@cofhe/foundry-plugin 0.0.0-alpha-20260409113701

package/README.md

@@ -0,0 +1,93 @@
+# @cofhe/foundry-plugin
+
+Foundry test utilities for [CoFHE](https://github.com/FhenixProtocol/cofhesdk). Provides `CofheTest` (base test contract with mock deployment) and `CofheClient` (SDK-like client for encrypting inputs, decrypting outputs, and managing permits).
+
+## Installation
+
+**npm / pnpm**
+
+```sh
+npm install --save-dev @cofhe/foundry-plugin
+```
+
+Add to `foundry.toml`:
+
+```toml
+[profile.default]
+libs = ["node_modules", "lib"]
+remappings = [
+  "forge-std/=node_modules/forge-std/src/",
+  "@openzeppelin/contracts/=node_modules/@openzeppelin/contracts/",
+  "@fhenixprotocol/cofhe-contracts/=node_modules/@fhenixprotocol/cofhe-contracts/",
+  "@cofhe/mock-contracts/=node_modules/@cofhe/mock-contracts/",
+  "@cofhe/foundry-plugin/=node_modules/@cofhe/foundry-plugin/contracts/"
+]
+```
+
+**Git submodule**
+
+```sh
+git submodule add https://github.com/FhenixProtocol/cofhesdk lib/cofhe-foundry-plugin
+# also add @cofhe/mock-contracts as a second submodule or via npm
+```
+
+## Usage
+
+Inherit `CofheTest` in your test contract and call `deployMocks()` in `setUp`. Use `createCofheClient()` to get a connected client.
+
+```solidity
+import { CofheTest } from "@cofhe/foundry-plugin/CofheTest.sol";
+import { CofheClient } from "@cofhe/foundry-plugin/CofheClient.sol";
+
+contract MyTest is CofheTest {
+    CofheClient client;
+    MyContract target;
+
+    uint256 constant USER_PKEY = 0xac09...;
+
+    function setUp() public {
+        deployMocks();
+        client = createCofheClient();
+        client.connect(USER_PKEY);
+        target = new MyContract();
+    }
+
+    function testEncryptAndStore() public {
+        InEuint32 memory enc = client.createInEuint32(42);
+
+        vm.prank(client.account());
+        target.store(enc);
+
+        expectPlaintext(target.eValue(), uint32(42));
+    }
+}
+```
+
+## API
+
+### `CofheTest` (abstract base)
+
+| Function                         | Description                                                  |
+| -------------------------------- | ------------------------------------------------------------ |
+| `deployMocks()`                  | Deploys all mock contracts and wires them together           |
+| `createCofheClient()`            | Returns a new unconnected `CofheClient`                      |
+| `enableLogs()` / `disableLogs()` | Toggle plaintext operation logging                           |
+| `getPlaintext(ctHash)`           | Returns the stored plaintext for a ciphertext handle         |
+| `expectPlaintext(handle, value)` | Asserts the plaintext of an encrypted handle matches `value` |
+
+`getPlaintext` and `expectPlaintext` have typed overloads for `ebool`, `euint8`, `euint16`, `euint32`, `euint64`, `euint128`, and `eaddress`.
+
+### `CofheClient`
+
+| Function                                      | Description                                                                      |
+| --------------------------------------------- | -------------------------------------------------------------------------------- |
+| `connect(pkey)`                               | Sets the active account from a private key                                       |
+| `account()`                                   | Returns the connected account address                                            |
+| `createInEbool/8/16/32/64/128/address(value)` | Creates a signed encrypted input                                                 |
+| `decryptForTx_withoutPermit(ctHash)`          | Decrypts a globally-allowed ciphertext; returns `(ctHash, plaintext, signature)` |
+| `decryptForTx_withPermit(ctHash, permit)`     | Decrypts with a permission; returns `(ctHash, plaintext, signature)`             |
+| `decryptForView(ctHash, sealingKey, permit)`  | Seals and unseals for off-chain reading                                          |
+| `permit_createSelf()`                         | Creates a self-permit for the connected account                                  |
+| `permit_createShared(recipient)`              | Creates the issuer half of a shared permit                                       |
+| `permit_exportShared(permit)`                 | Strips recipient fields for safe transmission                                    |
+| `permit_importShared(export)`                 | Completes a shared permit as the recipient                                       |

package/contracts/CofheClient.sol

@@ -0,0 +1,291 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.13;
+
+import { Test } from 'forge-std/Test.sol';
+import { MessageHashUtils } from '@openzeppelin/contracts/utils/cryptography/MessageHashUtils.sol';
+import '@fhenixprotocol/cofhe-contracts/FHE.sol';
+import { MockTaskManager } from '@cofhe/mock-contracts/contracts/MockTaskManager.sol';
+import { MockACL } from '@cofhe/mock-contracts/contracts/MockACL.sol';
+import { MockZkVerifier } from '@cofhe/mock-contracts/contracts/MockZkVerifier.sol';
+import { MockZkVerifierSigner } from './MockZkVerifierSigner.sol';
+import { MockThresholdNetwork } from '@cofhe/mock-contracts/contracts/MockThresholdNetwork.sol';
+import { MockThresholdNetworkSigner } from './MockThresholdNetworkSigner.sol';
+import { Permission, PermissionUtils } from '@cofhe/mock-contracts/contracts/Permissioned.sol';
+import { ZK_VERIFIER_SIGNER_ADDRESS, DECRYPT_RESULT_SIGNER_ADDRESS } from '@cofhe/mock-contracts/contracts/MockCoFHE.sol';
+
+/// @notice Portable representation of the issuer's half of a shared permit, safe to transmit as cleartext.
+struct SharedPermitExport {
+  address issuer;
+  uint64 expiration;
+  address recipient;
+  uint256 validatorId;
+  address validatorContract;
+  bytes issuerSignature;
+}
+
+/// @notice SDK-like client for Foundry tests. Mirrors the JS SDK's `createCofheClient` pattern.
+/// @dev    Must be deployed via `CofheTestUtils.createCofheClient()` after `deployMocks()`.
+///         Call `connect(pkey)` before using any other function.
+contract CofheClient is Test {
+  // Keep in sync with `packages/sdk/core/consts.ts`
+  address constant ZK_VERIFIER_ADDRESS = 0x0000000000000000000000000000000000005001;
+  address constant THRESHOLD_NETWORK_ADDRESS = 0x0000000000000000000000000000000000005002;
+
+  MockTaskManager public mockTaskManager;
+  MockACL public mockAcl;
+  MockZkVerifier public mockZkVerifier;
+  MockZkVerifierSigner public mockZkVerifierSigner;
+  MockThresholdNetwork public mockThresholdNetwork;
+  MockThresholdNetworkSigner public mockThresholdNetworkSigner;
+
+  uint256 private _pkey;
+  address private _account;
+  bool private _connected;
+
+  constructor() {
+    mockTaskManager = MockTaskManager(TASK_MANAGER_ADDRESS);
+    mockAcl = MockACL(address(mockTaskManager.acl()));
+    mockZkVerifier = MockZkVerifier(ZK_VERIFIER_ADDRESS);
+    mockZkVerifierSigner = MockZkVerifierSigner(ZK_VERIFIER_SIGNER_ADDRESS);
+    mockThresholdNetwork = MockThresholdNetwork(THRESHOLD_NETWORK_ADDRESS);
+    mockThresholdNetworkSigner = MockThresholdNetworkSigner(DECRYPT_RESULT_SIGNER_ADDRESS);
+  }
+
+  modifier onlyConnected() {
+    require(_connected, 'CofheClient: not connected');
+    _;
+  }
+
+  /// @notice Returns the address derived from the connected private key.
+  function account() public view onlyConnected returns (address) {
+    return _account;
+  }
+
+  /// @notice Stores the private key, derives the account address, and marks the client as connected.
+  function connect(uint256 pkey) public {
+    _pkey = pkey;
+    _account = vm.addr(pkey);
+    _connected = true;
+  }
+
+  // =====================
+  //       ENCRYPT
+  // =====================
+
+  /// @notice Creates a signed encrypted input for the connected account (security zone 0).
+  function createEncryptedInput(
+    uint8 utype,
+    uint256 value
+  ) internal onlyConnected returns (EncryptedInput memory input) {
+    input = mockZkVerifier.zkVerify(value, utype, _account, 0, block.chainid);
+    input = mockZkVerifierSigner.zkVerifySign(input, _account);
+  }
+
+  /// @notice Creates an encrypted boolean input.
+  function createInEbool(bool value) public returns (InEbool memory) {
+    return abi.decode(abi.encode(createEncryptedInput(Utils.EBOOL_TFHE, value ? 1 : 0)), (InEbool));
+  }
+
+  /// @notice Creates an encrypted uint8 input.
+  function createInEuint8(uint8 value) public returns (InEuint8 memory) {
+    return abi.decode(abi.encode(createEncryptedInput(Utils.EUINT8_TFHE, value)), (InEuint8));
+  }
+
+  /// @notice Creates an encrypted uint16 input.
+  function createInEuint16(uint16 value) public returns (InEuint16 memory) {
+    return abi.decode(abi.encode(createEncryptedInput(Utils.EUINT16_TFHE, value)), (InEuint16));
+  }
+
+  /// @notice Creates an encrypted uint32 input.
+  function createInEuint32(uint32 value) public returns (InEuint32 memory) {
+    return abi.decode(abi.encode(createEncryptedInput(Utils.EUINT32_TFHE, value)), (InEuint32));
+  }
+
+  /// @notice Creates an encrypted uint64 input.
+  function createInEuint64(uint64 value) public returns (InEuint64 memory) {
+    return abi.decode(abi.encode(createEncryptedInput(Utils.EUINT64_TFHE, value)), (InEuint64));
+  }
+
+  /// @notice Creates an encrypted uint128 input.
+  function createInEuint128(uint128 value) public returns (InEuint128 memory) {
+    return abi.decode(abi.encode(createEncryptedInput(Utils.EUINT128_TFHE, value)), (InEuint128));
+  }
+
+  /// @notice Creates an encrypted address input.
+  function createInEaddress(address value) public returns (InEaddress memory) {
+    return abi.decode(abi.encode(createEncryptedInput(Utils.EADDRESS_TFHE, uint256(uint160(value)))), (InEaddress));
+  }
+
+  // =====================
+  //    DECRYPT FOR TX
+  // =====================
+
+  /// @notice Decrypts a globally-allowed ciphertext and returns the plaintext with a publishable signature.
+  function decryptForTx_withoutPermit(
+    bytes32 ctHash
+  ) public view onlyConnected returns (bytes32, uint256, bytes memory) {
+    uint256 ct = uint256(ctHash);
+
+    (bool allowed, string memory error, uint256 decryptedValue) = mockThresholdNetwork.decryptForTxWithoutPermit(ct);
+    require(allowed, string.concat('CofheClient: decryptForTx failed: ', error));
+
+    bytes memory signature = mockThresholdNetworkSigner.signDecryptResult(ct, decryptedValue);
+    return (ctHash, decryptedValue, signature);
+  }
+
+  /// @notice Decrypts a ciphertext using a permit and returns the plaintext with a publishable signature.
+  function decryptForTx_withPermit(
+    bytes32 ctHash,
+    Permission memory permission
+  ) public view onlyConnected returns (bytes32, uint256, bytes memory) {
+    uint256 ct = uint256(ctHash);
+
+    (bool allowed, string memory error, uint256 decryptedValue) = mockThresholdNetwork.decryptForTxWithPermit(
+      ct,
+      permission
+    );
+    require(allowed, string.concat('CofheClient: decryptForTx failed: ', error));
+
+    bytes memory signature = mockThresholdNetworkSigner.signDecryptResult(ct, decryptedValue);
+    return (ctHash, decryptedValue, signature);
+  }
+
+  // =====================
+  //   DECRYPT FOR VIEW
+  // =====================
+
+  /// @notice Decrypts a ciphertext for off-chain reading by sealing/unsealing with the permit's sealing key.
+  function decryptForView(
+    bytes32 ctHash,
+    Permission memory permission
+  ) public view onlyConnected returns (uint256) {
+    uint256 ct = uint256(ctHash);
+
+    (bool allowed, string memory error, bytes32 sealedOutput) = mockThresholdNetwork.querySealOutput(
+      ct,
+      block.chainid,
+      permission
+    );
+    require(allowed, string.concat('CofheClient: decryptForView failed: ', error));
+
+    return mockThresholdNetwork.unseal(sealedOutput, permission.sealingKey);
+  }
+
+  // =====================
+  //      PERMITS
+  // =====================
+
+  bytes32 private constant PERMISSION_TYPE_HASH =
+    keccak256('EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)');
+
+  function permissionDomainSeparator() internal view returns (bytes32) {
+    string memory name;
+    string memory version;
+    uint256 chainId;
+    address verifyingContract;
+
+    (, name, version, chainId, verifyingContract, , ) = mockAcl.eip712Domain();
+
+    return
+      keccak256(
+        abi.encode(PERMISSION_TYPE_HASH, keccak256(bytes(name)), keccak256(bytes(version)), chainId, verifyingContract)
+      );
+  }
+
+  /// @notice Wraps a struct hash into a full EIP-712 typed data hash using the ACL's domain separator.
+  function permissionHashTypedDataV4(bytes32 structHash) public view returns (bytes32) {
+    return MessageHashUtils.toTypedDataHash(permissionDomainSeparator(), structHash);
+  }
+
+  function _signPermission(bytes32 structHash, uint256 pkey) internal pure returns (bytes memory signature) {
+    (uint8 v, bytes32 r, bytes32 s) = vm.sign(pkey, structHash);
+    return abi.encodePacked(r, s, v);
+  }
+
+  function _signIssuerSelf(Permission memory permission, uint256 pkey) internal view returns (Permission memory) {
+    bytes32 permissionHash = PermissionUtils.issuerSelfHash(permission);
+    bytes32 structHash = permissionHashTypedDataV4(permissionHash);
+    permission.issuerSignature = _signPermission(structHash, pkey);
+    return permission;
+  }
+
+  function _signIssuerShared(Permission memory permission, uint256 pkey) internal view returns (Permission memory) {
+    bytes32 permissionHash = PermissionUtils.issuerSharedHash(permission);
+    bytes32 structHash = permissionHashTypedDataV4(permissionHash);
+    permission.issuerSignature = _signPermission(structHash, pkey);
+    return permission;
+  }
+
+  function _signRecipient(Permission memory permission, uint256 pkey) internal view returns (Permission memory) {
+    bytes32 permissionHash = PermissionUtils.recipientHash(permission);
+    bytes32 structHash = permissionHashTypedDataV4(permissionHash);
+    permission.recipientSignature = _signPermission(structHash, pkey);
+    return permission;
+  }
+
+  /// @notice Returns a blank Permission with default field values.
+  function createBasePermission() public pure returns (Permission memory permission) {
+    permission = Permission({
+      issuer: address(0),
+      expiration: 1000000000000,
+      recipient: address(0),
+      validatorId: 0,
+      validatorContract: address(0),
+      sealingKey: bytes32(0),
+      issuerSignature: new bytes(0),
+      recipientSignature: new bytes(0)
+    });
+  }
+
+  /// @notice Derives a deterministic sealing key from a seed.
+  function createSealingKey(uint256 seed) public pure returns (bytes32) {
+    return keccak256(abi.encodePacked(seed));
+  }
+
+  /// @notice Creates a self-permit for the connected account, signed with the stored private key.
+  function permit_createSelf() public view onlyConnected returns (Permission memory permission) {
+    permission = createBasePermission();
+    permission.issuer = _account;
+    permission.sealingKey = createSealingKey(uint256(uint160(_account)));
+    permission = _signIssuerSelf(permission, _pkey);
+  }
+
+  /// @notice Creates the issuer side of a shared permit. The result has no sealingKey (added by recipient on import).
+  function permit_createShared(address recipient) public view onlyConnected returns (Permission memory permission) {
+    permission = createBasePermission();
+    permission.issuer = _account;
+    permission.recipient = recipient;
+    permission = _signIssuerShared(permission, _pkey);
+  }
+
+  /// @notice Exports a shared permit, stripping sensitive/recipient-specific fields.
+  function permit_exportShared(Permission memory permission) public pure returns (SharedPermitExport memory exported) {
+    exported = SharedPermitExport({
+      issuer: permission.issuer,
+      expiration: permission.expiration,
+      recipient: permission.recipient,
+      validatorId: permission.validatorId,
+      validatorContract: permission.validatorContract,
+      issuerSignature: permission.issuerSignature
+    });
+  }
+
+  /// @notice Imports a shared permit export, adds the recipient's sealing key and signature.
+  function permit_importShared(
+    SharedPermitExport memory data
+  ) public view onlyConnected returns (Permission memory permission) {
+    require(data.recipient == _account, 'CofheClient: recipient mismatch');
+
+    permission = Permission({
+      issuer: data.issuer,
+      expiration: data.expiration,
+      recipient: data.recipient,
+      validatorId: data.validatorId,
+      validatorContract: data.validatorContract,
+      sealingKey: createSealingKey(uint256(uint160(_account))),
+      issuerSignature: data.issuerSignature,
+      recipientSignature: new bytes(0)
+    });
+    permission = _signRecipient(permission, _pkey);
+  }
+}

package/contracts/CofheTest.sol

@@ -0,0 +1,242 @@
+// SPDX-License-Identifier: UNLICENSED
+pragma solidity ^0.8.13;
+
+import { Test } from 'forge-std/Test.sol';
+import '@fhenixprotocol/cofhe-contracts/FHE.sol';
+import { MockTaskManager } from '@cofhe/mock-contracts/contracts/MockTaskManager.sol';
+import { MockACL } from '@cofhe/mock-contracts/contracts/MockACL.sol';
+import { MockZkVerifier } from '@cofhe/mock-contracts/contracts/MockZkVerifier.sol';
+import { MockZkVerifierSigner } from './MockZkVerifierSigner.sol';
+import { MockThresholdNetwork } from '@cofhe/mock-contracts/contracts/MockThresholdNetwork.sol';
+import { MockThresholdNetworkSigner } from './MockThresholdNetworkSigner.sol';
+import { CofheClient } from './CofheClient.sol';
+import {
+  ZK_VERIFIER_SIGNER_ADDRESS,
+  DECRYPT_RESULT_SIGNER_ADDRESS
+} from '@cofhe/mock-contracts/contracts/MockCoFHE.sol';
+
+/// @notice Base contract for Foundry tests that use the CoFHE mock environment.
+/// @dev    Inherit this contract and call `deployMocks()` in your `setUp()` function.
+///         Use `createCofheClient()` to obtain a connected client instance.
+abstract contract CofheTest is Test {
+  MockTaskManager public mockTaskManager;
+  MockACL public mockAcl;
+  MockZkVerifier public mockZkVerifier;
+  MockZkVerifierSigner public mockZkVerifierSigner;
+  MockThresholdNetwork public mockThresholdNetwork;
+  MockThresholdNetworkSigner public mockThresholdNetworkSigner;
+
+  // Keep in sync with `packages/sdk/core/consts.ts`
+  address constant ZK_VERIFIER_ADDRESS = 0x0000000000000000000000000000000000005001;
+  address constant THRESHOLD_NETWORK_ADDRESS = 0x0000000000000000000000000000000000005002;
+
+  address public constant TM_ADMIN = address(128);
+
+  // =====================
+  //     DEPLOY MOCKS
+  // =====================
+
+  /// @notice Deploys all mock contracts and wires them together, mirroring the Hardhat plugin's deployment order.
+  function deployMocks() public {
+    // 1. Task Manager
+    deployCodeTo('MockTaskManager.sol:MockTaskManager', TASK_MANAGER_ADDRESS);
+    mockTaskManager = MockTaskManager(TASK_MANAGER_ADDRESS);
+    mockTaskManager.initialize(TM_ADMIN);
+    mockTaskManager.setLogOps(false);
+    vm.label(address(mockTaskManager), 'MockTaskManager');
+
+    // 2. ACL (non-fixed deploy so constructor runs and EIP712 domain is set)
+    mockAcl = new MockACL();
+    vm.label(address(mockAcl), 'MockACL');
+
+    // 3. Link Task Manager <-> ACL, configure signers
+    vm.startPrank(TM_ADMIN);
+    mockTaskManager.setACLContract(address(mockAcl));
+    mockTaskManager.setSecurityZoneMin(0);
+    mockTaskManager.setSecurityZoneMax(1);
+    mockTaskManager.setVerifierSigner(ZK_VERIFIER_SIGNER_ADDRESS);
+    mockTaskManager.setDecryptResultSigner(DECRYPT_RESULT_SIGNER_ADDRESS);
+    vm.stopPrank();
+
+    // 4. Fund ZK Verifier Signer
+    vm.deal(ZK_VERIFIER_SIGNER_ADDRESS, 10 ether);
+
+    // 5. ZK Verifier
+    deployCodeTo('MockZkVerifier.sol:MockZkVerifier', ZK_VERIFIER_ADDRESS);
+    mockZkVerifier = MockZkVerifier(ZK_VERIFIER_ADDRESS);
+    vm.label(address(mockZkVerifier), 'MockZkVerifier');
+
+    // 6. ZK Verifier Signer
+    deployCodeTo('MockZkVerifierSigner.sol:MockZkVerifierSigner', ZK_VERIFIER_SIGNER_ADDRESS);
+    mockZkVerifierSigner = MockZkVerifierSigner(ZK_VERIFIER_SIGNER_ADDRESS);
+    vm.label(address(mockZkVerifierSigner), 'MockZkVerifierSigner');
+
+    // 7. Threshold Network
+    deployCodeTo('MockThresholdNetwork.sol:MockThresholdNetwork', THRESHOLD_NETWORK_ADDRESS);
+    mockThresholdNetwork = MockThresholdNetwork(THRESHOLD_NETWORK_ADDRESS);
+    mockThresholdNetwork.initialize(TASK_MANAGER_ADDRESS, address(mockAcl));
+    vm.label(address(mockThresholdNetwork), 'MockThresholdNetwork');
+
+    // 8. Threshold Network Signer
+    deployCodeTo('MockThresholdNetworkSigner.sol:MockThresholdNetworkSigner', DECRYPT_RESULT_SIGNER_ADDRESS);
+    mockThresholdNetworkSigner = MockThresholdNetworkSigner(DECRYPT_RESULT_SIGNER_ADDRESS);
+    vm.label(address(mockThresholdNetworkSigner), 'MockThresholdNetworkSigner');
+  }
+
+  // =====================
+  //    CREATE CLIENT
+  // =====================
+
+  /// @notice Deploys a new CofheClient instance. Call `connect(pkey)` on the result before use.
+  function createCofheClient() public returns (CofheClient) {
+    return new CofheClient();
+  }
+
+  // =====================
+  //       LOGGING
+  // =====================
+
+  /// @notice Enables plaintext operation logging in the mock task manager.
+  function enableLogs() public {
+    mockTaskManager.setLogOps(true);
+  }
+
+  /// @notice Disables plaintext operation logging in the mock task manager.
+  function disableLogs() public {
+    mockTaskManager.setLogOps(false);
+  }
+
+  // =====================
+  //    GET PLAINTEXT
+  // =====================
+
+  /// @notice Returns the stored plaintext for a ciphertext hash. Reverts if the hash is not in mock storage.
+  function getPlaintext(bytes32 ctHash) public view returns (uint256) {
+    uint256 ct = uint256(ctHash);
+    require(mockTaskManager.inMockStorage(ct), 'CofheTest: plaintext does not exist');
+    return mockTaskManager.mockStorage(ct);
+  }
+
+  /// @notice Returns the stored plaintext of an ebool. Reverts if the hash is not in mock storage.
+  function getPlaintext(ebool eValue) internal view returns (bool) {
+    return getPlaintext(ebool.unwrap(eValue)) != 0;
+  }
+
+  /// @notice Returns the stored plaintext of an euint8. Reverts if the hash is not in mock storage.
+  function getPlaintext(euint8 eValue) internal view returns (uint8) {
+    return uint8(getPlaintext(euint8.unwrap(eValue)));
+  }
+
+  /// @notice Returns the stored plaintext of an euint16. Reverts if the hash is not in mock storage.
+  function getPlaintext(euint16 eValue) internal view returns (uint16) {
+    return uint16(getPlaintext(euint16.unwrap(eValue)));
+  }
+
+  /// @notice Returns the stored plaintext of an euint32. Reverts if the hash is not in mock storage.
+  function getPlaintext(euint32 eValue) internal view returns (uint32) {
+    return uint32(getPlaintext(euint32.unwrap(eValue)));
+  }
+
+  /// @notice Returns the stored plaintext of an euint64. Reverts if the hash is not in mock storage.
+  function getPlaintext(euint64 eValue) internal view returns (uint64) {
+    return uint64(getPlaintext(euint64.unwrap(eValue)));
+  }
+
+  /// @notice Returns the stored plaintext of an euint128. Reverts if the hash is not in mock storage.
+  function getPlaintext(euint128 eValue) internal view returns (uint128) {
+    return uint128(getPlaintext(euint128.unwrap(eValue)));
+  }
+
+  /// @notice Returns the stored plaintext of an eaddress. Reverts if the hash is not in mock storage.
+  function getPlaintext(eaddress eValue) internal view returns (address) {
+    return address(uint160(getPlaintext(eaddress.unwrap(eValue))));
+  }
+
+  // =====================
+  //   EXPECT PLAINTEXT
+  // =====================
+
+  /// @notice Asserts that a ctHash exists in mock storage and its plaintext matches the expected value.
+  function expectPlaintext(bytes32 ctHash, uint256 value) public view {
+    uint256 ct = uint256(ctHash);
+    assertEq(mockTaskManager.inMockStorage(ct), true);
+    assertEq(mockTaskManager.mockStorage(ct), value);
+  }
+
+  /// @notice Same as `expectPlaintext(bytes32, uint256)` but includes a failure message.
+  function expectPlaintext(bytes32 ctHash, uint256 value, string memory message) public view {
+    uint256 ct = uint256(ctHash);
+    assertEq(mockTaskManager.inMockStorage(ct), true, message);
+    assertEq(mockTaskManager.mockStorage(ct), value, message);
+  }
+
+  /// @notice Asserts that a ebool exists in mock storage and its plaintext matches the expected value.
+  function expectPlaintext(ebool eValue, bool value) public view {
+    expectPlaintext(ebool.unwrap(eValue), value ? 1 : 0);
+  }
+
+  /// @notice Asserts that a euint8 exists in mock storage and its plaintext matches the expected value.
+  function expectPlaintext(euint8 eValue, uint8 value) public view {
+    expectPlaintext(euint8.unwrap(eValue), uint256(value));
+  }
+
+  /// @notice Asserts that a euint16 exists in mock storage and its plaintext matches the expected value.
+  function expectPlaintext(euint16 eValue, uint16 value) public view {
+    expectPlaintext(euint16.unwrap(eValue), uint256(value));
+  }
+
+  /// @notice Asserts that a euint32 exists in mock storage and its plaintext matches the expected value.
+  function expectPlaintext(euint32 eValue, uint32 value) public view {
+    expectPlaintext(euint32.unwrap(eValue), uint256(value));
+  }
+
+  /// @notice Asserts that a euint64 exists in mock storage and its plaintext matches the expected value.
+  function expectPlaintext(euint64 eValue, uint64 value) public view {
+    expectPlaintext(euint64.unwrap(eValue), uint256(value));
+  }
+
+  /// @notice Asserts that a euint128 exists in mock storage and its plaintext matches the expected value.
+  function expectPlaintext(euint128 eValue, uint128 value) public view {
+    expectPlaintext(euint128.unwrap(eValue), uint256(value));
+  }
+
+  /// @notice Asserts that a eaddress exists in mock storage and its plaintext matches the expected value.
+  function expectPlaintext(eaddress eValue, address value) public view {
+    expectPlaintext(eaddress.unwrap(eValue), uint256(uint160(value)));
+  }
+
+  /// @notice Asserts that a ebool exists in mock storage and its plaintext matches the expected value, with a failure message.
+  function expectPlaintext(ebool eValue, bool value, string memory message) public view {
+    expectPlaintext(ebool.unwrap(eValue), value ? 1 : 0, message);
+  }
+
+  /// @notice Asserts that a euint8 exists in mock storage and its plaintext matches the expected value, with a failure message.
+  function expectPlaintext(euint8 eValue, uint8 value, string memory message) public view {
+    expectPlaintext(euint8.unwrap(eValue), uint256(value), message);
+  }
+
+  /// @notice Asserts that a euint16 exists in mock storage and its plaintext matches the expected value, with a failure message.
+  function expectPlaintext(euint16 eValue, uint16 value, string memory message) public view {
+    expectPlaintext(euint16.unwrap(eValue), uint256(value), message);
+  }
+
+  /// @notice Asserts that a euint32 exists in mock storage and its plaintext matches the expected value, with a failure message.
+  function expectPlaintext(euint32 eValue, uint32 value, string memory message) public view {
+    expectPlaintext(euint32.unwrap(eValue), uint256(value), message);
+  }
+
+  /// @notice Asserts that a euint64 exists in mock storage and its plaintext matches the expected value, with a failure message.
+  function expectPlaintext(euint64 eValue, uint64 value, string memory message) public view {
+    expectPlaintext(euint64.unwrap(eValue), uint256(value), message);
+  }
+
+  /// @notice Asserts that a euint128 exists in mock storage and its plaintext matches the expected value, with a failure message.
+  function expectPlaintext(euint128 eValue, uint128 value, string memory message) public view {
+    expectPlaintext(euint128.unwrap(eValue), uint256(value), message);
+  }
+
+  /// @notice Asserts that a eaddress exists in mock storage and its plaintext matches the expected value, with a failure message.
+  function expectPlaintext(eaddress eValue, address value, string memory message) public view {
+    expectPlaintext(eaddress.unwrap(eValue), uint256(uint160(value)), message);
+  }
+}

package/contracts/MockThresholdNetworkSigner.sol

@@ -0,0 +1,24 @@
+// SPDX-License-Identifier: BSD-3-Clause-Clear
+
+pragma solidity >=0.8.19 <0.9.0;
+
+import { Test } from 'forge-std/Test.sol';
+import { DECRYPT_RESULT_SIGNER_PRIVATE_KEY } from '@cofhe/mock-contracts/contracts/MockCoFHE.sol';
+
+/**
+ * @dev Generates valid signatures for decrypt results.
+ * Uses vm.sign to generate the signatures (only available in foundry tests).
+ * Mirrors the SDK's cofheMocksDecryptForTx.ts signing logic:
+ *   keccak256(abi.encodePacked(ctHash, decryptedValue)) signed with DECRYPT_RESULT_SIGNER_PRIVATE_KEY
+ */
+contract MockThresholdNetworkSigner is Test {
+  function signDecryptResult(
+    uint256 ctHash,
+    uint256 decryptedValue
+  ) public pure returns (bytes memory signature) {
+    bytes32 messageHash = keccak256(abi.encodePacked(ctHash, decryptedValue));
+
+    (uint8 v, bytes32 r, bytes32 s) = vm.sign(DECRYPT_RESULT_SIGNER_PRIVATE_KEY, messageHash);
+    signature = abi.encodePacked(r, s, v);
+  }
+}

package/contracts/MockZkVerifierSigner.sol

@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: BSD-3-Clause-Clear
+// solhint-disable one-contract-per-file
+
+pragma solidity >=0.8.19 <0.9.0;
+
+import { console } from 'forge-std/console.sol';
+import { Test } from 'forge-std/Test.sol';
+import { MessageHashUtils } from '@openzeppelin/contracts/utils/cryptography/MessageHashUtils.sol';
+import { EncryptedInput } from '@fhenixprotocol/cofhe-contracts/ICofhe.sol';
+import { ZK_VERIFIER_SIGNER_PRIVATE_KEY } from '@cofhe/mock-contracts/contracts/MockCoFHE.sol';
+
+/**
+ * @dev Generates valid signatures for encrypted inputs.
+ * Uses vm.sign to generate the signatures (only available in foundry tests)
+ * Should not need to be interacted with directly, is part of the `createEncryptedInput` function set
+ */
+contract MockZkVerifierSigner is Test {
+  function zkVerifySignPacked(
+    EncryptedInput[] memory inputs,
+    address sender
+  ) public view returns (EncryptedInput[] memory) {
+    EncryptedInput[] memory signedInputs = new EncryptedInput[](inputs.length);
+    for (uint256 i = 0; i < inputs.length; i++) {
+      signedInputs[i] = zkVerifySign(inputs[i], sender);
+    }
+    return signedInputs;
+  }
+
+  function zkVerifySign(EncryptedInput memory input, address sender) public view returns (EncryptedInput memory) {
+    bytes memory combined = abi.encodePacked(input.ctHash, input.utype, input.securityZone, sender, block.chainid);
+
+    bytes32 expectedHash = keccak256(combined);
+
+    (uint8 v, bytes32 r, bytes32 s) = vm.sign(ZK_VERIFIER_SIGNER_PRIVATE_KEY, expectedHash);
+    bytes memory signature = abi.encodePacked(r, s, v); // note the order here is different from line above.
+
+    input.signature = signature;
+    return input;
+  }
+}

package/foundry.toml

@@ -0,0 +1,17 @@
+[profile.default]
+src = "contracts"
+out = "out"
+libs = ["node_modules", "lib"]
+auto_detect_remappings = false
+remappings = [
+  "forge-std/=node_modules/forge-std/src/",
+  "hardhat/=node_modules/forge-std/src/",
+  "@openzeppelin/contracts/=node_modules/@openzeppelin/contracts/",
+  "@fhenixprotocol/cofhe-contracts/=node_modules/@fhenixprotocol/cofhe-contracts/",
+  "@cofhe/mock-contracts/=node_modules/@cofhe/mock-contracts/"
+]
+
+[lint]
+lint_on_build = false
+
+# See more config options https://github.com/foundry-rs/foundry/blob/master/crates/config/README.md#all-options

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@cofhe/foundry-plugin",
+  "version": "0.0.0-alpha-20260409113701",
+  "description": "Foundry plugin for CoFHE — Write and test FHE enabled contracts",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/FhenixProtocol/cofhesdk.git",
+    "directory": "packages/foundry-plugin"
+  },
+  "files": [
+    "contracts/**/*.sol",
+    "foundry.toml"
+  ],
+  "keywords": [
+    "blockchain",
+    "ethereum",
+    "smart-contracts",
+    "solidity",
+    "FHE",
+    "foundry",
+    "testing",
+    "cofhe",
+    "fhenix"
+  ],
+  "dependencies": {
+    "@fhenixprotocol/cofhe-contracts": "0.1.0",
+    "@openzeppelin/contracts": "^5.0.0",
+    "@cofhe/mock-contracts": "0.0.0-alpha-20260409113701"
+  },
+  "devDependencies": {
+    "forge-std": "github:foundry-rs/forge-std"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "scripts": {
+    "build": "forge build -q",
+    "test": "forge build -q && forge test -vvv",
+    "clean": "rm -rf out && rm -rf cache"
+  }
+}