@sig-net/midnight 0.19.0 → 0.21.0-rc.1

package/dist/constants.js

@@ -2,9 +2,7 @@
 // structs, and the published per-network counterparty values (the MPC root
 // public key and the signet contract address). Field widths mirror
 // Signet.compact (the wire format: keep in lockstep), and the string
-// constants are the values the MPC network routes on. Ported from the MVP's
-// contract-cli signet/constants.ts, adapted to the refactor's zero-padded
-// convention (Compact `pad(N, "text")`).
+// constants are the values the MPC network routes on.
 //
 // The routing constants belong in github.com/sig-net/signet.js, kept here
 // until upstreamed.
@@ -17,32 +15,17 @@ export const SELECTOR_BYTES = 4;
 /**
  * The complete serialised output the MPC attests for a FAILED remote
  * execution (reverted or replaced transaction): the 4-byte error marker
- * `0xdeadbeef` followed by one `0x01` byte. Schema-independent by design,
- * mirroring the canonical MPC's Borsh-format failure payload (sig-net/mpc,
- * node/src/respond_bidirectional.rs), so every respond schema shares one
- * fixed 5-byte failure width. Clients recompute their failure candidate from
- * this constant alone: no receipt or schema needed.
- *
- * The exact-equality check ({@link isMpcFailureOutput}) is unambiguous for
- * every respond schema whose packed width differs from 5 bytes. A schema
- * whose packed width is exactly 5 could in principle produce a legitimate
- * output equal to this sentinel, and such clients must route settlement by
- * digest-candidate matching (recompute both the real-output candidate and
- * the failure candidate, and see which digest the MPC attested), never by
- * inspecting output bytes.
+ * `0xdeadbeef` followed by one `0x01` byte, mirroring the canonical MPC's
+ * failure payload (sig-net/mpc, node/src/respond_bidirectional.rs). A
+ * respond schema whose packed width is exactly 5 bytes could produce a
+ * legitimate output equal to this sentinel: such clients must route
+ * settlement by digest-candidate matching, never by inspecting output
+ * bytes. See {@link isMpcFailureOutput}.
  */
 export const MPC_FAILURE_OUTPUT = new Uint8Array([0xde, 0xad, 0xbe, 0xef, 0x01]);
 /**
  * Whether an attested serialised output IS the MPC's fixed failure payload:
- * exact byte equality with the 5-byte {@link MPC_FAILURE_OUTPUT} (the length
- * must be exactly 5 and every byte must match). A prefix check would be
- * unsafe, as a legitimate packed output can begin with the same bytes.
- *
- * Unambiguous for every respond schema whose packed width differs from 5
- * bytes. A schema whose packed width is exactly 5 could in principle produce
- * a legitimate output equal to the sentinel: such clients must route
- * settlement by digest-candidate matching instead of inspecting output
- * bytes (see {@link MPC_FAILURE_OUTPUT}).
+ * exact byte equality with the 5-byte {@link MPC_FAILURE_OUTPUT}.
  *
  * @param serializedOutput - The attested serialised output.
  * @returns `true` when the output equals the MPC failure payload exactly.
@@ -52,9 +35,8 @@ export function isMpcFailureOutput(serializedOutput) {
         MPC_FAILURE_OUTPUT.every((byte, index) => serializedOutput[index] === byte));
 }
 /**
- * Default MPC key version (`keyVersion` field value). Version 0 is the
- * unsupported legacy format: the canonical MPC (and
- * `constructSignBidirectionalEvent`) requires `keyVersion >= 1`.
+ * Default MPC key version (`keyVersion` field value). The canonical MPC
+ * (and `constructSignBidirectionalEvent`) requires `keyVersion >= 1`.
  */
 export const SIGNET_DEFAULT_KEY_VERSION = 1n;
 /**
@@ -65,12 +47,12 @@ export const SIGNET_DEFAULT_KEY_VERSION = 1n;
  * @param text - The ASCII text to encode.
  * @param length - The fixed field width in bytes.
  * @returns `text`'s bytes followed by zero padding to exactly `length`.
- * @throws If the encoded text does not fit in `length` bytes.
+ * @throws {Error} If the encoded text does not fit in `length` bytes.
  */
 export function asciiPadded(text, length) {
     const encoded = new TextEncoder().encode(text);
     if (encoded.length > length) {
-        throw new Error(`"${text}" is ${encoded.length} bytes: does not fit the ${length}-byte field`);
+        throw new Error(`"${text}" is ${String(encoded.length)} bytes: does not fit the ${String(length)}-byte field`);
     }
     const out = new Uint8Array(length);
     out.set(encoded);
@@ -78,10 +60,7 @@ export function asciiPadded(text, length) {
 }
 /**
  * A named Midnight network: the single source of the network names shared
- * across the `@sig-net/midnight*` packages. midnight-js types a network id
- * as a bare `string` with no companion enum, so the names live here, and
- * `@sig-net/midnight-contract-deploy`'s network-id plumbing widens this
- * enum back to the SDK's string type for its deploy config.
+ * across the `@sig-net/midnight*` packages.
  */
 export var MidnightNetwork;
 (function (MidnightNetwork) {
@@ -108,14 +87,12 @@ const mpcRootPublicKeys = {
 /**
  * The MPC root public key of a deployed Midnight network, as hex: the
  * `mpcRootPublicKey` every client key derivation starts from (see
- * `deriveEvmAddress`). Only the {@link DeployedNetwork} networks have a
- * fixed key. A local standalone stack has none: its setup generates a fresh
- * `MPC_ROOT_KEY` per stack (the integration-test setup prints it and
- * appends it to the repo-root `.env`).
+ * `deriveEvmAddress`). A local standalone stack has no fixed key: its setup
+ * generates a fresh `MPC_ROOT_KEY` per stack.
  *
  * @param networkId - The deployed network to look up.
  * @returns The network's MPC root public key.
- * @throws Error when the network's key is not yet published in this package.
+ * @throws {Error} When the network's key is not yet published in this package.
  */
 export function getMpcRootPublicKey(networkId) {
     const publicKey = mpcRootPublicKeys[networkId];
@@ -136,15 +113,12 @@ const signetContractAddresses = {
 /**
  * The address of the central signet singleton contract on a deployed
  * Midnight network: the `signetContractAddress` a
- * `SignetRequestResponseReader` polls. Only the {@link DeployedNetwork}
- * networks have a fixed address. A local standalone stack has none: each
- * stack deploys its own singleton (the integration-test setup prints the
- * address as `MIDNIGHT_SIGNET_CONTRACT_ADDRESS` and appends it to the
- * repo-root `.env`).
+ * `SignetRequestResponseReader` polls. A local standalone stack has no
+ * fixed address: each stack deploys its own singleton.
  *
  * @param networkId - The deployed network to look up.
  * @returns The network's signet contract address.
- * @throws Error when the singleton's address is not yet published in this
+ * @throws {Error} When the singleton's address is not yet published in this
  *   package.
  */
 export function getSignetContractAddress(networkId) {

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,2EAA2E;AAC3E,mEAAmE;AACnE,qEAAqE;AACrE,4EAA4E;AAC5E,0EAA0E;AAC1E,yCAAyC;AACzC,EAAE;AACF,0EAA0E;AAC1E,oBAAoB;AAEpB,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,wFAAwF;AACxF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,gBAA4B;IAC7D,OAAO,CACL,gBAAgB,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM;QACrD,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,QAAQ,OAAO,CAAC,MAAM,4BAA4B,MAAM,aAAa,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAN,IAAY,eAWX;AAXD,WAAY,eAAe;IACzB,mFAAmF;IACnF,4CAAyB,CAAA;IACzB,2CAA2C;IAC3C,wCAAqB,CAAA;IACrB,iFAAiF;IACjF,sCAAmB,CAAA;IACnB,+EAA+E;IAC/E,sCAAmB,CAAA;IACnB,6CAA6C;IAC7C,sCAAmB,CAAA;AACrB,CAAC,EAXW,eAAe,KAAf,eAAe,QAW1B;AAWD,4EAA4E;AAC5E,4EAA4E;AAC5E,oDAAoD;AACpD,MAAM,iBAAiB,GAAoC;IACzD,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE;IAC9B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE;IAC7B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE;IAC7B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE;CAC9B,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAA0B;IAC5D,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAS,eAAe,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,MAAM,uBAAuB,GAAoC;IAC/D,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE;IAC9B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE;IAC7B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE;IAC7B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE;CAC9B,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAA0B;IACjE,MAAM,eAAe,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,iDAAiD,SAAS,eAAe,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,2EAA2E;AAC3E,mEAAmE;AACnE,qEAAqE;AACrE,sDAAsD;AACtD,EAAE;AACF,0EAA0E;AAC1E,oBAAoB;AAEpB,+DAA+D;AAC/D,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAEjC,8DAA8D;AAC9D,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,wFAAwF;AACxF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,gBAA4B;IAC7D,OAAO,CACL,gBAAgB,CAAC,MAAM,KAAK,kBAAkB,CAAC,MAAM;QACrD,kBAAkB,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,EAAE,CAAC;AAE7C;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,MAAc;IACtD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,IAAI,IAAI,QAAQ,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,MAAM,CAAC,MAAM,CAAC,aAAa,CAC9F,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACnC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACjB,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAN,IAAY,eAWX;AAXD,WAAY,eAAe;IACzB,mFAAmF;IACnF,4CAAyB,CAAA;IACzB,2CAA2C;IAC3C,wCAAqB,CAAA;IACrB,iFAAiF;IACjF,sCAAmB,CAAA;IACnB,+EAA+E;IAC/E,sCAAmB,CAAA;IACnB,6CAA6C;IAC7C,sCAAmB,CAAA;AACrB,CAAC,EAXW,eAAe,KAAf,eAAe,QAW1B;AAUD,4EAA4E;AAC5E,4EAA4E;AAC5E,oDAAoD;AACpD,MAAM,iBAAiB,GAAoC;IACzD,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE;IAC9B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE;IAC7B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE;IAC7B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE;CAC9B,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAA0B;IAC5D,MAAM,SAAS,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAS,eAAe,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qEAAqE;AACrE,0EAA0E;AAC1E,wEAAwE;AACxE,MAAM,uBAAuB,GAAoC;IAC/D,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,EAAE;IAC9B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE;IAC7B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE;IAC7B,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,EAAE;CAC9B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAA0B;IACjE,MAAM,eAAe,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,iDAAiD,SAAS,eAAe,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC"}

package/dist/ecdsa-attestation.d.ts

@@ -1,54 +1,14 @@
 import type { Secp256k1Point } from "@midnight-ntwrk/compact-runtime";
+import { Signature } from "ethers";
+import type { MpcSignature, RespondBidirectionalEvent, SignatureRespondedEvent } from "./signet-contract-events.ts";
 import type { RequestId } from "./signet-requests.ts";
-import type { MpcSignature, RespondBidirectionalEvent } from "./signet-contract-events.ts";
 export type { Secp256k1Point } from "@midnight-ntwrk/compact-runtime";
 /** secp256k1 curve (group) order n. */
 export declare const SECP256K1_ORDER: bigint;
-/** BLS12-381 scalar field order (the Compact `Field` type modulus). */
-export declare const BLS_ORDER = 52435875175126190479447740508185965837690552500527637822603658699938581184513n;
 /**
- * Convert little-endian bytes to a bigint. Matches Compact's
- * `Bytes<32> as Field` / `Bytes<32> as Secp256k1Scalar` interpretation (both
- * casts are little-endian).
- *
- * @param bytes - Little-endian byte array.
- * @returns The decoded non-negative integer.
- */
-export declare function bytesToBigint(bytes: Uint8Array): bigint;
-/**
- * Convert a bigint to exactly 32 little-endian bytes. Matches Compact's
- * `Field as Bytes<32>` / `Secp256k1Scalar as Bytes<32>` encoding (the inverse
- * of {@link bytesToBigint}). Negative inputs are interpreted in the BLS
- * scalar field.
- *
- * @param n - The integer to encode.
- * @returns The 32-byte little-endian encoding.
- */
-export declare function bigintToBytes32(n: bigint): Uint8Array;
-/**
- * Convert big-endian bytes to a bigint (SEC1 coordinate order, the byte
- * order the respond events' stored signature uses).
- *
- * @param bytes - Big-endian byte array.
- * @returns The decoded non-negative integer.
- */
-export declare function bytesToBigintBE(bytes: Uint8Array): bigint;
-/**
- * Convert a bigint to exactly 32 BIG-endian bytes (SEC1 scalar/coordinate
- * order, also the ABI word encoding): the big-endian counterpart of
- * {@link bigintToBytes32} and the inverse of {@link bytesToBigintBE}.
- *
- * @param value - The non-negative integer to encode.
- * @returns The 32-byte big-endian encoding.
- * @throws Error if the value is negative or does not fit 32 bytes.
- */
-export declare function bigintToBytes32BE(value: bigint): Uint8Array;
-/**
- * An ECDSA signature over the attestation digest, in the MPC's canonical
- * `Signature { big_r, s, recovery_id }` spirit with `r` already reduced to
- * the scalar `big_r.x mod n`, the form Compact's `Secp256k1EcdsaSignature`
- * takes. Build the stored form for posting in a respond event with
- * {@link ecdsaSignatureToMpcSignature}.
+ * An ECDSA signature in scalar form: what {@link signAttestationDigest}
+ * produces, and what {@link ecdsaSignatureToMpcSignature} encodes into the
+ * stored form respond events carry.
  */
 export interface EcdsaSignature {
     /** Signature scalar r (= R.x mod n). */
@@ -60,46 +20,60 @@ export interface EcdsaSignature {
 }
 /**
  * ECDSA-sign a 32-byte digest with a secp256k1 secret key, exactly as the
- * MPC signs the attestation digest: RFC 6979 deterministic, low-s, the digest
- * interpreted big-endian with NO extra hashing (`prehash: false`), the same
- * convention `secp256k1EcdsaVerify` checks in-circuit.
+ * MPC signs the attestation digest: the result verifies in-circuit against
+ * the matching public key. For posters and test fixtures.
  *
  * @param digest - The 32-byte digest to sign (e.g. the
  *   {@link calculateSignetAttestationDigest} output).
  * @param secretKey - The 32-byte secp256k1 secret key.
  * @returns The signature with its recovery id.
+ * @throws {Error} If no recovery id reproduces the signer's own public key.
  */
 export declare function signAttestationDigest(digest: Uint8Array, secretKey: Uint8Array): EcdsaSignature;
 /**
- * Build the stored-form signature both respond events carry from a
- * scalar-form one: R is reconstructed by decompressing the curve point with
- * x = `r` and the parity `recoveryId` names, undoing the compression an
- * `r || s || v` signature performs. For MPC-side posters (the fakenet
- * signer, tests). The negligible caveat: an R.x that overflowed the curve
- * order cannot be told apart from its reduced twin, so reconstruction picks
- * the x equal to `r` itself.
+ * Encode a scalar-form signature as the stored-form record both respond
+ * events carry. For MPC-side posters (the fakenet signer) and test fixtures.
  *
  * @param signature - The scalar-form signature (the signer's output shape).
  * @returns The stored-form signature: R as a full point, big-endian bytes.
- * @throws Error if the recovery id is not 0 or 1, or `r` is not the x
+ * @throws {Error} If the recovery id is not 0 or 1, or `r` is not the x
  *   coordinate of a secp256k1 point.
  */
 export declare function ecdsaSignatureToMpcSignature(signature: EcdsaSignature): MpcSignature;
 /**
- * Read a stored-form signature back into scalar form: the inverse of
+ * Decode a stored-form signature back to scalar form: the inverse of
  * {@link ecdsaSignatureToMpcSignature}, for off-chain consumers building a
- * transaction from the response. `r` comes out as `bigR.x` reduced mod the
- * curve order. Rejects records that do not even hold the shape, since posts
- * are unauthenticated and a malformed record is garbage. `bigR.y` is NOT
- * checked against the curve or the recovery id: signature verification is
- * the authority, not this decoder.
+ * transaction from the response. Checks shape only: acceptance does not mean
+ * the signature verifies.
  *
  * @param signature - The stored-form signature as posted.
  * @returns The scalar-form signature.
- * @throws Error if a component has the wrong byte length or the recovery id
+ * @throws {Error} If a component has the wrong byte length or the recovery id
  *   is not 0 or 1.
  */
 export declare function mpcSignatureToEcdsaSignature(signature: MpcSignature): EcdsaSignature;
+/**
+ * Decode a posted response signature record into an ethers
+ * {@link Signature}. Ethers' `r` is the ECDSA scalar (`bigR.x` reduced mod
+ * the curve order), not the raw coordinate.
+ *
+ * @param response - The posted signature record.
+ * @returns The ethers signature.
+ * @throws {Error} If the record is malformed (see {@link mpcSignatureToEcdsaSignature}).
+ */
+export declare function signatureRespondedEventToSignature(response: SignatureRespondedEvent): Signature;
+/**
+ * Encode an ethers signature as the {@link SignatureRespondedEvent} record a
+ * responder posts: the inverse of {@link signatureRespondedEventToSignature}.
+ * Responder-side (the fakenet posts through this; clients only verify), so
+ * it is exported through the `./testing` entry point with the other
+ * posting-side helpers.
+ *
+ * @param signature - The signature to encode (`r`/`s` as 0x hex, `yParity` 0 or 1).
+ * @returns The response record, ready to post.
+ * @throws {Error} If `r` is not the x coordinate of a secp256k1 point.
+ */
+export declare function signatureToSignatureRespondedEvent(signature: Pick<Signature, "r" | "s" | "yParity">): SignatureRespondedEvent;
 /**
  * Parse a secp256k1 public key from SEC1 hex (compressed or uncompressed,
  * optional `0x` prefix) into the Compact runtime's `Secp256k1Point` shape:
@@ -107,7 +81,7 @@ export declare function mpcSignatureToEcdsaSignature(signature: MpcSignature): E
  *
  * @param value - The SEC1 hex public key.
  * @returns The parsed point.
- * @throws Error if the value is not a valid secp256k1 public key.
+ * @throws {Error} If the value is not a valid secp256k1 public key.
  */
 export declare function parseSecp256k1PublicKey(value: string): Secp256k1Point;
 /**
@@ -130,18 +104,10 @@ export declare function secp256k1PublicKeyOf(secretKey: Uint8Array): Secp256k1Po
 /**
  * The attestation digest of a respond-bidirectional response:
  * `keccak256(requestId || serializedOutput)`, the 32-byte digest the MPC
- * ECDSA-signs to attest a remote execution.
- *
- * TS twin of the size-generic Compact circuit
- * `calculateSignetAttestationDigest` (which the compiler cannot export
- * compiled, so this is the one sanctioned re-implementation, pinned
- * byte-for-byte against the fixed-width oracle circuits in
- * circuits.compact). The constructions agree because the circuit's keccak
- * preimage of the `[RequestId, Bytes<N>]` pair is the raw concatenated
- * bytes, and it matches the MPC's respond-bidirectional hash
- * (`hash(request_id || serialized_output)`: one flat concatenation, one
- * hash). The output is hashed AS GIVEN, at its exact length: no padding and
- * no length binding.
+ * ECDSA-signs to attest a remote execution. TS twin of the size-generic
+ * Compact circuit of the same name, pinned against its fixed-width oracle
+ * circuits in tests. The output is hashed as given, at its exact length:
+ * no padding, no length prefix.
  *
  * @param requestId - The 32-byte request id the response answers.
  * @param serializedOutput - The serialised execution output, exact unpadded bytes.
@@ -149,31 +115,35 @@ export declare function secp256k1PublicKeyOf(secretKey: Uint8Array): Secp256k1Po
  */
 export declare function calculateSignetAttestationDigest(requestId: RequestId, serializedOutput: Uint8Array): Uint8Array;
 /**
- * Off-chain check of a posted respond-bidirectional attestation: recompute
- * the attestation digest of `(requestId, serializedOutput)` and verify the
- * event's ECDSA signature over it against `mpcResponseKey`.
- *
- * The event's declared request id is unauthenticated routing data, so this
- * check is the ONLY way to tell a genuine post from garbage: the signet
- * contract's event log is unauthenticated and every post is emitted
- * unverified. Use it to sift the candidates
- * {@link SignetRequestResponseReader.getRespondBidirectionalEvents}
- * returns before handing one to a contract. It is the off-chain counterpart
- * of the in-circuit `verifyRespondBidirectionalEvent` and answers the same
- * question, so a post this accepts is the post that proves at claim time.
+ * Produce the circuit-input form of a posted respond-bidirectional
+ * attestation: `signature.bigR.x` and `signature.s` byte-reversed into
+ * little-endian, everything else verbatim. The in-circuit
+ * `verifyRespondBidirectionalEvent` reads those two scalars through
+ * little-endian casts (the reversal is free off-chain and costly
+ * in-circuit), while the wire and ledger records stay big-endian: pass every
+ * event through this exactly once, at the circuit call. A record passed
+ * without the flip fails verification, never falsely accepts.
  *
- * Malformed records are garbage, not faults: a signature whose components
- * have the wrong width, whose `r` is off-curve, or which simply does not
- * verify all return `false` rather than throwing. High-`s` signatures are
- * accepted, matching the in-circuit verification (which enforces no low-`s`
- * policy) rather than the signer's own normalisation.
+ * @param event - The posted record as read off the ledger (big-endian).
+ * @returns The record in circuit-input form.
+ * @throws {Error} If a signature component is not exactly 32 bytes.
+ */
+export declare function respondBidirectionalEventToCircuitInput(event: RespondBidirectionalEvent): RespondBidirectionalEvent;
+/**
+ * Off-chain twin of the in-circuit `verifyRespondBidirectionalEvent`: checks
+ * a posted respond-bidirectional attestation against the execution output
+ * and the contract's pinned MPC response key. Clients run it to sift
+ * candidate posts before calling a contract: a post this accepts verifies
+ * in-circuit (once flipped to circuit-input form, see
+ * {@link respondBidirectionalEventToCircuitInput}). Takes the record as read
+ * off the ledger (big-endian). Malformed records return `false` rather than
+ * throwing.
  *
  * @param requestId - The 32-byte request id the response answers.
  * @param serializedOutput - The serialised execution output, exact unpadded bytes.
  * @param event - The posted record to check, as read off the ledger.
- * @param mpcResponseKey - The response key the requesting contract pinned:
- *   the MPC key derived for its address and the fixed "midnight response key"
- *   path (see {@link deriveMidnightResponseKey}).
+ * @param mpcResponseKey - The response key the requesting contract pinned
+ *   (see {@link deriveMidnightResponseKey}).
  * @returns Whether the post is a genuine attestation of that output.
  */
 export declare function verifyRespondBidirectionalSignature(requestId: RequestId, serializedOutput: Uint8Array, event: RespondBidirectionalEvent, mpcResponseKey: Secp256k1Point): boolean;

package/dist/ecdsa-attestation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ecdsa-attestation.d.ts","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EACV,YAAY,EACZ,yBAAyB,EAC1B,MAAM,6BAA6B,CAAC;AAIrC,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,uCAAuC;AACvC,eAAO,MAAM,eAAe,QAA2B,CAAC;AAExD,uEAAuE;AACvE,eAAO,MAAM,SAAS,iFAAiF,CAAC;AAExG;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAQvD;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMzD;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAW3D;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,2DAA2D;IAC3D,CAAC,EAAE,MAAM,CAAC;IACV,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,UAAU,GACpB,cAAc,CAiBhB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,cAAc,GAAG,YAAY,CAmBpF;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,YAAY,GAAG,cAAc,CAapF;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAcrE;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,cAAc,CAO1E;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,UAAU,GAC3B,UAAU,CAIZ;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,UAAU,EAC5B,KAAK,EAAE,yBAAyB,EAChC,cAAc,EAAE,cAAc,GAC7B,OAAO,CAyBT"}
+{"version":3,"file":"ecdsa-attestation.d.ts","sourceRoot":"","sources":["../src/ecdsa-attestation.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,OAAO,EAAU,SAAS,EAAW,MAAM,QAAQ,CAAC;AAGpD,OAAO,KAAK,EACV,YAAY,EACZ,yBAAyB,EACzB,uBAAuB,EACxB,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAItD,YAAY,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AAEtE,uCAAuC;AACvC,eAAO,MAAM,eAAe,QAA2B,CAAC;AAExD;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,wCAAwC;IACxC,CAAC,EAAE,MAAM,CAAC;IACV,2DAA2D;IAC3D,CAAC,EAAE,MAAM,CAAC;IACV,2CAA2C;IAC3C,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,cAAc,CAc/F;AAED;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,cAAc,GAAG,YAAY,CAqBpF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,YAAY,GAAG,cAAc,CAapF;AAED;;;;;;;;GAQG;AACH,wBAAgB,kCAAkC,CAAC,QAAQ,EAAE,uBAAuB,GAAG,SAAS,CAO/F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,GAAG,GAAG,GAAG,SAAS,CAAC,GAChD,uBAAuB,CAQzB;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CAgBrE;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,UAAU,GAAG,cAAc,CAO1E;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gCAAgC,CAC9C,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,UAAU,GAC3B,UAAU,CAEZ;AAgBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,uCAAuC,CACrD,KAAK,EAAE,yBAAyB,GAC/B,yBAAyB,CAQ3B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mCAAmC,CACjD,SAAS,EAAE,SAAS,EACpB,gBAAgB,EAAE,UAAU,EAC5B,KAAK,EAAE,yBAAyB,EAChC,cAAc,EAAE,cAAc,GAC7B,OAAO,CAyBT"}