@sig-net/midnight 0.19.0 → 0.20.0-rc.1

package/dist/ecdsa-attestation.js

@@ -1,104 +1,32 @@
-// secp256k1 ECDSA helpers: the TS side of the respond-bidirectional
-// attestation flow in Signet.compact: SIGNING (which needs the secret
-// scalar, so it cannot be a circuit), key parsing/formatting, the
-// byte-order conversions between noble's bigints and the little-endian
-// scalar bytes Compact's casts read, and the attestation digest's TS twin.
+// secp256k1 ECDSA helpers: the TS side of Signet.compact's respond flows:
+// SIGNING (which needs the secret scalar, so it cannot be a circuit), key
+// parsing/formatting, the signature-record codecs both respond events
+// share, and the attestation digest's TS twin.
 // Everything provable stays in Compact where possible: in-circuit
-// verification is `verifyRespondBidirectionalEvent`, the deploy-time key pin
-// is `pureCircuits.signetKeyHash`. The digest circuit is size-generic and the
-// compiler cannot export size-generic circuits top-level, so the digest is
+// verification is `verifyRespondBidirectionalEvent`. The digest circuit is
+// size-generic and the compiler cannot export size-generic circuits
+// top-level, so the digest is
 // the ONE sanctioned TS twin here, pinned byte-for-byte against the
 // fixed-width oracle circuits circuits.compact exports (see
 // tests/ecdsa-attestation.test.ts).
 //
 // This belongs in github.com/sig-net/signet.js as its Midnight adapter,
 // kept here until upstreamed.
-import { ethers } from "ethers";
 import { secp256k1 } from "@noble/curves/secp256k1.js";
+import { ethers, Signature, toBeHex } from "ethers";
+import { bigintToBytes32BE, bytesToBigintBE, stripHexPrefix } from "./byte-codecs.js";
 /** secp256k1 curve (group) order n. */
 export const SECP256K1_ORDER = secp256k1.Point.Fn.ORDER;
-/** BLS12-381 scalar field order (the Compact `Field` type modulus). */
-export const BLS_ORDER = 52435875175126190479447740508185965837690552500527637822603658699938581184513n;
-/**
- * Convert little-endian bytes to a bigint. Matches Compact's
- * `Bytes<32> as Field` / `Bytes<32> as Secp256k1Scalar` interpretation (both
- * casts are little-endian).
- *
- * @param bytes - Little-endian byte array.
- * @returns The decoded non-negative integer.
- */
-export function bytesToBigint(bytes) {
-    let result = 0n;
-    for (let i = bytes.length - 1; i >= 0; i--) {
-        // The index is in range by construction: the assertion satisfies
-        // consumers compiling with noUncheckedIndexedAccess.
-        result = (result << 8n) | BigInt(bytes[i]);
-    }
-    return result;
-}
-/**
- * Convert a bigint to exactly 32 little-endian bytes. Matches Compact's
- * `Field as Bytes<32>` / `Secp256k1Scalar as Bytes<32>` encoding (the inverse
- * of {@link bytesToBigint}). Negative inputs are interpreted in the BLS
- * scalar field.
- *
- * @param n - The integer to encode.
- * @returns The 32-byte little-endian encoding.
- */
-export function bigintToBytes32(n) {
-    const buf = new Uint8Array(32);
-    let v = n < 0n ? n + BLS_ORDER : n;
-    for (let i = 0; i < 32; i++) {
-        buf[i] = Number(v & 0xffn);
-        v >>= 8n;
-    }
-    return buf;
-}
-/**
- * Convert big-endian bytes to a bigint (SEC1 coordinate order, the byte
- * order the respond events' stored signature uses).
- *
- * @param bytes - Big-endian byte array.
- * @returns The decoded non-negative integer.
- */
-export function bytesToBigintBE(bytes) {
-    let value = 0n;
-    for (const byte of bytes) {
-        value = (value << 8n) | BigInt(byte);
-    }
-    return value;
-}
-/**
- * Convert a bigint to exactly 32 BIG-endian bytes (SEC1 scalar/coordinate
- * order, also the ABI word encoding): the big-endian counterpart of
- * {@link bigintToBytes32} and the inverse of {@link bytesToBigintBE}.
- *
- * @param value - The non-negative integer to encode.
- * @returns The 32-byte big-endian encoding.
- * @throws Error if the value is negative or does not fit 32 bytes.
- */
-export function bigintToBytes32BE(value) {
-    if (value < 0n || value >= 1n << 256n) {
-        throw new Error(`value does not fit 32 big-endian bytes: ${value}`);
-    }
-    const out = new Uint8Array(32);
-    let v = value;
-    for (let i = 31; i >= 0; i--) {
-        out[i] = Number(v & 0xffn);
-        v >>= 8n;
-    }
-    return out;
-}
 /**
  * ECDSA-sign a 32-byte digest with a secp256k1 secret key, exactly as the
- * MPC signs the attestation digest: RFC 6979 deterministic, low-s, the digest
- * interpreted big-endian with NO extra hashing (`prehash: false`), the same
- * convention `secp256k1EcdsaVerify` checks in-circuit.
+ * MPC signs the attestation digest: the result verifies in-circuit against
+ * the matching public key. For posters and test fixtures.
  *
  * @param digest - The 32-byte digest to sign (e.g. the
  *   {@link calculateSignetAttestationDigest} output).
  * @param secretKey - The 32-byte secp256k1 secret key.
  * @returns The signature with its recovery id.
+ * @throws {Error} If no recovery id reproduces the signer's own public key.
  */
 export function signAttestationDigest(digest, secretKey) {
     const sigBytes = secp256k1.sign(digest, secretKey, { prehash: false });
@@ -107,10 +35,7 @@ export function signAttestationDigest(digest, secretKey) {
     const pk = secp256k1.getPublicKey(secretKey, false);
     const pkHex = Buffer.from(pk).toString("hex");
     for (const recoveryId of [0, 1]) {
-        const recovered = sig
-            .addRecoveryBit(recoveryId)
-            .recoverPublicKey(digest)
-            .toHex(false);
+        const recovered = sig.addRecoveryBit(recoveryId).recoverPublicKey(digest).toHex(false);
         if (recovered === pkHex) {
             return { r: sig.r, s: sig.s, recoveryId };
         }
@@ -119,22 +44,17 @@ export function signAttestationDigest(digest, secretKey) {
     throw new Error("signature does not recover to its own public key");
 }
 /**
- * Build the stored-form signature both respond events carry from a
- * scalar-form one: R is reconstructed by decompressing the curve point with
- * x = `r` and the parity `recoveryId` names, undoing the compression an
- * `r || s || v` signature performs. For MPC-side posters (the fakenet
- * signer, tests). The negligible caveat: an R.x that overflowed the curve
- * order cannot be told apart from its reduced twin, so reconstruction picks
- * the x equal to `r` itself.
+ * Encode a scalar-form signature as the stored-form record both respond
+ * events carry. For MPC-side posters (the fakenet signer) and test fixtures.
  *
  * @param signature - The scalar-form signature (the signer's output shape).
  * @returns The stored-form signature: R as a full point, big-endian bytes.
- * @throws Error if the recovery id is not 0 or 1, or `r` is not the x
+ * @throws {Error} If the recovery id is not 0 or 1, or `r` is not the x
  *   coordinate of a secp256k1 point.
  */
 export function ecdsaSignatureToMpcSignature(signature) {
     if (signature.recoveryId !== 0 && signature.recoveryId !== 1) {
-        throw new Error(`expected a recovery id of 0 or 1, got ${signature.recoveryId}`);
+        throw new Error(`expected a recovery id of 0 or 1, got ${String(signature.recoveryId)}`);
     }
     // SEC1 compressed form: parity prefix (02 even, 03 odd) || x big-endian.
     const parityPrefix = signature.recoveryId === 0 ? "02" : "03";
@@ -144,7 +64,9 @@ export function ecdsaSignatureToMpcSignature(signature) {
         point = secp256k1.Point.fromHex(`${parityPrefix}${xHex}`);
     }
     catch (error) {
-        throw new Error(`signature r is not the x coordinate of a secp256k1 point (${String(error)})`);
+        throw new Error(`signature r is not the x coordinate of a secp256k1 point (${String(error)})`, {
+            cause: error,
+        });
     }
     const uncompressed = point.toBytes(false); // 0x04 || x || y
     return {
@@ -154,17 +76,14 @@ export function ecdsaSignatureToMpcSignature(signature) {
     };
 }
 /**
- * Read a stored-form signature back into scalar form: the inverse of
+ * Decode a stored-form signature back to scalar form: the inverse of
  * {@link ecdsaSignatureToMpcSignature}, for off-chain consumers building a
- * transaction from the response. `r` comes out as `bigR.x` reduced mod the
- * curve order. Rejects records that do not even hold the shape, since posts
- * are unauthenticated and a malformed record is garbage. `bigR.y` is NOT
- * checked against the curve or the recovery id: signature verification is
- * the authority, not this decoder.
+ * transaction from the response. Checks shape only: acceptance does not mean
+ * the signature verifies.
  *
  * @param signature - The stored-form signature as posted.
  * @returns The scalar-form signature.
- * @throws Error if a component has the wrong byte length or the recovery id
+ * @throws {Error} If a component has the wrong byte length or the recovery id
  *   is not 0 or 1.
  */
 export function mpcSignatureToEcdsaSignature(signature) {
@@ -173,7 +92,7 @@ export function mpcSignatureToEcdsaSignature(signature) {
         throw new Error("expected 32-byte bigR.x/bigR.y/s in a stored signature");
     }
     if (recoveryId !== 0n && recoveryId !== 1n) {
-        throw new Error(`expected a recovery id of 0 or 1, got ${recoveryId}`);
+        throw new Error(`expected a recovery id of 0 or 1, got ${String(recoveryId)}`);
     }
     return {
         r: bytesToBigintBE(bigR.x) % SECP256K1_ORDER,
@@ -181,6 +100,43 @@ export function mpcSignatureToEcdsaSignature(signature) {
         recoveryId: Number(recoveryId),
     };
 }
+/**
+ * Decode a posted response signature record into an ethers
+ * {@link Signature}. Ethers' `r` is the ECDSA scalar (`bigR.x` reduced mod
+ * the curve order), not the raw coordinate.
+ *
+ * @param response - The posted signature record.
+ * @returns The ethers signature.
+ * @throws {Error} If the record is malformed (see {@link mpcSignatureToEcdsaSignature}).
+ */
+export function signatureRespondedEventToSignature(response) {
+    const { r, s, recoveryId } = mpcSignatureToEcdsaSignature(response.signature);
+    return Signature.from({
+        r: toBeHex(r, 32),
+        s: toBeHex(s, 32),
+        v: recoveryId + 27,
+    });
+}
+/**
+ * Encode an ethers signature as the {@link SignatureRespondedEvent} record a
+ * responder posts: the inverse of {@link signatureRespondedEventToSignature}.
+ * Responder-side (the fakenet posts through this; clients only verify), so
+ * it is exported through the `./testing` entry point with the other
+ * posting-side helpers.
+ *
+ * @param signature - The signature to encode (`r`/`s` as 0x hex, `yParity` 0 or 1).
+ * @returns The response record, ready to post.
+ * @throws {Error} If `r` is not the x coordinate of a secp256k1 point.
+ */
+export function signatureToSignatureRespondedEvent(signature) {
+    return {
+        signature: ecdsaSignatureToMpcSignature({
+            r: BigInt(signature.r),
+            s: BigInt(signature.s),
+            recoveryId: signature.yParity,
+        }),
+    };
+}
 /**
  * Parse a secp256k1 public key from SEC1 hex (compressed or uncompressed,
  * optional `0x` prefix) into the Compact runtime's `Secp256k1Point` shape:
@@ -188,16 +144,18 @@ export function mpcSignatureToEcdsaSignature(signature) {
  *
  * @param value - The SEC1 hex public key.
  * @returns The parsed point.
- * @throws Error if the value is not a valid secp256k1 public key.
+ * @throws {Error} If the value is not a valid secp256k1 public key.
  */
 export function parseSecp256k1PublicKey(value) {
-    const hex = value.startsWith("0x") || value.startsWith("0X") ? value.slice(2) : value;
+    const hex = stripHexPrefix(value);
     let point;
     try {
         point = secp256k1.Point.fromHex(hex);
     }
     catch (error) {
-        throw new Error(`not a secp256k1 public key in SEC1 hex: "${value}" (${String(error)})`);
+        throw new Error(`not a secp256k1 public key in SEC1 hex: "${value}" (${String(error)})`, {
+            cause: error,
+        });
     }
     const uncompressed = point.toBytes(false); // 0x04 || x || y
     return {
@@ -236,18 +194,10 @@ export function secp256k1PublicKeyOf(secretKey) {
 /**
  * The attestation digest of a respond-bidirectional response:
  * `keccak256(requestId || serializedOutput)`, the 32-byte digest the MPC
- * ECDSA-signs to attest a remote execution.
- *
- * TS twin of the size-generic Compact circuit
- * `calculateSignetAttestationDigest` (which the compiler cannot export
- * compiled, so this is the one sanctioned re-implementation, pinned
- * byte-for-byte against the fixed-width oracle circuits in
- * circuits.compact). The constructions agree because the circuit's keccak
- * preimage of the `[RequestId, Bytes<N>]` pair is the raw concatenated
- * bytes, and it matches the MPC's respond-bidirectional hash
- * (`hash(request_id || serialized_output)`: one flat concatenation, one
- * hash). The output is hashed AS GIVEN, at its exact length: no padding and
- * no length binding.
+ * ECDSA-signs to attest a remote execution. TS twin of the size-generic
+ * Compact circuit of the same name, pinned against its fixed-width oracle
+ * circuits in tests. The output is hashed as given, at its exact length:
+ * no padding, no length prefix.
  *
  * @param requestId - The 32-byte request id the response answers.
  * @param serializedOutput - The serialised execution output, exact unpadded bytes.
@@ -257,31 +207,17 @@ export function calculateSignetAttestationDigest(requestId, serializedOutput) {
     return ethers.getBytes(ethers.keccak256(ethers.concat([requestId, serializedOutput])));
 }
 /**
- * Off-chain check of a posted respond-bidirectional attestation: recompute
- * the attestation digest of `(requestId, serializedOutput)` and verify the
- * event's ECDSA signature over it against `mpcResponseKey`.
- *
- * The event's declared request id is unauthenticated routing data, so this
- * check is the ONLY way to tell a genuine post from garbage: the signet
- * contract's event log is unauthenticated and every post is emitted
- * unverified. Use it to sift the candidates
- * {@link SignetRequestResponseReader.getRespondBidirectionalEvents}
- * returns before handing one to a contract. It is the off-chain counterpart
- * of the in-circuit `verifyRespondBidirectionalEvent` and answers the same
- * question, so a post this accepts is the post that proves at claim time.
- *
- * Malformed records are garbage, not faults: a signature whose components
- * have the wrong width, whose `r` is off-curve, or which simply does not
- * verify all return `false` rather than throwing. High-`s` signatures are
- * accepted, matching the in-circuit verification (which enforces no low-`s`
- * policy) rather than the signer's own normalisation.
+ * Off-chain twin of the in-circuit `verifyRespondBidirectionalEvent`: checks
+ * a posted respond-bidirectional attestation against the execution output
+ * and the contract's pinned MPC response key. Clients run it to sift
+ * candidate posts before calling a contract: a post this accepts verifies
+ * in-circuit. Malformed records return `false` rather than throwing.
  *
  * @param requestId - The 32-byte request id the response answers.
  * @param serializedOutput - The serialised execution output, exact unpadded bytes.
  * @param event - The posted record to check, as read off the ledger.
- * @param mpcResponseKey - The response key the requesting contract pinned:
- *   the MPC key derived for its address and the fixed "midnight response key"
- *   path (see {@link deriveMidnightResponseKey}).
+ * @param mpcResponseKey - The response key the requesting contract pinned
+ *   (see {@link deriveMidnightResponseKey}).
  * @returns Whether the post is a genuine attestation of that output.
  */
 export function verifyRespondBidirectionalSignature(requestId, serializedOutput, event, mpcResponseKey) {

package/dist/ecdsa-attestation.js.map

@@ -1 +1 @@
-{"version":3,"file":"ecdsa-attestation.js","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,sEAAsE;AACtE,kEAAkE;AAClE,uEAAuE;AACvE,2EAA2E;AAC3E,kEAAkE;AAClE,6EAA6E;AAC7E,8EAA8E;AAC9E,2EAA2E;AAC3E,oEAAoE;AACpE,4DAA4D;AAC5D,oCAAoC;AACpC,EAAE;AACF,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAavD,uCAAuC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAExD,uEAAuE;AACvE,MAAM,CAAC,MAAM,SAAS,GAAG,8EAA8E,CAAC;AAExG;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3C,iEAAiE;QACjE,qDAAqD;QACrD,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,KAAK,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAkBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAkB,EAClB,SAAqB;IAErB,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/D,wEAAwE;IACxE,MAAM,EAAE,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,MAAM,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,GAAG;aAClB,cAAc,CAAC,UAAU,CAAC;aAC1B,gBAAgB,CAAC,MAAM,CAAC;aACxB,KAAK,CAAC,KAAK,CAAC,CAAC;QAChB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAyB;IACpE,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,yEAAyE;IACzE,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,YAAY,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6DAA6D,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;IAC5D,OAAO;QACL,IAAI,EAAE,EAAE,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACrE,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QACjC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAuB;IAClE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;IAC1C,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yCAAyC,UAAU,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe;QAC5C,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACtF,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;IAC5D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAqB;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAqB;IACxD,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAoB,EACpB,gBAA4B;IAE5B,OAAO,MAAM,CAAC,QAAQ,CACpB,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,mCAAmC,CACjD,SAAoB,EACpB,gBAA4B,EAC5B,KAAgC,EAChC,cAA8B;IAE9B,IAAI,SAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,SAAS,GAAG,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC7E,qEAAqE;IACrE,sCAAsC;IACtC,MAAM,gBAAgB,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5C,gBAAgB,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,gBAAgB,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACrC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACpB,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE;YAC3D,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"ecdsa-attestation.js","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,0EAA0E;AAC1E,sEAAsE;AACtE,+CAA+C;AAC/C,kEAAkE;AAClE,2EAA2E;AAC3E,oEAAoE;AACpE,8BAA8B;AAC9B,oEAAoE;AACpE,4DAA4D;AAC5D,oCAAoC;AACpC,EAAE;AACF,wEAAwE;AACxE,8BAA8B;AAG9B,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEpD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAYtF,uCAAuC;AACvC,MAAM,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAgBxD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAkB,EAAE,SAAqB;IAC7E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC/D,wEAAwE;IACxE,MAAM,EAAE,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,KAAK,MAAM,UAAU,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAChC,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvF,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,6EAA6E;IAC7E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAyB;IACpE,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,yEAAyE;IACzE,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,YAAY,GAAG,IAAI,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6DAA6D,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YAC7F,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;IAC5D,OAAO;QACL,IAAI,EAAE,EAAE,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE;QACrE,CAAC,EAAE,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;QACjC,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;KACzC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAuB;IAClE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,SAAS,CAAC;IAC1C,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,eAAe;QAC5C,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;KAC/B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kCAAkC,CAAC,QAAiC;IAClF,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,4BAA4B,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC9E,OAAO,SAAS,CAAC,IAAI,CAAC;QACpB,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC;QACjB,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC;QACjB,CAAC,EAAE,UAAU,GAAG,EAAE;KACnB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kCAAkC,CAChD,SAAiD;IAEjD,OAAO;QACL,SAAS,EAAE,4BAA4B,CAAC;YACtC,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACtB,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACtB,UAAU,EAAE,SAAS,CAAC,OAAO;SAC9B,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACnD,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4CAA4C,KAAK,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;YACvF,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;IACL,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;IAC5D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAqB;IAC5D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACvE,OAAO,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAqB;IACxD,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO;QACL,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7C,CAAC,EAAE,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9C,QAAQ,EAAE,KAAK;KAChB,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,gCAAgC,CAC9C,SAAoB,EACpB,gBAA4B;IAE5B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mCAAmC,CACjD,SAAoB,EACpB,gBAA4B,EAC5B,KAAgC,EAChC,cAA8B;IAE9B,IAAI,SAAyB,CAAC;IAC9B,IAAI,CAAC;QACH,SAAS,GAAG,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAC7E,qEAAqE;IACrE,sCAAsC;IACtC,MAAM,gBAAgB,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC5C,gBAAgB,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACxD,gBAAgB,CAAC,GAAG,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACrC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACpB,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACtD,SAAS,CAAC,GAAG,CAAC,iBAAiB,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE;YAC3D,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/epsilon-derivation.d.ts

@@ -12,37 +12,33 @@ export declare const EPSILON_DERIVATION_PREFIX = "sig.network v2.0.0 epsilon der
 export declare const MIDNIGHT_TESTNET_CHAIN_ID = "midnight:testnet";
 /**
  * The FIXED derivation path of the MPC's respond-bidirectional RESPONSE key
- * for Midnight client contracts, mirroring the real MPC's per-chain
- * `<chain> response key` convention (sig-net/mpc
- * chain-signatures/node/src/respond_bidirectional.rs, where the epsilon
- * requester is the requesting tx's SENDER). The response key is derived PER
- * CLIENT CONTRACT from (the client contract's own address, this path): it is
- * not the MPC root key and not the key that signs the requested transaction.
- *
- * The key depends on the client contract's address, and a Midnight contract
- * address is a hash over the deploy (constructor arguments included), so the
- * key cannot exist before the deploy transaction is built. Client contracts
- * therefore pin its hash with a one-shot `initialise` circuit right after
- * deploy (never a constructor seal) and verify RespondBidirectionalEvents
- * against the pin.
+ * for Midnight client contracts. It enters the derivation string verbatim,
+ * mirroring the real MPC's per-chain `<chain> response key` convention
+ * (sig-net/mpc chain-signatures/node/src/respond_bidirectional.rs). The
+ * response key is derived PER CLIENT CONTRACT from (the client contract's
+ * own address, this path): it is not the MPC root key and not the key that
+ * signs the requested transaction. Client contracts pin its hash with a
+ * one-shot `initialise` circuit after deploy and verify
+ * RespondBidirectionalEvents against the pin.
  */
 export declare const MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH = "midnight response key";
 /**
  * Derive the EVM address the MPC network signs from for a given Midnight
  * contract and derivation path, using the sig-net v2.0.0 epsilon scheme:
- * `epsilon = keccak256("<prefix>:<chainId>:<contractAddress>:<path>")` and
- * `derivedPubKey = mpcRootPubKey + epsilon * G` on secp256k1.
- *
- * The MPC treats `path` as an opaque string: the vault's own account uses the
- * literal path `"vault"`, a user's account uses the lowercase hex of their
- * identity commitment.
+ * `epsilon = keccak256("<prefix>:<chainId>:<requester>:<path>")` and
+ * `derivedPubKey = mpcRootPubKey + epsilon * G` on secp256k1. The MPC
+ * treats `path` as an opaque string.
  *
  * @param mpcSecp256k1PubkeyHex - The MPC root secp256k1 public key as 0x-hex
- *   (compressed or uncompressed; normalized internally).
+ *   (compressed or uncompressed, normalised internally).
  * @param contractAddress - The Midnight contract address the request
- *   originates from (the "requester" in the derivation string).
- * @param path - The derivation path string (e.g. `"vault"` or a commitment
- *   hex).
+ *   originates from (`0x` prefix optional, case-insensitive: it enters the
+ *   derivation string through {@link normaliseRequesterAddress}).
+ * @param path - The derivation path string. For an account derived from an
+ *   on-ledger request record, this is the MPC's rendering of the record's
+ *   `path: Bytes<32>`: the lowercase hex of the FULL 32 bytes, no `0x`
+ *   prefix and no trimming ({@link bytesToHex} of the raw bytes), so
+ *   `0xab..00` and `0xab..` derive different accounts.
  * @param chainId - CAIP-2 chain id component of the derivation string.
  * @returns The derived EVM address as a 0x-prefixed EIP-55 checksummed string.
  */
@@ -63,10 +59,8 @@ export declare function deriveEpsilon(requester: string, path: string, chainId?:
 /**
  * Derive the MPC's respond-bidirectional RESPONSE key for one client
  * contract, public side: what the client pins via its `initialise` circuit
- * (`MPC_RESPONSE_KEY`) and what response verification checks against. See
- * {@link MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH} for the scheme (the requester
- * is the client contract's own address, mirroring the real MPC's
- * sender-scoped derivation).
+ * and what response verification checks against. See
+ * {@link MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH} for the scheme.
  *
  * @param mpcSecp256k1PubkeyHex - The MPC root secp256k1 public key as 0x-hex
  *   (compressed or uncompressed).
@@ -79,14 +73,13 @@ export declare function deriveMidnightResponseKey(mpcSecp256k1PubkeyHex: string,
  * Derive the MPC's respond-bidirectional RESPONSE key for one client
  * contract, secret side: `(rootSecret + epsilon) mod n`. MPC-side only
  * (the fakenet signer, test harnesses): a real client never holds the root
- * key. The result feeds `signAttestationDigest` directly.
+ * key.
  *
- * @param mpcRootSecretKey - The 32-byte MPC root secret key (big-endian, the
- *   standard secp256k1 encoding).
+ * @param mpcRootSecretKey - The 32-byte MPC root secret key (big-endian).
  * @param clientContractAddress - The client contract's Midnight address
  *   (`0x` prefix optional, case-insensitive).
  * @returns The 32-byte response secret key (big-endian).
- * @throws Error if the root key is not 32 bytes or the derived scalar is 0.
+ * @throws {Error} If the root key is not 32 bytes or the derived scalar is 0.
  */
 export declare function deriveMidnightResponseSecretKey(mpcRootSecretKey: Uint8Array, clientContractAddress: string): Uint8Array;
 //# sourceMappingURL=epsilon-derivation.d.ts.map

package/dist/epsilon-derivation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"epsilon-derivation.d.ts","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAaA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,0CAA0C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mCAAmC,0BAA0B,CAAC;AAE3E;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,EAC7B,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAGR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAKR;AA6BD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,qBAAqB,EAAE,MAAM,EAC7B,qBAAqB,EAAE,MAAM,GAC5B,cAAc,CAQhB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,UAAU,EAC5B,qBAAqB,EAAE,MAAM,GAC5B,UAAU,CAwBZ"}
+{"version":3,"file":"epsilon-derivation.d.ts","sourceRoot":"","sources":["../src/epsilon-derivation.ts"],"names":[],"mappings":"AAWA,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,0CAA0C,CAAC;AAEjF;;;GAGG;AACH,eAAO,MAAM,yBAAyB,qBAAqB,CAAC;AAE5D;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mCAAmC,0BAA0B,CAAC;AAe3E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,CAC9B,qBAAqB,EAAE,MAAM,EAC7B,eAAe,EAAE,MAAM,EACvB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAQR;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE,MAAkC,GAC1C,MAAM,CAKR;AAuBD;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CACvC,qBAAqB,EAAE,MAAM,EAC7B,qBAAqB,EAAE,MAAM,GAC5B,cAAc,CAQhB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,+BAA+B,CAC7C,gBAAgB,EAAE,UAAU,EAC5B,qBAAqB,EAAE,MAAM,GAC5B,UAAU,CAeZ"}

package/dist/epsilon-derivation.js

@@ -2,13 +2,11 @@
 //
 // This belongs in github.com/sig-net/signet.js, kept here until upstreamed.
 //
-// v2.0.0 (COLON-separated) is the only scheme the MPC answers. The v1.0.0
-// COMMA-separated form is `key_version 0` in the MPC's KDF and is not served;
-// the Compact contracts also assert `keyVersion >= 1`, which selects v2. The
-// two schemes hash different strings and derive different accounts, so a
-// v1 signer silently gets the wrong address rather than an error.
+// v2.0.0 (COLON-separated) is the only scheme the MPC answers: the Compact
+// contracts assert `keyVersion >= 1`, which selects v2.
 import { secp256k1 } from "@noble/curves/secp256k1.js";
 import { computeAddress, keccak256, SigningKey, toUtf8Bytes } from "ethers";
+import { bigintToBytes32BE, bytesToBigintBE, stripHexPrefix } from "./byte-codecs.js";
 import { SECP256K1_ORDER } from "./ecdsa-attestation.js";
 /**
  * Domain prefix of the sig-net v2.0.0 epsilon derivation scheme. The full
@@ -23,42 +21,50 @@ export const EPSILON_DERIVATION_PREFIX = "sig.network v2.0.0 epsilon derivation"
 export const MIDNIGHT_TESTNET_CHAIN_ID = "midnight:testnet";
 /**
  * The FIXED derivation path of the MPC's respond-bidirectional RESPONSE key
- * for Midnight client contracts, mirroring the real MPC's per-chain
- * `<chain> response key` convention (sig-net/mpc
- * chain-signatures/node/src/respond_bidirectional.rs, where the epsilon
- * requester is the requesting tx's SENDER). The response key is derived PER
- * CLIENT CONTRACT from (the client contract's own address, this path): it is
- * not the MPC root key and not the key that signs the requested transaction.
- *
- * The key depends on the client contract's address, and a Midnight contract
- * address is a hash over the deploy (constructor arguments included), so the
- * key cannot exist before the deploy transaction is built. Client contracts
- * therefore pin its hash with a one-shot `initialise` circuit right after
- * deploy (never a constructor seal) and verify RespondBidirectionalEvents
- * against the pin.
+ * for Midnight client contracts. It enters the derivation string verbatim,
+ * mirroring the real MPC's per-chain `<chain> response key` convention
+ * (sig-net/mpc chain-signatures/node/src/respond_bidirectional.rs). The
+ * response key is derived PER CLIENT CONTRACT from (the client contract's
+ * own address, this path): it is not the MPC root key and not the key that
+ * signs the requested transaction. Client contracts pin its hash with a
+ * one-shot `initialise` circuit after deploy and verify
+ * RespondBidirectionalEvents against the pin.
  */
 export const MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH = "midnight response key";
+/**
+ * Normalise a Midnight contract address for use as the requester component
+ * of the derivation string: strip an optional `0x` prefix and lowercase.
+ * Both sides of the protocol (the deploy pinning a key and the MPC signing
+ * with it) derive through this, so the rendering always agrees.
+ *
+ * @param contractAddress - The Midnight contract address, with or without `0x`.
+ * @returns The address as lowercase hex with no prefix.
+ */
+function normaliseRequesterAddress(contractAddress) {
+    return stripHexPrefix(contractAddress).toLowerCase();
+}
 /**
  * Derive the EVM address the MPC network signs from for a given Midnight
  * contract and derivation path, using the sig-net v2.0.0 epsilon scheme:
- * `epsilon = keccak256("<prefix>:<chainId>:<contractAddress>:<path>")` and
- * `derivedPubKey = mpcRootPubKey + epsilon * G` on secp256k1.
- *
- * The MPC treats `path` as an opaque string: the vault's own account uses the
- * literal path `"vault"`, a user's account uses the lowercase hex of their
- * identity commitment.
+ * `epsilon = keccak256("<prefix>:<chainId>:<requester>:<path>")` and
+ * `derivedPubKey = mpcRootPubKey + epsilon * G` on secp256k1. The MPC
+ * treats `path` as an opaque string.
  *
  * @param mpcSecp256k1PubkeyHex - The MPC root secp256k1 public key as 0x-hex
- *   (compressed or uncompressed; normalized internally).
+ *   (compressed or uncompressed, normalised internally).
  * @param contractAddress - The Midnight contract address the request
- *   originates from (the "requester" in the derivation string).
- * @param path - The derivation path string (e.g. `"vault"` or a commitment
- *   hex).
+ *   originates from (`0x` prefix optional, case-insensitive: it enters the
+ *   derivation string through {@link normaliseRequesterAddress}).
+ * @param path - The derivation path string. For an account derived from an
+ *   on-ledger request record, this is the MPC's rendering of the record's
+ *   `path: Bytes<32>`: the lowercase hex of the FULL 32 bytes, no `0x`
+ *   prefix and no trimming ({@link bytesToHex} of the raw bytes), so
+ *   `0xab..00` and `0xab..` derive different accounts.
  * @param chainId - CAIP-2 chain id component of the derivation string.
  * @returns The derived EVM address as a 0x-prefixed EIP-55 checksummed string.
  */
 export function deriveEvmAddress(mpcSecp256k1PubkeyHex, contractAddress, path, chainId = MIDNIGHT_TESTNET_CHAIN_ID) {
-    const derivedPoint = deriveChildPoint(mpcSecp256k1PubkeyHex, contractAddress, path, chainId);
+    const derivedPoint = deriveChildPoint(mpcSecp256k1PubkeyHex, normaliseRequesterAddress(contractAddress), path, chainId);
     return computeAddress(`0x${derivedPoint.toHex(false)}`);
 }
 /**
@@ -79,32 +85,26 @@ export function deriveEpsilon(requester, path, chainId = MIDNIGHT_TESTNET_CHAIN_
     // server's scalar arithmetic reduces implicitly.
     return BigInt(keccak256(toUtf8Bytes(fullPath))) % SECP256K1_ORDER;
 }
-/** Derive the child public key as a noble curve point (internal shape). */
+/**
+ * Derive the child public key as a noble curve point (internal shape).
+ *
+ * @param mpcSecp256k1PubkeyHex - The MPC root public key in SEC1 hex.
+ * @param requester - The normalised requester address.
+ * @param path - The derivation path component.
+ * @param chainId - The chain id component.
+ * @returns The derived child point on secp256k1.
+ */
 function deriveChildPoint(mpcSecp256k1PubkeyHex, requester, path, chainId) {
     const epsilon = deriveEpsilon(requester, path, chainId);
     const rootPubKeyHex = SigningKey.computePublicKey(mpcSecp256k1PubkeyHex, false);
     const rootPoint = secp256k1.Point.fromHex(rootPubKeyHex.slice(2));
     return epsilon === 0n ? rootPoint : rootPoint.add(secp256k1.Point.BASE.multiply(epsilon));
 }
-/**
- * Normalise a Midnight contract address for use as the requester component
- * of the derivation string: strip an optional `0x` prefix and lowercase.
- * Both sides of the protocol (the deploy pinning a key and the MPC signing
- * with it) derive through this, so the rendering always agrees.
- */
-function normaliseRequesterAddress(contractAddress) {
-    const hex = contractAddress.startsWith("0x") || contractAddress.startsWith("0X")
-        ? contractAddress.slice(2)
-        : contractAddress;
-    return hex.toLowerCase();
-}
 /**
  * Derive the MPC's respond-bidirectional RESPONSE key for one client
  * contract, public side: what the client pins via its `initialise` circuit
- * (`MPC_RESPONSE_KEY`) and what response verification checks against. See
- * {@link MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH} for the scheme (the requester
- * is the client contract's own address, mirroring the real MPC's
- * sender-scoped derivation).
+ * and what response verification checks against. See
+ * {@link MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH} for the scheme.
  *
  * @param mpcSecp256k1PubkeyHex - The MPC root secp256k1 public key as 0x-hex
  *   (compressed or uncompressed).
@@ -120,34 +120,24 @@ export function deriveMidnightResponseKey(mpcSecp256k1PubkeyHex, clientContractA
  * Derive the MPC's respond-bidirectional RESPONSE key for one client
  * contract, secret side: `(rootSecret + epsilon) mod n`. MPC-side only
  * (the fakenet signer, test harnesses): a real client never holds the root
- * key. The result feeds `signAttestationDigest` directly.
+ * key.
  *
- * @param mpcRootSecretKey - The 32-byte MPC root secret key (big-endian, the
- *   standard secp256k1 encoding).
+ * @param mpcRootSecretKey - The 32-byte MPC root secret key (big-endian).
  * @param clientContractAddress - The client contract's Midnight address
  *   (`0x` prefix optional, case-insensitive).
  * @returns The 32-byte response secret key (big-endian).
- * @throws Error if the root key is not 32 bytes or the derived scalar is 0.
+ * @throws {Error} If the root key is not 32 bytes or the derived scalar is 0.
  */
 export function deriveMidnightResponseSecretKey(mpcRootSecretKey, clientContractAddress) {
     if (mpcRootSecretKey.length !== 32) {
-        throw new Error(`MPC root secret key must be 32 bytes, got ${mpcRootSecretKey.length}`);
-    }
-    let root = 0n;
-    for (const byte of mpcRootSecretKey) {
-        root = (root << 8n) | BigInt(byte);
+        throw new Error(`MPC root secret key must be 32 bytes, got ${String(mpcRootSecretKey.length)}`);
     }
+    const root = bytesToBigintBE(mpcRootSecretKey);
     const epsilon = deriveEpsilon(normaliseRequesterAddress(clientContractAddress), MIDNIGHT_RESPOND_BIDIRECTIONAL_PATH, MIDNIGHT_TESTNET_CHAIN_ID);
     const child = (root + epsilon) % SECP256K1_ORDER;
     if (child === 0n) {
         throw new Error("derived response secret key is zero (invalid scalar)");
     }
-    const out = new Uint8Array(32);
-    let value = child;
-    for (let i = 31; i >= 0; i--) {
-        out[i] = Number(value & 0xffn);
-        value >>= 8n;
-    }
-    return out;
+    return bigintToBytes32BE(child);
 }
 //# sourceMappingURL=epsilon-derivation.js.map