@cofhe/mock-contracts 0.8.0 → 1.0.0-alpha.0

package/contracts/ACPShareRegistry.sol

@@ -1,8 +1,10 @@
 // SPDX-License-Identifier: MIT
-pragma solidity >=0.8.19 <0.9.0;
+pragma solidity >=0.8.25 <0.9.0;
 
-import { EnumerableSet } from '@openzeppelin/contracts/utils/structs/EnumerableSet.sol';
-import { ACP, IPermissionCustomIdValidator } from './Permissioned.sol';
+import {UUPSUpgradeable} from "@openzeppelin/contracts-upgradeable/proxy/utils/UUPSUpgradeable.sol";
+import {AccessControlUpgradeable} from "@openzeppelin/contracts-upgradeable/access/AccessControlUpgradeable.sol";
+import {EnumerableSet} from "@openzeppelin/contracts/utils/structs/EnumerableSet.sol";
+import {ACP, IPermissionCustomIdValidator} from "./Permissioned.sol";
 
 /**
  * @notice On-chain hand-off for sharing ACPs — replaces the JSON copy-paste flow.
@@ -12,7 +14,15 @@ import { ACP, IPermissionCustomIdValidator } from './Permissioned.sol';
  * are indexed globally per recipient — a share is addressed to a person, and any
  * cofhesdk-enabled app may surface it.
  *
- * The registry stores the payload verbatim and stays deliberately dumb:
+ * Pointer-based: the full ACP and an optional metadata blob travel in the `Shared`
+ * event; storage keeps only the share header — the fields this contract checks
+ * (issuer, recipient, expiration, revoker) and the block of that event — plus the
+ * recipient's set of share ids. A reader takes the header from `sharesFor` / `getShare`
+ * and fetches the event with a `getLogs` over that one block, filtered by the
+ * share id topic. If that block holds several `Shared` events for the share id (it
+ * was removed and posted again within the block), the last one is the share.
+ *
+ * The registry stays deliberately dumb:
  *
  *  - The posted ACP carries `sealingKey = 0` and `recipientSignature = ""` — the
  *    recipient supplies both at import, exactly as in the off-chain flow.
@@ -20,126 +30,229 @@ import { ACP, IPermissionCustomIdValidator } from './Permissioned.sol';
  *    before the recipient signs, and the SDK validates everything at import. The
  *    trust the registry adds is `msg.sender == acp.issuer` — a share listed under
  *    a recipient was genuinely posted by its claimed issuer.
+ *  - The metadata is opaque bytes, never interpreted here (the SDK defines the
+ *    format: labels saying where each ctHash of a SNAPSHOT share came from). It is
+ *    written once, with the share, and cannot be replaced.
  *  - `isShareValid` is the verification hook for other contracts: share exists,
  *    is unexpired, and is not revoked (per the share's own revoker contract).
  *
- * Nothing stored here is sensitive: every field is part of the cleartext share
+ * Nothing posted here is sensitive: every field is part of the cleartext share
  * payload by design. Posting on-chain does make the issuer→recipient sharing
  * relationship public. (A future variant may accept an encrypted payload as a
  * parallel entry type; this registry's cleartext entries would be unaffected.)
- *
- * The production counterpart is upgradeable (OZ AccessControl for the upgrader
- * role) and deployed to a fixed address as core infrastructure.
  */
-contract ACPShareRegistry {
-  using EnumerableSet for EnumerableSet.Bytes32Set;
-
-  /// @notice recipient => ids of shares addressed to them
-  mapping(address => EnumerableSet.Bytes32Set) private _shareIdsFor;
-
-  /// @notice share id => stored payload
-  mapping(bytes32 => ACP) private _shares;
-
-  event Shared(address indexed recipient, address indexed issuer, bytes32 shareId);
-  event ShareRemoved(address indexed recipient, address indexed issuer, bytes32 shareId);
-
-  error NotIssuer();
-  error NotIssuerOrRecipient();
-  error RecipientMissing();
-  error SealingKeyMustBeEmpty();
-  error IssuerSignatureMissing();
-  error ShareExpired();
-  error AlreadyShared();
-  error UnknownShare();
-
-  /// @notice Post a sharing ACP for its recipient to pick up.
-  /// @dev The share id is the hash of the payload — reposting an identical share reverts.
-  function share(ACP calldata acp) external returns (bytes32 shareId) {
-    if (msg.sender != acp.issuer) revert NotIssuer();
-    if (acp.recipient == address(0)) revert RecipientMissing();
-    if (acp.sealingKey != bytes32(0)) revert SealingKeyMustBeEmpty();
-    if (acp.issuerSignature.length == 0) revert IssuerSignatureMissing();
-    if (acp.expiration < block.timestamp) revert ShareExpired();
-
-    shareId = keccak256(abi.encode(acp));
-    // the id commits to the recipient, so a duplicate can only be in this set
-    if (!_shareIdsFor[acp.recipient].add(shareId)) revert AlreadyShared();
-    _shares[shareId] = acp;
-
-    emit Shared(acp.recipient, acp.issuer, shareId);
-  }
-
-  /// @notice Remove a share. The issuer may retract it; the recipient may dismiss it
-  ///         (e.g. after importing, or to decline).
-  function removeShare(bytes32 shareId) external {
-    ACP storage acp = _shares[shareId];
-    if (acp.issuer == address(0)) revert UnknownShare();
-    if (msg.sender != acp.issuer && msg.sender != acp.recipient) revert NotIssuerOrRecipient();
-
-    address recipient = acp.recipient;
-    address issuer = acp.issuer;
-
-    // the id set and the payload map stay in sync — mirror share()'s add() handling
-    if (!_shareIdsFor[recipient].remove(shareId)) revert UnknownShare();
-    delete _shares[shareId];
-
-    emit ShareRemoved(recipient, issuer, shareId);
-  }
-
-  /// @notice All importable shares addressed to `recipient`: unexpired and not revoked.
-  ///         Dead entries stay in storage until removed but are filtered here.
-  function sharesFor(address recipient) external view returns (ACP[] memory acps) {
-    EnumerableSet.Bytes32Set storage ids = _shareIdsFor[recipient];
-    uint256 len = ids.length();
-    if (len == 0) return acps;
-
-    // single pass: allocate for the maximum, fill with valid shares only
-    acps = new ACP[](len);
-    uint256 live = 0;
-    for (uint256 i = 0; i < len; i++) {
-      ACP storage acp = _shares[ids.at(i)];
-      if (_isValid(acp)) {
-        acps[live] = acp;
-        live++;
-      }
+contract ACPShareRegistry is UUPSUpgradeable, AccessControlUpgradeable {
+    using EnumerableSet for EnumerableSet.Bytes32Set;
+
+    /// @notice Role allowed to upgrade the implementation.
+    bytes32 public constant UPGRADER_ROLE = keccak256("UPGRADER_ROLE");
+
+    /// @notice What storage keeps of a share: the fields `removeShare` and the validity
+    ///         check read, and where to find the rest.
+    /// @dev Packed into four slots; the two revoker slots stay zero for a share without
+    ///      a revoker.
+    struct ShareHeader {
+        address issuer;
+        uint64 expiration;
+        address recipient;
+        /// @dev Block of the `Shared` event that carries the full ACP and the metadata
+        ///      (the L2 block on Arbitrum). The last `Shared` event for the share id in that
+        ///      block, should it hold more than one.
+        uint64 blockNumber;
+        address revokerContract;
+        uint256 revokerData;
+    }
+
+    /// @custom:storage-location erc7201:cofhe.storage.ACPShareRegistry.v2
+    struct ACPShareRegistryStorage {
+        /// @dev recipient => ids of shares addressed to them
+        mapping(address => EnumerableSet.Bytes32Set) shareIdsFor;
+        /// @dev share id => stored header
+        mapping(bytes32 => ShareHeader) headers;
+    }
+
+    /// @dev keccak256(abi.encode(uint256(keccak256("cofhe.storage.ACPShareRegistry.v2")) - 1)) & ~bytes32(uint256(0xff))
+    bytes32 private constant ACP_SHARE_REGISTRY_SLOT =
+        keccak256(abi.encode(uint256(keccak256("cofhe.storage.ACPShareRegistry.v2")) - 1)) & ~bytes32(uint256(0xff));
+
+    /// @notice The first version's storage, which kept every share whole. Abandoned by the
+    ///         in-place upgrade: nothing reads it, and its shares are not carried over. Declared
+    ///         only so the namespace stays reserved (the OpenZeppelin layout check requires it).
+    /// @custom:storage-location erc7201:cofhe.storage.ACPShareRegistry
+    struct ACPShareRegistryStorageV1 {
+        /// @dev recipient => ids of shares addressed to them
+        mapping(address => EnumerableSet.Bytes32Set) shareIdsFor;
+        /// @dev share id => stored payload
+        mapping(bytes32 => ACP) shares;
+    }
+
+    /// @notice A share was posted. `acp` is the payload as posted; `metadata` is the opaque
+    ///         blob that came with it (empty when none). The share id is
+    ///         `keccak256(abi.encode(acp))`. A share removed and posted again in the same block
+    ///         emits this twice there with the same id; the later one (higher log index) is
+    ///         the share, and only its `metadata` can differ.
+    event Shared(address indexed recipient, address indexed issuer, bytes32 indexed shareId, ACP acp, bytes metadata);
+    event ShareRemoved(address indexed recipient, address indexed issuer, bytes32 indexed shareId);
+
+    error NotIssuer();
+    error NotIssuerOrRecipient();
+    error RecipientMissing();
+    error SealingKeyMustBeEmpty();
+    error IssuerSignatureMissing();
+    error ShareExpired();
+    error AlreadyShared();
+    error UnknownShare();
+
+    /// @custom:oz-upgrades-unsafe-allow constructor
+    constructor() {
+        _disableInitializers();
     }
 
-    // truncate the memory array's length to the live count (shrink-only)
-    if (live < len) {
-      assembly {
-        mstore(acps, live)
-      }
+    /**
+     * @notice              Initializes the contract.
+     * @param initialAdmin  Receives DEFAULT_ADMIN_ROLE and UPGRADER_ROLE.
+     */
+    function initialize(address initialAdmin) public initializer {
+        __AccessControl_init();
+        _grantRole(DEFAULT_ADMIN_ROLE, initialAdmin);
+        _grantRole(UPGRADER_ROLE, initialAdmin);
     }
-  }
-
-  /// @notice A single share by id (zeroed struct if unknown/removed).
-  function getShare(bytes32 shareId) external view returns (ACP memory) {
-    return _shares[shareId];
-  }
-
-  /// @notice Verification hook for contracts: the share exists, was posted by its
-  ///         claimed issuer (guaranteed at posting), is unexpired, and is not
-  ///         revoked per its own revoker contract.
-  function isShareValid(bytes32 shareId) external view returns (bool) {
-    if (_shares[shareId].issuer == address(0)) return false;
-    return _isValid(_shares[shareId]);
-  }
-
-  /// @dev Unexpired and not revoked. The revoker call mirrors `withPermission`'s
-  ///      revocation clause; a reverting revoker fails closed (share invalid).
-  function _isValid(ACP storage acp) private view returns (bool) {
-    if (acp.expiration < block.timestamp) return false;
-
-    if (acp.revokerData != 0 && acp.revokerContract != address(0)) {
-      try IPermissionCustomIdValidator(acp.revokerContract).disabled(acp.issuer, acp.revokerData) returns (
-        bool disabled
-      ) {
-        if (disabled) return false;
-      } catch {
-        return false;
-      }
+
+    /// @notice Post a sharing ACP for its recipient to pick up, with an optional metadata
+    ///         blob (`""` for none).
+    /// @dev The share id is the hash of the payload — reposting an identical share reverts,
+    ///      whatever its metadata.
+    function share(ACP calldata acp, bytes calldata metadata) external returns (bytes32 shareId) {
+        if (msg.sender != acp.issuer) revert NotIssuer();
+        if (acp.recipient == address(0)) revert RecipientMissing();
+        if (acp.sealingKey != bytes32(0)) revert SealingKeyMustBeEmpty();
+        if (acp.issuerSignature.length == 0) revert IssuerSignatureMissing();
+        if (acp.expiration < block.timestamp) revert ShareExpired();
+
+        ACPShareRegistryStorage storage $ = _getStorage();
+
+        shareId = keccak256(abi.encode(acp));
+        // the id commits to the recipient, so a duplicate can only be in this set
+        if (!$.shareIdsFor[acp.recipient].add(shareId)) revert AlreadyShared();
+        $.headers[shareId] = ShareHeader({
+            issuer: acp.issuer,
+            expiration: acp.expiration,
+            recipient: acp.recipient,
+            blockNumber: uint64(_blockNumber()),
+            revokerContract: acp.revokerContract,
+            revokerData: acp.revokerData
+        });
+
+        emit Shared(acp.recipient, acp.issuer, shareId, acp, metadata);
     }
 
-    return true;
-  }
+    /// @notice Remove a share. The issuer may retract it; the recipient may dismiss it
+    ///         (e.g. after importing, or to decline). The `Shared` event stays in its block;
+    ///         readers go by the header, which is gone.
+    function removeShare(bytes32 shareId) external {
+        ACPShareRegistryStorage storage $ = _getStorage();
+
+        ShareHeader storage header = $.headers[shareId];
+        if (header.issuer == address(0)) revert UnknownShare();
+        if (msg.sender != header.issuer && msg.sender != header.recipient) revert NotIssuerOrRecipient();
+
+        address recipient = header.recipient;
+        address issuer = header.issuer;
+
+        // the id set and the header map stay in sync — mirror share()'s add() handling
+        if (!$.shareIdsFor[recipient].remove(shareId)) revert UnknownShare();
+        delete $.headers[shareId];
+
+        emit ShareRemoved(recipient, issuer, shareId);
+    }
+
+    /// @notice The importable shares addressed to `recipient` — unexpired and not revoked —
+    ///         as their ids and headers, index for index. Dead entries stay in storage until
+    ///         removed but are filtered here.
+    function sharesFor(
+        address recipient
+    ) external view returns (bytes32[] memory shareIds, ShareHeader[] memory headers) {
+        ACPShareRegistryStorage storage $ = _getStorage();
+        EnumerableSet.Bytes32Set storage ids = $.shareIdsFor[recipient];
+        uint256 len = ids.length();
+
+        // single pass: allocate for the maximum, fill with valid shares only
+        shareIds = new bytes32[](len);
+        headers = new ShareHeader[](len);
+        uint256 live = 0;
+        for (uint256 i = 0; i < len; i++) {
+            bytes32 shareId = ids.at(i);
+            ShareHeader storage header = $.headers[shareId];
+            if (_isValid(header)) {
+                shareIds[live] = shareId;
+                headers[live] = header;
+                live++;
+            }
+        }
+
+        // truncate the memory arrays' length to the live count (shrink-only)
+        if (live < len) {
+            assembly {
+                mstore(shareIds, live)
+                mstore(headers, live)
+            }
+        }
+    }
+
+    /// @notice The header of a single share (zeroed struct if unknown/removed).
+    function getShare(bytes32 shareId) external view returns (ShareHeader memory) {
+        return _getStorage().headers[shareId];
+    }
+
+    /// @notice Verification hook for contracts: the share exists, was posted by its
+    ///         claimed issuer (guaranteed at posting), is unexpired, and is not
+    ///         revoked per its own revoker contract.
+    function isShareValid(bytes32 shareId) external view returns (bool) {
+        ShareHeader storage header = _getStorage().headers[shareId];
+        if (header.issuer == address(0)) return false;
+        return _isValid(header);
+    }
+
+    /// @dev Unexpired and not revoked. The revoker call mirrors `withPermission`'s
+    ///      revocation clause; a reverting revoker fails closed (share invalid).
+    function _isValid(ShareHeader storage header) private view returns (bool) {
+        if (header.expiration < block.timestamp) return false;
+
+        if (header.revokerData != 0 && header.revokerContract != address(0)) {
+            try IPermissionCustomIdValidator(header.revokerContract).disabled(header.issuer, header.revokerData) returns (
+                bool disabled
+            ) {
+                if (disabled) return false;
+            } catch {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    /// @dev The number a `getLogs` query takes for the current block. On Arbitrum `block.number`
+    ///      is an L1 block estimate and the L2 block comes from the ArbSys precompile; elsewhere
+    ///      nothing answers at that address and `block.number` is the block.
+    function _blockNumber() private view returns (uint256) {
+        (bool ok, bytes memory result) = address(100).staticcall(abi.encodeWithSignature("arbBlockNumber()"));
+        return ok && result.length == 32 ? abi.decode(result, (uint256)) : block.number;
+    }
+
+    /**
+     * @dev Should revert when `msg.sender` is not authorized to upgrade the contract.
+     *      Empty implementation since authorization is handled by the role check.
+     */
+    /* solhint-disable-next-line no-empty-blocks */
+    function _authorizeUpgrade(address _newImplementation) internal virtual override onlyRole(UPGRADER_ROLE) {}
+
+    /**
+     * @dev Returns the registry storage location.
+     */
+    function _getStorage() internal pure returns (ACPShareRegistryStorage storage $) {
+        bytes32 slot = ACP_SHARE_REGISTRY_SLOT;
+        assembly {
+            $.slot := slot
+        }
+    }
 }

package/contracts/ACPTimestampRevoker.sol

@@ -1,62 +1,64 @@
 // SPDX-License-Identifier: MIT
 pragma solidity >=0.8.19 <0.9.0;
 
-import { IPermissionCustomIdValidator } from './Permissioned.sol';
+import {IPermissionCustomIdValidator} from "./Permissioned.sol";
 
 /**
  * @notice Default ACP revoker — timestamp-based revocation.
  *
  * Implements the unchanged revoker interface. Interprets a permission's
- * `revokerData` as its creation timestamp (populated by the SDK at acp
- * creation). Every SDK-created acp points here by default: no upfront
- * contract call is needed — an ACP is revocable from birth.
+ * `revokerData` as its creation timestamp (populated by the SDK at permission
+ * creation, backdated 60s for clock skew). Every SDK-created permission points
+ * here by default: no upfront contract call is needed — a permission is
+ * revocable from birth.
  *
  * `disabled(issuer, id)` truth table:
  *
  *   | condition                   | result | meaning                          |
  *   |-----------------------------|--------|----------------------------------|
- *   | id > block.timestamp        | true   | future-dated acps never       |
+ *   | id > block.timestamp        | true   | future-dated permissions never   |
  *   |                             |        | validate (closes the revoke-all  |
- *   |                             |        | dodge: an ACP dated ahead of a|
- *   |                             |        | mass revocation would survive it)|
+ *   |                             |        | dodge: a permission dated ahead  |
+ *   |                             |        | of a mass revocation would       |
+ *   |                             |        | otherwise survive it)            |
  *   | id <= revokeAllAt[issuer]   | true   | mass revocation (inclusive)      |
  *   | revokedSingle[issuer][id]   | true   | targeted revocation              |
- *   | otherwise                   | false  | acp valid                     |
+ *   | otherwise                   | false  | permission valid                 |
  *
- * Accepted trade-offs (by design, see ACPV3 spec discussion):
- *  - Two acps minted by the same issuer in the same second share an id;
+ * Accepted trade-offs (by design, see ACP spec discussion):
+ *  - Two permissions minted by the same issuer in the same second share an id;
  *    revoking one revokes both. Over-revocation is the fail-safe direction.
  *  - Revocation is permanent — there is no un-revoke.
  *
- * The production counterpart is upgradeable (OZ AccessControl for the
- * upgrader role) and deployed to a fixed address as core infrastructure.
+ * @dev TODO(review): production wants this upgradeable (OZ AccessControl for the
+ *      upgrader role) and deployed to a fixed address as core infrastructure.
  */
 contract ACPTimestampRevoker is IPermissionCustomIdValidator {
-  /// @notice issuer => threshold; acps with id (creation ts) at or before this are revoked
-  mapping(address => uint256) public revokeAllAt;
+    /// @notice issuer => threshold; permissions with id (creation ts) at or before this are revoked
+    mapping(address => uint256) public revokeAllAt;
 
-  /// @notice issuer => id => revoked
-  mapping(address => mapping(uint256 => bool)) public revokedSingle;
+    /// @notice issuer => id => revoked
+    mapping(address => mapping(uint256 => bool)) public revokedSingle;
 
-  event RevokedSingle(address indexed issuer, uint256 indexed id);
-  event RevokedAll(address indexed issuer, uint256 at);
+    event RevokedSingle(address indexed issuer, uint256 indexed id);
+    event RevokedAll(address indexed issuer, uint256 at);
 
-  /// @notice Revoke a single acp by its id (creation timestamp).
-  ///         Only affects acps issued by the caller.
-  function revokeSingle(uint256 id) external {
-    revokedSingle[msg.sender][id] = true;
-    emit RevokedSingle(msg.sender, id);
-  }
+    /// @notice Revoke a single permission by its id (creation timestamp).
+    ///         Only affects permissions issued by the caller.
+    function revokeSingle(uint256 id) external {
+        revokedSingle[msg.sender][id] = true;
+        emit RevokedSingle(msg.sender, id);
+    }
 
-  /// @notice Revoke every acp the caller created up to now.
-  ///         O(1): a single threshold write, regardless of acp count.
-  function revokeAllExisting() external {
-    revokeAllAt[msg.sender] = block.timestamp;
-    emit RevokedAll(msg.sender, block.timestamp);
-  }
+    /// @notice Revoke every permission the caller created up to now.
+    ///         O(1): a single threshold write, regardless of permission count.
+    function revokeAllExisting() external {
+        revokeAllAt[msg.sender] = block.timestamp;
+        emit RevokedAll(msg.sender, block.timestamp);
+    }
 
-  /// @dev Called by the ACL during permission validation.
-  function disabled(address issuer, uint256 id) external view returns (bool) {
-    return id > block.timestamp || id <= revokeAllAt[issuer] || revokedSingle[issuer][id];
-  }
+    /// @dev Called by the ACL during permission validation.
+    function disabled(address issuer, uint256 id) external view returns (bool) {
+        return id > block.timestamp || id <= revokeAllAt[issuer] || revokedSingle[issuer][id];
+    }
 }

package/contracts/MockACL.sol

@@ -2,7 +2,8 @@
 pragma solidity >=0.8.19 <0.9.0;
 
 import { Strings } from '@openzeppelin/contracts/utils/Strings.sol';
-import { MockPermissioned, ACP, SCOPE_GLOBAL, SCOPE_CONTRACT, SCOPE_HANDLES } from './Permissioned.sol';
+import { ACP, SCOPE_GLOBAL, SCOPE_CONTRACT, SCOPE_HANDLES } from './Permissioned.sol';
+import { MockPermissioned } from './MockPermissioned.sol';
 
 /**
  * @title  ACL

package/contracts/MockCoFHE.sol

@@ -329,8 +329,13 @@ abstract contract MockCoFHE {
       return;
     }
     if (funcId == FunctionId.not) {
-      bool inputIsTruthy = _get(input) == 1;
-      _set(ctHash, !inputIsTruthy);
+      if (getIsBoolTypeFromHash(ctHash)) {
+        bool inputIsTruthy = _get(input) == 1;
+        _set(ctHash, !inputIsTruthy);
+      } else {
+        // bitwise NOT, masked to the type width by _set
+        _set(ctHash, ~_get(input));
+      }
       if (logOps) logOperation('FHE.not', logCtHash(input), logCtHash(ctHash));
       return;
     }
@@ -393,8 +398,14 @@ abstract contract MockCoFHE {
       return;
     }
     if (funcId == FunctionId.rem) {
-      unchecked {
-        _set(ctHash, _get(input1) % _get(input2));
+      // Like TFHE-rs, the remainder by zero returns the first input unchanged
+      uint256 cleartext2 = _get(input2);
+      if (cleartext2 == 0) {
+        _set(ctHash, _get(input1));
+      } else {
+        unchecked {
+          _set(ctHash, _get(input1) % cleartext2);
+        }
       }
       if (logOps) logOperation('FHE.rem', string.concat(logCtHash(input1), ' % ', logCtHash(input2)), logCtHash(ctHash));
       return;
@@ -483,19 +494,32 @@ abstract contract MockCoFHE {
       return;
     }
     if (funcId == FunctionId.rol) {
-      unchecked {
-        _set(ctHash, _get(input1) << _get(input2));
-      }
+      // rotation within the type width, amount modulo the width (TFHE-rs semantics); _set masks the result
+      uint256 bits = getUtypeBits(ctHash);
+      uint256 shift = _get(input2) % bits;
+      uint256 value = _get(input1);
+      _set(ctHash, shift == 0 ? value : (value << shift) | (value >> (bits - shift)));
 
-      if (logOps) logOperation('FHE.rol', string.concat(logCtHash(input1), ' << ', logCtHash(input2)), logCtHash(ctHash));
+      if (logOps)
+        logOperation(
+          'FHE.rol',
+          string.concat('rol(', logCtHash(input1), ', ', logCtHash(input2), ')'),
+          logCtHash(ctHash)
+        );
       return;
     }
     if (funcId == FunctionId.ror) {
-      unchecked {
-        _set(ctHash, _get(input1) >> _get(input2));
-      }
+      uint256 bits = getUtypeBits(ctHash);
+      uint256 shift = _get(input2) % bits;
+      uint256 value = _get(input1);
+      _set(ctHash, shift == 0 ? value : (value >> shift) | (value << (bits - shift)));
 
-      if (logOps) logOperation('FHE.ror', string.concat(logCtHash(input1), ' >> ', logCtHash(input2)), logCtHash(ctHash));
+      if (logOps)
+        logOperation(
+          'FHE.ror',
+          string.concat('ror(', logCtHash(input1), ', ', logCtHash(input2), ')'),
+          logCtHash(ctHash)
+        );
       return;
     }
     revert InvalidTwoInputOperation(Utils.functionIdToString(funcId));

package/contracts/MockERC1967Proxy.sol

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: MIT
+pragma solidity >=0.8.25 <0.9.0;
+
+import { ERC1967Proxy } from '@openzeppelin/contracts/proxy/ERC1967/ERC1967Proxy.sol';
+
+/**
+ * @notice OpenZeppelin's ERC-1967 proxy under a name of its own (no clash with a project's own
+ * `ERC1967Proxy` artifact). The ACP share registry is the production contract, which refuses to
+ * be initialized directly, so the mocks deploy it behind this proxy as production does.
+ */
+contract MockERC1967Proxy is ERC1967Proxy {
+  constructor(address implementation, bytes memory data) payable ERC1967Proxy(implementation, data) {}
+}

package/contracts/MockPermissioned.sol

@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: MIT
+pragma solidity >=0.8.25 <0.9.0;
+
+import { PermissionedUpgradeable } from './Permissioned.sol';
+
+/**
+ * @notice The ACL's ACP checks, taken unchanged from cofhe-contracts (`PermissionedUpgradeable`
+ * in Permissioned.sol), on a contract deployed directly rather than behind a proxy. The EIP-712
+ * domain ("ACL", "2") is defined by code there, so it needs no initialization.
+ */
+contract MockPermissioned is PermissionedUpgradeable {
+  /// @dev Exposed for tests that build typed-data digests.
+  function hashTypedDataV4(bytes32 structHash) public view virtual returns (bytes32) {
+    return _hashTypedDataV4(structHash);
+  }
+}