@cofhe/sdk 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # @cofhe/sdk Changelog
 
+## 0.7.0
+
+### Minor Changes
+
+- fb87d91: **ACP-era chains only.** The SDK signs and sends ACP (Permit V3) exclusively. Chains whose ACL still serves the pre-upgrade V2 `Permission` protocol are rejected with a clear error at permit-signing time (the ACL's `eip712Domain` version is probed and must be `"2"`). Decryption request bodies carry the ACP object under the `acp` key, and backend error handling recognizes the `acp_*` codes exclusively — seven map 1:1 onto the former `permit_*` codes, while revocation now surfaces as `acp_denied` (see the [0.7.0 migration guide](https://cofhesdk.fhenix.io/migrating-to-0-7-0) for the full table).
+- fb87d91: **Breaking: Permit (V2) → ACP (Access Control Permission).** Permits become scoped, revocable ACPs; old names are removed rather than deprecated. Highlights (full list in the [0.7.0 migration guide](https://cofhesdk.fhenix.io/migrating-to-0-7-0)):
+
+  - `Permit`/`Permission`/`PermitUtils`/`client.permits` → `ACP`/`ACPPublic`/`ACPUtils`/`client.acp`; `getPermission()` → `getPublic()`
+  - `ACPPrivate` & `ACPPublic` are top-level types, `ACP` is the union; the sealing keypair is flattened to `sealingPrivateKey`/`sealingKey` (the `SealingKey` class is removed)
+  - New scope fields (`scope`, `contracts`, `handles: bytes32[]`) and revocation fields renamed `validatorId`/`validatorContract` → `revokerData`/`revokerContract`; default revoker `ACPTimestampRevoker` with `revokeACP`/`revokeAllACPs`/`isACPRevoked` on the client
+  - EIP-712 domain bumped to `("ACL", "2")` with new `ACPIssuerSelf`/`ACPIssuerShared`/`ACPRecipient` types — previously signed permits no longer verify; the permit store migrates by wiping retired-format permits
+  - `ACPUtils.export()` produces a fixed `SharedACP` shape and only accepts signed sharing ACPs
+
+- fb87d91: **On-chain ACP sharing.** New `ACPShareRegistry` contract (deployed with the mocks) lets an issuer post a sharing ACP on-chain for its recipient to discover and import — replacing the JSON copy-paste hand-off.
+
+  - `client.acp.shareOnChain(acp)` posts a signed sharing ACP (issuer-only, same guards as `export()`); `cancelShare(shareId)` retracts it
+  - `client.acp.getIncomingShares()` lists importable shares addressed to the connected account (unexpired, not revoked — the registry checks the share's own revoker)
+  - `client.acp.importFromChain(share)` imports like the JSON flow (recipient sealing key + signature); `dismissShare(shareId)` cleans up the entry
+  - config: `acp.sharingRegistry: Record<chainId, address>`
+  - registry exposes `isShareValid(shareId)` as an on-chain verification hook for contracts
+
+- fb87d91: Migrate `cofheClient.encryptInputs` from one-signature-per-ciphertext to the new batch verification scheme (one signature per batch, per `FhenixProtocol/cofhe-contracts#78`).
+
+  **Breaking:** `EncryptInputsBuilder.execute()` now always returns `[...hashes, signature]` (`HashPlusProofResult<T>`) instead of an array of per-item `EncryptedItemInput` structs. `EncryptedItemInput` and its per-type aliases (`EncryptedBoolInput`, `EncryptedUint8Input`, etc.) are removed, along with `EncryptInputsBuilder.asHashPlusProof()` (no longer needed - it's the only shape now). `@cofhe/abi`'s `extractEncryptableValues`/`insertEncryptedValues` now detect `external*` ABI types instead of `struct InEuintXX`, with a new calling convention: any function with encrypted inputs must end with a plain `bytes` parameter to receive the shared batch signature. `@cofhe/foundry-plugin`'s `CofheClient.createIn*` helpers are renamed to `createExternal*` (`createInEuint32` → `createExternalEuint32`, etc.) and now return an `external*` handle plus a batch signature rather than an `InEuintXX` struct; the `createIn*_asHashPlusProof` variants are removed as redundant. See the [0.7.0 migration guide](https://cofhesdk.fhenix.io/migrating-to-0-7-0) for the full list of changes and what contract authors need to update.
+
+- fb87d91: Bind encrypted inputs to a consuming contract (`FhenixProtocol/cofhe-contracts#77`). The verifier-signed digest now includes the contract that will consume the ciphertext, closing a replay path where a signed input packet observed on-chain could be reused against a different contract than the one it was signed for.
+
+  **Breaking:** `EncryptInputsBuilder.setConsumingContract(address)` must be called before `.execute()` - it throws `ConsumingContractUninitialized` otherwise. `@cofhe/mock-contracts`'s `MockTaskManager` signature digest changed to include the consuming contract (external ABI unchanged). `@cofhe/foundry-plugin`'s `CofheClient.createExternal*`/`createEuint32sBatch` helpers now take a required `address consumingContract` as their last parameter (no global setter). `@cofhe/react`'s `useCofheEncryptAndWriteContract` defaults `consumingContract` to the write's target address automatically; `useCofheEncrypt` accepts it as an explicit option. See the [0.7.0 migration guide](https://cofhesdk.fhenix.io/migrating-to-0-7-0) for full details.
+
+- fb87d91: **Permit is now ACP everywhere.** All Permit-named API surface is renamed to ACP to avoid confusion with classic DeFi permits: types (`SelfACP`, `SharingACP`, `RecipientACP`, ...), client methods (`getOrCreateSelfACP`, `withACP`, ...), react hooks and components (`useCofheACPs`, `ACPCard`, ...), error codes (`ACP_DENIED`, ...), the `@cofhe/sdk/permits` entrypoint (now `@cofhe/sdk/acps`), and all documentation. English prose words (permitted/permitting) and protocol contract interfaces are unchanged. The persisted store key also changed; previously stored ACPs are not migrated and are transparently re-created on next use.
+
+### Patch Changes
+
+- d4d662f: fix(sdk): don't activate delegated (sharing) permits on creation
+
+  `createPermitWithSign` always stored the newly created permit as the issuer's active permit, so creating a delegated/sharing permit hijacked the issuer's own active permit. A delegated permit is for the recipient and must not change the issuer's active permit.
+
+  `createSharing` now defaults to store-only; `getOrCreateSharingACP` (which genuinely wants an active sharing ACP) opts in via `activate: true`. Self ACPs are unchanged.
+
+- f01cac7: Decrypt/sealoutput failures now map the threshold network's stable `error` codes to dedicated `CofheErrorCode` values (e.g. `ACPDenied`, `CtNotFound`, `UnsupportedType`) instead of a generic `DecryptFailed`/`SealOutputFailed`, and `CofheError` gains an `apiErrorCode` field with the raw backend string.
+
+  Also fixes submit-time `404` retries: a `404` is only retried while the backend reports `ct_not_found` (still indexing); any other error code now fails immediately instead of being blindly retried for up to `set404RetryTimeout`.
+
+## 0.6.1
+
+### Patch Changes
+
+- 670cda8: Prepare an alpha snapshot release.
+
 ## 0.6.0
 
 ### Minor Changes

package/acps/acp.ts

@@ -0,0 +1,411 @@
+import { keccak256, toHex, zeroAddress, parseAbi, type Hex, type PublicClient, type WalletClient } from 'viem';
+import {
+  type ACP,
+  type SelfACP,
+  type SharingACP,
+  type RecipientACP,
+  type CreateSelfACPOptions,
+  type CreateSharingACPOptions,
+  type ImportSharedACPOptions,
+  type SharedACP,
+  type SerializedACP,
+  type EIP712Domain,
+  type ACPPublic,
+  type EthEncryptedData,
+  type ACPHashFields,
+} from './types.js';
+import {
+  validateSelfACPOptions,
+  validateSharingACPOptions,
+  validateImportACPOptions,
+  validateSelfACP,
+  validateSharingACP,
+  validateImportACP,
+  ValidationUtils,
+} from './validation.js';
+import { SignatureUtils } from './signature.js';
+import { GenerateSealingKey, unsealWithPrivateKey } from './sealing.js';
+import { checkACPValidityOnChain, getAclEIP712Domain } from './onchain-utils.js';
+
+/**
+ * Main ACP utilities - functional approach for React compatibility
+ */
+export const ACPUtils = {
+  /**
+   * Create a self acp for personal use
+   */
+  createSelf: (options: CreateSelfACPOptions): SelfACP => {
+    const validation = validateSelfACPOptions(options);
+
+    // Always generate a new sealing key - users cannot provide their own
+    const sealingPair = GenerateSealingKey();
+
+    const acp = {
+      hash: ACPUtils.getHash(validation),
+      ...validation,
+      sealingPrivateKey: sealingPair.privateKey,
+      sealingKey: sealingPair.publicKey,
+      _signedDomain: undefined,
+    } satisfies SelfACP;
+
+    return acp;
+  },
+
+  /**
+   * Create a sharing acp to be shared with another user
+   */
+  createSharing: (options: CreateSharingACPOptions): SharingACP => {
+    const validation = validateSharingACPOptions(options);
+
+    // Always generate a new sealing key - users cannot provide their own
+    const sealingPair = GenerateSealingKey();
+
+    const acp = {
+      hash: ACPUtils.getHash(validation),
+      ...validation,
+      sealingPrivateKey: sealingPair.privateKey,
+      sealingKey: sealingPair.publicKey,
+      _signedDomain: undefined,
+    } satisfies SharingACP;
+
+    return acp;
+  },
+
+  /**
+   * Import a shared acp from various input formats
+   */
+  importShared: (options: ImportSharedACPOptions | string): RecipientACP => {
+    let parsedOptions: ImportSharedACPOptions;
+
+    // Handle different input types
+    if (typeof options === 'string') {
+      // Parse JSON string
+      try {
+        parsedOptions = JSON.parse(options);
+      } catch (error) {
+        throw new Error(`Failed to parse JSON string: ${error}`);
+      }
+    } else if (typeof options === 'object' && options !== null) {
+      // Handle both ImportSharedACPOptions and any object
+      parsedOptions = options;
+    } else {
+      throw new Error('Invalid input type, expected ImportSharedACPOptions, object, or string');
+    }
+
+    // Validate type if provided
+    if (parsedOptions.type != null && parsedOptions.type !== 'sharing') {
+      throw new Error(`Invalid acp type <${parsedOptions.type}>, must be "sharing"`);
+    }
+
+    const validation = validateImportACPOptions({ ...parsedOptions, type: 'recipient' });
+
+    // Always generate a new sealing key - users cannot provide their own
+    const sealingPair = GenerateSealingKey();
+
+    const acp = {
+      hash: ACPUtils.getHash(validation),
+      ...validation,
+      sealingPrivateKey: sealingPair.privateKey,
+      sealingKey: sealingPair.publicKey,
+      _signedDomain: undefined,
+    } satisfies RecipientACP;
+
+    return acp;
+  },
+
+  /**
+   * Sign an ACP with the provided wallet client
+   */
+  sign: async <T extends ACP>(acp: T, publicClient: PublicClient, walletClient: WalletClient): Promise<T> => {
+    if (walletClient == null || walletClient.account == null) {
+      throw new Error(
+        'Missing walletClient, you must pass in a `walletClient` for the connected user to create an ACP signature'
+      );
+    }
+
+    const primaryType = SignatureUtils.getPrimaryType(acp.type);
+    const domain = await getAclEIP712Domain(publicClient);
+    const { types, message } = SignatureUtils.getSignatureParams(ACPUtils.getPublic(acp, true), primaryType);
+
+    const signature = await walletClient.signTypedData({
+      domain,
+      types,
+      primaryType,
+      message,
+      account: walletClient.account,
+    });
+
+    let updatedACP: ACP;
+    if (acp.type === 'self' || acp.type === 'sharing') {
+      updatedACP = {
+        ...acp,
+        issuerSignature: signature,
+        _signedDomain: domain,
+      };
+    } else {
+      updatedACP = {
+        ...acp,
+        recipientSignature: signature,
+        _signedDomain: domain,
+      };
+    }
+
+    return updatedACP as T;
+  },
+
+  /**
+   * Create and sign a self acp in one operation
+   */
+  createSelfAndSign: async (
+    options: CreateSelfACPOptions,
+    publicClient: PublicClient,
+    walletClient: WalletClient
+  ): Promise<SelfACP> => {
+    const acp = ACPUtils.createSelf(options);
+    return ACPUtils.sign(acp, publicClient, walletClient);
+  },
+
+  /**
+   * Create and sign a sharing acp in one operation
+   */
+  createSharingAndSign: async (
+    options: CreateSharingACPOptions,
+    publicClient: PublicClient,
+    walletClient: WalletClient
+  ): Promise<SharingACP> => {
+    const acp = ACPUtils.createSharing(options);
+    return ACPUtils.sign(acp, publicClient, walletClient);
+  },
+
+  /**
+   * Import and sign a shared acp in one operation from various input formats
+   */
+  importSharedAndSign: async (
+    options: ImportSharedACPOptions | string,
+    publicClient: PublicClient,
+    walletClient: WalletClient
+  ): Promise<RecipientACP> => {
+    const acp = ACPUtils.importShared(options);
+    return ACPUtils.sign(acp, publicClient, walletClient);
+  },
+
+  /**
+   * Deserialize an ACP from serialized data
+   */
+  deserialize: (data: SerializedACP): ACP => {
+    return { ...data };
+  },
+
+  /**
+   * Serialize an ACP for storage
+   */
+  serialize: (acp: ACP): SerializedACP => {
+    return {
+      hash: acp.hash,
+      name: acp.name,
+      type: acp.type,
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles,
+      sealingKey: acp.sealingKey,
+      issuerSignature: acp.issuerSignature,
+      recipientSignature: acp.recipientSignature,
+      _signedDomain: acp._signedDomain,
+      sealingPrivateKey: acp.sealingPrivateKey,
+    };
+  },
+
+  /**
+   * Validate an ACP (schema-level validation)
+   */
+  validateSchema: (acp: ACP) => {
+    if (acp.type === 'self') {
+      return validateSelfACP(acp);
+    } else if (acp.type === 'sharing') {
+      return validateSharingACP(acp);
+    } else if (acp.type === 'recipient') {
+      return validateImportACP(acp);
+    } else {
+      throw new Error('Invalid ACP type');
+    }
+  },
+
+  /**
+   * Validate an ACP (holistic validation).
+   *
+   * This validates:
+   * - ACP schema (shape + invariants)
+   * - ACP is signed
+   * - ACP is not expired
+   *
+   * For schema-only validation, use `validateSchema(acp)`.
+   */
+  validate: (acp: ACP) => {
+    const validated = ACPUtils.validateSchema(acp);
+    ValidationUtils.assertSignedAndNotExpired(validated as ACP);
+    return validated;
+  },
+
+  /**
+   * Get the public component of an ACP — the signed struct sent on-chain / to the decryption backend.
+   * Strips the private component (hash, name, type, sealing pair).
+   */
+  getPublic: (acp: ACP, skipValidation = false): ACPPublic => {
+    if (!skipValidation) {
+      ACPUtils.validateSchema(acp);
+    }
+
+    return {
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles,
+      sealingKey: acp.sealingKey,
+      issuerSignature: acp.issuerSignature,
+      recipientSignature: acp.recipientSignature,
+    };
+  },
+
+  /**
+   * Get a stable hash for the acp (used as key in storage)
+   */
+  getHash: (acp: ACPHashFields): string => {
+    const data = JSON.stringify({
+      type: acp.type,
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles,
+    });
+    return keccak256(toHex(data));
+  },
+
+  /**
+   * Export acp data for sharing (strips the private component).
+   * Fixed `SharedACP` shape — every field always present, aligned with
+   * `ACPPublic` and the on-chain sharing payload.
+   */
+  export: (acp: ACP): string => {
+    if (acp.type !== 'sharing') {
+      throw new Error(
+        `Cannot export a '${acp.type}' ACP — only 'sharing' ACPs are exportable. The export includes the issuer signature.`
+      );
+    }
+    if (acp.issuerSignature === '0x') {
+      throw new Error(
+        'Cannot export an unsigned sharing ACP — sign it first (the recipient needs the issuer signature).'
+      );
+    }
+
+    const shared: SharedACP = {
+      name: acp.name,
+      type: acp.type,
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles,
+      issuerSignature: acp.issuerSignature,
+    };
+
+    return JSON.stringify(shared, undefined, 2);
+  },
+
+  /**
+   * Unseal encrypted data using the acp's sealing key
+   */
+  unseal: (acp: ACP, ciphertext: EthEncryptedData): bigint => {
+    return unsealWithPrivateKey(acp.sealingPrivateKey, ciphertext);
+  },
+
+  /**
+   * Check if acp is expired
+   */
+  isExpired: (acp: ACP): boolean => {
+    return ValidationUtils.isExpired(acp);
+  },
+
+  /**
+   * Check if acp is signed
+   */
+  isSigned: (acp: ACP): boolean => {
+    return ValidationUtils.isSigned(acp);
+  },
+
+  /**
+   * Check if acp is signed and not expired
+   */
+  isSignedAndNotExpired: (acp: ACP) => {
+    return ValidationUtils.isSignedAndNotExpired(acp);
+  },
+
+  /**
+   * Assert that acp is signed and not expired
+   */
+  assertSignedAndNotExpired: (acp: ACP): void => {
+    return ValidationUtils.assertSignedAndNotExpired(acp);
+  },
+
+  isValid: (acp: ACP) => {
+    return ValidationUtils.isValid(acp);
+  },
+
+  /**
+   * Update acp name (returns new acp instance)
+   */
+  updateName: (acp: ACP, name: string): ACP => {
+    return { ...acp, name };
+  },
+
+  /**
+   * Fetch EIP712 domain from the blockchain
+   */
+  fetchEIP712Domain: async (publicClient: PublicClient): Promise<EIP712Domain> => {
+    return getAclEIP712Domain(publicClient);
+  },
+
+  /**
+   * Check if acp's signed domain matches the provided domain
+   */
+  matchesDomain: (acp: ACP, domain: EIP712Domain): boolean => {
+    return (
+      acp._signedDomain?.name === domain.name &&
+      acp._signedDomain?.version === domain.version &&
+      acp._signedDomain?.verifyingContract === domain.verifyingContract &&
+      acp._signedDomain?.chainId === domain.chainId
+    );
+  },
+
+  /**
+   * Check if acp's signed domain is valid for the current chain
+   */
+  checkSignedDomainValid: async (acp: ACP, publicClient: PublicClient): Promise<boolean> => {
+    if (acp._signedDomain == null) return false;
+    const domain = await getAclEIP712Domain(publicClient);
+    return ACPUtils.matchesDomain(acp, domain);
+  },
+
+  /**
+   * Check if acp passes the on-chain validation
+   */
+  checkValidityOnChain: async (acp: ACP, publicClient: PublicClient): Promise<boolean> => {
+    const publicAcp = ACPUtils.getPublic(acp);
+    return checkACPValidityOnChain(publicAcp, publicClient);
+  },
+};

package/acps/index.ts

@@ -0,0 +1,70 @@
+// Core types
+export type {
+  ACP,
+  CreateSelfACPOptions as SelfACPOptions,
+  CreateSharingACPOptions as SharingACPOptions,
+  ImportSharedACPOptions as ImportACPOptions,
+  SerializedACP,
+  ACPMetadata,
+  ACPPublic,
+  SharedACP,
+  IncomingShare,
+  EIP712Domain,
+  EIP712Types,
+  EIP712Message,
+  ValidationResult,
+  ACPSignaturePrimaryType,
+} from './types.js';
+
+// Main utilities
+export { ACPUtils } from './acp.js';
+
+// Validation utilities
+export {
+  // Self ACP validators
+  SelfACPOptionsValidator,
+  SelfACPValidator,
+  validateSelfACPOptions,
+  validateSelfACP,
+  // Sharing ACP validators
+  SharingACPOptionsValidator,
+  SharingACPValidator,
+  validateSharingACPOptions,
+  validateSharingACP,
+  // Import ACP validators
+  ImportACPOptionsValidator,
+  ImportACPValidator,
+  validateImportACPOptions,
+  validateImportACP,
+  // Common utilities
+  ValidationUtils,
+} from './validation.js';
+
+// Signature utilities
+export { SignatureUtils, getSignatureTypesAndMessage, SignatureTypes } from './signature.js';
+
+// Storage utilities
+export {
+  acpStore,
+  getACP,
+  getActiveACP,
+  getACPs,
+  setACP,
+  removeACP,
+  getActiveACPHash,
+  setActiveACPHash,
+  removeActiveACPHash,
+  clearStaleStore,
+  ACP_STORE_DEFAULTS,
+} from './store.js';
+
+// Sealing utilities
+export { GenerateSealingKey, seal, unsealWithPrivateKey, type SealingKeyPair } from './sealing.js';
+export type { EthEncryptedData } from './sealing.js';
+
+// Re-export everything for convenience
+export * from './types.js';
+export * from './acp.js';
+export * from './validation.js';
+export * from './signature.js';
+export * from './store.js';

package/{permits → acps}/onchain-utils.ts

@@ -6,7 +6,7 @@ import {
   decodeErrorResult,
   parseAbi,
 } from 'viem';
-import type { EIP712Domain, Permission } from './types';
+import type { EIP712Domain, ACPPublic } from './types';
 import { TASK_MANAGER_ADDRESS } from '../core/consts.js';
 
 export const getAclAddress = async (publicClient: PublicClient): Promise<Hex> => {
@@ -23,6 +23,10 @@ export const getAclAddress = async (publicClient: PublicClient): Promise<Hex> =>
   })) as `0x${string}`;
 };
 
+/**
+ * ACP (ACP V3) signing domain — fetched from the ACL contract, which since V3
+ * carries the ACP verification logic and signs as name "ACL", version "2".
+ */
 export const getAclEIP712Domain = async (publicClient: PublicClient): Promise<EIP712Domain> => {
   const aclAddress = await getAclAddress(publicClient);
   const EIP712_DOMAIN_IFACE =
@@ -41,6 +45,12 @@ export const getAclEIP712Domain = async (publicClient: PublicClient): Promise<EI
   // eslint-disable-next-line no-unused-vars
   const [_fields, name, version, chainId, verifyingContract, _salt, _extensions] = domain;
 
+  if (version !== '2') {
+    throw new Error(
+      `Chain ${chainId}'s ACL serves EIP-712 domain version "${version}" — this SDK requires the upgraded (ACP-era) ACL, which signs as version "2". Pre-upgrade (V2 Permission) chains are not supported.`
+    );
+  }
+
   return {
     name,
     version,
@@ -49,28 +59,28 @@ export const getAclEIP712Domain = async (publicClient: PublicClient): Promise<EI
   };
 };
 
-export const checkPermitValidityOnChain = async (
-  permission: Permission,
-  publicClient: PublicClient
-): Promise<boolean> => {
+export const checkACPValidityOnChain = async (acp: ACPPublic, publicClient: PublicClient): Promise<boolean> => {
   const aclAddress = await getAclAddress(publicClient);
 
-  // Check if the permit is valid
+  // Check if the acp is valid (structure: expiration / signatures / revocation)
   try {
     await publicClient.simulateContract({
       address: aclAddress,
-      abi: checkPermitValidityAbi,
-      functionName: 'checkPermitValidity',
+      abi: checkACPValidityAbi,
+      functionName: 'checkPermissionValidity',
       args: [
         {
-          issuer: permission.issuer,
-          expiration: BigInt(permission.expiration),
-          recipient: permission.recipient,
-          validatorId: BigInt(permission.validatorId),
-          validatorContract: permission.validatorContract,
-          sealingKey: permission.sealingKey,
-          issuerSignature: permission.issuerSignature,
-          recipientSignature: permission.recipientSignature,
+          issuer: acp.issuer,
+          expiration: BigInt(acp.expiration),
+          recipient: acp.recipient,
+          revokerData: BigInt(acp.revokerData),
+          revokerContract: acp.revokerContract,
+          scope: acp.scope,
+          contracts: acp.contracts,
+          handles: acp.handles,
+          sealingKey: acp.sealingKey,
+          issuerSignature: acp.issuerSignature,
+          recipientSignature: acp.recipientSignature,
         },
       ],
     });
@@ -86,7 +96,7 @@ export const checkPermitValidityOnChain = async (
     }
 
     // Check details field for custom error names (e.g., from Hardhat test nodes)
-    const customErrorName = extractCustomErrorFromDetails(err, checkPermitValidityAbi);
+    const customErrorName = extractCustomErrorFromDetails(err, checkACPValidityAbi);
     if (customErrorName) {
       throw new Error(customErrorName);
     }
@@ -95,7 +105,7 @@ export const checkPermitValidityOnChain = async (
     const hhDetailsData = extractReturnData(err);
     if (hhDetailsData != null) {
       const decoded = decodeErrorResult({
-        abi: checkPermitValidityAbi,
+        abi: checkACPValidityAbi,
         data: hhDetailsData,
       });
 
@@ -136,15 +146,15 @@ function extractReturnData(err: unknown): `0x${string}` | undefined {
   return s.match(/return data:\s*(0x[a-fA-F0-9]+)/)?.[1] as `0x${string}` | undefined;
 }
 
-const checkPermitValidityAbi = [
+const checkACPValidityAbi = [
   {
     type: 'function',
-    name: 'checkPermitValidity',
+    name: 'checkPermissionValidity',
     inputs: [
       {
-        name: 'permission',
+        name: 'acp',
         type: 'tuple',
-        internalType: 'struct Permission',
+        internalType: 'struct ACP',
         components: [
           {
             name: 'issuer',
@@ -162,15 +172,30 @@ const checkPermitValidityAbi = [
             internalType: 'address',
           },
           {
-            name: 'validatorId',
+            name: 'revokerData',
             type: 'uint256',
             internalType: 'uint256',
           },
           {
-            name: 'validatorContract',
+            name: 'revokerContract',
             type: 'address',
             internalType: 'address',
           },
+          {
+            name: 'scope',
+            type: 'uint8',
+            internalType: 'uint8',
+          },
+          {
+            name: 'contracts',
+            type: 'address[]',
+            internalType: 'address[]',
+          },
+          {
+            name: 'handles',
+            type: 'bytes32[]',
+            internalType: 'bytes32[]',
+          },
           {
             name: 'sealingKey',
             type: 'bytes32',