@cofhe/sdk 0.6.0 → 0.7.0

package/core/decrypt/tnDecryptV2.ts

@@ -1,9 +1,11 @@
-import { type Permission } from '@/permits';
+import { type ACPPublic } from '@/acps';
+import { cofheFetch } from '../debug.js';
 
 import { CofheError, CofheErrorCode } from '../error';
 import { type DecryptPollCallbackFunction } from '../types';
 import { normalizeTnSignature, parseDecryptedBytesToBigInt } from './tnDecryptUtils';
 import { computeMinuteRampPollIntervalMs } from './polling.js';
+import { mapApiErrorCodeToCofheErrorCode, parseApiErrorResponseBody } from './apiError.js';
 import { classifySubmitResponse, normalize404RetryTimeoutMs, throwIfSubmitRetryTimedOut } from './submitRetry.js';
 
 // Polling configuration
@@ -177,7 +179,7 @@ async function submitDecryptRequestV2(
   thresholdNetworkUrl: string,
   ctHash: bigint | string,
   chainId: number,
-  permission: Permission | null,
+  acp: ACPPublic | null,
   overallStartTime: number,
   retry404TimeoutMs: number,
   onPoll?: DecryptPollCallbackFunction
@@ -185,28 +187,32 @@ async function submitDecryptRequestV2(
   const body: {
     ct_tempkey: string;
     host_chain_id: number;
-    permit?: Permission;
+    acp?: ACPPublic;
   } = {
     ct_tempkey: BigInt(ctHash).toString(16).padStart(64, '0'),
     host_chain_id: chainId,
   };
 
-  if (permission) {
-    body.permit = permission;
+  if (acp) {
+    body.acp = acp;
   }
 
   let attemptIndex = 0;
+  let last404ApiErrorMessage: string | undefined;
 
   for (;;) {
     let response: Response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt`, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(body),
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt`,
+        /*op:decrypt*/ {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify(body),
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: CofheErrorCode.DecryptFailed,
@@ -221,17 +227,20 @@ async function submitDecryptRequestV2(
       });
     }
 
-    const responseClassification = await classifySubmitResponse({ response });
+    const responseClassification = await classifySubmitResponse({
+      response,
+      fallbackErrorCode: CofheErrorCode.DecryptFailed,
+    });
 
     if (responseClassification.kind === 'fatal-http') {
       throw new CofheError({
-        code: CofheErrorCode.DecryptFailed,
+        code: responseClassification.cofheErrorCode,
+        apiErrorCode: responseClassification.apiErrorCode,
         message: `decrypt request failed: ${responseClassification.errorMessage}`,
         hint: 'Check the threshold network URL and request parameters.',
         context: {
           thresholdNetworkUrl,
-          status: response.status,
-          statusText: response.statusText,
+          status: responseClassification.status,
           body,
           attemptIndex,
         },
@@ -285,6 +294,10 @@ async function submitDecryptRequestV2(
       });
     }
 
+    if (responseClassification.status === 404) {
+      last404ApiErrorMessage = responseClassification.apiErrorMessage;
+    }
+
     const elapsedMs = Date.now() - overallStartTime;
 
     throwIfSubmitRetryTimedOut({
@@ -297,6 +310,7 @@ async function submitDecryptRequestV2(
       thresholdNetworkUrl,
       body,
       attemptIndex,
+      lastKnownErrorMessage: last404ApiErrorMessage,
     });
 
     onPoll?.({
@@ -352,12 +366,15 @@ async function pollDecryptStatusV2(
 
     let response: Response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt/${requestId}`, {
-        method: 'GET',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt/${requestId}`,
+        /*op:decrypt-poll*/ {
+          method: 'GET',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: CofheErrorCode.DecryptFailed,
@@ -384,17 +401,11 @@ async function pollDecryptStatusV2(
     }
 
     if (!response.ok) {
-      let errorMessage = `HTTP ${response.status}`;
-      try {
-        const errorBody = (await response.json()) as Record<string, unknown>;
-        const maybeMessage = (errorBody.error_message || errorBody.message) as unknown;
-        if (typeof maybeMessage === 'string' && maybeMessage.length > 0) errorMessage = maybeMessage;
-      } catch {
-        errorMessage = response.statusText || errorMessage;
-      }
+      const { apiErrorCode, errorMessage } = await parseApiErrorResponseBody(response);
 
       throw new CofheError({
-        code: CofheErrorCode.DecryptFailed,
+        code: mapApiErrorCodeToCofheErrorCode(apiErrorCode, CofheErrorCode.DecryptFailed),
+        apiErrorCode,
         message: `decrypt status poll failed: ${errorMessage}`,
         context: {
           thresholdNetworkUrl,
@@ -448,12 +459,12 @@ async function pollDecryptStatusV2(
 export async function tnDecryptV2(params: {
   ctHash: bigint | string;
   chainId: number;
-  permission: Permission | null;
+  acp: ACPPublic | null;
   thresholdNetworkUrl: string;
   retry404TimeoutMs?: number;
   onPoll?: DecryptPollCallbackFunction;
 }): Promise<{ decryptedValue: bigint; signature: `0x${string}` }> {
-  const { thresholdNetworkUrl, ctHash, chainId, permission, retry404TimeoutMs, onPoll } = params;
+  const { thresholdNetworkUrl, ctHash, chainId, acp, retry404TimeoutMs, onPoll } = params;
   const normalized404RetryTimeoutMs = normalize404RetryTimeoutMs({
     timeoutMs: retry404TimeoutMs,
     operationLabel: 'decrypt',
@@ -464,7 +475,7 @@ export async function tnDecryptV2(params: {
     thresholdNetworkUrl,
     ctHash,
     chainId,
-    permission,
+    acp,
     overallStartTime,
     normalized404RetryTimeoutMs,
     onPoll

package/core/decrypt/tnSealOutputV1.ts

@@ -1,11 +1,12 @@
-import { type Permission, type EthEncryptedData } from '@/permits';
+import { type ACPPublic, type EthEncryptedData } from '@/acps';
 
 import { CofheError, CofheErrorCode } from '../error.js';
+import {} from './tnDecryptUtils.js';
 
 export async function tnSealOutputV1(
   ctHash: bigint,
   chainId: number,
-  permission: Permission,
+  acp: ACPPublic,
   thresholdNetworkUrl: string
 ): Promise<EthEncryptedData> {
   let sealed: EthEncryptedData | undefined;
@@ -15,7 +16,7 @@ export async function tnSealOutputV1(
   const body = {
     ct_tempkey: ctHash.toString(16).padStart(64, '0'),
     host_chain_id: chainId,
-    permit: permission,
+    acp: acp,
   };
 
   try {

package/core/decrypt/tnSealOutputV2.ts

@@ -1,9 +1,12 @@
-import { type Permission, type EthEncryptedData } from '@/permits';
+import { type ACPPublic, type EthEncryptedData } from '@/acps';
+import { cofheFetch } from '../debug.js';
 
 import { CofheError, CofheErrorCode } from '../error.js';
 import { type DecryptPollCallbackFunction } from '../types.js';
 import { computeMinuteRampPollIntervalMs } from './polling.js';
+import { mapApiErrorCodeToCofheErrorCode, parseApiErrorResponseBody } from './apiError.js';
 import { classifySubmitResponse, normalize404RetryTimeoutMs, throwIfSubmitRetryTimedOut } from './submitRetry.js';
+import {} from './tnDecryptUtils.js';
 
 // Polling configuration
 const POLL_INTERVAL_MS = 1000; // 1 second
@@ -135,7 +138,7 @@ async function submitSealOutputRequest(
   thresholdNetworkUrl: string,
   ctHash: bigint | string,
   chainId: number,
-  permission: Permission,
+  acp: ACPPublic,
   overallStartTime: number,
   retry404TimeoutMs: number,
   onPoll?: DecryptPollCallbackFunction
@@ -143,20 +146,24 @@ async function submitSealOutputRequest(
   const body = {
     ct_tempkey: BigInt(ctHash).toString(16).padStart(64, '0'),
     host_chain_id: chainId,
-    permit: permission,
+    acp,
   };
   let attemptIndex = 0;
+  let last404ApiErrorMessage: string | undefined;
 
   for (;;) {
     let response: Response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput`, {
-        method: 'POST',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-        body: JSON.stringify(body),
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput`,
+        /*op:sealoutput*/ {
+          method: 'POST',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+          body: JSON.stringify(body),
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: CofheErrorCode.SealOutputFailed,
@@ -171,17 +178,20 @@ async function submitSealOutputRequest(
       });
     }
 
-    const responseClassification = await classifySubmitResponse({ response });
+    const responseClassification = await classifySubmitResponse({
+      response,
+      fallbackErrorCode: CofheErrorCode.SealOutputFailed,
+    });
 
     if (responseClassification.kind === 'fatal-http') {
       throw new CofheError({
-        code: CofheErrorCode.SealOutputFailed,
+        code: responseClassification.cofheErrorCode,
+        apiErrorCode: responseClassification.apiErrorCode,
         message: `sealOutput request failed: ${responseClassification.errorMessage}`,
         hint: 'Check the threshold network URL and request parameters.',
         context: {
           thresholdNetworkUrl,
-          status: response.status,
-          statusText: response.statusText,
+          status: responseClassification.status,
           body,
           attemptIndex,
         },
@@ -232,6 +242,10 @@ async function submitSealOutputRequest(
       });
     }
 
+    if (responseClassification.status === 404) {
+      last404ApiErrorMessage = responseClassification.apiErrorMessage;
+    }
+
     const elapsedMs = Date.now() - overallStartTime;
 
     throwIfSubmitRetryTimedOut({
@@ -244,6 +258,7 @@ async function submitSealOutputRequest(
       thresholdNetworkUrl,
       body,
       attemptIndex,
+      lastKnownErrorMessage: last404ApiErrorMessage,
     });
 
     onPoll?.({
@@ -303,12 +318,15 @@ async function pollSealOutputStatus(
 
     let response: Response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput/${requestId}`, {
-        method: 'GET',
-        headers: {
-          'Content-Type': 'application/json',
-        },
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput/${requestId}`,
+        /*op:sealoutput-poll*/ {
+          method: 'GET',
+          headers: {
+            'Content-Type': 'application/json',
+          },
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: CofheErrorCode.SealOutputFailed,
@@ -337,16 +355,11 @@ async function pollSealOutputStatus(
 
     // Handle other non-200 status codes
     if (!response.ok) {
-      let errorMessage = `HTTP ${response.status}`;
-      try {
-        const errorBody = await response.json();
-        errorMessage = errorBody.error_message || errorBody.message || errorMessage;
-      } catch {
-        errorMessage = response.statusText || errorMessage;
-      }
+      const { apiErrorCode, errorMessage } = await parseApiErrorResponseBody(response);
 
       throw new CofheError({
-        code: CofheErrorCode.SealOutputFailed,
+        code: mapApiErrorCodeToCofheErrorCode(apiErrorCode, CofheErrorCode.SealOutputFailed),
+        apiErrorCode,
         message: `sealOutput status poll failed: ${errorMessage}`,
         context: {
           thresholdNetworkUrl,
@@ -400,12 +413,12 @@ async function pollSealOutputStatus(
 export async function tnSealOutputV2(params: {
   ctHash: bigint | string;
   chainId: number;
-  permission: Permission;
+  acp: ACPPublic;
   thresholdNetworkUrl: string;
   retry404TimeoutMs?: number;
   onPoll?: DecryptPollCallbackFunction;
 }): Promise<EthEncryptedData> {
-  const { thresholdNetworkUrl, ctHash, chainId, permission, retry404TimeoutMs, onPoll } = params;
+  const { thresholdNetworkUrl, ctHash, chainId, acp, retry404TimeoutMs, onPoll } = params;
   const normalized404RetryTimeoutMs = normalize404RetryTimeoutMs({
     timeoutMs: retry404TimeoutMs,
     operationLabel: 'sealOutput',
@@ -418,7 +431,7 @@ export async function tnSealOutputV2(params: {
     thresholdNetworkUrl,
     ctHash,
     chainId,
-    permission,
+    acp,
     overallStartTime,
     normalized404RetryTimeoutMs,
     onPoll

package/core/encrypt/cofheMocksZkVerifySign.ts

@@ -1,15 +1,6 @@
 import { type EncryptableItem, FheTypes } from '../types.js';
-import { type VerifyResult } from './zkPackProveVerify.js';
-import {
-  createWalletClient,
-  http,
-  encodePacked,
-  keccak256,
-  hashMessage,
-  toBytes,
-  type PublicClient,
-  type WalletClient,
-} from 'viem';
+import { type VerifyBatchResult } from './zkPackProveVerify.js';
+import { createWalletClient, http, encodePacked, keccak256, type PublicClient, type WalletClient } from 'viem';
 import { MockZkVerifierAbi } from './MockZkVerifierAbi.js';
 import { hardhat } from 'viem/chains';
 import { CofheError, CofheErrorCode } from '../error.js';
@@ -178,89 +169,80 @@ async function insertCtHashes(items: EncryptableItemWithCtHash[], walletClient:
 }
 
 /**
- * The mocks verify the EncryptedInputs' signature against the known proof signer account.
- * Locally, we create the proof signatures from the known proof signer account.
+ * The mocks verify a batch's signature against the known verifier signer account.
+ * Locally, we create the single batch signature from the known signer account, over
+ * keccak256(h_0 || h_1 || ... || h_n), where each h_i is the same per-item message hash
+ * used by the on-chain digest (`ctHash || utype || securityZone || sender || chainId ||
+ * consumingContract`, per cofhe-contracts#77's contract-binding fix). This is the one
+ * canonical signer implementation used by the mocks - there is no separate per-item signing
+ * path.
  */
-async function createProofSignatures(
+async function createBatchProofSignature(
   items: EncryptableItemWithCtHash[],
   securityZone: number,
-  account: string
-): Promise<`0x${string}`[]> {
-  let signatures: `0x${string}`[] = [];
-
-  // Create wallet client for the encrypted input signer
-  // This wallet won't send a transaction, so gas isn't needed
-  // This wallet doesn't need to be connected to the network
-  let encInputSignerClient: WalletClient | undefined;
-
-  try {
-    encInputSignerClient = createMockZkVerifierSigner();
-  } catch (err) {
-    throw new CofheError({
-      code: CofheErrorCode.ZkMocksCreateProofSignatureFailed,
-      message: `mockZkVerifySign createProofSignatures failed while creating wallet client`,
-      cause: err instanceof Error ? err : undefined,
-      context: {
-        MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY,
-      },
-    });
-  }
-
+  account: string,
+  consumingContract: string
+): Promise<`0x${string}`> {
   try {
-    for (const item of items) {
-      // Pack the data into bytes and hash it
-      const packedData = encodePacked(
-        ['uint256', 'uint8', 'uint8', 'address', 'uint256'],
-        [BigInt(item.ctHash), item.utype, securityZone, account as `0x${string}`, BigInt(hardhat.id)]
-      );
-      const messageHash = keccak256(packedData);
+    // Compute each item's per-item message hash h_i
+    const itemHashes = items.map((item) =>
+      keccak256(
+        encodePacked(
+          ['uint256', 'uint8', 'uint8', 'address', 'uint256', 'address'],
+          [
+            BigInt(item.ctHash),
+            item.utype,
+            securityZone,
+            account as `0x${string}`,
+            BigInt(hardhat.id),
+            consumingContract as `0x${string}`,
+          ]
+        )
+      )
+    );
 
-      const signature = await sign({
-        hash: messageHash,
-        privateKey: MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY,
-        to: 'hex',
-      });
+    // Fold into one batch digest: keccak256(h_0 || h_1 || ... || h_n)
+    const batchDigest = keccak256(
+      encodePacked(
+        itemHashes.map(() => 'bytes32' as const),
+        itemHashes
+      )
+    );
 
-      signatures.push(signature);
-    }
+    // Sign once for the whole batch
+    return await sign({
+      hash: batchDigest,
+      privateKey: MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY,
+      to: 'hex',
+    });
   } catch (err) {
     throw new CofheError({
       code: CofheErrorCode.ZkMocksCreateProofSignatureFailed,
-      message: `mockZkVerifySign createProofSignatures failed while calling signMessage`,
+      message: `mockZkVerifySign createBatchProofSignature failed while signing the batch digest`,
       cause: err instanceof Error ? err : undefined,
       context: {
         items,
         securityZone,
+        consumingContract,
       },
     });
   }
-
-  if (signatures.length !== items.length) {
-    throw new CofheError({
-      code: CofheErrorCode.ZkMocksCreateProofSignatureFailed,
-      message: `mockZkVerifySign createProofSignatures returned incorrect number of signatures`,
-      context: {
-        items,
-        securityZone,
-      },
-    });
-  }
-
-  return signatures;
 }
 
 /**
- * Transforms the encryptable items into EncryptedInputs ready to be used in a transaction on the hardhat chain.
- * The EncryptedInputs are returned in the same format as from CoFHE, and include on-chain verifiable signatures.
+ * Transforms the encryptable items into a batch-verified result ready to be used in a
+ * transaction on the hardhat chain. Mirrors the shape returned by CoFHE's `/verifyBatch`:
+ * per-item ctHash/ctType, plus one shared on-chain verifiable signature for the whole batch.
  */
 export async function cofheMocksZkVerifySign(
   items: EncryptableItem[],
   account: string,
   securityZone: number,
+  consumingContract: string,
   publicClient: PublicClient,
   walletClient: WalletClient,
   zkvWalletClient: WalletClient | undefined
-): Promise<VerifyResult[]> {
+): Promise<VerifyBatchResult> {
   // Use config._internal?.zkvWalletClient if provided, otherwise use a mock zk verifier signer
   const _walletClient = zkvWalletClient ?? createMockZkVerifierSigner();
 
@@ -270,12 +252,15 @@ export async function cofheMocksZkVerifySign(
   // Insert the ctHashes into the MockZkVerifier contract
   await insertCtHashes(encryptableItems, _walletClient);
 
-  // Locally create the proof signatures from the known proof signer account
-  const signatures = await createProofSignatures(encryptableItems, securityZone, account);
+  // Locally create the single batch signature from the known signer account
+  const signature = await createBatchProofSignature(encryptableItems, securityZone, account, consumingContract);
 
-  // Return the ctHashes and signatures in the same format as CoFHE
-  return encryptableItems.map((item, index) => ({
-    ct_hash: item.ctHash.toString(),
-    signature: signatures[index],
-  }));
+  // Return the ctHashes/ctTypes and the batch signature, in the same shape as CoFHE's /verifyBatch
+  return {
+    outputs: encryptableItems.map((item) => ({
+      ct_hash: item.ctHash.toString(),
+      ct_type: item.utype,
+    })),
+    signature,
+  };
 }