@fhevm/sdk 0.0.1 → 1.0.0-alpha.1

package/_esm/core/kms/fetchKmsSignedcryptedShares-p.js

@@ -0,0 +1,124 @@
+import { assertHandlesBelongToSameChainId } from '../handle/FhevmHandle.js';
+import { createKmsSigncryptedShares } from '../kms/KmsSigncryptedShares-p.js';
+import { readKmsSignersContext } from '../host-contracts/readKmsSignersContext-p.js';
+import { assertIsSignedDecryptionPermit, assertPermitIncludesContractAddresses } from './SignedDecryptionPermit-p.js';
+import { assertKmsDecryptionBitLimit } from './utils.js';
+import { checkPersistAllowed } from '../host-contracts/checkPersistAllowed.js';
+import { assertExtraDataMatchesKmsSingersContext } from '../host-contracts/KmsSignersContext-p.js';
+import { createKmsEip712Domain } from './createKmsEip712Domain.js';
+////////////////////////////////////////////////////////////////////////////////
+const MAX_USER_DECRYPT_CONTRACT_ADDRESSES = 10;
+////////////////////////////////////////////////////////////////////////////////
+// fetchKmsSignedcryptedShares
+////////////////////////////////////////////////////////////////////////////////
+export async function fetchKmsSignedcryptedShares(context, parameters) {
+    const { signedPermit, options, pairs } = parameters;
+    // Check: every requested contractAddress is listed in the permit
+    assertPermitIncludesContractAddresses(signedPermit, pairs.map((p) => p.contractAddress));
+    // Caller-provided options override runtime config defaults (e.g. auth)
+    const relayerOptions = {
+        auth: context.runtime.config.auth,
+        ...options,
+    };
+    assertIsSignedDecryptionPermit(signedPermit, {});
+    // The max number of contracts allowed in a permit is managed by the `SignedDecryptionPermit` directly
+    const { encryptedDataOwnerAddress, signerAddress, signature } = signedPermit;
+    // 1. Check: At least one handle/contract pair is required
+    if (pairs.length === 0) {
+        throw Error(`encrypted value/contract pairs must not be empty, at least one encrypted value/contract pair is required`);
+    }
+    // 2. Check: At least one contract
+    const contractAddressesLength = signedPermit.eip712.message.contractAddresses.length;
+    if (contractAddressesLength === 0) {
+        throw Error('contractAddresses is empty');
+    }
+    // 3. Check: No more that 10 contract addresses
+    if (contractAddressesLength > MAX_USER_DECRYPT_CONTRACT_ADDRESSES) {
+        throw Error(`contractAddresses max length of ${MAX_USER_DECRYPT_CONTRACT_ADDRESSES} exceeded`);
+    }
+    const handleContractPairs = pairs;
+    const handles = pairs.map((p) => p.handle);
+    Object.freeze(handles);
+    // 4. Check: All handles belong to the host chainId
+    assertHandlesBelongToSameChainId(handles, BigInt(context.chain.id));
+    // 5. Check: 2048 bits limit
+    assertKmsDecryptionBitLimit(handles);
+    // 6. Check: Expiration date
+    signedPermit.assertNotExpired();
+    // 7. Check: ACL permissions (user is signer or delegatorAddress)
+    await checkPersistAllowed(context, {
+        address: context.chain.fhevm.contracts.acl.address,
+        userAddress: encryptedDataOwnerAddress,
+        handleContractPairs,
+    });
+    // 8. Verify the EIP712 signature
+    // Not required because a signedPermit is guaranteed to be verified.
+    // 9. Fetch `KmsSignersContext` on-chain (cached)
+    // Reject the permit early if it was signed against a different KMS context
+    // (e.g. stale permit from a previous context rotation).
+    //
+    // Compares the `extraData` embedded in the permit's EIP-712 message with the
+    // `extraData` derived from the provided context. A mismatch indicates the permit
+    // was created for a different KMS context (e.g. different context ID or version)
+    // and must not be used for decryption.
+    //
+    // TODO: The current check is a strict byte-level comparison. A permit signed
+    // with the correct `kmsContextId` but a different `extraData` encoding format
+    // (e.g. a version change in the serialization scheme) will be rejected even
+    // though the context ID matches. Consider comparing the decoded `kmsContextId`
+    // instead of the raw `extraData` bytes.
+    const requestedKmsSignersContext = await readKmsSignersContext(context, {
+        address: context.chain.fhevm.contracts.kmsVerifier.address,
+    });
+    assertExtraDataMatchesKmsSingersContext({
+        extraData: signedPermit.eip712.message.extraData,
+        kmsSignersContext: requestedKmsSignersContext,
+    }, { subject: 'Invalid permit' });
+    // 10. Fetch `KmsSigncryptedShares` from the relayer
+    // Safe casts: the discriminated union on parameters guarantees
+    // that options type matches signedPermit type, but TS can't prove
+    // it after destructuring (nested discriminant limitation).
+    const relayerUrl = context.chain.fhevm.relayerUrl;
+    let shares;
+    if (signedPermit.isDelegated) {
+        shares = await context.runtime.relayer.fetchDelegatedUserDecrypt({ relayerUrl, chainId: context.chain.id }, {
+            payload: {
+                handleContractPairs,
+                kmsDecryptEip712Signer: signerAddress,
+                kmsDecryptEip712Message: signedPermit.eip712.message,
+                kmsDecryptEip712Signature: signature,
+            },
+            options: relayerOptions,
+        });
+    }
+    else {
+        shares = await context.runtime.relayer.fetchUserDecrypt({ relayerUrl, chainId: context.chain.id }, {
+            payload: {
+                handleContractPairs,
+                kmsDecryptEip712Signer: signerAddress,
+                kmsDecryptEip712Message: signedPermit.eip712.message,
+                kmsDecryptEip712Signature: signature,
+            },
+            options: relayerOptions,
+        });
+    }
+    // 11. Build and verify the sealed validated `KmsSigncryptedShares` object
+    const sharesMetadata = {
+        kmsSignersContext: requestedKmsSignersContext,
+        eip712Domain: createKmsEip712Domain({
+            chainId: context.chain.fhevm.gateway.id,
+            verifyingContractAddressDecryption: context.chain.fhevm.gateway.contracts.decryption.address,
+        }),
+        eip712Signature: signature,
+        eip712SignerAddress: signerAddress,
+        handles,
+    };
+    // 12. The returned KmsSigncryptedShares is guaranteed to be fully verified:
+    // uniform extraData across shares, valid extraData format, and consistency
+    // with the KmsSignersContext (see KmsSigncryptedSharesImpl invariants).
+    return await createKmsSigncryptedShares(context, {
+        metadata: sharesMetadata,
+        shares,
+    });
+}
+//# sourceMappingURL=fetchKmsSignedcryptedShares-p.js.map

package/_esm/core/kms/fetchKmsSignedcryptedShares-p.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetchKmsSignedcryptedShares-p.js","sourceRoot":"","sources":["../../../core/kms/fetchKmsSignedcryptedShares-p.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,kCAAkC,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,8BAA8B,EAAE,qCAAqC,EAAE,MAAM,+BAA+B,CAAC;AACtH,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,uCAAuC,EAAE,MAAM,0CAA0C,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AA4CnE,gFAAgF;AAEhF,MAAM,mCAAmC,GAAG,EAAE,CAAC;AAE/C,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAAgB,EAAE,UAAsB;IACxF,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;IAEpD,iEAAiE;IACjE,qCAAqC,CACnC,YAAY,EACZ,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CACpC,CAAC;IAEF,uEAAuE;IACvE,MAAM,cAAc,GAAG;QACrB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;QACjC,GAAG,OAAO;KACX,CAAC;IAEF,8BAA8B,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IAEjD,sGAAsG;IACtG,MAAM,EAAE,yBAAyB,EAAE,aAAa,EAAE,SAAS,EAAE,GAAG,YAAY,CAAC;IAE7E,0DAA0D;IAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,CACT,0GAA0G,CAC3G,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,MAAM,uBAAuB,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC;IACrF,IAAI,uBAAuB,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;IAED,+CAA+C;IAC/C,IAAI,uBAAuB,GAAG,mCAAmC,EAAE,CAAC;QAClE,MAAM,KAAK,CAAC,mCAAmC,mCAAmC,WAAW,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,mBAAmB,GAAG,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEvB,mDAAmD;IACnD,gCAAgC,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAiB,CAAC,CAAC;IAEpF,4BAA4B;IAC5B,2BAA2B,CAAC,OAAO,CAAC,CAAC;IAErC,4BAA4B;IAC5B,YAAY,CAAC,gBAAgB,EAAE,CAAC;IAEhC,iEAAiE;IACjE,MAAM,mBAAmB,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,OAA6B;QACxE,WAAW,EAAE,yBAAyB;QACtC,mBAAmB;KACpB,CAAC,CAAC;IAEH,iCAAiC;IACjC,oEAAoE;IAEpE,iDAAiD;IACjD,2EAA2E;IAC3E,wDAAwD;IACxD,EAAE;IACF,6EAA6E;IAC7E,iFAAiF;IACjF,iFAAiF;IACjF,uCAAuC;IACvC,EAAE;IACF,6EAA6E;IAC7E,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,wCAAwC;IACxC,MAAM,0BAA0B,GAAsB,MAAM,qBAAqB,CAAC,OAAO,EAAE;QACzF,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,OAA6B;KACjF,CAAC,CAAC;IAEH,uCAAuC,CACrC;QACE,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS;QAChD,iBAAiB,EAAE,0BAA0B;KAC9C,EACD,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAC9B,CAAC;IAEF,oDAAoD;IACpD,+DAA+D;IAC/D,kEAAkE;IAClE,2DAA2D;IAC3D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;IAElD,IAAI,MAAsC,CAAC;IAE3C,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,yBAAyB,CAC9D,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EACzC;YACE,OAAO,EAAE;gBACP,mBAAmB;gBACnB,sBAAsB,EAAE,aAAa;gBACrC,uBAAuB,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO;gBACpD,yBAAyB,EAAE,SAAS;aACrC;YACD,OAAO,EAAE,cAAoD;SAC9D,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CACrD,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,EACzC;YACE,OAAO,EAAE;gBACP,mBAAmB;gBACnB,sBAAsB,EAAE,aAAa;gBACrC,uBAAuB,EAAE,YAAY,CAAC,MAAM,CAAC,OAAO;gBACpD,yBAAyB,EAAE,SAAS;aACrC;YACD,OAAO,EAAE,cAA2C;SACrD,CACF,CAAC;IACJ,CAAC;IAED,0EAA0E;IAC1E,MAAM,cAAc,GAAiC;QACnD,iBAAiB,EAAE,0BAA0B;QAC7C,YAAY,EAAE,qBAAqB,CAAC;YAClC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;YACvC,kCAAkC,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO;SAC7F,CAAC;QACF,eAAe,EAAE,SAAS;QAC1B,mBAAmB,EAAE,aAAa;QAClC,OAAO;KACR,CAAC;IAEF,4EAA4E;IAC5E,2EAA2E;IAC3E,wEAAwE;IACxE,OAAO,MAAM,0BAA0B,CAAC,OAAO,EAAE;QAC/C,QAAQ,EAAE,cAAc;QACxB,MAAM;KACP,CAAC,CAAC;AACL,CAAC"}

package/_esm/core/kms/index.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=index.js.map

package/_esm/core/kms/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../core/kms/index.ts"],"names":[],"mappings":""}

package/_esm/core/kms/kmsDelegatedUserDecryptEip712Types.js

@@ -0,0 +1,28 @@
+////////////////////////////////////////////////////////////////////////////////
+// KmsDelegateUserDecryptEIP712Types
+////////////////////////////////////////////////////////////////////////////////
+export const kmsDelegatedUserDecryptEip712Types = {
+    EIP712Domain: [
+        { name: 'name', type: 'string' },
+        { name: 'version', type: 'string' },
+        { name: 'chainId', type: 'uint256' },
+        { name: 'verifyingContract', type: 'address' },
+    ],
+    // CRITICAL: Field order is authoritative — it determines the EIP-712 type hash.
+    // Changing the order will produce a different signature and break on-chain verification.
+    // Must match the Solidity struct definition exactly.
+    DelegatedUserDecryptRequestVerification: [
+        { name: 'publicKey', type: 'bytes' },
+        { name: 'contractAddresses', type: 'address[]' },
+        { name: 'delegatorAddress', type: 'address' },
+        { name: 'startTimestamp', type: 'uint256' },
+        { name: 'durationDays', type: 'uint256' },
+        { name: 'extraData', type: 'bytes' },
+    ],
+};
+Object.freeze(kmsDelegatedUserDecryptEip712Types);
+Object.freeze(kmsDelegatedUserDecryptEip712Types.EIP712Domain);
+Object.freeze(kmsDelegatedUserDecryptEip712Types.DelegatedUserDecryptRequestVerification);
+kmsDelegatedUserDecryptEip712Types.EIP712Domain.forEach(Object.freeze);
+kmsDelegatedUserDecryptEip712Types.DelegatedUserDecryptRequestVerification.forEach(Object.freeze);
+//# sourceMappingURL=kmsDelegatedUserDecryptEip712Types.js.map

package/_esm/core/kms/kmsDelegatedUserDecryptEip712Types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kmsDelegatedUserDecryptEip712Types.js","sourceRoot":"","sources":["../../../core/kms/kmsDelegatedUserDecryptEip712Types.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,oCAAoC;AACpC,gFAAgF;AAEhF,MAAM,CAAC,MAAM,kCAAkC,GAAsC;IACnF,YAAY,EAAE;QACZ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;QAChC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;QACnC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;QACpC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;KACtC;IACV,gFAAgF;IAChF,yFAAyF;IACzF,qDAAqD;IACrD,uCAAuC,EAAE;QACvC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;QACpC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE;QAChD,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7C,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3C,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;QACzC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;KAC5B;CACF,CAAC;AAEX,MAAM,CAAC,MAAM,CAAC,kCAAkC,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,CAAC,kCAAkC,CAAC,YAAY,CAAC,CAAC;AAC/D,MAAM,CAAC,MAAM,CAAC,kCAAkC,CAAC,uCAAuC,CAAC,CAAC;AAC1F,kCAAkC,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACvE,kCAAkC,CAAC,uCAAuC,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC"}

package/_esm/core/kms/kmsExtraData.js

@@ -0,0 +1,35 @@
+import { asUint256BigInt, asUint8Number } from '../base/uint.js';
+import { asBytes32Hex, assertIsBytesHex } from '../base/bytes.js';
+const EXTRA_DATA_V1 = 0x01;
+export function fromKmsExtraData(extraData) {
+    // First byte = version (characters 2-3 after '0x')
+    const version = asUint8Number(parseInt(extraData.slice(2, 4), 16));
+    if (version === EXTRA_DATA_V1) {
+        // 1 version byte + 32 contextId bytes = 33 bytes = 66 hex chars + 2 for '0x' = 68
+        if (extraData.length < 68) {
+            throw new Error(`extraData too short for v1: expected at least 33 bytes, got ${(extraData.length - 2) / 2}`);
+        }
+        // 32-byte contextId starts at byte 1 (hex chars 4..67)
+        const contextIdBytes32Hex = asBytes32Hex(`0x${extraData.slice(4, 68)}`);
+        const kmsContextId = asUint256BigInt(BigInt(contextIdBytes32Hex));
+        return { version, kmsContextId };
+    }
+    throw new Error(`Unsupported extraData version ${version}`);
+}
+/**
+ * Encodes a KMS context ID into the v1 extraData format.
+ * Layout: `0x` + `01` (version byte) + 32-byte big-endian context ID.
+ */
+export function toKmsExtraData(args) {
+    const v = args.version.toString(16).padStart(2, '0');
+    const id = args.kmsContextId.toString(16).padStart(64, '0');
+    return `0x${v}${id}`;
+}
+export function assertIsKmsExtraData(value, options) {
+    if (value === '0x00') {
+        return;
+    }
+    assertIsBytesHex(value, { ...options, byteLength: 33 });
+    fromKmsExtraData(value);
+}
+//# sourceMappingURL=kmsExtraData.js.map

package/_esm/core/kms/kmsExtraData.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kmsExtraData.js","sourceRoot":"","sources":["../../../core/kms/kmsExtraData.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAElE,MAAM,aAAa,GAAG,IAAI,CAAC;AAE3B,MAAM,UAAU,gBAAgB,CAAC,SAAmB;IAIlD,mDAAmD;IACnD,MAAM,OAAO,GAAG,aAAa,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAEnE,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,kFAAkF;QAClF,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,uDAAuD;QACvD,MAAM,mBAAmB,GAAe,YAAY,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QACpF,MAAM,YAAY,GAAG,eAAe,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAClE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAG9B;IACC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACrD,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC5D,OAAO,KAAK,CAAC,GAAG,EAAE,EAAc,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,KAAc,EACd,OAAmD;IAEnD,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QACrB,OAAO;IACT,CAAC;IACD,gBAAgB,CAAC,KAAK,EAAE,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,EAAgB,EAAE,CAAC,CAAC;IACtE,gBAAgB,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC"}

package/_esm/core/kms/kmsPublicDecryptEip712Types.js

@@ -0,0 +1,25 @@
+////////////////////////////////////////////////////////////////////////////////
+// KmsPublicDecryptEIP712Types
+////////////////////////////////////////////////////////////////////////////////
+export const kmsPublicDecryptEip712Types = {
+    EIP712Domain: [
+        { name: 'name', type: 'string' },
+        { name: 'version', type: 'string' },
+        { name: 'chainId', type: 'uint256' },
+        { name: 'verifyingContract', type: 'address' },
+    ],
+    // CRITICAL: Field order is authoritative — it determines the EIP-712 type hash.
+    // Changing the order will produce a different signature and break on-chain verification.
+    // Must match the Solidity struct definition exactly.
+    PublicDecryptVerification: [
+        { name: 'ctHandles', type: 'bytes32[]' },
+        { name: 'decryptedResult', type: 'bytes' },
+        { name: 'extraData', type: 'bytes' },
+    ],
+};
+Object.freeze(kmsPublicDecryptEip712Types);
+Object.freeze(kmsPublicDecryptEip712Types.EIP712Domain);
+Object.freeze(kmsPublicDecryptEip712Types.PublicDecryptVerification);
+kmsPublicDecryptEip712Types.EIP712Domain.forEach(Object.freeze);
+kmsPublicDecryptEip712Types.PublicDecryptVerification.forEach(Object.freeze);
+//# sourceMappingURL=kmsPublicDecryptEip712Types.js.map

package/_esm/core/kms/kmsPublicDecryptEip712Types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kmsPublicDecryptEip712Types.js","sourceRoot":"","sources":["../../../core/kms/kmsPublicDecryptEip712Types.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,2BAA2B,GAAgC;IACtE,YAAY,EAAE;QACZ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;QAChC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;QACnC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;QACpC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;KACtC;IACV,gFAAgF;IAChF,yFAAyF;IACzF,qDAAqD;IACrD,yBAAyB,EAAE;QACzB,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE;QACxC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,OAAO,EAAE;QAC1C,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;KAC5B;CACF,CAAC;AAEX,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC;AAC3C,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;AACxD,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,yBAAyB,CAAC,CAAC;AACrE,2BAA2B,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAChE,2BAA2B,CAAC,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC"}

package/_esm/core/kms/kmsUserDecryptEip712Types.js

@@ -0,0 +1,27 @@
+////////////////////////////////////////////////////////////////////////////////
+// KmsUserDecryptEIP712Types
+////////////////////////////////////////////////////////////////////////////////
+export const kmsUserDecryptEip712Types = {
+    EIP712Domain: [
+        { name: 'name', type: 'string' },
+        { name: 'version', type: 'string' },
+        { name: 'chainId', type: 'uint256' },
+        { name: 'verifyingContract', type: 'address' },
+    ],
+    // CRITICAL: Field order is authoritative — it determines the EIP-712 type hash.
+    // Changing the order will produce a different signature and break on-chain verification.
+    // Must match the Solidity struct definition exactly.
+    UserDecryptRequestVerification: [
+        { name: 'publicKey', type: 'bytes' },
+        { name: 'contractAddresses', type: 'address[]' },
+        { name: 'startTimestamp', type: 'uint256' },
+        { name: 'durationDays', type: 'uint256' },
+        { name: 'extraData', type: 'bytes' },
+    ],
+};
+Object.freeze(kmsUserDecryptEip712Types);
+Object.freeze(kmsUserDecryptEip712Types.EIP712Domain);
+Object.freeze(kmsUserDecryptEip712Types.UserDecryptRequestVerification);
+kmsUserDecryptEip712Types.EIP712Domain.forEach(Object.freeze);
+kmsUserDecryptEip712Types.UserDecryptRequestVerification.forEach(Object.freeze);
+//# sourceMappingURL=kmsUserDecryptEip712Types.js.map

package/_esm/core/kms/kmsUserDecryptEip712Types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kmsUserDecryptEip712Types.js","sourceRoot":"","sources":["../../../core/kms/kmsUserDecryptEip712Types.ts"],"names":[],"mappings":"AAEA,gFAAgF;AAChF,4BAA4B;AAC5B,gFAAgF;AAEhF,MAAM,CAAC,MAAM,yBAAyB,GAA8B;IAClE,YAAY,EAAE;QACZ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE;QAChC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;QACnC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;QACpC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE;KACtC;IACV,gFAAgF;IAChF,yFAAyF;IACzF,qDAAqD;IACrD,8BAA8B,EAAE;QAC9B,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;QACpC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,WAAW,EAAE;QAChD,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE;QAC3C,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE;QACzC,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE;KAC5B;CACF,CAAC;AAEX,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;AACzC,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;AACtD,MAAM,CAAC,MAAM,CAAC,yBAAyB,CAAC,8BAA8B,CAAC,CAAC;AACxE,yBAAyB,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC9D,yBAAyB,CAAC,8BAA8B,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC"}

package/_esm/core/kms/publicDecrypt.js

@@ -0,0 +1,65 @@
+import { assertHandlesBelongToSameChainId } from '../handle/FhevmHandle.js';
+import { assertKmsDecryptionBitLimit } from '../kms/utils.js';
+import { readKmsSignersContext, reconcileKmsSignersContext } from '../host-contracts/readKmsSignersContext-p.js';
+import { kmsSignersContextToExtraData } from '../host-contracts/KmsSignersContext-p.js';
+import { createPublicDecryptionProof } from '../kms/PublicDecryptionProof-p.js';
+import { checkAllowedForDecryption } from '../host-contracts/checkAllowedForDecryption.js';
+////////////////////////////////////////////////////////////////////////////////
+export async function publicDecrypt(context, parameters) {
+    const { handles, options, originToken } = parameters;
+    // Request side: build dynamic extraData from current context ID
+    // Contrary to the userDecrypt flow, the publicDecrypt doesn't require for an
+    // EIP-712 signature from the user, so the SDK can safely fetch the current
+    // context ID and build the extraData transparently to the user.
+    const requestedKmsSignersContext = await readKmsSignersContext(context, {
+        address: context.chain.fhevm.contracts.kmsVerifier.address,
+    });
+    const requestedExtraData = kmsSignersContextToExtraData(requestedKmsSignersContext);
+    const orderedHandles = handles;
+    // Caller-provided options override runtime config defaults (e.g. auth)
+    const relayerOptions = {
+        auth: context.runtime.config.auth,
+        ...options,
+    };
+    // 1. Check: At least one handle is required
+    if (orderedHandles.length === 0) {
+        throw Error(`handles must not be empty, at least one handle is required`);
+    }
+    // 2. Check: 2048 bits limit
+    assertKmsDecryptionBitLimit(orderedHandles);
+    // 3. Check: All handles belong to the host chainId
+    assertHandlesBelongToSameChainId(orderedHandles, BigInt(context.chain.id));
+    // 4. Check: ACL permissions
+    await checkAllowedForDecryption(context, {
+        address: context.chain.fhevm.contracts.acl.address,
+        handles: orderedHandles,
+    });
+    // 5. Call relayer
+    const { orderedAbiEncodedClearValues, kmsPublicDecryptEIP712Signatures, extraData: relayerExtraData, } = await context.runtime.relayer.fetchPublicDecrypt({
+        relayerUrl: context.chain.fhevm.relayerUrl,
+        chainId: context.chain.id,
+    }, {
+        payload: {
+            orderedHandles,
+            extraData: requestedExtraData,
+        },
+        options: relayerOptions,
+    });
+    // 6. Reconcile KMS signer context using 'loose' mode
+    const reconciledKmsSignersContext = await reconcileKmsSignersContext(context, {
+        address: context.chain.fhevm.contracts.kmsVerifier.address,
+        relayerExtraData,
+        requestedKmsSignersContext: requestedKmsSignersContext,
+        mode: 'loose',
+    });
+    // 7. Verify and Compute PublicDecryptionProof
+    const publicDecryptionProof = await createPublicDecryptionProof(context, {
+        originToken,
+        orderedHandles: orderedHandles,
+        orderedAbiEncodedClearValues,
+        kmsPublicDecryptEIP712Signatures,
+        kmsSignersContext: reconciledKmsSignersContext,
+    });
+    return publicDecryptionProof;
+}
+//# sourceMappingURL=publicDecrypt.js.map

package/_esm/core/kms/publicDecrypt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publicDecrypt.js","sourceRoot":"","sources":["../../../core/kms/publicDecrypt.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gCAAgC,EAAE,MAAM,0BAA0B,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,0BAA0B,EAAE,MAAM,8CAA8C,CAAC;AACjH,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAmB3F,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,UAAsB;IAC1E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,UAAU,CAAC;IAErD,gEAAgE;IAChE,6EAA6E;IAC7E,2EAA2E;IAC3E,gEAAgE;IAChE,MAAM,0BAA0B,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE;QACtE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,OAA6B;KACjF,CAAC,CAAC;IAEH,MAAM,kBAAkB,GAAa,4BAA4B,CAAC,0BAA0B,CAAC,CAAC;IAE9F,MAAM,cAAc,GAAG,OAAO,CAAC;IAE/B,uEAAuE;IACvE,MAAM,cAAc,GAAgC;QAClD,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI;QACjC,GAAG,OAAO;KACX,CAAC;IAEF,4CAA4C;IAC5C,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC5E,CAAC;IAED,4BAA4B;IAC5B,2BAA2B,CAAC,cAAc,CAAC,CAAC;IAE5C,mDAAmD;IACnD,gCAAgC,CAAC,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAiB,CAAC,CAAC;IAE3F,4BAA4B;IAC5B,MAAM,yBAAyB,CAAC,OAAO,EAAE;QACvC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,OAA6B;QACxE,OAAO,EAAE,cAAc;KACxB,CAAC,CAAC;IAEH,kBAAkB;IAClB,MAAM,EACJ,4BAA4B,EAC5B,gCAAgC,EAChC,SAAS,EAAE,gBAAgB,GAC5B,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,kBAAkB,CAClD;QACE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU;QAC1C,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;KAC1B,EACD;QACE,OAAO,EAAE;YACP,cAAc;YACd,SAAS,EAAE,kBAAkB;SAC9B;QACD,OAAO,EAAE,cAAc;KACxB,CACF,CAAC;IAEF,qDAAqD;IACrD,MAAM,2BAA2B,GAAsB,MAAM,0BAA0B,CAAC,OAAO,EAAE;QAC/F,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,OAA6B;QAChF,gBAAgB;QAChB,0BAA0B,EAAE,0BAA0B;QACtD,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IAEH,8CAA8C;IAC9C,MAAM,qBAAqB,GAA0B,MAAM,2BAA2B,CAAC,OAAO,EAAE;QAC9F,WAAW;QACX,cAAc,EAAE,cAAc;QAC9B,4BAA4B;QAC5B,gCAAgC;QAChC,iBAAiB,EAAE,2BAA2B;KAC/C,CAAC,CAAC;IAEH,OAAO,qBAAqB,CAAC;AAC/B,CAAC"}

package/_esm/core/kms/utils.js

@@ -0,0 +1,38 @@
+const MAX_KMS_DECRYPT_DECRYPTION_BIT_LIMIT = 2048;
+/**
+ * Asserts that the total encrypted bits across the given handles does not
+ * exceed the maximum number of bits the KMS is able to decrypt in a single call.
+ *
+ * @param handles - Handles to sum encrypted bits for
+ * @returns The total encrypted bits across all handles
+ * @throws {Error} If the total exceeds the limit
+ */
+export function assertKmsDecryptionBitLimit(handles) {
+    let total = 0;
+    for (const handle of handles) {
+        total += handle.encryptionBits;
+        if (total > MAX_KMS_DECRYPT_DECRYPTION_BIT_LIMIT) {
+            throw new Error(`Cannot decrypt more than ${MAX_KMS_DECRYPT_DECRYPTION_BIT_LIMIT} encrypted bits in a single request`);
+        }
+    }
+    return total;
+}
+export function assertKmsEIP712DeadlineValidity({ startTimestamp, durationDays, }, maxDurationDays) {
+    if (durationDays === 0) {
+        throw Error('durationDays is zero');
+    }
+    const durationDaysBigInt = BigInt(durationDays);
+    if (durationDaysBigInt > BigInt(maxDurationDays)) {
+        throw Error(`durationDays is above max duration of ${maxDurationDays}`);
+    }
+    const startTimestampBigInt = BigInt(startTimestamp);
+    const currentTimestamp = BigInt(Math.floor(Date.now() / 1000));
+    if (startTimestampBigInt > currentTimestamp) {
+        throw Error('startTimestamp is set in the future');
+    }
+    const durationInSeconds = durationDaysBigInt * BigInt(24 * 60 * 60);
+    if (startTimestampBigInt + durationInSeconds < currentTimestamp) {
+        throw Error('request has expired');
+    }
+}
+//# sourceMappingURL=utils.js.map

package/_esm/core/kms/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../../core/kms/utils.ts"],"names":[],"mappings":"AAGA,MAAM,oCAAoC,GAAG,IAAkB,CAAC;AAEhE;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CAAC,OAA0B;IACpE,IAAI,KAAK,GAAW,CAAC,CAAC;IAEtB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,IAAI,MAAM,CAAC,cAAc,CAAC;QAE/B,IAAI,KAAK,GAAG,oCAAoC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,4BAA4B,oCAAoC,qCAAqC,CACtG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,KAAmB,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,EACE,cAAc,EACd,YAAY,GAIb,EACD,eAA2B;IAE3B,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,kBAAkB,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,kBAAkB,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,CAAC;QACjD,MAAM,KAAK,CAAC,yCAAyC,eAAe,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC;IAEpD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IAC/D,IAAI,oBAAoB,GAAG,gBAAgB,EAAE,CAAC;QAC5C,MAAM,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,iBAAiB,GAAG,kBAAkB,GAAG,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;IACpE,IAAI,oBAAoB,GAAG,iBAAiB,GAAG,gBAAgB,EAAE,CAAC;QAChE,MAAM,KAAK,CAAC,qBAAqB,CAAC,CAAC;IACrC,CAAC;AACH,CAAC"}

package/_esm/core/kms/verifyKmsPublicDecryptEip712-p.js

@@ -0,0 +1,46 @@
+import { recoverSigners } from '../utils-p/runtime/recoverSigners.js';
+import { assertKmsSignerThreshold, kmsSignersContextToExtraData } from '../host-contracts/KmsSignersContext-p.js';
+import { createKmsEip712Domain } from './createKmsEip712Domain.js';
+import { kmsPublicDecryptEip712Types } from './kmsPublicDecryptEip712Types.js';
+////////////////////////////////////////////////////////////////////////////////
+export async function verifyKmsPublicDecryptEip712(context, parameters) {
+    const { kmsSignersContext, orderedHandles: orderedEncryptedValues, orderedAbiEncodedClearValues } = parameters;
+    // TODO:  use createKmsPublicDecryptEIP712 instead!
+    const extraData = kmsSignersContextToExtraData(kmsSignersContext);
+    ////////////////////////////////////////////////////////////////////////////
+    //
+    // Warning!!!! Do not use '0x00' here!! Only '0x' is permitted!
+    //
+    ////////////////////////////////////////////////////////////////////////////
+    let signedExtraData = extraData;
+    if (extraData === '0x00') {
+        signedExtraData = '0x';
+    }
+    const handlesBytes32Hex = orderedEncryptedValues.map((h) => h.bytes32Hex);
+    const message = {
+        ctHandles: handlesBytes32Hex,
+        decryptedResult: orderedAbiEncodedClearValues,
+        extraData: signedExtraData,
+    };
+    //////////////////////////////////////////////////////////////////////////////
+    //
+    // Warning!
+    // A 'PublicDecryptVerification' KmsEip712Domain uses the gateway chainId!
+    //
+    //////////////////////////////////////////////////////////////////////////////
+    const domain = createKmsEip712Domain({
+        chainId: context.chain.fhevm.gateway.id,
+        verifyingContractAddressDecryption: context.chain.fhevm.gateway.contracts.decryption.address,
+    });
+    // 1. Verify signatures
+    const recoveredAddresses = await recoverSigners(context, {
+        domain,
+        types: kmsPublicDecryptEip712Types,
+        primaryType: 'PublicDecryptVerification',
+        signatures: parameters.kmsPublicDecryptEIP712Signatures,
+        message,
+    });
+    // 2. Verify signature threshold is reached
+    assertKmsSignerThreshold(kmsSignersContext, recoveredAddresses);
+}
+//# sourceMappingURL=verifyKmsPublicDecryptEip712-p.js.map

package/_esm/core/kms/verifyKmsPublicDecryptEip712-p.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyKmsPublicDecryptEip712-p.js","sourceRoot":"","sources":["../../../core/kms/verifyKmsPublicDecryptEip712-p.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AAClH,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,kCAAkC,CAAC;AAgB/E,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAAgB,EAAE,UAAsB;IACzF,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,sBAAsB,EAAE,4BAA4B,EAAE,GAAG,UAAU,CAAC;IAE/G,mDAAmD;IAEnD,MAAM,SAAS,GAAa,4BAA4B,CAAC,iBAAiB,CAAC,CAAC;IAE5E,4EAA4E;IAC5E,EAAE;IACF,+DAA+D;IAC/D,EAAE;IACF,4EAA4E;IAC5E,IAAI,eAAe,GAAa,SAAS,CAAC;IAC1C,IAAI,SAAS,KAAM,MAAmB,EAAE,CAAC;QACvC,eAAe,GAAG,IAAgB,CAAC;IACrC,CAAC;IAED,MAAM,iBAAiB,GAA0B,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IAEjG,MAAM,OAAO,GAAkC;QAC7C,SAAS,EAAE,iBAAiB;QAC5B,eAAe,EAAE,4BAA4B;QAC7C,SAAS,EAAE,eAAe;KAC3B,CAAC;IAEF,8EAA8E;IAC9E,EAAE;IACF,WAAW;IACX,0EAA0E;IAC1E,EAAE;IACF,8EAA8E;IAC9E,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACnC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;QACvC,kCAAkC,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO;KAC7F,CAAC,CAAC;IAEH,uBAAuB;IACvB,MAAM,kBAAkB,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE;QACvD,MAAM;QACN,KAAK,EAAE,2BAA2B;QAClC,WAAW,EAAE,2BAA2B;QACxC,UAAU,EAAE,UAAU,CAAC,gCAAgC;QACvD,OAAO;KACR,CAAC,CAAC;IAEH,2CAA2C;IAC3C,wBAAwB,CAAC,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;AAClE,CAAC"}

package/_esm/core/modules/decrypt/mock.js

@@ -0,0 +1,82 @@
+////////////////////////////////////////////////////////////////////////////////
+// decryptAndReconstruct
+////////////////////////////////////////////////////////////////////////////////
+export async function decryptAndReconstruct(_runtime, _parameters) {
+    throw new Error('Not yet implemented');
+}
+//////////////////////////////////////////////////////////////////////////////
+// generateTkmsPrivateKey
+//////////////////////////////////////////////////////////////////////////////
+export async function generateTkmsPrivateKey(_runtime) {
+    throw new Error('Not yet implemented');
+}
+//////////////////////////////////////////////////////////////////////////////
+// getTkmsPublicKeyHex
+//////////////////////////////////////////////////////////////////////////////
+export async function getTkmsPublicKeyHex(_runtime, _parameters) {
+    throw new Error('Not yet implemented');
+}
+//////////////////////////////////////////////////////////////////////////////
+// serializeTkmsPrivateKey
+//////////////////////////////////////////////////////////////////////////////
+export async function serializeTkmsPrivateKey(_runtime, _parameters) {
+    throw new Error('Not yet implemented');
+}
+//////////////////////////////////////////////////////////////////////////////
+// deserializeTkmsPrivateKey
+//////////////////////////////////////////////////////////////////////////////
+export async function deserializeTkmsPrivateKey(_runtime, _parameters) {
+    throw new Error('Not yet implemented');
+}
+//////////////////////////////////////////////////////////////////////////////
+// verifyTkmsPrivateKey
+//////////////////////////////////////////////////////////////////////////////
+export function verifyTkmsPrivateKey(_runtime, _parameters) {
+    throw new Error('Not yet implemented');
+}
+//////////////////////////////////////////////////////////////////////////////
+// decryptActions
+//////////////////////////////////////////////////////////////////////////////
+export const decryptModule = (runtime) => {
+    return Object.freeze({
+        decrypt: Object.freeze({
+            initTkmsModule: () => Promise.resolve(),
+            getTkmsModuleInfo: () => {
+                throw new Error('Not yet implemented');
+            },
+            generateTkmsPrivateKey: () => generateTkmsPrivateKey(runtime),
+            decryptAndReconstruct: (args) => decryptAndReconstruct(runtime, args),
+            serializeTkmsPrivateKey: (args) => serializeTkmsPrivateKey(runtime, args),
+            deserializeTkmsPrivateKey: (args) => deserializeTkmsPrivateKey(runtime, args),
+            verifyTkmsPrivateKey: (args) => {
+                verifyTkmsPrivateKey(runtime, args);
+            },
+            getTkmsPublicKeyHex: (args) => getTkmsPublicKeyHex(runtime, args),
+        }),
+    });
+};
+//////////////////////////////////////////////////////////////////////////////
+// userDecryptActions
+//////////////////////////////////////////////////////////////////////////////
+export const userDecryptModule = (runtime, parameters) => {
+    const { privateKey } = parameters;
+    return Object.freeze({
+        userDecrypt: Object.freeze({
+            initTkmsModule: () => Promise.resolve(),
+            getTkmsModuleInfo: () => {
+                throw new Error('Not yet implemented');
+            },
+            decryptAndReconstruct: (args) => decryptAndReconstruct(runtime, {
+                ...args,
+                tkmsPrivateKey: privateKey,
+            }),
+            getTkmsPublicKeyHex: () => getTkmsPublicKeyHex(runtime, {
+                tkmsPrivateKey: privateKey,
+            }),
+            serializeTkmsPrivateKey: () => serializeTkmsPrivateKey(runtime, {
+                tkmsPrivateKey: privateKey,
+            }),
+        }),
+    });
+};
+//# sourceMappingURL=mock.js.map

package/_esm/core/modules/decrypt/mock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mock.js","sourceRoot":"","sources":["../../../../core/modules/decrypt/mock.ts"],"names":[],"mappings":"AAmBA,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAsB,EACtB,WAA4C;IAE5C,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAsB;IACjE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAsB,EACtB,WAA0C;IAE1C,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAsB,EACtB,WAA8C;IAE9C,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAsB,EACtB,WAAgD;IAEhD,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,UAAU,oBAAoB,CAAC,QAAsB,EAAE,WAA2C;IACtG,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,iBAAiB;AACjB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,aAAa,GAAyB,CAAC,OAAqB,EAAE,EAAE;IAC3E,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;YACvC,iBAAiB,EAAE,GAAG,EAAE;gBACtB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,sBAAsB,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC;YAC7D,qBAAqB,EAAE,CAAC,IAAqC,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC;YACtG,uBAAuB,EAAE,CAAC,IAAuC,EAAE,EAAE,CAAC,uBAAuB,CAAC,OAAO,EAAE,IAAI,CAAC;YAC5G,yBAAyB,EAAE,CAAC,IAAyC,EAAE,EAAE,CACvE,yBAAyB,CAAC,OAAO,EAAE,IAAI,CAAC;YAC1C,oBAAoB,EAAE,CAAC,IAAoC,EAAE,EAAE;gBAC7D,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;YACD,mBAAmB,EAAE,CAAC,IAAmC,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC;SACjG,CAAC;KACH,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAA6B,CACzD,OAAqB,EACrB,UAAuC,EACvC,EAAE;IACF,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;IAClC,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;YACzB,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE;YACvC,iBAAiB,EAAE,GAAG,EAAE;gBACtB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YACD,qBAAqB,EAAE,CAAC,IAAyC,EAAE,EAAE,CACnE,qBAAqB,CAAC,OAAO,EAAE;gBAC7B,GAAG,IAAI;gBACP,cAAc,EAAE,UAAU;aAC3B,CAAC;YACJ,mBAAmB,EAAE,GAAG,EAAE,CACxB,mBAAmB,CAAC,OAAO,EAAE;gBAC3B,cAAc,EAAE,UAAU;aAC3B,CAAC;YACJ,uBAAuB,EAAE,GAAG,EAAE,CAC5B,uBAAuB,CAAC,OAAO,EAAE;gBAC/B,cAAc,EAAE,UAAU;aAC3B,CAAC;SACL,CAAC;KACH,CAAC,CAAC;AACL,CAAC,CAAC"}