@sig-net/midnight 0.10.0 → 0.12.0

package/dist/constants.d.ts

@@ -2,42 +2,51 @@
 export declare const CAIP2_ID_BYTES = 32;
 /** Width of `SignBidirectionalEvent.params` (`Bytes<64>`). */
 export declare const MPC_PARAMS_BYTES = 64;
-/** Width of `EVMCalldata.selector` (`Bytes<4>`) — the literal first 4 calldata bytes. */
+/** Width of `EvmCalldata.selector` (`Bytes<4>`): the literal first 4 calldata bytes. */
 export declare const SELECTOR_BYTES = 4;
-/** Width of `RespondBidirectionalEvent.serializedOutput` (`Bytes<128>`). */
-export declare const SERIALIZED_OUTPUT_BYTES = 128;
 /**
- * The MPC's error sentinel: `serializedOutput` beginning with these four
+ * The MPC's error sentinel: a serialised output beginning with these four
  * bytes marks a failed/absent remote execution (mirrors the sig-net MPC's
  * MAGIC_ERROR_PREFIX).
  */
 export declare const MPC_ERROR_SENTINEL: Uint8Array<ArrayBuffer>;
 /**
- * Whether an attestation's serialized output reports a successful remote
- * execution: the first byte is 1 — the little-endian encoding of the
- * ABI-decoded success flag, matching the circuits'
- * `serializedOutput as Field == 1` check.
+ * The complete serialised output the MPC attests for a FAILED remote
+ * execution (reverted or replaced transaction): the error sentinel followed
+ * by one `0x01` byte. Schema-independent by design, mirroring the canonical
+ * MPC's Borsh-format failure payload (sig-net/mpc,
+ * node/src/respond_bidirectional.rs), so every respond schema shares one
+ * fixed 5-byte failure width. Clients recompute their failure candidate from
+ * this constant alone: no receipt or schema needed.
+ */
+export declare const MPC_FAILURE_OUTPUT: Uint8Array<ArrayBuffer>;
+/**
+ * Whether an attested serialised output reports a successful remote
+ * execution: the first byte is 1, the packed little-endian encoding of a
+ * leading boolean success flag. The output is the exact unpadded respond
+ * payload (see `serializeRespondOutput`), so its length follows from the
+ * request's respond schema.
  *
- * @param serializedOutput - The attestation's serialized output.
+ * @param serializedOutput - The attested serialised output.
  * @returns `true` when the remote call succeeded.
  */
 export declare function executionSucceeded(serializedOutput: Uint8Array): boolean;
 /**
- * Whether an attestation's serialized output is the MPC's error sentinel
- * (see {@link MPC_ERROR_SENTINEL}) rather than a call result.
+ * Whether an attested serialised output is the MPC's error sentinel
+ * (see {@link MPC_ERROR_SENTINEL}).
  *
- * @param serializedOutput - The attestation's serialized output.
+ * @param serializedOutput - The attested serialised output.
  * @returns `true` when the MPC reported an execution error.
  */
 export declare function isExecutionError(serializedOutput: Uint8Array): boolean;
 /**
  * Default MPC key version (`keyVersion` field value). Version 0 is the
- * unsupported legacy format — the canonical MPC (and
+ * unsupported legacy format: the canonical MPC (and
  * `constructSignBidirectionalEvent`) requires `keyVersion >= 1`.
  */
 export declare const SIGNET_DEFAULT_KEY_VERSION = 1n;
 /**
- * Encode text as zero-padded ASCII bytes — the Compact `pad(N, "text")`
+ * Encode text as zero-padded ASCII bytes, the Compact `pad(N, "text")`
  * convention every string-ish field of the request structs uses (consumers
  * NUL-trim on decode).
  *

package/dist/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAUA,+DAA+D;AAC/D,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,yFAAyF;AACzF,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC,4EAA4E;AAC5E,eAAO,MAAM,uBAAuB,MAAM,CAAC;AAE3C;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAA2C,CAAC;AAE3E;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAAC,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAExE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAEtE;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAQpE"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AASA,+DAA+D;AAC/D,eAAO,MAAM,cAAc,KAAK,CAAC;AAEjC,8DAA8D;AAC9D,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAEnC,wFAAwF;AACxF,eAAO,MAAM,cAAc,IAAI,CAAC;AAEhC;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,yBAA2C,CAAC;AAE3E;;;;;;;;GAQG;AACH,eAAO,MAAM,kBAAkB,yBAAiD,CAAC;AAEjF;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAExE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,gBAAgB,EAAE,UAAU,GAAG,OAAO,CAEtE;AAED;;;;GAIG;AACH,eAAO,MAAM,0BAA0B,KAAK,CAAC;AAE7C;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,UAAU,CAQpE"}

package/dist/constants.js

@@ -1,43 +1,51 @@
 // MPC routing constants + the padded-ASCII codec for the signet request
-// structs. Field widths mirror Signet.compact (the wire format —
-// keep in lockstep); the string constants are the values the MPC network
+// structs. Field widths mirror Signet.compact (the wire format: keep in
+// lockstep), and the string constants are the values the MPC network
 // routes on. Ported from the MVP's contract-cli signet/constants.ts, adapted
-// to the refactor's zero-padded convention (Compact `pad(N, "text")`) — the
-// MVP's 2-byte length-prefixed codec is gone with the old layout.
+// to the refactor's zero-padded convention (Compact `pad(N, "text")`).
 //
-// The routing constants belong in github.com/sig-net/signet.js — kept here
+// The routing constants belong in github.com/sig-net/signet.js, kept here
 // until upstreamed.
 /** Width of `SignBidirectionalEvent.caip2Id` (`Bytes<32>`). */
 export const CAIP2_ID_BYTES = 32;
 /** Width of `SignBidirectionalEvent.params` (`Bytes<64>`). */
 export const MPC_PARAMS_BYTES = 64;
-/** Width of `EVMCalldata.selector` (`Bytes<4>`) — the literal first 4 calldata bytes. */
+/** Width of `EvmCalldata.selector` (`Bytes<4>`): the literal first 4 calldata bytes. */
 export const SELECTOR_BYTES = 4;
-/** Width of `RespondBidirectionalEvent.serializedOutput` (`Bytes<128>`). */
-export const SERIALIZED_OUTPUT_BYTES = 128;
 /**
- * The MPC's error sentinel: `serializedOutput` beginning with these four
+ * The MPC's error sentinel: a serialised output beginning with these four
  * bytes marks a failed/absent remote execution (mirrors the sig-net MPC's
  * MAGIC_ERROR_PREFIX).
  */
 export const MPC_ERROR_SENTINEL = new Uint8Array([0xde, 0xad, 0xbe, 0xef]);
 /**
- * Whether an attestation's serialized output reports a successful remote
- * execution: the first byte is 1 — the little-endian encoding of the
- * ABI-decoded success flag, matching the circuits'
- * `serializedOutput as Field == 1` check.
+ * The complete serialised output the MPC attests for a FAILED remote
+ * execution (reverted or replaced transaction): the error sentinel followed
+ * by one `0x01` byte. Schema-independent by design, mirroring the canonical
+ * MPC's Borsh-format failure payload (sig-net/mpc,
+ * node/src/respond_bidirectional.rs), so every respond schema shares one
+ * fixed 5-byte failure width. Clients recompute their failure candidate from
+ * this constant alone: no receipt or schema needed.
+ */
+export const MPC_FAILURE_OUTPUT = new Uint8Array([0xde, 0xad, 0xbe, 0xef, 0x01]);
+/**
+ * Whether an attested serialised output reports a successful remote
+ * execution: the first byte is 1, the packed little-endian encoding of a
+ * leading boolean success flag. The output is the exact unpadded respond
+ * payload (see `serializeRespondOutput`), so its length follows from the
+ * request's respond schema.
  *
- * @param serializedOutput - The attestation's serialized output.
+ * @param serializedOutput - The attested serialised output.
  * @returns `true` when the remote call succeeded.
  */
 export function executionSucceeded(serializedOutput) {
     return serializedOutput[0] === 1;
 }
 /**
- * Whether an attestation's serialized output is the MPC's error sentinel
- * (see {@link MPC_ERROR_SENTINEL}) rather than a call result.
+ * Whether an attested serialised output is the MPC's error sentinel
+ * (see {@link MPC_ERROR_SENTINEL}).
  *
- * @param serializedOutput - The attestation's serialized output.
+ * @param serializedOutput - The attested serialised output.
  * @returns `true` when the MPC reported an execution error.
  */
 export function isExecutionError(serializedOutput) {
@@ -45,12 +53,12 @@ export function isExecutionError(serializedOutput) {
 }
 /**
  * Default MPC key version (`keyVersion` field value). Version 0 is the
- * unsupported legacy format — the canonical MPC (and
+ * unsupported legacy format: the canonical MPC (and
  * `constructSignBidirectionalEvent`) requires `keyVersion >= 1`.
  */
 export const SIGNET_DEFAULT_KEY_VERSION = 1n;
 /**
- * Encode text as zero-padded ASCII bytes — the Compact `pad(N, "text")`
+ * Encode text as zero-padded ASCII bytes, the Compact `pad(N, "text")`
  * convention every string-ish field of the request structs uses (consumers
  * NUL-trim on decode).
  *
@@ -62,7 +70,7 @@ export const SIGNET_DEFAULT_KEY_VERSION = 1n;
 export function asciiPadded(text, length) {
     const encoded = new TextEncoder().encode(text);
     if (encoded.length > length) {
-        throw new Error(`"${text}" is ${encoded.length} bytes — does not fit the ${length}-byte field`);
+        throw new Error(`"${text}" is ${encoded.length} bytes: does not fit the ${length}-byte field`);
     }
     const out = new Uint8Array(length);
     out.set(encoded);

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,iEAAiE;AACjE,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,kEAAkE;AAClE,EAAE;AACF,2EAA2E;AAC3E,oBAAoB;AAEpB,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,yFAAyF;AACzF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC,4EAA4E;AAC5E,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,gBAA4B;IAC7D,OAAO,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,gBAA4B;IAC3D,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,QAAQ,OAAO,CAAC,MAAM,6BAA6B,MAAM,aAAa,CAAC,CAAC;IAClG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,wEAAwE;AACxE,wEAAwE;AACxE,qEAAqE;AACrE,6EAA6E;AAC7E,uEAAuE;AACvE,EAAE;AACF,0EAA0E;AAC1E,oBAAoB;AAEpB,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,wFAAwF;AACxF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjF;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,gBAA4B;IAC7D,OAAO,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,gBAA4B;IAC3D,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,QAAQ,OAAO,CAAC,MAAM,4BAA4B,MAAM,aAAa,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/ecdsa-attestation.d.ts

@@ -1,4 +1,6 @@
 import type { Secp256k1Point } from "@midnight-ntwrk/compact-runtime";
+import type { RequestId } from "./signet-requests.ts";
+import type { MpcSignature } from "./signet-contract-state-reader.ts";
 export type { Secp256k1Point } from "@midnight-ntwrk/compact-runtime";
 /** secp256k1 curve (group) order n. */
 export declare const SECP256K1_ORDER: bigint;
@@ -16,18 +18,37 @@ export declare function bytesToBigint(bytes: Uint8Array): bigint;
 /**
  * Convert a bigint to exactly 32 little-endian bytes. Matches Compact's
  * `Field as Bytes<32>` / `Secp256k1Scalar as Bytes<32>` encoding (the inverse
- * of {@link bytesToBigint}); negative inputs are interpreted in the BLS
+ * of {@link bytesToBigint}). Negative inputs are interpreted in the BLS
  * scalar field.
  *
  * @param n - The integer to encode.
  * @returns The 32-byte little-endian encoding.
  */
 export declare function bigintToBytes32(n: bigint): Uint8Array;
+/**
+ * Convert big-endian bytes to a bigint (SEC1 coordinate order, the byte
+ * order the respond events' stored signature uses).
+ *
+ * @param bytes - Big-endian byte array.
+ * @returns The decoded non-negative integer.
+ */
+export declare function bytesToBigintBE(bytes: Uint8Array): bigint;
+/**
+ * Convert a bigint to exactly 32 BIG-endian bytes (SEC1 scalar/coordinate
+ * order, also the ABI word encoding): the big-endian counterpart of
+ * {@link bigintToBytes32} and the inverse of {@link bytesToBigintBE}.
+ *
+ * @param value - The non-negative integer to encode.
+ * @returns The 32-byte big-endian encoding.
+ * @throws Error if the value is negative or does not fit 32 bytes.
+ */
+export declare function bigintToBytes32BE(value: bigint): Uint8Array;
 /**
  * An ECDSA signature over the attestation digest, in the MPC's canonical
  * `Signature { big_r, s, recovery_id }` spirit with `r` already reduced to
- * the scalar `big_r.x mod n` — the form Compact's `Secp256k1EcdsaSignature`
- * takes.
+ * the scalar `big_r.x mod n`, the form Compact's `Secp256k1EcdsaSignature`
+ * takes. Build the stored form for posting in a respond event with
+ * {@link ecdsaSignatureToMpcSignature}.
  */
 export interface EcdsaSignature {
     /** Signature scalar r (= R.x mod n). */
@@ -40,18 +61,48 @@ export interface EcdsaSignature {
 /**
  * ECDSA-sign a 32-byte digest with a secp256k1 secret key, exactly as the
  * MPC signs the attestation digest: RFC 6979 deterministic, low-s, the digest
- * interpreted big-endian with NO extra hashing (`prehash: false`) — the same
+ * interpreted big-endian with NO extra hashing (`prehash: false`), the same
  * convention `secp256k1EcdsaVerify` checks in-circuit.
  *
- * @param digest - The 32-byte digest to sign (e.g. the compiled
- *   `pureCircuits.signetAttestationDigest` output).
+ * @param digest - The 32-byte digest to sign (e.g. the
+ *   {@link calculateSignetAttestationDigest} output).
  * @param secretKey - The 32-byte secp256k1 secret key.
  * @returns The signature with its recovery id.
  */
 export declare function signAttestationDigest(digest: Uint8Array, secretKey: Uint8Array): EcdsaSignature;
+/**
+ * Build the stored-form signature both respond events carry from a
+ * scalar-form one: R is reconstructed by decompressing the curve point with
+ * x = `r` and the parity `recoveryId` names, undoing the compression an
+ * `r || s || v` signature performs. For MPC-side posters (the fakenet
+ * signer, tests). The negligible caveat: an R.x that overflowed the curve
+ * order cannot be told apart from its reduced twin, so reconstruction picks
+ * the x equal to `r` itself.
+ *
+ * @param signature - The scalar-form signature (the signer's output shape).
+ * @returns The stored-form signature: R as a full point, big-endian bytes.
+ * @throws Error if the recovery id is not 0 or 1, or `r` is not the x
+ *   coordinate of a secp256k1 point.
+ */
+export declare function ecdsaSignatureToMpcSignature(signature: EcdsaSignature): MpcSignature;
+/**
+ * Read a stored-form signature back into scalar form: the inverse of
+ * {@link ecdsaSignatureToMpcSignature}, for off-chain consumers building a
+ * transaction from the response. `r` comes out as `bigR.x` reduced mod the
+ * curve order. Rejects records that do not even hold the shape, since posts
+ * are unauthenticated and a malformed record is garbage. `bigR.y` is NOT
+ * checked against the curve or the recovery id: signature verification is
+ * the authority, not this decoder.
+ *
+ * @param signature - The stored-form signature as posted.
+ * @returns The scalar-form signature.
+ * @throws Error if a component has the wrong byte length or the recovery id
+ *   is not 0 or 1.
+ */
+export declare function mpcSignatureToEcdsaSignature(signature: MpcSignature): EcdsaSignature;
 /**
  * Parse a secp256k1 public key from SEC1 hex (compressed or uncompressed,
- * optional `0x` prefix) into the Compact runtime's `Secp256k1Point` shape —
+ * optional `0x` prefix) into the Compact runtime's `Secp256k1Point` shape:
  * how deploys receive the MPC response key to pin.
  *
  * @param value - The SEC1 hex public key.
@@ -61,7 +112,7 @@ export declare function signAttestationDigest(digest: Uint8Array, secretKey: Uin
 export declare function parseSecp256k1PublicKey(value: string): Secp256k1Point;
 /**
  * Format a secp256k1 public key point as uncompressed SEC1 hex (with `0x`
- * prefix) — the round-trip inverse of {@link parseSecp256k1PublicKey}, for
+ * prefix): the round-trip inverse of {@link parseSecp256k1PublicKey}, for
  * handing a response key to deploys via env/config.
  *
  * @param point - The point to format.
@@ -69,11 +120,32 @@ export declare function parseSecp256k1PublicKey(value: string): Secp256k1Point;
  */
 export declare function formatSecp256k1PublicKey(point: Secp256k1Point): string;
 /**
- * Derive the `Secp256k1Point` of a secret key — convenience for tests and
+ * Derive the `Secp256k1Point` of a secret key: a convenience for tests and
  * signers that hold key material as raw bytes.
  *
  * @param secretKey - The 32-byte secp256k1 secret key.
  * @returns The public key point.
  */
 export declare function secp256k1PublicKeyOf(secretKey: Uint8Array): Secp256k1Point;
+/**
+ * The attestation digest of a respond-bidirectional response:
+ * `keccak256(requestId || serializedOutput)`, the 32-byte digest the MPC
+ * ECDSA-signs to attest a remote execution.
+ *
+ * TS twin of the size-generic Compact circuit
+ * `calculateSignetAttestationDigest` (which the compiler cannot export
+ * compiled, so this is the one sanctioned re-implementation, pinned
+ * byte-for-byte against the fixed-width oracle circuits in
+ * circuits.compact). The constructions agree because the circuit's keccak
+ * preimage of the `[RequestId, Bytes<N>]` pair is the raw concatenated
+ * bytes, and it matches the MPC's respond-bidirectional hash
+ * (`hash(request_id || serialized_output)`: one flat concatenation, one
+ * hash). The output is hashed AS GIVEN, at its exact length: no padding and
+ * no length binding.
+ *
+ * @param requestId - The 32-byte request id the response answers.
+ * @param serializedOutput - The serialised execution output, exact unpadded bytes.
+ * @returns The 32-byte attestation digest.
+ */
+export declare function calculateSignetAttestationDigest(requestId: RequestId, serializedOutput: Uint8Array): Uint8Array;
 //# sourceMappingURL=ecdsa-attestation.d.ts.map

package/dist/ecdsa-attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ecdsa-attestation.d.ts","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAItE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,uCAAuC;AACvC,eAAO,MAAM,eAAe,QAA2B,CAAC;AAExD,uEAAuE;AACvE,eAAO,MAAM,SAAS,iFAAiF,CAAC;AAExG;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAWD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,2DAA2D;IAC3D,CAAC,EAAE,MAAM,CAAC;IACV,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,UAAU,GACpB,cAAc,CAiBhB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAcrE;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,cAAc,CAO1E"}
+{"version":3,"file":"ecdsa-attestation.d.ts","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mCAAmC,CAAC;AAItE,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,uCAAuC;AACvC,eAAO,MAAM,eAAe,QAA2B,CAAC;AAExD,uEAAuE;AACvE,eAAO,MAAM,SAAS,iFAAiF,CAAC;AAExG;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAQvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAW3D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,2DAA2D;IAC3D,CAAC,EAAE,MAAM,CAAC;IACV,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,UAAU,GACpB,cAAc,CAiBhB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,cAAc,GAAG,YAAY,CAmBpF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,YAAY,GAAG,cAAc,CAapF;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAcrE;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,cAAc,CAO1E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,UAAU,GAC3B,UAAU,CAIZ"}

package/dist/ecdsa-attestation.js

@@ -1,15 +1,19 @@
 // secp256k1 ECDSA helpers: the TS side of the respond-bidirectional
-// attestation flow in Signet.compact — SIGNING (which needs the secret
-// scalar, so it cannot be a circuit), key parsing/formatting, and the
-// byte-order conversions between noble's bigints and the ledger-stored
-// little-endian scalar bytes. Everything provable stays in Compact: the
-// attestation digest is the COMPILED `pureCircuits.signetAttestationDigest`,
-// verification is `pureCircuits.verifyRespondBidirectionalEvent` (the same
-// check client contracts run in-circuit), and the deploy-time key pin is
-// `pureCircuits.signetKeyHash` — this file never re-implements any of them.
+// attestation flow in Signet.compact: SIGNING (which needs the secret
+// scalar, so it cannot be a circuit), key parsing/formatting, the
+// byte-order conversions between noble's bigints and the little-endian
+// scalar bytes Compact's casts read, and the attestation digest's TS twin.
+// Everything provable stays in Compact where possible: in-circuit
+// verification is `verifyRespondBidirectionalEvent`, the deploy-time key pin
+// is `pureCircuits.signetKeyHash`. The digest circuit is size-generic and the
+// compiler cannot export size-generic circuits top-level, so the digest is
+// the ONE sanctioned TS twin here, pinned byte-for-byte against the
+// fixed-width oracle circuits circuits.compact exports (see
+// tests/ecdsa-attestation.test.ts).
 //
-// This belongs in github.com/sig-net/signet.js as its Midnight adapter —
+// This belongs in github.com/sig-net/signet.js as its Midnight adapter,
 // kept here until upstreamed.
+import { ethers } from "ethers";
 import { secp256k1 } from "@noble/curves/secp256k1.js";
 /** secp256k1 curve (group) order n. */
 export const SECP256K1_ORDER = secp256k1.Point.Fn.ORDER;
@@ -26,6 +30,8 @@ export const BLS_ORDER = 5243587517512619047944774050818596583769055250052763782
 export function bytesToBigint(bytes) {
     let result = 0n;
     for (let i = bytes.length - 1; i >= 0; i--) {
+        // The index is in range by construction: the assertion satisfies
+        // consumers compiling with noUncheckedIndexedAccess.
         result = (result << 8n) | BigInt(bytes[i]);
     }
     return result;
@@ -33,7 +39,7 @@ export function bytesToBigint(bytes) {
 /**
  * Convert a bigint to exactly 32 little-endian bytes. Matches Compact's
  * `Field as Bytes<32>` / `Secp256k1Scalar as Bytes<32>` encoding (the inverse
- * of {@link bytesToBigint}); negative inputs are interpreted in the BLS
+ * of {@link bytesToBigint}). Negative inputs are interpreted in the BLS
  * scalar field.
  *
  * @param n - The integer to encode.
@@ -48,22 +54,49 @@ export function bigintToBytes32(n) {
     }
     return buf;
 }
-/** Convert big-endian bytes to a bigint (SEC1 coordinate order). */
-function bytesToBigintBE(bytes) {
+/**
+ * Convert big-endian bytes to a bigint (SEC1 coordinate order, the byte
+ * order the respond events' stored signature uses).
+ *
+ * @param bytes - Big-endian byte array.
+ * @returns The decoded non-negative integer.
+ */
+export function bytesToBigintBE(bytes) {
     let value = 0n;
     for (const byte of bytes) {
         value = (value << 8n) | BigInt(byte);
     }
     return value;
 }
+/**
+ * Convert a bigint to exactly 32 BIG-endian bytes (SEC1 scalar/coordinate
+ * order, also the ABI word encoding): the big-endian counterpart of
+ * {@link bigintToBytes32} and the inverse of {@link bytesToBigintBE}.
+ *
+ * @param value - The non-negative integer to encode.
+ * @returns The 32-byte big-endian encoding.
+ * @throws Error if the value is negative or does not fit 32 bytes.
+ */
+export function bigintToBytes32BE(value) {
+    if (value < 0n || value >= 1n << 256n) {
+        throw new Error(`value does not fit 32 big-endian bytes: ${value}`);
+    }
+    const out = new Uint8Array(32);
+    let v = value;
+    for (let i = 31; i >= 0; i--) {
+        out[i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    return out;
+}
 /**
  * ECDSA-sign a 32-byte digest with a secp256k1 secret key, exactly as the
  * MPC signs the attestation digest: RFC 6979 deterministic, low-s, the digest
- * interpreted big-endian with NO extra hashing (`prehash: false`) — the same
+ * interpreted big-endian with NO extra hashing (`prehash: false`), the same
  * convention `secp256k1EcdsaVerify` checks in-circuit.
  *
- * @param digest - The 32-byte digest to sign (e.g. the compiled
- *   `pureCircuits.signetAttestationDigest` output).
+ * @param digest - The 32-byte digest to sign (e.g. the
+ *   {@link calculateSignetAttestationDigest} output).
  * @param secretKey - The 32-byte secp256k1 secret key.
  * @returns The signature with its recovery id.
  */
@@ -85,9 +118,72 @@ export function signAttestationDigest(digest, secretKey) {
     /* v8 ignore next: unreachable for a signature this function just produced */
     throw new Error("signature does not recover to its own public key");
 }
+/**
+ * Build the stored-form signature both respond events carry from a
+ * scalar-form one: R is reconstructed by decompressing the curve point with
+ * x = `r` and the parity `recoveryId` names, undoing the compression an
+ * `r || s || v` signature performs. For MPC-side posters (the fakenet
+ * signer, tests). The negligible caveat: an R.x that overflowed the curve
+ * order cannot be told apart from its reduced twin, so reconstruction picks
+ * the x equal to `r` itself.
+ *
+ * @param signature - The scalar-form signature (the signer's output shape).
+ * @returns The stored-form signature: R as a full point, big-endian bytes.
+ * @throws Error if the recovery id is not 0 or 1, or `r` is not the x
+ *   coordinate of a secp256k1 point.
+ */
+export function ecdsaSignatureToMpcSignature(signature) {
+    if (signature.recoveryId !== 0 && signature.recoveryId !== 1) {
+        throw new Error(`expected a recovery id of 0 or 1, got ${signature.recoveryId}`);
+    }
+    // SEC1 compressed form: parity prefix (02 even, 03 odd) || x big-endian.
+    const parityPrefix = signature.recoveryId === 0 ? "02" : "03";
+    const xHex = signature.r.toString(16).padStart(64, "0");
+    let point;
+    try {
+        point = secp256k1.Point.fromHex(`${parityPrefix}${xHex}`);
+    }
+    catch (error) {
+        throw new Error(`signature r is not the x coordinate of a secp256k1 point (${String(error)})`);
+    }
+    const uncompressed = point.toBytes(false); // 0x04 || x || y
+    return {
+        bigR: { x: uncompressed.slice(1, 33), y: uncompressed.slice(33, 65) },
+        s: bigintToBytes32BE(signature.s),
+        recoveryId: BigInt(signature.recoveryId),
+    };
+}
+/**
+ * Read a stored-form signature back into scalar form: the inverse of
+ * {@link ecdsaSignatureToMpcSignature}, for off-chain consumers building a
+ * transaction from the response. `r` comes out as `bigR.x` reduced mod the
+ * curve order. Rejects records that do not even hold the shape, since posts
+ * are unauthenticated and a malformed record is garbage. `bigR.y` is NOT
+ * checked against the curve or the recovery id: signature verification is
+ * the authority, not this decoder.
+ *
+ * @param signature - The stored-form signature as posted.
+ * @returns The scalar-form signature.
+ * @throws Error if a component has the wrong byte length or the recovery id
+ *   is not 0 or 1.
+ */
+export function mpcSignatureToEcdsaSignature(signature) {
+    const { bigR, s, recoveryId } = signature;
+    if (bigR.x.length !== 32 || bigR.y.length !== 32 || s.length !== 32) {
+        throw new Error("expected 32-byte bigR.x/bigR.y/s in a stored signature");
+    }
+    if (recoveryId !== 0n && recoveryId !== 1n) {
+        throw new Error(`expected a recovery id of 0 or 1, got ${recoveryId}`);
+    }
+    return {
+        r: bytesToBigintBE(bigR.x) % SECP256K1_ORDER,
+        s: bytesToBigintBE(s),
+        recoveryId: Number(recoveryId),
+    };
+}
 /**
  * Parse a secp256k1 public key from SEC1 hex (compressed or uncompressed,
- * optional `0x` prefix) into the Compact runtime's `Secp256k1Point` shape —
+ * optional `0x` prefix) into the Compact runtime's `Secp256k1Point` shape:
  * how deploys receive the MPC response key to pin.
  *
  * @param value - The SEC1 hex public key.
@@ -112,7 +208,7 @@ export function parseSecp256k1PublicKey(value) {
 }
 /**
  * Format a secp256k1 public key point as uncompressed SEC1 hex (with `0x`
- * prefix) — the round-trip inverse of {@link parseSecp256k1PublicKey}, for
+ * prefix): the round-trip inverse of {@link parseSecp256k1PublicKey}, for
  * handing a response key to deploys via env/config.
  *
  * @param point - The point to format.
@@ -123,7 +219,7 @@ export function formatSecp256k1PublicKey(point) {
     return `0x04${toBE32(point.x)}${toBE32(point.y)}`;
 }
 /**
- * Derive the `Secp256k1Point` of a secret key — convenience for tests and
+ * Derive the `Secp256k1Point` of a secret key: a convenience for tests and
  * signers that hold key material as raw bytes.
  *
  * @param secretKey - The 32-byte secp256k1 secret key.
@@ -137,4 +233,27 @@ export function secp256k1PublicKeyOf(secretKey) {
         identity: false,
     };
 }
+/**
+ * The attestation digest of a respond-bidirectional response:
+ * `keccak256(requestId || serializedOutput)`, the 32-byte digest the MPC
+ * ECDSA-signs to attest a remote execution.
+ *
+ * TS twin of the size-generic Compact circuit
+ * `calculateSignetAttestationDigest` (which the compiler cannot export
+ * compiled, so this is the one sanctioned re-implementation, pinned
+ * byte-for-byte against the fixed-width oracle circuits in
+ * circuits.compact). The constructions agree because the circuit's keccak
+ * preimage of the `[RequestId, Bytes<N>]` pair is the raw concatenated
+ * bytes, and it matches the MPC's respond-bidirectional hash
+ * (`hash(request_id || serialized_output)`: one flat concatenation, one
+ * hash). The output is hashed AS GIVEN, at its exact length: no padding and
+ * no length binding.
+ *
+ * @param requestId - The 32-byte request id the response answers.
+ * @param serializedOutput - The serialised execution output, exact unpadded bytes.
+ * @returns The 32-byte attestation digest.
+ */
+export function calculateSignetAttestationDigest(requestId, serializedOutput) {
+    return ethers.getBytes(ethers.keccak256(ethers.concat([requestId, serializedOutput])));
+}
 //# sourceMappingURL=ecdsa-attestation.js.map

package/dist/ecdsa-attestation.js.map

@@ -1 +1 @@
-{"version":3,"file":"ecdsa-attestation.js","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,uEAAuE;AACvE,wEAAwE;AACxE,6EAA6E;AAC7E,2EAA2E;AAC3E,yEAAyE;AACzE,4EAA4E;AAC5E,EAAE;AACF,yEAAyE;AACzE,8BAA8B;AAE9B,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAOvD,uCAAuC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAExD,uEAAuE;AACvE,MAAM,CAAC,MAAM,SAAS,GAAG,8EAA8E,CAAC;AAExG;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAiBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,SAAqB;IAErB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/D,wEAAwE;IACxE,MAAM,EAAE,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,MAAM,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,GAAG;aAClB,cAAc,CAAC,UAAU,CAAC;aAC1B,gBAAgB,CAAC,MAAM,CAAC;aACxB,KAAK,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtF,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;IAC5D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAqB;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAqB;IACxD,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ecdsa-attestation.js","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,sEAAsE;AACtE,kEAAkE;AAClE,uEAAuE;AACvE,2EAA2E;AAC3E,kEAAkE;AAClE,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,oEAAoE;AACpE,4DAA4D;AAC5D,oCAAoC;AACpC,EAAE;AACF,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAUvD,uCAAuC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAExD,uEAAuE;AACvE,MAAM,CAAC,MAAM,SAAS,GAAG,8EAA8E,CAAC;AAExG;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,iEAAiE;QACjE,qDAAqD;QACrD,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAkBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,SAAqB;IAErB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/D,wEAAwE;IACxE,MAAM,EAAE,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,MAAM,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,GAAG;aAClB,cAAc,CAAC,UAAU,CAAC;aAC1B,gBAAgB,CAAC,MAAM,CAAC;aACxB,KAAK,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAyB;IACpE,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,yEAAyE;IACzE,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,YAAY,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6DAA6D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;IAC5D,OAAO;QACL,IAAI,EAAE,EAAE,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACrE,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QACjC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAuB;IAClE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;IAC1C,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yCAAyC,UAAU,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe;QAC5C,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtF,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;IAC5D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAqB;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAqB;IACxD,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAoB,EACpB,gBAA4B;IAE5B,OAAO,MAAM,CAAC,QAAQ,CACpB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC"}

package/dist/epsilon-derivation.d.ts

@@ -1,10 +1,10 @@
 import { type Secp256k1Point } from "./ecdsa-attestation.ts";
 /**
- * Domain prefix of the sig-net v1.0.0 epsilon derivation scheme, as used by
- * the live response server. The full derivation string is
- * `<prefix>,<chainId>,<requester>,<path>` (comma-separated).
+ * Domain prefix of the sig-net v2.0.0 epsilon derivation scheme. The full
+ * derivation string is `<prefix>:<chainId>:<requester>:<path>` (colon-separated),
+ * matching `caip2_derivation_path` in the MPC's `crypto/src/kdf.rs`.
  */
-export declare const EPSILON_DERIVATION_PREFIX = "sig.network v1.0.0 epsilon derivation";
+export declare const EPSILON_DERIVATION_PREFIX = "sig.network v2.0.0 epsilon derivation";
 /**
  * CAIP-2 chain id under which the MPC derives keys for requests originating
  * from Midnight contracts.
@@ -29,8 +29,8 @@ export declare const MIDNIGHT_TESTNET_CHAIN_ID = "midnight:testnet";
 export declare const MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH = "midnight response key";
 /**
  * Derive the EVM address the MPC network signs from for a given Midnight
- * contract and derivation path, using the sig-net v1.0.0 epsilon scheme:
- * `epsilon = keccak256("<prefix>,<chainId>,<contractAddress>,<path>")` and
+ * contract and derivation path, using the sig-net v2.0.0 epsilon scheme:
+ * `epsilon = keccak256("<prefix>:<chainId>:<contractAddress>:<path>")` and
  * `derivedPubKey = mpcRootPubKey + epsilon * G` on secp256k1.
  *
  * The MPC treats `path` as an opaque string: the vault's own account uses the
@@ -48,8 +48,8 @@ export declare const MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH = "midnight response ke
  */
 export declare function deriveEvmAddress(mpcSecp256k1PubkeyHex: string, contractAddress: string, path: string, chainId?: string): string;
 /**
- * The epsilon scalar of the sig-net v1.0.0 derivation scheme:
- * `keccak256("<prefix>,<chainId>,<requester>,<path>")` reduced mod the
+ * The epsilon scalar of the sig-net v2.0.0 derivation scheme:
+ * `keccak256("<prefix>:<chainId>:<requester>:<path>")` reduced mod the
  * secp256k1 curve order. Child keys are `root + epsilon` (secret side) and
  * `rootPubKey + epsilon * G` (public side).
  *

package/dist/epsilon-derivation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"epsilon-derivation.d.ts","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAeA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,0CAA0C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mCAAmC,0BAA0B,CAAC;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,EAC7B,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAGR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAKR;AA6BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,qBAAqB,EAAE,MAAM,EAC7B,qBAAqB,EAAE,MAAM,GAC5B,cAAc,CAQhB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,UAAU,EAC5B,qBAAqB,EAAE,MAAM,GAC5B,UAAU,CAwBZ"}
+{"version":3,"file":"epsilon-derivation.d.ts","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAaA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,0CAA0C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mCAAmC,0BAA0B,CAAC;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,EAC7B,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAGR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAKR;AA6BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,qBAAqB,EAAE,MAAM,EAC7B,qBAAqB,EAAE,MAAM,GAC5B,cAAc,CAQhB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,UAAU,EAC5B,qBAAqB,EAAE,MAAM,GAC5B,UAAU,CAwBZ"}