@sig-net/midnight 0.13.0 → 0.15.0

package/dist/signet-request-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"signet-request-resolver.js","sourceRoot":"","sources":["../src/signet-request-resolver.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,uDAAuD;AACvD,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,6DAA6D;AAC7D,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,qCAAqC;AAErC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAiC7E;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,qBAAqB;IACf,MAAM,CAA0B;IAEjD,8EAA8E;IAC9E,4DAA4D;IAC3C,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAC;IAEhF;;OAEG;IACH,YAAY,MAAmC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,OAAO,CACX,SAAuB,EACvB,YAA2C;QAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,KAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,CAAC,uDAAuD;QAC3E,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC,CAAC,qDAAqD;QACzE,CAAC;QACD,MAAM,OAAO,GAAG,qBAAqB,CACnC,KAAK,CAAC,IAAI,EACV,YAAY,CAAC,kBAAkB,EAC/B,SAAS,CACV,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC,CAAC,kDAAkD;QACtE,CAAC;QACD,MAAM,QAAQ,GAA0B;YACtC,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,SAAS;YACT,OAAO;SACR,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}
+{"version":3,"file":"signet-request-resolver.js","sourceRoot":"","sources":["../src/signet-request-resolver.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,uDAAuD;AACvD,6EAA6E;AAC7E,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,0EAA0E;AAC1E,6DAA6D;AAC7D,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,qCAAqC;AAErC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAiC7E;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,qBAAqB;IACf,MAAM,CAA0B;IAEjD,8EAA8E;IAC9E,4DAA4D;IAC3C,aAAa,GAAG,IAAI,GAAG,EAAuC,CAAC;IAEhF;;OAEG;IACH,YAAY,MAAmC;QAC7C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,OAAO,CACX,SAAuB,EACvB,YAA2C;QAE3C,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,KAAwC,CAAC;QAC7C,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAC3E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC,CAAC,uDAAuD;QAC3E,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;YACjB,OAAO,SAAS,CAAC,CAAC,qDAAqD;QACzE,CAAC;QACD,MAAM,OAAO,GAAG,qBAAqB,CACnC,KAAK,CAAC,IAAI,EACV,YAAY,CAAC,YAAY,EACzB,SAAS,CACV,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC,CAAC,kDAAkD;QACtE,CAAC;QACD,MAAM,QAAQ,GAA0B;YACtC,aAAa,EAAE,YAAY,CAAC,aAAa;YACzC,SAAS;YACT,OAAO;SACR,CAAC;QACF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF"}

package/dist/signet-request-response-reader.d.ts

@@ -1,8 +1,9 @@
 import type { PublicDataProvider } from "@midnight-ntwrk/midnight-js-types";
 import type { Transaction } from "ethers";
 import { type SignatureRespondedEvent, type RespondBidirectionalEvent } from "./signet-contract-state-reader.ts";
+import { type Secp256k1Point } from "./ecdsa-attestation.ts";
 import type { RawContractState } from "./signature-state-reading.ts";
-import type { SignBidirectionalEvent, RequestIdHex } from "./signet-requests.ts";
+import { type SignBidirectionalEvent, type RequestIdHex } from "./signet-requests.ts";
 /**
  * The least of midnight-js's `PublicDataProvider` the reader needs: raw
  * contract state by address. Declared structurally so tests can satisfy it
@@ -26,12 +27,13 @@ export interface SignetRequestResponseReaderConfig {
     /** Address of the signet-compliant requester contract (e.g. the vault). */
     readonly requesterContractAddress: string;
     /**
-     * Ledger field position of the requester contract's request index: the
-     * same position the contract passes as `requestsIndexField` in its
-     * notifications. A contract is free to declare the index at any field, so
-     * the reader cannot assume one.
+     * Resolved ledger-tree path of the requester contract's request index: the
+     * same path the contract packs as `requestsPath` in its notifications
+     * (`[4]` for a flat contract's field 4, longer once chunking applies). A
+     * contract is free to declare the index at any field, so the reader cannot
+     * assume one.
      */
-    readonly requesterRequestsIndexField: number;
+    readonly requesterRequestsPath: readonly number[];
     /** Address of the central signet contract. */
     readonly signetContractAddress: string;
     /** Source of raw contract state, e.g. midnight-js's `indexerPublicDataProvider`. */
@@ -85,13 +87,13 @@ export declare class SignetRequestResponseReader {
     private queryRawState;
     /**
      * Fetch the request record for `requestId` from the requester contract's
-     * request index (at the configured `requesterRequestsIndexField`). Cached
+     * request index (at the configured `requesterRequestsPath`). Cached
      * after the first fetch.
      *
      * @param requestId - The request id to look up.
      * @returns The stored request record.
      * @throws Error when the requester contract has no state or holds no
-     *   request under `requestId` at the configured index field.
+     *   request under `requestId` at the configured index path.
      */
     getSignatureRequest(requestId: RequestIdHex): Promise<SignBidirectionalEvent>;
     /**
@@ -153,12 +155,11 @@ export declare class SignetRequestResponseReader {
     /**
      * Fetch every respond-bidirectional response posted for `requestId`, in
      * post (count) order. UNVERIFIED: the signet contract stores posts without
-     * checking them, so any entry may be garbage. Verify each candidate before
-     * trusting it (in-circuit at claim time, or off-chain: recompute the digest
-     * with the TS twin `calculateSignetAttestationDigest`, match it against the
-     * event's `attestationDigest`, and verify the ECDSA signature against the
-     * MPC response key you expect). An empty array simply means none posted
-     * yet: poll again.
+     * checking them, so any entry may be garbage. Each post carries a signature
+     * and nothing else, so verifying it against the MPC response key you expect
+     * is the only way to pick the genuine one: in-circuit at claim time, or off
+     * chain with {@link verifyRespondBidirectionalSignature} over the output you
+     * fetched. An empty array simply means none posted yet: poll again.
      *
      * @param requestId - The request id whose responses to enumerate.
      * @returns The posted records, index = count, empty when none yet.
@@ -166,5 +167,29 @@ export declare class SignetRequestResponseReader {
      *   disagrees with the log (inconsistent ledger).
      */
     getRespondBidirectionalEvents(requestId: RequestIdHex): Promise<RespondBidirectionalEvent[]>;
+    /**
+     * Fetch the respond-bidirectional posts for `requestId` and return the
+     * first (lowest count) one whose signature verifies over
+     * `serializedOutput` against `mpcResponseKey`: the off-chain twin of the
+     * check the client contract runs in-circuit, and the only way to pick a
+     * genuine post out of an unauthenticated log now that posts carry nothing
+     * but a signature.
+     *
+     * The output must be the exact unpadded bytes the attestation commits to
+     * (the packed respond payload, recomputed from the execution output the
+     * client fetched), so a post that verifies here is the post that proves at
+     * claim time.
+     *
+     * @param requestId - The request id to fetch a verified attestation for.
+     * @param serializedOutput - The serialised execution output the attestation
+     *   must commit to, exact unpadded bytes.
+     * @param mpcResponseKey - The MPC response key the requesting contract
+     *   pinned at deploy (see `deriveMidnightResponseKey`).
+     * @returns The first verifying post, or `undefined` when none has been
+     *   posted yet (poll again) or none attests this output.
+     * @throws Error when the signet contract has no state, or its counter
+     *   disagrees with the log (inconsistent ledger).
+     */
+    getVerifiedRespondBidirectionalEvent(requestId: RequestIdHex, serializedOutput: Uint8Array, mpcResponseKey: Secp256k1Point): Promise<RespondBidirectionalEvent | undefined>;
 }
 //# sourceMappingURL=signet-request-response-reader.d.ts.map

package/dist/signet-request-response-reader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signet-request-response-reader.d.ts","sourceRoot":"","sources":["../src/signet-request-response-reader.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAG1C,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC/B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAKrE,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACb,MAAM,sBAAsB,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,kBAAkB,CAChB,eAAe,EAAE,UAAU,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,GACvE,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC/C;AAED,yEAAyE;AACzE,MAAM,WAAW,iCAAiC;IAChD,2EAA2E;IAC3E,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;IAC7C,8CAA8C;IAC9C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,oFAAoF;IACpF,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;CACtD;AAED,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,QAAQ,EAAE,uBAAuB,CAAC;IAClC,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,2FAA2F;AAC3F,MAAM,WAAW,+BAA+B;IAC9C;;;OAGG;IACH,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IACnC;;;OAGG;IACH,QAAQ,EAAE,wBAAwB,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAG3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAGzB;IAEJ;;OAEG;gBACS,MAAM,EAAE,iCAAiC;IAIrD;;;;;;;OAOG;YACW,aAAa;IAc3B;;;;;;;;;OASG;IACG,mBAAmB,CACvB,SAAS,EAAE,YAAY,GACtB,OAAO,CAAC,sBAAsB,CAAC;IAwBlC;;;;;;;;;OASG;IACG,qBAAqB,CACzB,SAAS,EAAE,YAAY,GACtB,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAwBrC;;;;;;;;;;;;;OAaG;IACG,kCAAkC,CACtC,SAAS,EAAE,YAAY,EACvB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,+BAA+B,CAAC;IAiC3C;;;;;;;;;;;OAWG;IACG,yBAAyB,CAC7B,SAAS,EAAE,YAAY,GACtB,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;;;;;;;;;;;;OAeG;IACG,uBAAuB,CAC3B,SAAS,EAAE,YAAY,EACvB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAcnC;;;;;;;;;;;;;;OAcG;IACG,6BAA6B,CACjC,SAAS,EAAE,YAAY,GACtB,OAAO,CAAC,yBAAyB,EAAE,CAAC;CAuBxC"}
+{"version":3,"file":"signet-request-response-reader.d.ts","sourceRoot":"","sources":["../src/signet-request-response-reader.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AAG1C,OAAO,EAGL,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAC/B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAEL,KAAK,cAAc,EACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAKrE,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EAClB,MAAM,sBAAsB,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,uBAAuB;IACtC;;;;;;OAMG;IACH,kBAAkB,CAChB,eAAe,EAAE,UAAU,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,GACvE,OAAO,CAAC;QAAE,IAAI,EAAE,gBAAgB,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC/C;AAED,yEAAyE;AACzE,MAAM,WAAW,iCAAiC;IAChD,2EAA2E;IAC3E,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;IAC1C;;;;;;OAMG;IACH,QAAQ,CAAC,qBAAqB,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD,8CAA8C;IAC9C,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC;IACvC,oFAAoF;IACpF,QAAQ,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;CACtD;AAED,4DAA4D;AAC5D,MAAM,WAAW,wBAAwB;IACvC,kEAAkE;IAClE,KAAK,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,QAAQ,EAAE,uBAAuB,CAAC;IAClC,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gEAAgE;IAChE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,2FAA2F;AAC3F,MAAM,WAAW,+BAA+B;IAC9C;;;OAGG;IACH,QAAQ,CAAC,EAAE,uBAAuB,CAAC;IACnC;;;OAGG;IACH,QAAQ,EAAE,wBAAwB,EAAE,CAAC;CACtC;AAED;;;;;GAKG;AACH,qBAAa,2BAA2B;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;IAG3D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAGzB;IAEJ;;OAEG;gBACS,MAAM,EAAE,iCAAiC;IAIrD;;;;;;;OAOG;YACW,aAAa;IAc3B;;;;;;;;;OASG;IACG,mBAAmB,CACvB,SAAS,EAAE,YAAY,GACtB,OAAO,CAAC,sBAAsB,CAAC;IAwBlC;;;;;;;;;OASG;IACG,qBAAqB,CACzB,SAAS,EAAE,YAAY,GACtB,OAAO,CAAC,uBAAuB,EAAE,CAAC;IAwBrC;;;;;;;;;;;;;OAaG;IACG,kCAAkC,CACtC,SAAS,EAAE,YAAY,EACvB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,+BAA+B,CAAC;IAiC3C;;;;;;;;;;;OAWG;IACG,yBAAyB,CAC7B,SAAS,EAAE,YAAY,GACtB,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;;;;;;;;;;;;OAeG;IACG,uBAAuB,CAC3B,SAAS,EAAE,YAAY,EACvB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC;IAcnC;;;;;;;;;;;;;OAaG;IACG,6BAA6B,CACjC,SAAS,EAAE,YAAY,GACtB,OAAO,CAAC,yBAAyB,EAAE,CAAC;IAwBvC;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACG,oCAAoC,CACxC,SAAS,EAAE,YAAY,EACvB,gBAAgB,EAAE,UAAU,EAC5B,cAAc,EAAE,cAAc,GAC7B,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC;CAWlD"}

package/dist/signet-request-response-reader.js

@@ -11,7 +11,9 @@
 import { lookupSignetRequestAt } from "./signature-requests-state-reader.js";
 import { readSignetContractLedgerFromState, signetMapEntryKey, } from "./signet-contract-state-reader.js";
 import { recoverSignatureResponseSigner } from "./signature-response-verification.js";
+import { verifyRespondBidirectionalSignature, } from "./ecdsa-attestation.js";
 import { signBidirectionalEventToSignedEvmTransaction, signBidirectionalEventToUnsignedEvmTransaction, } from "./signet-evtype2tx-requests.js";
+import { requestIdBytes, } from "./signet-requests.js";
 /**
  * Reader over one requester contract / signet contract pair.
  * Construct once per pair and reuse: fetched request records are cached (they
@@ -45,13 +47,13 @@ export class SignetRequestResponseReader {
     }
     /**
      * Fetch the request record for `requestId` from the requester contract's
-     * request index (at the configured `requesterRequestsIndexField`). Cached
+     * request index (at the configured `requesterRequestsPath`). Cached
      * after the first fetch.
      *
      * @param requestId - The request id to look up.
      * @returns The stored request record.
      * @throws Error when the requester contract has no state or holds no
-     *   request under `requestId` at the configured index field.
+     *   request under `requestId` at the configured index path.
      */
     async getSignatureRequest(requestId) {
         const cached = this.requestCache.get(requestId);
@@ -59,10 +61,10 @@ export class SignetRequestResponseReader {
             return cached;
         }
         const raw = await this.queryRawState(this.config.requesterContractAddress, "requester");
-        const request = lookupSignetRequestAt(raw, this.config.requesterRequestsIndexField, requestId);
+        const request = lookupSignetRequestAt(raw, this.config.requesterRequestsPath, requestId);
         if (request === undefined) {
             throw new Error(`request ${requestId} is not on the requester contract's ledger ` +
-                `(request index at field ${this.config.requesterRequestsIndexField}): was it submitted?`);
+                `(request index at path ${JSON.stringify(this.config.requesterRequestsPath)}): was it submitted?`);
         }
         this.requestCache.set(requestId, request);
         return request;
@@ -181,12 +183,11 @@ export class SignetRequestResponseReader {
     /**
      * Fetch every respond-bidirectional response posted for `requestId`, in
      * post (count) order. UNVERIFIED: the signet contract stores posts without
-     * checking them, so any entry may be garbage. Verify each candidate before
-     * trusting it (in-circuit at claim time, or off-chain: recompute the digest
-     * with the TS twin `calculateSignetAttestationDigest`, match it against the
-     * event's `attestationDigest`, and verify the ECDSA signature against the
-     * MPC response key you expect). An empty array simply means none posted
-     * yet: poll again.
+     * checking them, so any entry may be garbage. Each post carries a signature
+     * and nothing else, so verifying it against the MPC response key you expect
+     * is the only way to pick the genuine one: in-circuit at claim time, or off
+     * chain with {@link verifyRespondBidirectionalSignature} over the output you
+     * fetched. An empty array simply means none posted yet: poll again.
      *
      * @param requestId - The request id whose responses to enumerate.
      * @returns The posted records, index = count, empty when none yet.
@@ -208,5 +209,32 @@ export class SignetRequestResponseReader {
         }
         return responses;
     }
+    /**
+     * Fetch the respond-bidirectional posts for `requestId` and return the
+     * first (lowest count) one whose signature verifies over
+     * `serializedOutput` against `mpcResponseKey`: the off-chain twin of the
+     * check the client contract runs in-circuit, and the only way to pick a
+     * genuine post out of an unauthenticated log now that posts carry nothing
+     * but a signature.
+     *
+     * The output must be the exact unpadded bytes the attestation commits to
+     * (the packed respond payload, recomputed from the execution output the
+     * client fetched), so a post that verifies here is the post that proves at
+     * claim time.
+     *
+     * @param requestId - The request id to fetch a verified attestation for.
+     * @param serializedOutput - The serialised execution output the attestation
+     *   must commit to, exact unpadded bytes.
+     * @param mpcResponseKey - The MPC response key the requesting contract
+     *   pinned at deploy (see `deriveMidnightResponseKey`).
+     * @returns The first verifying post, or `undefined` when none has been
+     *   posted yet (poll again) or none attests this output.
+     * @throws Error when the signet contract has no state, or its counter
+     *   disagrees with the log (inconsistent ledger).
+     */
+    async getVerifiedRespondBidirectionalEvent(requestId, serializedOutput, mpcResponseKey) {
+        const events = await this.getRespondBidirectionalEvents(requestId);
+        return events.find((event) => verifyRespondBidirectionalSignature(requestIdBytes(requestId), serializedOutput, event, mpcResponseKey));
+    }
 }
 //# sourceMappingURL=signet-request-response-reader.js.map

package/dist/signet-request-response-reader.js.map

@@ -1 +1 @@
-{"version":3,"file":"signet-request-response-reader.js","sourceRoot":"","sources":["../src/signet-request-response-reader.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,uBAAuB;AACvB,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,mEAAmE;AACnE,2EAA2E;AAC3E,iCAAiC;AAKjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EACL,iCAAiC,EACjC,iBAAiB,GAGlB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AAEtF,OAAO,EACL,4CAA4C,EAC5C,8CAA8C,GAC/C,MAAM,gCAAgC,CAAC;AAoExC;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAoC;IAE3D,wEAAwE;IACvD,YAAY,GAAG,IAAI,GAAG,EAGpC,CAAC;IAEJ;;OAEG;IACH,YAAY,MAAyC;QACnD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,eAAuB,EACvB,IAAY;QAEZ,MAAM,KAAK,GACT,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,cAAc,eAAe,qBAAqB,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CACvB,SAAuB;QAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EACpC,WAAW,CACZ,CAAC;QACF,MAAM,OAAO,GAAG,qBAAqB,CACnC,GAAG,EACH,IAAI,CAAC,MAAM,CAAC,2BAA2B,EACvC,SAAS,CACV,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,6CAA6C;gBAC/D,2BAA2B,IAAI,CAAC,MAAM,CAAC,2BAA2B,sBAAsB,CAC3F,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,qBAAqB,CACzB,SAAuB;QAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EACjC,iBAAiB,CAClB,CAAC;QACF,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,GACrC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,SAAS,GAA8B,EAAE,CAAC;QAChD,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAC7B,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CACpC,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,gBAAgB,SAAS,GAAG;oBAC5D,+BAA+B,UAAU,gCAAgC,CAC5E,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,kCAAkC,CACtC,SAAuB,EACvB,cAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAC5B,CAAC,QAAQ,EAAE,KAAK,EAA4B,EAAE;YAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,8BAA8B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK;oBACL,QAAQ;oBACR,cAAc,EAAE,8BAA8B,MAAM,CAAC,KAAK,CAAC,GAAG;iBAC/D,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC1D,OAAO;oBACL,KAAK;oBACL,QAAQ;oBACR,MAAM;oBACN,cAAc,EAAE,aAAa,MAAM,cAAc,cAAc,EAAE;iBAClE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrC,CAAC,CACF,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,EAAE,QAAQ;YACxE,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,yBAAyB,CAC7B,SAAuB;QAEvB,OAAO,8CAA8C,CACnD,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAC1C,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,uBAAuB,CAC3B,SAAuB,EACvB,cAAsB;QAEtB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,kCAAkC,CAChE,SAAS,EACT,cAAc,CACf,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,4EAA4E;QAC5E,wCAAwC;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,4CAA4C,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,6BAA6B,CACjC,SAAuB;QAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EACjC,iBAAiB,CAClB,CAAC;QACF,MAAM,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,GAC/D,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,8BAA8B,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,SAAS,GAAgC,EAAE,CAAC;QAClD,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAC1C,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CACpC,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,gBAAgB,SAAS,GAAG;oBACzE,+BAA+B,UAAU,gCAAgC,CAC5E,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"signet-request-response-reader.js","sourceRoot":"","sources":["../src/signet-request-response-reader.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,8EAA8E;AAC9E,0EAA0E;AAC1E,uBAAuB;AACvB,yEAAyE;AACzE,2EAA2E;AAC3E,uEAAuE;AACvE,mEAAmE;AACnE,2EAA2E;AAC3E,iCAAiC;AAKjC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAC;AAC7E,OAAO,EACL,iCAAiC,EACjC,iBAAiB,GAGlB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,8BAA8B,EAAE,MAAM,sCAAsC,CAAC;AACtF,OAAO,EACL,mCAAmC,GAEpC,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,4CAA4C,EAC5C,8CAA8C,GAC/C,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,cAAc,GAGf,MAAM,sBAAsB,CAAC;AAiE9B;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IACrB,MAAM,CAAoC;IAE3D,wEAAwE;IACvD,YAAY,GAAG,IAAI,GAAG,EAGpC,CAAC;IAEJ;;OAEG;IACH,YAAY,MAAyC;QACnD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACzB,eAAuB,EACvB,IAAY;QAEZ,MAAM,KAAK,GACT,MAAM,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,2BAA2B,IAAI,cAAc,eAAe,qBAAqB,CAClF,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC;IACpB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,mBAAmB,CACvB,SAAuB;QAEvB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,wBAAwB,EACpC,WAAW,CACZ,CAAC;QACF,MAAM,OAAO,GAAG,qBAAqB,CACnC,GAAG,EACH,IAAI,CAAC,MAAM,CAAC,qBAAqB,EACjC,SAAS,CACV,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,6CAA6C;gBAC/D,0BAA0B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,sBAAsB,CACpG,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,qBAAqB,CACzB,SAAuB;QAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EACjC,iBAAiB,CAClB,CAAC;QACF,MAAM,EAAE,iBAAiB,EAAE,UAAU,EAAE,GACrC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,SAAS,GAA8B,EAAE,CAAC;QAChD,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAC7B,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CACpC,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,6BAA6B,KAAK,gBAAgB,SAAS,GAAG;oBAC5D,+BAA+B,UAAU,gCAAgC,CAC5E,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,kCAAkC,CACtC,SAAuB,EACvB,cAAsB;QAEtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAC5B,CAAC,QAAQ,EAAE,KAAK,EAA4B,EAAE;YAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC5B,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,8BAA8B,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YAC7D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO;oBACL,KAAK;oBACL,QAAQ;oBACR,cAAc,EAAE,8BAA8B,MAAM,CAAC,KAAK,CAAC,GAAG;iBAC/D,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC1D,OAAO;oBACL,KAAK;oBACL,QAAQ;oBACR,MAAM;oBACN,cAAc,EAAE,aAAa,MAAM,cAAc,cAAc,EAAE;iBAClE,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrC,CAAC,CACF,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,EAAE,QAAQ;YACxE,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,yBAAyB,CAC7B,SAAuB;QAEvB,OAAO,8CAA8C,CACnD,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAC1C,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,uBAAuB,CAC3B,SAAuB,EACvB,cAAsB;QAEtB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAI,CAAC,kCAAkC,CAChE,SAAS,EACT,cAAc,CACf,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,4EAA4E;QAC5E,wCAAwC;QACxC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC1D,OAAO,4CAA4C,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACzE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,6BAA6B,CACjC,SAAuB;QAEvB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAClC,IAAI,CAAC,MAAM,CAAC,qBAAqB,EACjC,iBAAiB,CAClB,CAAC;QACF,MAAM,EAAE,8BAA8B,EAAE,uBAAuB,EAAE,GAC/D,iCAAiC,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,UAAU,GAAG,8BAA8B,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACvE,MAAM,SAAS,GAAgC,EAAE,CAAC;QAClD,KAAK,IAAI,KAAK,GAAG,EAAE,EAAE,KAAK,GAAG,UAAU,EAAE,KAAK,EAAE,EAAE,CAAC;YACjD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,GAAG,CAC1C,iBAAiB,CAAC,SAAS,EAAE,KAAK,CAAC,CACpC,CAAC;YACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,gBAAgB,SAAS,GAAG;oBACzE,+BAA+B,UAAU,gCAAgC,CAC5E,CAAC;YACJ,CAAC;YACD,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,oCAAoC,CACxC,SAAuB,EACvB,gBAA4B,EAC5B,cAA8B;QAE9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,SAAS,CAAC,CAAC;QACnE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAC3B,mCAAmC,CACjC,cAAc,CAAC,SAAS,CAAC,EACzB,gBAAgB,EAChB,KAAK,EACL,cAAc,CACf,CACF,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sig-net/midnight",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "repository": {
     "type": "git",
     "url": "https://github.com/sig-net/midnight-integration",
@@ -40,7 +40,7 @@
     "@midnight-ntwrk/compact-runtime": "0.18.0-rc.1",
     "@midnight-ntwrk/midnight-js-types": "5.0.0-beta.4",
     "@noble/curves": "^2.2.0",
-    "@sig-net/midnight-serde": "^0.13.0",
+    "@sig-net/midnight-serde": "^0.15.0",
     "ethers": "^6.17.0"
   },
   "devDependencies": {

package/src/Signet.compact

@@ -29,12 +29,12 @@
 //                                        (via SignetSigner interface) to notify the MPC of a SignBidirectionalEvent.
 //  - SignatureRespondedEvent: Counterpart to SignBidirectionalEvent containing MPC generated signature requested by a SignBidirectionalEvent.
 //                             Posted by MPC back to Signet singleton for clients to extract to build a signed transaction.
-//  - RespondBidirectionalEvent: Attestation of a transaction executed on a foreign blockchain: the attestation
-//                               digest of the request id and serialised output (see calculateSignetAttestationDigest)
-//                               plus the MPC's ECDSA signature over that digest, signed with the MPC's RESPONSE
-//                               key for the requesting contract: the key derived from the client contract's
-//                               address + the fixed path "midnight response key". The output itself travels
-//                               off chain. Posted by MPC back to Signet singleton for clients to extract,
+//  - RespondBidirectionalEvent: Attestation of a transaction executed on a foreign blockchain: the MPC's ECDSA
+//                               signature over the attestation digest of the request id and serialised output
+//                               (see calculateSignetAttestationDigest), signed with the MPC's RESPONSE key for
+//                               the requesting contract: the key derived from the client contract's address +
+//                               the fixed path "midnight response key". Both the digest and the output itself
+//                               travel off chain. Posted by MPC back to Signet singleton for clients to extract,
 //                               verify (see verifyRespondBidirectionalEvent) and deliver back to the client
 //                               contract.
 //
@@ -50,6 +50,10 @@
 //    verifies the posted SignatureRespondedEvent and broadcasts txn to destination chain.
 // 4. MPC observes txn execution on destination chain, posts a RespondBidirectionalEvent
 //    attestation to the central Signet contract, and the client polls it by RequestId.
+//    The client recovers the execution output itself off chain (for EVM: the mined
+//    call's return data via debug_traceTransaction, also served by the fakenet
+//    responder's /responses/{requestId} helper API) and hands output plus attestation
+//    to its verify circuit. See "Output recovery" in this package's README.
 //
 // Read more:
 //   - For full integration examples (such as an ERC20 cross chain vault example) see
@@ -205,22 +209,62 @@ module Signet {
   // Notification delivered by client contracts via cross contract call to Signet singleton
   // (via SignetSigner interface) to notify the MPC of a SignBidirectionalEvent.
   export struct SignBidirectionalEventNotification {
-      version: Uint<8>;   // payload layout tag; 1 = the V1 layout:
-                          // callerAddress (32) ++ requestsIndexField (1) ++ zero padding (95)
-      payload: Bytes<128>;
+    // Notification payload layout version.
+    // Curent Layout Version: 1 (see constructSignBidirectionalEventNotificationV1)
+    version: Uint<8>;
+    // Payload containing serialised notification payload.
+    payload: Bytes<128>;
   }
 
-  // Construction helper for the V1 SignBidirectionalEventNotification
+  // Construction helper for the V1 SignBidirectionalEventNotification.
+  //
+  // The payload is a pointer for the MPC. It names the contract that holds the
+  // SignBidirectionalEventMap (callerAddress) and the position of that map in the
+  // contract's raw on-chain state (requestsPathDepth + requestsPath). The MPC
+  // follows the path through the raw state tree to read the authenticated
+  // request, without the caller's compiled contract.
+  //
+  // Why a path: compactc packs a contract's public ledger fields into a tree of
+  // state values whose array nodes hold at most 15 entries (the compiler's
+  // maximum-ledger-segment-length). A contract with 15 or fewer ledger fields
+  // keeps each field directly in the root array, so field N sits at path [N]
+  // (depth 1). Past 15 fields the compiler splits the declaration list into
+  // segments of at most 15, remainder segment first, and the root array holds
+  // the segments. Each split adds one level to the tree and one entry to every
+  // field's path. Example: 20 fields split into segments of 5 and 15, so
+  // fields 0..4 sit at [0, 0]..[0, 4] and fields 5..19 sit at
+  // [1, 0]..[1, 14] (depth 2).
+  //
+  // How to determine the values: read the path from your contract's compiled
+  // artifacts, do not derive it by hand. The compiler records each field's
+  // resolved path as its "index" in managed/<contract>/compiler/contract-info.json
+  // (a bare number N means path [N]). The generated
+  // managed/<contract>/contract/index.js accessors walk the same indices, for
+  // example state.asArray()[1].asArray()[14] for a map recorded at [1, 14].
+  // Set requestsPathDepth to the number of path entries and requestsPath to
+  // the path itself, zero padded to 4 entries: [1, 14] becomes depth 2 and
+  // path [1, 14, 0, 0].
   export pure circuit constructSignBidirectionalEventNotificationV1(
     // Address of the client contract that stores and notifies of this SignBidirectionalEvent.
     // Set with kernel.self(). MUST match sender in associated SignBidirectionalEvent.
     callerAddress: ContractAddress,
-    requestsIndexField: Uint<8>
+    // Number of meaningful entries in requestsPath: 1 for a flat (15 or fewer
+    // field) contract, one more per chunk level after that (max 4).
+    requestsPathDepth: Uint<8>,
+    // Resolved ledger-tree path of the caller's SignBidirectionalEventMap, from
+    // its contract-info.json "index". Entries at and beyond requestsPathDepth
+    // are zero.
+    requestsPath: Vector<4, Uint<8>>
   ): SignBidirectionalEventNotification {
     return SignBidirectionalEventNotification {
       version: 1,
-      // 128 = 32 + 1 + 95
-      payload: Bytes[...callerAddress.bytes, requestsIndexField, ...default<Bytes<95>>]
+      // 128 = 32 + 1 + 4 + 91
+      payload: Bytes[
+        ...callerAddress.bytes,
+        requestsPathDepth,
+        requestsPath[0], requestsPath[1], requestsPath[2], requestsPath[3],
+        ...default<Bytes<91>>
+      ]
     };
   }
 
@@ -254,30 +298,30 @@ module Signet {
     signature: Signature;
   }
 
-  // Attestation of a transaction executed on a foreign blockchain: the 32-byte
-  // attestation digest of the request id and serialised output (see
-  // calculateSignetAttestationDigest) plus the MPC's ECDSA (secp256k1) signature
-  // over that digest, signed with the MPC's RESPONSE key for the requesting contract:
-  //   mpcResponseKey = f(mpcRootKey[keyVersion], sender, "midnight response key")
-  // i.e. the same derivation as request-signing keys but with the FIXED
-  // respond-bidirectional path, so it is per-client-contract yet independent of any
-  // request's own path (mirrors the MPC's per-chain "<chain> response key" convention).
-  // The execution output itself is unbounded, so it travels off chain. Posted by MPC
-  // back to Signet singleton for clients to extract, verify and deliver back to the
-  // client contract. Clients fetch the full output off chain, recompute the digest
-  // and verify via verifyRespondBidirectionalEvent. The singleton stores posts
-  // UNVERIFIED: client contracts must verify the signature themselves against their
-  // MPC response key.
+  // RespondBidirectionalEvent is the final step of the Sig Network Sign Bidirectional flow.
+  // It holds an MPC ECDSA signature of an attestation digest verifying foreign chain execution output.
+  //
+  // The attestation digest is a keccak256 hash of the request id concatenated with the serialised foreign
+  // transaction execution output:
+  //    attestationDigest = keccak256(requestId + serialisedOutput)
+  //
+  // The signature is the ECDSA secp256k1 signature over the attestation digest by the MPC with the
+  // client contract's MPC response key:
+  //  signature = signSECP256k1(mpcResponseKey, attestationDigest)
+  //
+  // Where the MPC response key is a per-client-contract key derived using the same derivation function
+  // as request signing keys, with the path set to the fixed "midnight response key":
+  //  mpcResponseKey = f(mpcRootKey[keyVersion], sender, "midnight response key")
+  //
+  // Storage & Verification:
+  // The execution output is of variable size, so it travels off chain, and the digest
+  // over it is recomputed rather than stored. The client fetches the output, recomputes
+  // the attestation digest and verifies the signature in-circuit via
+  // verifyRespondBidirectionalEvent against its derived MPC response key. The signature
+  // is the ONLY thing that distinguishes a genuine post from garbage: the Signet
+  // singleton is an unauthenticated log and stores every post unverified.
   export struct RespondBidirectionalEvent {
-    // The attestation digest the signature signs: keccak256 of the request id
-    // concatenated with the serialised output (see calculateSignetAttestationDigest).
-    // A checkpoint for off-chain readers: match a fetched output against the
-    // attestation (and check the signature) without any other inputs.
-    // verifyRespondBidirectionalEvent binds it to the actual output bytes in-circuit.
-    attestationDigest: Bytes<32>;
-
-    // The MPC's ECDSA signature over attestationDigest above. The verify
-    // circuit's r is this signature's bigR.x mod the curve order.
+    // The MPC's ECDSA signature over the attestation digest.
     signature: Signature;
   }
 
@@ -288,20 +332,13 @@ module Signet {
     requestId: RequestId;
   };
 
-  // The 32-byte attestation digest the MPC ECDSA-signs to attest a remote execution:
-  // keccak256 over the request id concatenated with the serialised output, exactly
-  // the MPC's respond-bidirectional construction (hash(request_id || serialized_output):
-  // one flat concatenation, one hash). The output is hashed AS GIVEN, at its exact
-  // width: no padding and no length binding. The width is a generic parameter, fixed
-  // by each client contract from its own respond serialisation schema. The digest
-  // commits to the output byte-for-byte: the keccak preimage of the
-  // [RequestId, Bytes<N>] pair is the raw concatenated bytes.
-  // secp256k1EcdsaVerify interprets the digest as a BIG-ENDIAN integer reduced mod
-  // the curve order (RFC 6979 convention). ONE implementation for everyone: client
-  // contracts call this in-circuit. The compiler cannot export a size-generic circuit
-  // top-level, so off-chain code uses the TS twin (calculateSignetAttestationDigest
-  // in ecdsa-attestation.ts), pinned byte-for-byte against the fixed-width
-  // instantiations circuits.compact exports as test oracles.
+  // Calculates the 32-byte attestation digest for a remote execution output:
+  //    attestationDigest = keccak256(requestId + serializedOutput)
+  //
+  // Inputs are concatenated raw with no padding or length prefixes. The output digest is
+  // interpreted as a big-endian integer during ECDSA signature verification.
+  //
+  // Note: Off-chain code should use the matching TypeScript twin in `ecdsa-attestation.ts`.
   export pure circuit calculateSignetAttestationDigest<#serializedOutputLength>(
     requestId: RequestId,
     serializedOutput: Bytes<serializedOutputLength>,
@@ -320,23 +357,21 @@ module Signet {
                  v[7],  v[6],  v[5],  v[4],  v[3],  v[2],  v[1],  v[0]];
   }
 
-  // Verify a RespondBidirectionalEvent against the serialised output it attests and
-  // a secp256k1 public key: the event's digest checkpoint must equal the recomputed
-  // attestation digest of (requestId, serializedOutput), and the event's ECDSA
-  // signature must sign that digest. This is the check client contracts run before
-  // accepting a response (the Signet singleton stores posts unverified). Pass the
-  // contract's MPC RESPONSE key (derived off-chain from the contract's address + the
-  // fixed path "midnight response key", typically hash-pinned in the contract's
-  // ledger at deploy time). The caller supplies serializedOutput at its exact
-  // unpadded width, per calculateSignetAttestationDigest.
+  // Verifies a RespondBidirectionalEvent against its execution output and MPC response key.
   //
-  // Takes the event as stored: the caller hands over the record it read, and the
-  // big-endian-to-little-endian re-encoding happens here, in one place for every
-  // integrator.
+  // Verification steps:
+  //  1. Recompute digest: digest = keccak256(requestId + serializedOutput)
+  //  2. Verify signature: secp256k1EcdsaVerify(digest, signature, mpcResponseKey) == true
   //
-  // ECDSA's r is bigR.x reduced mod the curve order. bigR.x is taken as-is: it is
-  // already below the order for all but a ~2^-128 fraction of signatures, and one
-  // that is not simply fails to verify.
+  // The caller supplies serializedOutput at its exact unpadded width, per
+  // calculateSignetAttestationDigest, and hands over the event record as stored: the
+  // big-endian-to-little-endian re-encoding of the signature scalars happens here, in one
+  // place for every integrator. ECDSA's r is bigR.x reduced mod the curve order; bigR.x is
+  // taken as-is, as it is already below the order for all but a ~2^-128 fraction of
+  // signatures, and one that is not simply fails to verify.
+  //
+  // Note: Client contracts must run this check before consuming outputs, as the Signet
+  // singleton stores responses unverified.
   export pure circuit verifyRespondBidirectionalEvent<#serializedOutputLength>(
     requestId: RequestId,
     serializedOutput: Bytes<serializedOutputLength>,
@@ -347,10 +382,8 @@ module Signet {
       requestId,
       serializedOutput,
     );
-    // Two consts rather than one `&&` expression: compactc 0.33 ICEs when the
-    // secp256k1EcdsaVerify call (its scalar casts) sits inside a subexpression.
-    const checkpointMatches = digest == respondBidirectionalEvent.attestationDigest;
-    const signatureValid = secp256k1EcdsaVerify(
+
+    return secp256k1EcdsaVerify(
       digest,
       Secp256k1EcdsaSignature {
         r: reverseBytes32(respondBidirectionalEvent.signature.bigR.x) as Secp256k1Scalar,
@@ -358,7 +391,6 @@ module Signet {
       },
       mpcResponseKey
     );
-    return checkpointMatches && signatureValid;
   }
 
   // Hash a secp256k1 public key exactly as client contracts pin it at deploy time