@cofhe/sdk 0.7.1 → 1.0.0-alpha.0

package/core/test/acpDefaults.test.ts

@@ -1,5 +1,6 @@
-import { describe, it, expect } from 'vitest';
+import { beforeEach, describe, it, expect, vi } from 'vitest';
 import { acps } from '../acps.js';
+import { clearTaskManagerAddressCache } from '../taskManager.js';
 
 type ScopeOpts = {
   revokerData?: number;
@@ -12,7 +13,10 @@ const opts = (o: ScopeOpts): ScopeOpts => o;
 
 const CHAIN = 31337;
 const REVOKER = '0x00000000000000000000000000000000000000aa' as `0x${string}`;
+const ACL_REVOKER = '0x00000000000000000000000000000000000000cc' as `0x${string}`;
 const CONTRACT_A = '0x00000000000000000000000000000000000000bb' as `0x${string}`;
+const ACL = '0x00000000000000000000000000000000000000dd' as `0x${string}`;
+const TM = '0x0000000000000000000000000000000000005000' as `0x${string}`;
 
 const acpConfig = {
   defaultRevoker: { [CHAIN]: REVOKER },
@@ -20,33 +24,118 @@ const acpConfig = {
 };
 
 describe('applyACPDefaults', () => {
-  it('injects default revoker (contract + creation timestamp) when no revoker options given', () => {
-    const before = Math.round(Date.now() / 1000);
-    const result = acps.applyACPDefaults(opts({}), acpConfig, CHAIN);
+  beforeEach(() => {
+    acps.clearAclServedAddresses();
+    clearTaskManagerAddressCache();
+  });
+
+  it('uses the exact chain block timestamp for an ACL-served revoker', async () => {
+    const latestBlockTimestamp = 1_700_000_000;
+    const publicClient = {
+      readContract: vi.fn(({ functionName }: { functionName: string }) => {
+        if (functionName === 'getTm') return Promise.resolve(TM);
+        if (functionName === 'acl') return Promise.resolve(ACL);
+        if (functionName === 'defaultRevokerContract') return Promise.resolve(ACL_REVOKER);
+        return Promise.reject(new Error(`unexpected ACL read: ${functionName}`));
+      }),
+      getBlock: vi.fn().mockResolvedValue({ timestamp: BigInt(latestBlockTimestamp) }),
+    } as any;
+
+    const result = await acps.applyACPDefaultsFromChain(opts({}), undefined, publicClient, CHAIN);
+
+    expect(publicClient.getBlock).toHaveBeenCalledWith();
+    expect(result.revokerContract).toBe(ACL_REVOKER);
+    expect(result.revokerData).toBe(latestBlockTimestamp);
+  });
+
+  it('prefers configured revoker over ACL but still uses the latest block timestamp', async () => {
+    const latestBlockTimestamp = 1_700_000_001;
+    const publicClient = {
+      readContract: vi.fn(({ functionName }: { functionName: string }) => {
+        if (functionName === 'getTm') return Promise.resolve(TM);
+        if (functionName === 'acl') return Promise.resolve(ACL);
+        if (functionName === 'defaultRevokerContract') return Promise.resolve(ACL_REVOKER);
+        return Promise.reject(new Error(`unexpected ACL read: ${functionName}`));
+      }),
+      getBlock: vi.fn().mockResolvedValue({ timestamp: BigInt(latestBlockTimestamp) }),
+    } as any;
+
+    const result = await acps.applyACPDefaultsFromChain(opts({}), acpConfig, publicClient, CHAIN);
+
+    expect(publicClient.readContract).not.toHaveBeenCalled();
+    expect(publicClient.getBlock).toHaveBeenCalledWith();
     expect(result.revokerContract).toBe(REVOKER);
-    expect(result.revokerData).toBeGreaterThanOrEqual(before - 60); // 60s clock-skew backdating
-    expect(result.revokerData).toBeLessThanOrEqual(Math.round(Date.now() / 1000) - 59);
+    expect(result.revokerData).toBe(latestBlockTimestamp);
+  });
+
+  it('avoids getBlock for explicit revoker options', async () => {
+    const publicClient = {
+      readContract: vi.fn(),
+      getBlock: vi.fn(),
+    } as any;
+
+    const result = await acps.applyACPDefaultsFromChain(
+      opts({ revokerData: 42, revokerContract: CONTRACT_A }),
+      acpConfig,
+      publicClient,
+      CHAIN
+    );
+
+    expect(publicClient.readContract).not.toHaveBeenCalled();
+    expect(publicClient.getBlock).not.toHaveBeenCalled();
+    expect(result).toMatchObject({ revokerData: 42, revokerContract: CONTRACT_A });
   });
 
-  it('does not override an explicit revoker pair', () => {
-    const result = acps.applyACPDefaults({ revokerData: 42, revokerContract: CONTRACT_A }, acpConfig, CHAIN);
-    expect(result.revokerData).toBe(42);
-    expect(result.revokerContract).toBe(CONTRACT_A);
+  it('avoids getBlock when neither config nor ACL provide a revoker', async () => {
+    const publicClient = {
+      readContract: vi.fn().mockRejectedValue(new Error('no ACL deployment')),
+      getBlock: vi.fn(),
+    } as any;
+
+    const result = await acps.applyACPDefaultsFromChain(opts({}), undefined, publicClient, CHAIN);
+
+    expect(publicClient.getBlock).not.toHaveBeenCalled();
+    expect(result).toEqual({});
   });
 
-  it('injects default contract scopes when no scope options given', () => {
-    const result = acps.applyACPDefaults(opts({}), acpConfig, CHAIN);
+  it('rejects a block timestamp outside JavaScript safe integer range', async () => {
+    const publicClient = {
+      readContract: vi.fn(({ functionName }: { functionName: string }) => {
+        if (functionName === 'getTm') return Promise.resolve(TM);
+        if (functionName === 'acl') return Promise.resolve(ACL);
+        if (functionName === 'defaultRevokerContract') return Promise.resolve(ACL_REVOKER);
+        return Promise.reject(new Error(`unexpected ACL read: ${functionName}`));
+      }),
+      getBlock: vi.fn().mockResolvedValue({ timestamp: BigInt(Number.MAX_SAFE_INTEGER) + 1n }),
+    } as any;
+
+    await expect(acps.applyACPDefaultsFromChain(opts({}), undefined, publicClient, CHAIN)).rejects.toThrow(
+      /ACP revokerData cannot represent the chain block timestamp .* as a safe integer/
+    );
+  });
+
+  it('injects default contract scopes when no scope options given', async () => {
+    const result = await acps.applyACPDefaultsFromChain(opts({}), acpConfig, noAclClient(), CHAIN);
     expect(result.contracts).toEqual([CONTRACT_A]);
   });
 
-  it('does not inject scopes when the caller provides any scope option (incl. explicit scope)', () => {
-    expect(acps.applyACPDefaults(opts({ scope: 0 }), acpConfig, CHAIN).contracts).toBeUndefined();
-    expect(acps.applyACPDefaults(opts({ handles: [1n] }), acpConfig, CHAIN).contracts).toBeUndefined();
-    expect(acps.applyACPDefaults(opts({ contracts: [] }), acpConfig, CHAIN).contracts).toEqual([]);
+  it('does not inject scopes when the caller provides any scope option (incl. explicit scope)', async () => {
+    const apply = (o: ScopeOpts) => acps.applyACPDefaultsFromChain(o, acpConfig, noAclClient(), CHAIN);
+    expect((await apply(opts({ scope: 0 }))).contracts).toBeUndefined();
+    expect((await apply(opts({ handles: [1n] }))).contracts).toBeUndefined();
+    expect((await apply(opts({ contracts: [] }))).contracts).toEqual([]);
   });
 
-  it('no-op for chains without defaults and for missing config', () => {
-    expect(acps.applyACPDefaults(opts({}), acpConfig, 999)).toEqual({});
-    expect(acps.applyACPDefaults(opts({}), undefined, CHAIN)).toEqual({});
+  it('no-op for chains without defaults and for missing config', async () => {
+    expect(await acps.applyACPDefaultsFromChain(opts({}), acpConfig, noAclClient(), 999)).toEqual({});
+    expect(await acps.applyACPDefaultsFromChain(opts({}), undefined, noAclClient(), CHAIN)).toEqual({});
   });
 });
+
+/** A chain with no ACL deployment: the ACL lookup serves no revoker. */
+function noAclClient() {
+  return {
+    readContract: vi.fn().mockRejectedValue(new Error('no ACL deployment')),
+    getBlock: vi.fn().mockResolvedValue({ timestamp: 1_700_000_000n }),
+  } as any;
+}

package/core/test/acpStoreAccountCase.test.ts

@@ -0,0 +1,80 @@
+/**
+ * @vitest-environment happy-dom
+ */
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+
+// Stub the on-chain EIP-712 domain read so the test needs no RPC (same approach as acps.test.ts).
+vi.mock('../../acps/onchain-utils.js', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('../../acps/onchain-utils.js')>()),
+  getAclEIP712Domain: async () => ({
+    name: 'ACL',
+    version: '2',
+    chainId: 421614,
+    verifyingContract: '0x1111111111111111111111111111111111111111' as `0x${string}`,
+  }),
+}));
+
+import { custom, createWalletClient, type PublicClient, type WalletClient } from 'viem';
+import { arbitrumSepolia } from 'viem/chains';
+import { privateKeyToAccount } from 'viem/accounts';
+import { acpStore } from '@/acps';
+import { acps } from '../acps.js';
+
+const chainId = 421614;
+// Offline clients: the wallet signs typed data locally, and any RPC call fails the test.
+const noRpc = custom({
+  request: async ({ method }) => {
+    throw new Error(`unexpected RPC call: ${method}`);
+  },
+});
+const publicClient = { getChainId: async () => chainId } as unknown as PublicClient;
+const walletClient: WalletClient = createWalletClient({
+  chain: arbitrumSepolia,
+  transport: noRpc,
+  account: privateKeyToAccount('0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80'),
+});
+const checksummed = walletClient.account!.address; // 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266
+const lowercase = checksummed.toLowerCase();
+
+describe('ACP store account keys are case-insensitive', () => {
+  beforeEach(() => {
+    acpStore.store.setState({ acps: {}, activeACPHash: {} });
+  });
+
+  it('finds the active ACP when the account is passed in lowercase', async () => {
+    const created = await acps.createSelf({ issuer: checksummed }, publicClient, walletClient);
+
+    expect(acps.getActiveACP(chainId, checksummed)?.hash).toBe(created.hash);
+    expect(acps.getActiveACP(chainId, lowercase)?.hash).toBe(created.hash);
+    expect(acps.getACP(chainId, lowercase, created.hash)?.hash).toBe(created.hash);
+    expect(Object.keys(acps.getACPs(chainId, lowercase))).toEqual([created.hash]);
+  });
+
+  it('getOrCreateSelfACP with a lowercase account reuses the stored ACP instead of signing a new one', async () => {
+    const signSpy = vi.spyOn(walletClient, 'signTypedData');
+
+    const first = await acps.getOrCreateSelfACP(publicClient, walletClient, chainId, lowercase);
+    const second = await acps.getOrCreateSelfACP(publicClient, walletClient, chainId, lowercase);
+
+    expect(second.hash).toBe(first.hash);
+    expect(signSpy).toHaveBeenCalledTimes(1);
+    expect(Object.keys(acps.getACPs(chainId, checksummed))).toHaveLength(1);
+  });
+
+  it('keeps one bucket per account whatever case it is written and read in', async () => {
+    const created = await acps.createSelf({ issuer: checksummed }, publicClient, walletClient);
+    acpStore.store.setState({ acps: {}, activeACPHash: {} });
+
+    // Stored under the lowercase spelling (e.g. a wallet client built from a lowercase address)...
+    acpStore.setACP(chainId, lowercase, created);
+    acpStore.setActiveACPHash(chainId, lowercase, created.hash);
+    // ...still found with the checksummed one, and a write in that case reuses the same bucket.
+    expect(acpStore.getActiveACP(chainId, checksummed)?.hash).toBe(created.hash);
+    acpStore.setACP(chainId, checksummed, created);
+    expect(Object.keys(acpStore.store.getState().acps[chainId])).toEqual([lowercase]);
+
+    acpStore.removeACP(chainId, checksummed, created.hash);
+    expect(acpStore.getActiveACPHash(chainId, lowercase)).toBeUndefined();
+    expect(acpStore.getACP(chainId, lowercase, created.hash)).toBeUndefined();
+  });
+});

package/core/test/acps.test.ts

@@ -1,7 +1,7 @@
 /**
  * @vitest-environment happy-dom
  */
-import { acpStore } from '@/acps';
+import { ACPUtils, acpStore, type IncomingShare, type SharingACP } from '@/acps';
 
 import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
 
@@ -143,7 +143,8 @@ describe('Core ACPs Tests', () => {
       // Import the acp as Alice (recipient)
       const acp = await acps.importShared(acpJson, publicClient, aliceWalletClient);
 
-      expect(acp.name).toBe('Original Sharing ACP');
+      // the issuer's name is not taken over: the acp is named after its issuer
+      expect(acp.name).toBe(`Shared by ${bobAddress.slice(0, 6)}…${bobAddress.slice(-4)}`);
       expect(acp.type).toBe('recipient');
       expect(acp.issuer).toBe(bobAddress);
       expect(acp.recipient).toBe(aliceAddress);
@@ -152,6 +153,130 @@ describe('Core ACPs Tests', () => {
     });
   });
 
+  describe('checkAccess on the issuer copy of a share', () => {
+    it('is valid while unexpired and not revoked, without needing the recipient signature', async () => {
+      const sharing = await acps.createSharing(
+        { name: 'To Alice', issuer: bobAddress, recipient: aliceAddress },
+        publicClient,
+        bobWalletClient
+      );
+      expect(sharing.recipientSignature).toBe('0x');
+      // No revoker configured here, so nothing on chain can disable it: valid without any RPC.
+      expect(await acps.checkAccess(sharing, publicClient)).toBe('valid');
+    });
+
+    it('reports expiry locally', async () => {
+      const sharing = await acps.createSharing(
+        { name: 'Old', issuer: bobAddress, recipient: aliceAddress, expiration: 1 },
+        publicClient,
+        bobWalletClient
+      );
+      expect(await acps.checkAccess(sharing, publicClient)).toBe('expired');
+    });
+  });
+
+  describe('Import without activation', () => {
+    const ZERO_SHARE_ID = `0x${'0'.repeat(64)}` as const;
+
+    // Alice already decrypts with her own self acp; Bob then shares with her.
+    const setUp = async () => {
+      const self = await acps.createSelf({ name: 'Alice self', issuer: aliceAddress }, publicClient, aliceWalletClient);
+      const sharing = await acps.createSharing(
+        { name: 'Shared with Alice', issuer: bobAddress, recipient: aliceAddress },
+        publicClient,
+        bobWalletClient
+      );
+      return { self, sharing };
+    };
+
+    const toIncomingShare = (sharing: SharingACP): IncomingShare => {
+      const { sealingKey: _sealingKey, recipientSignature: _recipientSignature, ...pub } = ACPUtils.getPublic(sharing);
+      return { ...pub, shareId: ZERO_SHARE_ID, metadata: '0x' };
+    };
+
+    it('importShared activates the imported acp by default', async () => {
+      const { sharing } = await setUp();
+      const imported = await acps.importShared(ACPUtils.export(sharing), publicClient, aliceWalletClient);
+
+      expect(acps.getActiveACPHash(chainId, aliceAddress)).toBe(imported.hash);
+    });
+
+    it('importShared with activate: false stores the acp and keeps the active one', async () => {
+      const { self, sharing } = await setUp();
+      const imported = await acps.importShared(ACPUtils.export(sharing), publicClient, aliceWalletClient, {
+        activate: false,
+      });
+
+      expect(acps.getACPs(chainId, aliceAddress)?.[imported.hash]).toBeDefined();
+      expect(acps.getActiveACPHash(chainId, aliceAddress)).toBe(self.hash);
+    });
+
+    it('importShared with activate: false leaves no active acp when there was none', async () => {
+      const sharing = await acps.createSharing(
+        { name: 'Shared with Alice', issuer: bobAddress, recipient: aliceAddress },
+        publicClient,
+        bobWalletClient
+      );
+      const imported = await acps.importShared(ACPUtils.export(sharing), publicClient, aliceWalletClient, {
+        activate: false,
+      });
+
+      expect(acps.getACPs(chainId, aliceAddress)?.[imported.hash]).toBeDefined();
+      expect(acps.getActiveACPHash(chainId, aliceAddress)).toBeUndefined();
+    });
+
+    it('importFromChain activates the imported acp by default', async () => {
+      const { sharing } = await setUp();
+      const imported = await acps.importFromChain(toIncomingShare(sharing), publicClient, aliceWalletClient);
+
+      expect(acps.getActiveACPHash(chainId, aliceAddress)).toBe(imported.hash);
+    });
+
+    it('importFromChain keeps the share metadata on the stored recipient acp', async () => {
+      const { sharing } = await setUp();
+      const imported = await acps.importFromChain(
+        { ...toIncomingShare(sharing), metadata: '0x03aa' },
+        publicClient,
+        aliceWalletClient
+      );
+
+      expect(imported.metadata).toBe('0x03aa');
+      expect(acps.getACPs(chainId, aliceAddress)?.[imported.hash]?.metadata).toBe('0x03aa');
+    });
+
+    it('importShared and importFromChain take the recipient name as an option', async () => {
+      const { sharing } = await setUp();
+      const fromJson = await acps.importShared(ACPUtils.export(sharing), publicClient, aliceWalletClient, {
+        name: 'From Bob (JSON)',
+      });
+      const fromChain = await acps.importFromChain(toIncomingShare(sharing), publicClient, aliceWalletClient, {
+        name: 'From Bob (chain)',
+      });
+
+      expect(fromJson.name).toBe('From Bob (JSON)');
+      expect(fromChain.name).toBe('From Bob (chain)');
+      // the same share, so the second import replaced the first in the store
+      expect(acps.getACPs(chainId, aliceAddress)?.[fromChain.hash]?.name).toBe('From Bob (chain)');
+    });
+
+    it('importFromChain of a share without metadata leaves none on the acp', async () => {
+      const { sharing } = await setUp();
+      const imported = await acps.importFromChain(toIncomingShare(sharing), publicClient, aliceWalletClient);
+
+      expect(imported.metadata).toBeUndefined();
+    });
+
+    it('importFromChain with activate: false stores the acp and keeps the active one', async () => {
+      const { self, sharing } = await setUp();
+      const imported = await acps.importFromChain(toIncomingShare(sharing), publicClient, aliceWalletClient, {
+        activate: false,
+      });
+
+      expect(acps.getACPs(chainId, aliceAddress)?.[imported.hash]).toBeDefined();
+      expect(acps.getActiveACPHash(chainId, aliceAddress)).toBe(self.hash);
+    });
+  });
+
   describe('ACP Retrieval', () => {
     let createdACP: any;
     let acpHash: string;
@@ -528,7 +653,7 @@ describe('Core ACPs Tests', () => {
       const exported = acps.export(acp);
       const parsed = JSON.parse(exported);
 
-      expect(parsed.name).toBe('Test Sharing ACP');
+      expect(parsed).not.toHaveProperty('name');
       expect(parsed.type).toBe('sharing');
       expect(parsed.issuer).toBe(bobAddress);
       expect(parsed.recipient).toBe(aliceAddress);

package/core/test/apiError.test.ts

@@ -47,6 +47,14 @@ describe('mapApiErrorCodeToCofheErrorCode', () => {
       CofheErrorCode.SealOutputFailed
     );
   });
+
+  it('falls back for a code that only exists on Object.prototype', () => {
+    for (const inherited of ['toString', 'constructor', 'valueOf', 'hasOwnProperty']) {
+      expect(mapApiErrorCodeToCofheErrorCode(inherited, CofheErrorCode.DecryptFailed)).toBe(
+        CofheErrorCode.DecryptFailed
+      );
+    }
+  });
 });
 
 describe('parseApiErrorResponseBody', () => {

package/core/test/appKeyConfig.test.ts

@@ -0,0 +1,94 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { type PublicClient, type WalletClient } from 'viem';
+import { createCofheClientBase } from '../client';
+import { type CofheClient } from '../clientTypes';
+import { createCofheConfigBase, type CofheInputConfig } from '../config';
+import { acps } from '../acps';
+import { shareAppKey } from '../../acps/share-metadata';
+
+vi.mock('../keyStore', () => ({
+  createKeysStore: vi.fn(() => ({
+    rehydrateKeysStore: vi.fn().mockResolvedValue(undefined),
+    getFheKey: vi.fn(),
+    getCrs: vi.fn(),
+    setFheKey: vi.fn(),
+    setCrs: vi.fn(),
+    clearKeysStorage: vi.fn(),
+    store: {} as any,
+  })),
+}));
+
+const CHAIN_ID = 11155111;
+const ACCOUNT = '0x1234567890123456789012345678901234567890';
+const REGISTRY = '0x00000000000000000000000000000000000000e0';
+const APP = 'explorer.fhenix.io';
+const APP_KEY = shareAppKey(APP);
+
+const publicClient = { getChainId: vi.fn().mockResolvedValue(CHAIN_ID) } as unknown as PublicClient;
+const walletClient = {
+  getAddresses: vi.fn().mockResolvedValue([ACCOUNT]),
+  account: { address: ACCOUNT },
+} as unknown as WalletClient;
+
+/** A connected client; `acp.sharingRegistry` is set so the on-chain calls need no ACL lookup. */
+const connectedClient = async (acp: CofheInputConfig['acp']): Promise<CofheClient> => {
+  const client = createCofheClientBase({
+    config: createCofheConfigBase({ supportedChains: [], acp: { sharingRegistry: { [CHAIN_ID]: REGISTRY }, ...acp } }),
+    zkBuilderAndCrsGenerator: {} as any,
+    tfhePublicKeyDeserializer: {} as any,
+    compactPkeCrsDeserializer: {} as any,
+    initTfhe: () => Promise.resolve(false),
+  });
+  await client.connect(publicClient, walletClient);
+  return client;
+};
+
+const sharingOptions = { issuer: ACCOUNT, recipient: '0x00000000000000000000000000000000000000a1' };
+
+describe('the app key from config.acp.app', () => {
+  const spies = {
+    defaults: vi.spyOn(acps, 'applyACPDefaultsFromChain').mockImplementation(async (options) => options),
+    createSharing: vi.spyOn(acps, 'createSharing').mockResolvedValue({} as any),
+    getOrCreate: vi.spyOn(acps, 'getOrCreateSharingACP').mockResolvedValue({} as any),
+    shareOnChain: vi.spyOn(acps, 'shareOnChain').mockResolvedValue({ txHash: '0x', shareId: '0x' }),
+    getIncoming: vi.spyOn(acps, 'getIncomingShares').mockResolvedValue([]),
+  };
+  afterEach(() => Object.values(spies).forEach((spy) => spy.mockClear()));
+
+  it('goes on every share the client creates', async () => {
+    const client = await connectedClient({ app: APP });
+    await client.acp.createSharing(sharingOptions);
+    expect(spies.createSharing.mock.calls[0][0]).toMatchObject({ ...sharingOptions, appKey: APP_KEY });
+
+    await client.acp.getOrCreateSharingACP(sharingOptions);
+    expect(spies.getOrCreate.mock.calls[0][2]).toMatchObject({ ...sharingOptions, appKey: APP_KEY });
+  });
+
+  it('goes with labels posted by shareOnChain', async () => {
+    const client = await connectedClient({ app: APP });
+    await client.acp.shareOnChain({} as any, { labels: [] });
+    expect(spies.shareOnChain.mock.calls[0][3]).toEqual({ labels: [], appKey: APP_KEY });
+  });
+
+  it('filters the inbox', async () => {
+    const client = await connectedClient({ app: APP });
+    await client.acp.getIncomingShares();
+    expect(spies.getIncoming).toHaveBeenCalledWith(publicClient, REGISTRY, ACCOUNT, { appKey: APP_KEY });
+  });
+
+  it('is the keccak256 of the app name, and an explicit appKey wins over it', async () => {
+    const client = await connectedClient({ app: APP });
+    const other = shareAppKey('other.app');
+    await client.acp.createSharing({ ...sharingOptions, appKey: other });
+    expect(spies.createSharing.mock.calls[0][0]).toMatchObject({ appKey: other });
+    expect(APP_KEY).toMatch(/^0x[0-9a-f]{64}$/);
+  });
+
+  it('is absent without an app: shares carry no key and every share is listed', async () => {
+    const client = await connectedClient({});
+    await client.acp.createSharing(sharingOptions);
+    expect(spies.createSharing.mock.calls[0][0]).not.toHaveProperty('appKey');
+    await client.acp.getIncomingShares();
+    expect(spies.getIncoming).toHaveBeenCalledWith(publicClient, REGISTRY, ACCOUNT, {});
+  });
+});

package/core/test/client.test.ts

@@ -6,6 +6,7 @@ import { CofheError, CofheErrorCode } from '../error.js';
 import { type PublicClient, type WalletClient } from 'viem';
 import { EncryptInputsBuilder } from '../encrypt/encryptInputsBuilder.js';
 import { Encryptable } from '../types.js';
+import { acps } from '../acps.js';
 
 // Mock dependencies
 vi.mock('../keyStore', () => ({
@@ -428,5 +429,45 @@ describe('createCofheClientBase', () => {
       expect(client.acp).toHaveProperty('selectActiveACP');
       expect(client.acp).toHaveProperty('removeActiveACP');
     });
+
+    describe('import activation', () => {
+      const share = { shareId: `0x${'0'.repeat(64)}` } as any;
+
+      it('importShared forwards activate with the connected clients', async () => {
+        const publicClient = createMockPublicClient();
+        const walletClient = createMockWalletClient();
+        await client.connect(publicClient, walletClient);
+        const spy = vi.spyOn(acps, 'importShared').mockResolvedValue({} as any);
+
+        await client.acp.importShared('{}', { activate: false });
+
+        expect(spy).toHaveBeenCalledWith('{}', publicClient, walletClient, { activate: false });
+        spy.mockRestore();
+      });
+
+      it('importShared still takes explicit clients, activating by default', async () => {
+        await client.connect(createMockPublicClient(), createMockWalletClient());
+        const publicClient = createMockPublicClient();
+        const walletClient = createMockWalletClient();
+        const spy = vi.spyOn(acps, 'importShared').mockResolvedValue({} as any);
+
+        await client.acp.importShared('{}', { publicClient, walletClient });
+
+        expect(spy).toHaveBeenCalledWith('{}', publicClient, walletClient, { activate: undefined });
+        spy.mockRestore();
+      });
+
+      it('importFromChain forwards activate', async () => {
+        const publicClient = createMockPublicClient();
+        const walletClient = createMockWalletClient();
+        await client.connect(publicClient, walletClient);
+        const spy = vi.spyOn(acps, 'importFromChain').mockResolvedValue({} as any);
+
+        await client.acp.importFromChain(share, { activate: false });
+
+        expect(spy).toHaveBeenCalledWith(share, publicClient, walletClient, { activate: false });
+        spy.mockRestore();
+      });
+    });
   });
 });

package/core/test/config.test.ts

@@ -62,6 +62,14 @@ describe('createCofheConfigBase', () => {
     expectValidConfigItem('environment', 'react', 'react');
   });
 
+  it('acp.app', () => {
+    expectInvalidConfigItem('acp.app', '');
+    expectInvalidConfigItem('acp.app', 123);
+
+    expectValidConfigItem('acp.app', 'explorer.fhenix.io', 'explorer.fhenix.io');
+    expectValidConfigItem('acp.app', undefined, undefined);
+  });
+
   it('supportedChains', () => {
     expectInvalidConfigItem('supportedChains', {});
     expectInvalidConfigItem('supportedChains', 'not-an-array');
@@ -162,6 +170,22 @@ describe('createCofheConfigBase', () => {
     expectValidConfigItem('useWorkers', undefined, true); // defaults to true
   });
 
+  it('tfheThreads', () => {
+    expectInvalidConfigItem('tfheThreads', 'not-a-setting');
+    expectInvalidConfigItem('tfheThreads', null);
+    expectInvalidConfigItem('tfheThreads', true);
+    expectInvalidConfigItem('tfheThreads', 0);
+    expectInvalidConfigItem('tfheThreads', -4);
+    expectInvalidConfigItem('tfheThreads', 2.5);
+    expectInvalidConfigItem('tfheThreads', {});
+
+    expectValidConfigItem('tfheThreads', 'auto', 'auto');
+    expectValidConfigItem('tfheThreads', false, false);
+    expectValidConfigItem('tfheThreads', 1, 1);
+    expectValidConfigItem('tfheThreads', 4, 4);
+    expectValidConfigItem('tfheThreads', undefined, 'auto'); // defaults to 'auto'
+  });
+
   it('should get config item', () => {
     const config: CofheInputConfig = {
       supportedChains: [sepolia],

package/core/test/decrypt.test.ts

@@ -1,5 +1,5 @@
 import { STAGING_TESTS, stagingViemChain } from './stagingRedirect';
-import { FheTypes, verifyDecryptResult, createCofheConfigBase, TASK_MANAGER_ADDRESS } from '@/core';
+import { FheTypes, verifyDecryptResult, createCofheConfigBase, getTaskManagerAddress } from '@/core';
 import { getChainById, stagingCofhe } from '@/chains';
 import {
   TEST_PRIVATE_KEY,
@@ -19,7 +19,12 @@ import { createPublicClient, createWalletClient, http, parseAbi } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
 import { arbitrumSepolia, baseSepolia, sepolia } from 'viem/chains';
 
-const account = privateKeyToAccount(TEST_PRIVATE_KEY);
+// Live-chain suite: needs the funded TEST_PRIVATE_KEY (signs decrypt requests against
+// pre-deployed testnet fixtures). Without it — fork PRs, where secrets are unavailable —
+// the suite skips; CI runs it separately with the key (test-live job).
+const LIVE_TESTS = Boolean(TEST_PRIVATE_KEY);
+const DEFAULT_TEST_PRIVATE_KEY = '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80';
+const account = privateKeyToAccount(TEST_PRIVATE_KEY || DEFAULT_TEST_PRIVATE_KEY);
 
 const TEST_CHAIN_ID = STAGING_TESTS ? stagingViemChain.id : PRIMARY_TEST_CHAIN;
 
@@ -29,7 +34,7 @@ const VIEM_CHAINS: Record<number, Chain> = {
   11155111: sepolia,
 };
 
-describe('Core – Decrypt Tests', () => {
+describe.skipIf(!LIVE_TESTS)('Core – Decrypt Tests', () => {
   let publicClient: PublicClient;
   let walletClient: WalletClient;
   let config: ReturnType<typeof createCofheConfigBase>;
@@ -236,6 +241,8 @@ describe('Core – Decrypt Tests', () => {
         },
       ] as const;
 
+      const taskManagerAddress = await getTaskManagerAddress(publicClient);
+
       for (const sample of samples) {
         const sdkResult = await verifyDecryptResult(sample.handle, sample.cleartext, sample.signature, publicClient);
 
@@ -243,7 +250,7 @@ describe('Core – Decrypt Tests', () => {
           'function verifyDecryptResultSafe(uint256 ctHash, uint256 cleartext, bytes signature) view returns (bool)',
         ]);
         const tmResult = await publicClient.readContract({
-          address: TASK_MANAGER_ADDRESS,
+          address: taskManagerAddress,
           abi: verifyDecryptResultSafeAbi,
           functionName: 'verifyDecryptResultSafe',
           args: [sample.handle, sample.cleartext, sample.signature],