@cofhe/sdk 0.8.0 → 1.0.0

package/dist/web.d.cts

@@ -1,8 +1,8 @@
-import { I as IStorage, C as CofheInputConfig, a as CofheConfig, b as CofheClient, E as EncryptableItem } from './clientTypes-D3aIXmUp.cjs';
+import { I as IStorage, C as CofheInputConfig, a as CofheConfig, b as CofheClient, E as EncryptableItem } from './clientTypes-IO6b5Um8.cjs';
 import 'viem';
 import './types-C07FK-cL.cjs';
 import 'zod';
-import './onchain-utils-CUAK8glx.cjs';
+import './onchain-utils-CgOslubH.cjs';
 import 'zustand/vanilla';
 
 declare function createSsrStorage(): IStorage;

package/dist/web.d.ts

@@ -1,8 +1,8 @@
-import { I as IStorage, C as CofheInputConfig, a as CofheConfig, b as CofheClient, E as EncryptableItem } from './clientTypes-5YPPR16m.js';
+import { I as IStorage, C as CofheInputConfig, a as CofheConfig, b as CofheClient, E as EncryptableItem } from './clientTypes-b1pOxOUE.js';
 import 'viem';
 import './types-C07FK-cL.js';
 import 'zod';
-import './onchain-utils-CUAK8glx.js';
+import './onchain-utils-CgOslubH.js';
 import 'zustand/vanilla';
 
 declare function createSsrStorage(): IStorage;

package/dist/web.js

@@ -1,8 +1,9 @@
-import { createCofheConfigBase, createCofheClientBase, fheTypeToString } from './chunk-GGI7Y6AW.js';
+import { createCofheConfigBase, createCofheClientBase } from './chunk-O2ITEUEU.js';
 import './chunk-UKQAJK4N.js';
-import './chunk-UJYOBHYA.js';
+import './chunk-3L2IVPMI.js';
 import { initTfheThreadPool } from './chunk-KSOV5B4B.js';
-import { TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT } from './chunk-NMKMCAI3.js';
+import { fheTypeToString, fromHexString } from './chunk-WJGTPW7K.js';
+import { TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT } from './chunk-J23FYAI2.js';
 import { constructClient } from 'iframe-shared-storage';
 
 // web/const.ts
@@ -233,13 +234,6 @@ function requireTfhe() {
   }
   return tfheModule;
 }
-var fromHexString = (hexString) => {
-  const cleanString = hexString.length % 2 === 1 ? `0${hexString}` : hexString;
-  const arr = cleanString.replace(/^0x/, "").match(/.{1,2}/g);
-  if (!arr)
-    return new Uint8Array();
-  return new Uint8Array(arr.map((byte) => parseInt(byte, 16)));
-};
 var _deserializeTfhePublicKey = (buff) => {
   return requireTfhe().TfheCompactPublicKey.safe_deserialize(
     fromHexString(buff),

package/dist/zkProve.worker.cjs

@@ -1,5 +1,7 @@
 'use strict';
 
+require('viem');
+
 // core/consts.ts
 var TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT = BigInt(1 << 30);
 
@@ -51,6 +53,18 @@ async function initTfheThreadPool(mod, setting = "auto") {
     };
   }
 }
+var HEX_BODY_REGEX = /^[0-9a-fA-F]*$/;
+var fromHexString = (hexString) => {
+  const body = hexString.replace(/^0x/, "");
+  if (!HEX_BODY_REGEX.test(body)) {
+    throw new Error("Invalid hex string: contains non-hexadecimal characters");
+  }
+  const padded = body.length % 2 === 1 ? `0${body}` : body;
+  const arr = padded.match(/.{1,2}/g);
+  if (!arr)
+    return new Uint8Array();
+  return new Uint8Array(arr.map((byte) => parseInt(byte, 16)));
+};
 
 // web/zkProve.worker.ts
 var tfheModule = null;
@@ -74,13 +88,6 @@ function initTfhe(tfheThreads = "auto") {
   })();
   return initPromise;
 }
-function fromHexString(hexString) {
-  const cleanString = hexString.length % 2 === 1 ? `0${hexString}` : hexString;
-  const arr = cleanString.replace(/^0x/, "").match(/.{1,2}/g);
-  if (!arr)
-    return new Uint8Array();
-  return new Uint8Array(arr.map((byte) => parseInt(byte, 16)));
-}
 if (typeof self !== "undefined") {
   self.onmessage = async (event) => {
     const { id, type, fheKeyHex, crsHex, items, metadata, tfheThreads } = event.data;

package/dist/zkProve.worker.js

@@ -1,5 +1,6 @@
 import { initTfheThreadPool } from './chunk-KSOV5B4B.js';
-import { TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT } from './chunk-NMKMCAI3.js';
+import { fromHexString } from './chunk-WJGTPW7K.js';
+import { TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT } from './chunk-J23FYAI2.js';
 
 // web/zkProve.worker.ts
 var tfheModule = null;
@@ -23,13 +24,6 @@ function initTfhe(tfheThreads = "auto") {
   })();
   return initPromise;
 }
-function fromHexString(hexString) {
-  const cleanString = hexString.length % 2 === 1 ? `0${hexString}` : hexString;
-  const arr = cleanString.replace(/^0x/, "").match(/.{1,2}/g);
-  if (!arr)
-    return new Uint8Array();
-  return new Uint8Array(arr.map((byte) => parseInt(byte, 16)));
-}
 if (typeof self !== "undefined") {
   self.onmessage = async (event) => {
     const { id, type, fheKeyHex, crsHex, items, metadata, tfheThreads } = event.data;

package/node/index.ts

@@ -10,6 +10,7 @@ import {
   type FheKeyDeserializer,
   TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT,
 } from '@/core';
+import { fromHexString } from '../core/utils.js';
 
 // Import node-specific storage (internal use only)
 import { createNodeStorage } from './storage.js';
@@ -30,16 +31,6 @@ async function initTfhe(): Promise<boolean> {
   return true;
 }
 
-/**
- * Utility to convert the hex string key to a Uint8Array for use with tfhe
- */
-const fromHexString = (hexString: string): Uint8Array => {
-  const cleanString = hexString.length % 2 === 1 ? `0${hexString}` : hexString;
-  const arr = cleanString.replace(/^0x/, '').match(/.{1,2}/g);
-  if (!arr) return new Uint8Array();
-  return new Uint8Array(arr.map((byte) => parseInt(byte, 16)));
-};
-
 const _deserializeTfhePublicKey = (buff: string): TfheCompactPublicKey => {
   return TfheCompactPublicKey.safe_deserialize(fromHexString(buff), TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT);
 };

package/node/storage.ts

@@ -8,6 +8,17 @@ import { join } from 'path';
 // Memory storage fallback
 const memoryStorage: Record<string, unknown> = {};
 
+const getStorageDir = () => join(process.env.HOME || process.env.USERPROFILE || '.', '.cofhesdk');
+
+/**
+ * Keep the directory and files private to the current user. `mode` only applies
+ * on creation, so chmod also tightens directories/files created by earlier SDK versions.
+ */
+const ensureStorageDir = async (storageDir: string) => {
+  await fs.mkdir(storageDir, { recursive: true, mode: 0o700 });
+  await fs.chmod(storageDir, 0o700).catch(() => {});
+};
+
 /**
  * Creates a node storage implementation using the filesystem
  * @returns IStorage implementation for Node.js environments
@@ -16,8 +27,8 @@ export const createNodeStorage = (): IStorage => {
   return {
     getItem: async (name: string) => {
       try {
-        const storageDir = join(process.env.HOME || process.env.USERPROFILE || '.', '.cofhesdk');
-        await fs.mkdir(storageDir, { recursive: true });
+        const storageDir = getStorageDir();
+        await ensureStorageDir(storageDir);
         const filePath = join(storageDir, `${name}.json`);
         const data = await fs.readFile(filePath, 'utf8').catch(() => null);
         return data ? JSON.parse(data) : null;
@@ -28,10 +39,11 @@ export const createNodeStorage = (): IStorage => {
     },
     setItem: async (name: string, value: any) => {
       try {
-        const storageDir = join(process.env.HOME || process.env.USERPROFILE || '.', '.cofhesdk');
-        await fs.mkdir(storageDir, { recursive: true });
+        const storageDir = getStorageDir();
+        await ensureStorageDir(storageDir);
         const filePath = join(storageDir, `${name}.json`);
-        await fs.writeFile(filePath, JSON.stringify(value));
+        await fs.writeFile(filePath, JSON.stringify(value), { mode: 0o600 });
+        await fs.chmod(filePath, 0o600).catch(() => {});
       } catch (e) {
         console.warn('Node.js filesystem modules not available, falling back to memory storage' + e);
         memoryStorage[name] = value;
@@ -39,8 +51,7 @@ export const createNodeStorage = (): IStorage => {
     },
     removeItem: async (name: string) => {
       try {
-        const storageDir = join(process.env.HOME || process.env.USERPROFILE || '.', '.cofhesdk');
-        const filePath = join(storageDir, `${name}.json`);
+        const filePath = join(getStorageDir(), `${name}.json`);
         await fs.unlink(filePath).catch(() => {});
       } catch (e) {
         console.warn('Node.js filesystem modules not available, falling back to memory storage' + e);

package/node/test/storage-permissions.test.ts

@@ -0,0 +1,40 @@
+import { describe, it, expect } from 'vitest';
+import { promises as fs } from 'fs';
+import os from 'os';
+import path from 'path';
+import { createNodeStorage } from '../storage.js';
+
+const withTempHome = async (fn: (home: string) => Promise<void>) => {
+  const home = await fs.mkdtemp(path.join(os.tmpdir(), 'cofhe-home-'));
+  const oldHome = process.env.HOME;
+  process.env.HOME = home;
+  try {
+    await fn(home);
+  } finally {
+    if (oldHome === undefined) delete process.env.HOME;
+    else process.env.HOME = oldHome;
+    await fs.rm(home, { recursive: true, force: true });
+  }
+};
+
+describe('node storage permissions', () => {
+  it.skipIf(process.platform === 'win32')('does not make stored data readable by other users', () =>
+    withTempHome(async (home) => {
+      await createNodeStorage().setItem('t', { value: 1 });
+      const st = await fs.stat(path.join(home, '.cofhesdk', 't.json'));
+      expect(st.mode & 0o077).toBe(0);
+    })
+  );
+
+  it.skipIf(process.platform === 'win32')('tightens permissions of a file created with loose permissions', () =>
+    withTempHome(async (home) => {
+      const dir = path.join(home, '.cofhesdk');
+      await fs.mkdir(dir, { mode: 0o755 });
+      const file = path.join(dir, 't.json');
+      await fs.writeFile(file, '{}', { mode: 0o644 });
+      await createNodeStorage().setItem('t', { value: 1 });
+      expect((await fs.stat(file)).mode & 0o077).toBe(0);
+      expect((await fs.stat(dir)).mode & 0o077).toBe(0);
+    })
+  );
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cofhe/sdk",
-  "version": "0.8.0",
+  "version": "1.0.0",
   "type": "module",
   "description": "SDK for Fhenix COFHE coprocessor interaction",
   "main": "./dist/core.cjs",
@@ -101,9 +101,9 @@
     "tsup": "8.0.2",
     "typescript": "5.5.4",
     "vitest": "3.2.4",
-    "@cofhe/test-setup": "0.0.0",
+    "@cofhe/eslint-config": "0.2.1",
     "@cofhe/tsconfig": "0.1.2",
-    "@cofhe/eslint-config": "0.2.1"
+    "@cofhe/test-setup": "0.0.0"
   },
   "publishConfig": {
     "access": "public",
@@ -116,7 +116,7 @@
     "check:types": "tsc --noEmit",
     "clean": "rm -rf .turbo && rm -rf node_modules && rm -rf dist",
     "test": "vitest run",
-    "test:live": "vitest run core/test/decrypt.test.ts node/test/inherited.test.ts web/test/inherited.web.test.ts",
+    "test:live": "vitest run core/test/decrypt.test.ts acps/share-metadata/test/live.test.ts node/test/inherited.test.ts web/test/inherited.web.test.ts",
     "test:threadpool": "vitest run web/test/threadPoolOff.web.test.ts web/test/threadPoolOn.web.test.ts web/test/mainThreadPool.web.test.ts web/test/workerInitRace.web.test.ts --no-file-parallelism",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage"

package/web/index.ts

@@ -14,6 +14,7 @@ import {
   fheTypeToString,
   TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT,
 } from '@/core';
+import { fromHexString } from '../core/utils.js';
 
 // Import web-specific storage (internal use only)
 import { createSsrStorage, createWebStorage } from './storage.js';
@@ -116,16 +117,6 @@ function requireTfhe(): typeof import('tfhe') {
   return tfheModule;
 }
 
-/**
- * Utility to convert the hex string key to a Uint8Array for use with tfhe
- */
-const fromHexString = (hexString: string): Uint8Array => {
-  const cleanString = hexString.length % 2 === 1 ? `0${hexString}` : hexString;
-  const arr = cleanString.replace(/^0x/, '').match(/.{1,2}/g);
-  if (!arr) return new Uint8Array();
-  return new Uint8Array(arr.map((byte) => parseInt(byte, 16)));
-};
-
 const _deserializeTfhePublicKey = (buff: string): TfheCompactPublicKey => {
   return requireTfhe().TfheCompactPublicKey.safe_deserialize(
     fromHexString(buff),

package/web/test/threadPoolBenchHelper.ts

@@ -10,6 +10,7 @@ import { TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT } from '../../core/consts';
 import { STAGING_TESTS } from '../../core/test/stagingRedirect';
 import { arbSepolia as cofheArbSepolia, stagingCofhe } from '@/chains';
 import { initTfheThreadPool, type TfheThreadPoolResult } from '../tfheThreadPool.js';
+import { fromHexString } from '../../core/utils.js';
 
 // Same backend as the rest of the web suite: Arbitrum Sepolia, or staging when
 // TEST_STAGING_ENABLED=true.
@@ -30,13 +31,6 @@ declare const __THREADPOOL_TESTS__: boolean | undefined;
  */
 export const THREADPOOL_TESTS = typeof __THREADPOOL_TESTS__ !== 'undefined' ? __THREADPOOL_TESTS__ : false;
 
-function fromHexString(hexString: string): Uint8Array {
-  const cleanString = hexString.length % 2 === 1 ? `0${hexString}` : hexString;
-  const arr = cleanString.replace(/^0x/, '').match(/.{1,2}/g);
-  if (!arr) return new Uint8Array();
-  return new Uint8Array(arr.map((byte) => parseInt(byte, 16)));
-}
-
 /** Fetch the network's real FHE public key + CRS. Proving itself is fully local. */
 export async function fetchNetworkKeys(securityZone = 0): Promise<{ fheKey: string; crs: string }> {
   const post = async (path: string) => {

package/web/zkProve.worker.ts

@@ -10,6 +10,7 @@ import { TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT } from '../core/consts';
 import type { ZkProveWorkerRequest, ZkProveWorkerResponse } from '../core/encrypt/zkPackProveVerify.js';
 import { initTfheThreadPool, type TfheThreadPoolResult } from './tfheThreadPool.js';
 import type { TfheThreadsSetting } from '../core/types.js';
+import { fromHexString } from '../core/utils.js';
 
 // TFHE module (will be initialized on first use)
 let tfheModule: any = null;
@@ -57,16 +58,6 @@ function initTfhe(tfheThreads: TfheThreadsSetting = 'auto'): Promise<void> {
   return initPromise;
 }
 
-/**
- * Convert hex string to Uint8Array
- */
-function fromHexString(hexString: string): Uint8Array {
-  const cleanString = hexString.length % 2 === 1 ? `0${hexString}` : hexString;
-  const arr = cleanString.replace(/^0x/, '').match(/.{1,2}/g);
-  if (!arr) return new Uint8Array();
-  return new Uint8Array(arr.map((byte) => parseInt(byte, 16)));
-}
-
 // Guard the top-level `self` references so this file is safe to evaluate in
 // non-worker contexts (e.g. when bundlers like webpack pull the worker chunk
 // into the server bundle for SSR). The body is dead code anywhere `self` is

package/dist/chunk-NMKMCAI3.js

@@ -1,14 +0,0 @@
-// core/consts.ts
-var COFHE_ADDRESS_BOOK_ADDRESS = "0xC0F4e00E531a2B086492Ae3DCC1515038307196b";
-var TASK_MANAGER_ID = 1n;
-var MOCKS_TASK_MANAGER_ADDRESS = "0x0000000000000000000000000000000000005000";
-var MOCKS_ZK_VERIFIER_ADDRESS = "0x0000000000000000000000000000000000005001";
-var MOCKS_THRESHOLD_NETWORK_ADDRESS = "0x0000000000000000000000000000000000005002";
-var MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY = "0x6C8D7F768A6BB4AAFE85E8A2F5A9680355239C7E14646ED62B044E39DE154512";
-var MOCKS_ZK_VERIFIER_SIGNER_ADDRESS = "0x6E12D8C87503D4287c294f2Fdef96ACd9DFf6bd2";
-var MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY = "0x59c6995e998f97a5a0044966f0945389dc9e86dae88c7a8412f4603b6b78690d";
-var TFHE_RS_ZK_MAX_BITS = 2048;
-var TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT = BigInt(1 << 30);
-var TFHE_RS_KEY_VERSION = 2;
-
-export { COFHE_ADDRESS_BOOK_ADDRESS, MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY, MOCKS_TASK_MANAGER_ADDRESS, MOCKS_THRESHOLD_NETWORK_ADDRESS, MOCKS_ZK_VERIFIER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY, TASK_MANAGER_ID, TFHE_RS_KEY_VERSION, TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT, TFHE_RS_ZK_MAX_BITS };