@cofhe/sdk 0.8.0 → 1.0.0

package/core/encrypt/cofheMocksZkVerifySign.ts

@@ -1,5 +1,14 @@
 import { type EncryptableItem, FheTypes } from '../types.js';
-import { type VerifyBatchResult } from './zkPackProveVerify.js';
+import {
+  type VerifyBatchResult,
+  MAX_UINT8,
+  MAX_UINT16,
+  MAX_UINT32,
+  MAX_UINT64,
+  MAX_UINT128,
+  MAX_UINT160,
+} from './zkPackProveVerify.js';
+import { toBigIntOrThrow, validateBigIntInRange } from '../utils.js';
 import { createWalletClient, http, encodePacked, keccak256, type PublicClient, type WalletClient } from 'viem';
 import { MockZkVerifierAbi } from './MockZkVerifierAbi.js';
 import { hardhat } from 'viem/chains';
@@ -19,7 +28,9 @@ function createMockZkVerifierSigner() {
   });
 }
 /**
- * The mocks don't use a tfhe builder, so we check the encryptable bits here to preserve parity
+ * The mocks don't use a tfhe builder, so we check the encryptable bits and value ranges here to
+ * preserve parity with `zkPack`. Without the range check, MockCoFHE masks an out-of-range value
+ * with the utype mask (e.g. uint8(256) -> 0) instead of rejecting it like the production path.
  */
 export async function cofheMocksCheckEncryptableBits(items: EncryptableItem[]): Promise<void> {
   let totalBits = 0;
@@ -30,22 +41,27 @@ export async function cofheMocksCheckEncryptableBits(items: EncryptableItem[]):
         break;
       }
       case FheTypes.Uint8: {
+        validateBigIntInRange(toBigIntOrThrow(item.data), MAX_UINT8);
         totalBits += 8;
         break;
       }
       case FheTypes.Uint16: {
+        validateBigIntInRange(toBigIntOrThrow(item.data), MAX_UINT16);
         totalBits += 16;
         break;
       }
       case FheTypes.Uint32: {
+        validateBigIntInRange(toBigIntOrThrow(item.data), MAX_UINT32);
         totalBits += 32;
         break;
       }
       case FheTypes.Uint64: {
+        validateBigIntInRange(toBigIntOrThrow(item.data), MAX_UINT64);
         totalBits += 64;
         break;
       }
       case FheTypes.Uint128: {
+        validateBigIntInRange(toBigIntOrThrow(item.data), MAX_UINT128);
         totalBits += 128;
         break;
       }
@@ -55,6 +71,7 @@ export async function cofheMocksCheckEncryptableBits(items: EncryptableItem[]):
       //   break;
       // }
       case FheTypes.Uint160: {
+        validateBigIntInRange(toBigIntOrThrow(item.data), MAX_UINT160);
         totalBits += 160;
         break;
       }

package/core/test/acpDefaults.test.ts

@@ -1,5 +1,6 @@
-import { describe, it, expect } from 'vitest';
+import { beforeEach, describe, it, expect, vi } from 'vitest';
 import { acps } from '../acps.js';
+import { clearTaskManagerAddressCache } from '../taskManager.js';
 
 type ScopeOpts = {
   revokerData?: number;
@@ -12,7 +13,10 @@ const opts = (o: ScopeOpts): ScopeOpts => o;
 
 const CHAIN = 31337;
 const REVOKER = '0x00000000000000000000000000000000000000aa' as `0x${string}`;
+const ACL_REVOKER = '0x00000000000000000000000000000000000000cc' as `0x${string}`;
 const CONTRACT_A = '0x00000000000000000000000000000000000000bb' as `0x${string}`;
+const ACL = '0x00000000000000000000000000000000000000dd' as `0x${string}`;
+const TM = '0x0000000000000000000000000000000000005000' as `0x${string}`;
 
 const acpConfig = {
   defaultRevoker: { [CHAIN]: REVOKER },
@@ -20,33 +24,118 @@ const acpConfig = {
 };
 
 describe('applyACPDefaults', () => {
-  it('injects default revoker (contract + creation timestamp) when no revoker options given', () => {
-    const before = Math.round(Date.now() / 1000);
-    const result = acps.applyACPDefaults(opts({}), acpConfig, CHAIN);
+  beforeEach(() => {
+    acps.clearAclServedAddresses();
+    clearTaskManagerAddressCache();
+  });
+
+  it('uses the exact chain block timestamp for an ACL-served revoker', async () => {
+    const latestBlockTimestamp = 1_700_000_000;
+    const publicClient = {
+      readContract: vi.fn(({ functionName }: { functionName: string }) => {
+        if (functionName === 'getTm') return Promise.resolve(TM);
+        if (functionName === 'acl') return Promise.resolve(ACL);
+        if (functionName === 'defaultRevokerContract') return Promise.resolve(ACL_REVOKER);
+        return Promise.reject(new Error(`unexpected ACL read: ${functionName}`));
+      }),
+      getBlock: vi.fn().mockResolvedValue({ timestamp: BigInt(latestBlockTimestamp) }),
+    } as any;
+
+    const result = await acps.applyACPDefaultsFromChain(opts({}), undefined, publicClient, CHAIN);
+
+    expect(publicClient.getBlock).toHaveBeenCalledWith();
+    expect(result.revokerContract).toBe(ACL_REVOKER);
+    expect(result.revokerData).toBe(latestBlockTimestamp);
+  });
+
+  it('prefers configured revoker over ACL but still uses the latest block timestamp', async () => {
+    const latestBlockTimestamp = 1_700_000_001;
+    const publicClient = {
+      readContract: vi.fn(({ functionName }: { functionName: string }) => {
+        if (functionName === 'getTm') return Promise.resolve(TM);
+        if (functionName === 'acl') return Promise.resolve(ACL);
+        if (functionName === 'defaultRevokerContract') return Promise.resolve(ACL_REVOKER);
+        return Promise.reject(new Error(`unexpected ACL read: ${functionName}`));
+      }),
+      getBlock: vi.fn().mockResolvedValue({ timestamp: BigInt(latestBlockTimestamp) }),
+    } as any;
+
+    const result = await acps.applyACPDefaultsFromChain(opts({}), acpConfig, publicClient, CHAIN);
+
+    expect(publicClient.readContract).not.toHaveBeenCalled();
+    expect(publicClient.getBlock).toHaveBeenCalledWith();
     expect(result.revokerContract).toBe(REVOKER);
-    expect(result.revokerData).toBeGreaterThanOrEqual(before - 60); // 60s clock-skew backdating
-    expect(result.revokerData).toBeLessThanOrEqual(Math.round(Date.now() / 1000) - 59);
+    expect(result.revokerData).toBe(latestBlockTimestamp);
+  });
+
+  it('avoids getBlock for explicit revoker options', async () => {
+    const publicClient = {
+      readContract: vi.fn(),
+      getBlock: vi.fn(),
+    } as any;
+
+    const result = await acps.applyACPDefaultsFromChain(
+      opts({ revokerData: 42, revokerContract: CONTRACT_A }),
+      acpConfig,
+      publicClient,
+      CHAIN
+    );
+
+    expect(publicClient.readContract).not.toHaveBeenCalled();
+    expect(publicClient.getBlock).not.toHaveBeenCalled();
+    expect(result).toMatchObject({ revokerData: 42, revokerContract: CONTRACT_A });
   });
 
-  it('does not override an explicit revoker pair', () => {
-    const result = acps.applyACPDefaults({ revokerData: 42, revokerContract: CONTRACT_A }, acpConfig, CHAIN);
-    expect(result.revokerData).toBe(42);
-    expect(result.revokerContract).toBe(CONTRACT_A);
+  it('avoids getBlock when neither config nor ACL provide a revoker', async () => {
+    const publicClient = {
+      readContract: vi.fn().mockRejectedValue(new Error('no ACL deployment')),
+      getBlock: vi.fn(),
+    } as any;
+
+    const result = await acps.applyACPDefaultsFromChain(opts({}), undefined, publicClient, CHAIN);
+
+    expect(publicClient.getBlock).not.toHaveBeenCalled();
+    expect(result).toEqual({});
   });
 
-  it('injects default contract scopes when no scope options given', () => {
-    const result = acps.applyACPDefaults(opts({}), acpConfig, CHAIN);
+  it('rejects a block timestamp outside JavaScript safe integer range', async () => {
+    const publicClient = {
+      readContract: vi.fn(({ functionName }: { functionName: string }) => {
+        if (functionName === 'getTm') return Promise.resolve(TM);
+        if (functionName === 'acl') return Promise.resolve(ACL);
+        if (functionName === 'defaultRevokerContract') return Promise.resolve(ACL_REVOKER);
+        return Promise.reject(new Error(`unexpected ACL read: ${functionName}`));
+      }),
+      getBlock: vi.fn().mockResolvedValue({ timestamp: BigInt(Number.MAX_SAFE_INTEGER) + 1n }),
+    } as any;
+
+    await expect(acps.applyACPDefaultsFromChain(opts({}), undefined, publicClient, CHAIN)).rejects.toThrow(
+      /ACP revokerData cannot represent the chain block timestamp .* as a safe integer/
+    );
+  });
+
+  it('injects default contract scopes when no scope options given', async () => {
+    const result = await acps.applyACPDefaultsFromChain(opts({}), acpConfig, noAclClient(), CHAIN);
     expect(result.contracts).toEqual([CONTRACT_A]);
   });
 
-  it('does not inject scopes when the caller provides any scope option (incl. explicit scope)', () => {
-    expect(acps.applyACPDefaults(opts({ scope: 0 }), acpConfig, CHAIN).contracts).toBeUndefined();
-    expect(acps.applyACPDefaults(opts({ handles: [1n] }), acpConfig, CHAIN).contracts).toBeUndefined();
-    expect(acps.applyACPDefaults(opts({ contracts: [] }), acpConfig, CHAIN).contracts).toEqual([]);
+  it('does not inject scopes when the caller provides any scope option (incl. explicit scope)', async () => {
+    const apply = (o: ScopeOpts) => acps.applyACPDefaultsFromChain(o, acpConfig, noAclClient(), CHAIN);
+    expect((await apply(opts({ scope: 0 }))).contracts).toBeUndefined();
+    expect((await apply(opts({ handles: [1n] }))).contracts).toBeUndefined();
+    expect((await apply(opts({ contracts: [] }))).contracts).toEqual([]);
   });
 
-  it('no-op for chains without defaults and for missing config', () => {
-    expect(acps.applyACPDefaults(opts({}), acpConfig, 999)).toEqual({});
-    expect(acps.applyACPDefaults(opts({}), undefined, CHAIN)).toEqual({});
+  it('no-op for chains without defaults and for missing config', async () => {
+    expect(await acps.applyACPDefaultsFromChain(opts({}), acpConfig, noAclClient(), 999)).toEqual({});
+    expect(await acps.applyACPDefaultsFromChain(opts({}), undefined, noAclClient(), CHAIN)).toEqual({});
   });
 });
+
+/** A chain with no ACL deployment: the ACL lookup serves no revoker. */
+function noAclClient() {
+  return {
+    readContract: vi.fn().mockRejectedValue(new Error('no ACL deployment')),
+    getBlock: vi.fn().mockResolvedValue({ timestamp: 1_700_000_000n }),
+  } as any;
+}

package/core/test/acpStoreAccountCase.test.ts

@@ -0,0 +1,80 @@
+/**
+ * @vitest-environment happy-dom
+ */
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+
+// Stub the on-chain EIP-712 domain read so the test needs no RPC (same approach as acps.test.ts).
+vi.mock('../../acps/onchain-utils.js', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('../../acps/onchain-utils.js')>()),
+  getAclEIP712Domain: async () => ({
+    name: 'ACL',
+    version: '2',
+    chainId: 421614,
+    verifyingContract: '0x1111111111111111111111111111111111111111' as `0x${string}`,
+  }),
+}));
+
+import { custom, createWalletClient, type PublicClient, type WalletClient } from 'viem';
+import { arbitrumSepolia } from 'viem/chains';
+import { privateKeyToAccount } from 'viem/accounts';
+import { acpStore } from '@/acps';
+import { acps } from '../acps.js';
+
+const chainId = 421614;
+// Offline clients: the wallet signs typed data locally, and any RPC call fails the test.
+const noRpc = custom({
+  request: async ({ method }) => {
+    throw new Error(`unexpected RPC call: ${method}`);
+  },
+});
+const publicClient = { getChainId: async () => chainId } as unknown as PublicClient;
+const walletClient: WalletClient = createWalletClient({
+  chain: arbitrumSepolia,
+  transport: noRpc,
+  account: privateKeyToAccount('0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80'),
+});
+const checksummed = walletClient.account!.address; // 0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266
+const lowercase = checksummed.toLowerCase();
+
+describe('ACP store account keys are case-insensitive', () => {
+  beforeEach(() => {
+    acpStore.store.setState({ acps: {}, activeACPHash: {} });
+  });
+
+  it('finds the active ACP when the account is passed in lowercase', async () => {
+    const created = await acps.createSelf({ issuer: checksummed }, publicClient, walletClient);
+
+    expect(acps.getActiveACP(chainId, checksummed)?.hash).toBe(created.hash);
+    expect(acps.getActiveACP(chainId, lowercase)?.hash).toBe(created.hash);
+    expect(acps.getACP(chainId, lowercase, created.hash)?.hash).toBe(created.hash);
+    expect(Object.keys(acps.getACPs(chainId, lowercase))).toEqual([created.hash]);
+  });
+
+  it('getOrCreateSelfACP with a lowercase account reuses the stored ACP instead of signing a new one', async () => {
+    const signSpy = vi.spyOn(walletClient, 'signTypedData');
+
+    const first = await acps.getOrCreateSelfACP(publicClient, walletClient, chainId, lowercase);
+    const second = await acps.getOrCreateSelfACP(publicClient, walletClient, chainId, lowercase);
+
+    expect(second.hash).toBe(first.hash);
+    expect(signSpy).toHaveBeenCalledTimes(1);
+    expect(Object.keys(acps.getACPs(chainId, checksummed))).toHaveLength(1);
+  });
+
+  it('keeps one bucket per account whatever case it is written and read in', async () => {
+    const created = await acps.createSelf({ issuer: checksummed }, publicClient, walletClient);
+    acpStore.store.setState({ acps: {}, activeACPHash: {} });
+
+    // Stored under the lowercase spelling (e.g. a wallet client built from a lowercase address)...
+    acpStore.setACP(chainId, lowercase, created);
+    acpStore.setActiveACPHash(chainId, lowercase, created.hash);
+    // ...still found with the checksummed one, and a write in that case reuses the same bucket.
+    expect(acpStore.getActiveACP(chainId, checksummed)?.hash).toBe(created.hash);
+    acpStore.setACP(chainId, checksummed, created);
+    expect(Object.keys(acpStore.store.getState().acps[chainId])).toEqual([lowercase]);
+
+    acpStore.removeACP(chainId, checksummed, created.hash);
+    expect(acpStore.getActiveACPHash(chainId, lowercase)).toBeUndefined();
+    expect(acpStore.getACP(chainId, lowercase, created.hash)).toBeUndefined();
+  });
+});

package/core/test/acps.test.ts

@@ -143,7 +143,8 @@ describe('Core ACPs Tests', () => {
       // Import the acp as Alice (recipient)
       const acp = await acps.importShared(acpJson, publicClient, aliceWalletClient);
 
-      expect(acp.name).toBe('Original Sharing ACP');
+      // the issuer's name is not taken over: the acp is named after its issuer
+      expect(acp.name).toBe(`Shared by ${bobAddress.slice(0, 6)}…${bobAddress.slice(-4)}`);
       expect(acp.type).toBe('recipient');
       expect(acp.issuer).toBe(bobAddress);
       expect(acp.recipient).toBe(aliceAddress);
@@ -190,7 +191,7 @@ describe('Core ACPs Tests', () => {
 
     const toIncomingShare = (sharing: SharingACP): IncomingShare => {
       const { sealingKey: _sealingKey, recipientSignature: _recipientSignature, ...pub } = ACPUtils.getPublic(sharing);
-      return { ...pub, shareId: ZERO_SHARE_ID };
+      return { ...pub, shareId: ZERO_SHARE_ID, metadata: '0x' };
     };
 
     it('importShared activates the imported acp by default', async () => {
@@ -231,6 +232,40 @@ describe('Core ACPs Tests', () => {
       expect(acps.getActiveACPHash(chainId, aliceAddress)).toBe(imported.hash);
     });
 
+    it('importFromChain keeps the share metadata on the stored recipient acp', async () => {
+      const { sharing } = await setUp();
+      const imported = await acps.importFromChain(
+        { ...toIncomingShare(sharing), metadata: '0x03aa' },
+        publicClient,
+        aliceWalletClient
+      );
+
+      expect(imported.metadata).toBe('0x03aa');
+      expect(acps.getACPs(chainId, aliceAddress)?.[imported.hash]?.metadata).toBe('0x03aa');
+    });
+
+    it('importShared and importFromChain take the recipient name as an option', async () => {
+      const { sharing } = await setUp();
+      const fromJson = await acps.importShared(ACPUtils.export(sharing), publicClient, aliceWalletClient, {
+        name: 'From Bob (JSON)',
+      });
+      const fromChain = await acps.importFromChain(toIncomingShare(sharing), publicClient, aliceWalletClient, {
+        name: 'From Bob (chain)',
+      });
+
+      expect(fromJson.name).toBe('From Bob (JSON)');
+      expect(fromChain.name).toBe('From Bob (chain)');
+      // the same share, so the second import replaced the first in the store
+      expect(acps.getACPs(chainId, aliceAddress)?.[fromChain.hash]?.name).toBe('From Bob (chain)');
+    });
+
+    it('importFromChain of a share without metadata leaves none on the acp', async () => {
+      const { sharing } = await setUp();
+      const imported = await acps.importFromChain(toIncomingShare(sharing), publicClient, aliceWalletClient);
+
+      expect(imported.metadata).toBeUndefined();
+    });
+
     it('importFromChain with activate: false stores the acp and keeps the active one', async () => {
       const { self, sharing } = await setUp();
       const imported = await acps.importFromChain(toIncomingShare(sharing), publicClient, aliceWalletClient, {
@@ -618,7 +653,7 @@ describe('Core ACPs Tests', () => {
       const exported = acps.export(acp);
       const parsed = JSON.parse(exported);
 
-      expect(parsed.name).toBe('Test Sharing ACP');
+      expect(parsed).not.toHaveProperty('name');
       expect(parsed.type).toBe('sharing');
       expect(parsed.issuer).toBe(bobAddress);
       expect(parsed.recipient).toBe(aliceAddress);

package/core/test/apiError.test.ts

@@ -47,6 +47,14 @@ describe('mapApiErrorCodeToCofheErrorCode', () => {
       CofheErrorCode.SealOutputFailed
     );
   });
+
+  it('falls back for a code that only exists on Object.prototype', () => {
+    for (const inherited of ['toString', 'constructor', 'valueOf', 'hasOwnProperty']) {
+      expect(mapApiErrorCodeToCofheErrorCode(inherited, CofheErrorCode.DecryptFailed)).toBe(
+        CofheErrorCode.DecryptFailed
+      );
+    }
+  });
 });
 
 describe('parseApiErrorResponseBody', () => {

package/core/test/appKeyConfig.test.ts

@@ -0,0 +1,94 @@
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { type PublicClient, type WalletClient } from 'viem';
+import { createCofheClientBase } from '../client';
+import { type CofheClient } from '../clientTypes';
+import { createCofheConfigBase, type CofheInputConfig } from '../config';
+import { acps } from '../acps';
+import { shareAppKey } from '../../acps/share-metadata';
+
+vi.mock('../keyStore', () => ({
+  createKeysStore: vi.fn(() => ({
+    rehydrateKeysStore: vi.fn().mockResolvedValue(undefined),
+    getFheKey: vi.fn(),
+    getCrs: vi.fn(),
+    setFheKey: vi.fn(),
+    setCrs: vi.fn(),
+    clearKeysStorage: vi.fn(),
+    store: {} as any,
+  })),
+}));
+
+const CHAIN_ID = 11155111;
+const ACCOUNT = '0x1234567890123456789012345678901234567890';
+const REGISTRY = '0x00000000000000000000000000000000000000e0';
+const APP = 'explorer.fhenix.io';
+const APP_KEY = shareAppKey(APP);
+
+const publicClient = { getChainId: vi.fn().mockResolvedValue(CHAIN_ID) } as unknown as PublicClient;
+const walletClient = {
+  getAddresses: vi.fn().mockResolvedValue([ACCOUNT]),
+  account: { address: ACCOUNT },
+} as unknown as WalletClient;
+
+/** A connected client; `acp.sharingRegistry` is set so the on-chain calls need no ACL lookup. */
+const connectedClient = async (acp: CofheInputConfig['acp']): Promise<CofheClient> => {
+  const client = createCofheClientBase({
+    config: createCofheConfigBase({ supportedChains: [], acp: { sharingRegistry: { [CHAIN_ID]: REGISTRY }, ...acp } }),
+    zkBuilderAndCrsGenerator: {} as any,
+    tfhePublicKeyDeserializer: {} as any,
+    compactPkeCrsDeserializer: {} as any,
+    initTfhe: () => Promise.resolve(false),
+  });
+  await client.connect(publicClient, walletClient);
+  return client;
+};
+
+const sharingOptions = { issuer: ACCOUNT, recipient: '0x00000000000000000000000000000000000000a1' };
+
+describe('the app key from config.acp.app', () => {
+  const spies = {
+    defaults: vi.spyOn(acps, 'applyACPDefaultsFromChain').mockImplementation(async (options) => options),
+    createSharing: vi.spyOn(acps, 'createSharing').mockResolvedValue({} as any),
+    getOrCreate: vi.spyOn(acps, 'getOrCreateSharingACP').mockResolvedValue({} as any),
+    shareOnChain: vi.spyOn(acps, 'shareOnChain').mockResolvedValue({ txHash: '0x', shareId: '0x' }),
+    getIncoming: vi.spyOn(acps, 'getIncomingShares').mockResolvedValue([]),
+  };
+  afterEach(() => Object.values(spies).forEach((spy) => spy.mockClear()));
+
+  it('goes on every share the client creates', async () => {
+    const client = await connectedClient({ app: APP });
+    await client.acp.createSharing(sharingOptions);
+    expect(spies.createSharing.mock.calls[0][0]).toMatchObject({ ...sharingOptions, appKey: APP_KEY });
+
+    await client.acp.getOrCreateSharingACP(sharingOptions);
+    expect(spies.getOrCreate.mock.calls[0][2]).toMatchObject({ ...sharingOptions, appKey: APP_KEY });
+  });
+
+  it('goes with labels posted by shareOnChain', async () => {
+    const client = await connectedClient({ app: APP });
+    await client.acp.shareOnChain({} as any, { labels: [] });
+    expect(spies.shareOnChain.mock.calls[0][3]).toEqual({ labels: [], appKey: APP_KEY });
+  });
+
+  it('filters the inbox', async () => {
+    const client = await connectedClient({ app: APP });
+    await client.acp.getIncomingShares();
+    expect(spies.getIncoming).toHaveBeenCalledWith(publicClient, REGISTRY, ACCOUNT, { appKey: APP_KEY });
+  });
+
+  it('is the keccak256 of the app name, and an explicit appKey wins over it', async () => {
+    const client = await connectedClient({ app: APP });
+    const other = shareAppKey('other.app');
+    await client.acp.createSharing({ ...sharingOptions, appKey: other });
+    expect(spies.createSharing.mock.calls[0][0]).toMatchObject({ appKey: other });
+    expect(APP_KEY).toMatch(/^0x[0-9a-f]{64}$/);
+  });
+
+  it('is absent without an app: shares carry no key and every share is listed', async () => {
+    const client = await connectedClient({});
+    await client.acp.createSharing(sharingOptions);
+    expect(spies.createSharing.mock.calls[0][0]).not.toHaveProperty('appKey');
+    await client.acp.getIncomingShares();
+    expect(spies.getIncoming).toHaveBeenCalledWith(publicClient, REGISTRY, ACCOUNT, {});
+  });
+});

package/core/test/config.test.ts

@@ -62,6 +62,14 @@ describe('createCofheConfigBase', () => {
     expectValidConfigItem('environment', 'react', 'react');
   });
 
+  it('acp.app', () => {
+    expectInvalidConfigItem('acp.app', '');
+    expectInvalidConfigItem('acp.app', 123);
+
+    expectValidConfigItem('acp.app', 'explorer.fhenix.io', 'explorer.fhenix.io');
+    expectValidConfigItem('acp.app', undefined, undefined);
+  });
+
   it('supportedChains', () => {
     expectInvalidConfigItem('supportedChains', {});
     expectInvalidConfigItem('supportedChains', 'not-an-array');

package/core/test/decryptBuilders.test.ts

@@ -1,13 +1,26 @@
-import { describe, it, expect } from 'vitest';
-import { type PublicClient, type WalletClient, createPublicClient, createWalletClient, http } from 'viem';
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { type PublicClient, type WalletClient, createPublicClient, createWalletClient, http, zeroAddress } from 'viem';
 import { privateKeyToAccount } from 'viem/accounts';
 import { arbitrumSepolia } from 'viem/chains';
+import { ACPUtils, acpStore, type ACP } from '@/acps';
 import { DecryptForTxBuilder } from '../decrypt/decryptForTxBuilder.js';
 import { DecryptForViewBuilder } from '../decrypt/decryptForViewBuilder.js';
+import { tnDecryptV2 } from '../decrypt/tnDecryptV2';
+import { tnSealOutputV2 } from '../decrypt/tnSealOutputV2';
 import { createCofheConfigBase, type CofheConfig } from '../config.js';
 import { CofheErrorCode } from '../error.js';
 import { FheTypes } from '../types.js';
 
+// Stub the threshold network calls so tests can assert whether a request was dispatched
+vi.mock('../decrypt/tnDecryptV2', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('../decrypt/tnDecryptV2')>()),
+  tnDecryptV2: vi.fn(),
+}));
+vi.mock('../decrypt/tnSealOutputV2', async (importOriginal) => ({
+  ...(await importOriginal<typeof import('../decrypt/tnSealOutputV2')>()),
+  tnSealOutputV2: vi.fn(),
+}));
+
 const TEST_PRIVATE_KEY = '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80';
 const account = privateKeyToAccount(TEST_PRIVATE_KEY);
 const TEST_CHAIN_ID = 421614;
@@ -416,3 +429,98 @@ describe('DecryptForViewBuilder', () => {
     });
   });
 });
+
+// ---------------------------------------------------------------------------
+// Expired acp (regression, issue #272)
+//
+// The getOrCreate* half of #272 is covered in acps.test.ts. These cover the decrypt path:
+// execute() must reject an expired acp (ACPUtils.validate) before any request is dispatched
+// to the threshold network, however the acp was selected.
+// ---------------------------------------------------------------------------
+
+describe('execute – expired acp (regression, issue #272)', () => {
+  type Selection = 'active acp' | 'acp hash' | 'acp object';
+  const selections: Selection[] = ['active acp', 'acp hash', 'acp object'];
+
+  const now = () => Math.floor(Date.now() / 1000);
+
+  // Built by hand rather than with ACPUtils.sign, which reads the ACL's EIP-712 domain over RPC.
+  // validate() only checks that a signature is present, and the threshold network is stubbed.
+  function createSignedSelfACP(expiration: number): ACP {
+    return {
+      ...ACPUtils.createSelf({ name: 'Test Self ACP', issuer: account.address, expiration }),
+      issuerSignature: `0x${'11'.repeat(65)}`,
+      _signedDomain: { name: 'ACL', version: '1', chainId: TEST_CHAIN_ID, verifyingContract: zeroAddress },
+    };
+  }
+
+  // Stores the acp and makes it the active acp for the test chain + account
+  function seedACP(acp: ACP) {
+    acpStore.setACP(TEST_CHAIN_ID, account.address, acp);
+    acpStore.setActiveACPHash(TEST_CHAIN_ID, account.address, acp.hash);
+  }
+
+  function selectTxACP(selection: Selection, acp: ACP) {
+    const builder = createTxBuilder();
+    if (selection === 'acp hash') return builder.withACP(acp.hash);
+    if (selection === 'acp object') return builder.withACP(acp);
+    return builder.withACP();
+  }
+
+  function selectViewACP(selection: Selection, acp: ACP) {
+    const builder = createViewBuilder(FheTypes.Uint32);
+    if (selection === 'acp hash') return builder.withACP(acp.hash);
+    if (selection === 'acp object') return builder.withACP(acp);
+    return builder.withACP();
+  }
+
+  beforeEach(() => {
+    acpStore.store.setState({ acps: {}, activeACPHash: {} });
+    vi.mocked(tnDecryptV2).mockReset();
+    vi.mocked(tnSealOutputV2).mockReset();
+  });
+
+  afterEach(() => {
+    acpStore.store.setState({ acps: {}, activeACPHash: {} });
+  });
+
+  describe('decryptForTx', () => {
+    it.each(selections)('rejects an expired acp selected via %s without dispatching', async (selection) => {
+      const acp = createSignedSelfACP(now() - 3600);
+      seedACP(acp);
+
+      await expect(selectTxACP(selection, acp).execute()).rejects.toThrow('ACP is expired');
+      expect(tnDecryptV2).not.toHaveBeenCalled();
+    });
+
+    it('dispatches a valid acp (control for the expired cases)', async () => {
+      vi.mocked(tnDecryptV2).mockResolvedValue({ decryptedValue: 7n, signature: '0x1234' });
+      const acp = createSignedSelfACP(now() + 3600);
+      seedACP(acp);
+
+      const result = await selectTxACP('active acp', acp).execute();
+
+      expect(result.decryptedValue).toBe(7n);
+      expect(tnDecryptV2).toHaveBeenCalledOnce();
+    });
+  });
+
+  describe('decryptForView', () => {
+    it.each(selections)('rejects an expired acp selected via %s without dispatching', async (selection) => {
+      const acp = createSignedSelfACP(now() - 3600);
+      seedACP(acp);
+
+      await expect(selectViewACP(selection, acp).execute()).rejects.toThrow('ACP is expired');
+      expect(tnSealOutputV2).not.toHaveBeenCalled();
+    });
+
+    it('dispatches a valid acp (control for the expired cases)', async () => {
+      vi.mocked(tnSealOutputV2).mockRejectedValue(new Error('stubbed threshold network'));
+      const acp = createSignedSelfACP(now() + 3600);
+      seedACP(acp);
+
+      await expect(selectViewACP('active acp', acp).execute()).rejects.toThrow('stubbed threshold network');
+      expect(tnSealOutputV2).toHaveBeenCalledOnce();
+    });
+  });
+});