@cofhe/sdk 0.6.0 → 0.7.0

package/dist/node.cjs

@@ -24,7 +24,8 @@ var CofheError = class _CofheError extends Error {
   cause;
   hint;
   context;
-  constructor({ code, message, cause, hint, context }) {
+  apiErrorCode;
+  constructor({ code, message, cause, hint, context, apiErrorCode }) {
     const fullMessage = cause ? `${message} | Caused by: ${cause.message}` : message;
     super(fullMessage);
     this.name = "CofheError";
@@ -32,6 +33,7 @@ var CofheError = class _CofheError extends Error {
     this.cause = cause;
     this.hint = hint;
     this.context = context;
+    this.apiErrorCode = apiErrorCode;
     if (Error.captureStackTrace) {
       Error.captureStackTrace(this, _CofheError);
     }
@@ -50,6 +52,7 @@ var CofheError = class _CofheError extends Error {
       message: wrapperError?.message ?? "An internal error occurred",
       hint: wrapperError?.hint,
       context: wrapperError?.context,
+      apiErrorCode: wrapperError?.apiErrorCode,
       cause
     });
   }
@@ -63,6 +66,7 @@ var CofheError = class _CofheError extends Error {
       message: this.message,
       hint: this.hint,
       context: this.context,
+      apiErrorCode: this.apiErrorCode,
       cause: this.cause ? {
         name: this.cause.name,
         message: this.cause.message,
@@ -75,7 +79,8 @@ var CofheError = class _CofheError extends Error {
    * Returns a human-readable string representation of the error
    */
   toString() {
-    const parts = [`${this.name} [${this.code}]: ${this.message}`];
+    const codeSuffix = this.apiErrorCode ? ` (api: ${this.apiErrorCode})` : "";
+    const parts = [`${this.name} [${this.code}]${codeSuffix}: ${this.message}`];
     if (this.hint) {
       parts.push(`Hint: ${this.hint}`);
     }
@@ -311,18 +316,19 @@ var constructZkPoKMetadata = (accountAddr, securityZone, chainId) => {
   metadata.set(chainIdBytes, 1 + accountBytes.length);
   return metadata;
 };
-var zkVerify = async (verifierUrl, serializedBytes, address, securityZone, chainId) => {
+var zkVerifyBatch = async (verifierUrl, serializedBytes, address, securityZone, chainId, consumingContract) => {
   const packed_list = toHexString(serializedBytes);
   const sz_byte = new Uint8Array([securityZone]);
   const payload = {
     packed_list,
     account_addr: address,
     security_zone: sz_byte[0],
-    chain_id: chainId
+    chain_id: chainId,
+    contract_address: consumingContract
   };
   const body = JSON.stringify(payload);
   try {
-    const response = await fetch(`${verifierUrl}/verify`, {
+    const response = await fetch(`${verifierUrl}/verifyBatch`, {
       method: "POST",
       headers: {
         "Content-Type": "application/json"
@@ -333,26 +339,25 @@ var zkVerify = async (verifierUrl, serializedBytes, address, securityZone, chain
       const errorBody = await response.text();
       throw new CofheError({
         code: "ZK_VERIFY_FAILED" /* ZkVerifyFailed */,
-        message: `HTTP error! ZK proof verification failed - ${errorBody}`
+        message: `HTTP error! ZK batch proof verification failed - ${errorBody}`
       });
     }
     const json = await response.json();
     if (json.status !== "success") {
       throw new CofheError({
         code: "ZK_VERIFY_FAILED" /* ZkVerifyFailed */,
-        message: `ZK proof verification response malformed - ${json.error}`
+        message: `ZK batch proof verification response malformed - ${json.error}`
       });
     }
-    return json.data.map(({ ct_hash, signature, recid }) => {
-      return {
-        ct_hash,
-        signature: concatSigRecid(signature, recid)
-      };
-    });
+    const { ciphertexts, signature, recid } = json.data;
+    return {
+      outputs: ciphertexts,
+      signature: concatSigRecid(signature, recid)
+    };
   } catch (e) {
     throw new CofheError({
       code: "ZK_VERIFY_FAILED" /* ZkVerifyFailed */,
-      message: `ZK proof verification failed`,
+      message: `ZK batch proof verification failed`,
       cause: e instanceof Error ? e : void 0
     });
   }
@@ -597,67 +602,59 @@ async function insertCtHashes(items, walletClient) {
     });
   }
 }
-async function createProofSignatures(items, securityZone, account) {
-  let signatures = [];
-  let encInputSignerClient;
+async function createBatchProofSignature(items, securityZone, account, consumingContract) {
   try {
-    encInputSignerClient = createMockZkVerifierSigner();
-  } catch (err) {
-    throw new CofheError({
-      code: "ZK_MOCKS_CREATE_PROOF_SIGNATURE_FAILED" /* ZkMocksCreateProofSignatureFailed */,
-      message: `mockZkVerifySign createProofSignatures failed while creating wallet client`,
-      cause: err instanceof Error ? err : void 0,
-      context: {
-        MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY
-      }
+    const itemHashes = items.map(
+      (item) => viem.keccak256(
+        viem.encodePacked(
+          ["uint256", "uint8", "uint8", "address", "uint256", "address"],
+          [
+            BigInt(item.ctHash),
+            item.utype,
+            securityZone,
+            account,
+            BigInt(chains.hardhat.id),
+            consumingContract
+          ]
+        )
+      )
+    );
+    const batchDigest = viem.keccak256(
+      viem.encodePacked(
+        itemHashes.map(() => "bytes32"),
+        itemHashes
+      )
+    );
+    return await accounts.sign({
+      hash: batchDigest,
+      privateKey: MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY,
+      to: "hex"
     });
-  }
-  try {
-    for (const item of items) {
-      const packedData = viem.encodePacked(
-        ["uint256", "uint8", "uint8", "address", "uint256"],
-        [BigInt(item.ctHash), item.utype, securityZone, account, BigInt(chains.hardhat.id)]
-      );
-      const messageHash = viem.keccak256(packedData);
-      const signature = await accounts.sign({
-        hash: messageHash,
-        privateKey: MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY,
-        to: "hex"
-      });
-      signatures.push(signature);
-    }
   } catch (err) {
     throw new CofheError({
       code: "ZK_MOCKS_CREATE_PROOF_SIGNATURE_FAILED" /* ZkMocksCreateProofSignatureFailed */,
-      message: `mockZkVerifySign createProofSignatures failed while calling signMessage`,
+      message: `mockZkVerifySign createBatchProofSignature failed while signing the batch digest`,
       cause: err instanceof Error ? err : void 0,
       context: {
         items,
-        securityZone
-      }
-    });
-  }
-  if (signatures.length !== items.length) {
-    throw new CofheError({
-      code: "ZK_MOCKS_CREATE_PROOF_SIGNATURE_FAILED" /* ZkMocksCreateProofSignatureFailed */,
-      message: `mockZkVerifySign createProofSignatures returned incorrect number of signatures`,
-      context: {
-        items,
-        securityZone
+        securityZone,
+        consumingContract
       }
     });
   }
-  return signatures;
 }
-async function cofheMocksZkVerifySign(items, account, securityZone, publicClient, walletClient, zkvWalletClient) {
+async function cofheMocksZkVerifySign(items, account, securityZone, consumingContract, publicClient, walletClient, zkvWalletClient) {
   const _walletClient = zkvWalletClient ?? createMockZkVerifierSigner();
   const encryptableItems = await calcCtHashes(items, account, securityZone, publicClient);
   await insertCtHashes(encryptableItems, _walletClient);
-  const signatures = await createProofSignatures(encryptableItems, securityZone, account);
-  return encryptableItems.map((item, index) => ({
-    ct_hash: item.ctHash.toString(),
-    signature: signatures[index]
-  }));
+  const signature = await createBatchProofSignature(encryptableItems, securityZone, account, consumingContract);
+  return {
+    outputs: encryptableItems.map((item) => ({
+      ct_hash: item.ctHash.toString(),
+      ct_type: item.utype
+    })),
+    signature
+  };
 }
 var EnvironmentSchema = zod.z.enum(["MOCK", "TESTNET", "MAINNET"]);
 var CofheChainSchema = zod.z.object({
@@ -700,8 +697,8 @@ var CofheConfigSchema = zod.z.object({
   environment: zod.z.enum(["node", "hardhat", "web", "react"]).optional().default("node"),
   /** List of supported chain configurations */
   supportedChains: zod.z.array(zod.z.custom()),
-  /** Default permit expiration in seconds, default is 30 days */
-  defaultPermitExpiration: zod.z.number().optional().default(60 * 60 * 24 * 30),
+  /** Default acp expiration in seconds, default is 30 days */
+  defaultACPExpiration: zod.z.number().optional().default(60 * 60 * 24 * 30),
   /** Storage method for fhe keys (defaults to indexedDB on web, filesystem on node) */
   fheKeyStorage: zod.z.object({
     getItem: zod.z.custom((val) => typeof val === "function", {
@@ -716,6 +713,12 @@ var CofheConfigSchema = zod.z.object({
   }).or(zod.z.null()).default(null),
   /** Whether to use Web Workers for ZK proof generation (web platform only) */
   useWorkers: zod.z.boolean().optional().default(true),
+  /** ACP acp defaults */
+  acp: zod.z.object({
+    defaultRevoker: zod.z.custom().optional(),
+    defaultContractScopes: zod.z.custom().optional(),
+    sharingRegistry: zod.z.custom().optional()
+  }).optional().default({}),
   /** Mocks configs */
   mocks: zod.z.object({
     decryptDelay: zod.z.number().optional().default(0),
@@ -726,8 +729,19 @@ var CofheConfigSchema = zod.z.object({
     zkvWalletClient: zod.z.any().optional()
   }).optional()
 });
+var RENAMED_COFHE_CONFIG_KEYS = {
+  defaultPermitExpiration: "defaultACPExpiration"
+};
+function assertNoRenamedConfigKeys(config, renamedKeys, label) {
+  const stale = Object.keys(config).filter((key) => key in renamedKeys);
+  if (stale.length === 0)
+    return;
+  const renames = stale.map((key) => `\`${key}\` is now \`${renamedKeys[key]}\``).join("; ");
+  throw new Error(`Invalid ${label}: ${renames}. See the v0.7.0 migration guide.`);
+}
 function createCofheConfigBase(config) {
-  const result = CofheConfigSchema.safeParse(config);
+  assertNoRenamedConfigKeys(config, RENAMED_COFHE_CONFIG_KEYS, "cofhe configuration");
+  const result = CofheConfigSchema.strict().safeParse(config);
   if (!result.success) {
     throw new Error(`Invalid cofhe configuration: ${zod.z.prettifyError(result.error)}`, { cause: result.error });
   }
@@ -1076,9 +1090,9 @@ var BaseBuilder = class {
 // core/encrypt/encryptInputsBuilder.ts
 var EncryptInputsBuilder = class extends BaseBuilder {
   securityZone;
+  consumingContract;
   stepCallback;
   inputItems;
-  hpp = false;
   zkvWalletClient;
   tfhePublicKeyDeserializer;
   compactPkeCrsDeserializer;
@@ -1145,20 +1159,6 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     this.keysStorage = params.keysStorage;
     this.useWorker = params.config?.useWorkers ?? true;
   }
-  /**
-   * @param account - Account that will create the tx using the encrypted inputs.
-   *
-   * If not provided, the account will be fetched from the connected walletClient.
-   *
-   * Example:
-   * ```typescript
-   * const encrypted = await encryptInputs([Encryptable.uint128(10n)])
-   *   .setAccount("0x123")
-   *   .execute();
-   * ```
-   *
-   * @returns The chainable EncryptInputsBuilder instance.
-   */
   setAccount(account) {
     this.account = account;
     return this;
@@ -1166,20 +1166,6 @@ var EncryptInputsBuilder = class extends BaseBuilder {
   getAccount() {
     return this.account;
   }
-  /**
-   * @param chainId - Chain that will consume the encrypted inputs.
-   *
-   * If not provided, the chainId will be fetched from the connected publicClient.
-   *
-   * Example:
-   * ```typescript
-   * const encrypted = await encryptInputs([Encryptable.uint128(10n)])
-   *   .setChainId(11155111)
-   *   .execute();
-   * ```
-   *
-   * @returns The chainable EncryptInputsBuilder instance.
-   */
   setChainId(chainId) {
     this.chainId = chainId;
     return this;
@@ -1187,20 +1173,6 @@ var EncryptInputsBuilder = class extends BaseBuilder {
   getChainId() {
     return this.chainId;
   }
-  /**
-   * @param securityZone - Security zone to encrypt the inputs for.
-   *
-   * If not provided, the default securityZone 0 will be used.
-   *
-   * Example:
-   * ```typescript
-   * const encrypted = await encryptInputs([Encryptable.uint128(10n)])
-   *   .setSecurityZone(1)
-   *   .execute();
-   * ```
-   *
-   * @returns The chainable EncryptInputsBuilder instance.
-   */
   setSecurityZone(securityZone) {
     this.securityZone = securityZone;
     return this;
@@ -1209,33 +1181,44 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     return this.securityZone;
   }
   /**
+   * @param address - The contract that will consume the resulting hashes+signature (i.e. the
+   * contract that will call `FHE.asEuint*`/`FHE.asEuint*s` with them).
+   *
+   * Required before `execute()` - the verifier binds this address into the signed digest, so a
+   * batch signed for one contract cannot be replayed into another.
+   *
    * Example:
    * ```typescript
    * const encrypted = await encryptInputs([Encryptable.uint128(10n)])
-   *   .asHashPlusProof()
+   *   .setConsumingContract("0x123...890")
    *   .execute();
    * ```
    *
-   * @returns Chainable EncryptInputsBuilder instance that will return a HashPlusProofResult instead of an array of EncryptedItemInputs.
+   * @returns The chainable EncryptInputsBuilder instance.
    */
-  asHashPlusProof() {
-    this.hpp = true;
+  setConsumingContract(address) {
+    this.consumingContract = address;
     return this;
   }
+  getConsumingContract() {
+    return this.consumingContract;
+  }
   /**
-   * @param useWorker - Whether to use Web Workers for ZK proof generation.
-   *
-   * Overrides the config-level useWorkers setting for this specific encryption.
-   *
-   * Example:
-   * ```typescript
-   * const encrypted = await encryptInputs([Encryptable.uint128(10n)])
-   *   .setUseWorker(false)
-   *   .execute();
-   * ```
-   *
-   * @returns The chainable EncryptInputsBuilder instance.
+   * Asserts that this.consumingContract is populated
+   * @throws {CofheError} If consumingContract is not set
    */
+  assertConsumingContract() {
+    if (this.consumingContract)
+      return;
+    throw new CofheError({
+      code: "CONSUMING_CONTRACT_UNINITIALIZED" /* ConsumingContractUninitialized */,
+      message: "Consuming contract is not set",
+      hint: "Use setConsumingContract(...) to set the contract that will consume the encrypted inputs.",
+      context: {
+        consumingContract: this.consumingContract
+      }
+    });
+  }
   setUseWorker(useWorker) {
     this.useWorker = useWorker;
     return this;
@@ -1256,21 +1239,6 @@ var EncryptInputsBuilder = class extends BaseBuilder {
   getUseWorker() {
     return this.useWorker;
   }
-  /**
-   * @param callback - Function to be called with the encryption step.
-   *
-   * Useful for debugging and tracking the progress of the encryption process.
-   * Useful for a UI element that shows the progress of the encryption process.
-   *
-   * Example:
-   * ```typescript
-   * const encrypted = await encryptInputs([Encryptable.uint128(10n)])
-   *   .onStep((step: EncryptStep) => console.log(step))
-   *   .execute();
-   * ```
-   *
-   * @returns The EncryptInputsBuilder instance.
-   */
   onStep(callback) {
     this.stepCallback = callback;
     return this;
@@ -1409,6 +1377,7 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     this.assertAccount();
     this.assertPublicClient();
     this.assertWalletClient();
+    this.assertConsumingContract();
     const [initTfheDelay, fetchKeysDelay, packDelay, proveDelay, verifyDelay] = this.resolveEncryptDelays();
     this.fireStepStart("initTfhe" /* InitTfhe */);
     await sleep(initTfheDelay);
@@ -1434,22 +1403,17 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     this.fireStepEnd("prove" /* Prove */, { isMocks: true, mockSleep: proveDelay });
     this.fireStepStart("verify" /* Verify */);
     await sleep(verifyDelay);
-    const signedResults = await cofheMocksZkVerifySign(
+    const result = await cofheMocksZkVerifySign(
       this.inputItems,
       this.account,
       this.securityZone,
+      this.consumingContract,
       this.publicClient,
       this.walletClient,
       this.zkvWalletClient
     );
-    const encryptedInputs = signedResults.map(({ ct_hash, signature }, index) => ({
-      ctHash: BigInt(ct_hash),
-      securityZone: this.securityZone,
-      utype: this.inputItems[index].utype,
-      signature
-    }));
     this.fireStepEnd("verify" /* Verify */, { isMocks: true, mockSleep: verifyDelay });
-    return encryptedInputs;
+    return result;
   }
   /**
    * In the production context, perform a true encryption with the CoFHE coprocessor.
@@ -1457,6 +1421,7 @@ var EncryptInputsBuilder = class extends BaseBuilder {
   async productionExecute() {
     this.assertAccount();
     this.assertChainId();
+    this.assertConsumingContract();
     this.fireStepStart("initTfhe" /* InitTfhe */);
     const tfheInitializationExecuted = await this.initTfheOrThrow();
     this.fireStepEnd("initTfhe" /* InitTfhe */, { tfheInitializationExecuted });
@@ -1491,26 +1456,24 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     });
     this.fireStepStart("verify" /* Verify */);
     const zkVerifierUrl = await this.getZkVerifierUrl();
-    const verifyResults = await zkVerify(zkVerifierUrl, proof, this.account, this.securityZone, this.chainId);
-    const encryptedInputs = verifyResults.map(
-      ({ ct_hash, signature }, index) => ({
-        ctHash: BigInt(ct_hash),
-        securityZone: this.securityZone,
-        utype: this.inputItems[index].utype,
-        signature
-      })
+    const result = await zkVerifyBatch(
+      zkVerifierUrl,
+      proof,
+      this.account,
+      this.securityZone,
+      this.chainId,
+      this.consumingContract
     );
     this.fireStepEnd("verify" /* Verify */);
-    return encryptedInputs;
-  }
-  structsToHashPlusProof(inItems) {
-    let hashes = [];
-    let proof = "";
-    for (const item of inItems) {
-      hashes.push("0x" + item.ctHash.toString(16).padStart(64, "0"));
-      proof += item.signature;
-    }
-    return [...hashes, proof];
+    return result;
+  }
+  /**
+   * Converts a batch-verified result (per-item ctHash/ctType + one shared signature) into the
+   * tuple returned by `execute()`: per-item hashes in input order, followed by the single signature.
+   */
+  buildBatchResult(result) {
+    const hashes = result.outputs.map((output) => "0x" + BigInt(output.ct_hash).toString(16).padStart(64, "0"));
+    return [...hashes, result.signature];
   }
   /**
    * Final step of the encryption process. MUST BE CALLED LAST IN THE CHAIN.
@@ -1532,18 +1495,16 @@ var EncryptInputsBuilder = class extends BaseBuilder {
    * @returns The encrypted inputs.
    */
   async execute() {
-    let items;
+    let result;
     if (this.chainId === chains.hardhat.id)
-      items = await this.mocksExecute();
+      result = await this.mocksExecute();
     else
-      items = await this.productionExecute();
-    if (this.hpp)
-      return this.structsToHashPlusProof(items);
-    return items;
+      result = await this.productionExecute();
+    return this.buildBatchResult(result);
   }
 };
 
-// permits/utils.ts
+// acps/utils.ts
 var fromHexString = (hexString) => {
   const cleanString = hexString.length % 2 === 1 ? `0${hexString}` : hexString;
   const arr = cleanString.replace(/^0x/, "").match(/.{1,2}/g);
@@ -1563,120 +1524,33 @@ function toBigInt(value) {
     return value;
   }
 }
-function toBeArray(value) {
-  const bigIntValue = typeof value === "number" ? BigInt(value) : value;
-  const hex = bigIntValue.toString(16);
-  const paddedHex = hex.length % 2 === 0 ? hex : "0" + hex;
-  return fromHexString(paddedHex);
-}
-function isString(value) {
-  if (typeof value !== "string") {
-    throw new Error(`Expected value which is \`string\`, received value of type \`${typeof value}\`.`);
-  }
-}
-function isNumber(value) {
-  const is = typeof value === "number" && !Number.isNaN(value);
-  if (!is) {
-    throw new Error(`Expected value which is \`number\`, received value of type \`${typeof value}\`.`);
-  }
-}
-function isBigIntOrNumber(value) {
-  const is = typeof value === "bigint";
-  if (!is) {
-    try {
-      isNumber(value);
-    } catch (e) {
-      throw new Error(`Value ${value} is not a number or bigint: ${typeof value}`);
-    }
-  }
-}
 
-// permits/sealing.ts
-var PRIVATE_KEY_LENGTH = 64;
-var PUBLIC_KEY_LENGTH = 64;
-var SealingKey = class _SealingKey {
-  /**
-   * The private key used for decryption.
-   */
-  privateKey;
-  /**
-   * The public key used for encryption.
-   */
-  publicKey;
-  /**
-   * Constructs a SealingKey instance with the given private and public keys.
-   *
-   * @param {string} privateKey - The private key used for decryption.
-   * @param {string} publicKey - The public key used for encryption.
-   * @throws Will throw an error if the provided keys lengths do not match
-   *         the required lengths for private and public keys.
-   */
-  constructor(privateKey, publicKey) {
-    if (privateKey.length !== PRIVATE_KEY_LENGTH) {
-      throw new Error(`Private key must be of length ${PRIVATE_KEY_LENGTH}`);
-    }
-    if (publicKey.length !== PUBLIC_KEY_LENGTH) {
-      throw new Error(`Public key must be of length ${PUBLIC_KEY_LENGTH}`);
-    }
-    this.privateKey = privateKey;
-    this.publicKey = publicKey;
-  }
-  unseal = (parsedData) => {
-    const nonce = parsedData.nonce instanceof Uint8Array ? parsedData.nonce : new Uint8Array(parsedData.nonce);
-    const ephemPublicKey = parsedData.public_key instanceof Uint8Array ? parsedData.public_key : new Uint8Array(parsedData.public_key);
-    const dataToDecrypt = parsedData.data instanceof Uint8Array ? parsedData.data : new Uint8Array(parsedData.data);
-    const privateKeyBytes = fromHexString(this.privateKey);
-    const decryptedMessage = nacl__default.default.box.open(dataToDecrypt, nonce, ephemPublicKey, privateKeyBytes);
-    if (!decryptedMessage) {
-      throw new Error("Failed to decrypt message");
-    }
-    return toBigInt(decryptedMessage);
-  };
-  /**
-   * Serializes the SealingKey to a JSON object.
-   */
-  serialize = () => {
-    return {
-      privateKey: this.privateKey,
-      publicKey: this.publicKey
-    };
-  };
-  /**
-   * Deserializes the SealingKey from a JSON object.
-   */
-  static deserialize = (privateKey, publicKey) => {
-    return new _SealingKey(privateKey, publicKey);
-  };
-  /**
-   * Seals (encrypts) the provided message for a receiver with the specified public key.
-   *
-   * @param {bigint | number} value - The message to be encrypted.
-   * @param {string} publicKey - The public key of the intended recipient.
-   * @returns string - The encrypted message in hexadecimal format.
-   * @static
-   * @throws Will throw if the provided publicKey or value do not meet defined preconditions.
-   */
-  static seal = (value, publicKey) => {
-    isString(publicKey);
-    isBigIntOrNumber(value);
-    const ephemeralKeyPair = nacl__default.default.box.keyPair();
-    const nonce = nacl__default.default.randomBytes(nacl__default.default.box.nonceLength);
-    const encryptedMessage = nacl__default.default.box(toBeArray(value), nonce, fromHexString(publicKey), ephemeralKeyPair.secretKey);
-    return {
-      data: encryptedMessage,
-      public_key: ephemeralKeyPair.publicKey,
-      nonce
-    };
-  };
-};
+// acps/sealing.ts
+var KEY_HEX_LENGTH = 64;
 var GenerateSealingKey = () => {
   const sodiumKeypair = nacl__default.default.box.keyPair();
-  return new SealingKey(toHexString2(sodiumKeypair.secretKey), toHexString2(sodiumKeypair.publicKey));
+  return {
+    privateKey: `0x${toHexString2(sodiumKeypair.secretKey)}`,
+    publicKey: `0x${toHexString2(sodiumKeypair.publicKey)}`
+  };
+};
+var unsealWithPrivateKey = (privateKey, parsedData) => {
+  assertKeyLength(privateKey, "Private");
+  const nonce = parsedData.nonce instanceof Uint8Array ? parsedData.nonce : new Uint8Array(parsedData.nonce);
+  const ephemPublicKey = parsedData.public_key instanceof Uint8Array ? parsedData.public_key : new Uint8Array(parsedData.public_key);
+  const dataToDecrypt = parsedData.data instanceof Uint8Array ? parsedData.data : new Uint8Array(parsedData.data);
+  const decryptedMessage = nacl__default.default.box.open(dataToDecrypt, nonce, ephemPublicKey, fromHexString(privateKey));
+  if (!decryptedMessage) {
+    throw new Error("Failed to decrypt message");
+  }
+  return toBigInt(decryptedMessage);
+};
+var assertKeyLength = (key, kind) => {
+  const bare = key.startsWith("0x") ? key.slice(2) : key;
+  if (bare.length !== KEY_HEX_LENGTH) {
+    throw new Error(`${kind} key must be of length ${KEY_HEX_LENGTH}`);
+  }
 };
-var SerializedSealingPair = zod.z.object({
-  privateKey: zod.z.string(),
-  publicKey: zod.z.string()
-});
 var addressSchema = zod.z.string().refine((val) => viem.isAddress(val), {
   error: "Invalid address"
 }).transform((val) => viem.getAddress(val));
@@ -1695,46 +1569,70 @@ var bytesNotEmptySchema = bytesSchema.refine((val) => val !== "0x", {
   error: "Must not be empty"
 });
 var DEFAULT_EXPIRATION_FN = () => Math.round(Date.now() / 1e3) + 7 * 24 * 60 * 60;
-var zPermitWithDefaults = zod.z.object({
-  name: zod.z.string().optional().default("Unnamed Permit"),
+var handlesSchema = zod.z.array(zod.z.string().regex(/^0x[0-9a-fA-F]{64}$/, "Invalid handle: expected 32-byte hex")).optional().default([]);
+var contractsSchema = zod.z.array(addressSchema).optional().default([]);
+var SCOPE_GLOBAL = 0;
+var SCOPE_CONTRACT = 1;
+var SCOPE_HANDLES = 2;
+var ScopeConsistencyRefinement = [
+  (data) => data.scope === SCOPE_GLOBAL && data.contracts.length === 0 && data.handles.length === 0 || data.scope === SCOPE_CONTRACT && data.contracts.length > 0 && data.handles.length === 0 || data.scope === SCOPE_HANDLES && data.handles.length > 0 && data.contracts.length === 0,
+  {
+    error: "ACP scope :: arrays must match the scope mode (Global: both empty; Contract: contracts only; Handles: handles only)",
+    path: ["scope"]
+  }
+];
+var withDerivedScope = (data) => ({
+  ...data,
+  scope: data.scope ?? (data.contracts.length > 0 ? SCOPE_CONTRACT : data.handles.length > 0 ? SCOPE_HANDLES : SCOPE_GLOBAL)
+});
+var zACPWithDefaults = zod.z.object({
+  name: zod.z.string().optional().default("Unnamed ACP"),
   type: zod.z.enum(["self", "sharing", "recipient"]),
   issuer: addressNotZeroSchema,
   expiration: zod.z.int().optional().default(DEFAULT_EXPIRATION_FN),
   recipient: addressSchema.optional().default(viem.zeroAddress),
-  validatorId: zod.z.int().optional().default(0),
-  validatorContract: addressSchema.optional().default(viem.zeroAddress),
+  revokerData: zod.z.int().optional().default(0),
+  revokerContract: addressSchema.optional().default(viem.zeroAddress),
+  scope: zod.z.int().min(0).max(2).optional().default(0),
+  contracts: contractsSchema,
+  handles: handlesSchema,
   issuerSignature: bytesSchema.optional().default("0x"),
   recipientSignature: bytesSchema.optional().default("0x")
 });
-var zPermitWithSealingPair = zPermitWithDefaults.extend({
-  sealingPair: SerializedSealingPair.optional()
+var zACPWithSealingKeys = zACPWithDefaults.extend({
+  /** X25519 private key, 0x-prefixed 32-byte hex; never leaves the client */
+  sealingPrivateKey: zod.z.string().regex(/^0x[0-9a-fA-F]{64}$/, "Invalid sealing private key").optional(),
+  sealingKey: zod.z.string().regex(/^0x[0-9a-fA-F]{64}$/, "Invalid sealing key").optional()
 });
 var ExternalValidatorRefinement = [
-  (data) => data.validatorId !== 0 && data.validatorContract !== viem.zeroAddress || data.validatorId === 0 && data.validatorContract === viem.zeroAddress,
+  (data) => data.revokerData !== 0 && data.revokerContract !== viem.zeroAddress || data.revokerData === 0 && data.revokerContract === viem.zeroAddress,
   {
-    error: "Permit external validator :: validatorId and validatorContract must either both be set or both be unset.",
-    path: ["validatorId", "validatorContract"]
+    error: "ACP external revoker :: revokerData and revokerContract must either both be set or both be unset.",
+    path: ["revokerData", "revokerContract"]
   }
 ];
 var RecipientRefinement = [
   (data) => data.issuer !== data.recipient,
   {
-    error: "Sharing permit :: issuer and recipient must not be the same",
+    error: "Sharing acp :: issuer and recipient must not be the same",
     path: ["issuer", "recipient"]
   }
 ];
-var SelfPermitOptionsValidator = zod.z.object({
+var SelfACPOptionsValidator = zod.z.object({
   type: zod.z.literal("self").optional().default("self"),
   issuer: addressNotZeroSchema,
-  name: zod.z.string().optional().default("Unnamed Permit"),
+  name: zod.z.string().optional().default("Unnamed ACP"),
   expiration: zod.z.int().optional().default(DEFAULT_EXPIRATION_FN),
   recipient: addressSchema.optional().default(viem.zeroAddress),
-  validatorId: zod.z.int().optional().default(0),
-  validatorContract: addressSchema.optional().default(viem.zeroAddress),
+  revokerData: zod.z.int().optional().default(0),
+  revokerContract: addressSchema.optional().default(viem.zeroAddress),
+  scope: zod.z.int().min(0).max(2).optional(),
+  contracts: contractsSchema,
+  handles: handlesSchema,
   issuerSignature: bytesSchema.optional().default("0x"),
   recipientSignature: bytesSchema.optional().default("0x")
-}).refine(...ExternalValidatorRefinement);
-var SelfPermitValidator = zPermitWithSealingPair.refine((data) => data.type === "self", {
+}).refine(...ExternalValidatorRefinement).transform(withDerivedScope).refine(...ScopeConsistencyRefinement);
+var SelfACPValidator = zACPWithSealingKeys.refine((data) => data.type === "self", {
   error: "Type must be 'self'"
 }).refine((data) => data.recipient === viem.zeroAddress, {
   error: "Recipient must be zeroAddress"
@@ -1743,18 +1641,21 @@ var SelfPermitValidator = zPermitWithSealingPair.refine((data) => data.type ===
 }).refine((data) => data.recipientSignature === "0x", {
   error: "RecipientSignature must be empty"
 }).refine(...ExternalValidatorRefinement);
-var SharingPermitOptionsValidator = zod.z.object({
+var SharingACPOptionsValidator = zod.z.object({
   type: zod.z.literal("sharing").optional().default("sharing"),
   issuer: addressNotZeroSchema,
   recipient: addressNotZeroSchema,
-  name: zod.z.string().optional().default("Unnamed Permit"),
+  name: zod.z.string().optional().default("Unnamed ACP"),
   expiration: zod.z.int().optional().default(DEFAULT_EXPIRATION_FN),
-  validatorId: zod.z.int().optional().default(0),
-  validatorContract: addressSchema.optional().default(viem.zeroAddress),
+  revokerData: zod.z.int().optional().default(0),
+  revokerContract: addressSchema.optional().default(viem.zeroAddress),
+  scope: zod.z.int().min(0).max(2).optional(),
+  contracts: contractsSchema,
+  handles: handlesSchema,
   issuerSignature: bytesSchema.optional().default("0x"),
   recipientSignature: bytesSchema.optional().default("0x")
-}).refine(...RecipientRefinement).refine(...ExternalValidatorRefinement);
-var SharingPermitValidator = zPermitWithSealingPair.refine((data) => data.type === "sharing", {
+}).refine(...RecipientRefinement).refine(...ExternalValidatorRefinement).transform(withDerivedScope).refine(...ScopeConsistencyRefinement);
+var SharingACPValidator = zACPWithSealingKeys.refine((data) => data.type === "sharing", {
   error: "Type must be 'sharing'"
 }).refine((data) => data.recipient !== viem.zeroAddress, {
   error: "Recipient must not be zeroAddress"
@@ -1763,18 +1664,21 @@ var SharingPermitValidator = zPermitWithSealingPair.refine((data) => data.type =
 }).refine((data) => data.recipientSignature === "0x", {
   error: "RecipientSignature must be empty"
 }).refine(...ExternalValidatorRefinement);
-var ImportPermitOptionsValidator = zod.z.object({
+var ImportACPOptionsValidator = zod.z.object({
   type: zod.z.literal("recipient").optional().default("recipient"),
   issuer: addressNotZeroSchema,
   recipient: addressNotZeroSchema,
-  name: zod.z.string().optional().default("Unnamed Permit"),
+  name: zod.z.string().optional().default("Unnamed ACP"),
   expiration: zod.z.int(),
-  validatorId: zod.z.int().optional().default(0),
-  validatorContract: addressSchema.optional().default(viem.zeroAddress),
+  revokerData: zod.z.int().optional().default(0),
+  revokerContract: addressSchema.optional().default(viem.zeroAddress),
+  scope: zod.z.int().min(0).max(2).optional(),
+  contracts: contractsSchema,
+  handles: handlesSchema,
   issuerSignature: bytesNotEmptySchema,
   recipientSignature: bytesSchema.optional().default("0x")
-}).refine(...ExternalValidatorRefinement);
-var ImportPermitValidator = zPermitWithSealingPair.refine((data) => data.type === "recipient", {
+}).refine(...ExternalValidatorRefinement).transform(withDerivedScope).refine(...ScopeConsistencyRefinement);
+var ImportACPValidator = zACPWithSealingKeys.refine((data) => data.type === "recipient", {
   error: "Type must be 'recipient'"
 }).refine((data) => data.recipient !== viem.zeroAddress, {
   error: "Recipient must not be zeroAddress"
@@ -1790,116 +1694,125 @@ var safeParseAndThrowFormatted = (schema, data, message) => {
   }
   return result.data;
 };
-var validateSelfPermitOptions = (options) => {
-  return safeParseAndThrowFormatted(SelfPermitOptionsValidator, options, "Invalid self permit options");
+var validateSelfACPOptions = (options) => {
+  return safeParseAndThrowFormatted(SelfACPOptionsValidator, options, "Invalid self acp options");
 };
-var validateSharingPermitOptions = (options) => {
-  return safeParseAndThrowFormatted(SharingPermitOptionsValidator, options, "Invalid sharing permit options");
+var validateSharingACPOptions = (options) => {
+  return safeParseAndThrowFormatted(SharingACPOptionsValidator, options, "Invalid sharing acp options");
 };
-var validateImportPermitOptions = (options) => {
-  return safeParseAndThrowFormatted(ImportPermitOptionsValidator, options, "Invalid import permit options");
+var validateImportACPOptions = (options) => {
+  return safeParseAndThrowFormatted(ImportACPOptionsValidator, options, "Invalid import acp options");
 };
-var validateSelfPermit = (permit) => {
-  return safeParseAndThrowFormatted(SelfPermitValidator, permit, "Invalid self permit");
+var validateSelfACP = (acp) => {
+  return safeParseAndThrowFormatted(SelfACPValidator, acp, "Invalid self acp");
 };
-var validateSharingPermit = (permit) => {
-  return safeParseAndThrowFormatted(SharingPermitValidator, permit, "Invalid sharing permit");
+var validateSharingACP = (acp) => {
+  return safeParseAndThrowFormatted(SharingACPValidator, acp, "Invalid sharing acp");
 };
-var validateImportPermit = (permit) => {
-  return safeParseAndThrowFormatted(ImportPermitValidator, permit, "Invalid import permit");
+var validateImportACP = (acp) => {
+  return safeParseAndThrowFormatted(ImportACPValidator, acp, "Invalid import acp");
 };
 var ValidationUtils = {
   /**
-   * Check if permit is expired
+   * Check if acp is expired
    */
-  isExpired: (permit) => {
-    return permit.expiration < Math.floor(Date.now() / 1e3);
+  isExpired: (acp) => {
+    return acp.expiration < Math.floor(Date.now() / 1e3);
   },
   /**
-   * Check if permit is signed by the active party
+   * Check if acp is signed by the active party
    */
-  isSigned: (permit) => {
-    if (permit.type === "self" || permit.type === "sharing") {
-      return permit.issuerSignature !== "0x";
+  isSigned: (acp) => {
+    if (acp.type === "self" || acp.type === "sharing") {
+      return acp.issuerSignature !== "0x";
     }
-    if (permit.type === "recipient") {
-      return permit.recipientSignature !== "0x";
+    if (acp.type === "recipient") {
+      return acp.recipientSignature !== "0x";
     }
     return false;
   },
   /**
-   * Checks that a permit is signed and not expired.
+   * Checks that an ACP is signed and not expired.
    */
-  isSignedAndNotExpired: (permit) => {
-    if (ValidationUtils.isExpired(permit)) {
+  isSignedAndNotExpired: (acp) => {
+    if (ValidationUtils.isExpired(acp)) {
       return { valid: false, error: "expired" };
     }
-    if (!ValidationUtils.isSigned(permit)) {
+    if (!ValidationUtils.isSigned(acp)) {
       return { valid: false, error: "not-signed" };
     }
     return { valid: true, error: null };
   },
   /**
-   * Asserts that a permit is signed and not expired.
+   * Asserts that an ACP is signed and not expired.
    *
    * Throws `Error` with message:
-   * - `Permit is expired`
-   * - `Permit is not signed`
+   * - `ACP is expired`
+   * - `ACP is not signed`
    */
-  assertSignedAndNotExpired: (permit) => {
-    const result = ValidationUtils.isSignedAndNotExpired(permit);
+  assertSignedAndNotExpired: (acp) => {
+    const result = ValidationUtils.isSignedAndNotExpired(acp);
     if (result.valid)
       return;
     if (result.error === "expired") {
-      throw new Error("Permit is expired");
+      throw new Error("ACP is expired");
     }
     if (result.error === "not-signed") {
-      throw new Error("Permit is not signed");
+      throw new Error("ACP is not signed");
     }
-    throw new Error("Permit is invalid");
+    throw new Error("ACP is invalid");
   },
-  isValid: (permit) => {
-    const schema = permit.type === "self" ? SelfPermitValidator : permit.type === "sharing" ? SharingPermitValidator : permit.type === "recipient" ? ImportPermitValidator : null;
+  isValid: (acp) => {
+    const schema = acp.type === "self" ? SelfACPValidator : acp.type === "sharing" ? SharingACPValidator : acp.type === "recipient" ? ImportACPValidator : null;
     if (schema == null)
       return { valid: false, error: "invalid-schema" };
-    const schemaResult = schema.safeParse(permit);
+    const schemaResult = schema.safeParse(acp);
     if (!schemaResult.success)
       return { valid: false, error: "invalid-schema" };
-    return ValidationUtils.isSignedAndNotExpired(permit);
+    return ValidationUtils.isSignedAndNotExpired(acp);
   }
 };
 
-// permits/signature.ts
-var PermitSignatureAllFields = [
+// acps/signature.ts
+var ACPSignatureAllFields = [
   { name: "issuer", type: "address" },
   { name: "expiration", type: "uint64" },
   { name: "recipient", type: "address" },
-  { name: "validatorId", type: "uint256" },
-  { name: "validatorContract", type: "address" },
+  { name: "revokerData", type: "uint256" },
+  { name: "revokerContract", type: "address" },
+  { name: "scope", type: "uint8" },
+  { name: "contracts", type: "address[]" },
+  { name: "handles", type: "bytes32[]" },
   { name: "sealingKey", type: "bytes32" },
   { name: "issuerSignature", type: "bytes" }
 ];
 var SignatureTypes = {
-  PermissionedV2IssuerSelf: [
+  ACPIssuerSelf: [
     "issuer",
     "expiration",
     "recipient",
-    "validatorId",
-    "validatorContract",
+    "revokerData",
+    "revokerContract",
+    "scope",
+    "contracts",
+    "handles",
     "sealingKey"
   ],
-  PermissionedV2IssuerShared: [
+  ACPIssuerShared: [
     "issuer",
     "expiration",
     "recipient",
-    "validatorId",
-    "validatorContract"
+    "revokerData",
+    "revokerContract",
+    "scope",
+    "contracts",
+    "handles"
   ],
-  PermissionedV2Recipient: ["sealingKey", "issuerSignature"]
+  ACPRecipient: ["sealingKey", "issuerSignature"]
 };
 var getSignatureTypesAndMessage = (primaryType, fields, values) => {
   const types = {
-    [primaryType]: PermitSignatureAllFields.filter((fieldType) => fields.includes(fieldType.name))
+    [primaryType]: ACPSignatureAllFields.filter((fieldType) => fields.includes(fieldType.name))
   };
   const message = {};
   fields.forEach((field) => {
@@ -1911,22 +1824,22 @@ var getSignatureTypesAndMessage = (primaryType, fields, values) => {
 };
 var SignatureUtils = {
   /**
-   * Get signature parameters for a permit
+   * Get signature parameters for an ACP
    */
-  getSignatureParams: (permit, primaryType) => {
-    return getSignatureTypesAndMessage(primaryType, SignatureTypes[primaryType], permit);
+  getSignatureParams: (acp, primaryType) => {
+    return getSignatureTypesAndMessage(primaryType, SignatureTypes[primaryType], acp);
   },
   /**
-   * Determine the required signature type based on permit type
+   * Determine the required signature type based on acp type
    */
-  getPrimaryType: (permitType) => {
-    if (permitType === "self")
-      return "PermissionedV2IssuerSelf";
-    if (permitType === "sharing")
-      return "PermissionedV2IssuerShared";
-    if (permitType === "recipient")
-      return "PermissionedV2Recipient";
-    throw new Error(`Unknown permit type: ${permitType}`);
+  getPrimaryType: (acpType) => {
+    if (acpType === "self")
+      return "ACPIssuerSelf";
+    if (acpType === "sharing")
+      return "ACPIssuerShared";
+    if (acpType === "recipient")
+      return "ACPRecipient";
+    throw new Error(`Unknown acp type: ${acpType}`);
   }
 };
 var getAclAddress = async (publicClient) => {
@@ -1948,6 +1861,11 @@ var getAclEIP712Domain = async (publicClient) => {
     functionName: "eip712Domain"
   });
   const [_fields, name, version, chainId, verifyingContract, _salt, _extensions] = domain;
+  if (version !== "2") {
+    throw new Error(
+      `Chain ${chainId}'s ACL serves EIP-712 domain version "${version}" \u2014 this SDK requires the upgraded (ACP-era) ACL, which signs as version "2". Pre-upgrade (V2 Permission) chains are not supported.`
+    );
+  }
   return {
     name,
     version,
@@ -1955,23 +1873,26 @@ var getAclEIP712Domain = async (publicClient) => {
     verifyingContract
   };
 };
-var checkPermitValidityOnChain = async (permission, publicClient) => {
+var checkACPValidityOnChain = async (acp, publicClient) => {
   const aclAddress = await getAclAddress(publicClient);
   try {
     await publicClient.simulateContract({
       address: aclAddress,
-      abi: checkPermitValidityAbi,
-      functionName: "checkPermitValidity",
+      abi: checkACPValidityAbi,
+      functionName: "checkPermissionValidity",
       args: [
         {
-          issuer: permission.issuer,
-          expiration: BigInt(permission.expiration),
-          recipient: permission.recipient,
-          validatorId: BigInt(permission.validatorId),
-          validatorContract: permission.validatorContract,
-          sealingKey: permission.sealingKey,
-          issuerSignature: permission.issuerSignature,
-          recipientSignature: permission.recipientSignature
+          issuer: acp.issuer,
+          expiration: BigInt(acp.expiration),
+          recipient: acp.recipient,
+          revokerData: BigInt(acp.revokerData),
+          revokerContract: acp.revokerContract,
+          scope: acp.scope,
+          contracts: acp.contracts,
+          handles: acp.handles,
+          sealingKey: acp.sealingKey,
+          issuerSignature: acp.issuerSignature,
+          recipientSignature: acp.recipientSignature
         }
       ]
     });
@@ -1984,14 +1905,14 @@ var checkPermitValidityOnChain = async (permission, publicClient) => {
         throw new Error(errorName);
       }
     }
-    const customErrorName = extractCustomErrorFromDetails(err, checkPermitValidityAbi);
+    const customErrorName = extractCustomErrorFromDetails(err, checkACPValidityAbi);
     if (customErrorName) {
       throw new Error(customErrorName);
     }
     const hhDetailsData = extractReturnData(err);
     if (hhDetailsData != null) {
       const decoded = viem.decodeErrorResult({
-        abi: checkPermitValidityAbi,
+        abi: checkACPValidityAbi,
         data: hhDetailsData
       });
       throw new Error(decoded.errorName);
@@ -2019,15 +1940,15 @@ function extractReturnData(err) {
   const s = anyErr?.details ?? anyErr?.cause?.details ?? anyErr?.shortMessage ?? anyErr?.message ?? String(err);
   return s.match(/return data:\s*(0x[a-fA-F0-9]+)/)?.[1];
 }
-var checkPermitValidityAbi = [
+var checkACPValidityAbi = [
   {
     type: "function",
-    name: "checkPermitValidity",
+    name: "checkPermissionValidity",
     inputs: [
       {
-        name: "permission",
+        name: "acp",
         type: "tuple",
-        internalType: "struct Permission",
+        internalType: "struct ACP",
         components: [
           {
             name: "issuer",
@@ -2045,15 +1966,30 @@ var checkPermitValidityAbi = [
             internalType: "address"
           },
           {
-            name: "validatorId",
+            name: "revokerData",
             type: "uint256",
             internalType: "uint256"
           },
           {
-            name: "validatorContract",
+            name: "revokerContract",
             type: "address",
             internalType: "address"
           },
+          {
+            name: "scope",
+            type: "uint8",
+            internalType: "uint8"
+          },
+          {
+            name: "contracts",
+            type: "address[]",
+            internalType: "address[]"
+          },
+          {
+            name: "handles",
+            type: "bytes32[]",
+            internalType: "bytes32[]"
+          },
           {
             name: "sealingKey",
             type: "bytes32",
@@ -2103,38 +2039,40 @@ var checkPermitValidityAbi = [
   }
 ];
 
-// permits/permit.ts
-var PermitUtils = {
+// acps/acp.ts
+var ACPUtils = {
   /**
-   * Create a self permit for personal use
+   * Create a self acp for personal use
    */
   createSelf: (options) => {
-    const validation = validateSelfPermitOptions(options);
+    const validation = validateSelfACPOptions(options);
     const sealingPair = GenerateSealingKey();
-    const permit = {
-      hash: PermitUtils.getHash(validation),
+    const acp = {
+      hash: ACPUtils.getHash(validation),
       ...validation,
-      sealingPair,
+      sealingPrivateKey: sealingPair.privateKey,
+      sealingKey: sealingPair.publicKey,
       _signedDomain: void 0
     };
-    return permit;
+    return acp;
   },
   /**
-   * Create a sharing permit to be shared with another user
+   * Create a sharing acp to be shared with another user
    */
   createSharing: (options) => {
-    const validation = validateSharingPermitOptions(options);
+    const validation = validateSharingACPOptions(options);
     const sealingPair = GenerateSealingKey();
-    const permit = {
-      hash: PermitUtils.getHash(validation),
+    const acp = {
+      hash: ACPUtils.getHash(validation),
       ...validation,
-      sealingPair,
+      sealingPrivateKey: sealingPair.privateKey,
+      sealingKey: sealingPair.publicKey,
       _signedDomain: void 0
     };
-    return permit;
+    return acp;
   },
   /**
-   * Import a shared permit from various input formats
+   * Import a shared acp from various input formats
    */
   importShared: (options) => {
     let parsedOptions;
@@ -2147,33 +2085,34 @@ var PermitUtils = {
     } else if (typeof options === "object" && options !== null) {
       parsedOptions = options;
     } else {
-      throw new Error("Invalid input type, expected ImportSharedPermitOptions, object, or string");
+      throw new Error("Invalid input type, expected ImportSharedACPOptions, object, or string");
     }
     if (parsedOptions.type != null && parsedOptions.type !== "sharing") {
-      throw new Error(`Invalid permit type <${parsedOptions.type}>, must be "sharing"`);
+      throw new Error(`Invalid acp type <${parsedOptions.type}>, must be "sharing"`);
     }
-    const validation = validateImportPermitOptions({ ...parsedOptions, type: "recipient" });
+    const validation = validateImportACPOptions({ ...parsedOptions, type: "recipient" });
     const sealingPair = GenerateSealingKey();
-    const permit = {
-      hash: PermitUtils.getHash(validation),
+    const acp = {
+      hash: ACPUtils.getHash(validation),
       ...validation,
-      sealingPair,
+      sealingPrivateKey: sealingPair.privateKey,
+      sealingKey: sealingPair.publicKey,
       _signedDomain: void 0
     };
-    return permit;
+    return acp;
   },
   /**
-   * Sign a permit with the provided wallet client
+   * Sign an ACP with the provided wallet client
    */
-  sign: async (permit, publicClient, walletClient) => {
+  sign: async (acp, publicClient, walletClient) => {
     if (walletClient == null || walletClient.account == null) {
       throw new Error(
-        "Missing walletClient, you must pass in a `walletClient` for the connected user to create a permit signature"
+        "Missing walletClient, you must pass in a `walletClient` for the connected user to create an ACP signature"
       );
     }
-    const primaryType = SignatureUtils.getPrimaryType(permit.type);
+    const primaryType = SignatureUtils.getPrimaryType(acp.type);
     const domain = await getAclEIP712Domain(publicClient);
-    const { types, message } = SignatureUtils.getSignatureParams(PermitUtils.getPermission(permit, true), primaryType);
+    const { types, message } = SignatureUtils.getSignatureParams(ACPUtils.getPublic(acp, true), primaryType);
     const signature = await walletClient.signTypedData({
       domain,
       types,
@@ -2181,190 +2120,209 @@ var PermitUtils = {
       message,
       account: walletClient.account
     });
-    let updatedPermit;
-    if (permit.type === "self" || permit.type === "sharing") {
-      updatedPermit = {
-        ...permit,
+    let updatedACP;
+    if (acp.type === "self" || acp.type === "sharing") {
+      updatedACP = {
+        ...acp,
         issuerSignature: signature,
         _signedDomain: domain
       };
     } else {
-      updatedPermit = {
-        ...permit,
+      updatedACP = {
+        ...acp,
         recipientSignature: signature,
         _signedDomain: domain
       };
     }
-    return updatedPermit;
+    return updatedACP;
   },
   /**
-   * Create and sign a self permit in one operation
+   * Create and sign a self acp in one operation
    */
   createSelfAndSign: async (options, publicClient, walletClient) => {
-    const permit = PermitUtils.createSelf(options);
-    return PermitUtils.sign(permit, publicClient, walletClient);
+    const acp = ACPUtils.createSelf(options);
+    return ACPUtils.sign(acp, publicClient, walletClient);
   },
   /**
-   * Create and sign a sharing permit in one operation
+   * Create and sign a sharing acp in one operation
    */
   createSharingAndSign: async (options, publicClient, walletClient) => {
-    const permit = PermitUtils.createSharing(options);
-    return PermitUtils.sign(permit, publicClient, walletClient);
+    const acp = ACPUtils.createSharing(options);
+    return ACPUtils.sign(acp, publicClient, walletClient);
   },
   /**
-   * Import and sign a shared permit in one operation from various input formats
+   * Import and sign a shared acp in one operation from various input formats
    */
   importSharedAndSign: async (options, publicClient, walletClient) => {
-    const permit = PermitUtils.importShared(options);
-    return PermitUtils.sign(permit, publicClient, walletClient);
+    const acp = ACPUtils.importShared(options);
+    return ACPUtils.sign(acp, publicClient, walletClient);
   },
   /**
-   * Deserialize a permit from serialized data
+   * Deserialize an ACP from serialized data
    */
   deserialize: (data) => {
-    return {
-      ...data,
-      sealingPair: SealingKey.deserialize(data.sealingPair.privateKey, data.sealingPair.publicKey)
-    };
+    return { ...data };
   },
   /**
-   * Serialize a permit for storage
+   * Serialize an ACP for storage
    */
-  serialize: (permit) => {
+  serialize: (acp) => {
     return {
-      hash: permit.hash,
-      name: permit.name,
-      type: permit.type,
-      issuer: permit.issuer,
-      expiration: permit.expiration,
-      recipient: permit.recipient,
-      validatorId: permit.validatorId,
-      validatorContract: permit.validatorContract,
-      issuerSignature: permit.issuerSignature,
-      recipientSignature: permit.recipientSignature,
-      _signedDomain: permit._signedDomain,
-      sealingPair: permit.sealingPair.serialize()
+      hash: acp.hash,
+      name: acp.name,
+      type: acp.type,
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles,
+      sealingKey: acp.sealingKey,
+      issuerSignature: acp.issuerSignature,
+      recipientSignature: acp.recipientSignature,
+      _signedDomain: acp._signedDomain,
+      sealingPrivateKey: acp.sealingPrivateKey
     };
   },
   /**
-   * Validate a permit (schema-level validation)
+   * Validate an ACP (schema-level validation)
    */
-  validateSchema: (permit) => {
-    if (permit.type === "self") {
-      return validateSelfPermit(permit);
-    } else if (permit.type === "sharing") {
-      return validateSharingPermit(permit);
-    } else if (permit.type === "recipient") {
-      return validateImportPermit(permit);
+  validateSchema: (acp) => {
+    if (acp.type === "self") {
+      return validateSelfACP(acp);
+    } else if (acp.type === "sharing") {
+      return validateSharingACP(acp);
+    } else if (acp.type === "recipient") {
+      return validateImportACP(acp);
     } else {
-      throw new Error("Invalid permit type");
+      throw new Error("Invalid ACP type");
     }
   },
   /**
-   * Validate a permit (holistic validation).
+   * Validate an ACP (holistic validation).
    *
    * This validates:
-   * - Permit schema (shape + invariants)
-   * - Permit is signed
-   * - Permit is not expired
+   * - ACP schema (shape + invariants)
+   * - ACP is signed
+   * - ACP is not expired
    *
-   * For schema-only validation, use `validateSchema(permit)`.
+   * For schema-only validation, use `validateSchema(acp)`.
    */
-  validate: (permit) => {
-    const validated = PermitUtils.validateSchema(permit);
+  validate: (acp) => {
+    const validated = ACPUtils.validateSchema(acp);
     ValidationUtils.assertSignedAndNotExpired(validated);
     return validated;
   },
   /**
-   * Get the permission object from a permit (for use in contracts)
+   * Get the public component of an ACP — the signed struct sent on-chain / to the decryption backend.
+   * Strips the private component (hash, name, type, sealing pair).
    */
-  getPermission: (permit, skipValidation = false) => {
+  getPublic: (acp, skipValidation = false) => {
     if (!skipValidation) {
-      PermitUtils.validateSchema(permit);
+      ACPUtils.validateSchema(acp);
     }
     return {
-      issuer: permit.issuer,
-      expiration: permit.expiration,
-      recipient: permit.recipient,
-      validatorId: permit.validatorId,
-      validatorContract: permit.validatorContract,
-      sealingKey: `0x${permit.sealingPair.publicKey}`,
-      issuerSignature: permit.issuerSignature,
-      recipientSignature: permit.recipientSignature
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles,
+      sealingKey: acp.sealingKey,
+      issuerSignature: acp.issuerSignature,
+      recipientSignature: acp.recipientSignature
     };
   },
   /**
-   * Get a stable hash for the permit (used as key in storage)
+   * Get a stable hash for the acp (used as key in storage)
    */
-  getHash: (permit) => {
+  getHash: (acp) => {
     const data = JSON.stringify({
-      type: permit.type,
-      issuer: permit.issuer,
-      expiration: permit.expiration,
-      recipient: permit.recipient,
-      validatorId: permit.validatorId,
-      validatorContract: permit.validatorContract
+      type: acp.type,
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles
     });
     return viem.keccak256(viem.toHex(data));
   },
   /**
-   * Export permit data for sharing (removes sensitive fields)
+   * Export acp data for sharing (strips the private component).
+   * Fixed `SharedACP` shape — every field always present, aligned with
+   * `ACPPublic` and the on-chain sharing payload.
    */
-  export: (permit) => {
-    const cleanedPermit = {
-      name: permit.name,
-      type: permit.type,
-      issuer: permit.issuer,
-      expiration: permit.expiration
+  export: (acp) => {
+    if (acp.type !== "sharing") {
+      throw new Error(
+        `Cannot export a '${acp.type}' ACP \u2014 only 'sharing' ACPs are exportable. The export includes the issuer signature.`
+      );
+    }
+    if (acp.issuerSignature === "0x") {
+      throw new Error(
+        "Cannot export an unsigned sharing ACP \u2014 sign it first (the recipient needs the issuer signature)."
+      );
+    }
+    const shared = {
+      name: acp.name,
+      type: acp.type,
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles,
+      issuerSignature: acp.issuerSignature
     };
-    if (permit.recipient !== viem.zeroAddress)
-      cleanedPermit.recipient = permit.recipient;
-    if (permit.validatorId !== 0)
-      cleanedPermit.validatorId = permit.validatorId;
-    if (permit.validatorContract !== viem.zeroAddress)
-      cleanedPermit.validatorContract = permit.validatorContract;
-    if (permit.type === "sharing" && permit.issuerSignature !== "0x")
-      cleanedPermit.issuerSignature = permit.issuerSignature;
-    return JSON.stringify(cleanedPermit, void 0, 2);
+    return JSON.stringify(shared, void 0, 2);
   },
   /**
-   * Unseal encrypted data using the permit's sealing key
+   * Unseal encrypted data using the acp's sealing key
    */
-  unseal: (permit, ciphertext) => {
-    return permit.sealingPair.unseal(ciphertext);
+  unseal: (acp, ciphertext) => {
+    return unsealWithPrivateKey(acp.sealingPrivateKey, ciphertext);
   },
   /**
-   * Check if permit is expired
+   * Check if acp is expired
    */
-  isExpired: (permit) => {
-    return ValidationUtils.isExpired(permit);
+  isExpired: (acp) => {
+    return ValidationUtils.isExpired(acp);
   },
   /**
-   * Check if permit is signed
+   * Check if acp is signed
    */
-  isSigned: (permit) => {
-    return ValidationUtils.isSigned(permit);
+  isSigned: (acp) => {
+    return ValidationUtils.isSigned(acp);
   },
   /**
-   * Check if permit is signed and not expired
+   * Check if acp is signed and not expired
    */
-  isSignedAndNotExpired: (permit) => {
-    return ValidationUtils.isSignedAndNotExpired(permit);
+  isSignedAndNotExpired: (acp) => {
+    return ValidationUtils.isSignedAndNotExpired(acp);
   },
   /**
-   * Assert that permit is signed and not expired
+   * Assert that acp is signed and not expired
    */
-  assertSignedAndNotExpired: (permit) => {
-    return ValidationUtils.assertSignedAndNotExpired(permit);
+  assertSignedAndNotExpired: (acp) => {
+    return ValidationUtils.assertSignedAndNotExpired(acp);
   },
-  isValid: (permit) => {
-    return ValidationUtils.isValid(permit);
+  isValid: (acp) => {
+    return ValidationUtils.isValid(acp);
   },
   /**
-   * Update permit name (returns new permit instance)
+   * Update acp name (returns new acp instance)
    */
-  updateName: (permit, name) => {
-    return { ...permit, name };
+  updateName: (acp, name) => {
+    return { ...acp, name };
   },
   /**
    * Fetch EIP712 domain from the blockchain
@@ -2373,230 +2331,468 @@ var PermitUtils = {
     return getAclEIP712Domain(publicClient);
   },
   /**
-   * Check if permit's signed domain matches the provided domain
+   * Check if acp's signed domain matches the provided domain
    */
-  matchesDomain: (permit, domain) => {
-    return permit._signedDomain?.name === domain.name && permit._signedDomain?.version === domain.version && permit._signedDomain?.verifyingContract === domain.verifyingContract && permit._signedDomain?.chainId === domain.chainId;
+  matchesDomain: (acp, domain) => {
+    return acp._signedDomain?.name === domain.name && acp._signedDomain?.version === domain.version && acp._signedDomain?.verifyingContract === domain.verifyingContract && acp._signedDomain?.chainId === domain.chainId;
   },
   /**
-   * Check if permit's signed domain is valid for the current chain
+   * Check if acp's signed domain is valid for the current chain
    */
-  checkSignedDomainValid: async (permit, publicClient) => {
-    if (permit._signedDomain == null)
+  checkSignedDomainValid: async (acp, publicClient) => {
+    if (acp._signedDomain == null)
       return false;
     const domain = await getAclEIP712Domain(publicClient);
-    return PermitUtils.matchesDomain(permit, domain);
+    return ACPUtils.matchesDomain(acp, domain);
   },
   /**
-   * Check if permit passes the on-chain validation
+   * Check if acp passes the on-chain validation
    */
-  checkValidityOnChain: async (permit, publicClient) => {
-    const permission = PermitUtils.getPermission(permit);
-    return checkPermitValidityOnChain(permission, publicClient);
+  checkValidityOnChain: async (acp, publicClient) => {
+    const publicAcp = ACPUtils.getPublic(acp);
+    return checkACPValidityOnChain(publicAcp, publicClient);
   }
 };
-var PERMIT_STORE_DEFAULTS = {
-  permits: {},
-  activePermitHash: {}
+var ACP_STORE_DEFAULTS = {
+  acps: {},
+  activeACPHash: {}
 };
-var _permitStore = vanilla.createStore()(
-  middleware.persist(() => PERMIT_STORE_DEFAULTS, { name: "cofhesdk-permits" })
+var ACP_STORE_VERSION = 3;
+var _acpStore = vanilla.createStore()(
+  middleware.persist(() => ACP_STORE_DEFAULTS, {
+    name: "cofhesdk-acps",
+    version: ACP_STORE_VERSION,
+    migrate: (persistedState, version) => {
+      if (version < ACP_STORE_VERSION)
+        return ACP_STORE_DEFAULTS;
+      return persistedState;
+    }
+  })
 );
 var clearStaleStore = () => {
-  const state = _permitStore.getState();
-  const hasExpectedStructure = state && typeof state === "object" && "permits" in state && "activePermitHash" in state && typeof state.permits === "object" && typeof state.activePermitHash === "object";
+  const state = _acpStore.getState();
+  const hasExpectedStructure = state && typeof state === "object" && "acps" in state && "activeACPHash" in state && typeof state.acps === "object" && typeof state.activeACPHash === "object";
   if (hasExpectedStructure)
     return;
-  _permitStore.setState({ permits: {}, activePermitHash: {} });
+  _acpStore.setState({ acps: {}, activeACPHash: {} });
 };
-var getPermit = (chainId, account, hash) => {
+var getACP = (chainId, account, hash) => {
   clearStaleStore();
   if (chainId == null || account == null || hash == null)
     return;
-  const savedPermit = _permitStore.getState().permits[chainId]?.[account]?.[hash];
-  if (savedPermit == null)
+  const savedACP = _acpStore.getState().acps[chainId]?.[account]?.[hash];
+  if (savedACP == null)
     return;
-  return PermitUtils.deserialize(savedPermit);
+  return ACPUtils.deserialize(savedACP);
 };
-var getActivePermit = (chainId, account) => {
+var getActiveACP = (chainId, account) => {
   clearStaleStore();
   if (chainId == null || account == null)
     return;
-  const activePermitHash = _permitStore.getState().activePermitHash[chainId]?.[account];
-  return getPermit(chainId, account, activePermitHash);
+  const activeACPHash = _acpStore.getState().activeACPHash[chainId]?.[account];
+  return getACP(chainId, account, activeACPHash);
 };
-var getPermits = (chainId, account) => {
+var getACPs = (chainId, account) => {
   clearStaleStore();
   if (chainId == null || account == null)
     return {};
-  return Object.entries(_permitStore.getState().permits[chainId]?.[account] ?? {}).reduce(
-    (acc, [hash, permit]) => {
-      if (permit == void 0)
+  return Object.entries(_acpStore.getState().acps[chainId]?.[account] ?? {}).reduce(
+    (acc, [hash, acp]) => {
+      if (acp == void 0)
         return acc;
-      return { ...acc, [hash]: PermitUtils.deserialize(permit) };
+      return { ...acc, [hash]: ACPUtils.deserialize(acp) };
     },
     {}
   );
 };
-var setPermit = (chainId, account, permit) => {
+var setACP = (chainId, account, acp) => {
   clearStaleStore();
-  _permitStore.setState(
+  _acpStore.setState(
     immer.produce((state) => {
-      if (state.permits[chainId] == null)
-        state.permits[chainId] = {};
-      if (state.permits[chainId][account] == null)
-        state.permits[chainId][account] = {};
-      state.permits[chainId][account][permit.hash] = PermitUtils.serialize(permit);
+      if (state.acps[chainId] == null)
+        state.acps[chainId] = {};
+      if (state.acps[chainId][account] == null)
+        state.acps[chainId][account] = {};
+      state.acps[chainId][account][acp.hash] = ACPUtils.serialize(acp);
     })
   );
 };
-var removePermit = (chainId, account, hash) => {
+var removeACP = (chainId, account, hash) => {
   clearStaleStore();
-  _permitStore.setState(
+  _acpStore.setState(
     immer.produce((state) => {
-      if (state.permits[chainId] == null)
-        state.permits[chainId] = {};
-      if (state.activePermitHash[chainId] == null)
-        state.activePermitHash[chainId] = {};
-      const accountPermits = state.permits[chainId][account];
-      if (accountPermits == null)
+      if (state.acps[chainId] == null)
+        state.acps[chainId] = {};
+      if (state.activeACPHash[chainId] == null)
+        state.activeACPHash[chainId] = {};
+      const accountACPs = state.acps[chainId][account];
+      if (accountACPs == null)
         return;
-      if (accountPermits[hash] == null)
+      if (accountACPs[hash] == null)
         return;
-      if (state.activePermitHash[chainId][account] === hash) {
-        state.activePermitHash[chainId][account] = void 0;
+      if (state.activeACPHash[chainId][account] === hash) {
+        state.activeACPHash[chainId][account] = void 0;
       }
-      accountPermits[hash] = void 0;
+      accountACPs[hash] = void 0;
     })
   );
 };
-var getActivePermitHash = (chainId, account) => {
+var getActiveACPHash = (chainId, account) => {
   clearStaleStore();
   if (chainId == null || account == null)
     return void 0;
-  return _permitStore.getState().activePermitHash[chainId]?.[account];
+  return _acpStore.getState().activeACPHash[chainId]?.[account];
 };
-var setActivePermitHash = (chainId, account, hash) => {
+var setActiveACPHash = (chainId, account, hash) => {
   clearStaleStore();
-  _permitStore.setState(
+  _acpStore.setState(
     immer.produce((state) => {
-      if (state.activePermitHash[chainId] == null)
-        state.activePermitHash[chainId] = {};
-      state.activePermitHash[chainId][account] = hash;
+      if (state.activeACPHash[chainId] == null)
+        state.activeACPHash[chainId] = {};
+      state.activeACPHash[chainId][account] = hash;
     })
   );
 };
-var removeActivePermitHash = (chainId, account) => {
+var removeActiveACPHash = (chainId, account) => {
   clearStaleStore();
-  _permitStore.setState(
+  _acpStore.setState(
     immer.produce((state) => {
-      if (state.activePermitHash[chainId])
-        state.activePermitHash[chainId][account] = void 0;
+      if (state.activeACPHash[chainId])
+        state.activeACPHash[chainId][account] = void 0;
     })
   );
 };
 var resetStore = () => {
   clearStaleStore();
-  _permitStore.setState({ permits: {}, activePermitHash: {} });
+  _acpStore.setState({ acps: {}, activeACPHash: {} });
 };
-var permitStore = {
-  store: _permitStore,
-  getPermit,
-  getActivePermit,
-  getPermits,
-  setPermit,
-  removePermit,
-  getActivePermitHash,
-  setActivePermitHash,
-  removeActivePermitHash,
+var acpStore = {
+  store: _acpStore,
+  getACP,
+  getActiveACP,
+  getACPs,
+  setACP,
+  removeACP,
+  getActiveACPHash,
+  setActiveACPHash,
+  removeActiveACPHash,
   resetStore
 };
-var storeActivePermit = async (permit, publicClient, walletClient) => {
+var ACP_VALIDATOR_ABI = viem.parseAbi([
+  "function revokeSingle(uint256 id)",
+  "function revokeAllExisting()",
+  "function disabled(address issuer, uint256 id) view returns (bool)"
+]);
+var storeACP = async (acp, publicClient, walletClient) => {
   const chainId = await publicClient.getChainId();
   const account = walletClient.account.address;
-  permitStore.setPermit(chainId, account, permit);
-  permitStore.setActivePermitHash(chainId, account, permit.hash);
+  acpStore.setACP(chainId, account, acp);
 };
-var createPermitWithSign = async (options, publicClient, walletClient, permitMethod) => {
-  const permit = await permitMethod(options, publicClient, walletClient);
-  await storeActivePermit(permit, publicClient, walletClient);
-  return permit;
+var storeActiveACP = async (acp, publicClient, walletClient) => {
+  await storeACP(acp, publicClient, walletClient);
+  const chainId = await publicClient.getChainId();
+  const account = walletClient.account.address;
+  acpStore.setActiveACPHash(chainId, account, acp.hash);
+};
+var createACPWithSign = async (options, publicClient, walletClient, acpMethod, activate = true) => {
+  const acp = await acpMethod(options, publicClient, walletClient);
+  if (activate) {
+    await storeActiveACP(acp, publicClient, walletClient);
+  } else {
+    await storeACP(acp, publicClient, walletClient);
+  }
+  return acp;
 };
 var createSelf = async (options, publicClient, walletClient) => {
-  return createPermitWithSign(options, publicClient, walletClient, PermitUtils.createSelfAndSign);
+  return createACPWithSign(options, publicClient, walletClient, ACPUtils.createSelfAndSign);
 };
 var createSharing = async (options, publicClient, walletClient) => {
-  return createPermitWithSign(options, publicClient, walletClient, PermitUtils.createSharingAndSign);
+  return createACPWithSign(options, publicClient, walletClient, ACPUtils.createSharingAndSign, false);
 };
 var importShared = async (options, publicClient, walletClient) => {
-  return createPermitWithSign(options, publicClient, walletClient, PermitUtils.importSharedAndSign);
+  return createACPWithSign(options, publicClient, walletClient, ACPUtils.importSharedAndSign);
 };
-var getHash = (permit) => {
-  return PermitUtils.getHash(permit);
+var getHash = (acp) => {
+  return ACPUtils.getHash(acp);
 };
-var exportShared = (permit) => {
-  return PermitUtils.export(permit);
+var exportShared = (acp) => {
+  return ACPUtils.export(acp);
 };
-var serialize = (permit) => {
-  return PermitUtils.serialize(permit);
+var serialize = (acp) => {
+  return ACPUtils.serialize(acp);
 };
 var deserialize = (serialized) => {
-  return PermitUtils.deserialize(serialized);
+  return ACPUtils.deserialize(serialized);
 };
-var getPermit2 = (chainId, account, hash) => {
-  return permitStore.getPermit(chainId, account, hash);
+var getACP2 = (chainId, account, hash) => {
+  return acpStore.getACP(chainId, account, hash);
 };
-var getPermits2 = (chainId, account) => {
-  return permitStore.getPermits(chainId, account);
+var getACPs2 = (chainId, account) => {
+  return acpStore.getACPs(chainId, account);
 };
-var getActivePermit2 = (chainId, account) => {
-  return permitStore.getActivePermit(chainId, account);
+var getActiveACP2 = (chainId, account) => {
+  return acpStore.getActiveACP(chainId, account);
 };
-var getActivePermitHash2 = (chainId, account) => {
-  return permitStore.getActivePermitHash(chainId, account);
+var getActiveACPHash2 = (chainId, account) => {
+  return acpStore.getActiveACPHash(chainId, account);
 };
-var selectActivePermit = (chainId, account, hash) => {
-  permitStore.setActivePermitHash(chainId, account, hash);
+var selectActiveACP = (chainId, account, hash) => {
+  acpStore.setActiveACPHash(chainId, account, hash);
 };
-var getOrCreateSelfPermit = async (publicClient, walletClient, chainId, account, options) => {
+var getOrCreateSelfACP = async (publicClient, walletClient, chainId, account, options) => {
   const _chainId = chainId ?? await publicClient.getChainId();
   const _account = account ?? walletClient.account.address;
-  const activePermit = await getActivePermit2(_chainId, _account);
-  if (activePermit && activePermit.type === "self") {
-    return activePermit;
+  const activeACP = await getActiveACP2(_chainId, _account);
+  if (activeACP && activeACP.type === "self" && ACPUtils.isValid(activeACP).valid) {
+    return activeACP;
   }
-  return createSelf(options ?? { issuer: _account, name: "Autogenerated Self Permit" }, publicClient, walletClient);
+  return createSelf(options ?? { issuer: _account, name: "Autogenerated Self ACP" }, publicClient, walletClient);
 };
-var getOrCreateSharingPermit = async (publicClient, walletClient, options, chainId, account) => {
+var getOrCreateSharingACP = async (publicClient, walletClient, options, chainId, account) => {
   const _chainId = chainId ?? await publicClient.getChainId();
   const _account = account ?? walletClient.account.address;
-  const activePermit = await getActivePermit2(_chainId, _account);
-  if (activePermit && activePermit.type === "sharing") {
-    return activePermit;
+  const activeACP = await getActiveACP2(_chainId, _account);
+  if (activeACP && activeACP.type === "sharing" && ACPUtils.isValid(activeACP).valid) {
+    return activeACP;
   }
   return createSharing(options, publicClient, walletClient);
 };
-var removePermit2 = async (chainId, account, hash) => permitStore.removePermit(chainId, account, hash);
-var removeActivePermit = async (chainId, account) => permitStore.removeActivePermitHash(chainId, account);
-var permits = {
-  getSnapshot: permitStore.store.getState,
-  subscribe: permitStore.store.subscribe,
+var applyACPDefaults = (options, acpConfig, chainId) => {
+  const result = { ...options };
+  const defaultRevoker = acpConfig?.defaultRevoker?.[chainId];
+  const hasValidatorOptions = options.revokerData != null || options.revokerContract != null;
+  if (defaultRevoker != null && !hasValidatorOptions) {
+    result.revokerContract = defaultRevoker;
+    result.revokerData = Math.round(Date.now() / 1e3) - 60;
+  }
+  const defaultContracts = acpConfig?.defaultContractScopes?.[chainId];
+  const hasScopeOptions = options.scope != null || options.contracts != null || options.handles != null;
+  if (defaultContracts != null && defaultContracts.length > 0 && !hasScopeOptions) {
+    result.contracts = defaultContracts;
+  }
+  return result;
+};
+var ACL_SERVED_ADDRESSES_ABI = viem.parseAbi([
+  "function acl() view returns (address)",
+  "function defaultRevokerContract() view returns (address)",
+  "function shareRegistry() view returns (address)"
+]);
+var aclServedAddressesCache = /* @__PURE__ */ new Map();
+var clearAclServedAddresses = () => aclServedAddressesCache.clear();
+var getAclServedAddresses = async (publicClient, chainId) => {
+  const cached = aclServedAddressesCache.get(chainId);
+  if (cached != null)
+    return cached;
+  let aclAddress;
+  try {
+    aclAddress = await publicClient.readContract({
+      address: TASK_MANAGER_ADDRESS,
+      abi: ACL_SERVED_ADDRESSES_ABI,
+      functionName: "acl"
+    });
+  } catch {
+    return {};
+  }
+  const [defaultRevoker, shareRegistry] = await Promise.all([
+    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "defaultRevokerContract" }).catch(() => void 0),
+    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "shareRegistry" }).catch(() => void 0)
+  ]);
+  const resolved = {
+    defaultRevoker: defaultRevoker != null && defaultRevoker !== viem.zeroAddress ? defaultRevoker : void 0,
+    shareRegistry: shareRegistry != null && shareRegistry !== viem.zeroAddress ? shareRegistry : void 0
+  };
+  aclServedAddressesCache.set(chainId, resolved);
+  return resolved;
+};
+var applyACPDefaultsFromChain = async (options, acpConfig, publicClient, chainId) => {
+  const hasExplicitRevoker = acpConfig?.defaultRevoker?.[chainId] != null || options.revokerData != null || options.revokerContract != null;
+  if (hasExplicitRevoker)
+    return applyACPDefaults(options, acpConfig, chainId);
+  const served = await getAclServedAddresses(publicClient, chainId);
+  const effectiveConfig = served.defaultRevoker != null ? { ...acpConfig, defaultRevoker: { ...acpConfig?.defaultRevoker, [chainId]: served.defaultRevoker } } : acpConfig;
+  return applyACPDefaults(options, effectiveConfig, chainId);
+};
+var revokeACP = async (acp, walletClient) => {
+  if (acp.revokerContract === viem.zeroAddress || acp.revokerData === 0) {
+    throw new Error("ACP is not revocable: it has no revoker (revokerContract/revokerData unset)");
+  }
+  if (walletClient.account == null)
+    throw new Error("Missing walletClient account");
+  if (walletClient.account.address.toLowerCase() !== acp.issuer.toLowerCase()) {
+    throw new Error("Only the acp issuer can revoke it");
+  }
+  return walletClient.writeContract({
+    address: acp.revokerContract,
+    abi: ACP_VALIDATOR_ABI,
+    functionName: "revokeSingle",
+    args: [BigInt(acp.revokerData)],
+    account: walletClient.account,
+    chain: walletClient.chain
+  });
+};
+var revokeAllACPs = async (walletClient, publicClient, revokerContract) => {
+  if (walletClient.account == null)
+    throw new Error("Missing walletClient account");
+  let revoker = revokerContract;
+  if (revoker == null) {
+    const chainId = await publicClient.getChainId();
+    const active = getActiveACP2(chainId, walletClient.account.address);
+    revoker = active?.revokerContract;
+  }
+  if (revoker == null || revoker === viem.zeroAddress) {
+    throw new Error("No revoker contract: pass `revokerContract` or activate a revocable acp first");
+  }
+  return walletClient.writeContract({
+    address: revoker,
+    abi: ACP_VALIDATOR_ABI,
+    functionName: "revokeAllExisting",
+    args: [],
+    account: walletClient.account,
+    chain: walletClient.chain
+  });
+};
+var isACPRevoked = async (acp, publicClient) => {
+  if (acp.revokerContract === viem.zeroAddress || acp.revokerData === 0)
+    return false;
+  return publicClient.readContract({
+    address: acp.revokerContract,
+    abi: ACP_VALIDATOR_ABI,
+    functionName: "disabled",
+    args: [acp.issuer, BigInt(acp.revokerData)]
+  });
+};
+var ACP_SHARE_REGISTRY_ABI = viem.parseAbi([
+  "struct ACP { address issuer; uint64 expiration; address recipient; uint256 revokerData; address revokerContract; uint8 scope; address[] contracts; bytes32[] handles; bytes32 sealingKey; bytes issuerSignature; bytes recipientSignature; }",
+  "function share(ACP calldata acp) external returns (bytes32)",
+  "function removeShare(bytes32 shareId) external",
+  "function sharesFor(address recipient) external view returns (ACP[] memory)",
+  "function getShare(bytes32 shareId) external view returns (ACP memory)",
+  "function isShareValid(bytes32 shareId) external view returns (bool)"
+]);
+var ACP_TUPLE = [
+  {
+    type: "tuple",
+    components: [
+      { name: "issuer", type: "address" },
+      { name: "expiration", type: "uint64" },
+      { name: "recipient", type: "address" },
+      { name: "revokerData", type: "uint256" },
+      { name: "revokerContract", type: "address" },
+      { name: "scope", type: "uint8" },
+      { name: "contracts", type: "address[]" },
+      { name: "handles", type: "bytes32[]" },
+      { name: "sealingKey", type: "bytes32" },
+      { name: "issuerSignature", type: "bytes" },
+      { name: "recipientSignature", type: "bytes" }
+    ]
+  }
+];
+var ZERO_BYTES32 = `0x${"0".repeat(64)}`;
+var toChainShare = (acp) => {
+  const pub = ACPUtils.getPublic(acp, true);
+  return {
+    ...pub,
+    expiration: BigInt(pub.expiration),
+    revokerData: BigInt(pub.revokerData),
+    sealingKey: ZERO_BYTES32,
+    recipientSignature: "0x"
+  };
+};
+var computeShareId = (acp) => {
+  const p = toChainShare(acp);
+  return viem.keccak256(viem.encodeAbiParameters(ACP_TUPLE, [p]));
+};
+var shareOnChain = async (acp, walletClient, registry) => {
+  if (acp.type !== "sharing") {
+    throw new Error(`Cannot share a '${acp.type}' ACP on-chain \u2014 only 'sharing' ACPs are shareable.`);
+  }
+  if (acp.issuerSignature === "0x") {
+    throw new Error("Cannot share an unsigned sharing ACP \u2014 sign it first.");
+  }
+  if (walletClient.account == null)
+    throw new Error("Missing walletClient account");
+  if (walletClient.account.address.toLowerCase() !== acp.issuer.toLowerCase()) {
+    throw new Error("Only the ACP issuer can share it on-chain");
+  }
+  const txHash = await walletClient.writeContract({
+    address: registry,
+    abi: ACP_SHARE_REGISTRY_ABI,
+    functionName: "share",
+    args: [toChainShare(acp)],
+    account: walletClient.account,
+    chain: walletClient.chain ?? null
+  });
+  return { txHash, shareId: computeShareId(acp) };
+};
+var getIncomingShares = async (publicClient, registry, recipient) => {
+  const raw = await publicClient.readContract({
+    address: registry,
+    abi: ACP_SHARE_REGISTRY_ABI,
+    functionName: "sharesFor",
+    args: [recipient]
+  });
+  return raw.map((s) => ({
+    shareId: viem.keccak256(viem.encodeAbiParameters(ACP_TUPLE, [s])),
+    issuer: s.issuer,
+    expiration: Number(s.expiration),
+    recipient: s.recipient,
+    revokerData: Number(s.revokerData),
+    revokerContract: s.revokerContract,
+    scope: Number(s.scope),
+    contracts: [...s.contracts],
+    handles: [...s.handles],
+    issuerSignature: s.issuerSignature
+  }));
+};
+var importFromChain = async (share, publicClient, walletClient) => {
+  const { shareId: _shareId, ...options } = share;
+  return importShared({ ...options, type: "sharing" }, publicClient, walletClient);
+};
+var removeShareOnChain = async (shareId, walletClient, registry) => {
+  if (walletClient.account == null)
+    throw new Error("Missing walletClient account");
+  return walletClient.writeContract({
+    address: registry,
+    abi: ACP_SHARE_REGISTRY_ABI,
+    functionName: "removeShare",
+    args: [shareId],
+    account: walletClient.account,
+    chain: walletClient.chain ?? null
+  });
+};
+var removeACP2 = async (chainId, account, hash) => acpStore.removeACP(chainId, account, hash);
+var removeActiveACP = async (chainId, account) => acpStore.removeActiveACPHash(chainId, account);
+var acps = {
+  getSnapshot: acpStore.store.getState,
+  subscribe: acpStore.store.subscribe,
   createSelf,
   createSharing,
   importShared,
-  getOrCreateSelfPermit,
-  getOrCreateSharingPermit,
+  getOrCreateSelfACP,
+  getOrCreateSharingACP,
   getHash,
   export: exportShared,
   serialize,
   deserialize,
-  getPermit: getPermit2,
-  getPermits: getPermits2,
-  getActivePermit: getActivePermit2,
-  getActivePermitHash: getActivePermitHash2,
-  removePermit: removePermit2,
-  selectActivePermit,
-  removeActivePermit
+  getACP: getACP2,
+  getACPs: getACPs2,
+  getActiveACP: getActiveACP2,
+  getActiveACPHash: getActiveACPHash2,
+  removeACP: removeACP2,
+  selectActiveACP,
+  removeActiveACP,
+  revokeACP,
+  revokeAllACPs,
+  isACPRevoked,
+  shareOnChain,
+  getIncomingShares,
+  importFromChain,
+  removeShareOnChain,
+  computeShareId,
+  applyACPDefaults,
+  applyACPDefaultsFromChain,
+  getAclServedAddresses,
+  clearAclServedAddresses
 };
 function uint160ToAddress(uint160) {
   const hexStr = uint160.toString(16).padStart(40, "0");
@@ -2659,13 +2855,16 @@ var MockThresholdNetworkAbi = [
       {
         name: "permission",
         type: "tuple",
-        internalType: "struct Permission",
+        internalType: "struct ACPermission",
         components: [
           { name: "issuer", type: "address", internalType: "address" },
           { name: "expiration", type: "uint64", internalType: "uint64" },
           { name: "recipient", type: "address", internalType: "address" },
-          { name: "validatorId", type: "uint256", internalType: "uint256" },
-          { name: "validatorContract", type: "address", internalType: "address" },
+          { name: "revokerData", type: "uint256", internalType: "uint256" },
+          { name: "revokerContract", type: "address", internalType: "address" },
+          { name: "scope", type: "uint8", internalType: "uint8" },
+          { name: "contracts", type: "address[]", internalType: "address[]" },
+          { name: "handles", type: "bytes32[]", internalType: "bytes32[]" },
           { name: "sealingKey", type: "bytes32", internalType: "bytes32" },
           { name: "issuerSignature", type: "bytes", internalType: "bytes" },
           { name: "recipientSignature", type: "bytes", internalType: "bytes" }
@@ -2688,13 +2887,16 @@ var MockThresholdNetworkAbi = [
       {
         name: "permission",
         type: "tuple",
-        internalType: "struct Permission",
+        internalType: "struct ACPermission",
         components: [
           { name: "issuer", type: "address", internalType: "address" },
           { name: "expiration", type: "uint64", internalType: "uint64" },
           { name: "recipient", type: "address", internalType: "address" },
-          { name: "validatorId", type: "uint256", internalType: "uint256" },
-          { name: "validatorContract", type: "address", internalType: "address" },
+          { name: "revokerData", type: "uint256", internalType: "uint256" },
+          { name: "revokerContract", type: "address", internalType: "address" },
+          { name: "scope", type: "uint8", internalType: "uint8" },
+          { name: "contracts", type: "address[]", internalType: "address[]" },
+          { name: "handles", type: "bytes32[]", internalType: "bytes32[]" },
           { name: "sealingKey", type: "bytes32", internalType: "bytes32" },
           { name: "issuerSignature", type: "bytes", internalType: "bytes" },
           { name: "recipientSignature", type: "bytes", internalType: "bytes" }
@@ -2759,19 +2961,22 @@ var MockThresholdNetworkAbi = [
   },
   {
     type: "function",
-    name: "decryptForTxWithPermit",
+    name: "decryptForTxWithACP",
     inputs: [
       { name: "ctHash", type: "uint256", internalType: "uint256" },
       {
         name: "permission",
         type: "tuple",
-        internalType: "struct Permission",
+        internalType: "struct ACPermission",
         components: [
           { name: "issuer", type: "address", internalType: "address" },
           { name: "expiration", type: "uint64", internalType: "uint64" },
           { name: "recipient", type: "address", internalType: "address" },
-          { name: "validatorId", type: "uint256", internalType: "uint256" },
-          { name: "validatorContract", type: "address", internalType: "address" },
+          { name: "revokerData", type: "uint256", internalType: "uint256" },
+          { name: "revokerContract", type: "address", internalType: "address" },
+          { name: "scope", type: "uint8", internalType: "uint8" },
+          { name: "contracts", type: "address[]", internalType: "address[]" },
+          { name: "handles", type: "bytes32[]", internalType: "bytes32[]" },
           { name: "sealingKey", type: "bytes32", internalType: "bytes32" },
           { name: "issuerSignature", type: "bytes", internalType: "bytes" },
           { name: "recipientSignature", type: "bytes", internalType: "bytes" }
@@ -2787,7 +2992,7 @@ var MockThresholdNetworkAbi = [
   },
   {
     type: "function",
-    name: "decryptForTxWithoutPermit",
+    name: "decryptForTxWithoutACP",
     inputs: [{ name: "ctHash", type: "uint256", internalType: "uint256" }],
     outputs: [
       { name: "allowed", type: "bool", internalType: "bool" },
@@ -2799,12 +3004,12 @@ var MockThresholdNetworkAbi = [
 ];
 
 // core/decrypt/cofheMocksDecryptForView.ts
-async function cofheMocksDecryptForView(ctHash, utype, permit, publicClient) {
-  const permission = PermitUtils.getPermission(permit, true);
+async function cofheMocksDecryptForView(ctHash, utype, acp, publicClient) {
+  const wireAcp = ACPUtils.getPublic(acp, true);
   const permissionWithBigInts = {
-    ...permission,
-    expiration: BigInt(permission.expiration),
-    validatorId: BigInt(permission.validatorId)
+    ...wireAcp,
+    expiration: BigInt(wireAcp.expiration),
+    revokerData: BigInt(wireAcp.revokerData)
   };
   const [allowed, error, result] = await publicClient.readContract({
     address: MOCKS_THRESHOLD_NETWORK_ADDRESS,
@@ -2825,11 +3030,34 @@ async function cofheMocksDecryptForView(ctHash, utype, permit, publicClient) {
     });
   }
   const sealedBigInt = BigInt(result);
-  const sealingKeyBigInt = BigInt(permission.sealingKey);
+  const sealingKeyBigInt = BigInt(acp.sealingKey);
   const unsealed = sealedBigInt ^ sealingKeyBigInt;
   return unsealed;
 }
 
+// core/debug.ts
+var interceptors = {};
+async function cofheFetch(url, init, ctx = { op: "request" }) {
+  let finalUrl = url;
+  let finalInit = init;
+  if (interceptors.onRequest) {
+    const override = await interceptors.onRequest(finalUrl, finalInit, ctx);
+    if (override) {
+      if (override.url !== void 0)
+        finalUrl = override.url;
+      if (override.init !== void 0)
+        finalInit = override.init;
+    }
+  }
+  let response = await fetch(finalUrl, finalInit);
+  if (interceptors.onResponse) {
+    const replaced = await interceptors.onResponse(response, ctx);
+    if (replaced)
+      response = replaced;
+  }
+  return response;
+}
+
 // core/decrypt/polling.ts
 function computeMinuteRampPollIntervalMs(elapsedMs, params) {
   const elapsedSeconds = Math.floor(elapsedMs / 1e3);
@@ -2838,11 +3066,61 @@ function computeMinuteRampPollIntervalMs(elapsedMs, params) {
   return Math.min(params.maxIntervalMs, Math.max(params.minIntervalMs, intervalMs));
 }
 
+// core/decrypt/apiError.ts
+var BACKEND_ERROR_CODE_TO_COFHE_ERROR_CODE = {
+  bad_request: "BAD_REQUEST" /* BadRequest */,
+  unknown_chain: "UNKNOWN_CHAIN" /* UnknownChain */,
+  acp_malformed: "ACP_MALFORMED" /* ACPMalformed */,
+  acp_denied: "ACP_DENIED" /* ACPDenied */,
+  // ACP-era backends fold revoked into denied
+  acp_expired: "ACP_EXPIRED" /* ACPExpired */,
+  acp_invalid: "ACP_INVALID" /* ACPInvalid */,
+  acp_required: "ACP_REQUIRED" /* ACPRequired */,
+  acp_verifier_error: "ACP_VERIFIER_ERROR" /* ACPVerifierError */,
+  acp_verifier_timeout: "ACP_VERIFIER_TIMEOUT" /* ACPVerifierTimeout */,
+  not_publicly_allowed: "NOT_PUBLICLY_ALLOWED" /* NotPubliclyAllowed */,
+  ct_not_found: "CT_NOT_FOUND" /* CtNotFound */,
+  unsupported_security_zone: "UNSUPPORTED_SECURITY_ZONE" /* UnsupportedSecurityZone */,
+  unsupported_type: "UNSUPPORTED_TYPE" /* UnsupportedType */,
+  internal_error: "INTERNAL_ERROR" /* InternalError */,
+  signing_failed: "SIGNING_FAILED" /* SigningFailed */,
+  ct_source_error: "CT_SOURCE_ERROR" /* CtSourceError */,
+  ct_source_timeout: "CT_SOURCE_TIMEOUT" /* CtSourceTimeout */,
+  seal_failed: "SEAL_FAILED" /* SealFailed */
+};
+function isBackendApiErrorCode(value) {
+  return value in BACKEND_ERROR_CODE_TO_COFHE_ERROR_CODE;
+}
+async function parseApiErrorResponseBody(response) {
+  let errorMessage = `HTTP ${response.status}`;
+  let apiErrorCode;
+  try {
+    const body = await response.json();
+    if (body && typeof body === "object") {
+      const record = body;
+      if (typeof record.error === "string" && record.error.length > 0) {
+        apiErrorCode = record.error;
+      }
+      if (typeof record.error_message === "string" && record.error_message.length > 0) {
+        errorMessage = record.error_message;
+      } else if (typeof record.message === "string" && record.message.length > 0) {
+        errorMessage = record.message;
+      }
+    }
+  } catch {
+    errorMessage = response.statusText || errorMessage;
+  }
+  return { apiErrorCode, errorMessage };
+}
+function mapApiErrorCodeToCofheErrorCode(apiErrorCode, fallback) {
+  if (apiErrorCode && isBackendApiErrorCode(apiErrorCode)) {
+    return BACKEND_ERROR_CODE_TO_COFHE_ERROR_CODE[apiErrorCode];
+  }
+  return fallback;
+}
+
 // core/decrypt/submitRetry.ts
 var DEFAULT_404_RETRY_TIMEOUT_MS = 1e4;
-function isRetryableSubmitStatus(status) {
-  return status === 204 || status === 404;
-}
 function normalize404RetryTimeoutMs(params) {
   const { timeoutMs, operationLabel, errorCode } = params;
   if (timeoutMs === void 0)
@@ -2859,32 +3137,24 @@ function normalize404RetryTimeoutMs(params) {
   return timeoutMs;
 }
 async function classifySubmitResponse(params) {
-  const { response, extractErrorMessage } = params;
-  if (isRetryableSubmitStatus(response.status)) {
-    return { kind: "retryable", status: response.status };
+  const { response, fallbackErrorCode } = params;
+  if (response.status === 204) {
+    return { kind: "retryable", status: 204 };
   }
   if (response.ok) {
     return { kind: "parse-json" };
   }
-  let errorMessage = `HTTP ${response.status}`;
-  try {
-    const errorBody = await response.json();
-    const maybeErrorMessage = extractErrorMessage?.(errorBody);
-    if (typeof maybeErrorMessage === "string" && maybeErrorMessage.length > 0) {
-      errorMessage = maybeErrorMessage;
-    } else if (errorBody && typeof errorBody === "object") {
-      const defaultMessage = errorBody.error_message;
-      const fallbackMessage = errorBody.message;
-      if (typeof defaultMessage === "string" && defaultMessage.length > 0) {
-        errorMessage = defaultMessage;
-      } else if (typeof fallbackMessage === "string" && fallbackMessage.length > 0) {
-        errorMessage = fallbackMessage;
-      }
-    }
-  } catch {
-    errorMessage = response.statusText || errorMessage;
+  const { apiErrorCode, errorMessage } = await parseApiErrorResponseBody(response);
+  if (response.status === 404) {
+    return { kind: "retryable", status: 404, apiErrorMessage: errorMessage };
   }
-  return { kind: "fatal-http", errorMessage };
+  return {
+    kind: "fatal-http",
+    status: response.status,
+    cofheErrorCode: mapApiErrorCodeToCofheErrorCode(apiErrorCode, fallbackErrorCode),
+    apiErrorCode,
+    errorMessage
+  };
 }
 function throwIfSubmitRetryTimedOut(params) {
   const {
@@ -2896,12 +3166,14 @@ function throwIfSubmitRetryTimedOut(params) {
     overallTimeoutMs,
     thresholdNetworkUrl,
     body,
-    attemptIndex
+    attemptIndex,
+    lastKnownErrorMessage
   } = params;
   if (status === 404 && elapsedMs > retry404TimeoutMs) {
     throw new CofheError({
-      code: errorCode,
-      message: `${operationLabel} submit retried 404 responses without receiving request_id for ${retry404TimeoutMs}ms`,
+      code: "CT_NOT_FOUND" /* CtNotFound */,
+      apiErrorCode: "ct_not_found",
+      message: `${operationLabel} ciphertext not found after retrying for ${retry404TimeoutMs}ms` + (lastKnownErrorMessage ? `: ${lastKnownErrorMessage}` : ""),
       hint: "The ciphertext may not be indexed yet. Increase set404RetryTimeout(...) if the backend is slow to index ciphertexts.",
       context: {
         thresholdNetworkUrl,
@@ -2927,6 +3199,62 @@ function throwIfSubmitRetryTimedOut(params) {
     });
   }
 }
+function normalizeTnSignature(signature) {
+  if (typeof signature !== "string") {
+    throw new CofheError({
+      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
+      message: "decrypt response missing signature",
+      context: {
+        signature
+      }
+    });
+  }
+  const trimmed = signature.trim();
+  if (trimmed.length === 0) {
+    throw new CofheError({
+      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
+      message: "decrypt response returned empty signature"
+    });
+  }
+  const prefixed = trimmed.startsWith("0x") ? trimmed : `0x${trimmed}`;
+  const parsed = viem.parseSignature(prefixed);
+  return viem.serializeSignature(parsed);
+}
+function parseDecryptedBytesToBigInt(decrypted) {
+  if (!Array.isArray(decrypted)) {
+    throw new CofheError({
+      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
+      message: "decrypt response field <decrypted> must be a byte array",
+      context: {
+        decrypted
+      }
+    });
+  }
+  if (decrypted.length === 0) {
+    throw new CofheError({
+      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
+      message: "decrypt response field <decrypted> was an empty byte array",
+      context: {
+        decrypted
+      }
+    });
+  }
+  let hex = "";
+  for (const b of decrypted) {
+    if (typeof b !== "number" || !Number.isInteger(b) || b < 0 || b > 255) {
+      throw new CofheError({
+        code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
+        message: "decrypt response field <decrypted> contained a non-byte value",
+        context: {
+          badElement: b,
+          decrypted
+        }
+      });
+    }
+    hex += b.toString(16).padStart(2, "0");
+  }
+  return BigInt(`0x${hex}`);
+}
 
 // core/decrypt/tnSealOutputV2.ts
 var POLL_INTERVAL_MS = 1e3;
@@ -2989,23 +3317,28 @@ function parseCompletedSealOutputResponse(params) {
   }
   return convertSealedData(sealed);
 }
-async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, permission, overallStartTime, retry404TimeoutMs, onPoll) {
+async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, acp, overallStartTime, retry404TimeoutMs, onPoll) {
   const body = {
     ct_tempkey: BigInt(ctHash).toString(16).padStart(64, "0"),
     host_chain_id: chainId,
-    permit: permission
+    acp
   };
   let attemptIndex = 0;
+  let last404ApiErrorMessage;
   for (; ; ) {
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput`,
+        /*op:sealoutput*/
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
@@ -3019,16 +3352,19 @@ async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, per
         }
       });
     }
-    const responseClassification = await classifySubmitResponse({ response });
+    const responseClassification = await classifySubmitResponse({
+      response,
+      fallbackErrorCode: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */
+    });
     if (responseClassification.kind === "fatal-http") {
       throw new CofheError({
-        code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
+        code: responseClassification.cofheErrorCode,
+        apiErrorCode: responseClassification.apiErrorCode,
         message: `sealOutput request failed: ${responseClassification.errorMessage}`,
         hint: "Check the threshold network URL and request parameters.",
         context: {
           thresholdNetworkUrl,
-          status: response.status,
-          statusText: response.statusText,
+          status: responseClassification.status,
           body,
           attemptIndex
         }
@@ -3074,6 +3410,9 @@ async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, per
         }
       });
     }
+    if (responseClassification.status === 404) {
+      last404ApiErrorMessage = responseClassification.apiErrorMessage;
+    }
     const elapsedMs = Date.now() - overallStartTime;
     throwIfSubmitRetryTimedOut({
       operationLabel: "sealOutput",
@@ -3084,7 +3423,8 @@ async function submitSealOutputRequest(thresholdNetworkUrl, ctHash, chainId, per
       overallTimeoutMs: SEAL_OUTPUT_TIMEOUT_MS,
       thresholdNetworkUrl,
       body,
-      attemptIndex
+      attemptIndex,
+      lastKnownErrorMessage: last404ApiErrorMessage
     });
     onPoll?.({
       operation: "sealoutput",
@@ -3128,12 +3468,16 @@ async function pollSealOutputStatus(thresholdNetworkUrl, requestId, overallStart
     }
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/sealoutput/${requestId}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json"
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/sealoutput/${requestId}`,
+        /*op:sealoutput-poll*/
+        {
+          method: "GET",
+          headers: {
+            "Content-Type": "application/json"
+          }
         }
-      });
+      );
     } catch (e) {
       throw new CofheError({
         code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
@@ -3158,15 +3502,10 @@ async function pollSealOutputStatus(thresholdNetworkUrl, requestId, overallStart
       });
     }
     if (!response.ok) {
-      let errorMessage = `HTTP ${response.status}`;
-      try {
-        const errorBody = await response.json();
-        errorMessage = errorBody.error_message || errorBody.message || errorMessage;
-      } catch {
-        errorMessage = response.statusText || errorMessage;
-      }
+      const { apiErrorCode, errorMessage } = await parseApiErrorResponseBody(response);
       throw new CofheError({
-        code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
+        code: mapApiErrorCodeToCofheErrorCode(apiErrorCode, "SEAL_OUTPUT_FAILED" /* SealOutputFailed */),
+        apiErrorCode,
         message: `sealOutput status poll failed: ${errorMessage}`,
         context: {
           thresholdNetworkUrl,
@@ -3210,7 +3549,7 @@ async function pollSealOutputStatus(thresholdNetworkUrl, requestId, overallStart
   });
 }
 async function tnSealOutputV2(params) {
-  const { thresholdNetworkUrl, ctHash, chainId, permission, retry404TimeoutMs, onPoll } = params;
+  const { thresholdNetworkUrl, ctHash, chainId, acp, retry404TimeoutMs, onPoll } = params;
   const normalized404RetryTimeoutMs = normalize404RetryTimeoutMs({
     timeoutMs: retry404TimeoutMs,
     operationLabel: "sealOutput",
@@ -3221,7 +3560,7 @@ async function tnSealOutputV2(params) {
     thresholdNetworkUrl,
     ctHash,
     chainId,
-    permission,
+    acp,
     overallStartTime,
     normalized404RetryTimeoutMs,
     onPoll
@@ -3237,8 +3576,8 @@ var DEFAULT_404_RETRY_TIMEOUT_MS2 = 1e4;
 var DecryptForViewBuilder = class extends BaseBuilder {
   ctHash;
   utype;
-  permitHash;
-  permit;
+  acpHash;
+  acp;
   pollCallback;
   retry404TimeoutMs = DEFAULT_404_RETRY_TIMEOUT_MS2;
   constructor(params) {
@@ -3252,11 +3591,11 @@ var DecryptForViewBuilder = class extends BaseBuilder {
     });
     this.ctHash = params.ctHash;
     this.utype = params.utype;
-    this.permitHash = params.permitHash;
-    this.permit = params.permit;
+    this.acpHash = params.acpHash;
+    this.acp = params.acp;
   }
   /**
-   * @param chainId - Chain to decrypt values from. Used to fetch the threshold network URL and use the correct permit.
+   * @param chainId - Chain to decrypt values from. Used to fetch the threshold network URL and use the correct acp.
    *
    * If not provided, the chainId will be fetched from the connected publicClient.
    *
@@ -3277,7 +3616,7 @@ var DecryptForViewBuilder = class extends BaseBuilder {
     return this.chainId;
   }
   /**
-   * @param account - Account to decrypt values from. Used to fetch the correct permit.
+   * @param account - Account to decrypt values from. Used to fetch the correct acp.
    *
    * If not provided, the account will be fetched from the connected walletClient.
    *
@@ -3314,61 +3653,61 @@ var DecryptForViewBuilder = class extends BaseBuilder {
     this.retry404TimeoutMs = timeoutMs;
     return this;
   }
-  withPermit(permitOrPermitHash) {
-    if (typeof permitOrPermitHash === "string") {
-      this.permitHash = permitOrPermitHash;
-      this.permit = void 0;
-    } else if (permitOrPermitHash === void 0) {
-      this.permitHash = void 0;
-      this.permit = void 0;
+  withACP(acpOrACPHash) {
+    if (typeof acpOrACPHash === "string") {
+      this.acpHash = acpOrACPHash;
+      this.acp = void 0;
+    } else if (acpOrACPHash === void 0) {
+      this.acpHash = void 0;
+      this.acp = void 0;
     } else {
-      this.permit = permitOrPermitHash;
-      this.permitHash = void 0;
+      this.acp = acpOrACPHash;
+      this.acpHash = void 0;
     }
     return this;
   }
   /**
-   * @param permitHash - Permit hash to decrypt values from. Used to fetch the correct permit.
+   * @param acpHash - ACP hash to decrypt values from. Used to fetch the correct acp.
    *
-   * If not provided, the active permit for the chainId and account will be used.
-   * If `setPermit()` is called, it will be used regardless of chainId, account, or permitHash.
+   * If not provided, the active acp for the chainId and account will be used.
+   * If `setACP()` is called, it will be used regardless of chainId, account, or acpHash.
    *
    * Example:
    * ```typescript
    * const unsealed = await client.decryptForView(ctHash, utype)
-   *   .setPermitHash('0x1234567890123456789012345678901234567890')
+   *   .setACPHash('0x1234567890123456789012345678901234567890')
    *   .execute();
    * ```
    *
    * @returns The chainable DecryptForViewBuilder instance.
    */
-  /** @deprecated Use `withPermit(permitHash)` instead. */
-  setPermitHash(permitHash) {
-    return this.withPermit(permitHash);
+  /** @deprecated Use `withACP(acpHash)` instead. */
+  setACPHash(acpHash) {
+    return this.withACP(acpHash);
   }
-  getPermitHash() {
-    return this.permitHash;
+  getACPHash() {
+    return this.acpHash;
   }
   /**
-   * @param permit - Permit to decrypt values with. If provided, it will be used regardless of chainId, account, or permitHash.
+   * @param acp - ACP to decrypt values with. If provided, it will be used regardless of chainId, account, or acpHash.
    *
-   * If not provided, the permit will be determined by chainId, account, and permitHash.
+   * If not provided, the acp will be determined by chainId, account, and acpHash.
    *
    * Example:
    * ```typescript
    * const unsealed = await client.decryptForView(ctHash, utype)
-   *   .setPermit(permit)
+   *   .setACP(acp)
    *   .execute();
    * ```
    *
    * @returns The chainable DecryptForViewBuilder instance.
    */
-  /** @deprecated Use `withPermit(permit)` instead. */
-  setPermit(permit) {
-    return this.withPermit(permit);
+  /** @deprecated Use `withACP(acp)` instead. */
+  setACP(acp) {
+    return this.withACP(acp);
   }
-  getPermit() {
-    return this.permit;
+  getACP() {
+    return this.acp;
   }
   async getThresholdNetworkUrl() {
     this.assertChainId();
@@ -3384,77 +3723,77 @@ var DecryptForViewBuilder = class extends BaseBuilder {
         }
       });
   }
-  async getResolvedPermit() {
-    if (this.permit)
-      return this.permit;
+  async getResolvedACP() {
+    if (this.acp)
+      return this.acp;
     this.assertChainId();
     this.assertAccount();
-    if (this.permitHash) {
-      const permit2 = await permits.getPermit(this.chainId, this.account, this.permitHash);
-      if (!permit2) {
+    if (this.acpHash) {
+      const acp2 = await acps.getACP(this.chainId, this.account, this.acpHash);
+      if (!acp2) {
         throw new CofheError({
-          code: "PERMIT_NOT_FOUND" /* PermitNotFound */,
-          message: `Permit with hash <${this.permitHash}> not found for account <${this.account}> and chainId <${this.chainId}>`,
-          hint: "Ensure the permit exists and is valid.",
+          code: "ACP_NOT_FOUND" /* ACPNotFound */,
+          message: `ACP with hash <${this.acpHash}> not found for account <${this.account}> and chainId <${this.chainId}>`,
+          hint: "Ensure the acp exists and is valid.",
           context: {
             chainId: this.chainId,
             account: this.account,
-            permitHash: this.permitHash
+            acpHash: this.acpHash
           }
         });
       }
-      return permit2;
+      return acp2;
     }
-    const permit = await permits.getActivePermit(this.chainId, this.account);
-    if (!permit) {
+    const acp = await acps.getActiveACP(this.chainId, this.account);
+    if (!acp) {
       throw new CofheError({
-        code: "PERMIT_NOT_FOUND" /* PermitNotFound */,
-        message: `Active permit not found for chainId <${this.chainId}> and account <${this.account}>`,
-        hint: "Ensure a permit exists for this account on this chain.",
+        code: "ACP_NOT_FOUND" /* ACPNotFound */,
+        message: `Active acp not found for chainId <${this.chainId}> and account <${this.account}>`,
+        hint: "Ensure an ACP exists for this account on this chain.",
         context: {
           chainId: this.chainId,
           account: this.account
         }
       });
     }
-    return permit;
+    return acp;
   }
   /**
    * On hardhat, interact with MockZkVerifier contract instead of CoFHE
    */
-  async mocksSealOutput(permit) {
+  async mocksSealOutput(acp) {
     this.assertPublicClient();
     const mocksDecryptDelay = this.config.mocks.decryptDelay;
     if (mocksDecryptDelay > 0)
       await sleep(mocksDecryptDelay);
-    return cofheMocksDecryptForView(this.ctHash, this.utype, permit, this.publicClient);
+    return cofheMocksDecryptForView(this.ctHash, this.utype, acp, this.publicClient);
   }
   /**
    * In the production context, perform a true decryption with the CoFHE coprocessor.
    */
-  async productionSealOutput(permit) {
+  async productionSealOutput(acp) {
     this.assertChainId();
     this.assertPublicClient();
     const thresholdNetworkUrl = await this.getThresholdNetworkUrl();
-    const permission = PermitUtils.getPermission(permit, true);
+    const wireAcp = ACPUtils.getPublic(acp, true);
     const sealed = await tnSealOutputV2({
       ctHash: this.ctHash,
       chainId: this.chainId,
-      permission,
+      acp: wireAcp,
       thresholdNetworkUrl,
       retry404TimeoutMs: this.retry404TimeoutMs,
       onPoll: this.pollCallback
     });
-    return PermitUtils.unseal(permit, sealed);
+    return ACPUtils.unseal(acp, sealed);
   }
   /**
    * Final step of the decryption process. MUST BE CALLED LAST IN THE CHAIN.
    *
    * This will:
-   * - Use a permit based on provided permit OR chainId + account + permitHash
-   * - Check permit validity
-   * - Call CoFHE `/sealoutput` with the permit, which returns a sealed (encrypted) item
-   * - Unseal the sealed item with the permit
+   * - Use an ACP based on provided acp OR chainId + account + acpHash
+   * - Check acp validity
+   * - Call CoFHE `/sealoutput` with the acp, which returns a sealed (encrypted) item
+   * - Unseal the sealed item with the acp
    * - Return the unsealed item
    *
    * Example:
@@ -3462,7 +3801,7 @@ var DecryptForViewBuilder = class extends BaseBuilder {
    * const unsealed = await client.decryptForView(ctHash, utype)
    *   .setChainId(11155111)      // optional
    *   .setAccount('0x123...890') // optional
-   *   .withPermit()              // optional
+   *   .withACP()              // optional
    *   .execute();                // execute
    * ```
    *
@@ -3470,14 +3809,14 @@ var DecryptForViewBuilder = class extends BaseBuilder {
    */
   async execute() {
     this.validateUtypeOrThrow();
-    const permit = await this.getResolvedPermit();
-    PermitUtils.validate(permit);
-    const chainId = permit._signedDomain.chainId;
+    const acp = await this.getResolvedACP();
+    ACPUtils.validate(acp);
+    const chainId = acp._signedDomain.chainId;
     let unsealed;
     if (chainId === hardhat2.id) {
-      unsealed = await this.mocksSealOutput(permit);
+      unsealed = await this.mocksSealOutput(acp);
     } else {
-      unsealed = await this.productionSealOutput(permit);
+      unsealed = await this.productionSealOutput(acp);
     }
     return convertViaUtype(this.utype, unsealed);
   }
@@ -3485,28 +3824,28 @@ var DecryptForViewBuilder = class extends BaseBuilder {
 var UINT_TYPE_MASK = 0x7fn;
 var TYPE_BYTE_OFFSET = 8n;
 var getEncryptionTypeFromCtHash = (ctHash) => Number(ctHash >> TYPE_BYTE_OFFSET & UINT_TYPE_MASK);
-async function cofheMocksDecryptForTx(ctHash, utype, permit, publicClient) {
+async function cofheMocksDecryptForTx(ctHash, utype, acp, publicClient) {
   let allowed;
   let error;
   let decryptedValue;
-  if (permit !== null) {
-    let permission = PermitUtils.getPermission(permit, true);
+  if (acp !== null) {
+    const wireAcp = ACPUtils.getPublic(acp, true);
     const permissionWithBigInts = {
-      ...permission,
-      expiration: BigInt(permission.expiration),
-      validatorId: BigInt(permission.validatorId)
+      ...wireAcp,
+      expiration: BigInt(wireAcp.expiration),
+      revokerData: BigInt(wireAcp.revokerData)
     };
     [allowed, error, decryptedValue] = await publicClient.readContract({
       address: MOCKS_THRESHOLD_NETWORK_ADDRESS,
       abi: MockThresholdNetworkAbi,
-      functionName: "decryptForTxWithPermit",
+      functionName: "decryptForTxWithACP",
       args: [BigInt(ctHash), permissionWithBigInts]
     });
   } else {
     [allowed, error, decryptedValue] = await publicClient.readContract({
       address: MOCKS_THRESHOLD_NETWORK_ADDRESS,
       abi: MockThresholdNetworkAbi,
-      functionName: "decryptForTxWithoutPermit",
+      functionName: "decryptForTxWithoutACP",
       args: [BigInt(ctHash)]
     });
   }
@@ -3541,62 +3880,6 @@ async function cofheMocksDecryptForTx(ctHash, utype, permit, publicClient) {
     signature
   };
 }
-function normalizeTnSignature(signature) {
-  if (typeof signature !== "string") {
-    throw new CofheError({
-      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
-      message: "decrypt response missing signature",
-      context: {
-        signature
-      }
-    });
-  }
-  const trimmed = signature.trim();
-  if (trimmed.length === 0) {
-    throw new CofheError({
-      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
-      message: "decrypt response returned empty signature"
-    });
-  }
-  const prefixed = trimmed.startsWith("0x") ? trimmed : `0x${trimmed}`;
-  const parsed = viem.parseSignature(prefixed);
-  return viem.serializeSignature(parsed);
-}
-function parseDecryptedBytesToBigInt(decrypted) {
-  if (!Array.isArray(decrypted)) {
-    throw new CofheError({
-      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
-      message: "decrypt response field <decrypted> must be a byte array",
-      context: {
-        decrypted
-      }
-    });
-  }
-  if (decrypted.length === 0) {
-    throw new CofheError({
-      code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
-      message: "decrypt response field <decrypted> was an empty byte array",
-      context: {
-        decrypted
-      }
-    });
-  }
-  let hex = "";
-  for (const b of decrypted) {
-    if (typeof b !== "number" || !Number.isInteger(b) || b < 0 || b > 255) {
-      throw new CofheError({
-        code: "DECRYPT_RETURNED_NULL" /* DecryptReturnedNull */,
-        message: "decrypt response field <decrypted> contained a non-byte value",
-        context: {
-          badElement: b,
-          decrypted
-        }
-      });
-    }
-    hex += b.toString(16).padStart(2, "0");
-  }
-  return BigInt(`0x${hex}`);
-}
 
 // core/decrypt/tnDecryptV2.ts
 var POLL_INTERVAL_MS2 = 1e3;
@@ -3718,25 +4001,30 @@ function assertDecryptStatusResponseV2(value) {
   }
   return value;
 }
-async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, permission, overallStartTime, retry404TimeoutMs, onPoll) {
+async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, acp, overallStartTime, retry404TimeoutMs, onPoll) {
   const body = {
     ct_tempkey: BigInt(ctHash).toString(16).padStart(64, "0"),
     host_chain_id: chainId
   };
-  if (permission) {
-    body.permit = permission;
+  if (acp) {
+    body.acp = acp;
   }
   let attemptIndex = 0;
+  let last404ApiErrorMessage;
   for (; ; ) {
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt`, {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json"
-        },
-        body: JSON.stringify(body)
-      });
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt`,
+        /*op:decrypt*/
+        {
+          method: "POST",
+          headers: {
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify(body)
+        }
+      );
     } catch (e) {
       throw new CofheError({
         code: "DECRYPT_FAILED" /* DecryptFailed */,
@@ -3750,16 +4038,19 @@ async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, perm
         }
       });
     }
-    const responseClassification = await classifySubmitResponse({ response });
+    const responseClassification = await classifySubmitResponse({
+      response,
+      fallbackErrorCode: "DECRYPT_FAILED" /* DecryptFailed */
+    });
     if (responseClassification.kind === "fatal-http") {
       throw new CofheError({
-        code: "DECRYPT_FAILED" /* DecryptFailed */,
+        code: responseClassification.cofheErrorCode,
+        apiErrorCode: responseClassification.apiErrorCode,
         message: `decrypt request failed: ${responseClassification.errorMessage}`,
         hint: "Check the threshold network URL and request parameters.",
         context: {
           thresholdNetworkUrl,
-          status: response.status,
-          statusText: response.statusText,
+          status: responseClassification.status,
           body,
           attemptIndex
         }
@@ -3807,6 +4098,9 @@ async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, perm
         }
       });
     }
+    if (responseClassification.status === 404) {
+      last404ApiErrorMessage = responseClassification.apiErrorMessage;
+    }
     const elapsedMs = Date.now() - overallStartTime;
     throwIfSubmitRetryTimedOut({
       operationLabel: "decrypt",
@@ -3817,7 +4111,8 @@ async function submitDecryptRequestV2(thresholdNetworkUrl, ctHash, chainId, perm
       overallTimeoutMs: DECRYPT_TIMEOUT_MS,
       thresholdNetworkUrl,
       body,
-      attemptIndex
+      attemptIndex,
+      lastKnownErrorMessage: last404ApiErrorMessage
     });
     onPoll?.({
       operation: "decrypt",
@@ -3861,12 +4156,16 @@ async function pollDecryptStatusV2(thresholdNetworkUrl, requestId, overallStartT
     }
     let response;
     try {
-      response = await fetch(`${thresholdNetworkUrl}/v2/decrypt/${requestId}`, {
-        method: "GET",
-        headers: {
-          "Content-Type": "application/json"
+      response = await cofheFetch(
+        `${thresholdNetworkUrl}/v2/decrypt/${requestId}`,
+        /*op:decrypt-poll*/
+        {
+          method: "GET",
+          headers: {
+            "Content-Type": "application/json"
+          }
         }
-      });
+      );
     } catch (e) {
       throw new CofheError({
         code: "DECRYPT_FAILED" /* DecryptFailed */,
@@ -3891,17 +4190,10 @@ async function pollDecryptStatusV2(thresholdNetworkUrl, requestId, overallStartT
       });
     }
     if (!response.ok) {
-      let errorMessage = `HTTP ${response.status}`;
-      try {
-        const errorBody = await response.json();
-        const maybeMessage = errorBody.error_message || errorBody.message;
-        if (typeof maybeMessage === "string" && maybeMessage.length > 0)
-          errorMessage = maybeMessage;
-      } catch {
-        errorMessage = response.statusText || errorMessage;
-      }
+      const { apiErrorCode, errorMessage } = await parseApiErrorResponseBody(response);
       throw new CofheError({
-        code: "DECRYPT_FAILED" /* DecryptFailed */,
+        code: mapApiErrorCodeToCofheErrorCode(apiErrorCode, "DECRYPT_FAILED" /* DecryptFailed */),
+        apiErrorCode,
         message: `decrypt status poll failed: ${errorMessage}`,
         context: {
           thresholdNetworkUrl,
@@ -3946,7 +4238,7 @@ async function pollDecryptStatusV2(thresholdNetworkUrl, requestId, overallStartT
   });
 }
 async function tnDecryptV2(params) {
-  const { thresholdNetworkUrl, ctHash, chainId, permission, retry404TimeoutMs, onPoll } = params;
+  const { thresholdNetworkUrl, ctHash, chainId, acp, retry404TimeoutMs, onPoll } = params;
   const normalized404RetryTimeoutMs = normalize404RetryTimeoutMs({
     timeoutMs: retry404TimeoutMs,
     operationLabel: "decrypt",
@@ -3957,7 +4249,7 @@ async function tnDecryptV2(params) {
     thresholdNetworkUrl,
     ctHash,
     chainId,
-    permission,
+    acp,
     overallStartTime,
     normalized404RetryTimeoutMs,
     onPoll
@@ -3972,9 +4264,9 @@ async function tnDecryptV2(params) {
 var DEFAULT_404_RETRY_TIMEOUT_MS3 = 1e4;
 var DecryptForTxBuilder = class extends BaseBuilder {
   ctHash;
-  permitHash;
-  permit;
-  permitSelection = "unset";
+  acpHash;
+  acp;
+  acpSelection = "unset";
   pollCallback;
   retry404TimeoutMs = DEFAULT_404_RETRY_TIMEOUT_MS3;
   constructor(params) {
@@ -4019,137 +4311,137 @@ var DecryptForTxBuilder = class extends BaseBuilder {
     this.retry404TimeoutMs = timeoutMs;
     return this;
   }
-  withPermit(permitOrPermitHash) {
-    if (this.permitSelection === "with-permit") {
+  withACP(acpOrACPHash) {
+    if (this.acpSelection === "with-acp") {
       throw new CofheError({
         code: "INTERNAL_ERROR" /* InternalError */,
-        message: "decryptForTx: withPermit() can only be selected once.",
-        hint: "Choose the permit mode once. If you need a different permit, start a new decryptForTx() builder chain."
+        message: "decryptForTx: withACP() can only be selected once.",
+        hint: "Choose the acp mode once. If you need a different acp, start a new decryptForTx() builder chain."
       });
     }
-    if (this.permitSelection === "without-permit") {
+    if (this.acpSelection === "without-acp") {
       throw new CofheError({
         code: "INTERNAL_ERROR" /* InternalError */,
-        message: "decryptForTx: cannot call withPermit() after withoutPermit() has been selected.",
-        hint: "Choose exactly one permit mode: either call .withPermit(...) or .withoutPermit(), but not both."
+        message: "decryptForTx: cannot call withACP() after withoutACP() has been selected.",
+        hint: "Choose exactly one acp mode: either call .withACP(...) or .withoutACP(), but not both."
       });
     }
-    this.permitSelection = "with-permit";
-    if (typeof permitOrPermitHash === "string") {
-      this.permitHash = permitOrPermitHash;
-      this.permit = void 0;
-    } else if (permitOrPermitHash === void 0) {
-      this.permitHash = void 0;
-      this.permit = void 0;
+    this.acpSelection = "with-acp";
+    if (typeof acpOrACPHash === "string") {
+      this.acpHash = acpOrACPHash;
+      this.acp = void 0;
+    } else if (acpOrACPHash === void 0) {
+      this.acpHash = void 0;
+      this.acp = void 0;
     } else {
-      this.permit = permitOrPermitHash;
-      this.permitHash = void 0;
+      this.acp = acpOrACPHash;
+      this.acpHash = void 0;
     }
     return this;
   }
   /**
-   * Select "no permit" mode.
+   * Select "no acp" mode.
    *
-   * This uses global allowance (no permit required) and sends an empty permission payload to `/decrypt`.
+   * This uses global allowance (no acp required) and sends an empty permission payload to `/decrypt`.
    */
-  withoutPermit() {
-    if (this.permitSelection === "without-permit") {
+  withoutACP() {
+    if (this.acpSelection === "without-acp") {
       throw new CofheError({
         code: "INTERNAL_ERROR" /* InternalError */,
-        message: "decryptForTx: withoutPermit() can only be selected once.",
-        hint: "Choose the permit mode once. If you need a different mode, start a new decryptForTx() builder chain."
+        message: "decryptForTx: withoutACP() can only be selected once.",
+        hint: "Choose the acp mode once. If you need a different mode, start a new decryptForTx() builder chain."
       });
     }
-    if (this.permitSelection === "with-permit") {
+    if (this.acpSelection === "with-acp") {
       throw new CofheError({
         code: "INTERNAL_ERROR" /* InternalError */,
-        message: "decryptForTx: cannot call withoutPermit() after withPermit() has been selected.",
-        hint: "Choose exactly one permit mode: either call .withPermit(...) or .withoutPermit(), but not both."
+        message: "decryptForTx: cannot call withoutACP() after withACP() has been selected.",
+        hint: "Choose exactly one acp mode: either call .withACP(...) or .withoutACP(), but not both."
       });
     }
-    this.permitSelection = "without-permit";
-    this.permitHash = void 0;
-    this.permit = void 0;
+    this.acpSelection = "without-acp";
+    this.acpHash = void 0;
+    this.acp = void 0;
     return this;
   }
-  getPermit() {
-    return this.permit;
+  getACP() {
+    return this.acp;
   }
-  getPermitHash() {
-    return this.permitHash;
+  getACPHash() {
+    return this.acpHash;
   }
   async getThresholdNetworkUrl() {
     this.assertChainId();
     return getThresholdNetworkUrlOrThrow(this.config, this.chainId);
   }
-  async getResolvedPermit() {
-    if (this.permitSelection === "unset") {
+  async getResolvedACP() {
+    if (this.acpSelection === "unset") {
       throw new CofheError({
         code: "INTERNAL_ERROR" /* InternalError */,
-        message: "decryptForTx: missing permit selection; call withPermit(...) or withoutPermit() before execute().",
-        hint: "Call .withPermit() to use the active permit, or .withoutPermit() for global allowance."
+        message: "decryptForTx: missing acp selection; call withACP(...) or withoutACP() before execute().",
+        hint: "Call .withACP() to use the active acp, or .withoutACP() for global allowance."
       });
     }
-    if (this.permitSelection === "without-permit") {
+    if (this.acpSelection === "without-acp") {
       return null;
     }
-    if (this.permit)
-      return this.permit;
+    if (this.acp)
+      return this.acp;
     this.assertChainId();
     this.assertAccount();
-    if (this.permitHash) {
-      const permit2 = await permits.getPermit(this.chainId, this.account, this.permitHash);
-      if (!permit2) {
+    if (this.acpHash) {
+      const acp2 = await acps.getACP(this.chainId, this.account, this.acpHash);
+      if (!acp2) {
         throw new CofheError({
-          code: "PERMIT_NOT_FOUND" /* PermitNotFound */,
-          message: `Permit with hash <${this.permitHash}> not found for account <${this.account}> and chainId <${this.chainId}>`,
-          hint: "Ensure the permit exists and is valid.",
+          code: "ACP_NOT_FOUND" /* ACPNotFound */,
+          message: `ACP with hash <${this.acpHash}> not found for account <${this.account}> and chainId <${this.chainId}>`,
+          hint: "Ensure the acp exists and is valid.",
           context: {
             chainId: this.chainId,
             account: this.account,
-            permitHash: this.permitHash
+            acpHash: this.acpHash
           }
         });
       }
-      return permit2;
+      return acp2;
     }
-    const permit = await permits.getActivePermit(this.chainId, this.account);
-    if (!permit) {
+    const acp = await acps.getActiveACP(this.chainId, this.account);
+    if (!acp) {
       throw new CofheError({
-        code: "PERMIT_NOT_FOUND" /* PermitNotFound */,
-        message: `Active permit not found for chainId <${this.chainId}> and account <${this.account}>`,
-        hint: "Create a permit (e.g. client.permits.createSelf(...)) and/or set it active (client.permits.selectActivePermit(hash)).",
+        code: "ACP_NOT_FOUND" /* ACPNotFound */,
+        message: `Active acp not found for chainId <${this.chainId}> and account <${this.account}>`,
+        hint: "Create an ACP (e.g. client.acp.createSelf(...)) and/or set it active (client.acp.selectActiveACP(hash)).",
         context: {
           chainId: this.chainId,
           account: this.account
         }
       });
     }
-    return permit;
+    return acp;
   }
   /**
    * On hardhat, interact with MockThresholdNetwork contract
    */
-  async mocksDecryptForTx(permit) {
+  async mocksDecryptForTx(acp) {
     this.assertPublicClient();
     const delay = this.config.mocks.decryptDelay;
     if (delay > 0)
       await sleep(delay);
-    const result = await cofheMocksDecryptForTx(this.ctHash, 0, permit, this.publicClient);
+    const result = await cofheMocksDecryptForTx(this.ctHash, 0, acp, this.publicClient);
     return result;
   }
   /**
    * In the production context, perform a true decryption with the CoFHE coprocessor.
    */
-  async productionDecryptForTx(permit) {
+  async productionDecryptForTx(acp) {
     this.assertChainId();
     this.assertPublicClient();
     const thresholdNetworkUrl = await this.getThresholdNetworkUrl();
-    const permission = permit ? PermitUtils.getPermission(permit, true) : null;
+    const wireAcp = acp ? ACPUtils.getPublic(acp, true) : null;
     const { decryptedValue, signature } = await tnDecryptV2({
       ctHash: this.ctHash,
       chainId: this.chainId,
-      permission,
+      acp: wireAcp,
       thresholdNetworkUrl,
       retry404TimeoutMs: this.retry404TimeoutMs,
       onPoll: this.pollCallback
@@ -4163,19 +4455,19 @@ var DecryptForTxBuilder = class extends BaseBuilder {
   /**
    * Final step of the decryptForTx process. MUST BE CALLED LAST IN THE CHAIN.
    *
-   * You must explicitly choose one permit mode before calling `execute()`:
-   * - `withPermit(permit)` / `withPermit(permitHash)` / `withPermit()` (active permit)
-   * - `withoutPermit()` (global allowance)
+   * You must explicitly choose one acp mode before calling `execute()`:
+   * - `withACP(acp)` / `withACP(acpHash)` / `withACP()` (active acp)
+   * - `withoutACP()` (global allowance)
    */
   async execute() {
-    const permit = await this.getResolvedPermit();
-    if (permit !== null) {
-      PermitUtils.validate(permit);
-      const chainId = permit._signedDomain.chainId;
+    const acp = await this.getResolvedACP();
+    if (acp !== null) {
+      ACPUtils.validate(acp);
+      const chainId = acp._signedDomain.chainId;
       if (chainId === hardhat2.id) {
-        return await this.mocksDecryptForTx(permit);
+        return await this.mocksDecryptForTx(acp);
       } else {
-        return await this.productionDecryptForTx(permit);
+        return await this.productionDecryptForTx(acp);
       }
     } else {
       if (!this.chainId) {
@@ -4238,6 +4530,21 @@ function createCofheClientBase(opts) {
   const updateConnectState = (partial) => {
     connectStore.setState((state) => ({ ...state, ...partial }));
   };
+  const _resolveSharingRegistry = async (publicClient, chainId) => {
+    const configured = opts.config.acp?.sharingRegistry?.[chainId];
+    if (configured != null)
+      return configured;
+    const registry = (await acps.getAclServedAddresses(publicClient, chainId)).shareRegistry;
+    if (registry == null) {
+      throw new CofheError({
+        code: "MISSING_CONFIG" /* MissingConfig */,
+        message: `No ACP share registry available for chainId <${chainId}>`,
+        hint: "The ACL on this chain does not serve a share registry address. Set `acp.sharingRegistry` in the cofhe config to use on-chain sharing.",
+        context: { chainId }
+      });
+    }
+    return registry;
+  };
   const _requireConnected = () => {
     const state = connectStore.getState();
     const notConnected = !state.connected || !state.account || !state.chainId || !state.publicClient || !state.walletClient;
@@ -4360,74 +4667,147 @@ function createCofheClientBase(opts) {
     }
     return { chainId: _chainId, account: _account };
   };
-  const clientPermits = {
+  const clientACPs = {
     // Pass through store access
-    getSnapshot: permits.getSnapshot,
-    subscribe: permits.subscribe,
+    getSnapshot: acps.getSnapshot,
+    subscribe: acps.subscribe,
     // Creation methods (require connection)
     createSelf: async (options, clients) => {
       _requireConnected();
       const { publicClient, walletClient } = clients ?? connectStore.getState();
-      return permits.createSelf(options, publicClient, walletClient);
+      const chainId = await publicClient.getChainId();
+      return acps.createSelf(
+        await acps.applyACPDefaultsFromChain(options, opts.config.acp, publicClient, chainId),
+        publicClient,
+        walletClient
+      );
     },
     createSharing: async (options, clients) => {
       _requireConnected();
       const { publicClient, walletClient } = clients ?? connectStore.getState();
-      return permits.createSharing(options, publicClient, walletClient);
+      const chainId = await publicClient.getChainId();
+      return acps.createSharing(
+        await acps.applyACPDefaultsFromChain(options, opts.config.acp, publicClient, chainId),
+        publicClient,
+        walletClient
+      );
     },
     importShared: async (options, clients) => {
       _requireConnected();
       const { publicClient, walletClient } = clients ?? connectStore.getState();
-      return permits.importShared(options, publicClient, walletClient);
+      return acps.importShared(options, publicClient, walletClient);
     },
     // Get or create methods (require connection)
-    getOrCreateSelfPermit: async (chainId, account, options) => {
+    getOrCreateSelfACP: async (chainId, account, options) => {
       _requireConnected();
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
       const { publicClient, walletClient } = connectStore.getState();
-      return permits.getOrCreateSelfPermit(publicClient, walletClient, _chainId, _account, options);
+      const optionsWithDefaults = await acps.applyACPDefaultsFromChain(
+        options ?? { issuer: _account, name: "Autogenerated Self ACP" },
+        opts.config.acp,
+        publicClient,
+        _chainId
+      );
+      return acps.getOrCreateSelfACP(publicClient, walletClient, _chainId, _account, optionsWithDefaults);
     },
-    getOrCreateSharingPermit: async (options, chainId, account) => {
+    getOrCreateSharingACP: async (options, chainId, account) => {
       _requireConnected();
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
       const { publicClient, walletClient } = connectStore.getState();
-      return permits.getOrCreateSharingPermit(publicClient, walletClient, options, _chainId, _account);
+      return acps.getOrCreateSharingACP(
+        publicClient,
+        walletClient,
+        await acps.applyACPDefaultsFromChain(options, opts.config.acp, publicClient, _chainId),
+        _chainId,
+        _account
+      );
+    },
+    // Revocation (require connection)
+    revokeACP: async (acp) => {
+      _requireConnected();
+      const { walletClient } = connectStore.getState();
+      return acps.revokeACP(acp, walletClient);
+    },
+    revokeAllACPs: async (revokerContract) => {
+      _requireConnected();
+      const { publicClient, walletClient } = connectStore.getState();
+      return acps.revokeAllACPs(walletClient, publicClient, revokerContract);
+    },
+    isACPRevoked: async (acp) => {
+      _requireConnected();
+      const { publicClient } = connectStore.getState();
+      return acps.isACPRevoked(acp, publicClient);
+    },
+    // On-chain sharing (require connection + config.acp.sharingRegistry)
+    shareOnChain: async (acp) => {
+      _requireConnected();
+      const { publicClient, walletClient } = connectStore.getState();
+      const chainId = await publicClient.getChainId();
+      const sharingRegistry = await _resolveSharingRegistry(publicClient, chainId);
+      return acps.shareOnChain(acp, walletClient, sharingRegistry);
+    },
+    getIncomingShares: async () => {
+      _requireConnected();
+      const { publicClient, walletClient } = connectStore.getState();
+      const chainId = await publicClient.getChainId();
+      const account = walletClient.account.address;
+      const sharingRegistry = await _resolveSharingRegistry(publicClient, chainId);
+      return acps.getIncomingShares(publicClient, sharingRegistry, account);
+    },
+    importFromChain: async (share) => {
+      _requireConnected();
+      const { publicClient, walletClient } = connectStore.getState();
+      return acps.importFromChain(share, publicClient, walletClient);
+    },
+    dismissShare: async (shareId) => {
+      _requireConnected();
+      const { publicClient, walletClient } = connectStore.getState();
+      const chainId = await publicClient.getChainId();
+      const sharingRegistry = await _resolveSharingRegistry(publicClient, chainId);
+      return acps.removeShareOnChain(shareId, walletClient, sharingRegistry);
+    },
+    cancelShare: async (shareId) => {
+      _requireConnected();
+      const { publicClient, walletClient } = connectStore.getState();
+      const chainId = await publicClient.getChainId();
+      const sharingRegistry = await _resolveSharingRegistry(publicClient, chainId);
+      return acps.removeShareOnChain(shareId, walletClient, sharingRegistry);
     },
     // Retrieval methods (auto-fill chainId/account)
-    getPermit: (hash, chainId, account) => {
+    getACP: (hash, chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.getPermit(_chainId, _account, hash);
+      return acps.getACP(_chainId, _account, hash);
     },
-    getPermits: (chainId, account) => {
+    getACPs: (chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.getPermits(_chainId, _account);
+      return acps.getACPs(_chainId, _account);
     },
-    getActivePermit: (chainId, account) => {
+    getActiveACP: (chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.getActivePermit(_chainId, _account);
+      return acps.getActiveACP(_chainId, _account);
     },
-    getActivePermitHash: (chainId, account) => {
+    getActiveACPHash: (chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.getActivePermitHash(_chainId, _account);
+      return acps.getActiveACPHash(_chainId, _account);
     },
     // Mutation methods (auto-fill chainId/account)
-    selectActivePermit: (hash, chainId, account) => {
+    selectActiveACP: (hash, chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.selectActivePermit(_chainId, _account, hash);
+      return acps.selectActiveACP(_chainId, _account, hash);
     },
-    removePermit: async (hash, chainId, account) => {
+    removeACP: async (hash, chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.removePermit(_chainId, _account, hash);
+      return acps.removeACP(_chainId, _account, hash);
     },
-    removeActivePermit: async (chainId, account) => {
+    removeActiveACP: async (chainId, account) => {
       const { chainId: _chainId, account: _account } = _getChainIdAndAccount(chainId, account);
-      return permits.removeActivePermit(_chainId, _account);
+      return acps.removeActiveACP(_chainId, _account);
     },
     // Utils (no context needed)
-    getHash: permits.getHash,
-    export: permits.export,
-    serialize: permits.serialize,
-    deserialize: permits.deserialize
+    getHash: acps.getHash,
+    export: acps.export,
+    serialize: acps.serialize,
+    deserialize: acps.deserialize
   };
   return {
     // Zustand reactive accessors (don't export store directly to prevent mutation)
@@ -4455,7 +4835,7 @@ function createCofheClientBase(opts) {
     decryptHandle: decryptForView,
     decryptForTx,
     verifyDecryptResult: verifyDecryptResult2,
-    permits: clientPermits
+    acp: clientACPs
     // Add SDK-specific methods below that require connection
     // Example:
     // async encryptData(data: unknown) {