM,eAAe,QAA2B,CAAC;AAExD,uEAAuE;AACvE,eAAO,MAAM,SAAS,iFAAiF,CAAC;AAExG;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAW3D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,2DAA2D;IAC3D,CAAC,EAAE,MAAM,CAAC;IACV,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,UAAU,GACpB,cAAc,CAiBhB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,cAAc,GAAG,YAAY,CAmBpF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,YAAY,GAAG,cAAc,CAapF;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAcrE;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,cAAc,CAO1E"}

package/dist/ecdsa-attestation.js

@@ -1,8 +1,8 @@
 // secp256k1 ECDSA helpers: the TS side of the respond-bidirectional
 // attestation flow in Signet.compact — SIGNING (which needs the secret
 // scalar, so it cannot be a circuit), key parsing/formatting, and the
-// byte-order conversions between noble's bigints and the ledger-stored
-// little-endian scalar bytes. Everything provable stays in Compact: the
+// byte-order conversions between noble's bigints and the little-endian
+// scalar bytes Compact's casts read. Everything provable stays in Compact: the
 // attestation digest is the COMPILED `pureCircuits.signetAttestationDigest`,
 // verification is `pureCircuits.verifyRespondBidirectionalEvent` (the same
 // check client contracts run in-circuit), and the deploy-time key pin is
@@ -48,14 +48,41 @@ export function bigintToBytes32(n) {
     }
     return buf;
 }
-/** Convert big-endian bytes to a bigint (SEC1 coordinate order). */
-function bytesToBigintBE(bytes) {
+/**
+ * Convert big-endian bytes to a bigint (SEC1 coordinate order, the byte
+ * order the respond events' stored signature uses).
+ *
+ * @param bytes - Big-endian byte array.
+ * @returns The decoded non-negative integer.
+ */
+export function bytesToBigintBE(bytes) {
     let value = 0n;
     for (const byte of bytes) {
         value = (value << 8n) | BigInt(byte);
     }
     return value;
 }
+/**
+ * Convert a bigint to exactly 32 BIG-endian bytes (SEC1 scalar/coordinate
+ * order, also the ABI word encoding) — the big-endian counterpart of
+ * {@link bigintToBytes32} and the inverse of {@link bytesToBigintBE}.
+ *
+ * @param value - The non-negative integer to encode.
+ * @returns The 32-byte big-endian encoding.
+ * @throws Error if the value is negative or does not fit 32 bytes.
+ */
+export function bigintToBytes32BE(value) {
+    if (value < 0n || value >= 1n << 256n) {
+        throw new Error(`value does not fit 32 big-endian bytes: ${value}`);
+    }
+    const out = new Uint8Array(32);
+    let v = value;
+    for (let i = 31; i >= 0; i--) {
+        out[i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    return out;
+}
 /**
  * ECDSA-sign a 32-byte digest with a secp256k1 secret key, exactly as the
  * MPC signs the attestation digest: RFC 6979 deterministic, low-s, the digest
@@ -85,6 +112,71 @@ export function signAttestationDigest(digest, secretKey) {
     /* v8 ignore next: unreachable for a signature this function just produced */
     throw new Error("signature does not recover to its own public key");
 }
+/**
+ * Build the stored-form signature both respond events carry from a
+ * scalar-form one: R is reconstructed by decompressing the curve point with
+ * x = `r` and the parity `recoveryId` names — undoing the compression an
+ * `r || s || v` signature performs. For MPC-side posters (the fakenet
+ * signer, tests). The negligible caveat: an R.x that overflowed the curve
+ * order cannot be told apart from its reduced twin, so reconstruction picks
+ * the x equal to `r` itself.
+ *
+ * @param signature - The scalar-form signature (the signer's output shape).
+ * @returns The stored-form signature: R as a full point, big-endian bytes.
+ * @throws Error if the recovery id is not 0 or 1, or `r` is not the x
+ *   coordinate of a secp256k1 point.
+ */
+export function ecdsaSignatureToMpcSignature(signature) {
+    if (signature.recoveryId !== 0 && signature.recoveryId !== 1) {
+        throw new Error(`expected a recovery id of 0 or 1, got ${signature.recoveryId}`);
+    }
+    // SEC1 compressed form: parity prefix (02 even, 03 odd) || x big-endian.
+    const parityPrefix = signature.recoveryId === 0 ? "02" : "03";
+    const xHex = signature.r.toString(16).padStart(64, "0");
+    let point;
+    try {
+        point = secp256k1.Point.fromHex(`${parityPrefix}${xHex}`);
+    }
+    catch (error) {
+        throw new Error(`signature r is not the x coordinate of a secp256k1 point (${String(error)})`);
+    }
+    const uncompressed = point.toBytes(false); // 0x04 || x || y
+    return {
+        bigR: { x: uncompressed.slice(1, 33), y: uncompressed.slice(33, 65) },
+        s: bigintToBytes32BE(signature.s),
+        recoveryId: BigInt(signature.recoveryId),
+    };
+}
+/**
+ * Read a stored-form signature back into scalar form — the inverse of
+ * {@link ecdsaSignatureToMpcSignature}, for off-chain consumers building a
+ * transaction from the response. In-circuit verification does not need this:
+ * `verifyRespondBidirectionalEvent` takes the stored record as-is. `r` comes
+ * out as `bigR.x` reduced mod the curve order. Rejects records that do not
+ * even hold the shape, since posts are unauthenticated and a malformed
+ * record is garbage, not a signature. `bigR.y` is NOT checked against the
+ * curve or the recovery id: signature verification is the authority, not
+ * this decoder.
+ *
+ * @param signature - The stored-form signature as posted.
+ * @returns The scalar-form signature.
+ * @throws Error if a component has the wrong byte length or the recovery id
+ *   is not 0 or 1.
+ */
+export function mpcSignatureToEcdsaSignature(signature) {
+    const { bigR, s, recoveryId } = signature;
+    if (bigR.x.length !== 32 || bigR.y.length !== 32 || s.length !== 32) {
+        throw new Error("expected 32-byte bigR.x/bigR.y/s in a stored signature");
+    }
+    if (recoveryId !== 0n && recoveryId !== 1n) {
+        throw new Error(`expected a recovery id of 0 or 1, got ${recoveryId}`);
+    }
+    return {
+        r: bytesToBigintBE(bigR.x) % SECP256K1_ORDER,
+        s: bytesToBigintBE(s),
+        recoveryId: Number(recoveryId),
+    };
+}
 /**
  * Parse a secp256k1 public key from SEC1 hex (compressed or uncompressed,
  * optional `0x` prefix) into the Compact runtime's `Secp256k1Point` shape —

package/dist/ecdsa-attestation.js.map

@@ -1 +1 @@
-{"version":3,"file":"ecdsa-attestation.js","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,6EAA6E;AAC7E,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,yEAAyE;AACzE,8BAA8B;AAE9B,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAOvD,uCAAuC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAExD,uEAAuE;AACvE,MAAM,CAAC,MAAM,SAAS,GAAG,8EAA8E,CAAC;AAExG;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAiBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,SAAqB;IAErB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/D,wEAAwE;IACxE,MAAM,EAAE,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,MAAM,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,GAAG;aAClB,cAAc,CAAC,UAAU,CAAC;aAC1B,gBAAgB,CAAC,MAAM,CAAC;aACxB,KAAK,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtF,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;IAC5D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAqB;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAqB;IACxD,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ecdsa-attestation.js","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,+EAA+E;AAC/E,6EAA6E;AAC7E,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,yEAAyE;AACzE,8BAA8B;AAE9B,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AASvD,uCAAuC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAExD,uEAAuE;AACvE,MAAM,CAAC,MAAM,SAAS,GAAG,8EAA8E,CAAC;AAExG;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAkBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,SAAqB;IAErB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/D,wEAAwE;IACxE,MAAM,EAAE,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,MAAM,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,GAAG;aAClB,cAAc,CAAC,UAAU,CAAC;aAC1B,gBAAgB,CAAC,MAAM,CAAC;aACxB,KAAK,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAyB;IACpE,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,yEAAyE;IACzE,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,YAAY,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6DAA6D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;IAC5D,OAAO;QACL,IAAI,EAAE,EAAE,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACrE,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QACjC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAuB;IAClE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;IAC1C,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yCAAyC,UAAU,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe;QAC5C,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtF,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;IAC5D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAqB;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAqB;IACxD,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC"}

package/dist/epsilon-derivation.d.ts

@@ -1,10 +1,10 @@
 import { type Secp256k1Point } from "./ecdsa-attestation.ts";
 /**
- * Domain prefix of the sig-net v1.0.0 epsilon derivation scheme, as used by
- * the live response server. The full derivation string is
- * `<prefix>,<chainId>,<requester>,<path>` (comma-separated).
+ * Domain prefix of the sig-net v2.0.0 epsilon derivation scheme. The full
+ * derivation string is `<prefix>:<chainId>:<requester>:<path>` (colon-separated),
+ * matching `caip2_derivation_path` in the MPC's `crypto/src/kdf.rs`.
  */
-export declare const EPSILON_DERIVATION_PREFIX = "sig.network v1.0.0 epsilon derivation";
+export declare const EPSILON_DERIVATION_PREFIX = "sig.network v2.0.0 epsilon derivation";
 /**
  * CAIP-2 chain id under which the MPC derives keys for requests originating
  * from Midnight contracts.
@@ -29,8 +29,8 @@ export declare const MIDNIGHT_TESTNET_CHAIN_ID = "midnight:testnet";
 export declare const MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH = "midnight response key";
 /**
  * Derive the EVM address the MPC network signs from for a given Midnight
- * contract and derivation path, using the sig-net v1.0.0 epsilon scheme:
- * `epsilon = keccak256("<prefix>,<chainId>,<contractAddress>,<path>")` and
+ * contract and derivation path, using the sig-net v2.0.0 epsilon scheme:
+ * `epsilon = keccak256("<prefix>:<chainId>:<contractAddress>:<path>")` and
  * `derivedPubKey = mpcRootPubKey + epsilon * G` on secp256k1.
  *
  * The MPC treats `path` as an opaque string: the vault's own account uses the
@@ -48,8 +48,8 @@ export declare const MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH = "midnight response ke
  */
 export declare function deriveEvmAddress(mpcSecp256k1PubkeyHex: string, contractAddress: string, path: string, chainId?: string): string;
 /**
- * The epsilon scalar of the sig-net v1.0.0 derivation scheme:
- * `keccak256("<prefix>,<chainId>,<requester>,<path>")` reduced mod the
+ * The epsilon scalar of the sig-net v2.0.0 derivation scheme:
+ * `keccak256("<prefix>:<chainId>:<requester>:<path>")` reduced mod the
  * secp256k1 curve order. Child keys are `root + epsilon` (secret side) and
  * `rootPubKey + epsilon * G` (public side).
  *

package/dist/epsilon-derivation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"epsilon-derivation.d.ts","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAeA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,0CAA0C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mCAAmC,0BAA0B,CAAC;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,EAC7B,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAGR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAKR;AA6BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,qBAAqB,EAAE,MAAM,EAC7B,qBAAqB,EAAE,MAAM,GAC5B,cAAc,CAQhB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,UAAU,EAC5B,qBAAqB,EAAE,MAAM,GAC5B,UAAU,CAwBZ"}
+{"version":3,"file":"epsilon-derivation.d.ts","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAaA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,0CAA0C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mCAAmC,0BAA0B,CAAC;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,EAC7B,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAGR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAKR;AA6BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,qBAAqB,EAAE,MAAM,EAC7B,qBAAqB,EAAE,MAAM,GAC5B,cAAc,CAQhB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,UAAU,EAC5B,qBAAqB,EAAE,MAAM,GAC5B,UAAU,CAwBZ"}

package/dist/epsilon-derivation.js

@@ -1,23 +1,21 @@
 // Epsilon key derivation: contract address + path -> derived EVM account.
 //
 // This belongs in github.com/sig-net/signet.js — kept here until upstreamed.
-// It is NOT imported from signet.js because signet.js's `deriveChildPublicKey`
-// implements the v2.0.0 COLON-separated epsilon format
-// (`sig.network v2.0.0 epsilon derivation:<chainId>:<requester>:<path>`),
-// which is incompatible with the live sig-net response server's v1.0.0
-// COMMA-separated format (see solana-signet-program
-// clients/response-server/src/modules/CryptoUtils.ts). The two schemes hash
-// different strings and therefore derive different accounts; this module
-// matches the server.
+//
+// v2.0.0 (COLON-separated) is the only scheme the MPC answers. The v1.0.0
+// COMMA-separated form is `key_version 0` in the MPC's KDF and is not served;
+// the Compact contracts also assert `keyVersion >= 1`, which selects v2. The
+// two schemes hash different strings and derive different accounts, so a
+// v1 signer silently gets the wrong address rather than an error.
 import { secp256k1 } from "@noble/curves/secp256k1.js";
 import { computeAddress, keccak256, SigningKey, toUtf8Bytes } from "ethers";
 import { SECP256K1_ORDER } from "./ecdsa-attestation.js";
 /**
- * Domain prefix of the sig-net v1.0.0 epsilon derivation scheme, as used by
- * the live response server. The full derivation string is
- * `<prefix>,<chainId>,<requester>,<path>` (comma-separated).
+ * Domain prefix of the sig-net v2.0.0 epsilon derivation scheme. The full
+ * derivation string is `<prefix>:<chainId>:<requester>:<path>` (colon-separated),
+ * matching `caip2_derivation_path` in the MPC's `crypto/src/kdf.rs`.
  */
-export const EPSILON_DERIVATION_PREFIX = "sig.network v1.0.0 epsilon derivation";
+export const EPSILON_DERIVATION_PREFIX = "sig.network v2.0.0 epsilon derivation";
 /**
  * CAIP-2 chain id under which the MPC derives keys for requests originating
  * from Midnight contracts.
@@ -42,8 +40,8 @@ export const MIDNIGHT_TESTNET_CHAIN_ID = "midnight:testnet";
 export const MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH = "midnight response key";
 /**
  * Derive the EVM address the MPC network signs from for a given Midnight
- * contract and derivation path, using the sig-net v1.0.0 epsilon scheme:
- * `epsilon = keccak256("<prefix>,<chainId>,<contractAddress>,<path>")` and
+ * contract and derivation path, using the sig-net v2.0.0 epsilon scheme:
+ * `epsilon = keccak256("<prefix>:<chainId>:<contractAddress>:<path>")` and
  * `derivedPubKey = mpcRootPubKey + epsilon * G` on secp256k1.
  *
  * The MPC treats `path` as an opaque string: the vault's own account uses the
@@ -64,8 +62,8 @@ export function deriveEvmAddress(mpcSecp256k1PubkeyHex, contractAddress, path, c
     return computeAddress(`0x${derivedPoint.toHex(false)}`);
 }
 /**
- * The epsilon scalar of the sig-net v1.0.0 derivation scheme:
- * `keccak256("<prefix>,<chainId>,<requester>,<path>")` reduced mod the
+ * The epsilon scalar of the sig-net v2.0.0 derivation scheme:
+ * `keccak256("<prefix>:<chainId>:<requester>:<path>")` reduced mod the
  * secp256k1 curve order. Child keys are `root + epsilon` (secret side) and
  * `rootPubKey + epsilon * G` (public side).
  *
@@ -76,7 +74,7 @@ export function deriveEvmAddress(mpcSecp256k1PubkeyHex, contractAddress, path, c
  * @returns The epsilon scalar, in `[0, n)`.
  */
 export function deriveEpsilon(requester, path, chainId = MIDNIGHT_TESTNET_CHAIN_ID) {
-    const fullPath = `${EPSILON_DERIVATION_PREFIX},${chainId},${requester},${path}`;
+    const fullPath = `${EPSILON_DERIVATION_PREFIX}:${chainId}:${requester}:${path}`;
     // Reduce mod n before using: noble throws on scalars >= n, whereas the
     // server's scalar arithmetic reduces implicitly.
     return BigInt(keccak256(toUtf8Bytes(fullPath))) % SECP256K1_ORDER;

package/dist/epsilon-derivation.js.map

@@ -1 +1 @@
-{"version":3,"file":"epsilon-derivation.js","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,6EAA6E;AAC7E,+EAA+E;AAC/E,uDAAuD;AACvD,0EAA0E;AAC1E,uEAAuE;AACvE,oDAAoD;AACpD,4EAA4E;AAC5E,yEAAyE;AACzE,sBAAsB;AAEtB,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAuB,MAAM,wBAAwB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,uCAAuC,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAE5D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,uBAAuB,CAAC;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,qBAA6B,EAC7B,eAAuB,EACvB,IAAY,EACZ,UAAkB,yBAAyB;IAE3C,MAAM,YAAY,GAAG,gBAAgB,CAAC,qBAAqB,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7F,OAAO,cAAc,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,IAAY,EACZ,UAAkB,yBAAyB;IAE3C,MAAM,QAAQ,GAAG,GAAG,yBAAyB,IAAI,OAAO,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;IAChF,uEAAuE;IACvE,iDAAiD;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC;AACpE,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CACvB,qBAA6B,EAC7B,SAAiB,EACjB,IAAY,EACZ,OAAe;IAEf,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,eAAuB;IACxD,MAAM,GAAG,GACP,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC;QAClE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,eAAe,CAAC;IACtB,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,qBAA6B,EAC7B,qBAA6B;IAE7B,MAAM,KAAK,GAAG,gBAAgB,CAC5B,qBAAqB,EACrB,yBAAyB,CAAC,qBAAqB,CAAC,EAChD,mCAAmC,EACnC,yBAAyB,CAC1B,CAAC;IACF,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAC7C,gBAA4B,EAC5B,qBAA6B;IAE7B,IAAI,gBAAgB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAC3B,yBAAyB,CAAC,qBAAqB,CAAC,EAChD,mCAAmC,EACnC,yBAAyB,CAC1B,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,eAAe,CAAC;IACjD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;QAC/B,KAAK,KAAK,EAAE,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"epsilon-derivation.js","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,EAAE;AACF,6EAA6E;AAC7E,EAAE;AACF,0EAA0E;AAC1E,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,kEAAkE;AAElE,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAE5E,OAAO,EAAE,eAAe,EAAuB,MAAM,wBAAwB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,uCAAuC,CAAC;AAEjF;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,kBAAkB,CAAC;AAE5D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,uBAAuB,CAAC;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,qBAA6B,EAC7B,eAAuB,EACvB,IAAY,EACZ,UAAkB,yBAAyB;IAE3C,MAAM,YAAY,GAAG,gBAAgB,CAAC,qBAAqB,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IAC7F,OAAO,cAAc,CAAC,KAAK,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,SAAiB,EACjB,IAAY,EACZ,UAAkB,yBAAyB;IAE3C,MAAM,QAAQ,GAAG,GAAG,yBAAyB,IAAI,OAAO,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;IAChF,uEAAuE;IACvE,iDAAiD;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC;AACpE,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CACvB,qBAA6B,EAC7B,SAAiB,EACjB,IAAY,EACZ,OAAe;IAEf,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,aAAa,GAAG,UAAU,CAAC,gBAAgB,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,eAAuB;IACxD,MAAM,GAAG,GACP,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,UAAU,CAAC,IAAI,CAAC;QAClE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1B,CAAC,CAAC,eAAe,CAAC;IACtB,OAAO,GAAG,CAAC,WAAW,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,qBAA6B,EAC7B,qBAA6B;IAE7B,MAAM,KAAK,GAAG,gBAAgB,CAC5B,qBAAqB,EACrB,yBAAyB,CAAC,qBAAqB,CAAC,EAChD,mCAAmC,EACnC,yBAAyB,CAC1B,CAAC;IACF,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,+BAA+B,CAC7C,gBAA4B,EAC5B,qBAA6B;IAE7B,IAAI,gBAAgB,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,6CAA6C,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAC3B,yBAAyB,CAAC,qBAAqB,CAAC,EAChD,mCAAmC,EACnC,yBAAyB,CAC1B,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,eAAe,CAAC;IACjD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;QAC/B,KAAK,KAAK,EAAE,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/managed/compiler/contract-info.json

@@ -75,13 +75,6 @@
             "type-name": "Bytes",
             "length": 128
           }
-        },
-        {
-          "name": "outputLen",
-          "type": {
-            "type-name": "Uint",
-            "maxval": 255
-          }
         }
       ],
       "result-type": {
@@ -126,24 +119,49 @@
                 }
               },
               {
-                "name": "r",
-                "type": {
-                  "type-name": "Bytes",
-                  "length": 32
-                }
-              },
-              {
-                "name": "s",
-                "type": {
-                  "type-name": "Bytes",
-                  "length": 32
-                }
-              },
-              {
-                "name": "recoveryId",
+                "name": "signature",
                 "type": {
-                  "type-name": "Uint",
-                  "maxval": 255
+                  "type-name": "Struct",
+                  "name": "Signature",
+                  "elements": [
+                    {
+                      "name": "bigR",
+                      "type": {
+                        "type-name": "Struct",
+                        "name": "AffinePoint",
+                        "elements": [
+                          {
+                            "name": "x",
+                            "type": {
+                              "type-name": "Bytes",
+                              "length": 32
+                            }
+                          },
+                          {
+                            "name": "y",
+                            "type": {
+                              "type-name": "Bytes",
+                              "length": 32
+                            }
+                          }
+                        ]
+                      }
+                    },
+                    {
+                      "name": "s",
+                      "type": {
+                        "type-name": "Bytes",
+                        "length": 32
+                      }
+                    },
+                    {
+                      "name": "recoveryId",
+                      "type": {
+                        "type-name": "Uint",
+                        "maxval": 255
+                      }
+                    }
+                  ]
                 }
               }
             ]

package/dist/managed/compiler/contract-manifest.json

@@ -7,26 +7,26 @@
     "type": "directory",
     "contract-info.json": {
       "type": "file",
-      "size": 6108,
-      "hash": "936ac5ce6f9907eaa010e61295bf2c42cd10410458791ac8b431829876e5bf61"
+      "size": 6935,
+      "hash": "fd5062d1dd4a2e8f0a6295dd28e33631aac7829d6ae4c5f07acdc1be2c57d218"
     }
   },
   "contract": {
     "type": "directory",
     "index.d.ts": {
       "type": "file",
-      "size": 5153,
-      "hash": "8e0669479f86b45d1b561c351ca2952932c3407cb993be10a27a54db732863b3"
+      "size": 5683,
+      "hash": "b974f22abb20ac4d35a8b532dfee9becdcc17f2f7d4b4ab3eea480b584de087e"
     },
     "index.js": {
       "type": "file",
-      "size": 41463,
-      "hash": "0166a441ee087c3376b035286cdc2b94b4bf20f1df977c862a420a84b7912eaf"
+      "size": 43240,
+      "hash": "88f3c259fe0a38d3b6a88fc497a36c28b2908e9ac4acde7f478537c4da9e1de5"
     },
     "index.js.map": {
       "type": "file",
-      "size": 3469,
-      "hash": "468d63e7361fae52cee908332606da3d854de3b5c4e73c49c1f049501ddb1ac2"
+      "size": 3820,
+      "hash": "0201ceb0f1f99727aec454888c558105ef8e1f4fde7a4ae8ea87245876269303"
     }
   }
 }

package/dist/managed/contract/index.d.ts

@@ -16,14 +16,16 @@ export type PureCircuits = {
                                                                                  payload: Uint8Array
                                                                                };
   signetAttestationDigest(requestId_0: Uint8Array,
-                          serializedOutput_0: Uint8Array,
-                          outputLen_0: bigint): Uint8Array;
+                          serializedOutput_0: Uint8Array): Uint8Array;
   verifyRespondBidirectionalEvent(requestId_0: Uint8Array,
                                   respondBidirectionalEvent_0: { serializedOutput: Uint8Array,
                                                                  outputLen: bigint,
-                                                                 r: Uint8Array,
-                                                                 s: Uint8Array,
-                                                                 recoveryId: bigint
+                                                                 signature: { bigR: { x: Uint8Array,
+                                                                                      y: Uint8Array
+                                                                                    },
+                                                                              s: Uint8Array,
+                                                                              recoveryId: bigint
+                                                                            }
                                                                },
                                   mpcResponseKey_0: __compactRuntime.Secp256k1Point): boolean;
   signetKeyHash(pk_0: __compactRuntime.Secp256k1Point): Uint8Array;
@@ -43,15 +45,17 @@ export type Circuits<PS> = {
                                                                                                                            }>>;
   signetAttestationDigest(context: __compactRuntime.CircuitContext<PS>,
                           requestId_0: Uint8Array,
-                          serializedOutput_0: Uint8Array,
-                          outputLen_0: bigint): Promise<__compactRuntime.CircuitResults<PS, Uint8Array>>;
+                          serializedOutput_0: Uint8Array): Promise<__compactRuntime.CircuitResults<PS, Uint8Array>>;
   verifyRespondBidirectionalEvent(context: __compactRuntime.CircuitContext<PS>,
                                   requestId_0: Uint8Array,
                                   respondBidirectionalEvent_0: { serializedOutput: Uint8Array,
                                                                  outputLen: bigint,
-                                                                 r: Uint8Array,
-                                                                 s: Uint8Array,
-                                                                 recoveryId: bigint
+                                                                 signature: { bigR: { x: Uint8Array,
+                                                                                      y: Uint8Array
+                                                                                    },
+                                                                              s: Uint8Array,
+                                                                              recoveryId: bigint
+                                                                            }
                                                                },
                                   mpcResponseKey_0: __compactRuntime.Secp256k1Point): Promise<__compactRuntime.CircuitResults<PS, boolean>>;
   signetKeyHash(context: __compactRuntime.CircuitContext<PS>,