@cofhe/sdk 0.5.2 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @cofhe/sdk Changelog
 
+## 0.6.1
+
+### Patch Changes
+
+- 670cda8: Prepare an alpha snapshot release.
+
+## 0.6.0
+
+### Minor Changes
+
+- 566f126: Remove the legacy `TestBed` mock surface and stop auto-deploying `SimpleTest` through the Hardhat plugins. Core mock contracts still deploy automatically, while tests that need `SimpleTest` should deploy it explicitly from their own artifacts.
+
+  This also removes `TEST_BED_ADDRESS` and cleans up duplicate `SimpleTest` exports from `@cofhe/mock-contracts`.
+
+### Patch Changes
+
+- bf23270: Upgrade `zustand` to 5.0.13 to pick up the upstream persist storage fix used by the SDK and React package.
+- 2711f9b: Add hash-plus-proof (HPP) support to `EncryptInputsBuilder`.
+
+  Calling `.asHashPlusProof()` on the builder transitions its type parameter to `HPP = true`, causing `.execute()` to return `HashPlusProofResult<T>` — a typed tuple of per-input `External*Hash` values followed by a single `ExternalHashProof`, matching the Solidity `externalEbool` / `externalEuint*` / `externalEaddress` type aliases.
+
+  New public types exported from `@cofhe/sdk`:
+
+  - `ExternalBoolHash`, `ExternalUint8Hash`, `ExternalUint16Hash`, `ExternalUint32Hash`, `ExternalUint64Hash`, `ExternalUint128Hash`, `ExternalAddressHash` — branded `0x${string}` types discriminated by `utype`
+  - `ExternalHashProof` — branded `0x${string}` proof blob
+  - `AnyExternalHash` — union of all `External*Hash` types
+  - `EncryptableToExternalHashMap<E>` — maps a single `EncryptableItem` to its `External*Hash`
+  - `ExternalItemHashes<T>` — maps an `EncryptableItem[]` tuple to the corresponding hash tuple
+  - `HashPlusProofResult<T>` — `[...ExternalItemHashes<T>, ExternalHashProof]`
+
 ## 0.5.2
 
 ### Patch Changes

package/chains/chains/hardhat.ts

@@ -8,8 +8,8 @@ export const hardhat = defineChain({
   name: 'Hardhat',
   network: 'localhost',
   // These are unused in the mock environment
-  coFheUrl: 'http://127.0.0.1:8448',
-  verifierUrl: 'http://127.0.0.1:3001',
-  thresholdNetworkUrl: 'http://127.0.0.1:3000',
+  coFheUrl: 'http://ignored-in-mock-environment',
+  verifierUrl: 'http://ignored-in-mock-environment',
+  thresholdNetworkUrl: 'http://ignored-in-mock-environment',
   environment: 'MOCK',
 });

package/core/consts.ts

@@ -7,9 +7,6 @@ export const MOCKS_ZK_VERIFIER_ADDRESS = '0x000000000000000000000000000000000000
 /** Mock Threshold Network contract address (used for testing) */
 export const MOCKS_THRESHOLD_NETWORK_ADDRESS = '0x0000000000000000000000000000000000005002' as const;
 
-/** Test Bed contract address (used for testing) */
-export const TEST_BED_ADDRESS = '0x0000000000000000000000000000000000005003' as const;
-
 /** Private key for the Mock ZK Verifier signer account */
 export const MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY =
   '0x6C8D7F768A6BB4AAFE85E8A2F5A9680355239C7E14646ED62B044E39DE154512' as const;

package/core/debug.ts

@@ -0,0 +1,72 @@
+// Neutral, opt-in debug interceptors around every low-level SDK network request.
+// Purpose-agnostic: a registered handler can observe, rewrite the URL, mutate the
+// request body/init, replace the response, or throw — enabling fault-injection,
+// logging, latency simulation, endpoint redirection, etc. without any
+// scenario-specific code in the SDK.
+//
+// Nothing is active unless an interceptor is registered (setCofheDebugInterceptors),
+// so this is a no-op in production by default.
+
+export interface CofheRequestContext {
+  /** Coarse label for the call site, e.g. 'decrypt' | 'sealoutput' | 'fetchKeys'. */
+  op: string;
+}
+
+export interface CofheRequestOverride {
+  url?: string;
+  init?: RequestInit;
+}
+
+export type CofheOnRequest = (
+  url: string,
+  init: RequestInit | undefined,
+  ctx: CofheRequestContext
+) => CofheRequestOverride | void | Promise<CofheRequestOverride | void>;
+
+export type CofheOnResponse = (
+  response: Response,
+  ctx: CofheRequestContext
+) => Response | void | Promise<Response | void>;
+
+export interface CofheDebugInterceptors {
+  onRequest?: CofheOnRequest;
+  onResponse?: CofheOnResponse;
+}
+
+const interceptors: CofheDebugInterceptors = {};
+
+/** Register (or clear, with null) the debug interceptors. */
+export function setCofheDebugInterceptors(next: CofheDebugInterceptors | null): void {
+  interceptors.onRequest = next?.onRequest;
+  interceptors.onResponse = next?.onResponse;
+}
+
+export function getCofheDebugInterceptors(): CofheDebugInterceptors {
+  return interceptors;
+}
+
+/**
+ * fetch() wrapper used by all low-level SDK network ops. Applies the registered
+ * debug interceptors when present; otherwise behaves exactly like fetch().
+ */
+export async function cofheFetch(
+  url: string,
+  init?: RequestInit,
+  ctx: CofheRequestContext = { op: 'request' }
+): Promise<Response> {
+  let finalUrl = url;
+  let finalInit = init;
+  if (interceptors.onRequest) {
+    const override = await interceptors.onRequest(finalUrl, finalInit, ctx);
+    if (override) {
+      if (override.url !== undefined) finalUrl = override.url;
+      if (override.init !== undefined) finalInit = override.init;
+    }
+  }
+  let response = await fetch(finalUrl, finalInit);
+  if (interceptors.onResponse) {
+    const replaced = await interceptors.onResponse(response, ctx);
+    if (replaced) response = replaced;
+  }
+  return response;
+}

package/core/decrypt/tnDecryptV2.ts

@@ -1,4 +1,5 @@
 import { type Permission } from '@/permits';
+import { cofheFetch } from '../debug.js';
 
 import { CofheError, CofheErrorCode } from '../error';
 import { type DecryptPollCallbackFunction } from '../types';
@@ -200,13 +201,16 @@ async function submitDecryptRequestV2(
   for (;;) {
     let response: Response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt`, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(body),
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt`,
+        /*op:decrypt*/ {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify(body),
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: CofheErrorCode.DecryptFailed,
@@ -352,12 +356,15 @@ async function pollDecryptStatusV2(
 
     let response: Response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt/${requestId}`, {
-        method: 'GET',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt/${requestId}`,
+        /*op:decrypt-poll*/ {
+          method: 'GET',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: CofheErrorCode.DecryptFailed,

package/core/decrypt/tnSealOutputV2.ts

@@ -1,4 +1,5 @@
 import { type Permission, type EthEncryptedData } from '@/permits';
+import { cofheFetch } from '../debug.js';
 
 import { CofheError, CofheErrorCode } from '../error.js';
 import { type DecryptPollCallbackFunction } from '../types.js';
@@ -150,13 +151,16 @@ async function submitSealOutputRequest(
   for (;;) {
     let response: Response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput`, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(body),
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput`,
+        /*op:sealoutput*/ {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify(body),
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: CofheErrorCode.SealOutputFailed,
@@ -303,12 +307,15 @@ async function pollSealOutputStatus(
 
     let response: Response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput/${requestId}`, {
-        method: 'GET',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput/${requestId}`,
+        /*op:sealoutput-poll*/ {
+          method: 'GET',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: CofheErrorCode.SealOutputFailed,

package/core/encrypt/cofheMocksZkVerifySign.ts

@@ -185,8 +185,8 @@ async function createProofSignatures(
   items: EncryptableItemWithCtHash[],
   securityZone: number,
   account: string
-): Promise<string[]> {
-  let signatures: string[] = [];
+): Promise<`0x${string}`[]> {
+  let signatures: `0x${string}`[] = [];
 
   // Create wallet client for the encrypted input signer
   // This wallet won't send a transaction, so gas isn't needed

package/core/encrypt/encryptInputsBuilder.ts

@@ -16,6 +16,7 @@ import {
   type EncryptedItemInputs,
   type TfheInitializer,
   type EncryptStepCallbackContext,
+  type HashPlusProofResult,
 } from '../types.js';
 import { cofheMocksCheckEncryptableBits, cofheMocksZkVerifySign } from './cofheMocksZkVerifySign.js';
 import { hardhat } from 'viem/chains';
@@ -47,10 +48,11 @@ type EncryptInputsBuilderParams<T extends EncryptableItem[]> = BaseBuilderParams
  * config, tfhePublicKeyDeserializer, compactPkeCrsDeserializer, and zkBuilderAndCrsGenerator are required to be set in the builder.
  */
 
-export class EncryptInputsBuilder<T extends EncryptableItem[]> extends BaseBuilder {
+export class EncryptInputsBuilder<T extends EncryptableItem[], HPP extends boolean = false> extends BaseBuilder {
   private securityZone: number;
   private stepCallback?: EncryptStepCallbackFunction;
   private inputItems: [...T];
+  private hpp: boolean = false;
 
   private zkvWalletClient: WalletClient | undefined;
 
@@ -154,7 +156,7 @@ export class EncryptInputsBuilder<T extends EncryptableItem[]> extends BaseBuild
    *
    * @returns The chainable EncryptInputsBuilder instance.
    */
-  setAccount(account: string): EncryptInputsBuilder<T> {
+  setAccount(account: string): EncryptInputsBuilder<T, HPP> {
     this.account = account;
     return this;
   }
@@ -177,7 +179,7 @@ export class EncryptInputsBuilder<T extends EncryptableItem[]> extends BaseBuild
    *
    * @returns The chainable EncryptInputsBuilder instance.
    */
-  setChainId(chainId: number): EncryptInputsBuilder<T> {
+  setChainId(chainId: number): EncryptInputsBuilder<T, HPP> {
     this.chainId = chainId;
     return this;
   }
@@ -200,7 +202,7 @@ export class EncryptInputsBuilder<T extends EncryptableItem[]> extends BaseBuild
    *
    * @returns The chainable EncryptInputsBuilder instance.
    */
-  setSecurityZone(securityZone: number): EncryptInputsBuilder<T> {
+  setSecurityZone(securityZone: number): EncryptInputsBuilder<T, HPP> {
     this.securityZone = securityZone;
     return this;
   }
@@ -209,6 +211,21 @@ export class EncryptInputsBuilder<T extends EncryptableItem[]> extends BaseBuild
     return this.securityZone;
   }
 
+  /**
+   * Example:
+   * ```typescript
+   * const encrypted = await encryptInputs([Encryptable.uint128(10n)])
+   *   .asHashPlusProof()
+   *   .execute();
+   * ```
+   *
+   * @returns Chainable EncryptInputsBuilder instance that will return a HashPlusProofResult instead of an array of EncryptedItemInputs.
+   */
+  asHashPlusProof(): EncryptInputsBuilder<T, true> {
+    this.hpp = true;
+    return this as unknown as EncryptInputsBuilder<T, true>;
+  }
+
   /**
    * @param useWorker - Whether to use Web Workers for ZK proof generation.
    *
@@ -223,7 +240,7 @@ export class EncryptInputsBuilder<T extends EncryptableItem[]> extends BaseBuild
    *
    * @returns The chainable EncryptInputsBuilder instance.
    */
-  setUseWorker(useWorker: boolean): EncryptInputsBuilder<T> {
+  setUseWorker(useWorker: boolean): EncryptInputsBuilder<T, HPP> {
     this.useWorker = useWorker;
     return this;
   }
@@ -260,7 +277,7 @@ export class EncryptInputsBuilder<T extends EncryptableItem[]> extends BaseBuild
    *
    * @returns The EncryptInputsBuilder instance.
    */
-  onStep(callback: EncryptStepCallbackFunction): EncryptInputsBuilder<T> {
+  onStep(callback: EncryptStepCallbackFunction): EncryptInputsBuilder<T, HPP> {
     this.stepCallback = callback;
     return this;
   }
@@ -541,7 +558,7 @@ export class EncryptInputsBuilder<T extends EncryptableItem[]> extends BaseBuild
     const verifyResults = await zkVerify(zkVerifierUrl, proof, this.account, this.securityZone, this.chainId);
     // Add securityZone and utype to the verify results
     const encryptedInputs: EncryptedItemInput[] = verifyResults.map(
-      ({ ct_hash, signature }: { ct_hash: string; signature: string }, index: number) => ({
+      ({ ct_hash, signature }: { ct_hash: string; signature: `0x${string}` }, index: number) => ({
         ctHash: BigInt(ct_hash),
         securityZone: this.securityZone,
         utype: this.inputItems[index].utype,
@@ -554,6 +571,18 @@ export class EncryptInputsBuilder<T extends EncryptableItem[]> extends BaseBuild
     return encryptedInputs as [...EncryptedItemInputs<T>];
   }
 
+  private structsToHashPlusProof(inItems: [...EncryptedItemInputs<T>]): HashPlusProofResult<T> {
+    let hashes: string[] = [];
+    let proof: string = '';
+
+    for (const item of inItems) {
+      hashes.push('0x' + item.ctHash.toString(16).padStart(64, '0'));
+      proof += item.signature;
+    }
+
+    return [...hashes, proof] as unknown as HashPlusProofResult<T>;
+  }
+
   /**
    * Final step of the encryption process. MUST BE CALLED LAST IN THE CHAIN.
    *
@@ -573,11 +602,17 @@ export class EncryptInputsBuilder<T extends EncryptableItem[]> extends BaseBuild
    *
    * @returns The encrypted inputs.
    */
-  async execute(): Promise<[...EncryptedItemInputs<T>]> {
-    // On hardhat chain, interact with MockZkVerifier contract instead of CoFHE
-    if (this.chainId === hardhat.id) return this.mocksExecute();
+  async execute(): Promise<HPP extends true ? HashPlusProofResult<T> : [...EncryptedItemInputs<T>]> {
+    type Result = HPP extends true ? HashPlusProofResult<T> : [...EncryptedItemInputs<T>];
+
+    let items: [...EncryptedItemInputs<T>];
 
+    // On hardhat chain, interact with MockZkVerifier contract instead of CoFHE
+    if (this.chainId === hardhat.id) items = await this.mocksExecute();
     // On other chains, interact with CoFHE coprocessor
-    return this.productionExecute();
+    else items = await this.productionExecute();
+
+    if (this.hpp) return this.structsToHashPlusProof(items) as unknown as Result;
+    return items as unknown as Result;
   }
 }

package/core/encrypt/zkPackProveVerify.ts

@@ -49,7 +49,7 @@ export type VerifyResultRaw = {
 
 export type VerifyResult = {
   ct_hash: string;
-  signature: string;
+  signature: `0x${string}`;
 };
 
 export type ZkProvenCiphertextList = {
@@ -321,6 +321,6 @@ export const zkVerify = async (
   }
 };
 
-const concatSigRecid = (signature: string, recid: number): string => {
-  return signature + (recid + 27).toString(16).padStart(2, '0');
+const concatSigRecid = (signature: string, recid: number): `0x${string}` => {
+  return `${signature}${(recid + 27).toString(16).padStart(2, '0')}` as `0x${string}`;
 };

package/core/index.ts

@@ -1,6 +1,16 @@
 // Client (base implementations)
 export { createCofheClientBase, InitialConnectStore as CONNECT_STORE_DEFAULTS } from './client.js';
 
+// Debug interceptors (neutral, opt-in network hooks for fault injection / logging)
+export { setCofheDebugInterceptors, getCofheDebugInterceptors, cofheFetch } from './debug.js';
+export type {
+  CofheDebugInterceptors,
+  CofheOnRequest,
+  CofheOnResponse,
+  CofheRequestContext,
+  CofheRequestOverride,
+} from './debug.js';
+
 // Configuration (base implementations)
 export { createCofheConfigBase, getCofheConfigItem } from './config.js';
 export type { CofheConfig, CofheInputConfig, CofheInternalConfig } from './config.js';
@@ -41,6 +51,19 @@ export type {
   EncryptedItemInputs,
   EncryptableToEncryptedItemInputMap,
   FheTypeValue,
+  // Hash-plus-proof external types
+  ExternalBoolHash,
+  ExternalUint8Hash,
+  ExternalUint16Hash,
+  ExternalUint32Hash,
+  ExternalUint64Hash,
+  ExternalUint128Hash,
+  ExternalAddressHash,
+  ExternalHashProof,
+  AnyExternalHash,
+  EncryptableToExternalHashMap,
+  ExternalItemHashes,
+  HashPlusProofResult,
   // Decryption types
   UnsealedItem,
   DecryptPollCallbackFunction,
@@ -96,7 +119,6 @@ export {
   MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY,
   MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY,
   MOCKS_THRESHOLD_NETWORK_ADDRESS,
-  TEST_BED_ADDRESS,
   TFHE_RS_ZK_MAX_BITS,
   TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT,
 } from './consts.js';

package/core/permits.ts

@@ -112,13 +112,18 @@ const selectActivePermit = (chainId: number, account: string, hash: string): voi
 // GET OR CREATE
 
 /**
- * Get the active self permit or create a new one if it doesn't exist
+ * Get the active self permit if a valid one exists, otherwise create a new one.
+ *
+ * An active permit is reused only when it is a self permit and is still valid
+ * (signed and not expired). An expired or otherwise invalid active permit is
+ * treated as missing and a fresh permit is created.
+ *
  * @param publicClient - The public client
  * @param walletClient - The wallet client
  * @param chainId - Optional chain ID (will use publicClient if not provided)
  * @param account - Optional account (will use walletClient if not provided)
  * @param options - The options for creating a self permit
- * @returns The existing or newly created permit
+ * @returns The existing valid permit or a newly created one
  */
 const getOrCreateSelfPermit = async (
   publicClient: PublicClient,
@@ -133,22 +138,27 @@ const getOrCreateSelfPermit = async (
   // Try to get active permit first
   const activePermit = await getActivePermit(_chainId, _account);
 
-  if (activePermit && activePermit.type === 'self') {
+  if (activePermit && activePermit.type === 'self' && PermitUtils.isValid(activePermit).valid) {
     return activePermit;
   }
 
-  // No active permit or wrong type, create new one
+  // No active permit, wrong type, or expired/invalid - create new one
   return createSelf(options ?? { issuer: _account, name: 'Autogenerated Self Permit' }, publicClient, walletClient);
 };
 
 /**
- * Get the active sharing permit or create a new one if it doesn't exist
+ * Get the active sharing permit if a valid one exists, otherwise create a new one.
+ *
+ * An active permit is reused only when it is a sharing permit and is still valid
+ * (signed and not expired). An expired or otherwise invalid active permit is
+ * treated as missing and a fresh permit is created.
+ *
  * @param publicClient - The public client
  * @param walletClient - The wallet client
  * @param options - The options for creating a sharing permit (required)
  * @param chainId - Optional chain ID (will use publicClient if not provided)
  * @param account - Optional account (will use walletClient if not provided)
- * @returns The existing or newly created permit
+ * @returns The existing valid permit or a newly created one
  */
 const getOrCreateSharingPermit = async (
   publicClient: PublicClient,
@@ -163,7 +173,7 @@ const getOrCreateSharingPermit = async (
   // Try to get active permit first
   const activePermit = await getActivePermit(_chainId, _account);
 
-  if (activePermit && activePermit.type === 'sharing') {
+  if (activePermit && activePermit.type === 'sharing' && PermitUtils.isValid(activePermit).valid) {
     return activePermit;
   }
 

package/core/test/encryptInputsBuilder.test.ts

@@ -744,6 +744,41 @@ describe('EncryptInputsBuilder', () => {
     });
   });
 
+  describe('asHashPlusProof', () => {
+    it('should return the same builder instance for chaining', () => {
+      expect(builder.asHashPlusProof()).toBe(builder);
+    });
+
+    it('execute() returns [hash, proof] for a single input', async () => {
+      const result = await builder.asHashPlusProof().execute();
+      expect(Array.isArray(result)).toBe(true);
+      expect(result).toHaveLength(2); // 1 hash + 1 proof
+    });
+
+    it('execute() returns [hash1, hash2, proof] for two inputs', async () => {
+      const result = await new EncryptInputsBuilder({
+        ...createDefaultParams(),
+        inputs: [Encryptable.uint128(100n), Encryptable.bool(true)] as [
+          ReturnType<typeof Encryptable.uint128>,
+          ReturnType<typeof Encryptable.bool>,
+        ],
+      })
+        .asHashPlusProof()
+        .execute();
+
+      expect(Array.isArray(result)).toBe(true);
+      expect(result).toHaveLength(3); // 2 hashes + 1 proof
+    });
+
+    it('should be composable with other builder methods', async () => {
+      const overriddenSender = '0x5555555555555555555555555555555555555555';
+      const result = await builder.asHashPlusProof().setAccount(overriddenSender).execute();
+
+      expect(Array.isArray(result)).toBe(true);
+      expect(result).toHaveLength(2);
+    });
+  });
+
   describe('setUseWorker and getUseWorker', () => {
     it('should have setUseWorker method', () => {
       expect(builder).toHaveProperty('setUseWorker');

package/core/test/permits.test.ts

@@ -304,6 +304,33 @@ describe('Core Permits Tests', () => {
       expect(Object.keys(allPermits).length).toBe(2);
     });
 
+    it('should create a new self permit when active permit is expired', async () => {
+      // Create an expired self permit (expiration in the past)
+      const expiredPermit = await permits.createSelf(
+        { name: 'Expired Self Permit', issuer: bobAddress, expiration: Math.floor(Date.now() / 1000) - 3600 },
+        publicClient,
+        bobWalletClient
+      );
+
+      // Sanity check - it is the active permit and is expired
+      const activeBefore = await permits.getActivePermit(chainId, bobAddress);
+      expect(activeBefore?.hash).toBe(expiredPermit.hash);
+
+      // getOrCreateSelfPermit should treat the expired permit as missing and create a fresh one
+      const permit = await permits.getOrCreateSelfPermit(publicClient, bobWalletClient, chainId, bobAddress, {
+        issuer: bobAddress,
+        name: 'Fresh Self Permit',
+      });
+
+      expect(permit.name).toBe('Fresh Self Permit');
+      expect(permit.type).toBe('self');
+      expect(permit.hash).not.toBe(expiredPermit.hash);
+
+      // The fresh permit should now be active
+      const activeAfter = await permits.getActivePermit(chainId, bobAddress);
+      expect(activeAfter?.hash).toBe(permit.hash);
+    });
+
     it('should use default options when none provided', async () => {
       const permit = await permits.getOrCreateSelfPermit(publicClient, bobWalletClient, chainId, bobAddress);
 
@@ -412,6 +439,41 @@ describe('Core Permits Tests', () => {
       expect(Object.keys(allPermits).length).toBe(2);
     });
 
+    it('should create a new sharing permit when active permit is expired', async () => {
+      // Create an expired sharing permit (expiration in the past)
+      const expiredPermit = await permits.createSharing(
+        {
+          name: 'Expired Sharing Permit',
+          issuer: bobAddress,
+          recipient: aliceAddress,
+          expiration: Math.floor(Date.now() / 1000) - 3600,
+        },
+        publicClient,
+        bobWalletClient
+      );
+
+      // getOrCreateSharingPermit should treat the expired permit as missing and create a fresh one
+      const permit = await permits.getOrCreateSharingPermit(
+        publicClient,
+        bobWalletClient,
+        {
+          issuer: bobAddress,
+          recipient: aliceAddress,
+          name: 'Fresh Sharing Permit',
+        },
+        chainId,
+        bobAddress
+      );
+
+      expect(permit.name).toBe('Fresh Sharing Permit');
+      expect(permit.type).toBe('sharing');
+      expect(permit.hash).not.toBe(expiredPermit.hash);
+
+      // The fresh permit should now be active
+      const activeAfter = await permits.getActivePermit(chainId, bobAddress);
+      expect(activeAfter?.hash).toBe(permit.hash);
+    });
+
     it('should use default chainId and account when not provided', async () => {
       const permit = await permits.getOrCreateSharingPermit(
         publicClient,