@cofhe/sdk 1.0.1 → 1.1.0-alpha.1

package/CHANGELOG.md

@@ -1,13 +1,5 @@
 # @cofhe/sdk Changelog
 
-## 1.0.1
-
-### Patch Changes
-
-- fcc819c: **Breaking:** `encryptInputs(...).execute()` now binds the consuming contract into the ZK proof itself, and the CoFHE verifier requires it. Upgrade to 1.0.1: 1.0.0 is deprecated because of an issue in ZK verification, and once the verifier is updated a proof from 1.0.0 fails with `ZK_VERIFY_FAILED`. No code change is needed beyond the upgrade; `setConsumingContract(...)` was already required.
-
-  `execute()` now throws `CofheError` with code `CONSUMING_CONTRACT_INVALID` when `setConsumingContract(...)` was given something that is not an address, before TFHE is initialised or any proving starts. The check is byte-level, 20 bytes of hex in any case, and does not validate the EIP-55 checksum, so every address 1.0.0 accepted still passes. Previously the bad address reached the verifier and failed there, after the proof was generated. `CofheErrorCode` gains `ConsumingContractInvalid`; an exhaustive `switch` over the enum needs the new arm.
-
 ## 1.0.0
 
 ### Major Changes

package/core/acps.ts

@@ -26,7 +26,7 @@ import {
   clearAclServedAddresses,
 } from '@/acps';
 
-import { type Hex, type PublicClient, type WalletClient, zeroAddress } from 'viem';
+import { type ContractFunctionParameters, type Hex, type PublicClient, type WalletClient, zeroAddress } from 'viem';
 
 // HELPERS
 
@@ -311,23 +311,39 @@ const getBlockRevokerData = async (publicClient: PublicClient): Promise<number>
  *
  * @returns the revocation transaction hash
  */
-const revokeACP = async (acp: ACP, walletClient: WalletClient): Promise<Hex> => {
+/**
+ * A registry or revoker write built but not sent: what a simulation or `writeContract` takes,
+ * minus the sender. For a caller that sends through its own path (simulate first, record the
+ * transaction) instead of the plain `writeContract` the senders below do.
+ */
+export type ShareRegistryWrite<functionName extends 'share' | 'removeShare'> = ContractFunctionParameters<
+  typeof ACP_SHARE_REGISTRY_ABI,
+  'nonpayable',
+  functionName
+>;
+export type RevokerWrite = ContractFunctionParameters<typeof ACP_REVOKER_ABI, 'nonpayable', 'revokeSingle'>;
+
+/** The revoker write that revokes one acp, built but not sent. Throws for an acp without a revoker. */
+const prepareRevokeACP = (acp: ACP): RevokerWrite => {
   if (acp.revokerContract === zeroAddress || acp.revokerData === 0) {
     throw new Error('ACP is not revocable: it has no revoker (revokerContract/revokerData unset)');
   }
+  return {
+    address: acp.revokerContract,
+    abi: ACP_REVOKER_ABI,
+    functionName: 'revokeSingle',
+    args: [BigInt(acp.revokerData)],
+  };
+};
+
+const revokeACP = async (acp: ACP, walletClient: WalletClient): Promise<Hex> => {
+  const write = prepareRevokeACP(acp);
   if (walletClient.account == null) throw new Error('Missing walletClient account');
   if (walletClient.account.address.toLowerCase() !== acp.issuer.toLowerCase()) {
     throw new Error('Only the acp issuer can revoke it');
   }
 
-  return walletClient.writeContract({
-    address: acp.revokerContract,
-    abi: ACP_REVOKER_ABI,
-    functionName: 'revokeSingle',
-    args: [BigInt(acp.revokerData)],
-    account: walletClient.account,
-    chain: walletClient.chain,
-  });
+  return walletClient.writeContract({ ...write, account: walletClient.account, chain: walletClient.chain });
 };
 
 /**
@@ -416,34 +432,51 @@ const metadataOf = (acp: ACP, { labels, metadata, appKey }: ShareOnChainOptions)
  * to discover and import — the on-chain alternative to `export()` — optionally
  * with the labels of its handles.
  */
-const shareOnChain = async (
+/**
+ * The registry `share` write for a signed sharing acp, built but not sent, with the share id it
+ * gets. Validates the acp, not the sender: the registry takes the write from the issuer only.
+ */
+const prepareShareOnChain = (
   acp: ACP,
-  walletClient: WalletClient,
   registry: Hex,
   options: ShareOnChainOptions = {}
-): Promise<{ txHash: Hex; shareId: Hex }> => {
+): { write: ShareRegistryWrite<'share'>; shareId: Hex } => {
   if (acp.type !== 'sharing') {
     throw new Error(`Cannot share a '${acp.type}' ACP on-chain — only 'sharing' ACPs are shareable.`);
   }
   if (acp.issuerSignature === '0x') {
     throw new Error('Cannot share an unsigned sharing ACP — sign it first.');
   }
+  return {
+    write: {
+      address: registry,
+      abi: ACP_SHARE_REGISTRY_ABI,
+      functionName: 'share',
+      args: [toChainShare(acp), metadataOf(acp, options)],
+    },
+    shareId: computeShareId(acp),
+  };
+};
+
+const shareOnChain = async (
+  acp: ACP,
+  walletClient: WalletClient,
+  registry: Hex,
+  options: ShareOnChainOptions = {}
+): Promise<{ txHash: Hex; shareId: Hex }> => {
+  const { write, shareId } = prepareShareOnChain(acp, registry, options);
   if (walletClient.account == null) throw new Error('Missing walletClient account');
   if (walletClient.account.address.toLowerCase() !== acp.issuer.toLowerCase()) {
     throw new Error('Only the ACP issuer can share it on-chain');
   }
-  const metadata = metadataOf(acp, options);
 
   const txHash = await walletClient.writeContract({
-    address: registry,
-    abi: ACP_SHARE_REGISTRY_ABI,
-    functionName: 'share',
-    args: [toChainShare(acp), metadata],
+    ...write,
     account: walletClient.account,
     chain: walletClient.chain ?? null,
   });
 
-  return { txHash, shareId: computeShareId(acp) };
+  return { txHash, shareId };
 };
 
 const toIncomingShare = ({ shareId, share: s, metadata }: PostedShare): IncomingShare => ({
@@ -514,14 +547,19 @@ const importFromChain = async (
   return importShared({ ...options, type: 'sharing' }, publicClient, walletClient, importOptions);
 };
 
+/** The registry `removeShare` write for one share id, built but not sent. */
+const prepareRemoveShare = (shareId: Hex, registry: Hex): ShareRegistryWrite<'removeShare'> => ({
+  address: registry,
+  abi: ACP_SHARE_REGISTRY_ABI,
+  functionName: 'removeShare',
+  args: [shareId],
+});
+
 /** Remove a share from the registry (issuer retracts / recipient dismisses). */
 const removeShareOnChain = async (shareId: Hex, walletClient: WalletClient, registry: Hex): Promise<Hex> => {
   if (walletClient.account == null) throw new Error('Missing walletClient account');
   return walletClient.writeContract({
-    address: registry,
-    abi: ACP_SHARE_REGISTRY_ABI,
-    functionName: 'removeShare',
-    args: [shareId],
+    ...prepareRemoveShare(shareId, registry),
     account: walletClient.account,
     chain: walletClient.chain ?? null,
   });
@@ -562,15 +600,18 @@ export const acps = {
   removeActiveACP,
 
   revokeACP,
+  prepareRevokeACP,
   revokeAllACPs,
   isACPRevoked,
   checkAccess,
 
   shareOnChain,
+  prepareShareOnChain,
   getIncomingShares,
   getShareFromChain,
   importFromChain,
   removeShareOnChain,
+  prepareRemoveShare,
   computeShareId,
 
   applyACPDefaultsFromChain,

package/core/client.ts

@@ -1,4 +1,4 @@
-import type { CreateSelfACPOptions, CreateSharingACPOptions, ImportSharedACPOptions } from '@/acps';
+import type { ACP, CreateSelfACPOptions, CreateSharingACPOptions, ImportSharedACPOptions } from '@/acps';
 import { decodeShareMetadata, shareAppKey, verifyShareLabels } from '@/acps';
 
 import { createStore } from 'zustand/vanilla';
@@ -90,6 +90,14 @@ export function createCofheClientBase<TConfig extends CofheConfig>(
     }
   };
 
+  /** The sharing writes the registry and the revoker take from the issuer only; say so before building one. */
+  const _requireIssuer = (acp: ACP, what: string) => {
+    const sender = connectStore.getState().walletClient?.account?.address;
+    if (sender == null || sender.toLowerCase() !== acp.issuer.toLowerCase()) {
+      throw new Error(`Only the acp issuer can ${what}`);
+    }
+  };
+
   // LIFECYCLE
 
   async function connect(publicClient: PublicClient, walletClient: WalletClient) {
@@ -306,6 +314,12 @@ export function createCofheClientBase<TConfig extends CofheConfig>(
       return acps.revokeACP(acp, walletClient!);
     },
 
+    prepareRevokeACP: (acp) => {
+      _requireConnected();
+      _requireIssuer(acp, 'revoke it');
+      return acps.prepareRevokeACP(acp);
+    },
+
     revokeAllACPs: async (revokerContract?: `0x${string}`) => {
       _requireConnected();
       const { publicClient, walletClient } = connectStore.getState();
@@ -333,6 +347,23 @@ export function createCofheClientBase<TConfig extends CofheConfig>(
       return acps.shareOnChain(acp, walletClient!, sharingRegistry, { ...withAppKey(), ...options });
     },
 
+    prepareShareOnChain: async (acp, options) => {
+      _requireConnected();
+      _requireIssuer(acp, 'share it on-chain');
+      const { publicClient } = connectStore.getState();
+      const chainId = await publicClient!.getChainId();
+      const sharingRegistry = await _resolveSharingRegistry(publicClient!, chainId);
+      return acps.prepareShareOnChain(acp, sharingRegistry, { ...withAppKey(), ...options });
+    },
+
+    prepareRemoveShare: async (shareId) => {
+      _requireConnected();
+      const { publicClient } = connectStore.getState();
+      const chainId = await publicClient!.getChainId();
+      const sharingRegistry = await _resolveSharingRegistry(publicClient!, chainId);
+      return acps.prepareRemoveShare(shareId, sharingRegistry);
+    },
+
     getIncomingShares: async () => {
       _requireConnected();
       const { publicClient, walletClient } = connectStore.getState();

package/core/clientTypes.ts

@@ -6,7 +6,13 @@ import { type DecryptForTxBuilderUnset } from './decrypt/decryptForTxBuilder.js'
 import { type EncryptInputsBuilderUnset } from './encrypt/encryptInputsBuilder.js';
 import { type ZkBuilderAndCrsGenerator, type ZkProveWorkerFunction } from './encrypt/zkPackProveVerify.js';
 import { type FheKeyDeserializer } from './fetchKeys.js';
-import { acps, type ImportSharedOptions, type ShareOnChainOptions } from './acps.js';
+import {
+  acps,
+  type ImportSharedOptions,
+  type RevokerWrite,
+  type ShareOnChainOptions,
+  type ShareRegistryWrite,
+} from './acps.js';
 import type { EncryptableItem, FheTypes, TfheInitializer } from './types.js';
 import type { ACPUtils } from 'acps/acp.js';
 import type {
@@ -114,6 +120,11 @@ export type CofheClientACPs = {
 
   // Revocation (on-chain, require connection)
   revokeACP: (acp: ACP) => Promise<`0x${string}`>;
+  /**
+   * The revoker write `revokeACP` sends, built but not sent — for an app that sends through its own
+   * path (a simulation first, a transaction store). Issuer only; throws for an acp without a revoker.
+   */
+  prepareRevokeACP: (acp: ACP) => RevokerWrite;
   revokeAllACPs: (revokerContract?: `0x${string}`) => Promise<`0x${string}`>;
   isACPRevoked: (acp: ACP) => Promise<boolean>;
   /**
@@ -129,6 +140,16 @@ export type CofheClientACPs = {
    * optionally with the labels of its handles (`options.labels`, one per handle) or an encoded blob.
    */
   shareOnChain: (acp: ACP, options?: ShareOnChainOptions) => Promise<{ txHash: `0x${string}`; shareId: `0x${string}` }>;
+  /**
+   * The registry write `shareOnChain` sends and the share id it gets, built but not sent — for an
+   * app that sends through its own path (a simulation first, a transaction store). Issuer only.
+   */
+  prepareShareOnChain: (
+    acp: ACP,
+    options?: ShareOnChainOptions
+  ) => Promise<{ write: ShareRegistryWrite<'share'>; shareId: `0x${string}` }>;
+  /** The registry write `dismissShare` / `cancelShare` sends, built but not sent. */
+  prepareRemoveShare: (shareId: `0x${string}`) => Promise<ShareRegistryWrite<'removeShare'>>;
   /** Importable shares addressed to the connected account (unexpired, not revoked), with their metadata. */
   getIncomingShares: () => Promise<IncomingShare[]>;
   /** One share by id, as posted; null when unknown or removed. */

package/core/decrypt/decryptForTxBuilder.ts

@@ -11,6 +11,7 @@ import { cofheMocksDecryptForTx } from './cofheMocksDecryptForTx';
 import { getPublicClientChainID, sleep } from '../utils';
 import { type DecryptPollCallbackFunction } from '../types';
 import { tnDecryptV2 } from './tnDecryptV2';
+import { assertDecryptTimeoutMs } from './submitRetry';
 
 const DEFAULT_404_RETRY_TIMEOUT_MS = 10_000;
 
@@ -65,6 +66,7 @@ export class DecryptForTxBuilder extends BaseBuilder {
   private acpSelection: DecryptForTxACPSelection = 'unset';
   private pollCallback?: DecryptPollCallbackFunction;
   private retry404TimeoutMs = DEFAULT_404_RETRY_TIMEOUT_MS;
+  private timeoutMs?: number;
 
   constructor(params: DecryptForTxBuilderParams) {
     super({
@@ -153,6 +155,19 @@ export class DecryptForTxBuilder extends BaseBuilder {
     return this;
   }
 
+  /**
+   * The whole budget of this decrypt in milliseconds, submit retries and status polling together
+   * (5 minutes by default). Past it, `execute()` rejects with `DecryptFailed`; a request still
+   * processing on the threshold network is not cancelled.
+   */
+  setTimeout(this: DecryptForTxBuilderUnset, timeoutMs: number): DecryptForTxBuilderUnset;
+  setTimeout(this: DecryptForTxBuilderSelected, timeoutMs: number): DecryptForTxBuilderSelected;
+  setTimeout(timeoutMs: number): DecryptForTxBuilder {
+    assertDecryptTimeoutMs(timeoutMs, 'decryptForTx');
+    this.timeoutMs = timeoutMs;
+    return this;
+  }
+
   /**
    * Select "use acp" mode.
    *
@@ -326,6 +341,7 @@ export class DecryptForTxBuilder extends BaseBuilder {
       acp: wireAcp,
       thresholdNetworkUrl,
       retry404TimeoutMs: this.retry404TimeoutMs,
+      timeoutMs: this.timeoutMs,
       onPoll: this.pollCallback,
     });
 

package/core/decrypt/decryptForViewBuilder.ts

@@ -13,6 +13,7 @@ import { cofheMocksDecryptForView } from './cofheMocksDecryptForView.js';
 import { tnSealOutputV2 } from './tnSealOutputV2.js';
 import { sleep } from '../utils.js';
 import { type DecryptPollCallbackFunction } from '../types.js';
+import { assertDecryptTimeoutMs } from './submitRetry.js';
 
 const DEFAULT_404_RETRY_TIMEOUT_MS = 10_000;
 
@@ -51,6 +52,7 @@ export class DecryptForViewBuilder<U extends FheTypes> extends BaseBuilder {
   private acp?: ACP;
   private pollCallback?: DecryptPollCallbackFunction;
   private retry404TimeoutMs = DEFAULT_404_RETRY_TIMEOUT_MS;
+  private timeoutMs?: number;
 
   constructor(params: DecryptForViewBuilderParams<U>) {
     super({
@@ -134,6 +136,17 @@ export class DecryptForViewBuilder<U extends FheTypes> extends BaseBuilder {
     return this;
   }
 
+  /**
+   * The whole budget of this decrypt in milliseconds, submit retries and status polling together
+   * (5 minutes by default). Past it, `execute()` rejects with `SealOutputFailed`; a request still
+   * processing on the threshold network is not cancelled.
+   */
+  setTimeout(timeoutMs: number): DecryptForViewBuilder<U> {
+    assertDecryptTimeoutMs(timeoutMs, 'decryptForView');
+    this.timeoutMs = timeoutMs;
+    return this;
+  }
+
   /**
    * Select "use acp" mode (optional).
    *
@@ -295,6 +308,7 @@ export class DecryptForViewBuilder<U extends FheTypes> extends BaseBuilder {
       acp: wireAcp,
       thresholdNetworkUrl,
       retry404TimeoutMs: this.retry404TimeoutMs,
+      timeoutMs: this.timeoutMs,
       onPoll: this.pollCallback,
     });
     return ACPUtils.unseal(acp, sealed);

package/core/decrypt/submitRetry.ts

@@ -2,6 +2,22 @@ import { CofheError, CofheErrorCode } from '../error.js';
 import { mapApiErrorCodeToCofheErrorCode, parseApiErrorResponseBody } from './apiError.js';
 
 export const DEFAULT_404_RETRY_TIMEOUT_MS = 10_000;
+/** The default budget of one decrypt, submit retries and status polling together. */
+export const DEFAULT_DECRYPT_TIMEOUT_MS = 5 * 60 * 1000;
+
+/**
+ * Validates a builder's `setTimeout(timeoutMs)` argument: the overall budget must be a positive,
+ * finite number of milliseconds (0 would time out before the first attempt).
+ */
+export function assertDecryptTimeoutMs(timeoutMs: number, operationLabel: string): void {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new CofheError({
+      code: CofheErrorCode.InternalError,
+      message: `${operationLabel}: setTimeout(timeoutMs) expects a finite number greater than 0.`,
+      context: { timeoutMs },
+    });
+  }
+}
 
 export type SubmitRetryableStatus = 204 | 404;
 

package/core/decrypt/tnDecryptV2.ts

@@ -6,12 +6,16 @@ import { type DecryptPollCallbackFunction } from '../types';
 import { normalizeTnSignature, parseDecryptedBytesToBigInt } from './tnDecryptUtils';
 import { computeMinuteRampPollIntervalMs } from './polling.js';
 import { mapApiErrorCodeToCofheErrorCode, parseApiErrorResponseBody } from './apiError.js';
-import { classifySubmitResponse, normalize404RetryTimeoutMs, throwIfSubmitRetryTimedOut } from './submitRetry.js';
+import {
+  DEFAULT_DECRYPT_TIMEOUT_MS,
+  classifySubmitResponse,
+  normalize404RetryTimeoutMs,
+  throwIfSubmitRetryTimedOut,
+} from './submitRetry.js';
 
 // Polling configuration
 const POLL_INTERVAL_MS = 1000; // 1 second
 const POLL_MAX_INTERVAL_MS = 10_000; // 10 seconds
-const DECRYPT_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes total across submit + poll
 const SUBMIT_RETRY_INTERVAL_MS = 1000; // 1 second
 
 type DecryptSubmitResponseV2 = {
@@ -182,6 +186,7 @@ async function submitDecryptRequestV2(
   acp: ACPPublic | null,
   overallStartTime: number,
   retry404TimeoutMs: number,
+  timeoutMs: number,
   onPoll?: DecryptPollCallbackFunction
 ): Promise<DecryptSubmitResultV2> {
   const body: {
@@ -306,7 +311,7 @@ async function submitDecryptRequestV2(
       status: responseClassification.status,
       elapsedMs,
       retry404TimeoutMs,
-      overallTimeoutMs: DECRYPT_TIMEOUT_MS,
+      overallTimeoutMs: timeoutMs,
       thresholdNetworkUrl,
       body,
       attemptIndex,
@@ -319,7 +324,7 @@ async function submitDecryptRequestV2(
       attemptIndex,
       elapsedMs,
       intervalMs: SUBMIT_RETRY_INTERVAL_MS,
-      timeoutMs: DECRYPT_TIMEOUT_MS,
+      timeoutMs,
     });
 
     await new Promise((resolve) => setTimeout(resolve, SUBMIT_RETRY_INTERVAL_MS));
@@ -331,6 +336,7 @@ async function pollDecryptStatusV2(
   thresholdNetworkUrl: string,
   requestId: string,
   overallStartTime: number,
+  timeoutMs: number,
   onPoll?: DecryptPollCallbackFunction
 ): Promise<{ decryptedValue: bigint; signature: `0x${string}` }> {
   let attemptIndex = 0;
@@ -348,18 +354,18 @@ async function pollDecryptStatusV2(
       attemptIndex,
       elapsedMs,
       intervalMs,
-      timeoutMs: DECRYPT_TIMEOUT_MS,
+      timeoutMs,
     });
 
-    if (elapsedMs > DECRYPT_TIMEOUT_MS) {
+    if (elapsedMs > timeoutMs) {
       throw new CofheError({
         code: CofheErrorCode.DecryptFailed,
-        message: `decrypt polling timed out after ${DECRYPT_TIMEOUT_MS}ms`,
+        message: `decrypt polling timed out after ${timeoutMs}ms`,
         hint: 'The request may still be processing. Try again later.',
         context: {
           thresholdNetworkUrl,
           requestId,
-          timeoutMs: DECRYPT_TIMEOUT_MS,
+          timeoutMs,
         },
       });
     }
@@ -462,9 +468,12 @@ export async function tnDecryptV2(params: {
   acp: ACPPublic | null;
   thresholdNetworkUrl: string;
   retry404TimeoutMs?: number;
+  /** The whole budget, submit retries and status polling together; `DEFAULT_DECRYPT_TIMEOUT_MS` by default. */
+  timeoutMs?: number;
   onPoll?: DecryptPollCallbackFunction;
 }): Promise<{ decryptedValue: bigint; signature: `0x${string}` }> {
   const { thresholdNetworkUrl, ctHash, chainId, acp, retry404TimeoutMs, onPoll } = params;
+  const timeoutMs = params.timeoutMs ?? DEFAULT_DECRYPT_TIMEOUT_MS;
   const normalized404RetryTimeoutMs = normalize404RetryTimeoutMs({
     timeoutMs: retry404TimeoutMs,
     operationLabel: 'decrypt',
@@ -478,6 +487,7 @@ export async function tnDecryptV2(params: {
     acp,
     overallStartTime,
     normalized404RetryTimeoutMs,
+    timeoutMs,
     onPoll
   );
 
@@ -485,5 +495,5 @@ export async function tnDecryptV2(params: {
     return submitResult;
   }
 
-  return await pollDecryptStatusV2(thresholdNetworkUrl, submitResult.requestId, overallStartTime, onPoll);
+  return await pollDecryptStatusV2(thresholdNetworkUrl, submitResult.requestId, overallStartTime, timeoutMs, onPoll);
 }

package/core/decrypt/tnSealOutputV2.ts

@@ -5,13 +5,17 @@ import { CofheError, CofheErrorCode } from '../error.js';
 import { type DecryptPollCallbackFunction } from '../types.js';
 import { computeMinuteRampPollIntervalMs } from './polling.js';
 import { mapApiErrorCodeToCofheErrorCode, parseApiErrorResponseBody } from './apiError.js';
-import { classifySubmitResponse, normalize404RetryTimeoutMs, throwIfSubmitRetryTimedOut } from './submitRetry.js';
+import {
+  DEFAULT_DECRYPT_TIMEOUT_MS,
+  classifySubmitResponse,
+  normalize404RetryTimeoutMs,
+  throwIfSubmitRetryTimedOut,
+} from './submitRetry.js';
 import {} from './tnDecryptUtils.js';
 
 // Polling configuration
 const POLL_INTERVAL_MS = 1000; // 1 second
 const POLL_MAX_INTERVAL_MS = 10_000; // 10 seconds
-const SEAL_OUTPUT_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes total across submit + poll
 const SUBMIT_RETRY_INTERVAL_MS = 1000; // 1 second
 
 // V2 API response types
@@ -141,6 +145,7 @@ async function submitSealOutputRequest(
   acp: ACPPublic,
   overallStartTime: number,
   retry404TimeoutMs: number,
+  timeoutMs: number,
   onPoll?: DecryptPollCallbackFunction
 ): Promise<SealOutputSubmitResult> {
   const body = {
@@ -254,7 +259,7 @@ async function submitSealOutputRequest(
       status: responseClassification.status,
       elapsedMs,
       retry404TimeoutMs,
-      overallTimeoutMs: SEAL_OUTPUT_TIMEOUT_MS,
+      overallTimeoutMs: timeoutMs,
       thresholdNetworkUrl,
       body,
       attemptIndex,
@@ -267,7 +272,7 @@ async function submitSealOutputRequest(
       attemptIndex,
       elapsedMs,
       intervalMs: SUBMIT_RETRY_INTERVAL_MS,
-      timeoutMs: SEAL_OUTPUT_TIMEOUT_MS,
+      timeoutMs,
     });
 
     await new Promise((resolve) => setTimeout(resolve, SUBMIT_RETRY_INTERVAL_MS));
@@ -282,6 +287,7 @@ async function pollSealOutputStatus(
   thresholdNetworkUrl: string,
   requestId: string,
   overallStartTime: number,
+  timeoutMs: number,
   onPoll?: DecryptPollCallbackFunction
 ): Promise<EthEncryptedData> {
   let attemptIndex = 0;
@@ -299,19 +305,19 @@ async function pollSealOutputStatus(
       attemptIndex,
       elapsedMs,
       intervalMs,
-      timeoutMs: SEAL_OUTPUT_TIMEOUT_MS,
+      timeoutMs,
     });
 
     // Check timeout
-    if (elapsedMs > SEAL_OUTPUT_TIMEOUT_MS) {
+    if (elapsedMs > timeoutMs) {
       throw new CofheError({
         code: CofheErrorCode.SealOutputFailed,
-        message: `sealOutput polling timed out after ${SEAL_OUTPUT_TIMEOUT_MS}ms`,
+        message: `sealOutput polling timed out after ${timeoutMs}ms`,
         hint: 'The request may still be processing. Try again later.',
         context: {
           thresholdNetworkUrl,
           requestId,
-          timeoutMs: SEAL_OUTPUT_TIMEOUT_MS,
+          timeoutMs,
         },
       });
     }
@@ -416,9 +422,12 @@ export async function tnSealOutputV2(params: {
   acp: ACPPublic;
   thresholdNetworkUrl: string;
   retry404TimeoutMs?: number;
+  /** The whole budget, submit retries and status polling together; `DEFAULT_DECRYPT_TIMEOUT_MS` by default. */
+  timeoutMs?: number;
   onPoll?: DecryptPollCallbackFunction;
 }): Promise<EthEncryptedData> {
   const { thresholdNetworkUrl, ctHash, chainId, acp, retry404TimeoutMs, onPoll } = params;
+  const timeoutMs = params.timeoutMs ?? DEFAULT_DECRYPT_TIMEOUT_MS;
   const normalized404RetryTimeoutMs = normalize404RetryTimeoutMs({
     timeoutMs: retry404TimeoutMs,
     operationLabel: 'sealOutput',
@@ -434,6 +443,7 @@ export async function tnSealOutputV2(params: {
     acp,
     overallStartTime,
     normalized404RetryTimeoutMs,
+    timeoutMs,
     onPoll
   );
 
@@ -442,5 +452,5 @@ export async function tnSealOutputV2(params: {
   }
 
   // Step 2: Poll for status until completed
-  return await pollSealOutputStatus(thresholdNetworkUrl, submitResult.requestId, overallStartTime, onPoll);
+  return await pollSealOutputStatus(thresholdNetworkUrl, submitResult.requestId, overallStartTime, timeoutMs, onPoll);
 }

package/core/encrypt/encryptInputsBuilder.ts

@@ -21,7 +21,7 @@ import { cofheMocksCheckEncryptableBits, cofheMocksZkVerifySign } from './cofheM
 import { hardhat } from 'viem/chains';
 import { fetchKeys, type FheKeyDeserializer } from '../fetchKeys.js';
 import { getZkVerifierUrlOrThrow } from '../config.js';
-import { type WalletClient, isAddress } from 'viem';
+import { type WalletClient } from 'viem';
 import { sleep } from '../utils.js';
 import { BaseBuilder, type BaseBuilderParams } from '../baseBuilder.js';
 import { type KeysStorage } from '../keyStore.js';
@@ -256,37 +256,19 @@ export class EncryptInputsBuilder<T extends EncryptableItem[]> extends BaseBuild
   }
 
   /**
-   * Asserts that this.consumingContract is populated and is an address.
-   * Runs before TFHE init, key fetching and proving, so a bad address costs
-   * nothing: the contract is bound into the proof, and a proof built for a
-   * non-address could only fail at the verifier, after the expensive step.
-   * @throws {CofheError} If consumingContract is not set or is not an address
+   * Asserts that this.consumingContract is populated
+   * @throws {CofheError} If consumingContract is not set
    */
   private assertConsumingContract(): asserts this is this & { consumingContract: string } {
-    if (!this.consumingContract) {
-      throw new CofheError({
-        code: CofheErrorCode.ConsumingContractUninitialized,
-        message: 'Consuming contract is not set',
-        hint: 'Use setConsumingContract(...) to set the contract that will consume the encrypted inputs.',
-        context: {
-          consumingContract: this.consumingContract,
-        },
-      });
-    }
-    // strict: false — 20 bytes of hex in any case, no EIP-55 checksum check. The
-    // verifier decodes the address case-insensitively and the chain compares bytes,
-    // so a mixed-case address with a wrong checksum works end to end and a patch
-    // release must keep accepting it.
-    if (!isAddress(this.consumingContract, { strict: false })) {
-      throw new CofheError({
-        code: CofheErrorCode.ConsumingContractInvalid,
-        message: 'Consuming contract is not an address',
-        hint: 'setConsumingContract(...) takes the 20-byte address of the contract that will consume the encrypted inputs.',
-        context: {
-          consumingContract: this.consumingContract,
-        },
-      });
-    }
+    if (this.consumingContract) return;
+    throw new CofheError({
+      code: CofheErrorCode.ConsumingContractUninitialized,
+      message: 'Consuming contract is not set',
+      hint: 'Use setConsumingContract(...) to set the contract that will consume the encrypted inputs.',
+      context: {
+        consumingContract: this.consumingContract,
+      },
+    });
   }
 
   /**
@@ -585,7 +567,7 @@ export class EncryptInputsBuilder<T extends EncryptableItem[]> extends BaseBuild
     this.fireStepStart(EncryptStep.Prove);
 
     // Construct metadata once (used by both worker and main thread paths)
-    const metadata = constructZkPoKMetadata(this.account, this.securityZone, this.chainId, this.consumingContract);
+    const metadata = constructZkPoKMetadata(this.account, this.securityZone, this.chainId);
 
     let proof: Uint8Array | null = null;
     let usedWorker = false;