L1 DIDFacet — 实现

For Claude: REQUIRED SUB-SKILL: Use superpowers:executing-plans to implement this plan task-by-task.

Goal: 在 L1 Diamond Proxy 中实现 DIDFacet，支持 L2→L1 DID 状态同步和 L1→L2 DID 操作请求。

Architecture: Event-Driven 双向同步。L2 DID 系统合约通过 L1Messenger 发送状态变更消息，L1 DIDFacet 通过 Mailbox proof 验证并缓存。L1→L2 方向通过 Bridgehub requestL2TransactionDirect 发送优先交易。

Tech Stack: Solidity 0.8.26, Foundry (forge), MockMailbox, MockBridgehub, era-contracts system contracts

---

Task 1: DIDMessageLib + IDIDFacet 接口

Files:

• Create: contracts/src/did/DIDMessageLib.sol

• Create: contracts/src/did/IDIDFacet.sol

• Create: contracts/test/mocks/MockBridgehub.sol

• Test: contracts/test/DIDFacet.t.sol (初始骨架)

Step 1: Write DIDMessageLib

// contracts/src/did/DIDMessageLib.sol
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

/// @title DIDMessageLib
/// @notice Message type constants and encoding/decoding helpers for L2↔L1 DID sync.
library DIDMessageLib {
    // ── Message Types ────────────────────────────────────────────
    uint8 constant DID_CREATED = 0;
    uint8 constant DID_UPDATED = 1;
    uint8 constant DID_DEACTIVATED = 2;
    uint8 constant CREDENTIAL_ISSUED = 3;
    uint8 constant CREDENTIAL_REVOKED = 4;
    uint8 constant COMPLIANCE_UPDATED = 5;
    uint8 constant TRUSTED_ISSUER_ADDED = 6;
    uint8 constant TRUSTED_ISSUER_REMOVED = 7;

    // ── Errors ───────────────────────────────────────────────────
    error UnknownMessageType(uint8 messageType);

    // ── Decode helpers ───────────────────────────────────────────

    /// @notice Extract the message type (first byte) from encoded message
    function messageType(bytes calldata message) internal pure returns (uint8) {
        return abi.decode(message, (uint8));
    }

    /// @notice Decode DID_CREATED or DID_UPDATED message
    function decodeDIDDocument(bytes calldata message)
        internal
        pure
        returns (
            uint8 msgType,
            address identity,
            bytes32[] memory verificationMethods,
            bytes32 serviceEndpointHash,
            uint256 nonce
        )
    {
        (msgType, identity, verificationMethods, serviceEndpointHash, nonce) =
            abi.decode(message, (uint8, address, bytes32[], bytes32, uint256));
    }

    /// @notice Decode DID_DEACTIVATED message
    function decodeDIDDeactivated(bytes calldata message)
        internal
        pure
        returns (uint8 msgType, address identity, uint256 nonce)
    {
        (msgType, identity, nonce) = abi.decode(message, (uint8, address, uint256));
    }

    /// @notice Decode CREDENTIAL_ISSUED message
    function decodeCredentialIssued(bytes calldata message)
        internal
        pure
        returns (
            uint8 msgType,
            bytes32 credentialId,
            address issuer,
            address subject,
            bytes32 credentialType,
            bytes32 claimHash,
            uint64 issuedAt,
            uint64 expiresAt
        )
    {
        (msgType, credentialId, issuer, subject, credentialType, claimHash, issuedAt, expiresAt) =
            abi.decode(message, (uint8, bytes32, address, address, bytes32, bytes32, uint64, uint64));
    }

    /// @notice Decode CREDENTIAL_REVOKED message
    function decodeCredentialRevoked(bytes calldata message)
        internal
        pure
        returns (uint8 msgType, bytes32 credentialId, address issuer)
    {
        (msgType, credentialId, issuer) = abi.decode(message, (uint8, bytes32, address));
    }

    /// @notice Decode COMPLIANCE_UPDATED message
    function decodeComplianceUpdated(bytes calldata message)
        internal
        pure
        returns (uint8 msgType, address identity, bytes32 requirement, bool status)
    {
        (msgType, identity, requirement, status) =
            abi.decode(message, (uint8, address, bytes32, bool));
    }

    /// @notice Decode TRUSTED_ISSUER_ADDED or TRUSTED_ISSUER_REMOVED message
    function decodeTrustedIssuer(bytes calldata message)
        internal
        pure
        returns (uint8 msgType, address issuer)
    {
        (msgType, issuer) = abi.decode(message, (uint8, address));
    }
}

Step 2: Write IDIDFacet interface

// contracts/src/did/IDIDFacet.sol
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

/// @title IDIDFacet
/// @notice Interface for L1 DIDFacet — bidirectional L1↔L2 DID sync via Mailbox.
interface IDIDFacet {
    // ── Data Structures ──────────────────────────────────────────

    struct DIDSnapshot {
        bytes32[] verificationMethods;
        address controller;
        uint64 created;
        uint64 updated;
        bool active;
        bytes32 serviceEndpointHash;
        uint256 nonce;
        uint256 lastSyncBatch;
    }

    struct CredentialSnapshot {
        address issuer;
        address subject;
        bytes32 credentialType;
        bytes32 claimHash;
        uint64 issuedAt;
        uint64 expiresAt;
        bool revoked;
        uint256 lastSyncBatch;
    }

    // ── Events ───────────────────────────────────────────────────

    event DIDDocumentSynced(address indexed identity, uint8 messageType, uint256 l2BatchNumber);
    event CredentialSynced(bytes32 indexed credentialId, uint8 messageType, uint256 l2BatchNumber);
    event ComplianceSynced(address indexed identity, bytes32 indexed requirement, bool status, uint256 l2BatchNumber);
    event TrustedIssuerSynced(address indexed issuer, bool added, uint256 l2BatchNumber);
    event L2TransactionRequested(bytes32 indexed l2TxHash, address indexed sender, address l2Target, bytes4 selector);

    // ── Errors ───────────────────────────────────────────────────

    error MessageAlreadyProcessed(bytes32 messageKey);
    error InvalidL2MessageProof();
    error InvalidMessageSender(address expected, address actual);
    error StaleNonce(uint256 current, uint256 received);
    error NotAdmin();

    // ── L2→L1 Sync Functions ─────────────────────────────────────

    function syncDIDDocument(
        uint256 _l2BatchNumber,
        uint256 _l2MessageIndex,
        uint16 _l2TxNumberInBatch,
        bytes32[] calldata _proof,
        bytes calldata _message
    ) external;

    function syncCredential(
        uint256 _l2BatchNumber,
        uint256 _l2MessageIndex,
        uint16 _l2TxNumberInBatch,
        bytes32[] calldata _proof,
        bytes calldata _message
    ) external;

    function syncCompliance(
        uint256 _l2BatchNumber,
        uint256 _l2MessageIndex,
        uint16 _l2TxNumberInBatch,
        bytes32[] calldata _proof,
        bytes calldata _message
    ) external;

    // ── L1→L2 Request Functions ──────────────────────────────────

    function requestCreateDID(
        bytes32[] calldata _verificationMethods,
        bytes32 _serviceEndpointHash,
        uint256 _l2GasLimit,
        uint256 _l2GasPerPubdataByteLimit
    ) external payable returns (bytes32 l2TxHash);

    function requestIssueCredential(
        address _subject,
        bytes32 _credentialType,
        bytes32 _claimHash,
        uint64 _expiresAt,
        uint256 _l2GasLimit,
        uint256 _l2GasPerPubdataByteLimit
    ) external payable returns (bytes32 l2TxHash);

    function requestDeactivateDID(
        uint256 _l2GasLimit,
        uint256 _l2GasPerPubdataByteLimit
    ) external payable returns (bytes32 l2TxHash);

    function requestRevokeCredential(
        bytes32 _credentialId,
        uint256 _l2GasLimit,
        uint256 _l2GasPerPubdataByteLimit
    ) external payable returns (bytes32 l2TxHash);

    function requestAddTrustedIssuer(
        address _issuer,
        uint256 _l2GasLimit,
        uint256 _l2GasPerPubdataByteLimit
    ) external payable returns (bytes32 l2TxHash);

    // ── View Functions ───────────────────────────────────────────

    function getDIDDocument(address _identity) external view returns (DIDSnapshot memory);
    function isIdentityActive(address _identity) external view returns (bool);
    function getCredential(bytes32 _credentialId) external view returns (CredentialSnapshot memory);
    function isCredentialValid(bytes32 _credentialId) external view returns (bool);
    function checkCompliance(address _identity, bytes32 _requirement) external view returns (bool);
    function isTrustedIssuer(address _issuer) external view returns (bool);
    function isMessageProcessed(uint256 _l2BatchNumber, uint256 _l2MessageIndex) external view returns (bool);
}

Step 3: Write MockBridgehub

// contracts/test/mocks/MockBridgehub.sol
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

/// @notice Mock Bridgehub for testing DIDFacet L1→L2 requests.
/// Records all L2 transaction requests for test assertions.
contract MockBridgehub {
    struct L2TxRequest {
        uint256 chainId;
        address l2Contract;
        bytes l2Calldata;
        uint256 l2GasLimit;
        uint256 l2GasPerPubdataByteLimit;
        address refundRecipient;
        uint256 msgValue;
    }

    L2TxRequest[] public requests;
    uint256 public requestCount;
    bytes32 public nextTxHash;

    constructor() {
        nextTxHash = keccak256("mock-l2-tx-hash");
    }

    function setNextTxHash(bytes32 _hash) external {
        nextTxHash = _hash;
    }

    function requestL2TransactionDirect(
        L2TransactionRequestDirect calldata _request
    ) external payable returns (bytes32 canonicalTxHash) {
        requests.push(L2TxRequest({
            chainId: _request.chainId,
            l2Contract: _request.l2Contract,
            l2Calldata: _request.l2Calldata,
            l2GasLimit: _request.l2GasLimit,
            l2GasPerPubdataByteLimit: _request.l2GasPerPubdataByteLimit,
            refundRecipient: _request.refundRecipient,
            msgValue: msg.value
        }));
        requestCount++;
        return nextTxHash;
    }

    function getLastRequest() external view returns (L2TxRequest memory) {
        require(requestCount > 0, "No requests");
        return requests[requestCount - 1];
    }
}

struct L2TransactionRequestDirect {
    uint256 chainId;
    uint256 mintValue;
    address l2Contract;
    uint256 l2Value;
    bytes l2Calldata;
    uint256 l2GasLimit;
    uint256 l2GasPerPubdataByteLimit;
    bytes[] factoryDeps;
    address refundRecipient;
}

Step 4: Create minimal test skeleton and run to verify compilation

// contracts/test/DIDFacet.t.sol — skeleton
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import "forge-std/Test.sol";
import "../src/did/DIDMessageLib.sol";
import "../src/did/IDIDFacet.sol";

contract DIDFacetTest is Test {
    function test_messageLib_constants() public pure {
        assertEq(DIDMessageLib.DID_CREATED, 0);
        assertEq(DIDMessageLib.DID_DEACTIVATED, 2);
        assertEq(DIDMessageLib.CREDENTIAL_ISSUED, 3);
        assertEq(DIDMessageLib.TRUSTED_ISSUER_ADDED, 6);
    }
}

Run: cd contracts && forge test --match-contract DIDFacetTest -v Expected: 1 test PASS

Step 5: Commit

git add contracts/src/did/DIDMessageLib.sol contracts/src/did/IDIDFacet.sol \
        contracts/test/mocks/MockBridgehub.sol contracts/test/DIDFacet.t.sol
git commit -m "feat(did): DIDMessageLib + IDIDFacet interface + MockBridgehub"

---

Task 2: DIDFacetLocal — L2→L1 Sync 实现 + 测试

Files:

• Create: contracts/src/did/DIDFacetLocal.sol

• Modify: contracts/test/DIDFacet.t.sol

Step 1: Write DIDFacetLocal with L2→L1 sync functions

// contracts/src/did/DIDFacetLocal.sol
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import "../interfaces/IMailbox.sol";
import "./IDIDFacet.sol";
import "./DIDMessageLib.sol";

/// @title DIDFacetLocal
/// @notice Local test version of L1 DIDFacet.
///         Uses MockMailbox for proof verification and MockBridgehub for L2 requests.
///         Production version inherits ZKChainBase and lives in era-contracts Diamond Proxy.
contract DIDFacetLocal is IDIDFacet {
    // ── Immutables ───────────────────────────────────────────────
    IMailbox public immutable MAILBOX;
    address public immutable BRIDGEHUB;
    uint256 public immutable CHAIN_ID;

    // ── Storage ──────────────────────────────────────────────────
    mapping(address => DIDSnapshot) private _didSnapshots;
    mapping(bytes32 => CredentialSnapshot) private _credentialSnapshots;
    mapping(address => mapping(bytes32 => bool)) private _complianceCache;
    mapping(address => bool) private _trustedIssuerCache;
    mapping(bytes32 => bool) private _processedMessages;

    address public l2DIDRegistry;
    address public l2CredentialRegistry;
    address public l2IdentityVerifier;
    address public admin;

    // ── Constructor ──────────────────────────────────────────────
    constructor(
        address _mailbox,
        address _bridgehub,
        uint256 _chainId,
        address _l2DIDRegistry,
        address _l2CredentialRegistry,
        address _l2IdentityVerifier
    ) {
        require(_mailbox != address(0), "Zero mailbox");
        require(_bridgehub != address(0), "Zero bridgehub");
        MAILBOX = IMailbox(_mailbox);
        BRIDGEHUB = _bridgehub;
        CHAIN_ID = _chainId;
        l2DIDRegistry = _l2DIDRegistry;
        l2CredentialRegistry = _l2CredentialRegistry;
        l2IdentityVerifier = _l2IdentityVerifier;
        admin = msg.sender;
    }

    // ── Modifiers ────────────────────────────────────────────────
    modifier onlyAdmin() {
        if (msg.sender != admin) revert NotAdmin();
        _;
    }

    // ── L2→L1 Sync: DID Document ────────────────────────────────

    function syncDIDDocument(
        uint256 _l2BatchNumber,
        uint256 _l2MessageIndex,
        uint16 _l2TxNumberInBatch,
        bytes32[] calldata _proof,
        bytes calldata _message
    ) external override {
        _verifyAndMarkProcessed(_l2BatchNumber, _l2MessageIndex, _l2TxNumberInBatch, _proof, _message, l2DIDRegistry);

        uint8 msgType = DIDMessageLib.messageType(_message);

        if (msgType == DIDMessageLib.DID_CREATED || msgType == DIDMessageLib.DID_UPDATED) {
            (, address identity, bytes32[] memory methods, bytes32 serviceHash, uint256 nonce) =
                DIDMessageLib.decodeDIDDocument(_message);

            DIDSnapshot storage snap = _didSnapshots[identity];
            if (snap.nonce >= nonce && snap.lastSyncBatch > 0) revert StaleNonce(snap.nonce, nonce);

            snap.verificationMethods = methods;
            snap.controller = identity;
            snap.serviceEndpointHash = serviceHash;
            snap.nonce = nonce;
            snap.active = true;
            snap.lastSyncBatch = _l2BatchNumber;

            if (msgType == DIDMessageLib.DID_CREATED) {
                snap.created = uint64(block.timestamp);
            }
            snap.updated = uint64(block.timestamp);

            emit DIDDocumentSynced(identity, msgType, _l2BatchNumber);
        } else if (msgType == DIDMessageLib.DID_DEACTIVATED) {
            (, address identity, uint256 nonce) = DIDMessageLib.decodeDIDDeactivated(_message);

            DIDSnapshot storage snap = _didSnapshots[identity];
            snap.active = false;
            snap.nonce = nonce;
            snap.updated = uint64(block.timestamp);
            snap.lastSyncBatch = _l2BatchNumber;

            emit DIDDocumentSynced(identity, msgType, _l2BatchNumber);
        } else {
            revert DIDMessageLib.UnknownMessageType(msgType);
        }
    }

    // ── L2→L1 Sync: Credential ──────────────────────────────────

    function syncCredential(
        uint256 _l2BatchNumber,
        uint256 _l2MessageIndex,
        uint16 _l2TxNumberInBatch,
        bytes32[] calldata _proof,
        bytes calldata _message
    ) external override {
        _verifyAndMarkProcessed(_l2BatchNumber, _l2MessageIndex, _l2TxNumberInBatch, _proof, _message, l2CredentialRegistry);

        uint8 msgType = DIDMessageLib.messageType(_message);

        if (msgType == DIDMessageLib.CREDENTIAL_ISSUED) {
            (, bytes32 credId, address issuer, address subject, bytes32 credType, bytes32 claimHash, uint64 issuedAt, uint64 expiresAt) =
                DIDMessageLib.decodeCredentialIssued(_message);

            _credentialSnapshots[credId] = CredentialSnapshot({
                issuer: issuer,
                subject: subject,
                credentialType: credType,
                claimHash: claimHash,
                issuedAt: issuedAt,
                expiresAt: expiresAt,
                revoked: false,
                lastSyncBatch: _l2BatchNumber
            });

            emit CredentialSynced(credId, msgType, _l2BatchNumber);
        } else if (msgType == DIDMessageLib.CREDENTIAL_REVOKED) {
            (, bytes32 credId, ) = DIDMessageLib.decodeCredentialRevoked(_message);

            _credentialSnapshots[credId].revoked = true;
            _credentialSnapshots[credId].lastSyncBatch = _l2BatchNumber;

            emit CredentialSynced(credId, msgType, _l2BatchNumber);
        } else {
            revert DIDMessageLib.UnknownMessageType(msgType);
        }
    }

    // ── L2→L1 Sync: Compliance + TrustedIssuer ──────────────────

    function syncCompliance(
        uint256 _l2BatchNumber,
        uint256 _l2MessageIndex,
        uint16 _l2TxNumberInBatch,
        bytes32[] calldata _proof,
        bytes calldata _message
    ) external override {
        _verifyAndMarkProcessed(_l2BatchNumber, _l2MessageIndex, _l2TxNumberInBatch, _proof, _message, l2IdentityVerifier);

        uint8 msgType = DIDMessageLib.messageType(_message);

        if (msgType == DIDMessageLib.COMPLIANCE_UPDATED) {
            (, address identity, bytes32 requirement, bool status) =
                DIDMessageLib.decodeComplianceUpdated(_message);

            _complianceCache[identity][requirement] = status;
            emit ComplianceSynced(identity, requirement, status, _l2BatchNumber);
        } else if (msgType == DIDMessageLib.TRUSTED_ISSUER_ADDED) {
            (, address issuer) = DIDMessageLib.decodeTrustedIssuer(_message);

            _trustedIssuerCache[issuer] = true;
            emit TrustedIssuerSynced(issuer, true, _l2BatchNumber);
        } else if (msgType == DIDMessageLib.TRUSTED_ISSUER_REMOVED) {
            (, address issuer) = DIDMessageLib.decodeTrustedIssuer(_message);

            _trustedIssuerCache[issuer] = false;
            emit TrustedIssuerSynced(issuer, false, _l2BatchNumber);
        } else {
            revert DIDMessageLib.UnknownMessageType(msgType);
        }
    }

    // ── L1→L2 Request Functions (placeholder — Task 3) ──────────

    function requestCreateDID(bytes32[] calldata, bytes32, uint256, uint256)
        external payable override returns (bytes32) { revert("Not implemented"); }
    function requestIssueCredential(address, bytes32, bytes32, uint64, uint256, uint256)
        external payable override returns (bytes32) { revert("Not implemented"); }
    function requestDeactivateDID(uint256, uint256)
        external payable override returns (bytes32) { revert("Not implemented"); }
    function requestRevokeCredential(bytes32, uint256, uint256)
        external payable override returns (bytes32) { revert("Not implemented"); }
    function requestAddTrustedIssuer(address, uint256, uint256)
        external payable override returns (bytes32) { revert("Not implemented"); }

    // ── View Functions ───────────────────────────────────────────

    function getDIDDocument(address _identity) external view override returns (DIDSnapshot memory) {
        return _didSnapshots[_identity];
    }

    function isIdentityActive(address _identity) external view override returns (bool) {
        return _didSnapshots[_identity].active;
    }

    function getCredential(bytes32 _credentialId) external view override returns (CredentialSnapshot memory) {
        return _credentialSnapshots[_credentialId];
    }

    function isCredentialValid(bytes32 _credentialId) external view override returns (bool) {
        CredentialSnapshot memory snap = _credentialSnapshots[_credentialId];
        if (snap.issuer == address(0)) return false;
        if (snap.revoked) return false;
        if (snap.expiresAt != 0 && block.timestamp > snap.expiresAt) return false;
        return true;
    }

    function checkCompliance(address _identity, bytes32 _requirement) external view override returns (bool) {
        return _complianceCache[_identity][_requirement];
    }

    function isTrustedIssuer(address _issuer) external view override returns (bool) {
        return _trustedIssuerCache[_issuer];
    }

    function isMessageProcessed(uint256 _l2BatchNumber, uint256 _l2MessageIndex) external view override returns (bool) {
        bytes32 key = keccak256(abi.encode(_l2BatchNumber, _l2MessageIndex));
        return _processedMessages[key];
    }

    // ── Admin Functions ──────────────────────────────────────────

    function setL2Addresses(address _did, address _cred, address _verifier) external onlyAdmin {
        l2DIDRegistry = _did;
        l2CredentialRegistry = _cred;
        l2IdentityVerifier = _verifier;
    }

    // ── Internal ─────────────────────────────────────────────────

    function _verifyAndMarkProcessed(
        uint256 _l2BatchNumber,
        uint256 _l2MessageIndex,
        uint16 _l2TxNumberInBatch,
        bytes32[] calldata _proof,
        bytes calldata _message,
        address _expectedSender
    ) internal {
        bytes32 messageKey = keccak256(abi.encode(_l2BatchNumber, _l2MessageIndex));
        if (_processedMessages[messageKey]) revert MessageAlreadyProcessed(messageKey);

        IMailbox.L2Message memory l2Message = IMailbox.L2Message({
            txNumberInBatch: _l2TxNumberInBatch,
            sender: _expectedSender,
            data: _message
        });

        bool valid = MAILBOX.proveL2MessageInclusion(_l2BatchNumber, _l2MessageIndex, l2Message, _proof);
        if (!valid) revert InvalidL2MessageProof();

        _processedMessages[messageKey] = true;
    }
}

Step 2: Write L2→L1 sync tests (14 tests)

Add these tests to contracts/test/DIDFacet.t.sol:

// contracts/test/DIDFacet.t.sol
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

import "forge-std/Test.sol";
import "../src/did/DIDFacetLocal.sol";
import "../src/did/DIDMessageLib.sol";
import "../src/did/IDIDFacet.sol";
import "./mocks/MockMailbox.sol";
import "./mocks/MockBridgehub.sol";

contract DIDFacetTest is Test {
    DIDFacetLocal public facet;
    MockMailbox public mockMailbox;
    MockBridgehub public mockBridgehub;

    address constant L2_DID_REGISTRY = address(0x8017);
    address constant L2_CREDENTIAL_REGISTRY = address(0x8018);
    address constant L2_IDENTITY_VERIFIER = address(0x8019);
    uint256 constant CHAIN_ID = 271;

    address alice = makeAddr("alice");
    address bob = makeAddr("bob");
    address issuer = makeAddr("issuer");
    address submitter = makeAddr("submitter");

    bytes32 constant KYC_TYPE = keccak256("KYC");
    bytes32 constant KYC_REQ = keccak256("KYC_COMPLIANCE");

    function setUp() public {
        mockMailbox = new MockMailbox(true); // default accept proofs
        mockBridgehub = new MockBridgehub();
        facet = new DIDFacetLocal(
            address(mockMailbox),
            address(mockBridgehub),
            CHAIN_ID,
            L2_DID_REGISTRY,
            L2_CREDENTIAL_REGISTRY,
            L2_IDENTITY_VERIFIER
        );
    }

    // ── Helpers ──────────────────────────────────────────────────

    function _methods1() internal pure returns (bytes32[] memory) {
        bytes32[] memory m = new bytes32[](1);
        m[0] = keccak256("pubkey_alice");
        return m;
    }

    function _encodeDIDCreated(address identity, bytes32[] memory methods, bytes32 serviceHash, uint256 nonce)
        internal pure returns (bytes memory)
    {
        return abi.encode(DIDMessageLib.DID_CREATED, identity, methods, serviceHash, nonce);
    }

    function _encodeDIDUpdated(address identity, bytes32[] memory methods, bytes32 serviceHash, uint256 nonce)
        internal pure returns (bytes memory)
    {
        return abi.encode(DIDMessageLib.DID_UPDATED, identity, methods, serviceHash, nonce);
    }

    function _encodeDIDDeactivated(address identity, uint256 nonce)
        internal pure returns (bytes memory)
    {
        return abi.encode(DIDMessageLib.DID_DEACTIVATED, identity, nonce);
    }

    function _encodeCredentialIssued(
        bytes32 credId, address _issuer, address subject, bytes32 credType,
        bytes32 claimHash, uint64 issuedAt, uint64 expiresAt
    ) internal pure returns (bytes memory) {
        return abi.encode(DIDMessageLib.CREDENTIAL_ISSUED, credId, _issuer, subject, credType, claimHash, issuedAt, expiresAt);
    }

    function _encodeCredentialRevoked(bytes32 credId, address _issuer)
        internal pure returns (bytes memory)
    {
        return abi.encode(DIDMessageLib.CREDENTIAL_REVOKED, credId, _issuer);
    }

    function _encodeComplianceUpdated(address identity, bytes32 requirement, bool status)
        internal pure returns (bytes memory)
    {
        return abi.encode(DIDMessageLib.COMPLIANCE_UPDATED, identity, requirement, status);
    }

    function _encodeTrustedIssuerAdded(address _issuer) internal pure returns (bytes memory) {
        return abi.encode(DIDMessageLib.TRUSTED_ISSUER_ADDED, _issuer);
    }

    function _encodeTrustedIssuerRemoved(address _issuer) internal pure returns (bytes memory) {
        return abi.encode(DIDMessageLib.TRUSTED_ISSUER_REMOVED, _issuer);
    }

    // ── DIDMessageLib Constants ──────────────────────────────────

    function test_messageLib_constants() public pure {
        assertEq(DIDMessageLib.DID_CREATED, 0);
        assertEq(DIDMessageLib.DID_DEACTIVATED, 2);
        assertEq(DIDMessageLib.CREDENTIAL_ISSUED, 3);
        assertEq(DIDMessageLib.TRUSTED_ISSUER_ADDED, 6);
    }

    // ── Constructor ──────────────────────────────────────────────

    function test_constructor_setsAddresses() public view {
        assertEq(address(facet.MAILBOX()), address(mockMailbox));
        assertEq(facet.BRIDGEHUB(), address(mockBridgehub));
        assertEq(facet.CHAIN_ID(), CHAIN_ID);
        assertEq(facet.l2DIDRegistry(), L2_DID_REGISTRY);
        assertEq(facet.l2CredentialRegistry(), L2_CREDENTIAL_REGISTRY);
        assertEq(facet.l2IdentityVerifier(), L2_IDENTITY_VERIFIER);
    }

    function test_constructor_revert_zeroMailbox() public {
        vm.expectRevert("Zero mailbox");
        new DIDFacetLocal(address(0), address(mockBridgehub), CHAIN_ID, L2_DID_REGISTRY, L2_CREDENTIAL_REGISTRY, L2_IDENTITY_VERIFIER);
    }

    // ── syncDIDDocument ──────────────────────────────────────────

    function test_syncDIDDocument_created() public {
        bytes memory message = _encodeDIDCreated(alice, _methods1(), keccak256("service"), 1);

        vm.prank(submitter);
        facet.syncDIDDocument(100, 0, 1, new bytes32[](0), message);

        IDIDFacet.DIDSnapshot memory snap = facet.getDIDDocument(alice);
        assertEq(snap.controller, alice);
        assertEq(snap.verificationMethods.length, 1);
        assertEq(snap.verificationMethods[0], keccak256("pubkey_alice"));
        assertTrue(snap.active);
        assertEq(snap.nonce, 1);
        assertEq(snap.lastSyncBatch, 100);
    }

    function test_syncDIDDocument_updated() public {
        // First sync: create
        bytes memory msg1 = _encodeDIDCreated(alice, _methods1(), keccak256("service"), 1);
        facet.syncDIDDocument(100, 0, 1, new bytes32[](0), msg1);

        // Second sync: update
        bytes32[] memory newMethods = new bytes32[](2);
        newMethods[0] = keccak256("pubkey_alice_new");
        newMethods[1] = keccak256("pubkey_alice_2");
        bytes memory msg2 = _encodeDIDUpdated(alice, newMethods, keccak256("service2"), 2);
        facet.syncDIDDocument(101, 0, 1, new bytes32[](0), msg2);

        IDIDFacet.DIDSnapshot memory snap = facet.getDIDDocument(alice);
        assertEq(snap.verificationMethods.length, 2);
        assertEq(snap.nonce, 2);
        assertEq(snap.serviceEndpointHash, keccak256("service2"));
    }

    function test_syncDIDDocument_deactivated() public {
        bytes memory msg1 = _encodeDIDCreated(alice, _methods1(), keccak256("service"), 1);
        facet.syncDIDDocument(100, 0, 1, new bytes32[](0), msg1);
        assertTrue(facet.isIdentityActive(alice));

        bytes memory msg2 = _encodeDIDDeactivated(alice, 2);
        facet.syncDIDDocument(101, 0, 1, new bytes32[](0), msg2);
        assertFalse(facet.isIdentityActive(alice));
    }

    function test_syncDIDDocument_emitsEvent() public {
        bytes memory message = _encodeDIDCreated(alice, _methods1(), keccak256("service"), 1);

        vm.expectEmit(true, false, false, true);
        emit IDIDFacet.DIDDocumentSynced(alice, DIDMessageLib.DID_CREATED, 100);

        facet.syncDIDDocument(100, 0, 1, new bytes32[](0), message);
    }

    function test_syncDIDDocument_revert_replay() public {
        bytes memory message = _encodeDIDCreated(alice, _methods1(), keccak256("service"), 1);
        facet.syncDIDDocument(100, 0, 1, new bytes32[](0), message);

        bytes32 expectedKey = keccak256(abi.encode(uint256(100), uint256(0)));
        vm.expectRevert(abi.encodeWithSelector(IDIDFacet.MessageAlreadyProcessed.selector, expectedKey));
        facet.syncDIDDocument(100, 0, 1, new bytes32[](0), message);
    }

    function test_syncDIDDocument_revert_invalidProof() public {
        mockMailbox.setDefaultResponse(false);
        bytes memory message = _encodeDIDCreated(alice, _methods1(), keccak256("service"), 1);

        vm.expectRevert(IDIDFacet.InvalidL2MessageProof.selector);
        facet.syncDIDDocument(100, 0, 1, new bytes32[](0), message);
    }

    function test_syncDIDDocument_revert_staleNonce() public {
        bytes memory msg1 = _encodeDIDCreated(alice, _methods1(), keccak256("service"), 5);
        facet.syncDIDDocument(100, 0, 1, new bytes32[](0), msg1);

        // Try to sync with same nonce
        bytes memory msg2 = _encodeDIDUpdated(alice, _methods1(), keccak256("service2"), 5);
        vm.expectRevert(abi.encodeWithSelector(IDIDFacet.StaleNonce.selector, 5, 5));
        facet.syncDIDDocument(101, 0, 1, new bytes32[](0), msg2);
    }

    // ── syncCredential ───────────────────────────────────────────

    function test_syncCredential_issued() public {
        bytes32 credId = keccak256("cred-1");
        bytes memory message = _encodeCredentialIssued(credId, issuer, alice, KYC_TYPE, keccak256("claim"), 1000, 0);

        facet.syncCredential(100, 0, 1, new bytes32[](0), message);

        IDIDFacet.CredentialSnapshot memory snap = facet.getCredential(credId);
        assertEq(snap.issuer, issuer);
        assertEq(snap.subject, alice);
        assertEq(snap.credentialType, KYC_TYPE);
        assertTrue(facet.isCredentialValid(credId));
    }

    function test_syncCredential_revoked() public {
        bytes32 credId = keccak256("cred-1");
        bytes memory msg1 = _encodeCredentialIssued(credId, issuer, alice, KYC_TYPE, keccak256("claim"), 1000, 0);
        facet.syncCredential(100, 0, 1, new bytes32[](0), msg1);
        assertTrue(facet.isCredentialValid(credId));

        bytes memory msg2 = _encodeCredentialRevoked(credId, issuer);
        facet.syncCredential(101, 0, 1, new bytes32[](0), msg2);
        assertFalse(facet.isCredentialValid(credId));
    }

    function test_syncCredential_expired() public {
        bytes32 credId = keccak256("cred-1");
        uint64 expiry = uint64(block.timestamp + 100);
        bytes memory message = _encodeCredentialIssued(credId, issuer, alice, KYC_TYPE, keccak256("claim"), 1000, expiry);
        facet.syncCredential(100, 0, 1, new bytes32[](0), message);
        assertTrue(facet.isCredentialValid(credId));

        vm.warp(expiry + 1);
        assertFalse(facet.isCredentialValid(credId));
    }

    function test_syncCredential_emitsEvent() public {
        bytes32 credId = keccak256("cred-1");
        bytes memory message = _encodeCredentialIssued(credId, issuer, alice, KYC_TYPE, keccak256("claim"), 1000, 0);

        vm.expectEmit(true, false, false, true);
        emit IDIDFacet.CredentialSynced(credId, DIDMessageLib.CREDENTIAL_ISSUED, 100);

        facet.syncCredential(100, 0, 1, new bytes32[](0), message);
    }

    // ── syncCompliance ───────────────────────────────────────────

    function test_syncCompliance_updated() public {
        bytes memory message = _encodeComplianceUpdated(alice, KYC_REQ, true);
        facet.syncCompliance(100, 0, 1, new bytes32[](0), message);

        assertTrue(facet.checkCompliance(alice, KYC_REQ));
    }

    function test_syncCompliance_trustedIssuerAdded() public {
        bytes memory message = _encodeTrustedIssuerAdded(issuer);
        facet.syncCompliance(100, 0, 1, new bytes32[](0), message);

        assertTrue(facet.isTrustedIssuer(issuer));
    }

    function test_syncCompliance_trustedIssuerRemoved() public {
        // Add first
        bytes memory msg1 = _encodeTrustedIssuerAdded(issuer);
        facet.syncCompliance(100, 0, 1, new bytes32[](0), msg1);
        assertTrue(facet.isTrustedIssuer(issuer));

        // Remove
        bytes memory msg2 = _encodeTrustedIssuerRemoved(issuer);
        facet.syncCompliance(101, 0, 1, new bytes32[](0), msg2);
        assertFalse(facet.isTrustedIssuer(issuer));
    }

    // ── isMessageProcessed ───────────────────────────────────────

    function test_isMessageProcessed() public {
        assertFalse(facet.isMessageProcessed(100, 0));

        bytes memory message = _encodeDIDCreated(alice, _methods1(), keccak256("service"), 1);
        facet.syncDIDDocument(100, 0, 1, new bytes32[](0), message);

        assertTrue(facet.isMessageProcessed(100, 0));
        assertFalse(facet.isMessageProcessed(100, 1));
    }
}

Step 3: Run tests

Run: cd contracts && forge test --match-contract DIDFacetTest -v Expected: 17 tests PASS

Step 4: Commit

git add contracts/src/did/DIDFacetLocal.sol contracts/test/DIDFacet.t.sol
git commit -m "feat(did): DIDFacetLocal L2→L1 sync + 17 tests"

---

Task 3: DIDFacetLocal — L1→L2 Request 实现 + 测试

Files:

• Modify: contracts/src/did/DIDFacetLocal.sol

• Modify: contracts/test/DIDFacet.t.sol

Step 1: Replace request function placeholders with real implementations

Replace the 5 placeholder request* functions in DIDFacetLocal.sol:

    // ── L1→L2 Request Functions ──────────────────────────────────

    function requestCreateDID(
        bytes32[] calldata _verificationMethods,
        bytes32 _serviceEndpointHash,
        uint256 _l2GasLimit,
        uint256 _l2GasPerPubdataByteLimit
    ) external payable override returns (bytes32 l2TxHash) {
        bytes memory l2Calldata = abi.encodeWithSignature(
            "createDID(bytes32[],bytes32)",
            _verificationMethods,
            _serviceEndpointHash
        );
        l2TxHash = _requestL2Transaction(l2DIDRegistry, l2Calldata, _l2GasLimit, _l2GasPerPubdataByteLimit);
        emit L2TransactionRequested(l2TxHash, msg.sender, l2DIDRegistry, bytes4(l2Calldata));
    }

    function requestIssueCredential(
        address _subject,
        bytes32 _credentialType,
        bytes32 _claimHash,
        uint64 _expiresAt,
        uint256 _l2GasLimit,
        uint256 _l2GasPerPubdataByteLimit
    ) external payable override returns (bytes32 l2TxHash) {
        bytes memory l2Calldata = abi.encodeWithSignature(
            "issueCredential(address,bytes32,bytes32,uint64)",
            _subject,
            _credentialType,
            _claimHash,
            _expiresAt
        );
        l2TxHash = _requestL2Transaction(l2CredentialRegistry, l2Calldata, _l2GasLimit, _l2GasPerPubdataByteLimit);
        emit L2TransactionRequested(l2TxHash, msg.sender, l2CredentialRegistry, bytes4(l2Calldata));
    }

    function requestDeactivateDID(
        uint256 _l2GasLimit,
        uint256 _l2GasPerPubdataByteLimit
    ) external payable override returns (bytes32 l2TxHash) {
        bytes memory l2Calldata = abi.encodeWithSignature("deactivateDID()");
        l2TxHash = _requestL2Transaction(l2DIDRegistry, l2Calldata, _l2GasLimit, _l2GasPerPubdataByteLimit);
        emit L2TransactionRequested(l2TxHash, msg.sender, l2DIDRegistry, bytes4(l2Calldata));
    }

    function requestRevokeCredential(
        bytes32 _credentialId,
        uint256 _l2GasLimit,
        uint256 _l2GasPerPubdataByteLimit
    ) external payable override returns (bytes32 l2TxHash) {
        bytes memory l2Calldata = abi.encodeWithSignature(
            "revokeCredential(bytes32)",
            _credentialId
        );
        l2TxHash = _requestL2Transaction(l2CredentialRegistry, l2Calldata, _l2GasLimit, _l2GasPerPubdataByteLimit);
        emit L2TransactionRequested(l2TxHash, msg.sender, l2CredentialRegistry, bytes4(l2Calldata));
    }

    function requestAddTrustedIssuer(
        address _issuer,
        uint256 _l2GasLimit,
        uint256 _l2GasPerPubdataByteLimit
    ) external payable override returns (bytes32 l2TxHash) {
        bytes memory l2Calldata = abi.encodeWithSignature(
            "addTrustedIssuer(address)",
            _issuer
        );
        l2TxHash = _requestL2Transaction(l2IdentityVerifier, l2Calldata, _l2GasLimit, _l2GasPerPubdataByteLimit);
        emit L2TransactionRequested(l2TxHash, msg.sender, l2IdentityVerifier, bytes4(l2Calldata));
    }

    // ── Internal: L1→L2 ──────────────────────────────────────────

    function _requestL2Transaction(
        address _l2Contract,
        bytes memory _l2Calldata,
        uint256 _l2GasLimit,
        uint256 _l2GasPerPubdataByteLimit
    ) internal returns (bytes32) {
        L2TransactionRequestDirect memory request = L2TransactionRequestDirect({
            chainId: CHAIN_ID,
            mintValue: msg.value,
            l2Contract: _l2Contract,
            l2Value: 0,
            l2Calldata: _l2Calldata,
            l2GasLimit: _l2GasLimit,
            l2GasPerPubdataByteLimit: _l2GasPerPubdataByteLimit,
            factoryDeps: new bytes[](0),
            refundRecipient: msg.sender
        });

        return MockBridgehub(BRIDGEHUB).requestL2TransactionDirect{value: msg.value}(request);
    }

Note: Import L2TransactionRequestDirect struct and MockBridgehub — they must be accessible. Since DIDFacetLocal imports from MockBridgehub, move the struct to a shared location or import from the mock file. Simplest: import MockBridgehub directly in DIDFacetLocal (it's a Local test contract anyway).

Actually, better approach: create a minimal IBridgehub interface in contracts/src/interfaces/:

// contracts/src/interfaces/IBridgehubLocal.sol
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.26;

struct L2TransactionRequestDirect {
    uint256 chainId;
    uint256 mintValue;
    address l2Contract;
    uint256 l2Value;
    bytes l2Calldata;
    uint256 l2GasLimit;
    uint256 l2GasPerPubdataByteLimit;
    bytes[] factoryDeps;
    address refundRecipient;
}

interface IBridgehubLocal {
    function requestL2TransactionDirect(
        L2TransactionRequestDirect calldata _request
    ) external payable returns (bytes32 canonicalTxHash);
}

Then DIDFacetLocal imports IBridgehubLocal and MockBridgehub implements it.

Step 2: Write L1→L2 request tests (8 tests)

Add to contracts/test/DIDFacet.t.sol:

    // ── requestCreateDID ─────────────────────────────────────────

    function test_requestCreateDID_success() public {
        bytes32[] memory methods = _methods1();
        bytes32 serviceHash = keccak256("service");

        vm.deal(alice, 1 ether);
        vm.prank(alice);
        bytes32 txHash = facet.requestCreateDID{value: 0.1 ether}(methods, serviceHash, 500000, 800);

        assertEq(txHash, mockBridgehub.nextTxHash());
        assertEq(mockBridgehub.requestCount(), 1);
    }

    function test_requestCreateDID_calldata() public {
        bytes32[] memory methods = _methods1();
        bytes32 serviceHash = keccak256("service");

        vm.deal(alice, 1 ether);
        vm.prank(alice);
        facet.requestCreateDID{value: 0.1 ether}(methods, serviceHash, 500000, 800);

        MockBridgehub.L2TxRequest memory req = mockBridgehub.getLastRequest();
        assertEq(req.l2Contract, L2_DID_REGISTRY);
        assertEq(req.l2GasLimit, 500000);
        assertEq(req.chainId, CHAIN_ID);
    }

    function test_requestCreateDID_emitsEvent() public {
        bytes32[] memory methods = _methods1();
        bytes32 serviceHash = keccak256("service");
        bytes memory expectedCalldata = abi.encodeWithSignature("createDID(bytes32[],bytes32)", methods, serviceHash);

        vm.deal(alice, 1 ether);
        vm.expectEmit(true, true, false, true);
        emit IDIDFacet.L2TransactionRequested(mockBridgehub.nextTxHash(), alice, L2_DID_REGISTRY, bytes4(expectedCalldata));

        vm.prank(alice);
        facet.requestCreateDID{value: 0.1 ether}(methods, serviceHash, 500000, 800);
    }

    // ── requestIssueCredential ───────────────────────────────────

    function test_requestIssueCredential_success() public {
        vm.deal(alice, 1 ether);
        vm.prank(alice);
        bytes32 txHash = facet.requestIssueCredential{value: 0.1 ether}(bob, KYC_TYPE, keccak256("claim"), 0, 500000, 800);

        assertEq(txHash, mockBridgehub.nextTxHash());
        MockBridgehub.L2TxRequest memory req = mockBridgehub.getLastRequest();
        assertEq(req.l2Contract, L2_CREDENTIAL_REGISTRY);
    }

    // ── requestDeactivateDID ─────────────────────────────────────

    function test_requestDeactivateDID_success() public {
        vm.deal(alice, 1 ether);
        vm.prank(alice);
        facet.requestDeactivateDID{value: 0.1 ether}(500000, 800);

        MockBridgehub.L2TxRequest memory req = mockBridgehub.getLastRequest();
        assertEq(req.l2Contract, L2_DID_REGISTRY);
    }

    // ── requestRevokeCredential ──────────────────────────────────

    function test_requestRevokeCredential_success() public {
        vm.deal(alice, 1 ether);
        vm.prank(alice);
        facet.requestRevokeCredential{value: 0.1 ether}(keccak256("cred-1"), 500000, 800);

        MockBridgehub.L2TxRequest memory req = mockBridgehub.getLastRequest();
        assertEq(req.l2Contract, L2_CREDENTIAL_REGISTRY);
    }

    // ── requestAddTrustedIssuer ──────────────────────────────────

    function test_requestAddTrustedIssuer_success() public {
        vm.deal(alice, 1 ether);
        vm.prank(alice);
        facet.requestAddTrustedIssuer{value: 0.1 ether}(issuer, 500000, 800);

        MockBridgehub.L2TxRequest memory req = mockBridgehub.getLastRequest();
        assertEq(req.l2Contract, L2_IDENTITY_VERIFIER);
    }

    // ── Admin ────────────────────────────────────────────────────

    function test_setL2Addresses_success() public {
        address newDid = makeAddr("newDid");
        address newCred = makeAddr("newCred");
        address newVerifier = makeAddr("newVerifier");

        facet.setL2Addresses(newDid, newCred, newVerifier);

        assertEq(facet.l2DIDRegistry(), newDid);
        assertEq(facet.l2CredentialRegistry(), newCred);
        assertEq(facet.l2IdentityVerifier(), newVerifier);
    }

    function test_setL2Addresses_revert_notAdmin() public {
        vm.prank(alice);
        vm.expectRevert(IDIDFacet.NotAdmin.selector);
        facet.setL2Addresses(address(1), address(2), address(3));
    }

Step 3: Run tests

Run: cd contracts && forge test --match-contract DIDFacetTest -v Expected: 27 tests PASS (17 sync + 8 request + 2 admin)

Step 4: Commit

git add contracts/src/did/DIDFacetLocal.sol contracts/src/interfaces/IBridgehubLocal.sol \
        contracts/test/mocks/MockBridgehub.sol contracts/test/DIDFacet.t.sol
git commit -m "feat(did): DIDFacetLocal L1→L2 request functions + 10 tests"

---

Task 4: E2E 流程测试 + 查询边界测试

Files:

• Modify: contracts/test/DIDFacet.t.sol

Step 1: Add E2E and edge case tests (5 tests)

    // ── View edge cases ──────────────────────────────────────────

    function test_isCredentialValid_false_nonExistent() public view {
        assertFalse(facet.isCredentialValid(bytes32(0)));
    }

    function test_getDIDDocument_empty_nonExistent() public view {
        IDIDFacet.DIDSnapshot memory snap = facet.getDIDDocument(alice);
        assertEq(snap.controller, address(0));
        assertFalse(snap.active);
    }

    function test_checkCompliance_false_default() public view {
        assertFalse(facet.checkCompliance(alice, KYC_REQ));
    }

    // ── E2E Lifecycle ────────────────────────────────────────────

    function test_E2E_createSyncQueryLifecycle() public {
        // 1. L1 requests DID creation on L2
        vm.deal(alice, 1 ether);
        vm.prank(alice);
        bytes32 txHash = facet.requestCreateDID{value: 0.1 ether}(_methods1(), keccak256("service"), 500000, 800);
        assertTrue(txHash != bytes32(0));

        // 2. (Simulated) L2 executes and sends L1Messenger message
        //    Sync the DID document
        bytes memory syncMsg = _encodeDIDCreated(alice, _methods1(), keccak256("service"), 1);
        facet.syncDIDDocument(100, 0, 1, new bytes32[](0), syncMsg);

        // 3. Verify L1 cache
        assertTrue(facet.isIdentityActive(alice));
        IDIDFacet.DIDSnapshot memory snap = facet.getDIDDocument(alice);
        assertEq(snap.controller, alice);
        assertEq(snap.nonce, 1);

        // 4. Issue credential
        vm.deal(issuer, 1 ether);
        vm.prank(issuer);
        facet.requestIssueCredential{value: 0.1 ether}(alice, KYC_TYPE, keccak256("claim"), 0, 500000, 800);

        // 5. Sync credential
        bytes32 credId = keccak256("cred-1");
        bytes memory credMsg = _encodeCredentialIssued(credId, issuer, alice, KYC_TYPE, keccak256("claim"), 1000, 0);
        facet.syncCredential(101, 0, 1, new bytes32[](0), credMsg);
        assertTrue(facet.isCredentialValid(credId));

        // 6. Sync compliance
        bytes memory compMsg = _encodeComplianceUpdated(alice, KYC_REQ, true);
        facet.syncCompliance(101, 1, 2, new bytes32[](0), compMsg);
        assertTrue(facet.checkCompliance(alice, KYC_REQ));

        // 7. Deactivate DID
        vm.prank(alice);
        facet.requestDeactivateDID{value: 0.1 ether}(500000, 800);

        bytes memory deactMsg = _encodeDIDDeactivated(alice, 2);
        facet.syncDIDDocument(102, 0, 1, new bytes32[](0), deactMsg);
        assertFalse(facet.isIdentityActive(alice));
    }

    function test_E2E_trustedIssuerFlow() public {
        // 1. Initially not a trusted issuer
        assertFalse(facet.isTrustedIssuer(issuer));

        // 2. Request add from L1
        vm.deal(address(this), 1 ether);
        facet.requestAddTrustedIssuer{value: 0.1 ether}(issuer, 500000, 800);

        // 3. Sync the result
        bytes memory addMsg = _encodeTrustedIssuerAdded(issuer);
        facet.syncCompliance(100, 0, 1, new bytes32[](0), addMsg);
        assertTrue(facet.isTrustedIssuer(issuer));

        // 4. Remove
        bytes memory removeMsg = _encodeTrustedIssuerRemoved(issuer);
        facet.syncCompliance(101, 0, 1, new bytes32[](0), removeMsg);
        assertFalse(facet.isTrustedIssuer(issuer));
    }

Step 2: Run tests

Run: cd contracts && forge test --match-contract DIDFacetTest -v Expected: 32 tests PASS

Step 3: Commit

git add contracts/test/DIDFacet.t.sol
git commit -m "feat(did): DIDFacet E2E lifecycle + edge case tests (32 total)"

---

Task 5: L2 系统合约 L1Messenger 集成

Files:

• Modify: era-contracts-l1/system-contracts/contracts/DIDRegistry.sol

• Modify: era-contracts-l1/system-contracts/contracts/CredentialRegistry.sol

• Modify: era-contracts-l1/system-contracts/contracts/IdentityVerifier.sol

Step 1: Add L1Messenger calls to DIDRegistry.sol

Import L1Messenger and add calls to createDID(), updateDocument(), deactivateDID():

// Add import at top:
import {IL1Messenger, L1_MESSENGER_CONTRACT} from "./interfaces/IL1Messenger.sol";

// In createDID(), after existing logic and before closing brace:
IL1Messenger(L1_MESSENGER_CONTRACT).sendToL1(
    abi.encode(uint8(0), msg.sender, verificationMethods, serviceEndpointHash, _nonces[msg.sender])
);

// In updateDocument(), after existing logic:
IL1Messenger(L1_MESSENGER_CONTRACT).sendToL1(
    abi.encode(uint8(1), msg.sender, verificationMethods, serviceEndpointHash, _nonces[msg.sender])
);

// In deactivateDID(), after existing logic:
IL1Messenger(L1_MESSENGER_CONTRACT).sendToL1(
    abi.encode(uint8(2), msg.sender, _nonces[msg.sender])
);

Step 2: Add L1Messenger calls to CredentialRegistry.sol

// Add import at top:
import {IL1Messenger, L1_MESSENGER_CONTRACT} from "./interfaces/IL1Messenger.sol";

// In issueCredential(), before return:
IL1Messenger(L1_MESSENGER_CONTRACT).sendToL1(
    abi.encode(uint8(3), credentialId, msg.sender, subject, credentialType, claimHash, uint64(block.timestamp), expiresAt)
);

// In revokeCredential(), after setting _revoked:
IL1Messenger(L1_MESSENGER_CONTRACT).sendToL1(
    abi.encode(uint8(4), credentialId, msg.sender)
);

Step 3: Add L1Messenger calls to IdentityVerifier.sol

// Import should already exist (check first), if not add:
import {IL1Messenger, L1_MESSENGER_CONTRACT} from "./interfaces/IL1Messenger.sol";

// In setCompliance(), after setting compliance mapping:
IL1Messenger(L1_MESSENGER_CONTRACT).sendToL1(
    abi.encode(uint8(5), identity, requirement, status)
);

// In addTrustedIssuer(), after setting _trustedIssuers:
IL1Messenger(L1_MESSENGER_CONTRACT).sendToL1(
    abi.encode(uint8(6), issuer)
);

// In removeTrustedIssuer(), after deleting _trustedIssuers:
IL1Messenger(L1_MESSENGER_CONTRACT).sendToL1(
    abi.encode(uint8(7), issuer)
);

Step 4: Check IL1Messenger interface exists and has correct import path

The existing IL1Messenger.sol is at: era-contracts-l1/system-contracts/contracts/interfaces/IL1Messenger.sol

The L1_MESSENGER_CONTRACT constant is in Constants.sol at address 0x8008.

Verify correct import: import {IL1Messenger} from "./interfaces/IL1Messenger.sol"; and import {L1_MESSENGER_CONTRACT} from "./Constants.sol";

Note: Constants.sol defines address constant L1_MESSENGER_CONTRACT = address(SYSTEM_CONTRACTS_OFFSET + 0x08); which resolves to 0x8008. However the import style varies — check existing imports in the file.

Step 5: Compile system contracts

Run: cd era-contracts-l1/system-contracts && npx hardhat compile Expected: Compilation succeeds (may need nvm use 20 first)

Step 6: Commit

cd era-contracts-l1
git add system-contracts/contracts/DIDRegistry.sol \
        system-contracts/contracts/CredentialRegistry.sol \
        system-contracts/contracts/IdentityVerifier.sol
git commit -m "feat(did): L1Messenger integration for L2→L1 DID state sync"

---

Task 6: 全量回归测试 + dev-log 更新

Files:

• Verify: all tests pass

• Modify: docs/dev-log.md

Step 1: Run Foundry tests (contracts/)

Run: cd contracts && forge test -v Expected: All tests pass (previous 209 + new ~32 = ~241)

Step 2: Run system contract compilation (era-contracts-l1/)

Run: cd era-contracts-l1/system-contracts && nvm use 20 && npx hardhat compile Expected: Compilation succeeds

Step 3: Check era-core compilation

Run: cd era-core/core && ZKSYNC_USE_CUDA_STUBS=true cargo check Expected: No errors (era-core has no DIDFacet changes)

Step 4: Update dev-log

Append Phase 5b DIDFacet section to docs/dev-log.md.

Step 5: Commit

git add docs/dev-log.md
git commit -m "feat(did): L1 DIDFacet + Mailbox 双向同步 — Phase 5b dev-log"

---

Summary

Task	内容	新文件	测试数
1	DIDMessageLib + IDIDFacet + MockBridgehub	4	1
2	DIDFacetLocal L2→L1 sync	1	+16 (17)
3	DIDFacetLocal L1→L2 request + admin	1	+10 (27)
4	E2E lifecycle + edge cases	0	+5 (32)
5	L2 系统合约 L1Messenger 集成	0	compile
6	全量回归 + dev-log	0	~241