@cofhe/sdk 0.6.0 → 0.6.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @cofhe/sdk Changelog
 
+## 0.6.1
+
+### Patch Changes
+
+- 670cda8: Prepare an alpha snapshot release.
+
 ## 0.6.0
 
 ### Minor Changes

package/core/debug.ts

@@ -0,0 +1,72 @@
+// Neutral, opt-in debug interceptors around every low-level SDK network request.
+// Purpose-agnostic: a registered handler can observe, rewrite the URL, mutate the
+// request body/init, replace the response, or throw — enabling fault-injection,
+// logging, latency simulation, endpoint redirection, etc. without any
+// scenario-specific code in the SDK.
+//
+// Nothing is active unless an interceptor is registered (setCofheDebugInterceptors),
+// so this is a no-op in production by default.
+
+export interface CofheRequestContext {
+  /** Coarse label for the call site, e.g. 'decrypt' | 'sealoutput' | 'fetchKeys'. */
+  op: string;
+}
+
+export interface CofheRequestOverride {
+  url?: string;
+  init?: RequestInit;
+}
+
+export type CofheOnRequest = (
+  url: string,
+  init: RequestInit | undefined,
+  ctx: CofheRequestContext
+) => CofheRequestOverride | void | Promise<CofheRequestOverride | void>;
+
+export type CofheOnResponse = (
+  response: Response,
+  ctx: CofheRequestContext
+) => Response | void | Promise<Response | void>;
+
+export interface CofheDebugInterceptors {
+  onRequest?: CofheOnRequest;
+  onResponse?: CofheOnResponse;
+}
+
+const interceptors: CofheDebugInterceptors = {};
+
+/** Register (or clear, with null) the debug interceptors. */
+export function setCofheDebugInterceptors(next: CofheDebugInterceptors | null): void {
+  interceptors.onRequest = next?.onRequest;
+  interceptors.onResponse = next?.onResponse;
+}
+
+export function getCofheDebugInterceptors(): CofheDebugInterceptors {
+  return interceptors;
+}
+
+/**
+ * fetch() wrapper used by all low-level SDK network ops. Applies the registered
+ * debug interceptors when present; otherwise behaves exactly like fetch().
+ */
+export async function cofheFetch(
+  url: string,
+  init?: RequestInit,
+  ctx: CofheRequestContext = { op: 'request' }
+): Promise<Response> {
+  let finalUrl = url;
+  let finalInit = init;
+  if (interceptors.onRequest) {
+    const override = await interceptors.onRequest(finalUrl, finalInit, ctx);
+    if (override) {
+      if (override.url !== undefined) finalUrl = override.url;
+      if (override.init !== undefined) finalInit = override.init;
+    }
+  }
+  let response = await fetch(finalUrl, finalInit);
+  if (interceptors.onResponse) {
+    const replaced = await interceptors.onResponse(response, ctx);
+    if (replaced) response = replaced;
+  }
+  return response;
+}

package/core/decrypt/tnDecryptV2.ts

@@ -1,4 +1,5 @@
 import { type Permission } from '@/permits';
+import { cofheFetch } from '../debug.js';
 
 import { CofheError, CofheErrorCode } from '../error';
 import { type DecryptPollCallbackFunction } from '../types';
@@ -200,13 +201,16 @@ async function submitDecryptRequestV2(
   for (;;) {
     let response: Response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt`, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(body),
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt`,
+        /*op:decrypt*/ {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify(body),
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: CofheErrorCode.DecryptFailed,
@@ -352,12 +356,15 @@ async function pollDecryptStatusV2(
 
     let response: Response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt/${requestId}`, {
-        method: 'GET',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt/${requestId}`,
+        /*op:decrypt-poll*/ {
+          method: 'GET',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: CofheErrorCode.DecryptFailed,

package/core/decrypt/tnSealOutputV2.ts

@@ -1,4 +1,5 @@
 import { type Permission, type EthEncryptedData } from '@/permits';
+import { cofheFetch } from '../debug.js';
 
 import { CofheError, CofheErrorCode } from '../error.js';
 import { type DecryptPollCallbackFunction } from '../types.js';
@@ -150,13 +151,16 @@ async function submitSealOutputRequest(
   for (;;) {
     let response: Response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput`, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(body),
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput`,
+        /*op:sealoutput*/ {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify(body),
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: CofheErrorCode.SealOutputFailed,
@@ -303,12 +307,15 @@ async function pollSealOutputStatus(
 
     let response: Response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput/${requestId}`, {
-        method: 'GET',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput/${requestId}`,
+        /*op:sealoutput-poll*/ {
+          method: 'GET',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: CofheErrorCode.SealOutputFailed,

package/core/index.ts

@@ -1,6 +1,16 @@
 // Client (base implementations)
 export { createCofheClientBase, InitialConnectStore as CONNECT_STORE_DEFAULTS } from './client.js';
 
+// Debug interceptors (neutral, opt-in network hooks for fault injection / logging)
+export { setCofheDebugInterceptors, getCofheDebugInterceptors, cofheFetch } from './debug.js';
+export type {
+  CofheDebugInterceptors,
+  CofheOnRequest,
+  CofheOnResponse,
+  CofheRequestContext,
+  CofheRequestOverride,
+} from './debug.js';
+
 // Configuration (base implementations)
 export { createCofheConfigBase, getCofheConfigItem } from './config.js';
 export type { CofheConfig, CofheInputConfig, CofheInternalConfig } from './config.js';

package/core/permits.ts

@@ -112,13 +112,18 @@ const selectActivePermit = (chainId: number, account: string, hash: string): voi
 // GET OR CREATE
 
 /**
- * Get the active self permit or create a new one if it doesn't exist
+ * Get the active self permit if a valid one exists, otherwise create a new one.
+ *
+ * An active permit is reused only when it is a self permit and is still valid
+ * (signed and not expired). An expired or otherwise invalid active permit is
+ * treated as missing and a fresh permit is created.
+ *
  * @param publicClient - The public client
  * @param walletClient - The wallet client
  * @param chainId - Optional chain ID (will use publicClient if not provided)
  * @param account - Optional account (will use walletClient if not provided)
  * @param options - The options for creating a self permit
- * @returns The existing or newly created permit
+ * @returns The existing valid permit or a newly created one
  */
 const getOrCreateSelfPermit = async (
   publicClient: PublicClient,
@@ -133,22 +138,27 @@ const getOrCreateSelfPermit = async (
   // Try to get active permit first
   const activePermit = await getActivePermit(_chainId, _account);
 
-  if (activePermit && activePermit.type === 'self') {
+  if (activePermit && activePermit.type === 'self' && PermitUtils.isValid(activePermit).valid) {
     return activePermit;
   }
 
-  // No active permit or wrong type, create new one
+  // No active permit, wrong type, or expired/invalid - create new one
   return createSelf(options ?? { issuer: _account, name: 'Autogenerated Self Permit' }, publicClient, walletClient);
 };
 
 /**
- * Get the active sharing permit or create a new one if it doesn't exist
+ * Get the active sharing permit if a valid one exists, otherwise create a new one.
+ *
+ * An active permit is reused only when it is a sharing permit and is still valid
+ * (signed and not expired). An expired or otherwise invalid active permit is
+ * treated as missing and a fresh permit is created.
+ *
  * @param publicClient - The public client
  * @param walletClient - The wallet client
  * @param options - The options for creating a sharing permit (required)
  * @param chainId - Optional chain ID (will use publicClient if not provided)
  * @param account - Optional account (will use walletClient if not provided)
- * @returns The existing or newly created permit
+ * @returns The existing valid permit or a newly created one
  */
 const getOrCreateSharingPermit = async (
   publicClient: PublicClient,
@@ -163,7 +173,7 @@ const getOrCreateSharingPermit = async (
   // Try to get active permit first
   const activePermit = await getActivePermit(_chainId, _account);
 
-  if (activePermit && activePermit.type === 'sharing') {
+  if (activePermit && activePermit.type === 'sharing' && PermitUtils.isValid(activePermit).valid) {
     return activePermit;
   }
 

package/core/test/permits.test.ts

@@ -304,6 +304,33 @@ describe('Core Permits Tests', () => {
       expect(Object.keys(allPermits).length).toBe(2);
     });
 
+    it('should create a new self permit when active permit is expired', async () => {
+      // Create an expired self permit (expiration in the past)
+      const expiredPermit = await permits.createSelf(
+        { name: 'Expired Self Permit', issuer: bobAddress, expiration: Math.floor(Date.now() / 1000) - 3600 },
+        publicClient,
+        bobWalletClient
+      );
+
+      // Sanity check - it is the active permit and is expired
+      const activeBefore = await permits.getActivePermit(chainId, bobAddress);
+      expect(activeBefore?.hash).toBe(expiredPermit.hash);
+
+      // getOrCreateSelfPermit should treat the expired permit as missing and create a fresh one
+      const permit = await permits.getOrCreateSelfPermit(publicClient, bobWalletClient, chainId, bobAddress, {
+        issuer: bobAddress,
+        name: 'Fresh Self Permit',
+      });
+
+      expect(permit.name).toBe('Fresh Self Permit');
+      expect(permit.type).toBe('self');
+      expect(permit.hash).not.toBe(expiredPermit.hash);
+
+      // The fresh permit should now be active
+      const activeAfter = await permits.getActivePermit(chainId, bobAddress);
+      expect(activeAfter?.hash).toBe(permit.hash);
+    });
+
     it('should use default options when none provided', async () => {
       const permit = await permits.getOrCreateSelfPermit(publicClient, bobWalletClient, chainId, bobAddress);
 
@@ -412,6 +439,41 @@ describe('Core Permits Tests', () => {
       expect(Object.keys(allPermits).length).toBe(2);
     });
 
+    it('should create a new sharing permit when active permit is expired', async () => {
+      // Create an expired sharing permit (expiration in the past)
+      const expiredPermit = await permits.createSharing(
+        {
+          name: 'Expired Sharing Permit',
+          issuer: bobAddress,
+          recipient: aliceAddress,
+          expiration: Math.floor(Date.now() / 1000) - 3600,
+        },
+        publicClient,
+        bobWalletClient
+      );
+
+      // getOrCreateSharingPermit should treat the expired permit as missing and create a fresh one
+      const permit = await permits.getOrCreateSharingPermit(
+        publicClient,
+        bobWalletClient,
+        {
+          issuer: bobAddress,
+          recipient: aliceAddress,
+          name: 'Fresh Sharing Permit',
+        },
+        chainId,
+        bobAddress
+      );
+
+      expect(permit.name).toBe('Fresh Sharing Permit');
+      expect(permit.type).toBe('sharing');
+      expect(permit.hash).not.toBe(expiredPermit.hash);
+
+      // The fresh permit should now be active
+      const activeAfter = await permits.getActivePermit(chainId, bobAddress);
+      expect(activeAfter?.hash).toBe(permit.hash);
+    });
+
     it('should use default chainId and account when not provided', async () => {
       const permit = await permits.getOrCreateSharingPermit(
         publicClient,

package/dist/{chunk-PE5V5CCV.js → chunk-NOC3PYB7.js}

@@ -1730,7 +1730,7 @@ var getOrCreateSelfPermit = async (publicClient, walletClient, chainId, account,
   const _chainId = chainId ?? await publicClient.getChainId();
   const _account = account ?? walletClient.account.address;
   const activePermit = await getActivePermit(_chainId, _account);
-  if (activePermit && activePermit.type === "self") {
+  if (activePermit && activePermit.type === "self" && PermitUtils.isValid(activePermit).valid) {
     return activePermit;
   }
   return createSelf(options ?? { issuer: _account, name: "Autogenerated Self Permit" }, publicClient, walletClient);
@@ -1739,7 +1739,7 @@ var getOrCreateSharingPermit = async (publicClient, walletClient, options, chain
   const _chainId = chainId ?? await publicClient.getChainId();
   const _account = account ?? walletClient.account.address;
   const activePermit = await getActivePermit(_chainId, _account);
-  if (activePermit && activePermit.type === "sharing") {
+  if (activePermit && activePermit.type === "sharing" && PermitUtils.isValid(activePermit).valid) {
     return activePermit;
   }
   return createSharing(options, publicClient, walletClient);
@@ -1998,6 +1998,36 @@ async function cofheMocksDecryptForView(ctHash, utype, permit, publicClient) {
   return unsealed;
 }
 
+// core/debug.ts
+var interceptors = {};
+function setCofheDebugInterceptors(next) {
+  interceptors.onRequest = next?.onRequest;
+  interceptors.onResponse = next?.onResponse;
+}
+function getCofheDebugInterceptors() {
+  return interceptors;
+}
+async function cofheFetch(url, init, ctx = { op: "request" }) {
+  let finalUrl = url;
+  let finalInit = init;
+  if (interceptors.onRequest) {
+    const override = await interceptors.onRequest(finalUrl, finalInit, ctx);
+    if (override) {
+      if (override.url !== void 0)
+        finalUrl = override.url;
+      if (override.init !== void 0)
+        finalInit = override.init;
+    }
+  }
+  let response = await fetch(finalUrl, finalInit);
+  if (interceptors.onResponse) {
+    const replaced = await interceptors.onResponse(response, ctx);
+    if (replaced)
+      response = replaced;
+  }
+  return response;
+}
+
 // core/decrypt/polling.ts
 function computeMinuteRampPollIntervalMs(elapsedMs, params) {
   const elapsedSeconds = Math.floor(elapsedMs / 1e3);
@@ -2167,13 +2197,17 @@ async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, per
   for (; ; ) {
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput`,
+        /*op:sealoutput*/
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
@@ -2296,12 +2330,16 @@ async function pollSealOutputStatus(thresholdNetworkUrl, requestId, overallStart
     }
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput/${requestId}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json"
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput/${requestId}`,
+        /*op:sealoutput-poll*/
+        {
+          method: "GET",
+          headers: {
+            "Content-Type": "application/json"
+          }
         }
-      });
+      );
     } catch (e) {
       throw new CofheError({
         code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
@@ -2898,13 +2936,17 @@ async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, perm
   for (; ; ) {
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt`,
+        /*op:decrypt*/
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: "DECRYPT_FAILED" /* DecryptFailed */,
@@ -3029,12 +3071,16 @@ async function pollDecryptStatusV2(thresholdNetworkUrl, requestId, overallStartT
     }
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt/${requestId}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json"
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt/${requestId}`,
+        /*op:decrypt-poll*/
+        {
+          method: "GET",
+          headers: {
+            "Content-Type": "application/json"
+          }
         }
-      });
+      );
     } catch (e) {
       throw new CofheError({
         code: "DECRYPT_FAILED" /* DecryptFailed */,
@@ -3633,4 +3679,4 @@ function createCofheClientBase(opts) {
   };
 }
 
-export { CofheError, CofheErrorCode, DecryptForTxBuilder, DecryptForViewBuilder, EncryptInputsBuilder, EncryptStep, Encryptable, FheAllUTypes, FheTypes, FheUintUTypes, InitialConnectStore, assertCorrectEncryptedItemInput, createCofheClientBase, createCofheConfigBase, createKeysStore, fetchKeys, fheTypeToString, getCofheConfigItem, isCofheError, isEncryptableItem, isLastEncryptionStep, verifyDecryptResult, zkProveWithWorker };
+export { CofheError, CofheErrorCode, DecryptForTxBuilder, DecryptForViewBuilder, EncryptInputsBuilder, EncryptStep, Encryptable, FheAllUTypes, FheTypes, FheUintUTypes, InitialConnectStore, assertCorrectEncryptedItemInput, cofheFetch, createCofheClientBase, createCofheConfigBase, createKeysStore, fetchKeys, fheTypeToString, getCofheConfigItem, getCofheDebugInterceptors, isCofheError, isEncryptableItem, isLastEncryptionStep, setCofheDebugInterceptors, verifyDecryptResult, zkProveWithWorker };

package/dist/core.cjs

@@ -2752,7 +2752,7 @@ var getOrCreateSelfPermit = async (publicClient, walletClient, chainId, account,
   const _chainId = chainId ?? await publicClient.getChainId();
   const _account = account ?? walletClient.account.address;
   const activePermit = await getActivePermit2(_chainId, _account);
-  if (activePermit && activePermit.type === "self") {
+  if (activePermit && activePermit.type === "self" && PermitUtils.isValid(activePermit).valid) {
     return activePermit;
   }
   return createSelf(options ?? { issuer: _account, name: "Autogenerated Self Permit" }, publicClient, walletClient);
@@ -2761,7 +2761,7 @@ var getOrCreateSharingPermit = async (publicClient, walletClient, options, chain
   const _chainId = chainId ?? await publicClient.getChainId();
   const _account = account ?? walletClient.account.address;
   const activePermit = await getActivePermit2(_chainId, _account);
-  if (activePermit && activePermit.type === "sharing") {
+  if (activePermit && activePermit.type === "sharing" && PermitUtils.isValid(activePermit).valid) {
     return activePermit;
   }
   return createSharing(options, publicClient, walletClient);
@@ -3020,6 +3020,36 @@ async function cofheMocksDecryptForView(ctHash, utype, permit, publicClient) {
   return unsealed;
 }
 
+// core/debug.ts
+var interceptors = {};
+function setCofheDebugInterceptors(next) {
+  interceptors.onRequest = next?.onRequest;
+  interceptors.onResponse = next?.onResponse;
+}
+function getCofheDebugInterceptors() {
+  return interceptors;
+}
+async function cofheFetch(url, init, ctx = { op: "request" }) {
+  let finalUrl = url;
+  let finalInit = init;
+  if (interceptors.onRequest) {
+    const override = await interceptors.onRequest(finalUrl, finalInit, ctx);
+    if (override) {
+      if (override.url !== void 0)
+        finalUrl = override.url;
+      if (override.init !== void 0)
+        finalInit = override.init;
+    }
+  }
+  let response = await fetch(finalUrl, finalInit);
+  if (interceptors.onResponse) {
+    const replaced = await interceptors.onResponse(response, ctx);
+    if (replaced)
+      response = replaced;
+  }
+  return response;
+}
+
 // core/decrypt/polling.ts
 function computeMinuteRampPollIntervalMs(elapsedMs, params) {
   const elapsedSeconds = Math.floor(elapsedMs / 1e3);
@@ -3189,13 +3219,17 @@ async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, per
   for (; ; ) {
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput`,
+        /*op:sealoutput*/
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
@@ -3318,12 +3352,16 @@ async function pollSealOutputStatus(thresholdNetworkUrl, requestId, overallStart
     }
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput/${requestId}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json"
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput/${requestId}`,
+        /*op:sealoutput-poll*/
+        {
+          method: "GET",
+          headers: {
+            "Content-Type": "application/json"
+          }
         }
-      });
+      );
     } catch (e) {
       throw new CofheError({
         code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
@@ -3920,13 +3958,17 @@ async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, perm
   for (; ; ) {
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt`,
+        /*op:decrypt*/
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: "DECRYPT_FAILED" /* DecryptFailed */,
@@ -4051,12 +4093,16 @@ async function pollDecryptStatusV2(thresholdNetworkUrl, requestId, overallStartT
     }
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt/${requestId}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json"
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt/${requestId}`,
+        /*op:decrypt-poll*/
+        {
+          method: "GET",
+          headers: {
+            "Content-Type": "application/json"
+          }
         }
-      });
+      );
     } catch (e) {
       throw new CofheError({
         code: "DECRYPT_FAILED" /* DecryptFailed */,
@@ -4675,14 +4721,17 @@ exports.TASK_MANAGER_ADDRESS = TASK_MANAGER_ADDRESS;
 exports.TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT = TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT;
 exports.TFHE_RS_ZK_MAX_BITS = TFHE_RS_ZK_MAX_BITS;
 exports.assertCorrectEncryptedItemInput = assertCorrectEncryptedItemInput;
+exports.cofheFetch = cofheFetch;
 exports.createCofheClientBase = createCofheClientBase;
 exports.createCofheConfigBase = createCofheConfigBase;
 exports.createKeysStore = createKeysStore;
 exports.fetchKeys = fetchKeys;
 exports.fheTypeToString = fheTypeToString;
 exports.getCofheConfigItem = getCofheConfigItem;
+exports.getCofheDebugInterceptors = getCofheDebugInterceptors;
 exports.isCofheError = isCofheError;
 exports.isEncryptableItem = isEncryptableItem;
 exports.isLastEncryptionStep = isLastEncryptionStep;
+exports.setCofheDebugInterceptors = setCofheDebugInterceptors;
 exports.verifyDecryptResult = verifyDecryptResult;
 exports.zkProveWithWorker = zkProveWithWorker;

package/dist/core.d.cts

@@ -14,6 +14,29 @@ declare const InitialConnectStore: CofheClientConnectionState;
  */
 declare function createCofheClientBase<TConfig extends CofheConfig>(opts: CofheClientParams<TConfig>): CofheClient<TConfig>;
 
+interface CofheRequestContext {
+    /** Coarse label for the call site, e.g. 'decrypt' | 'sealoutput' | 'fetchKeys'. */
+    op: string;
+}
+interface CofheRequestOverride {
+    url?: string;
+    init?: RequestInit;
+}
+type CofheOnRequest = (url: string, init: RequestInit | undefined, ctx: CofheRequestContext) => CofheRequestOverride | void | Promise<CofheRequestOverride | void>;
+type CofheOnResponse = (response: Response, ctx: CofheRequestContext) => Response | void | Promise<Response | void>;
+interface CofheDebugInterceptors {
+    onRequest?: CofheOnRequest;
+    onResponse?: CofheOnResponse;
+}
+/** Register (or clear, with null) the debug interceptors. */
+declare function setCofheDebugInterceptors(next: CofheDebugInterceptors | null): void;
+declare function getCofheDebugInterceptors(): CofheDebugInterceptors;
+/**
+ * fetch() wrapper used by all low-level SDK network ops. Applies the registered
+ * debug interceptors when present; otherwise behaves exactly like fetch().
+ */
+declare function cofheFetch(url: string, init?: RequestInit, ctx?: CofheRequestContext): Promise<Response>;
+
 declare enum CofheErrorCode {
     InternalError = "INTERNAL_ERROR",
     UnknownEnvironment = "UNKNOWN_ENVIRONMENT",
@@ -137,4 +160,4 @@ declare function verifyDecryptResult(handle: bigint | string, cleartext: bigint,
  */
 declare function fheTypeToString(utype: FheTypes): string;
 
-export { InitialConnectStore as CONNECT_STORE_DEFAULTS, CofheClient, CofheClientConnectionState, CofheClientParams, CofheConfig, CofheError, CofheErrorCode, type CofheErrorParams, FheTypes, MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY, MOCKS_THRESHOLD_NETWORK_ADDRESS, MOCKS_ZK_VERIFIER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY, TASK_MANAGER_ADDRESS, TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT, TFHE_RS_ZK_MAX_BITS, createCofheClientBase, fheTypeToString, isCofheError, verifyDecryptResult };
+export { InitialConnectStore as CONNECT_STORE_DEFAULTS, CofheClient, CofheClientConnectionState, CofheClientParams, CofheConfig, type CofheDebugInterceptors, CofheError, CofheErrorCode, type CofheErrorParams, type CofheOnRequest, type CofheOnResponse, type CofheRequestContext, type CofheRequestOverride, FheTypes, MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY, MOCKS_THRESHOLD_NETWORK_ADDRESS, MOCKS_ZK_VERIFIER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY, TASK_MANAGER_ADDRESS, TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT, TFHE_RS_ZK_MAX_BITS, cofheFetch, createCofheClientBase, fheTypeToString, getCofheDebugInterceptors, isCofheError, setCofheDebugInterceptors, verifyDecryptResult };

package/dist/core.d.ts

@@ -14,6 +14,29 @@ declare const InitialConnectStore: CofheClientConnectionState;
  */
 declare function createCofheClientBase<TConfig extends CofheConfig>(opts: CofheClientParams<TConfig>): CofheClient<TConfig>;
 
+interface CofheRequestContext {
+    /** Coarse label for the call site, e.g. 'decrypt' | 'sealoutput' | 'fetchKeys'. */
+    op: string;
+}
+interface CofheRequestOverride {
+    url?: string;
+    init?: RequestInit;
+}
+type CofheOnRequest = (url: string, init: RequestInit | undefined, ctx: CofheRequestContext) => CofheRequestOverride | void | Promise<CofheRequestOverride | void>;
+type CofheOnResponse = (response: Response, ctx: CofheRequestContext) => Response | void | Promise<Response | void>;
+interface CofheDebugInterceptors {
+    onRequest?: CofheOnRequest;
+    onResponse?: CofheOnResponse;
+}
+/** Register (or clear, with null) the debug interceptors. */
+declare function setCofheDebugInterceptors(next: CofheDebugInterceptors | null): void;
+declare function getCofheDebugInterceptors(): CofheDebugInterceptors;
+/**
+ * fetch() wrapper used by all low-level SDK network ops. Applies the registered
+ * debug interceptors when present; otherwise behaves exactly like fetch().
+ */
+declare function cofheFetch(url: string, init?: RequestInit, ctx?: CofheRequestContext): Promise<Response>;
+
 declare enum CofheErrorCode {
     InternalError = "INTERNAL_ERROR",
     UnknownEnvironment = "UNKNOWN_ENVIRONMENT",
@@ -137,4 +160,4 @@ declare function verifyDecryptResult(handle: bigint | string, cleartext: bigint,
  */
 declare function fheTypeToString(utype: FheTypes): string;
 
-export { InitialConnectStore as CONNECT_STORE_DEFAULTS, CofheClient, CofheClientConnectionState, CofheClientParams, CofheConfig, CofheError, CofheErrorCode, type CofheErrorParams, FheTypes, MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY, MOCKS_THRESHOLD_NETWORK_ADDRESS, MOCKS_ZK_VERIFIER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY, TASK_MANAGER_ADDRESS, TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT, TFHE_RS_ZK_MAX_BITS, createCofheClientBase, fheTypeToString, isCofheError, verifyDecryptResult };
+export { InitialConnectStore as CONNECT_STORE_DEFAULTS, CofheClient, CofheClientConnectionState, CofheClientParams, CofheConfig, type CofheDebugInterceptors, CofheError, CofheErrorCode, type CofheErrorParams, type CofheOnRequest, type CofheOnResponse, type CofheRequestContext, type CofheRequestOverride, FheTypes, MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY, MOCKS_THRESHOLD_NETWORK_ADDRESS, MOCKS_ZK_VERIFIER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY, TASK_MANAGER_ADDRESS, TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT, TFHE_RS_ZK_MAX_BITS, cofheFetch, createCofheClientBase, fheTypeToString, getCofheDebugInterceptors, isCofheError, setCofheDebugInterceptors, verifyDecryptResult };

package/dist/core.js

@@ -1,4 +1,4 @@
-export { InitialConnectStore as CONNECT_STORE_DEFAULTS, CofheError, CofheErrorCode, DecryptForTxBuilder, DecryptForViewBuilder, EncryptInputsBuilder, EncryptStep, Encryptable, FheAllUTypes, FheTypes, FheUintUTypes, assertCorrectEncryptedItemInput, createCofheClientBase, createCofheConfigBase, createKeysStore, fetchKeys, fheTypeToString, getCofheConfigItem, isCofheError, isEncryptableItem, isLastEncryptionStep, verifyDecryptResult, zkProveWithWorker } from './chunk-PE5V5CCV.js';
+export { InitialConnectStore as CONNECT_STORE_DEFAULTS, CofheError, CofheErrorCode, DecryptForTxBuilder, DecryptForViewBuilder, EncryptInputsBuilder, EncryptStep, Encryptable, FheAllUTypes, FheTypes, FheUintUTypes, assertCorrectEncryptedItemInput, cofheFetch, createCofheClientBase, createCofheConfigBase, createKeysStore, fetchKeys, fheTypeToString, getCofheConfigItem, getCofheDebugInterceptors, isCofheError, isEncryptableItem, isLastEncryptionStep, setCofheDebugInterceptors, verifyDecryptResult, zkProveWithWorker } from './chunk-NOC3PYB7.js';
 import './chunk-MTRAXQXC.js';
 import './chunk-VB62WYPL.js';
 export { MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY, MOCKS_THRESHOLD_NETWORK_ADDRESS, MOCKS_ZK_VERIFIER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY, TASK_MANAGER_ADDRESS, TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT, TFHE_RS_ZK_MAX_BITS } from './chunk-ESMZCFJY.js';

package/dist/node.cjs

@@ -2562,7 +2562,7 @@ var getOrCreateSelfPermit = async (publicClient, walletClient, chainId, account,
   const _chainId = chainId ?? await publicClient.getChainId();
   const _account = account ?? walletClient.account.address;
   const activePermit = await getActivePermit2(_chainId, _account);
-  if (activePermit && activePermit.type === "self") {
+  if (activePermit && activePermit.type === "self" && PermitUtils.isValid(activePermit).valid) {
     return activePermit;
   }
   return createSelf(options ?? { issuer: _account, name: "Autogenerated Self Permit" }, publicClient, walletClient);
@@ -2571,7 +2571,7 @@ var getOrCreateSharingPermit = async (publicClient, walletClient, options, chain
   const _chainId = chainId ?? await publicClient.getChainId();
   const _account = account ?? walletClient.account.address;
   const activePermit = await getActivePermit2(_chainId, _account);
-  if (activePermit && activePermit.type === "sharing") {
+  if (activePermit && activePermit.type === "sharing" && PermitUtils.isValid(activePermit).valid) {
     return activePermit;
   }
   return createSharing(options, publicClient, walletClient);
@@ -2830,6 +2830,29 @@ async function cofheMocksDecryptForView(ctHash, utype, permit, publicClient) {
   return unsealed;
 }
 
+// core/debug.ts
+var interceptors = {};
+async function cofheFetch(url, init, ctx = { op: "request" }) {
+  let finalUrl = url;
+  let finalInit = init;
+  if (interceptors.onRequest) {
+    const override = await interceptors.onRequest(finalUrl, finalInit, ctx);
+    if (override) {
+      if (override.url !== void 0)
+        finalUrl = override.url;
+      if (override.init !== void 0)
+        finalInit = override.init;
+    }
+  }
+  let response = await fetch(finalUrl, finalInit);
+  if (interceptors.onResponse) {
+    const replaced = await interceptors.onResponse(response, ctx);
+    if (replaced)
+      response = replaced;
+  }
+  return response;
+}
+
 // core/decrypt/polling.ts
 function computeMinuteRampPollIntervalMs(elapsedMs, params) {
   const elapsedSeconds = Math.floor(elapsedMs / 1e3);
@@ -2999,13 +3022,17 @@ async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, per
   for (; ; ) {
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput`,
+        /*op:sealoutput*/
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
@@ -3128,12 +3155,16 @@ async function pollSealOutputStatus(thresholdNetworkUrl, requestId, overallStart
     }
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput/${requestId}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json"
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput/${requestId}`,
+        /*op:sealoutput-poll*/
+        {
+          method: "GET",
+          headers: {
+            "Content-Type": "application/json"
+          }
         }
-      });
+      );
     } catch (e) {
       throw new CofheError({
         code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
@@ -3730,13 +3761,17 @@ async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, perm
   for (; ; ) {
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt`,
+        /*op:decrypt*/
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: "DECRYPT_FAILED" /* DecryptFailed */,
@@ -3861,12 +3896,16 @@ async function pollDecryptStatusV2(thresholdNetworkUrl, requestId, overallStartT
     }
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt/${requestId}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json"
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt/${requestId}`,
+        /*op:decrypt-poll*/
+        {
+          method: "GET",
+          headers: {
+            "Content-Type": "application/json"
+          }
         }
-      });
+      );
     } catch (e) {
       throw new CofheError({
         code: "DECRYPT_FAILED" /* DecryptFailed */,

package/dist/node.js

@@ -1,4 +1,4 @@
-import { createCofheConfigBase, createCofheClientBase } from './chunk-PE5V5CCV.js';
+import { createCofheConfigBase, createCofheClientBase } from './chunk-NOC3PYB7.js';
 import './chunk-MTRAXQXC.js';
 import './chunk-VB62WYPL.js';
 import { TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT } from './chunk-ESMZCFJY.js';

package/dist/web.cjs

@@ -2597,7 +2597,7 @@ var getOrCreateSelfPermit = async (publicClient, walletClient, chainId, account,
   const _chainId = chainId ?? await publicClient.getChainId();
   const _account = account ?? walletClient.account.address;
   const activePermit = await getActivePermit2(_chainId, _account);
-  if (activePermit && activePermit.type === "self") {
+  if (activePermit && activePermit.type === "self" && PermitUtils.isValid(activePermit).valid) {
     return activePermit;
   }
   return createSelf(options ?? { issuer: _account, name: "Autogenerated Self Permit" }, publicClient, walletClient);
@@ -2606,7 +2606,7 @@ var getOrCreateSharingPermit = async (publicClient, walletClient, options, chain
   const _chainId = chainId ?? await publicClient.getChainId();
   const _account = account ?? walletClient.account.address;
   const activePermit = await getActivePermit2(_chainId, _account);
-  if (activePermit && activePermit.type === "sharing") {
+  if (activePermit && activePermit.type === "sharing" && PermitUtils.isValid(activePermit).valid) {
     return activePermit;
   }
   return createSharing(options, publicClient, walletClient);
@@ -2865,6 +2865,29 @@ async function cofheMocksDecryptForView(ctHash, utype, permit, publicClient) {
   return unsealed;
 }
 
+// core/debug.ts
+var interceptors = {};
+async function cofheFetch(url, init, ctx = { op: "request" }) {
+  let finalUrl = url;
+  let finalInit = init;
+  if (interceptors.onRequest) {
+    const override = await interceptors.onRequest(finalUrl, finalInit, ctx);
+    if (override) {
+      if (override.url !== void 0)
+        finalUrl = override.url;
+      if (override.init !== void 0)
+        finalInit = override.init;
+    }
+  }
+  let response = await fetch(finalUrl, finalInit);
+  if (interceptors.onResponse) {
+    const replaced = await interceptors.onResponse(response, ctx);
+    if (replaced)
+      response = replaced;
+  }
+  return response;
+}
+
 // core/decrypt/polling.ts
 function computeMinuteRampPollIntervalMs(elapsedMs, params) {
   const elapsedSeconds = Math.floor(elapsedMs / 1e3);
@@ -3034,13 +3057,17 @@ async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, per
   for (; ; ) {
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput`,
+        /*op:sealoutput*/
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
@@ -3163,12 +3190,16 @@ async function pollSealOutputStatus(thresholdNetworkUrl, requestId, overallStart
     }
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput/${requestId}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json"
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput/${requestId}`,
+        /*op:sealoutput-poll*/
+        {
+          method: "GET",
+          headers: {
+            "Content-Type": "application/json"
+          }
         }
-      });
+      );
     } catch (e) {
       throw new CofheError({
         code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
@@ -3765,13 +3796,17 @@ async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, perm
   for (; ; ) {
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt`,
+        /*op:decrypt*/
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: "DECRYPT_FAILED" /* DecryptFailed */,
@@ -3896,12 +3931,16 @@ async function pollDecryptStatusV2(thresholdNetworkUrl, requestId, overallStartT
     }
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt/${requestId}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json"
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt/${requestId}`,
+        /*op:decrypt-poll*/
+        {
+          method: "GET",
+          headers: {
+            "Content-Type": "application/json"
+          }
         }
-      });
+      );
     } catch (e) {
       throw new CofheError({
         code: "DECRYPT_FAILED" /* DecryptFailed */,

package/dist/web.js

@@ -1,4 +1,4 @@
-import { createCofheConfigBase, createCofheClientBase, fheTypeToString } from './chunk-PE5V5CCV.js';
+import { createCofheConfigBase, createCofheClientBase, fheTypeToString } from './chunk-NOC3PYB7.js';
 import './chunk-MTRAXQXC.js';
 import './chunk-VB62WYPL.js';
 import { TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT } from './chunk-ESMZCFJY.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cofhe/sdk",
-  "version": "0.6.0",
+  "version": "0.6.1",
   "type": "module",
   "description": "SDK for Fhenix COFHE coprocessor interaction",
   "main": "./dist/core.cjs",