@sig-net/midnight 0.12.0 → 0.14.0

package/dist/signet-request-response-reader.js

@@ -11,7 +11,9 @@
 import { lookupSignetRequestAt } from "./signature-requests-state-reader.js";
 import { readSignetContractLedgerFromState, signetMapEntryKey, } from "./signet-contract-state-reader.js";
 import { recoverSignatureResponseSigner } from "./signature-response-verification.js";
+import { verifyRespondBidirectionalSignature, } from "./ecdsa-attestation.js";
 import { signBidirectionalEventToSignedEvmTransaction, signBidirectionalEventToUnsignedEvmTransaction, } from "./signet-evtype2tx-requests.js";
+import { requestIdBytes, } from "./signet-requests.js";
 /**
  * Reader over one requester contract / signet contract pair.
  * Construct once per pair and reuse: fetched request records are cached (they
@@ -181,10 +183,11 @@ export class SignetRequestResponseReader {
     /**
      * Fetch every respond-bidirectional response posted for `requestId`, in
      * post (count) order. UNVERIFIED: the signet contract stores posts without
-     * checking them, so any entry may be garbage. Verify each candidate before
-     * trusting it (in-circuit at claim time, or off-chain via the compiled
-     * `pureCircuits.verifyRespondBidirectionalEvent` against the MPC derived
-     * key you expect). An empty array simply means none posted yet: poll again.
+     * checking them, so any entry may be garbage. Each post carries a signature
+     * and nothing else, so verifying it against the MPC response key you expect
+     * is the only way to pick the genuine one: in-circuit at claim time, or off
+     * chain with {@link verifyRespondBidirectionalSignature} over the output you
+     * fetched. An empty array simply means none posted yet: poll again.
      *
      * @param requestId - The request id whose responses to enumerate.
      * @returns The posted records, index = count, empty when none yet.
@@ -206,5 +209,32 @@ export class SignetRequestResponseReader {
         }
         return responses;
     }
+    /**
+     * Fetch the respond-bidirectional posts for `requestId` and return the
+     * first (lowest count) one whose signature verifies over
+     * `serializedOutput` against `mpcResponseKey`: the off-chain twin of the
+     * check the client contract runs in-circuit, and the only way to pick a
+     * genuine post out of an unauthenticated log now that posts carry nothing
+     * but a signature.
+     *
+     * The output must be the exact unpadded bytes the attestation commits to
+     * (the packed respond payload, recomputed from the execution output the
+     * client fetched), so a post that verifies here is the post that proves at
+     * claim time.
+     *
+     * @param requestId - The request id to fetch a verified attestation for.
+     * @param serializedOutput - The serialised execution output the attestation
+     *   must commit to, exact unpadded bytes.
+     * @param mpcResponseKey - The MPC response key the requesting contract
+     *   pinned at deploy (see `deriveMidnightResponseKey`).
+     * @returns The first verifying post, or `undefined` when none has been
+     *   posted yet (poll again) or none attests this output.
+     * @throws Error when the signet contract has no state, or its counter
+     *   disagrees with the log (inconsistent ledger).
+     */
+    async getVerifiedRespondBidirectionalEvent(requestId, serializedOutput, mpcResponseKey) {
+        const events = await this.getRespondBidirectionalEvents(requestId);
+        return events.find((event) => verifyRespondBidirectionalSignature(requestIdBytes(requestId), serializedOutput, event, mpcResponseKey));
+    }
 }
 //# sourceMappingURL=signet-request-response-reader.js.map

package/dist/signet-request-response-reader.js.map

@@ -1 +1 @@
-{"version":3,"file":"signet-request-response-reader.js","sourceRoot":"","sources":["../src/signet-request-response-reader.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,uBAAuB;AACvB,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,mEAAmE;AACnE,2EAA2E;AAC3E,iCAAiC;AAKjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EACL,iCAAiC,EACjC,iBAAiB,GAGlB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAEtF,OAAO,EACL,4CAA4C,EAC5C,8CAA8C,GAC/C,MAAM,gCAAgC,CAAC;AAoExC;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAoC;IAE3D,wEAAwE;IACvD,YAAY,GAAG,IAAI,GAAG,EAGpC,CAAC;IAEJ;;OAEG;IACH,YAAY,MAAyC;QACnD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,eAAuB,EACvB,IAAY;QAEZ,MAAM,KAAK,GACT,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,cAAc,eAAe,qBAAqB,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CACvB,SAAuB;QAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EACpC,WAAW,CACZ,CAAC;QACF,MAAM,OAAO,GAAG,qBAAqB,CACnC,GAAG,EACH,IAAI,CAAC,MAAM,CAAC,2BAA2B,EACvC,SAAS,CACV,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,6CAA6C;gBAC/D,2BAA2B,IAAI,CAAC,MAAM,CAAC,2BAA2B,sBAAsB,CAC3F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,qBAAqB,CACzB,SAAuB;QAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EACjC,iBAAiB,CAClB,CAAC;QACF,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,GACrC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,SAAS,GAA8B,EAAE,CAAC;QAChD,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAC7B,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CACpC,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,gBAAgB,SAAS,GAAG;oBAC5D,+BAA+B,UAAU,gCAAgC,CAC5E,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,kCAAkC,CACtC,SAAuB,EACvB,cAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAC5B,CAAC,QAAQ,EAAE,KAAK,EAA4B,EAAE;YAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,8BAA8B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK;oBACL,QAAQ;oBACR,cAAc,EAAE,8BAA8B,MAAM,CAAC,KAAK,CAAC,GAAG;iBAC/D,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC1D,OAAO;oBACL,KAAK;oBACL,QAAQ;oBACR,MAAM;oBACN,cAAc,EAAE,aAAa,MAAM,cAAc,cAAc,EAAE;iBAClE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrC,CAAC,CACF,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,EAAE,QAAQ;YACxE,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,yBAAyB,CAC7B,SAAuB;QAEvB,OAAO,8CAA8C,CACnD,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAC1C,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,uBAAuB,CAC3B,SAAuB,EACvB,cAAsB;QAEtB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,kCAAkC,CAChE,SAAS,EACT,cAAc,CACf,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,4EAA4E;QAC5E,wCAAwC;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,4CAA4C,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,6BAA6B,CACjC,SAAuB;QAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EACjC,iBAAiB,CAClB,CAAC;QACF,MAAM,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,GAC/D,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,8BAA8B,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,SAAS,GAAgC,EAAE,CAAC;QAClD,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAC1C,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CACpC,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,gBAAgB,SAAS,GAAG;oBACzE,+BAA+B,UAAU,gCAAgC,CAC5E,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"signet-request-response-reader.js","sourceRoot":"","sources":["../src/signet-request-response-reader.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,uBAAuB;AACvB,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,mEAAmE;AACnE,2EAA2E;AAC3E,iCAAiC;AAKjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EACL,iCAAiC,EACjC,iBAAiB,GAGlB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,EACL,mCAAmC,GAEpC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,4CAA4C,EAC5C,8CAA8C,GAC/C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,cAAc,GAGf,MAAM,sBAAsB,CAAC;AAgE9B;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAoC;IAE3D,wEAAwE;IACvD,YAAY,GAAG,IAAI,GAAG,EAGpC,CAAC;IAEJ;;OAEG;IACH,YAAY,MAAyC;QACnD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,eAAuB,EACvB,IAAY;QAEZ,MAAM,KAAK,GACT,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,cAAc,eAAe,qBAAqB,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CACvB,SAAuB;QAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EACpC,WAAW,CACZ,CAAC;QACF,MAAM,OAAO,GAAG,qBAAqB,CACnC,GAAG,EACH,IAAI,CAAC,MAAM,CAAC,2BAA2B,EACvC,SAAS,CACV,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,6CAA6C;gBAC/D,2BAA2B,IAAI,CAAC,MAAM,CAAC,2BAA2B,sBAAsB,CAC3F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,qBAAqB,CACzB,SAAuB;QAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EACjC,iBAAiB,CAClB,CAAC;QACF,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,GACrC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,SAAS,GAA8B,EAAE,CAAC;QAChD,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAC7B,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CACpC,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,gBAAgB,SAAS,GAAG;oBAC5D,+BAA+B,UAAU,gCAAgC,CAC5E,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,kCAAkC,CACtC,SAAuB,EACvB,cAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAC5B,CAAC,QAAQ,EAAE,KAAK,EAA4B,EAAE;YAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,8BAA8B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK;oBACL,QAAQ;oBACR,cAAc,EAAE,8BAA8B,MAAM,CAAC,KAAK,CAAC,GAAG;iBAC/D,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC1D,OAAO;oBACL,KAAK;oBACL,QAAQ;oBACR,MAAM;oBACN,cAAc,EAAE,aAAa,MAAM,cAAc,cAAc,EAAE;iBAClE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrC,CAAC,CACF,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,EAAE,QAAQ;YACxE,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,yBAAyB,CAC7B,SAAuB;QAEvB,OAAO,8CAA8C,CACnD,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAC1C,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,uBAAuB,CAC3B,SAAuB,EACvB,cAAsB;QAEtB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,kCAAkC,CAChE,SAAS,EACT,cAAc,CACf,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,4EAA4E;QAC5E,wCAAwC;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,4CAA4C,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,6BAA6B,CACjC,SAAuB;QAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EACjC,iBAAiB,CAClB,CAAC;QACF,MAAM,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,GAC/D,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,8BAA8B,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,SAAS,GAAgC,EAAE,CAAC;QAClD,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAC1C,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CACpC,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,gBAAgB,SAAS,GAAG;oBACzE,+BAA+B,UAAU,gCAAgC,CAC5E,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,oCAAoC,CACxC,SAAuB,EACvB,gBAA4B,EAC5B,cAA8B;QAE9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;QACnE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,mCAAmC,CACjC,cAAc,CAAC,SAAS,CAAC,EACzB,gBAAgB,EAChB,KAAK,EACL,cAAc,CACf,CACF,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sig-net/midnight",
-  "version": "0.12.0",
+  "version": "0.14.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/sig-net/midnight-integration",
@@ -40,7 +40,7 @@
     "@midnight-ntwrk/compact-runtime": "0.18.0-rc.1",
     "@midnight-ntwrk/midnight-js-types": "5.0.0-beta.4",
     "@noble/curves": "^2.2.0",
-    "@sig-net/midnight-serde": "^0.12.0",
+    "@sig-net/midnight-serde": "^0.14.0",
     "ethers": "^6.17.0"
   },
   "devDependencies": {

package/src/Signet.compact

@@ -7,8 +7,8 @@
 //    - client contract(s): contracts on the Midnight blockchain that integrate with the Signet Distributed MPC
 //                       to execute arbitrary transactions on foreign blockchains.
 //    - Signet singleton: a single contract on the Midnight blockchain holding the Signet registry for transaction
-//                        signature requests and responses, as well as the signed output of transactions executed
-//                        on foreign blockchains.
+//                        signature requests and responses, as well as signed attestations of transactions executed
+//                        on foreign blockchains (the execution outputs themselves travel off chain).
 //
 //  Usage:
 //   // Import this module at the start of a contract (resolved through node_modules via COMPACT_PATH):
@@ -29,12 +29,12 @@
 //                                        (via SignetSigner interface) to notify the MPC of a SignBidirectionalEvent.
 //  - SignatureRespondedEvent: Counterpart to SignBidirectionalEvent containing MPC generated signature requested by a SignBidirectionalEvent.
 //                             Posted by MPC back to Signet singleton for clients to extract to build a signed transaction.
-//  - RespondBidirectionalEvent: Attestation of a transaction executed on a foreign blockchain: the attestation
-//                               digest of the request id and serialised output (see calculateSignetAttestationDigest)
-//                               plus the MPC's ECDSA signature over that digest, signed with the MPC's RESPONSE
-//                               key for the requesting contract: the key derived from the client contract's
-//                               address + the fixed path "midnight response key". The output itself travels
-//                               off chain. Posted by MPC back to Signet singleton for clients to extract,
+//  - RespondBidirectionalEvent: Attestation of a transaction executed on a foreign blockchain: the MPC's ECDSA
+//                               signature over the attestation digest of the request id and serialised output
+//                               (see calculateSignetAttestationDigest), signed with the MPC's RESPONSE key for
+//                               the requesting contract: the key derived from the client contract's address +
+//                               the fixed path "midnight response key". Both the digest and the output itself
+//                               travel off chain. Posted by MPC back to Signet singleton for clients to extract,
 //                               verify (see verifyRespondBidirectionalEvent) and deliver back to the client
 //                               contract.
 //
@@ -50,6 +50,10 @@
 //    verifies the posted SignatureRespondedEvent and broadcasts txn to destination chain.
 // 4. MPC observes txn execution on destination chain, posts a RespondBidirectionalEvent
 //    attestation to the central Signet contract, and the client polls it by RequestId.
+//    The client recovers the execution output itself off chain (for EVM: the mined
+//    call's return data via debug_traceTransaction, also served by the fakenet
+//    responder's /responses/{requestId} helper API) and hands output plus attestation
+//    to its verify circuit. See "Output recovery" in this package's README.
 //
 // Read more:
 //   - For full integration examples (such as an ERC20 cross chain vault example) see
@@ -254,30 +258,30 @@ module Signet {
     signature: Signature;
   }
 
-  // Attestation of a transaction executed on a foreign blockchain: the 32-byte
-  // attestation digest of the request id and serialised output (see
-  // calculateSignetAttestationDigest) plus the MPC's ECDSA (secp256k1) signature
-  // over that digest, signed with the MPC's RESPONSE key for the requesting contract:
-  //   mpcResponseKey = f(mpcRootKey[keyVersion], sender, "midnight response key")
-  // i.e. the same derivation as request-signing keys but with the FIXED
-  // respond-bidirectional path, so it is per-client-contract yet independent of any
-  // request's own path (mirrors the MPC's per-chain "<chain> response key" convention).
-  // The execution output itself is unbounded, so it travels off chain. Posted by MPC
-  // back to Signet singleton for clients to extract, verify and deliver back to the
-  // client contract. Clients fetch the full output off chain, recompute the digest
-  // and verify via verifyRespondBidirectionalEvent. The singleton stores posts
-  // UNVERIFIED: client contracts must verify the signature themselves against their
-  // MPC response key.
+  // RespondBidirectionalEvent is the final step of the Sig Network Sign Bidirectional flow.
+  // It holds an MPC ECDSA signature of an attestation digest verifying foreign chain execution output.
+  //
+  // The attestation digest is a keccak256 hash of the request id concatenated with the serialised foreign
+  // transaction execution output:
+  //    attestationDigest = keccak256(requestId + serialisedOutput)
+  //
+  // The signature is the ECDSA secp256k1 signature over the attestation digest by the MPC with the
+  // client contract's MPC response key:
+  //  signature = signSECP256k1(mpcResponseKey, attestationDigest)
+  //
+  // Where the MPC response key is a per-client-contract key derived using the same derivation function
+  // as request signing keys, with the path set to the fixed "midnight response key":
+  //  mpcResponseKey = f(mpcRootKey[keyVersion], sender, "midnight response key")
+  //
+  // Storage & Verification:
+  // The execution output is of variable size, so it travels off chain, and the digest
+  // over it is recomputed rather than stored. The client fetches the output, recomputes
+  // the attestation digest and verifies the signature in-circuit via
+  // verifyRespondBidirectionalEvent against its derived MPC response key. The signature
+  // is the ONLY thing that distinguishes a genuine post from garbage: the Signet
+  // singleton is an unauthenticated log and stores every post unverified.
   export struct RespondBidirectionalEvent {
-    // The attestation digest the signature signs: keccak256 of the request id
-    // concatenated with the serialised output (see calculateSignetAttestationDigest).
-    // A checkpoint for off-chain readers: match a fetched output against the
-    // attestation (and check the signature) without any other inputs.
-    // verifyRespondBidirectionalEvent binds it to the actual output bytes in-circuit.
-    attestationDigest: Bytes<32>;
-
-    // The MPC's ECDSA signature over attestationDigest above. The verify
-    // circuit's r is this signature's bigR.x mod the curve order.
+    // The MPC's ECDSA signature over the attestation digest.
     signature: Signature;
   }
 
@@ -288,20 +292,13 @@ module Signet {
     requestId: RequestId;
   };
 
-  // The 32-byte attestation digest the MPC ECDSA-signs to attest a remote execution:
-  // keccak256 over the request id concatenated with the serialised output, exactly
-  // the MPC's respond-bidirectional construction (hash(request_id || serialized_output):
-  // one flat concatenation, one hash). The output is hashed AS GIVEN, at its exact
-  // width: no padding and no length binding. The width is a generic parameter, fixed
-  // by each client contract from its own respond serialisation schema. The digest
-  // commits to the output byte-for-byte: the keccak preimage of the
-  // [RequestId, Bytes<N>] pair is the raw concatenated bytes.
-  // secp256k1EcdsaVerify interprets the digest as a BIG-ENDIAN integer reduced mod
-  // the curve order (RFC 6979 convention). ONE implementation for everyone: client
-  // contracts call this in-circuit. The compiler cannot export a size-generic circuit
-  // top-level, so off-chain code uses the TS twin (calculateSignetAttestationDigest
-  // in ecdsa-attestation.ts), pinned byte-for-byte against the fixed-width
-  // instantiations circuits.compact exports as test oracles.
+  // Calculates the 32-byte attestation digest for a remote execution output:
+  //    attestationDigest = keccak256(requestId + serializedOutput)
+  //
+  // Inputs are concatenated raw with no padding or length prefixes. The output digest is
+  // interpreted as a big-endian integer during ECDSA signature verification.
+  //
+  // Note: Off-chain code should use the matching TypeScript twin in `ecdsa-attestation.ts`.
   export pure circuit calculateSignetAttestationDigest<#serializedOutputLength>(
     requestId: RequestId,
     serializedOutput: Bytes<serializedOutputLength>,
@@ -320,23 +317,21 @@ module Signet {
                  v[7],  v[6],  v[5],  v[4],  v[3],  v[2],  v[1],  v[0]];
   }
 
-  // Verify a RespondBidirectionalEvent against the serialised output it attests and
-  // a secp256k1 public key: the event's digest checkpoint must equal the recomputed
-  // attestation digest of (requestId, serializedOutput), and the event's ECDSA
-  // signature must sign that digest. This is the check client contracts run before
-  // accepting a response (the Signet singleton stores posts unverified). Pass the
-  // contract's MPC RESPONSE key (derived off-chain from the contract's address + the
-  // fixed path "midnight response key", typically hash-pinned in the contract's
-  // ledger at deploy time). The caller supplies serializedOutput at its exact
-  // unpadded width, per calculateSignetAttestationDigest.
+  // Verifies a RespondBidirectionalEvent against its execution output and MPC response key.
   //
-  // Takes the event as stored: the caller hands over the record it read, and the
-  // big-endian-to-little-endian re-encoding happens here, in one place for every
-  // integrator.
+  // Verification steps:
+  //  1. Recompute digest: digest = keccak256(requestId + serializedOutput)
+  //  2. Verify signature: secp256k1EcdsaVerify(digest, signature, mpcResponseKey) == true
   //
-  // ECDSA's r is bigR.x reduced mod the curve order. bigR.x is taken as-is: it is
-  // already below the order for all but a ~2^-128 fraction of signatures, and one
-  // that is not simply fails to verify.
+  // The caller supplies serializedOutput at its exact unpadded width, per
+  // calculateSignetAttestationDigest, and hands over the event record as stored: the
+  // big-endian-to-little-endian re-encoding of the signature scalars happens here, in one
+  // place for every integrator. ECDSA's r is bigR.x reduced mod the curve order; bigR.x is
+  // taken as-is, as it is already below the order for all but a ~2^-128 fraction of
+  // signatures, and one that is not simply fails to verify.
+  //
+  // Note: Client contracts must run this check before consuming outputs, as the Signet
+  // singleton stores responses unverified.
   export pure circuit verifyRespondBidirectionalEvent<#serializedOutputLength>(
     requestId: RequestId,
     serializedOutput: Bytes<serializedOutputLength>,
@@ -347,10 +342,8 @@ module Signet {
       requestId,
       serializedOutput,
     );
-    // Two consts rather than one `&&` expression: compactc 0.33 ICEs when the
-    // secp256k1EcdsaVerify call (its scalar casts) sits inside a subexpression.
-    const checkpointMatches = digest == respondBidirectionalEvent.attestationDigest;
-    const signatureValid = secp256k1EcdsaVerify(
+
+    return secp256k1EcdsaVerify(
       digest,
       Secp256k1EcdsaSignature {
         r: reverseBytes32(respondBidirectionalEvent.signature.bigR.x) as Secp256k1Scalar,
@@ -358,7 +351,6 @@ module Signet {
       },
       mpcResponseKey
     );
-    return checkpointMatches && signatureValid;
   }
 
   // Hash a secp256k1 public key exactly as client contracts pin it at deploy time