@cofhe/sdk 0.6.0 → 0.7.0

package/dist/{chunk-PE5V5CCV.js → chunk-43USWPEH.js}

@@ -1,8 +1,8 @@
-import { hardhat as hardhat$1 } from './chunk-MTRAXQXC.js';
-import { permitStore, PermitUtils } from './chunk-VB62WYPL.js';
+import { hardhat as hardhat$1 } from './chunk-N6IDQRRU.js';
+import { acpStore, ACPUtils } from './chunk-Q7CBWGQX.js';
 import { TFHE_RS_KEY_VERSION, TASK_MANAGER_ADDRESS, TFHE_RS_ZK_MAX_BITS, TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT, MOCKS_THRESHOLD_NETWORK_ADDRESS, MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY, MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY, MOCKS_ZK_VERIFIER_ADDRESS } from './chunk-ESMZCFJY.js';
 import { createStore } from 'zustand/vanilla';
-import { parseAbi, isAddressEqual, zeroAddress, recoverAddress, encodePacked, keccak256, createWalletClient, http, getAddress, parseSignature, serializeSignature } from 'viem';
+import { parseAbi, isAddressEqual, zeroAddress, recoverAddress, keccak256, encodeAbiParameters, encodePacked, createWalletClient, http, getAddress, parseSignature, serializeSignature } from 'viem';
 import { hardhat } from 'viem/chains';
 import { sign, privateKeyToAccount } from 'viem/accounts';
 import { z } from 'zod';
@@ -10,58 +10,78 @@ import { persist, createJSONStorage } from 'zustand/middleware';
 import { produce } from 'immer';
 
 // core/error.ts
-var CofheErrorCode = /* @__PURE__ */ ((CofheErrorCode3) => {
-  CofheErrorCode3["InternalError"] = "INTERNAL_ERROR";
-  CofheErrorCode3["UnknownEnvironment"] = "UNKNOWN_ENVIRONMENT";
-  CofheErrorCode3["InitTfheFailed"] = "INIT_TFHE_FAILED";
-  CofheErrorCode3["InitViemFailed"] = "INIT_VIEM_FAILED";
-  CofheErrorCode3["InitEthersFailed"] = "INIT_ETHERS_FAILED";
-  CofheErrorCode3["NotConnected"] = "NOT_CONNECTED";
-  CofheErrorCode3["MissingPublicClient"] = "MISSING_PUBLIC_CLIENT";
-  CofheErrorCode3["MissingWalletClient"] = "MISSING_WALLET_CLIENT";
-  CofheErrorCode3["MissingProviderParam"] = "MISSING_PROVIDER_PARAM";
-  CofheErrorCode3["EmptySecurityZonesParam"] = "EMPTY_SECURITY_ZONES_PARAM";
-  CofheErrorCode3["InvalidPermitData"] = "INVALID_PERMIT_DATA";
-  CofheErrorCode3["InvalidPermitDomain"] = "INVALID_PERMIT_DOMAIN";
-  CofheErrorCode3["PermitNotFound"] = "PERMIT_NOT_FOUND";
-  CofheErrorCode3["CannotRemoveLastPermit"] = "CANNOT_REMOVE_LAST_PERMIT";
-  CofheErrorCode3["AccountUninitialized"] = "ACCOUNT_UNINITIALIZED";
-  CofheErrorCode3["ChainIdUninitialized"] = "CHAIN_ID_UNINITIALIZED";
-  CofheErrorCode3["SealOutputFailed"] = "SEAL_OUTPUT_FAILED";
-  CofheErrorCode3["SealOutputReturnedNull"] = "SEAL_OUTPUT_RETURNED_NULL";
-  CofheErrorCode3["InvalidUtype"] = "INVALID_UTYPE";
-  CofheErrorCode3["DecryptFailed"] = "DECRYPT_FAILED";
-  CofheErrorCode3["DecryptReturnedNull"] = "DECRYPT_RETURNED_NULL";
-  CofheErrorCode3["ZkMocksInsertCtHashesFailed"] = "ZK_MOCKS_INSERT_CT_HASHES_FAILED";
-  CofheErrorCode3["ZkMocksCalcCtHashesFailed"] = "ZK_MOCKS_CALC_CT_HASHES_FAILED";
-  CofheErrorCode3["ZkMocksVerifySignFailed"] = "ZK_MOCKS_VERIFY_SIGN_FAILED";
-  CofheErrorCode3["ZkMocksCreateProofSignatureFailed"] = "ZK_MOCKS_CREATE_PROOF_SIGNATURE_FAILED";
-  CofheErrorCode3["ZkVerifyFailed"] = "ZK_VERIFY_FAILED";
-  CofheErrorCode3["ZkPackFailed"] = "ZK_PACK_FAILED";
-  CofheErrorCode3["ZkProveFailed"] = "ZK_PROVE_FAILED";
-  CofheErrorCode3["EncryptRemainingInItems"] = "ENCRYPT_REMAINING_IN_ITEMS";
-  CofheErrorCode3["ZkUninitialized"] = "ZK_UNINITIALIZED";
-  CofheErrorCode3["ZkVerifierUrlUninitialized"] = "ZK_VERIFIER_URL_UNINITIALIZED";
-  CofheErrorCode3["ThresholdNetworkUrlUninitialized"] = "THRESHOLD_NETWORK_URL_UNINITIALIZED";
-  CofheErrorCode3["MissingConfig"] = "MISSING_CONFIG";
-  CofheErrorCode3["UnsupportedChain"] = "UNSUPPORTED_CHAIN";
-  CofheErrorCode3["MissingZkBuilderAndCrsGenerator"] = "MISSING_ZK_BUILDER_AND_CRS_GENERATOR";
-  CofheErrorCode3["MissingTfhePublicKeyDeserializer"] = "MISSING_TFHE_PUBLIC_KEY_DESERIALIZER";
-  CofheErrorCode3["MissingCompactPkeCrsDeserializer"] = "MISSING_COMPACT_PKE_CRS_DESERIALIZER";
-  CofheErrorCode3["MissingFheKey"] = "MISSING_FHE_KEY";
-  CofheErrorCode3["MissingCrs"] = "MISSING_CRS";
-  CofheErrorCode3["FetchKeysFailed"] = "FETCH_KEYS_FAILED";
-  CofheErrorCode3["PublicWalletGetChainIdFailed"] = "PUBLIC_WALLET_GET_CHAIN_ID_FAILED";
-  CofheErrorCode3["PublicWalletGetAddressesFailed"] = "PUBLIC_WALLET_GET_ADDRESSES_FAILED";
-  CofheErrorCode3["RehydrateKeysStoreFailed"] = "REHYDRATE_KEYS_STORE_FAILED";
-  return CofheErrorCode3;
+var CofheErrorCode = /* @__PURE__ */ ((CofheErrorCode2) => {
+  CofheErrorCode2["InternalError"] = "INTERNAL_ERROR";
+  CofheErrorCode2["UnknownEnvironment"] = "UNKNOWN_ENVIRONMENT";
+  CofheErrorCode2["InitTfheFailed"] = "INIT_TFHE_FAILED";
+  CofheErrorCode2["InitViemFailed"] = "INIT_VIEM_FAILED";
+  CofheErrorCode2["InitEthersFailed"] = "INIT_ETHERS_FAILED";
+  CofheErrorCode2["NotConnected"] = "NOT_CONNECTED";
+  CofheErrorCode2["MissingPublicClient"] = "MISSING_PUBLIC_CLIENT";
+  CofheErrorCode2["MissingWalletClient"] = "MISSING_WALLET_CLIENT";
+  CofheErrorCode2["MissingProviderParam"] = "MISSING_PROVIDER_PARAM";
+  CofheErrorCode2["EmptySecurityZonesParam"] = "EMPTY_SECURITY_ZONES_PARAM";
+  CofheErrorCode2["InvalidACPData"] = "INVALID_ACP_DATA";
+  CofheErrorCode2["InvalidACPDomain"] = "INVALID_ACP_DOMAIN";
+  CofheErrorCode2["ACPNotFound"] = "ACP_NOT_FOUND";
+  CofheErrorCode2["CannotRemoveLastACP"] = "CANNOT_REMOVE_LAST_ACP";
+  CofheErrorCode2["AccountUninitialized"] = "ACCOUNT_UNINITIALIZED";
+  CofheErrorCode2["ChainIdUninitialized"] = "CHAIN_ID_UNINITIALIZED";
+  CofheErrorCode2["ConsumingContractUninitialized"] = "CONSUMING_CONTRACT_UNINITIALIZED";
+  CofheErrorCode2["SealOutputFailed"] = "SEAL_OUTPUT_FAILED";
+  CofheErrorCode2["SealOutputReturnedNull"] = "SEAL_OUTPUT_RETURNED_NULL";
+  CofheErrorCode2["InvalidUtype"] = "INVALID_UTYPE";
+  CofheErrorCode2["DecryptFailed"] = "DECRYPT_FAILED";
+  CofheErrorCode2["DecryptReturnedNull"] = "DECRYPT_RETURNED_NULL";
+  CofheErrorCode2["ZkMocksInsertCtHashesFailed"] = "ZK_MOCKS_INSERT_CT_HASHES_FAILED";
+  CofheErrorCode2["ZkMocksCalcCtHashesFailed"] = "ZK_MOCKS_CALC_CT_HASHES_FAILED";
+  CofheErrorCode2["ZkMocksVerifySignFailed"] = "ZK_MOCKS_VERIFY_SIGN_FAILED";
+  CofheErrorCode2["ZkMocksCreateProofSignatureFailed"] = "ZK_MOCKS_CREATE_PROOF_SIGNATURE_FAILED";
+  CofheErrorCode2["ZkVerifyFailed"] = "ZK_VERIFY_FAILED";
+  CofheErrorCode2["ZkPackFailed"] = "ZK_PACK_FAILED";
+  CofheErrorCode2["ZkProveFailed"] = "ZK_PROVE_FAILED";
+  CofheErrorCode2["EncryptRemainingInItems"] = "ENCRYPT_REMAINING_IN_ITEMS";
+  CofheErrorCode2["ZkUninitialized"] = "ZK_UNINITIALIZED";
+  CofheErrorCode2["ZkVerifierUrlUninitialized"] = "ZK_VERIFIER_URL_UNINITIALIZED";
+  CofheErrorCode2["ThresholdNetworkUrlUninitialized"] = "THRESHOLD_NETWORK_URL_UNINITIALIZED";
+  CofheErrorCode2["MissingConfig"] = "MISSING_CONFIG";
+  CofheErrorCode2["UnsupportedChain"] = "UNSUPPORTED_CHAIN";
+  CofheErrorCode2["MissingZkBuilderAndCrsGenerator"] = "MISSING_ZK_BUILDER_AND_CRS_GENERATOR";
+  CofheErrorCode2["MissingTfhePublicKeyDeserializer"] = "MISSING_TFHE_PUBLIC_KEY_DESERIALIZER";
+  CofheErrorCode2["MissingCompactPkeCrsDeserializer"] = "MISSING_COMPACT_PKE_CRS_DESERIALIZER";
+  CofheErrorCode2["MissingFheKey"] = "MISSING_FHE_KEY";
+  CofheErrorCode2["MissingCrs"] = "MISSING_CRS";
+  CofheErrorCode2["FetchKeysFailed"] = "FETCH_KEYS_FAILED";
+  CofheErrorCode2["PublicWalletGetChainIdFailed"] = "PUBLIC_WALLET_GET_CHAIN_ID_FAILED";
+  CofheErrorCode2["PublicWalletGetAddressesFailed"] = "PUBLIC_WALLET_GET_ADDRESSES_FAILED";
+  CofheErrorCode2["RehydrateKeysStoreFailed"] = "REHYDRATE_KEYS_STORE_FAILED";
+  CofheErrorCode2["BadRequest"] = "BAD_REQUEST";
+  CofheErrorCode2["UnknownChain"] = "UNKNOWN_CHAIN";
+  CofheErrorCode2["ACPMalformed"] = "ACP_MALFORMED";
+  CofheErrorCode2["ACPDenied"] = "ACP_DENIED";
+  CofheErrorCode2["ACPExpired"] = "ACP_EXPIRED";
+  CofheErrorCode2["ACPInvalid"] = "ACP_INVALID";
+  CofheErrorCode2["ACPRevoked"] = "ACP_REVOKED";
+  CofheErrorCode2["NotPubliclyAllowed"] = "NOT_PUBLICLY_ALLOWED";
+  CofheErrorCode2["CtNotFound"] = "CT_NOT_FOUND";
+  CofheErrorCode2["UnsupportedSecurityZone"] = "UNSUPPORTED_SECURITY_ZONE";
+  CofheErrorCode2["UnsupportedType"] = "UNSUPPORTED_TYPE";
+  CofheErrorCode2["SigningFailed"] = "SIGNING_FAILED";
+  CofheErrorCode2["CtSourceError"] = "CT_SOURCE_ERROR";
+  CofheErrorCode2["ACPVerifierError"] = "ACP_VERIFIER_ERROR";
+  CofheErrorCode2["CtSourceTimeout"] = "CT_SOURCE_TIMEOUT";
+  CofheErrorCode2["ACPVerifierTimeout"] = "ACP_VERIFIER_TIMEOUT";
+  CofheErrorCode2["ACPRequired"] = "ACP_REQUIRED";
+  CofheErrorCode2["SealFailed"] = "SEAL_FAILED";
+  return CofheErrorCode2;
 })(CofheErrorCode || {});
 var CofheError = class _CofheError extends Error {
   code;
   cause;
   hint;
   context;
-  constructor({ code, message, cause, hint, context }) {
+  apiErrorCode;
+  constructor({ code, message, cause, hint, context, apiErrorCode }) {
     const fullMessage = cause ? `${message} | Caused by: ${cause.message}` : message;
     super(fullMessage);
     this.name = "CofheError";
@@ -69,6 +89,7 @@ var CofheError = class _CofheError extends Error {
     this.cause = cause;
     this.hint = hint;
     this.context = context;
+    this.apiErrorCode = apiErrorCode;
     if (Error.captureStackTrace) {
       Error.captureStackTrace(this, _CofheError);
     }
@@ -87,6 +108,7 @@ var CofheError = class _CofheError extends Error {
       message: wrapperError?.message ?? "An internal error occurred",
       hint: wrapperError?.hint,
       context: wrapperError?.context,
+      apiErrorCode: wrapperError?.apiErrorCode,
       cause
     });
   }
@@ -100,6 +122,7 @@ var CofheError = class _CofheError extends Error {
       message: this.message,
       hint: this.hint,
       context: this.context,
+      apiErrorCode: this.apiErrorCode,
       cause: this.cause ? {
         name: this.cause.name,
         message: this.cause.message,
@@ -112,7 +135,8 @@ var CofheError = class _CofheError extends Error {
    * Returns a human-readable string representation of the error
    */
   toString() {
-    const parts = [`${this.name} [${this.code}]: ${this.message}`];
+    const codeSuffix = this.apiErrorCode ? ` (api: ${this.apiErrorCode})` : "";
+    const parts = [`${this.name} [${this.code}]${codeSuffix}: ${this.message}`];
     if (this.hint) {
       parts.push(`Hint: ${this.hint}`);
     }
@@ -198,10 +222,6 @@ var FheAllUTypes = [
   // FheTypes.Uint256,
   7 /* Uint160 */
 ];
-function assertCorrectEncryptedItemInput(input) {
-  if (!input.signature.startsWith("0x"))
-    throw new Error("Signature must be a hex string starting with 0x");
-}
 var EncryptableFactoriesImpl = {
   bool: (data, securityZone = 0) => ({ data, securityZone, utype: 0 /* Bool */ }),
   address: (data, securityZone = 0) => ({ data, securityZone, utype: 7 /* Uint160 */ }),
@@ -481,18 +501,19 @@ var constructZkPoKMetadata = (accountAddr, securityZone, chainId) => {
   metadata.set(chainIdBytes, 1 + accountBytes.length);
   return metadata;
 };
-var zkVerify = async (verifierUrl, serializedBytes, address, securityZone, chainId) => {
+var zkVerifyBatch = async (verifierUrl, serializedBytes, address, securityZone, chainId, consumingContract) => {
   const packed_list = toHexString(serializedBytes);
   const sz_byte = new Uint8Array([securityZone]);
   const payload = {
     packed_list,
     account_addr: address,
     security_zone: sz_byte[0],
-    chain_id: chainId
+    chain_id: chainId,
+    contract_address: consumingContract
   };
   const body = JSON.stringify(payload);
   try {
-    const response = await fetch(`${verifierUrl}/verify`, {
+    const response = await fetch(`${verifierUrl}/verifyBatch`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -503,26 +524,25 @@ var zkVerify = async (verifierUrl, serializedBytes, address, securityZone, chain
       const errorBody = await response.text();
       throw new CofheError({
         code: "ZK_VERIFY_FAILED" /* ZkVerifyFailed */,
-        message: `HTTP error! ZK proof verification failed - ${errorBody}`
+        message: `HTTP error! ZK batch proof verification failed - ${errorBody}`
       });
     }
     const json = await response.json();
     if (json.status !== "success") {
       throw new CofheError({
         code: "ZK_VERIFY_FAILED" /* ZkVerifyFailed */,
-        message: `ZK proof verification response malformed - ${json.error}`
+        message: `ZK batch proof verification response malformed - ${json.error}`
       });
     }
-    return json.data.map(({ ct_hash, signature, recid }) => {
-      return {
-        ct_hash,
-        signature: concatSigRecid(signature, recid)
-      };
-    });
+    const { ciphertexts, signature, recid } = json.data;
+    return {
+      outputs: ciphertexts,
+      signature: concatSigRecid(signature, recid)
+    };
   } catch (e) {
     throw new CofheError({
       code: "ZK_VERIFY_FAILED" /* ZkVerifyFailed */,
-      message: `ZK proof verification failed`,
+      message: `ZK batch proof verification failed`,
       cause: e instanceof Error ? e : void 0
     });
   }
@@ -767,75 +787,67 @@ async function insertCtHashes(items, walletClient) {
     });
   }
 }
-async function createProofSignatures(items, securityZone, account) {
-  let signatures = [];
-  let encInputSignerClient;
+async function createBatchProofSignature(items, securityZone, account, consumingContract) {
   try {
-    encInputSignerClient = createMockZkVerifierSigner();
-  } catch (err) {
-    throw new CofheError({
-      code: "ZK_MOCKS_CREATE_PROOF_SIGNATURE_FAILED" /* ZkMocksCreateProofSignatureFailed */,
-      message: `mockZkVerifySign createProofSignatures failed while creating wallet client`,
-      cause: err instanceof Error ? err : void 0,
-      context: {
-        MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY
-      }
+    const itemHashes = items.map(
+      (item) => keccak256(
+        encodePacked(
+          ["uint256", "uint8", "uint8", "address", "uint256", "address"],
+          [
+            BigInt(item.ctHash),
+            item.utype,
+            securityZone,
+            account,
+            BigInt(hardhat.id),
+            consumingContract
+          ]
+        )
+      )
+    );
+    const batchDigest = keccak256(
+      encodePacked(
+        itemHashes.map(() => "bytes32"),
+        itemHashes
+      )
+    );
+    return await sign({
+      hash: batchDigest,
+      privateKey: MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY,
+      to: "hex"
     });
-  }
-  try {
-    for (const item of items) {
-      const packedData = encodePacked(
-        ["uint256", "uint8", "uint8", "address", "uint256"],
-        [BigInt(item.ctHash), item.utype, securityZone, account, BigInt(hardhat.id)]
-      );
-      const messageHash = keccak256(packedData);
-      const signature = await sign({
-        hash: messageHash,
-        privateKey: MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY,
-        to: "hex"
-      });
-      signatures.push(signature);
-    }
   } catch (err) {
     throw new CofheError({
       code: "ZK_MOCKS_CREATE_PROOF_SIGNATURE_FAILED" /* ZkMocksCreateProofSignatureFailed */,
-      message: `mockZkVerifySign createProofSignatures failed while calling signMessage`,
+      message: `mockZkVerifySign createBatchProofSignature failed while signing the batch digest`,
       cause: err instanceof Error ? err : void 0,
       context: {
         items,
-        securityZone
-      }
-    });
-  }
-  if (signatures.length !== items.length) {
-    throw new CofheError({
-      code: "ZK_MOCKS_CREATE_PROOF_SIGNATURE_FAILED" /* ZkMocksCreateProofSignatureFailed */,
-      message: `mockZkVerifySign createProofSignatures returned incorrect number of signatures`,
-      context: {
-        items,
-        securityZone
+        securityZone,
+        consumingContract
       }
     });
   }
-  return signatures;
 }
-async function cofheMocksZkVerifySign(items, account, securityZone, publicClient, walletClient, zkvWalletClient) {
+async function cofheMocksZkVerifySign(items, account, securityZone, consumingContract, publicClient, walletClient, zkvWalletClient) {
   const _walletClient = zkvWalletClient ?? createMockZkVerifierSigner();
   const encryptableItems = await calcCtHashes(items, account, securityZone, publicClient);
   await insertCtHashes(encryptableItems, _walletClient);
-  const signatures = await createProofSignatures(encryptableItems, securityZone, account);
-  return encryptableItems.map((item, index) => ({
-    ct_hash: item.ctHash.toString(),
-    signature: signatures[index]
-  }));
+  const signature = await createBatchProofSignature(encryptableItems, securityZone, account, consumingContract);
+  return {
+    outputs: encryptableItems.map((item) => ({
+      ct_hash: item.ctHash.toString(),
+      ct_type: item.utype
+    })),
+    signature
+  };
 }
 var CofheConfigSchema = z.object({
   /** Environment that the SDK is running in */
   environment: z.enum(["node", "hardhat", "web", "react"]).optional().default("node"),
   /** List of supported chain configurations */
   supportedChains: z.array(z.custom()),
-  /** Default permit expiration in seconds, default is 30 days */
-  defaultPermitExpiration: z.number().optional().default(60 * 60 * 24 * 30),
+  /** Default acp expiration in seconds, default is 30 days */
+  defaultACPExpiration: z.number().optional().default(60 * 60 * 24 * 30),
   /** Storage method for fhe keys (defaults to indexedDB on web, filesystem on node) */
   fheKeyStorage: z.object({
     getItem: z.custom((val) => typeof val === "function", {
@@ -850,6 +862,12 @@ var CofheConfigSchema = z.object({
   }).or(z.null()).default(null),
   /** Whether to use Web Workers for ZK proof generation (web platform only) */
   useWorkers: z.boolean().optional().default(true),
+  /** ACP acp defaults */
+  acp: z.object({
+    defaultRevoker: z.custom().optional(),
+    defaultContractScopes: z.custom().optional(),
+    sharingRegistry: z.custom().optional()
+  }).optional().default({}),
   /** Mocks configs */
   mocks: z.object({
     decryptDelay: z.number().optional().default(0),
@@ -860,8 +878,19 @@ var CofheConfigSchema = z.object({
     zkvWalletClient: z.any().optional()
   }).optional()
 });
+var RENAMED_COFHE_CONFIG_KEYS = {
+  defaultPermitExpiration: "defaultACPExpiration"
+};
+function assertNoRenamedConfigKeys(config, renamedKeys, label) {
+  const stale = Object.keys(config).filter((key) => key in renamedKeys);
+  if (stale.length === 0)
+    return;
+  const renames = stale.map((key) => `\`${key}\` is now \`${renamedKeys[key]}\``).join("; ");
+  throw new Error(`Invalid ${label}: ${renames}. See the v0.7.0 migration guide.`);
+}
 function createCofheConfigBase(config) {
-  const result = CofheConfigSchema.safeParse(config);
+  assertNoRenamedConfigKeys(config, RENAMED_COFHE_CONFIG_KEYS, "cofhe configuration");
+  const result = CofheConfigSchema.strict().safeParse(config);
   if (!result.success) {
     throw new Error(`Invalid cofhe configuration: ${z.prettifyError(result.error)}`, { cause: result.error });
   }
@@ -1213,9 +1242,9 @@ var BaseBuilder = class {
 // core/encrypt/encryptInputsBuilder.ts
 var EncryptInputsBuilder = class extends BaseBuilder {
   securityZone;
+  consumingContract;
   stepCallback;
   inputItems;
-  hpp = false;
   zkvWalletClient;
   tfhePublicKeyDeserializer;
   compactPkeCrsDeserializer;
@@ -1282,20 +1311,6 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     this.keysStorage = params.keysStorage;
     this.useWorker = params.config?.useWorkers ?? true;
   }
-  /**
-   * @param account - Account that will create the tx using the encrypted inputs.
-   *
-   * If not provided, the account will be fetched from the connected walletClient.
-   *
-   * Example:
-   * ```typescript
-   * const encrypted = await encryptInputs([Encryptable.uint128(10n)])
-   *   .setAccount("0x123")
-   *   .execute();
-   * ```
-   *
-   * @returns The chainable EncryptInputsBuilder instance.
-   */
   setAccount(account) {
     this.account = account;
     return this;
@@ -1303,20 +1318,6 @@ var EncryptInputsBuilder = class extends BaseBuilder {
   getAccount() {
     return this.account;
   }
-  /**
-   * @param chainId - Chain that will consume the encrypted inputs.
-   *
-   * If not provided, the chainId will be fetched from the connected publicClient.
-   *
-   * Example:
-   * ```typescript
-   * const encrypted = await encryptInputs([Encryptable.uint128(10n)])
-   *   .setChainId(11155111)
-   *   .execute();
-   * ```
-   *
-   * @returns The chainable EncryptInputsBuilder instance.
-   */
   setChainId(chainId) {
     this.chainId = chainId;
     return this;
@@ -1324,20 +1325,6 @@ var EncryptInputsBuilder = class extends BaseBuilder {
   getChainId() {
     return this.chainId;
   }
-  /**
-   * @param securityZone - Security zone to encrypt the inputs for.
-   *
-   * If not provided, the default securityZone 0 will be used.
-   *
-   * Example:
-   * ```typescript
-   * const encrypted = await encryptInputs([Encryptable.uint128(10n)])
-   *   .setSecurityZone(1)
-   *   .execute();
-   * ```
-   *
-   * @returns The chainable EncryptInputsBuilder instance.
-   */
   setSecurityZone(securityZone) {
     this.securityZone = securityZone;
     return this;
@@ -1346,33 +1333,44 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     return this.securityZone;
   }
   /**
+   * @param address - The contract that will consume the resulting hashes+signature (i.e. the
+   * contract that will call `FHE.asEuint*`/`FHE.asEuint*s` with them).
+   *
+   * Required before `execute()` - the verifier binds this address into the signed digest, so a
+   * batch signed for one contract cannot be replayed into another.
+   *
    * Example:
    * ```typescript
    * const encrypted = await encryptInputs([Encryptable.uint128(10n)])
-   *   .asHashPlusProof()
+   *   .setConsumingContract("0x123...890")
    *   .execute();
    * ```
    *
-   * @returns Chainable EncryptInputsBuilder instance that will return a HashPlusProofResult instead of an array of EncryptedItemInputs.
+   * @returns The chainable EncryptInputsBuilder instance.
    */
-  asHashPlusProof() {
-    this.hpp = true;
+  setConsumingContract(address) {
+    this.consumingContract = address;
     return this;
   }
+  getConsumingContract() {
+    return this.consumingContract;
+  }
   /**
-   * @param useWorker - Whether to use Web Workers for ZK proof generation.
-   *
-   * Overrides the config-level useWorkers setting for this specific encryption.
-   *
-   * Example:
-   * ```typescript
-   * const encrypted = await encryptInputs([Encryptable.uint128(10n)])
-   *   .setUseWorker(false)
-   *   .execute();
-   * ```
-   *
-   * @returns The chainable EncryptInputsBuilder instance.
+   * Asserts that this.consumingContract is populated
+   * @throws {CofheError} If consumingContract is not set
    */
+  assertConsumingContract() {
+    if (this.consumingContract)
+      return;
+    throw new CofheError({
+      code: "CONSUMING_CONTRACT_UNINITIALIZED" /* ConsumingContractUninitialized */,
+      message: "Consuming contract is not set",
+      hint: "Use setConsumingContract(...) to set the contract that will consume the encrypted inputs.",
+      context: {
+        consumingContract: this.consumingContract
+      }
+    });
+  }
   setUseWorker(useWorker) {
     this.useWorker = useWorker;
     return this;
@@ -1393,21 +1391,6 @@ var EncryptInputsBuilder = class extends BaseBuilder {
   getUseWorker() {
     return this.useWorker;
   }
-  /**
-   * @param callback - Function to be called with the encryption step.
-   *
-   * Useful for debugging and tracking the progress of the encryption process.
-   * Useful for a UI element that shows the progress of the encryption process.
-   *
-   * Example:
-   * ```typescript
-   * const encrypted = await encryptInputs([Encryptable.uint128(10n)])
-   *   .onStep((step: EncryptStep) => console.log(step))
-   *   .execute();
-   * ```
-   *
-   * @returns The EncryptInputsBuilder instance.
-   */
   onStep(callback) {
     this.stepCallback = callback;
     return this;
@@ -1546,6 +1529,7 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     this.assertAccount();
     this.assertPublicClient();
     this.assertWalletClient();
+    this.assertConsumingContract();
     const [initTfheDelay, fetchKeysDelay, packDelay, proveDelay, verifyDelay] = this.resolveEncryptDelays();
     this.fireStepStart("initTfhe" /* InitTfhe */);
     await sleep(initTfheDelay);
@@ -1571,22 +1555,17 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     this.fireStepEnd("prove" /* Prove */, { isMocks: true, mockSleep: proveDelay });
     this.fireStepStart("verify" /* Verify */);
     await sleep(verifyDelay);
-    const signedResults = await cofheMocksZkVerifySign(
+    const result = await cofheMocksZkVerifySign(
       this.inputItems,
       this.account,
       this.securityZone,
+      this.consumingContract,
       this.publicClient,
       this.walletClient,
       this.zkvWalletClient
     );
-    const encryptedInputs = signedResults.map(({ ct_hash, signature }, index) => ({
-      ctHash: BigInt(ct_hash),
-      securityZone: this.securityZone,
-      utype: this.inputItems[index].utype,
-      signature
-    }));
     this.fireStepEnd("verify" /* Verify */, { isMocks: true, mockSleep: verifyDelay });
-    return encryptedInputs;
+    return result;
   }
   /**
    * In the production context, perform a true encryption with the CoFHE coprocessor.
@@ -1594,6 +1573,7 @@ var EncryptInputsBuilder = class extends BaseBuilder {
   async productionExecute() {
     this.assertAccount();
     this.assertChainId();
+    this.assertConsumingContract();
     this.fireStepStart("initTfhe" /* InitTfhe */);
     const tfheInitializationExecuted = await this.initTfheOrThrow();
     this.fireStepEnd("initTfhe" /* InitTfhe */, { tfheInitializationExecuted });
@@ -1628,26 +1608,24 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     });
     this.fireStepStart("verify" /* Verify */);
     const zkVerifierUrl = await this.getZkVerifierUrl();
-    const verifyResults = await zkVerify(zkVerifierUrl, proof, this.account, this.securityZone, this.chainId);
-    const encryptedInputs = verifyResults.map(
-      ({ ct_hash, signature }, index) => ({
-        ctHash: BigInt(ct_hash),
-        securityZone: this.securityZone,
-        utype: this.inputItems[index].utype,
-        signature
-      })
+    const result = await zkVerifyBatch(
+      zkVerifierUrl,
+      proof,
+      this.account,
+      this.securityZone,
+      this.chainId,
+      this.consumingContract
     );
     this.fireStepEnd("verify" /* Verify */);
-    return encryptedInputs;
+    return result;
   }
-  structsToHashPlusProof(inItems) {
-    let hashes = [];
-    let proof = "";
-    for (const item of inItems) {
-      hashes.push("0x" + item.ctHash.toString(16).padStart(64, "0"));
-      proof += item.signature;
-    }
-    return [...hashes, proof];
+  /**
+   * Converts a batch-verified result (per-item ctHash/ctType + one shared signature) into the
+   * tuple returned by `execute()`: per-item hashes in input order, followed by the single signature.
+   */
+  buildBatchResult(result) {
+    const hashes = result.outputs.map((output) => "0x" + BigInt(output.ct_hash).toString(16).padStart(64, "0"));
+    return [...hashes, result.signature];
   }
   /**
    * Final step of the encryption process. MUST BE CALLED LAST IN THE CHAIN.
@@ -1669,102 +1647,329 @@ var EncryptInputsBuilder = class extends BaseBuilder {
    * @returns The encrypted inputs.
    */
   async execute() {
-    let items;
+    let result;
     if (this.chainId === hardhat.id)
-      items = await this.mocksExecute();
+      result = await this.mocksExecute();
     else
-      items = await this.productionExecute();
-    if (this.hpp)
-      return this.structsToHashPlusProof(items);
-    return items;
+      result = await this.productionExecute();
+    return this.buildBatchResult(result);
   }
 };
-var storeActivePermit = async (permit, publicClient, walletClient) => {
+var ACP_VALIDATOR_ABI = parseAbi([
+  "function revokeSingle(uint256 id)",
+  "function revokeAllExisting()",
+  "function disabled(address issuer, uint256 id) view returns (bool)"
+]);
+var storeACP = async (acp, publicClient, walletClient) => {
   const chainId = await publicClient.getChainId();
   const account = walletClient.account.address;
-  permitStore.setPermit(chainId, account, permit);
-  permitStore.setActivePermitHash(chainId, account, permit.hash);
+  acpStore.setACP(chainId, account, acp);
 };
-var createPermitWithSign = async (options, publicClient, walletClient, permitMethod) => {
-  const permit = await permitMethod(options, publicClient, walletClient);
-  await storeActivePermit(permit, publicClient, walletClient);
-  return permit;
+var storeActiveACP = async (acp, publicClient, walletClient) => {
+  await storeACP(acp, publicClient, walletClient);
+  const chainId = await publicClient.getChainId();
+  const account = walletClient.account.address;
+  acpStore.setActiveACPHash(chainId, account, acp.hash);
+};
+var createACPWithSign = async (options, publicClient, walletClient, acpMethod, activate = true) => {
+  const acp = await acpMethod(options, publicClient, walletClient);
+  if (activate) {
+    await storeActiveACP(acp, publicClient, walletClient);
+  } else {
+    await storeACP(acp, publicClient, walletClient);
+  }
+  return acp;
 };
 var createSelf = async (options, publicClient, walletClient) => {
-  return createPermitWithSign(options, publicClient, walletClient, PermitUtils.createSelfAndSign);
+  return createACPWithSign(options, publicClient, walletClient, ACPUtils.createSelfAndSign);
 };
 var createSharing = async (options, publicClient, walletClient) => {
-  return createPermitWithSign(options, publicClient, walletClient, PermitUtils.createSharingAndSign);
+  return createACPWithSign(options, publicClient, walletClient, ACPUtils.createSharingAndSign, false);
 };
 var importShared = async (options, publicClient, walletClient) => {
-  return createPermitWithSign(options, publicClient, walletClient, PermitUtils.importSharedAndSign);
+  return createACPWithSign(options, publicClient, walletClient, ACPUtils.importSharedAndSign);
 };
-var getHash = (permit) => {
-  return PermitUtils.getHash(permit);
+var getHash = (acp) => {
+  return ACPUtils.getHash(acp);
 };
-var exportShared = (permit) => {
-  return PermitUtils.export(permit);
+var exportShared = (acp) => {
+  return ACPUtils.export(acp);
 };
-var serialize = (permit) => {
-  return PermitUtils.serialize(permit);
+var serialize = (acp) => {
+  return ACPUtils.serialize(acp);
 };
 var deserialize = (serialized) => {
-  return PermitUtils.deserialize(serialized);
+  return ACPUtils.deserialize(serialized);
 };
-var getPermit = (chainId, account, hash) => {
-  return permitStore.getPermit(chainId, account, hash);
+var getACP = (chainId, account, hash) => {
+  return acpStore.getACP(chainId, account, hash);
 };
-var getPermits = (chainId, account) => {
-  return permitStore.getPermits(chainId, account);
+var getACPs = (chainId, account) => {
+  return acpStore.getACPs(chainId, account);
 };
-var getActivePermit = (chainId, account) => {
-  return permitStore.getActivePermit(chainId, account);
+var getActiveACP = (chainId, account) => {
+  return acpStore.getActiveACP(chainId, account);
 };
-var getActivePermitHash = (chainId, account) => {
-  return permitStore.getActivePermitHash(chainId, account);
+var getActiveACPHash = (chainId, account) => {
+  return acpStore.getActiveACPHash(chainId, account);
 };
-var selectActivePermit = (chainId, account, hash) => {
-  permitStore.setActivePermitHash(chainId, account, hash);
+var selectActiveACP = (chainId, account, hash) => {
+  acpStore.setActiveACPHash(chainId, account, hash);
 };
-var getOrCreateSelfPermit = async (publicClient, walletClient, chainId, account, options) => {
+var getOrCreateSelfACP = async (publicClient, walletClient, chainId, account, options) => {
   const _chainId = chainId ?? await publicClient.getChainId();
   const _account = account ?? walletClient.account.address;
-  const activePermit = await getActivePermit(_chainId, _account);
-  if (activePermit && activePermit.type === "self") {
-    return activePermit;
+  const activeACP = await getActiveACP(_chainId, _account);
+  if (activeACP && activeACP.type === "self" && ACPUtils.isValid(activeACP).valid) {
+    return activeACP;
   }
-  return createSelf(options ?? { issuer: _account, name: "Autogenerated Self Permit" }, publicClient, walletClient);
+  return createSelf(options ?? { issuer: _account, name: "Autogenerated Self ACP" }, publicClient, walletClient);
 };
-var getOrCreateSharingPermit = async (publicClient, walletClient, options, chainId, account) => {
+var getOrCreateSharingACP = async (publicClient, walletClient, options, chainId, account) => {
   const _chainId = chainId ?? await publicClient.getChainId();
   const _account = account ?? walletClient.account.address;
-  const activePermit = await getActivePermit(_chainId, _account);
-  if (activePermit && activePermit.type === "sharing") {
-    return activePermit;
+  const activeACP = await getActiveACP(_chainId, _account);
+  if (activeACP && activeACP.type === "sharing" && ACPUtils.isValid(activeACP).valid) {
+    return activeACP;
   }
   return createSharing(options, publicClient, walletClient);
 };
-var removePermit = async (chainId, account, hash) => permitStore.removePermit(chainId, account, hash);
-var removeActivePermit = async (chainId, account) => permitStore.removeActivePermitHash(chainId, account);
-var permits = {
-  getSnapshot: permitStore.store.getState,
-  subscribe: permitStore.store.subscribe,
+var applyACPDefaults = (options, acpConfig, chainId) => {
+  const result = { ...options };
+  const defaultRevoker = acpConfig?.defaultRevoker?.[chainId];
+  const hasValidatorOptions = options.revokerData != null || options.revokerContract != null;
+  if (defaultRevoker != null && !hasValidatorOptions) {
+    result.revokerContract = defaultRevoker;
+    result.revokerData = Math.round(Date.now() / 1e3) - 60;
+  }
+  const defaultContracts = acpConfig?.defaultContractScopes?.[chainId];
+  const hasScopeOptions = options.scope != null || options.contracts != null || options.handles != null;
+  if (defaultContracts != null && defaultContracts.length > 0 && !hasScopeOptions) {
+    result.contracts = defaultContracts;
+  }
+  return result;
+};
+var ACL_SERVED_ADDRESSES_ABI = parseAbi([
+  "function acl() view returns (address)",
+  "function defaultRevokerContract() view returns (address)",
+  "function shareRegistry() view returns (address)"
+]);
+var aclServedAddressesCache = /* @__PURE__ */ new Map();
+var clearAclServedAddresses = () => aclServedAddressesCache.clear();
+var getAclServedAddresses = async (publicClient, chainId) => {
+  const cached = aclServedAddressesCache.get(chainId);
+  if (cached != null)
+    return cached;
+  let aclAddress;
+  try {
+    aclAddress = await publicClient.readContract({
+      address: TASK_MANAGER_ADDRESS,
+      abi: ACL_SERVED_ADDRESSES_ABI,
+      functionName: "acl"
+    });
+  } catch {
+    return {};
+  }
+  const [defaultRevoker, shareRegistry] = await Promise.all([
+    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "defaultRevokerContract" }).catch(() => void 0),
+    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "shareRegistry" }).catch(() => void 0)
+  ]);
+  const resolved = {
+    defaultRevoker: defaultRevoker != null && defaultRevoker !== zeroAddress ? defaultRevoker : void 0,
+    shareRegistry: shareRegistry != null && shareRegistry !== zeroAddress ? shareRegistry : void 0
+  };
+  aclServedAddressesCache.set(chainId, resolved);
+  return resolved;
+};
+var applyACPDefaultsFromChain = async (options, acpConfig, publicClient, chainId) => {
+  const hasExplicitRevoker = acpConfig?.defaultRevoker?.[chainId] != null || options.revokerData != null || options.revokerContract != null;
+  if (hasExplicitRevoker)
+    return applyACPDefaults(options, acpConfig, chainId);
+  const served = await getAclServedAddresses(publicClient, chainId);
+  const effectiveConfig = served.defaultRevoker != null ? { ...acpConfig, defaultRevoker: { ...acpConfig?.defaultRevoker, [chainId]: served.defaultRevoker } } : acpConfig;
+  return applyACPDefaults(options, effectiveConfig, chainId);
+};
+var revokeACP = async (acp, walletClient) => {
+  if (acp.revokerContract === zeroAddress || acp.revokerData === 0) {
+    throw new Error("ACP is not revocable: it has no revoker (revokerContract/revokerData unset)");
+  }
+  if (walletClient.account == null)
+    throw new Error("Missing walletClient account");
+  if (walletClient.account.address.toLowerCase() !== acp.issuer.toLowerCase()) {
+    throw new Error("Only the acp issuer can revoke it");
+  }
+  return walletClient.writeContract({
+    address: acp.revokerContract,
+    abi: ACP_VALIDATOR_ABI,
+    functionName: "revokeSingle",
+    args: [BigInt(acp.revokerData)],
+    account: walletClient.account,
+    chain: walletClient.chain
+  });
+};
+var revokeAllACPs = async (walletClient, publicClient, revokerContract) => {
+  if (walletClient.account == null)
+    throw new Error("Missing walletClient account");
+  let revoker = revokerContract;
+  if (revoker == null) {
+    const chainId = await publicClient.getChainId();
+    const active = getActiveACP(chainId, walletClient.account.address);
+    revoker = active?.revokerContract;
+  }
+  if (revoker == null || revoker === zeroAddress) {
+    throw new Error("No revoker contract: pass `revokerContract` or activate a revocable acp first");
+  }
+  return walletClient.writeContract({
+    address: revoker,
+    abi: ACP_VALIDATOR_ABI,
+    functionName: "revokeAllExisting",
+    args: [],
+    account: walletClient.account,
+    chain: walletClient.chain
+  });
+};
+var isACPRevoked = async (acp, publicClient) => {
+  if (acp.revokerContract === zeroAddress || acp.revokerData === 0)
+    return false;
+  return publicClient.readContract({
+    address: acp.revokerContract,
+    abi: ACP_VALIDATOR_ABI,
+    functionName: "disabled",
+    args: [acp.issuer, BigInt(acp.revokerData)]
+  });
+};
+var ACP_SHARE_REGISTRY_ABI = parseAbi([
+  "struct ACP { address issuer; uint64 expiration; address recipient; uint256 revokerData; address revokerContract; uint8 scope; address[] contracts; bytes32[] handles; bytes32 sealingKey; bytes issuerSignature; bytes recipientSignature; }",
+  "function share(ACP calldata acp) external returns (bytes32)",
+  "function removeShare(bytes32 shareId) external",
+  "function sharesFor(address recipient) external view returns (ACP[] memory)",
+  "function getShare(bytes32 shareId) external view returns (ACP memory)",
+  "function isShareValid(bytes32 shareId) external view returns (bool)"
+]);
+var ACP_TUPLE = [
+  {
+    type: "tuple",
+    components: [
+      { name: "issuer", type: "address" },
+      { name: "expiration", type: "uint64" },
+      { name: "recipient", type: "address" },
+      { name: "revokerData", type: "uint256" },
+      { name: "revokerContract", type: "address" },
+      { name: "scope", type: "uint8" },
+      { name: "contracts", type: "address[]" },
+      { name: "handles", type: "bytes32[]" },
+      { name: "sealingKey", type: "bytes32" },
+      { name: "issuerSignature", type: "bytes" },
+      { name: "recipientSignature", type: "bytes" }
+    ]
+  }
+];
+var ZERO_BYTES32 = `0x${"0".repeat(64)}`;
+var toChainShare = (acp) => {
+  const pub = ACPUtils.getPublic(acp, true);
+  return {
+    ...pub,
+    expiration: BigInt(pub.expiration),
+    revokerData: BigInt(pub.revokerData),
+    sealingKey: ZERO_BYTES32,
+    recipientSignature: "0x"
+  };
+};
+var computeShareId = (acp) => {
+  const p = toChainShare(acp);
+  return keccak256(encodeAbiParameters(ACP_TUPLE, [p]));
+};
+var shareOnChain = async (acp, walletClient, registry) => {
+  if (acp.type !== "sharing") {
+    throw new Error(`Cannot share a '${acp.type}' ACP on-chain \u2014 only 'sharing' ACPs are shareable.`);
+  }
+  if (acp.issuerSignature === "0x") {
+    throw new Error("Cannot share an unsigned sharing ACP \u2014 sign it first.");
+  }
+  if (walletClient.account == null)
+    throw new Error("Missing walletClient account");
+  if (walletClient.account.address.toLowerCase() !== acp.issuer.toLowerCase()) {
+    throw new Error("Only the ACP issuer can share it on-chain");
+  }
+  const txHash = await walletClient.writeContract({
+    address: registry,
+    abi: ACP_SHARE_REGISTRY_ABI,
+    functionName: "share",
+    args: [toChainShare(acp)],
+    account: walletClient.account,
+    chain: walletClient.chain ?? null
+  });
+  return { txHash, shareId: computeShareId(acp) };
+};
+var getIncomingShares = async (publicClient, registry, recipient) => {
+  const raw = await publicClient.readContract({
+    address: registry,
+    abi: ACP_SHARE_REGISTRY_ABI,
+    functionName: "sharesFor",
+    args: [recipient]
+  });
+  return raw.map((s) => ({
+    shareId: keccak256(encodeAbiParameters(ACP_TUPLE, [s])),
+    issuer: s.issuer,
+    expiration: Number(s.expiration),
+    recipient: s.recipient,
+    revokerData: Number(s.revokerData),
+    revokerContract: s.revokerContract,
+    scope: Number(s.scope),
+    contracts: [...s.contracts],
+    handles: [...s.handles],
+    issuerSignature: s.issuerSignature
+  }));
+};
+var importFromChain = async (share, publicClient, walletClient) => {
+  const { shareId: _shareId, ...options } = share;
+  return importShared({ ...options, type: "sharing" }, publicClient, walletClient);
+};
+var removeShareOnChain = async (shareId, walletClient, registry) => {
+  if (walletClient.account == null)
+    throw new Error("Missing walletClient account");
+  return walletClient.writeContract({
+    address: registry,
+    abi: ACP_SHARE_REGISTRY_ABI,
+    functionName: "removeShare",
+    args: [shareId],
+    account: walletClient.account,
+    chain: walletClient.chain ?? null
+  });
+};
+var removeACP = async (chainId, account, hash) => acpStore.removeACP(chainId, account, hash);
+var removeActiveACP = async (chainId, account) => acpStore.removeActiveACPHash(chainId, account);
+var acps = {
+  getSnapshot: acpStore.store.getState,
+  subscribe: acpStore.store.subscribe,
   createSelf,
   createSharing,
   importShared,
-  getOrCreateSelfPermit,
-  getOrCreateSharingPermit,
+  getOrCreateSelfACP,
+  getOrCreateSharingACP,
   getHash,
   export: exportShared,
   serialize,
   deserialize,
-  getPermit,
-  getPermits,
-  getActivePermit,
-  getActivePermitHash,
-  removePermit,
-  selectActivePermit,
-  removeActivePermit
+  getACP,
+  getACPs,
+  getActiveACP,
+  getActiveACPHash,
+  removeACP,
+  selectActiveACP,
+  removeActiveACP,
+  revokeACP,
+  revokeAllACPs,
+  isACPRevoked,
+  shareOnChain,
+  getIncomingShares,
+  importFromChain,
+  removeShareOnChain,
+  computeShareId,
+  applyACPDefaults,
+  applyACPDefaultsFromChain,
+  getAclServedAddresses,
+  clearAclServedAddresses
 };
 function uint160ToAddress(uint160) {
   const hexStr = uint160.toString(16).padStart(40, "0");
@@ -1827,13 +2032,16 @@ var MockThresholdNetworkAbi = [
       {
         name: "permission",
         type: "tuple",
-        internalType: "struct Permission",
+        internalType: "struct ACPermission",
         components: [
           { name: "issuer", type: "address", internalType: "address" },
           { name: "expiration", type: "uint64", internalType: "uint64" },
           { name: "recipient", type: "address", internalType: "address" },
-          { name: "validatorId", type: "uint256", internalType: "uint256" },
-          { name: "validatorContract", type: "address", internalType: "address" },
+          { name: "revokerData", type: "uint256", internalType: "uint256" },
+          { name: "revokerContract", type: "address", internalType: "address" },
+          { name: "scope", type: "uint8", internalType: "uint8" },
+          { name: "contracts", type: "address[]", internalType: "address[]" },
+          { name: "handles", type: "bytes32[]", internalType: "bytes32[]" },
           { name: "sealingKey", type: "bytes32", internalType: "bytes32" },
           { name: "issuerSignature", type: "bytes", internalType: "bytes" },
           { name: "recipientSignature", type: "bytes", internalType: "bytes" }
@@ -1856,13 +2064,16 @@ var MockThresholdNetworkAbi = [
       {
         name: "permission",
         type: "tuple",
-        internalType: "struct Permission",
+        internalType: "struct ACPermission",
         components: [
           { name: "issuer", type: "address", internalType: "address" },
           { name: "expiration", type: "uint64", internalType: "uint64" },
           { name: "recipient", type: "address", internalType: "address" },
-          { name: "validatorId", type: "uint256", internalType: "uint256" },
-          { name: "validatorContract", type: "address", internalType: "address" },
+          { name: "revokerData", type: "uint256", internalType: "uint256" },
+          { name: "revokerContract", type: "address", internalType: "address" },
+          { name: "scope", type: "uint8", internalType: "uint8" },
+          { name: "contracts", type: "address[]", internalType: "address[]" },
+          { name: "handles", type: "bytes32[]", internalType: "bytes32[]" },
           { name: "sealingKey", type: "bytes32", internalType: "bytes32" },
           { name: "issuerSignature", type: "bytes", internalType: "bytes" },
           { name: "recipientSignature", type: "bytes", internalType: "bytes" }
@@ -1927,19 +2138,22 @@ var MockThresholdNetworkAbi = [
   },
   {
     type: "function",
-    name: "decryptForTxWithPermit",
+    name: "decryptForTxWithACP",
     inputs: [
       { name: "ctHash", type: "uint256", internalType: "uint256" },
       {
         name: "permission",
         type: "tuple",
-        internalType: "struct Permission",
+        internalType: "struct ACPermission",
         components: [
           { name: "issuer", type: "address", internalType: "address" },
           { name: "expiration", type: "uint64", internalType: "uint64" },
           { name: "recipient", type: "address", internalType: "address" },
-          { name: "validatorId", type: "uint256", internalType: "uint256" },
-          { name: "validatorContract", type: "address", internalType: "address" },
+          { name: "revokerData", type: "uint256", internalType: "uint256" },
+          { name: "revokerContract", type: "address", internalType: "address" },
+          { name: "scope", type: "uint8", internalType: "uint8" },
+          { name: "contracts", type: "address[]", internalType: "address[]" },
+          { name: "handles", type: "bytes32[]", internalType: "bytes32[]" },
           { name: "sealingKey", type: "bytes32", internalType: "bytes32" },
           { name: "issuerSignature", type: "bytes", internalType: "bytes" },
           { name: "recipientSignature", type: "bytes", internalType: "bytes" }
@@ -1955,7 +2169,7 @@ var MockThresholdNetworkAbi = [
   },
   {
     type: "function",
-    name: "decryptForTxWithoutPermit",
+    name: "decryptForTxWithoutACP",
     inputs: [{ name: "ctHash", type: "uint256", internalType: "uint256" }],
     outputs: [
       { name: "allowed", type: "bool", internalType: "bool" },
@@ -1967,12 +2181,12 @@ var MockThresholdNetworkAbi = [
 ];
 
 // core/decrypt/cofheMocksDecryptForView.ts
-async function cofheMocksDecryptForView(ctHash, utype, permit, publicClient) {
-  const permission = PermitUtils.getPermission(permit, true);
+async function cofheMocksDecryptForView(ctHash, utype, acp, publicClient) {
+  const wireAcp = ACPUtils.getPublic(acp, true);
   const permissionWithBigInts = {
-    ...permission,
-    expiration: BigInt(permission.expiration),
-    validatorId: BigInt(permission.validatorId)
+    ...wireAcp,
+    expiration: BigInt(wireAcp.expiration),
+    revokerData: BigInt(wireAcp.revokerData)
   };
   const [allowed, error, result] = await publicClient.readContract({
     address: MOCKS_THRESHOLD_NETWORK_ADDRESS,
@@ -1993,11 +2207,41 @@ async function cofheMocksDecryptForView(ctHash, utype, permit, publicClient) {
     });
   }
   const sealedBigInt = BigInt(result);
-  const sealingKeyBigInt = BigInt(permission.sealingKey);
+  const sealingKeyBigInt = BigInt(acp.sealingKey);
   const unsealed = sealedBigInt ^ sealingKeyBigInt;
   return unsealed;
 }
 
+// core/debug.ts
+var interceptors = {};
+function setCofheDebugInterceptors(next) {
+  interceptors.onRequest = next?.onRequest;
+  interceptors.onResponse = next?.onResponse;
+}
+function getCofheDebugInterceptors() {
+  return interceptors;
+}
+async function cofheFetch(url, init, ctx = { op: "request" }) {
+  let finalUrl = url;
+  let finalInit = init;
+  if (interceptors.onRequest) {
+    const override = await interceptors.onRequest(finalUrl, finalInit, ctx);
+    if (override) {
+      if (override.url !== void 0)
+        finalUrl = override.url;
+      if (override.init !== void 0)
+        finalInit = override.init;
+    }
+  }
+  let response = await fetch(finalUrl, finalInit);
+  if (interceptors.onResponse) {
+    const replaced = await interceptors.onResponse(response, ctx);
+    if (replaced)
+      response = replaced;
+  }
+  return response;
+}
+
 // core/decrypt/polling.ts
 function computeMinuteRampPollIntervalMs(elapsedMs, params) {
   const elapsedSeconds = Math.floor(elapsedMs / 1e3);
@@ -2006,11 +2250,61 @@ function computeMinuteRampPollIntervalMs(elapsedMs, params) {
   return Math.min(params.maxIntervalMs, Math.max(params.minIntervalMs, intervalMs));
 }
 
+// core/decrypt/apiError.ts
+var BACKEND_ERROR_CODE_TO_COFHE_ERROR_CODE = {
+  bad_request: "BAD_REQUEST" /* BadRequest */,
+  unknown_chain: "UNKNOWN_CHAIN" /* UnknownChain */,
+  acp_malformed: "ACP_MALFORMED" /* ACPMalformed */,
+  acp_denied: "ACP_DENIED" /* ACPDenied */,
+  // ACP-era backends fold revoked into denied
+  acp_expired: "ACP_EXPIRED" /* ACPExpired */,
+  acp_invalid: "ACP_INVALID" /* ACPInvalid */,
+  acp_required: "ACP_REQUIRED" /* ACPRequired */,
+  acp_verifier_error: "ACP_VERIFIER_ERROR" /* ACPVerifierError */,
+  acp_verifier_timeout: "ACP_VERIFIER_TIMEOUT" /* ACPVerifierTimeout */,
+  not_publicly_allowed: "NOT_PUBLICLY_ALLOWED" /* NotPubliclyAllowed */,
+  ct_not_found: "CT_NOT_FOUND" /* CtNotFound */,
+  unsupported_security_zone: "UNSUPPORTED_SECURITY_ZONE" /* UnsupportedSecurityZone */,
+  unsupported_type: "UNSUPPORTED_TYPE" /* UnsupportedType */,
+  internal_error: "INTERNAL_ERROR" /* InternalError */,
+  signing_failed: "SIGNING_FAILED" /* SigningFailed */,
+  ct_source_error: "CT_SOURCE_ERROR" /* CtSourceError */,
+  ct_source_timeout: "CT_SOURCE_TIMEOUT" /* CtSourceTimeout */,
+  seal_failed: "SEAL_FAILED" /* SealFailed */
+};
+function isBackendApiErrorCode(value) {
+  return value in BACKEND_ERROR_CODE_TO_COFHE_ERROR_CODE;
+}
+async function parseApiErrorResponseBody(response) {
+  let errorMessage = `HTTP ${response.status}`;
+  let apiErrorCode;
+  try {
+    const body = await response.json();
+    if (body && typeof body === "object") {
+      const record = body;
+      if (typeof record.error === "string" && record.error.length > 0) {
+        apiErrorCode = record.error;
+      }
+      if (typeof record.error_message === "string" && record.error_message.length > 0) {
+        errorMessage = record.error_message;
+      } else if (typeof record.message === "string" && record.message.length > 0) {
+        errorMessage = record.message;
+      }
+    }
+  } catch {
+    errorMessage = response.statusText || errorMessage;
+  }
+  return { apiErrorCode, errorMessage };
+}
+function mapApiErrorCodeToCofheErrorCode(apiErrorCode, fallback) {
+  if (apiErrorCode && isBackendApiErrorCode(apiErrorCode)) {
+    return BACKEND_ERROR_CODE_TO_COFHE_ERROR_CODE[apiErrorCode];
+  }
+  return fallback;
+}
+
 // core/decrypt/submitRetry.ts
 var DEFAULT_404_RETRY_TIMEOUT_MS = 1e4;
-function isRetryableSubmitStatus(status) {
-  return status === 204 || status === 404;
-}
 function normalize404RetryTimeoutMs(params) {
   const { timeoutMs, operationLabel, errorCode } = params;
   if (timeoutMs === void 0)
@@ -2027,32 +2321,24 @@ function normalize404RetryTimeoutMs(params) {
   return timeoutMs;
 }
 async function classifySubmitResponse(params) {
-  const { response, extractErrorMessage } = params;
-  if (isRetryableSubmitStatus(response.status)) {
-    return { kind: "retryable", status: response.status };
+  const { response, fallbackErrorCode } = params;
+  if (response.status === 204) {
+    return { kind: "retryable", status: 204 };
   }
   if (response.ok) {
     return { kind: "parse-json" };
   }
-  let errorMessage = `HTTP ${response.status}`;
-  try {
-    const errorBody = await response.json();
-    const maybeErrorMessage = extractErrorMessage?.(errorBody);
-    if (typeof maybeErrorMessage === "string" && maybeErrorMessage.length > 0) {
-      errorMessage = maybeErrorMessage;
-    } else if (errorBody && typeof errorBody === "object") {
-      const defaultMessage = errorBody.error_message;
-      const fallbackMessage = errorBody.message;
-      if (typeof defaultMessage === "string" && defaultMessage.length > 0) {
-        errorMessage = defaultMessage;
-      } else if (typeof fallbackMessage === "string" && fallbackMessage.length > 0) {
-        errorMessage = fallbackMessage;
-      }
-    }
-  } catch {
-    errorMessage = response.statusText || errorMessage;
+  const { apiErrorCode, errorMessage } = await parseApiErrorResponseBody(response);
+  if (response.status === 404) {
+    return { kind: "retryable", status: 404, apiErrorMessage: errorMessage };
   }
-  return { kind: "fatal-http", errorMessage };
+  return {
+    kind: "fatal-http",
+    status: response.status,
+    cofheErrorCode: mapApiErrorCodeToCofheErrorCode(apiErrorCode, fallbackErrorCode),
+    apiErrorCode,
+    errorMessage
+  };
 }
 function throwIfSubmitRetryTimedOut(params) {
   const {
@@ -2064,12 +2350,14 @@ function throwIfSubmitRetryTimedOut(params) {
     overallTimeoutMs,
     thresholdNetworkUrl,
     body,
-    attemptIndex
+    attemptIndex,
+    lastKnownErrorMessage
   } = params;
   if (status === 404 && elapsedMs > retry404TimeoutMs) {
     throw new CofheError({
-      code: errorCode,
-      message: `${operationLabel} submit retried 404 responses without receiving request_id for ${retry404TimeoutMs}ms`,
+      code: "CT_NOT_FOUND" /* CtNotFound */,
+      apiErrorCode: "ct_not_found",
+      message: `${operationLabel} ciphertext not found after retrying for ${retry404TimeoutMs}ms` + (lastKnownErrorMessage ? `: ${lastKnownErrorMessage}` : ""),
       hint: "The ciphertext may not be indexed yet. Increase set404RetryTimeout(...) if the backend is slow to index ciphertexts.",
       context: {
         thresholdNetworkUrl,
@@ -2095,6 +2383,62 @@ function throwIfSubmitRetryTimedOut(params) {
     });
   }
 }
+function normalizeTnSignature(signature) {
+  if (typeof signature !== "string") {
+    throw new CofheError({
+      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
+      message: "decrypt response missing signature",
+      context: {
+        signature
+      }
+    });
+  }
+  const trimmed = signature.trim();
+  if (trimmed.length === 0) {
+    throw new CofheError({
+      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
+      message: "decrypt response returned empty signature"
+    });
+  }
+  const prefixed = trimmed.startsWith("0x") ? trimmed : `0x${trimmed}`;
+  const parsed = parseSignature(prefixed);
+  return serializeSignature(parsed);
+}
+function parseDecryptedBytesToBigInt(decrypted) {
+  if (!Array.isArray(decrypted)) {
+    throw new CofheError({
+      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
+      message: "decrypt response field <decrypted> must be a byte array",
+      context: {
+        decrypted
+      }
+    });
+  }
+  if (decrypted.length === 0) {
+    throw new CofheError({
+      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
+      message: "decrypt response field <decrypted> was an empty byte array",
+      context: {
+        decrypted
+      }
+    });
+  }
+  let hex = "";
+  for (const b of decrypted) {
+    if (typeof b !== "number" || !Number.isInteger(b) || b < 0 || b > 255) {
+      throw new CofheError({
+        code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
+        message: "decrypt response field <decrypted> contained a non-byte value",
+        context: {
+          badElement: b,
+          decrypted
+        }
+      });
+    }
+    hex += b.toString(16).padStart(2, "0");
+  }
+  return BigInt(`0x${hex}`);
+}
 
 // core/decrypt/tnSealOutputV2.ts
 var POLL_INTERVAL_MS = 1e3;
@@ -2157,23 +2501,28 @@ function parseCompletedSealOutputResponse(params) {
   }
   return convertSealedData(sealed);
 }
-async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, permission, overallStartTime, retry404TimeoutMs, onPoll) {
+async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, acp, overallStartTime, retry404TimeoutMs, onPoll) {
   const body = {
     ct_tempkey: BigInt(ctHash).toString(16).padStart(64, "0"),
     host_chain_id: chainId,
-    permit: permission
+    acp
   };
   let attemptIndex = 0;
+  let last404ApiErrorMessage;
   for (; ; ) {
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput`,
+        /*op:sealoutput*/
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
@@ -2187,16 +2536,19 @@ async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, per
         }
       });
     }
-    const responseClassification = await classifySubmitResponse({ response });
+    const responseClassification = await classifySubmitResponse({
+      response,
+      fallbackErrorCode: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */
+    });
     if (responseClassification.kind === "fatal-http") {
       throw new CofheError({
-        code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
+        code: responseClassification.cofheErrorCode,
+        apiErrorCode: responseClassification.apiErrorCode,
         message: `sealOutput request failed: ${responseClassification.errorMessage}`,
         hint: "Check the threshold network URL and request parameters.",
         context: {
           thresholdNetworkUrl,
-          status: response.status,
-          statusText: response.statusText,
+          status: responseClassification.status,
           body,
           attemptIndex
         }
@@ -2242,6 +2594,9 @@ async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, per
         }
       });
     }
+    if (responseClassification.status === 404) {
+      last404ApiErrorMessage = responseClassification.apiErrorMessage;
+    }
     const elapsedMs = Date.now() - overallStartTime;
     throwIfSubmitRetryTimedOut({
       operationLabel: "sealOutput",
@@ -2252,7 +2607,8 @@ async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, per
       overallTimeoutMs: SEAL_OUTPUT_TIMEOUT_MS,
       thresholdNetworkUrl,
       body,
-      attemptIndex
+      attemptIndex,
+      lastKnownErrorMessage: last404ApiErrorMessage
     });
     onPoll?.({
       operation: "sealoutput",
@@ -2296,12 +2652,16 @@ async function pollSealOutputStatus(thresholdNetworkUrl, requestId, overallStart
     }
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput/${requestId}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json"
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput/${requestId}`,
+        /*op:sealoutput-poll*/
+        {
+          method: "GET",
+          headers: {
+            "Content-Type": "application/json"
+          }
         }
-      });
+      );
     } catch (e) {
       throw new CofheError({
         code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
@@ -2326,15 +2686,10 @@ async function pollSealOutputStatus(thresholdNetworkUrl, requestId, overallStart
       });
     }
     if (!response.ok) {
-      let errorMessage = `HTTP ${response.status}`;
-      try {
-        const errorBody = await response.json();
-        errorMessage = errorBody.error_message || errorBody.message || errorMessage;
-      } catch {
-        errorMessage = response.statusText || errorMessage;
-      }
+      const { apiErrorCode, errorMessage } = await parseApiErrorResponseBody(response);
       throw new CofheError({
-        code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
+        code: mapApiErrorCodeToCofheErrorCode(apiErrorCode, "SEAL_OUTPUT_FAILED" /* SealOutputFailed */),
+        apiErrorCode,
         message: `sealOutput status poll failed: ${errorMessage}`,
         context: {
           thresholdNetworkUrl,
@@ -2378,7 +2733,7 @@ async function pollSealOutputStatus(thresholdNetworkUrl, requestId, overallStart
   });
 }
 async function tnSealOutputV2(params) {
-  const { thresholdNetworkUrl, ctHash, chainId, permission, retry404TimeoutMs, onPoll } = params;
+  const { thresholdNetworkUrl, ctHash, chainId, acp, retry404TimeoutMs, onPoll } = params;
   const normalized404RetryTimeoutMs = normalize404RetryTimeoutMs({
     timeoutMs: retry404TimeoutMs,
     operationLabel: "sealOutput",
@@ -2389,7 +2744,7 @@ async function tnSealOutputV2(params) {
     thresholdNetworkUrl,
     ctHash,
     chainId,
-    permission,
+    acp,
     overallStartTime,
     normalized404RetryTimeoutMs,
     onPoll
@@ -2405,8 +2760,8 @@ var DEFAULT_404_RETRY_TIMEOUT_MS2 = 1e4;
 var DecryptForViewBuilder = class extends BaseBuilder {
   ctHash;
   utype;
-  permitHash;
-  permit;
+  acpHash;
+  acp;
   pollCallback;
   retry404TimeoutMs = DEFAULT_404_RETRY_TIMEOUT_MS2;
   constructor(params) {
@@ -2420,11 +2775,11 @@ var DecryptForViewBuilder = class extends BaseBuilder {
     });
     this.ctHash = params.ctHash;
     this.utype = params.utype;
-    this.permitHash = params.permitHash;
-    this.permit = params.permit;
+    this.acpHash = params.acpHash;
+    this.acp = params.acp;
   }
   /**
-   * @param chainId - Chain to decrypt values from. Used to fetch the threshold network URL and use the correct permit.
+   * @param chainId - Chain to decrypt values from. Used to fetch the threshold network URL and use the correct acp.
    *
    * If not provided, the chainId will be fetched from the connected publicClient.
    *
@@ -2445,7 +2800,7 @@ var DecryptForViewBuilder = class extends BaseBuilder {
     return this.chainId;
   }
   /**
-   * @param account - Account to decrypt values from. Used to fetch the correct permit.
+   * @param account - Account to decrypt values from. Used to fetch the correct acp.
    *
    * If not provided, the account will be fetched from the connected walletClient.
    *
@@ -2482,61 +2837,61 @@ var DecryptForViewBuilder = class extends BaseBuilder {
     this.retry404TimeoutMs = timeoutMs;
     return this;
   }
-  withPermit(permitOrPermitHash) {
-    if (typeof permitOrPermitHash === "string") {
-      this.permitHash = permitOrPermitHash;
-      this.permit = void 0;
-    } else if (permitOrPermitHash === void 0) {
-      this.permitHash = void 0;
-      this.permit = void 0;
+  withACP(acpOrACPHash) {
+    if (typeof acpOrACPHash === "string") {
+      this.acpHash = acpOrACPHash;
+      this.acp = void 0;
+    } else if (acpOrACPHash === void 0) {
+      this.acpHash = void 0;
+      this.acp = void 0;
     } else {
-      this.permit = permitOrPermitHash;
-      this.permitHash = void 0;
+      this.acp = acpOrACPHash;
+      this.acpHash = void 0;
     }
     return this;
   }
   /**
-   * @param permitHash - Permit hash to decrypt values from. Used to fetch the correct permit.
+   * @param acpHash - ACP hash to decrypt values from. Used to fetch the correct acp.
    *
-   * If not provided, the active permit for the chainId and account will be used.
-   * If `setPermit()` is called, it will be used regardless of chainId, account, or permitHash.
+   * If not provided, the active acp for the chainId and account will be used.
+   * If `setACP()` is called, it will be used regardless of chainId, account, or acpHash.
    *
    * Example:
    * ```typescript
    * const unsealed = await client.decryptForView(ctHash, utype)
-   *   .setPermitHash('0x1234567890123456789012345678901234567890')
+   *   .setACPHash('0x1234567890123456789012345678901234567890')
    *   .execute();
    * ```
    *
    * @returns The chainable DecryptForViewBuilder instance.
    */
-  /** @deprecated Use `withPermit(permitHash)` instead. */
-  setPermitHash(permitHash) {
-    return this.withPermit(permitHash);
+  /** @deprecated Use `withACP(acpHash)` instead. */
+  setACPHash(acpHash) {
+    return this.withACP(acpHash);
   }
-  getPermitHash() {
-    return this.permitHash;
+  getACPHash() {
+    return this.acpHash;
   }
   /**
-   * @param permit - Permit to decrypt values with. If provided, it will be used regardless of chainId, account, or permitHash.
+   * @param acp - ACP to decrypt values with. If provided, it will be used regardless of chainId, account, or acpHash.
    *
-   * If not provided, the permit will be determined by chainId, account, and permitHash.
+   * If not provided, the acp will be determined by chainId, account, and acpHash.
    *
    * Example:
    * ```typescript
    * const unsealed = await client.decryptForView(ctHash, utype)
-   *   .setPermit(permit)
+   *   .setACP(acp)
    *   .execute();
    * ```
    *
    * @returns The chainable DecryptForViewBuilder instance.
    */
-  /** @deprecated Use `withPermit(permit)` instead. */
-  setPermit(permit) {
-    return this.withPermit(permit);
+  /** @deprecated Use `withACP(acp)` instead. */
+  setACP(acp) {
+    return this.withACP(acp);
   }
-  getPermit() {
-    return this.permit;
+  getACP() {
+    return this.acp;
   }
   async getThresholdNetworkUrl() {
     this.assertChainId();
@@ -2552,77 +2907,77 @@ var DecryptForViewBuilder = class extends BaseBuilder {
         }
       });
   }
-  async getResolvedPermit() {
-    if (this.permit)
-      return this.permit;
+  async getResolvedACP() {
+    if (this.acp)
+      return this.acp;
     this.assertChainId();
     this.assertAccount();
-    if (this.permitHash) {
-      const permit2 = await permits.getPermit(this.chainId, this.account, this.permitHash);
-      if (!permit2) {
+    if (this.acpHash) {
+      const acp2 = await acps.getACP(this.chainId, this.account, this.acpHash);
+      if (!acp2) {
         throw new CofheError({
-          code: "PERMIT_NOT_FOUND" /* PermitNotFound */,
-          message: `Permit with hash <${this.permitHash}> not found for account <${this.account}> and chainId <${this.chainId}>`,
-          hint: "Ensure the permit exists and is valid.",
+          code: "ACP_NOT_FOUND" /* ACPNotFound */,
+          message: `ACP with hash <${this.acpHash}> not found for account <${this.account}> and chainId <${this.chainId}>`,
+          hint: "Ensure the acp exists and is valid.",
           context: {
             chainId: this.chainId,
             account: this.account,
-            permitHash: this.permitHash
+            acpHash: this.acpHash
           }
         });
       }
-      return permit2;
+      return acp2;
     }
-    const permit = await permits.getActivePermit(this.chainId, this.account);
-    if (!permit) {
+    const acp = await acps.getActiveACP(this.chainId, this.account);
+    if (!acp) {
       throw new CofheError({
-        code: "PERMIT_NOT_FOUND" /* PermitNotFound */,
-        message: `Active permit not found for chainId <${this.chainId}> and account <${this.account}>`,
-        hint: "Ensure a permit exists for this account on this chain.",
+        code: "ACP_NOT_FOUND" /* ACPNotFound */,
+        message: `Active acp not found for chainId <${this.chainId}> and account <${this.account}>`,
+        hint: "Ensure an ACP exists for this account on this chain.",
         context: {
           chainId: this.chainId,
           account: this.account
         }
       });
     }
-    return permit;
+    return acp;
   }
   /**
    * On hardhat, interact with MockZkVerifier contract instead of CoFHE
    */
-  async mocksSealOutput(permit) {
+  async mocksSealOutput(acp) {
     this.assertPublicClient();
     const mocksDecryptDelay = this.config.mocks.decryptDelay;
     if (mocksDecryptDelay > 0)
       await sleep(mocksDecryptDelay);
-    return cofheMocksDecryptForView(this.ctHash, this.utype, permit, this.publicClient);
+    return cofheMocksDecryptForView(this.ctHash, this.utype, acp, this.publicClient);
   }
   /**
    * In the production context, perform a true decryption with the CoFHE coprocessor.
    */
-  async productionSealOutput(permit) {
+  async productionSealOutput(acp) {
     this.assertChainId();
     this.assertPublicClient();
     const thresholdNetworkUrl = await this.getThresholdNetworkUrl();
-    const permission = PermitUtils.getPermission(permit, true);
+    const wireAcp = ACPUtils.getPublic(acp, true);
     const sealed = await tnSealOutputV2({
       ctHash: this.ctHash,
       chainId: this.chainId,
-      permission,
+      acp: wireAcp,
       thresholdNetworkUrl,
       retry404TimeoutMs: this.retry404TimeoutMs,
       onPoll: this.pollCallback
     });
-    return PermitUtils.unseal(permit, sealed);
+    return ACPUtils.unseal(acp, sealed);
   }
   /**
    * Final step of the decryption process. MUST BE CALLED LAST IN THE CHAIN.
    *
    * This will:
-   * - Use a permit based on provided permit OR chainId + account + permitHash
-   * - Check permit validity
-   * - Call CoFHE `/sealoutput` with the permit, which returns a sealed (encrypted) item
-   * - Unseal the sealed item with the permit
+   * - Use an ACP based on provided acp OR chainId + account + acpHash
+   * - Check acp validity
+   * - Call CoFHE `/sealoutput` with the acp, which returns a sealed (encrypted) item
+   * - Unseal the sealed item with the acp
    * - Return the unsealed item
    *
    * Example:
@@ -2630,7 +2985,7 @@ var DecryptForViewBuilder = class extends BaseBuilder {
    * const unsealed = await client.decryptForView(ctHash, utype)
    *   .setChainId(11155111)      // optional
    *   .setAccount('0x123...890') // optional
-   *   .withPermit()              // optional
+   *   .withACP()              // optional
    *   .execute();                // execute
    * ```
    *
@@ -2638,14 +2993,14 @@ var DecryptForViewBuilder = class extends BaseBuilder {
    */
   async execute() {
     this.validateUtypeOrThrow();
-    const permit = await this.getResolvedPermit();
-    PermitUtils.validate(permit);
-    const chainId = permit._signedDomain.chainId;
+    const acp = await this.getResolvedACP();
+    ACPUtils.validate(acp);
+    const chainId = acp._signedDomain.chainId;
     let unsealed;
     if (chainId === hardhat$1.id) {
-      unsealed = await this.mocksSealOutput(permit);
+      unsealed = await this.mocksSealOutput(acp);
     } else {
-      unsealed = await this.productionSealOutput(permit);
+      unsealed = await this.productionSealOutput(acp);
     }
     return convertViaUtype(this.utype, unsealed);
   }
@@ -2653,28 +3008,28 @@ var DecryptForViewBuilder = class extends BaseBuilder {
 var UINT_TYPE_MASK = 0x7fn;
 var TYPE_BYTE_OFFSET = 8n;
 var getEncryptionTypeFromCtHash = (ctHash) => Number(ctHash >> TYPE_BYTE_OFFSET & UINT_TYPE_MASK);
-async function cofheMocksDecryptForTx(ctHash, utype, permit, publicClient) {
+async function cofheMocksDecryptForTx(ctHash, utype, acp, publicClient) {
   let allowed;
   let error;
   let decryptedValue;
-  if (permit !== null) {
-    let permission = PermitUtils.getPermission(permit, true);
+  if (acp !== null) {
+    const wireAcp = ACPUtils.getPublic(acp, true);
     const permissionWithBigInts = {
-      ...permission,
-      expiration: BigInt(permission.expiration),
-      validatorId: BigInt(permission.validatorId)
+      ...wireAcp,
+      expiration: BigInt(wireAcp.expiration),
+      revokerData: BigInt(wireAcp.revokerData)
     };
     [allowed, error, decryptedValue] = await publicClient.readContract({
       address: MOCKS_THRESHOLD_NETWORK_ADDRESS,
       abi: MockThresholdNetworkAbi,
-      functionName: "decryptForTxWithPermit",
+      functionName: "decryptForTxWithACP",
       args: [BigInt(ctHash), permissionWithBigInts]
     });
   } else {
     [allowed, error, decryptedValue] = await publicClient.readContract({
       address: MOCKS_THRESHOLD_NETWORK_ADDRESS,
       abi: MockThresholdNetworkAbi,
-      functionName: "decryptForTxWithoutPermit",
+      functionName: "decryptForTxWithoutACP",
       args: [BigInt(ctHash)]
     });
   }
@@ -2709,62 +3064,6 @@ async function cofheMocksDecryptForTx(ctHash, utype, permit, publicClient) {
     signature
   };
 }
-function normalizeTnSignature(signature) {
-  if (typeof signature !== "string") {
-    throw new CofheError({
-      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
-      message: "decrypt response missing signature",
-      context: {
-        signature
-      }
-    });
-  }
-  const trimmed = signature.trim();
-  if (trimmed.length === 0) {
-    throw new CofheError({
-      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
-      message: "decrypt response returned empty signature"
-    });
-  }
-  const prefixed = trimmed.startsWith("0x") ? trimmed : `0x${trimmed}`;
-  const parsed = parseSignature(prefixed);
-  return serializeSignature(parsed);
-}
-function parseDecryptedBytesToBigInt(decrypted) {
-  if (!Array.isArray(decrypted)) {
-    throw new CofheError({
-      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
-      message: "decrypt response field <decrypted> must be a byte array",
-      context: {
-        decrypted
-      }
-    });
-  }
-  if (decrypted.length === 0) {
-    throw new CofheError({
-      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
-      message: "decrypt response field <decrypted> was an empty byte array",
-      context: {
-        decrypted
-      }
-    });
-  }
-  let hex = "";
-  for (const b of decrypted) {
-    if (typeof b !== "number" || !Number.isInteger(b) || b < 0 || b > 255) {
-      throw new CofheError({
-        code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
-        message: "decrypt response field <decrypted> contained a non-byte value",
-        context: {
-          badElement: b,
-          decrypted
-        }
-      });
-    }
-    hex += b.toString(16).padStart(2, "0");
-  }
-  return BigInt(`0x${hex}`);
-}
 
 // core/decrypt/tnDecryptV2.ts
 var POLL_INTERVAL_MS2 = 1e3;
@@ -2886,25 +3185,30 @@ function assertDecryptStatusResponseV2(value) {
   }
   return value;
 }
-async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, permission, overallStartTime, retry404TimeoutMs, onPoll) {
+async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, acp, overallStartTime, retry404TimeoutMs, onPoll) {
   const body = {
     ct_tempkey: BigInt(ctHash).toString(16).padStart(64, "0"),
     host_chain_id: chainId
   };
-  if (permission) {
-    body.permit = permission;
+  if (acp) {
+    body.acp = acp;
   }
   let attemptIndex = 0;
+  let last404ApiErrorMessage;
   for (; ; ) {
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt`,
+        /*op:decrypt*/
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: "DECRYPT_FAILED" /* DecryptFailed */,
@@ -2918,16 +3222,19 @@ async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, perm
         }
       });
     }
-    const responseClassification = await classifySubmitResponse({ response });
+    const responseClassification = await classifySubmitResponse({
+      response,
+      fallbackErrorCode: "DECRYPT_FAILED" /* DecryptFailed */
+    });
     if (responseClassification.kind === "fatal-http") {
       throw new CofheError({
-        code: "DECRYPT_FAILED" /* DecryptFailed */,
+        code: responseClassification.cofheErrorCode,
+        apiErrorCode: responseClassification.apiErrorCode,
         message: `decrypt request failed: ${responseClassification.errorMessage}`,
         hint: "Check the threshold network URL and request parameters.",
         context: {
           thresholdNetworkUrl,
-          status: response.status,
-          statusText: response.statusText,
+          status: responseClassification.status,
           body,
           attemptIndex
         }
@@ -2975,6 +3282,9 @@ async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, perm
         }
       });
     }
+    if (responseClassification.status === 404) {
+      last404ApiErrorMessage = responseClassification.apiErrorMessage;
+    }
     const elapsedMs = Date.now() - overallStartTime;
     throwIfSubmitRetryTimedOut({
       operationLabel: "decrypt",
@@ -2985,7 +3295,8 @@ async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, perm
       overallTimeoutMs: DECRYPT_TIMEOUT_MS,
       thresholdNetworkUrl,
       body,
-      attemptIndex
+      attemptIndex,
+      lastKnownErrorMessage: last404ApiErrorMessage
     });
     onPoll?.({
       operation: "decrypt",
@@ -3029,12 +3340,16 @@ async function pollDecryptStatusV2(thresholdNetworkUrl, requestId, overallStartT
     }
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt/${requestId}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json"
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt/${requestId}`,
+        /*op:decrypt-poll*/
+        {
+          method: "GET",
+          headers: {
+            "Content-Type": "application/json"
+          }
         }
-      });
+      );
     } catch (e) {
       throw new CofheError({
         code: "DECRYPT_FAILED" /* DecryptFailed */,
@@ -3059,17 +3374,10 @@ async function pollDecryptStatusV2(thresholdNetworkUrl, requestId, overallStartT
       });
     }
     if (!response.ok) {
-      let errorMessage = `HTTP ${response.status}`;
-      try {
-        const errorBody = await response.json();
-        const maybeMessage = errorBody.error_message || errorBody.message;
-        if (typeof maybeMessage === "string" && maybeMessage.length > 0)
-          errorMessage = maybeMessage;
-      } catch {
-        errorMessage = response.statusText || errorMessage;
-      }
+      const { apiErrorCode, errorMessage } = await parseApiErrorResponseBody(response);
       throw new CofheError({
-        code: "DECRYPT_FAILED" /* DecryptFailed */,
+        code: mapApiErrorCodeToCofheErrorCode(apiErrorCode, "DECRYPT_FAILED" /* DecryptFailed */),
+        apiErrorCode,
         message: `decrypt status poll failed: ${errorMessage}`,
         context: {
           thresholdNetworkUrl,
@@ -3114,7 +3422,7 @@ async function pollDecryptStatusV2(thresholdNetworkUrl, requestId, overallStartT
   });
 }
 async function tnDecryptV2(params) {
-  const { thresholdNetworkUrl, ctHash, chainId, permission, retry404TimeoutMs, onPoll } = params;
+  const { thresholdNetworkUrl, ctHash, chainId, acp, retry404TimeoutMs, onPoll } = params;
   const normalized404RetryTimeoutMs = normalize404RetryTimeoutMs({
     timeoutMs: retry404TimeoutMs,
     operationLabel: "decrypt",
@@ -3125,7 +3433,7 @@ async function tnDecryptV2(params) {
     thresholdNetworkUrl,
     ctHash,
     chainId,
-    permission,
+    acp,
     overallStartTime,
     normalized404RetryTimeoutMs,
     onPoll
@@ -3140,9 +3448,9 @@ async function tnDecryptV2(params) {
 var DEFAULT_404_RETRY_TIMEOUT_MS3 = 1e4;
 var DecryptForTxBuilder = class extends BaseBuilder {
   ctHash;
-  permitHash;
-  permit;
-  permitSelection = "unset";
+  acpHash;
+  acp;
+  acpSelection = "unset";
   pollCallback;
   retry404TimeoutMs = DEFAULT_404_RETRY_TIMEOUT_MS3;
   constructor(params) {
@@ -3187,137 +3495,137 @@ var DecryptForTxBuilder = class extends BaseBuilder {
     this.retry404TimeoutMs = timeoutMs;
     return this;
   }
-  withPermit(permitOrPermitHash) {
-    if (this.permitSelection === "with-permit") {
+  withACP(acpOrACPHash) {
+    if (this.acpSelection === "with-acp") {
       throw new CofheError({
         code: "INTERNAL_ERROR" /* InternalError */,
-        message: "decryptForTx: withPermit() can only be selected once.",
-        hint: "Choose the permit mode once. If you need a different permit, start a new decryptForTx() builder chain."
+        message: "decryptForTx: withACP() can only be selected once.",
+        hint: "Choose the acp mode once. If you need a different acp, start a new decryptForTx() builder chain."
       });
     }
-    if (this.permitSelection === "without-permit") {
+    if (this.acpSelection === "without-acp") {
       throw new CofheError({
         code: "INTERNAL_ERROR" /* InternalError */,
-        message: "decryptForTx: cannot call withPermit() after withoutPermit() has been selected.",
-        hint: "Choose exactly one permit mode: either call .withPermit(...) or .withoutPermit(), but not both."
+        message: "decryptForTx: cannot call withACP() after withoutACP() has been selected.",
+        hint: "Choose exactly one acp mode: either call .withACP(...) or .withoutACP(), but not both."
       });
     }
-    this.permitSelection = "with-permit";
-    if (typeof permitOrPermitHash === "string") {
-      this.permitHash = permitOrPermitHash;
-      this.permit = void 0;
-    } else if (permitOrPermitHash === void 0) {
-      this.permitHash = void 0;
-      this.permit = void 0;
+    this.acpSelection = "with-acp";
+    if (typeof acpOrACPHash === "string") {
+      this.acpHash = acpOrACPHash;
+      this.acp = void 0;
+    } else if (acpOrACPHash === void 0) {
+      this.acpHash = void 0;
+      this.acp = void 0;
     } else {
-      this.permit = permitOrPermitHash;
-      this.permitHash = void 0;
+      this.acp = acpOrACPHash;
+      this.acpHash = void 0;
     }
     return this;
   }
   /**
-   * Select "no permit" mode.
+   * Select "no acp" mode.
    *
-   * This uses global allowance (no permit required) and sends an empty permission payload to `/decrypt`.
+   * This uses global allowance (no acp required) and sends an empty permission payload to `/decrypt`.
    */
-  withoutPermit() {
-    if (this.permitSelection === "without-permit") {
+  withoutACP() {
+    if (this.acpSelection === "without-acp") {
       throw new CofheError({
         code: "INTERNAL_ERROR" /* InternalError */,
-        message: "decryptForTx: withoutPermit() can only be selected once.",
-        hint: "Choose the permit mode once. If you need a different mode, start a new decryptForTx() builder chain."
+        message: "decryptForTx: withoutACP() can only be selected once.",
+        hint: "Choose the acp mode once. If you need a different mode, start a new decryptForTx() builder chain."
       });
     }
-    if (this.permitSelection === "with-permit") {
+    if (this.acpSelection === "with-acp") {
       throw new CofheError({
         code: "INTERNAL_ERROR" /* InternalError */,
-        message: "decryptForTx: cannot call withoutPermit() after withPermit() has been selected.",
-        hint: "Choose exactly one permit mode: either call .withPermit(...) or .withoutPermit(), but not both."
+        message: "decryptForTx: cannot call withoutACP() after withACP() has been selected.",
+        hint: "Choose exactly one acp mode: either call .withACP(...) or .withoutACP(), but not both."
       });
     }
-    this.permitSelection = "without-permit";
-    this.permitHash = void 0;
-    this.permit = void 0;
+    this.acpSelection = "without-acp";
+    this.acpHash = void 0;
+    this.acp = void 0;
     return this;
   }
-  getPermit() {
-    return this.permit;
+  getACP() {
+    return this.acp;
   }
-  getPermitHash() {
-    return this.permitHash;
+  getACPHash() {
+    return this.acpHash;
   }
   async getThresholdNetworkUrl() {
     this.assertChainId();
     return getThresholdNetworkUrlOrThrow(this.config, this.chainId);
   }
-  async getResolvedPermit() {
-    if (this.permitSelection === "unset") {
+  async getResolvedACP() {
+    if (this.acpSelection === "unset") {
       throw new CofheError({
         code: "INTERNAL_ERROR" /* InternalError */,
-        message: "decryptForTx: missing permit selection; call withPermit(...) or withoutPermit() before execute().",
-        hint: "Call .withPermit() to use the active permit, or .withoutPermit() for global allowance."
+        message: "decryptForTx: missing acp selection; call withACP(...) or withoutACP() before execute().",
+        hint: "Call .withACP() to use the active acp, or .withoutACP() for global allowance."
       });
     }
-    if (this.permitSelection === "without-permit") {
+    if (this.acpSelection === "without-acp") {
       return null;
     }
-    if (this.permit)
-      return this.permit;
+    if (this.acp)
+      return this.acp;
     this.assertChainId();
     this.assertAccount();
-    if (this.permitHash) {
-      const permit2 = await permits.getPermit(this.chainId, this.account, this.permitHash);
-      if (!permit2) {
+    if (this.acpHash) {
+      const acp2 = await acps.getACP(this.chainId, this.account, this.acpHash);
+      if (!acp2) {
         throw new CofheError({
-          code: "PERMIT_NOT_FOUND" /* PermitNotFound */,
-          message: `Permit with hash <${this.permitHash}> not found for account <${this.account}> and chainId <${this.chainId}>`,
-          hint: "Ensure the permit exists and is valid.",
+          code: "ACP_NOT_FOUND" /* ACPNotFound */,
+          message: `ACP with hash <${this.acpHash}> not found for account <${this.account}> and chainId <${this.chainId}>`,
+          hint: "Ensure the acp exists and is valid.",
           context: {
             chainId: this.chainId,
             account: this.account,
-            permitHash: this.permitHash
+            acpHash: this.acpHash
           }
         });
       }
-      return permit2;
+      return acp2;
     }
-    const permit = await permits.getActivePermit(this.chainId, this.account);
-    if (!permit) {
+    const acp = await acps.getActiveACP(this.chainId, this.account);
+    if (!acp) {
       throw new CofheError({
-        code: "PERMIT_NOT_FOUND" /* PermitNotFound */,
-        message: `Active permit not found for chainId <${this.chainId}> and account <${this.account}>`,
-        hint: "Create a permit (e.g. client.permits.createSelf(...)) and/or set it active (client.permits.selectActivePermit(hash)).",
+        code: "ACP_NOT_FOUND" /* ACPNotFound */,
+        message: `Active acp not found for chainId <${this.chainId}> and account <${this.account}>`,
+        hint: "Create an ACP (e.g. client.acp.createSelf(...)) and/or set it active (client.acp.selectActiveACP(hash)).",
         context: {
           chainId: this.chainId,
           account: this.account
         }
       });
     }
-    return permit;
+    return acp;
   }
   /**
    * On hardhat, interact with MockThresholdNetwork contract
    */
-  async mocksDecryptForTx(permit) {
+  async mocksDecryptForTx(acp) {
     this.assertPublicClient();
     const delay = this.config.mocks.decryptDelay;
     if (delay > 0)
       await sleep(delay);
-    const result = await cofheMocksDecryptForTx(this.ctHash, 0, permit, this.publicClient);
+    const result = await cofheMocksDecryptForTx(this.ctHash, 0, acp, this.publicClient);
     return result;
   }
   /**
    * In the production context, perform a true decryption with the CoFHE coprocessor.
    */
-  async productionDecryptForTx(permit) {
+  async productionDecryptForTx(acp) {
     this.assertChainId();
     this.assertPublicClient();
     const thresholdNetworkUrl = await this.getThresholdNetworkUrl();
-    const permission = permit ? PermitUtils.getPermission(permit, true) : null;
+    const wireAcp = acp ? ACPUtils.getPublic(acp, true) : null;
     const { decryptedValue, signature } = await tnDecryptV2({
       ctHash: this.ctHash,
       chainId: this.chainId,
-      permission,
+      acp: wireAcp,
       thresholdNetworkUrl,
       retry404TimeoutMs: this.retry404TimeoutMs,
       onPoll: this.pollCallback
@@ -3331,19 +3639,19 @@ var DecryptForTxBuilder = class extends BaseBuilder {
   /**
    * Final step of the decryptForTx process. MUST BE CALLED LAST IN THE CHAIN.
    *
-   * You must explicitly choose one permit mode before calling `execute()`:
-   * - `withPermit(permit)` / `withPermit(permitHash)` / `withPermit()` (active permit)
-   * - `withoutPermit()` (global allowance)
+   * You must explicitly choose one acp mode before calling `execute()`:
+   * - `withACP(acp)` / `withACP(acpHash)` / `withACP()` (active acp)
+   * - `withoutACP()` (global allowance)
    */
   async execute() {
-    const permit = await this.getResolvedPermit();
-    if (permit !== null) {
-      PermitUtils.validate(permit);
-      const chainId = permit._signedDomain.chainId;
+    const acp = await this.getResolvedACP();
+    if (acp !== null) {
+      ACPUtils.validate(acp);
+      const chainId = acp._signedDomain.chainId;
       if (chainId === hardhat$1.id) {
-        return await this.mocksDecryptForTx(permit);
+        return await this.mocksDecryptForTx(acp);
       } else {
-        return await this.productionDecryptForTx(permit);
+        return await this.productionDecryptForTx(acp);
       }
     } else {
       if (!this.chainId) {
@@ -3406,6 +3714,21 @@ function createCofheClientBase(opts) {
   const updateConnectState = (partial) => {
     connectStore.setState((state) => ({ ...state, ...partial }));
   };
+  const _resolveSharingRegistry = async (publicClient, chainId) => {
+    const configured = opts.config.acp?.sharingRegistry?.[chainId];
+    if (configured != null)
+      return configured;
+    const registry = (await acps.getAclServedAddresses(publicClient, chainId)).shareRegistry;
+    if (registry == null) {
+      throw new CofheError({
+        code: "MISSING_CONFIG" /* MissingConfig */,
+        message: `No ACP share registry available for chainId <${chainId}>`,
+        hint: "The ACL on this chain does not serve a share registry address. Set `acp.sharingRegistry` in the cofhe config to use on-chain sharing.",
+        context: { chainId }
+      });
+    }
+    return registry;
+  };
   const _requireConnected = () => {
     const state = connectStore.getState();
     const notConnected = !state.connected || !state.account || !state.chainId || !state.publicClient || !state.walletClient;
@@ -3528,74 +3851,147 @@ function createCofheClientBase(opts) {
     }
     return { chainId: _chainId, account: _account };
   };
-  const clientPermits = {
+  const clientACPs = {
     // Pass through store access
-    getSnapshot: permits.getSnapshot,
-    subscribe: permits.subscribe,
+    getSnapshot: acps.getSnapshot,
+    subscribe: acps.subscribe,
     // Creation methods (require connection)
     createSelf: async (options, clients) => {
       _requireConnected();
       const { publicClient, walletClient } = clients ?? connectStore.getState();
-      return permits.createSelf(options, publicClient, walletClient);
+      const chainId = await publicClient.getChainId();
+      return acps.createSelf(
+        await acps.applyACPDefaultsFromChain(options, opts.config.acp, publicClient, chainId),
+        publicClient,
+        walletClient
+      );
     },
     createSharing: async (options, clients) => {
       _requireConnected();
       const { publicClient, walletClient } = clients ?? connectStore.getState();
-      return permits.createSharing(options, publicClient, walletClient);
+      const chainId = await publicClient.getChainId();
+      return acps.createSharing(
+        await acps.applyACPDefaultsFromChain(options, opts.config.acp, publicClient, chainId),
+        publicClient,
+        walletClient
+      );
     },
     importShared: async (options, clients) => {
       _requireConnected();
       const { publicClient, walletClient } = clients ?? connectStore.getState();
-      return permits.importShared(options, publicClient, walletClient);
+      return acps.importShared(options, publicClient, walletClient);
     },
     // Get or create methods (require connection)
-    getOrCreateSelfPermit: async (chainId, account, options) => {
+    getOrCreateSelfACP: async (chainId, account, options) => {
       _requireConnected();
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
       const { publicClient, walletClient } = connectStore.getState();
-      return permits.getOrCreateSelfPermit(publicClient, walletClient, _chainId, _account, options);
+      const optionsWithDefaults = await acps.applyACPDefaultsFromChain(
+        options ?? { issuer: _account, name: "Autogenerated Self ACP" },
+        opts.config.acp,
+        publicClient,
+        _chainId
+      );
+      return acps.getOrCreateSelfACP(publicClient, walletClient, _chainId, _account, optionsWithDefaults);
     },
-    getOrCreateSharingPermit: async (options, chainId, account) => {
+    getOrCreateSharingACP: async (options, chainId, account) => {
       _requireConnected();
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
       const { publicClient, walletClient } = connectStore.getState();
-      return permits.getOrCreateSharingPermit(publicClient, walletClient, options, _chainId, _account);
+      return acps.getOrCreateSharingACP(
+        publicClient,
+        walletClient,
+        await acps.applyACPDefaultsFromChain(options, opts.config.acp, publicClient, _chainId),
+        _chainId,
+        _account
+      );
+    },
+    // Revocation (require connection)
+    revokeACP: async (acp) => {
+      _requireConnected();
+      const { walletClient } = connectStore.getState();
+      return acps.revokeACP(acp, walletClient);
+    },
+    revokeAllACPs: async (revokerContract) => {
+      _requireConnected();
+      const { publicClient, walletClient } = connectStore.getState();
+      return acps.revokeAllACPs(walletClient, publicClient, revokerContract);
+    },
+    isACPRevoked: async (acp) => {
+      _requireConnected();
+      const { publicClient } = connectStore.getState();
+      return acps.isACPRevoked(acp, publicClient);
+    },
+    // On-chain sharing (require connection + config.acp.sharingRegistry)
+    shareOnChain: async (acp) => {
+      _requireConnected();
+      const { publicClient, walletClient } = connectStore.getState();
+      const chainId = await publicClient.getChainId();
+      const sharingRegistry = await _resolveSharingRegistry(publicClient, chainId);
+      return acps.shareOnChain(acp, walletClient, sharingRegistry);
+    },
+    getIncomingShares: async () => {
+      _requireConnected();
+      const { publicClient, walletClient } = connectStore.getState();
+      const chainId = await publicClient.getChainId();
+      const account = walletClient.account.address;
+      const sharingRegistry = await _resolveSharingRegistry(publicClient, chainId);
+      return acps.getIncomingShares(publicClient, sharingRegistry, account);
+    },
+    importFromChain: async (share) => {
+      _requireConnected();
+      const { publicClient, walletClient } = connectStore.getState();
+      return acps.importFromChain(share, publicClient, walletClient);
+    },
+    dismissShare: async (shareId) => {
+      _requireConnected();
+      const { publicClient, walletClient } = connectStore.getState();
+      const chainId = await publicClient.getChainId();
+      const sharingRegistry = await _resolveSharingRegistry(publicClient, chainId);
+      return acps.removeShareOnChain(shareId, walletClient, sharingRegistry);
+    },
+    cancelShare: async (shareId) => {
+      _requireConnected();
+      const { publicClient, walletClient } = connectStore.getState();
+      const chainId = await publicClient.getChainId();
+      const sharingRegistry = await _resolveSharingRegistry(publicClient, chainId);
+      return acps.removeShareOnChain(shareId, walletClient, sharingRegistry);
     },
     // Retrieval methods (auto-fill chainId/account)
-    getPermit: (hash, chainId, account) => {
+    getACP: (hash, chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.getPermit(_chainId, _account, hash);
+      return acps.getACP(_chainId, _account, hash);
     },
-    getPermits: (chainId, account) => {
+    getACPs: (chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.getPermits(_chainId, _account);
+      return acps.getACPs(_chainId, _account);
     },
-    getActivePermit: (chainId, account) => {
+    getActiveACP: (chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.getActivePermit(_chainId, _account);
+      return acps.getActiveACP(_chainId, _account);
     },
-    getActivePermitHash: (chainId, account) => {
+    getActiveACPHash: (chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.getActivePermitHash(_chainId, _account);
+      return acps.getActiveACPHash(_chainId, _account);
     },
     // Mutation methods (auto-fill chainId/account)
-    selectActivePermit: (hash, chainId, account) => {
+    selectActiveACP: (hash, chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.selectActivePermit(_chainId, _account, hash);
+      return acps.selectActiveACP(_chainId, _account, hash);
     },
-    removePermit: async (hash, chainId, account) => {
+    removeACP: async (hash, chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.removePermit(_chainId, _account, hash);
+      return acps.removeACP(_chainId, _account, hash);
     },
-    removeActivePermit: async (chainId, account) => {
+    removeActiveACP: async (chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.removeActivePermit(_chainId, _account);
+      return acps.removeActiveACP(_chainId, _account);
     },
     // Utils (no context needed)
-    getHash: permits.getHash,
-    export: permits.export,
-    serialize: permits.serialize,
-    deserialize: permits.deserialize
+    getHash: acps.getHash,
+    export: acps.export,
+    serialize: acps.serialize,
+    deserialize: acps.deserialize
   };
   return {
     // Zustand reactive accessors (don't export store directly to prevent mutation)
@@ -3623,7 +4019,7 @@ function createCofheClientBase(opts) {
     decryptHandle: decryptForView,
     decryptForTx,
     verifyDecryptResult: verifyDecryptResult2,
-    permits: clientPermits
+    acp: clientACPs
     // Add SDK-specific methods below that require connection
     // Example:
     // async encryptData(data: unknown) {
@@ -3633,4 +4029,4 @@ function createCofheClientBase(opts) {
   };
 }
 
-export { CofheError, CofheErrorCode, DecryptForTxBuilder, DecryptForViewBuilder, EncryptInputsBuilder, EncryptStep, Encryptable, FheAllUTypes, FheTypes, FheUintUTypes, InitialConnectStore, assertCorrectEncryptedItemInput, createCofheClientBase, createCofheConfigBase, createKeysStore, fetchKeys, fheTypeToString, getCofheConfigItem, isCofheError, isEncryptableItem, isLastEncryptionStep, verifyDecryptResult, zkProveWithWorker };
+export { CofheError, CofheErrorCode, DecryptForTxBuilder, DecryptForViewBuilder, EncryptInputsBuilder, EncryptStep, Encryptable, FheAllUTypes, FheTypes, FheUintUTypes, InitialConnectStore, assertNoRenamedConfigKeys, cofheFetch, createCofheClientBase, createCofheConfigBase, createKeysStore, fetchKeys, fheTypeToString, getCofheConfigItem, getCofheDebugInterceptors, isCofheError, isEncryptableItem, isLastEncryptionStep, setCofheDebugInterceptors, verifyDecryptResult, zkProveWithWorker };