Struct SsaCommitmentBuilder 

pub struct SsaCommitmentBuilder<S: PixSpec> {
    id: SsaId<S::Pseudonym>,
    poly_threshold: usize,
    num_polys: usize,
    committed_polynomials: HashMap<PolynomialIndex, PixGroup<S>>,
    total_committed: usize,
    complete: bool,
    exit_commitment_secret: PixScalar<S>,
    exit_commitment_public: PixGroup<S>,
    commitment_proof: Option<SsaCommitmentProof<S>>,
    full_ssa_commitment: Option<(PixGroup<S>, S::DepositAddress)>,
}

Builds a complete SSA from the incoming client constant-term commitments of the SSA-part polynomials for a specific Session Stealth Address (SSA).

One commitment per polynomial arrives, so “the SSA commitment is known” and “every polynomial is reconstructible” are the same event: committed_polynomials.len() == num_polys.

Fields

id: SsaId<S::Pseudonym>

poly_threshold: usize

Shares needed to reconstruct one polynomial, as negotiated at session establishment.

The commitments no longer carry the degree, so this is the only source for it. It is handed to every SsaPartBuilder as its min_shares.

num_polys: usize

committed_polynomials: HashMap<PolynomialIndex, PixGroup<S>>

Constant-term commitments received so far, decoded: each is decompressed and subgroup-checked exactly once, on arrival. Keeping the compressed representation instead would force a second decompression when the part builders are created, and decompression is the dominant per-commitment cost.

Drained when the part builders are handed out.

total_committed: usize

Commitments received so far, counted across polynomials that have since been handed out. Used for is_empty, which would otherwise report empty again after the drain.

complete: bool

exit_commitment_secret: PixScalar<S>

exit_commitment_public: PixGroup<S>

commitment_proof: Option<SsaCommitmentProof<S>>

First SsaCommitmentProof the peer supplied, checked once the constant-term set is complete — that is the point at which the commitment it opens becomes known.

Only the first is kept: any single valid proof is sufficient, and Schnorr proofs are randomised, so there is nothing to reconcile between several of them.

full_ssa_commitment: Option<(PixGroup<S>, S::DepositAddress)>

Implementations

impl<S: PixSpec> SsaCommitmentBuilder<S>

pub fn new( id: SsaId<S::Pseudonym>, poly_threshold: usize, num_polys: usize, exit_commitment_secret: PixScalar<S>, exit_commitment_public: PixGroup<S>, ) -> Self

pub fn is_empty(&self) -> bool

true if not a single coefficient commitment has been received yet.

Counts rather than inspecting committed_polynomials, which is drained when the part builders are handed out and would therefore report empty again afterwards.

pub fn get_deposit_address(&self) -> Option<&S::DepositAddress>

pub fn add_transposed( &mut self, coeff_index: CoefficientIndex, proof: Option<SsaCommitmentProof<S>>, polynomial_coeff_commitments: impl Iterator<Item = (PolynomialIndex, PixGroupRepr<S>)>, ) -> Result<CommitmentProgress<S>, S::Pseudonym>