@fhevm/sdk 0.13.2-1 → 0.14.0-12

package/core/actions/base/index.ts

@@ -36,16 +36,38 @@ export {
   fetchEncryptedValues,
 } from './fetchEncryptedValues.js';
 
-// v13: Only the Legacy version is exported
+// V1 permit (protocol v13 and below) — kept for chains/relayers not yet on v14.
 export {
   type CreateUnsignedLegacyDecryptionPermitEip712Parameters,
   type CreateUnsignedLegacyDecryptionPermitEip712ReturnType,
   createUnsignedLegacyDecryptionPermitEip712,
 } from './createUnsignedLegacyDecryptionPermitEip712.js';
 
-// v13: Only the Legacy version is exported
+export {
+  type CanUseUnifiedDecryptionPermitParameters,
+  type CanUseUnifiedDecryptionPermitReturnType,
+  canUseUnifiedDecryptionPermit,
+} from './canUseUnifiedDecryptionPermit.js';
+
+// V1 permit (protocol v13 and below) — kept for chains/relayers not yet on v14.
 export {
   type SignLegacyDecryptionPermitParameters,
   type SignLegacyDecryptionPermitReturnType,
   signLegacyDecryptionPermit,
 } from './signLegacyDecryptionPermit.js';
+
+// V2 permit (protocol v14 and above) — requires an SDK on protocol API v0.14.0+
+// and a chain whose KMSVerifier/ProtocolConfig support the unified extraData v2.
+export {
+  type CreateUnsignedUnifiedDecryptionPermitEip712Parameters,
+  type CreateUnsignedUnifiedDecryptionPermitEip712ReturnType,
+  createUnsignedUnifiedDecryptionPermitEip712,
+} from './createUnsignedUnifiedDecryptionPermitEip712.js';
+
+// V2 permit (protocol v14 and above) — requires an SDK on protocol API v0.14.0+
+// and a chain whose KMSVerifier/ProtocolConfig support the unified extraData v2.
+export {
+  type SignUnifiedDecryptionPermitParameters,
+  type SignUnifiedDecryptionPermitReturnType,
+  signUnifiedDecryptionPermit,
+} from './signUnifiedDecryptionPermit.js';

package/core/actions/base/signUnifiedDecryptionPermit.ts

@@ -0,0 +1,27 @@
+import type { Fhevm } from '../../types/coreFhevmClient.js';
+import type { FhevmChain } from '../../types/fhevmChain.js';
+import type { SignedDecryptionPermit } from '../../types/signedDecryptionPermit.js';
+import type { NativeSigner } from '../../modules/ethereum/types.js';
+import type { TransportKeyPair } from '../decrypt/index.js';
+import { signDecryptionPermitV2 as signUnifiedDecryptionPermit_ } from '../../kms/SignedDecryptionPermitV2-p.js';
+import { initPublicAction } from '../../runtime/CoreFhevm-p.js';
+
+export type SignUnifiedDecryptionPermitParameters = {
+  readonly contractAddresses: readonly string[];
+  readonly startTimestamp: number;
+  readonly durationSeconds: number;
+  readonly signerAddress: string;
+  readonly signer: NativeSigner;
+  readonly delegatorAddress?: string | undefined;
+  readonly transportKeyPair: TransportKeyPair;
+};
+
+export type SignUnifiedDecryptionPermitReturnType = SignedDecryptionPermit;
+
+export async function signUnifiedDecryptionPermit(
+  fhevm: Fhevm<FhevmChain>,
+  parameters: SignUnifiedDecryptionPermitParameters,
+): Promise<SignUnifiedDecryptionPermitReturnType> {
+  const fhevmContext = await initPublicAction(fhevm);
+  return signUnifiedDecryptionPermit_(fhevm, { ...parameters, fhevmContext });
+}

package/core/actions/host/resolveChainId.ts

@@ -38,7 +38,9 @@ export async function resolveChainId(
   const chainId = asUint64BigInt(await fhevm.runtime.ethereum.getChainId(trustedClient));
 
   if (resolvedId !== chainId) {
-    throw new Error(`Chain id mismatch: connected to chain ${chainId}, but expected chain ${resolvedId}`);
+    const message = `Chain id mismatch: connected to chain ${chainId}, but expected chain ${resolvedId}`;
+    fhevm.runtime.config.logger?.error?.(message, undefined);
+    throw new Error(message);
   }
 
   return resolvedId;

package/core/clients/decorators/base.ts

@@ -49,6 +49,11 @@ import {
   type SignLegacyDecryptionPermitParameters,
   type SignLegacyDecryptionPermitReturnType,
 } from '../../actions/base/signLegacyDecryptionPermit.js';
+import {
+  signUnifiedDecryptionPermit,
+  type SignUnifiedDecryptionPermitParameters,
+  type SignUnifiedDecryptionPermitReturnType,
+} from '../../actions/base/signUnifiedDecryptionPermit.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -145,6 +150,21 @@ export type BaseActions = {
   readonly signLegacyDecryptionPermit: (
     parameters: SignLegacyDecryptionPermitParameters,
   ) => Promise<SignLegacyDecryptionPermitReturnType>;
+  /**
+   * Signs a unified decryption permit (V2).
+   *
+   * Requires an SDK on protocol API v0.14.0+ and a chain whose KMSVerifier/ProtocolConfig
+   * support the unified extraData v2 — throws if the connected chain has not yet upgraded.
+   *
+   * - Without `delegatorAddress`: Alice signs to decrypt her own encrypted values.
+   * - With `delegatorAddress`: Bob signs to decrypt values belonging to `delegatorAddress` (Alice),
+   *   after Alice has granted permission via `FHE.delegateUserDecryption()` on-chain.
+   *
+   * Inspect `isDelegated` on the returned permit to distinguish the two cases.
+   */
+  readonly signUnifiedDecryptionPermit: (
+    parameters: SignUnifiedDecryptionPermitParameters,
+  ) => Promise<SignUnifiedDecryptionPermitReturnType>;
   /** Deserializes a previously serialized e2e transport key pair back into a usable key pair. */
   readonly parseTransportKeyPair: (
     parameters: ParseTransportKeyPairParameters,
@@ -176,6 +196,7 @@ function _baseActions(fhevm: Fhevm<FhevmChain>): BaseActions {
     decryptPublicValuesWithSignatures: (parameters) => decryptPublicValuesWithSignatures(fhevm, parameters),
     signDecryptionPermit: (parameters) => signDecryptionPermit(fhevm, parameters),
     signLegacyDecryptionPermit: (parameters) => signLegacyDecryptionPermit(fhevm, parameters),
+    signUnifiedDecryptionPermit: (parameters) => signUnifiedDecryptionPermit(fhevm, parameters),
     parseTransportKeyPair: (parameters) => parseTransportKeyPair(fhevm, parameters),
     serializeTransportKeyPair: (parameters) => serializeTransportKeyPair(fhevm, parameters),
     serializeSignedDecryptionPermit: (parameters) => serializeSignedDecryptionPermit(fhevm, parameters),

package/core/errors/Erc1271Error.ts

@@ -0,0 +1,85 @@
+import type { FhevmErrorBaseParams } from './FhevmErrorBase.js';
+import type { Prettify } from '../types/utils.js';
+import { FhevmErrorBase } from './FhevmErrorBase.js';
+
+////////////////////////////////////////////////////////////////////////////////
+// Erc1271VerificationError
+//
+// Definitive, client-side rejections of a user-decryption signature, mirroring
+// the shared `user-decryption-signature` crate's error taxonomy. Thrown
+// fail-fast (matching the relayer's sync 400). Only definitive failures throw;
+// see `verifyErc1271UserDecrypt` for how inconclusive outcomes are handled.
+////////////////////////////////////////////////////////////////////////////////
+
+export type Erc1271VerificationErrorParams = Prettify<Omit<FhevmErrorBaseParams, 'name' | 'message'>>;
+
+/** Base class for all definitive ERC-1271 / EOA signature rejections. */
+export abstract class Erc1271VerificationError extends FhevmErrorBase {}
+
+////////////////////////////////////////////////////////////////////////////////
+
+export type Erc1271EoaMismatchNoCodeErrorType = Erc1271EoaMismatchNoCodeError & {
+  name: 'Erc1271EoaMismatchNoCodeError';
+};
+
+/** ecrecover did not match `userAddress` and `userAddress` has no contract code. */
+export class Erc1271EoaMismatchNoCodeError extends Erc1271VerificationError {
+  constructor(params: Erc1271VerificationErrorParams & { userAddress: string }) {
+    super({
+      ...params,
+      name: 'Erc1271EoaMismatchNoCodeError',
+      message: `ecrecover signer mismatch and userAddress ${params.userAddress} has no contract code on the host chain`,
+    });
+  }
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+export type Erc1271EmptySigOnEoaErrorType = Erc1271EmptySigOnEoaError & {
+  name: 'Erc1271EmptySigOnEoaError';
+};
+
+/** An empty signature was supplied but `userAddress` has no contract code. */
+export class Erc1271EmptySigOnEoaError extends Erc1271VerificationError {
+  constructor(params: Erc1271VerificationErrorParams & { userAddress: string }) {
+    super({
+      ...params,
+      name: 'Erc1271EmptySigOnEoaError',
+      message: `empty signature is only valid for contracts; userAddress ${params.userAddress} has no contract code`,
+    });
+  }
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+export type Erc1271WrongMagicErrorType = Erc1271WrongMagicError & {
+  name: 'Erc1271WrongMagicError';
+};
+
+/** `isValidSignature` returned a non-magic value. */
+export class Erc1271WrongMagicError extends Erc1271VerificationError {
+  constructor(params: Erc1271VerificationErrorParams & { userAddress: string; magicValue: string }) {
+    super({
+      ...params,
+      name: 'Erc1271WrongMagicError',
+      message: `ERC-1271 isValidSignature returned non-magic value ${params.magicValue} for userAddress ${params.userAddress}`,
+    });
+  }
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+export type Erc1271RejectedErrorType = Erc1271RejectedError & {
+  name: 'Erc1271RejectedError';
+};
+
+/** `isValidSignature` reverted or returned malformed data. */
+export class Erc1271RejectedError extends Erc1271VerificationError {
+  constructor(params: Erc1271VerificationErrorParams & { userAddress: string; detail: string }) {
+    super({
+      ...params,
+      name: 'Erc1271RejectedError',
+      message: `ERC-1271 isValidSignature reverted or returned malformed data for userAddress ${params.userAddress}: ${params.detail}`,
+    });
+  }
+}

package/core/frozenContext/fhevmClientFrozenContext-p.ts

@@ -240,6 +240,7 @@ export function cloneFhevmClientFrozenContext(value: FhevmClientFrozenContext):
     readonly pubKeyCrsVersion?: PubKeyCrsVersionResolution | undefined;
     readonly tfheVersion?: TfheVersion | undefined;
     readonly tkmsVersion?: TkmsVersion | undefined;
+    readonly relayerSupportsV3UserDecryptRoute: boolean;
   };
 
   const hostContractVersions: Partial<Record<HostContractName, HostContractVersion>> = {};

package/core/frozenContext/resolveFhevmClientFrozenContext-p.ts

@@ -56,6 +56,11 @@ export async function resolveFhevmClientFrozenContext(fhevm: FhevmBase<FhevmChai
   const kmsVerifierAddress: ChecksummedAddress = addressToChecksummedAddress(
     asAddress(fhevm.chain.fhevm.contracts.kmsVerifier.address),
   );
+  // ProtocolConfig only exists on v0.14+ deployments — absent on older chains.
+  const protocolConfigAddress: ChecksummedAddress | undefined =
+    fhevm.chain.fhevm.contracts.protocolConfig === undefined
+      ? undefined
+      : addressToChecksummedAddress(asAddress(fhevm.chain.fhevm.contracts.protocolConfig.address));
 
   // Design note — reads are intentionally NOT pinned to a block number.
   // All protocol contracts (ACL, KMSVerifier, InputVerifier, ProtocolConfig, …)
@@ -63,18 +68,25 @@ export async function resolveFhevmClientFrozenContext(fhevm: FhevmBase<FhevmChai
   // `getVersion()` in one step, so this batch either all observes the pre-upgrade
   // versions or all observes the post-upgrade ones — never a mixed, half-applied
   // state. Capturing the whole basis in one call is what keeps it coherent.
-  const [aclVersion, inputVerifierVersion, kmsVerifierVersion] = (await executeWithBatching<unknown>(
-    [
-      () => getHostContractVersion(fhevm, { address: aclAddress }),
-      () => getHostContractVersion(fhevm, { address: inputVerifierAddress }),
-      () => getHostContractVersion(fhevm, { address: kmsVerifierAddress }),
-    ],
-    fhevm.options.batchRpcCalls,
-  )) as [HostContractVersion, HostContractVersion, HostContractVersion];
+  const [aclVersion, inputVerifierVersion, kmsVerifierVersion, protocolConfigVersion] =
+    (await executeWithBatching<unknown>(
+      [
+        () => getHostContractVersion(fhevm, { address: aclAddress }),
+        () => getHostContractVersion(fhevm, { address: inputVerifierAddress }),
+        () => getHostContractVersion(fhevm, { address: kmsVerifierAddress }),
+        ...(protocolConfigAddress === undefined
+          ? []
+          : [() => getHostContractVersion(fhevm, { address: protocolConfigAddress })]),
+      ],
+      fhevm.options.batchRpcCalls,
+    )) as [HostContractVersion, HostContractVersion, HostContractVersion, HostContractVersion | undefined];
 
   assertIsHostContractVersionOf(aclVersion, 'ACL');
   assertIsHostContractVersionOf(inputVerifierVersion, 'InputVerifier');
   assertIsHostContractVersionOf(kmsVerifierVersion, 'KMSVerifier');
+  if (protocolConfigVersion !== undefined) {
+    assertIsHostContractVersionOf(protocolConfigVersion, 'ProtocolConfig');
+  }
 
   const protocolContext = protocolContextFromAclVersion(fhevm.chain, aclVersion);
 
@@ -86,6 +98,7 @@ export async function resolveFhevmClientFrozenContext(fhevm: FhevmBase<FhevmChai
       ACL: aclVersion,
       InputVerifier: inputVerifierVersion,
       KMSVerifier: kmsVerifierVersion,
+      ...(protocolConfigVersion === undefined ? {} : { ProtocolConfig: protocolConfigVersion }),
     },
     protocolVersion: protocolContext.protocolVersion,
     pubKeyCrsVersion: protocolContext.pubKeyCrsVersion,

package/core/host-contracts/readKmsSignersContext-p.ts

@@ -15,7 +15,6 @@ import {
 } from '../kms/kmsExtraData-p.js';
 import { getKmsContextSignersAndThresholdFromExtraData } from './getKmsContextSignersAndThresholdFromExtraData-p.js';
 import { getKmsSignersAndThreshold } from './getKmsContextSignersAndThreshold-p.js';
-import { SDK_PROTOCOL_API_MAJOR_VERSION, SDK_PROTOCOL_API_MINOR_VERSION } from '../runtime/sdkProtocolApiVersion.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -42,15 +41,6 @@ type ReturnType = KmsSignersContext;
 //
 // Invariant — a KmsSignersContext carries the key it was indexed by.
 //
-// CRITICAL RULE — a v13-capped SDK must NEVER produce extraData v2.
-// The extraData version the SDK emits is gated by the RELAYER, not by the host
-// contracts: a v13 relayer rejects an unknown v2 `extraData` in its request
-// validation (HTTP 400 `validation_failed`), so the request never reaches the KMS.
-// This matters most during a v13 -> v14 rollout: the host contracts can already
-// support v2 while the relayer is still v13, so "the chain accepts v2" is NOT
-// sufficient — the SDK stays at v1 until the relayer is known to accept v2.
-// Hence the per-version cap enforced below.
-//
 ////////////////////////////////////////////////////////////////////////////////
 
 /**
@@ -58,25 +48,20 @@ type ReturnType = KmsSignersContext;
  * indexed on the **best `extraData` this SDK can produce** for that context.
  *
  * This is the read used when *creating* a permit: the returned context's `extraData`
- * is what the permit embeds and the user signs. So "best" is bounded by **two**
- * limits, not one:
- *   - the on-chain KMSVerifier version (which encodings the contract supports), and
- *   - this SDK's protocol-API cap ({@link SDK_PROTOCOL_API_MINOR_VERSION}) — the most
- *     recent `extraData` version the SDK knows how to build and sign.
+ * is what the permit embeds and the user signs. "Best" is bounded by the on-chain
+ * KMSVerifier version — which encodings the contract supports.
  *
- * The returned encoding is therefore `min(chain capability, SDK capability)`:
+ * The returned encoding:
  *   - v11 (KMSVerifier < 0.2.0)                         → v0 (no context concept)
- *   - >= 0.2.0 but a v13-capped SDK, or KMSVerifier < 0.4.0,
+ *   - >= 0.2.0 but KMSVerifier < 0.4.0,
  *     or no `protocolConfigAddress`                     → v1 (`contextId` only)
  *   - v14 chain (KMSVerifier >= 0.4.0, `protocolConfigAddress`
- *     set) **and** a v14-capable SDK                    → v2 (`contextId` + `epochId`)
+ *     set)                                              → v2 (`contextId` + `epochId`)
  *
- * NOTE — the meaning is subtly different from a plain "read the current context at
- * full chain precision": a v13-capped SDK deliberately returns a **v1** context on a
- * **v14** chain (dropping the epoch), because it must produce a v1 permit. It also
- * differs from {@link readKmsSignersContextFromPermitExtraData}, which resolves an
- * *already-chosen* permit `extraData` to the most precise context available — here we
- * instead choose the most precise encoding we are *allowed to produce*.
+ * NOTE — this differs from {@link readKmsSignersContextFromPermitExtraData}, which
+ * resolves an *already-chosen* permit `extraData` to the most precise context
+ * available — here we instead choose the most precise encoding we are *allowed to
+ * produce*.
  */
 export async function readCurrentKmsSignersContext(context: Context, parameters: Parameters): Promise<ReturnType> {
   // This version comes from the frozen context — a snapshot, NOT necessarily the
@@ -93,16 +78,6 @@ export async function readCurrentKmsSignersContext(context: Context, parameters:
     return _readCurrentKmsSignersContext_ProtocolApi_11(context, parameters);
   }
 
-  // If SDK is restricted to protocol API v13 then the best extraData
-  // we can get it must be v1
-  // KMSVerifier.version >= 0.2.0, it supports at least API Protocol 13
-  if (SDK_PROTOCOL_API_MAJOR_VERSION === 0 && SDK_PROTOCOL_API_MINOR_VERSION <= 13) {
-    // -> KmsSignersContext.extraData.version == 1
-    return _readCurrentKmsSignersContext_ProtocolApi_12_13(context, parameters);
-  }
-
-  // API Protocol 14+
-
   // KMSVerifier.version < 0.4.0, use only Protocol API v13
   if (
     isVersionStrictlyBefore(kmsVerifierVersion, { major: 0, minor: 4 }) ||
@@ -203,17 +178,6 @@ async function _readCurrentKmsSignersContext_ProtocolApi_14_or_higher(
   context: Context,
   parameters: Parameters,
 ): Promise<ReturnType> {
-  // Defense-in-depth for the CRITICAL RULE above: this is the only function that
-  // MINTS an extraData v2. It must never run under a v13-capped SDK. The caller
-  // (readCurrentKmsSignersContext) already gates on SDK_PROTOCOL_API_MINOR_VERSION,
-  // so reaching here with a capped SDK means that gate was bypassed/refactored away
-  // — fail loudly rather than silently emit a v2 the relayer would reject.
-  if (SDK_PROTOCOL_API_MAJOR_VERSION === 0 && SDK_PROTOCOL_API_MINOR_VERSION <= 13) {
-    throw new Error(
-      `Refusing to produce extraData v2: this SDK is capped at protocol API v0.${SDK_PROTOCOL_API_MINOR_VERSION} and must only emit extraData v1 (a v13 relayer rejects v2).`,
-    );
-  }
-
   if (parameters.protocolConfigAddress === undefined) {
     throw new Error('protocolConfigAddress is required on protocol v0.14.0+');
   }

package/core/key/FheEncryptionKeyCache-p.ts

@@ -314,6 +314,12 @@ export class FheEncryptionKeyCache {
         if (this.#cache.get(relayerUrl) === entry) {
           this.#cache.delete(relayerUrl);
         }
+        entry.owner
+          .deref()
+          ?.config.logger?.error?.(
+            `FheEncryptionKeyCache: ${resolvedKind === 'bytes' ? 'fetch' : 'conversion to wasm'} failed for relayerUrl="${relayerUrl}". Evicting cache entry; the next call will re-fetch.`,
+            err,
+          );
         throw err;
       },
     );

package/core/key/fetchFheEncryptionKey.ts

@@ -19,12 +19,28 @@ export async function fetchFheEncryptionKeyWasm(
 ): Promise<FheEncryptionKeyWasm> {
   const relayerUrl = context.chain.fhevm.relayerUrl;
   const runtime = context.runtime;
+  const logger = runtime.config.logger;
 
   // Ensure a bytes fetch is in-flight
   globalFheEncryptionKeyCache.ensureBytes({
     owner: runtime,
     relayerUrl,
-    fetcher: () => runtime.relayer.fetchFheEncryptionKeyBytes({ relayerUrl, chainId: context.chain.id }, parameters),
+    fetcher: async () => {
+      logger?.debug?.(
+        `Fetching FHE encryption key/CRS bytes from relayer "${relayerUrl}" (chainId=${context.chain.id}).`,
+      );
+      try {
+        const bytes = await runtime.relayer.fetchFheEncryptionKeyBytes(
+          { relayerUrl, chainId: context.chain.id },
+          parameters,
+        );
+        logger?.debug?.(`Fetched FHE encryption key/CRS bytes from relayer "${relayerUrl}".`);
+        return bytes;
+      } catch (e) {
+        logger?.error?.(`Failed to fetch FHE encryption key/CRS bytes from relayer "${relayerUrl}".`, e);
+        throw e;
+      }
+    },
     metadata: { chainId: context.chain.id, relayerUrl },
   });
 

package/core/kms/SignedDecryptionPermit-p.ts

@@ -6,21 +6,14 @@ import type { ErrorMetadataParams } from '../base/errors/ErrorBase.js';
 import type { NativeSigner } from '../modules/ethereum/types.js';
 import type { TransportKeyPair } from './TransportKeyPair-p.js';
 import type { FhevmClientFrozenContext } from '../types/fhevmClientFrozenContext-p.js';
-import type { BytesHex } from '../types/primitives.js';
 import { InvalidTypeError } from '../base/errors/InvalidTypeError.js';
 import {
   isSignedDecryptionPermitV1,
   parseSignedDecryptionPermitV1,
   signDecryptionPermitV1,
 } from './SignedDecryptionPermitV1-p.js';
-import {
-  isSignedDecryptionPermitV2,
-  parseSignedDecryptionPermitV2,
-  signDecryptionPermitV2,
-} from './SignedDecryptionPermitV2-p.js';
+import { isSignedDecryptionPermitV2, parseSignedDecryptionPermitV2 } from './SignedDecryptionPermitV2-p.js';
 import { isRecordUintNumberProperty, isUintNumber } from '../base/uint.js';
-import { SDK_PROTOCOL_API_MAJOR_VERSION, SDK_PROTOCOL_API_MINOR_VERSION } from '../runtime/sdkProtocolApiVersion.js';
-import { createKmsExtraDataFromBytesHex, EXTRA_DATA_V2 } from './kmsExtraData-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -159,15 +152,11 @@ export async function signDecryptionPermit(
   context: KmsSignDecryptionPermitContext,
   parameters: KmsSignDecryptionPermitParameters,
 ): Promise<SignedDecryptionPermit> {
-  // V1 permits are always created here: the current protocol API version this
-  // SDK is using is 0.13.0, so the SDK does not know the 0.14.0 API (which is
-  // what introduces V2 permits). Once the SDK adopts API 0.14.0, this branch
-  // falls through to signDecryptionPermitV2 below.
-  if (SDK_PROTOCOL_API_MAJOR_VERSION === 0 && SDK_PROTOCOL_API_MINOR_VERSION <= 13) {
-    return await signDecryptionPermitV1(context, parameters);
-  }
-
-  return await signDecryptionPermitV2(context, parameters);
+  // `signDecryptionPermit` (the public action wrapping this) is deprecated in
+  // favor of `signLegacyDecryptionPermit`/`signUnifiedDecryptionPermit`, but we
+  // deliberately keep it pinned to V1 here for good compatibility with callers
+  // that haven't migrated yet.
+  return await signDecryptionPermitV1(context, parameters);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -223,29 +212,6 @@ function _normalizeSerializedPermitDomainChainId(permit: unknown): unknown {
   };
 }
 
-/**
- * Reads the `extraData` version carried by a serialized permit, or `undefined` when
- * the permit exposes no decodable `extraData` (missing, wrong type, or malformed —
- * left to the downstream permit validation to report with proper context).
- *
- * Navigates `permit.eip712.message.extraData` defensively (the permit is untrusted
- * input). Used to enforce the SDK protocol-API cap at parse time — see the CRITICAL
- * RULE in `readKmsSignersContext-p.ts`.
- */
-function _parsePermitExtraDataVersion(permit: unknown): number | undefined {
-  const extraData = (
-    permit as { readonly eip712?: { readonly message?: { readonly extraData?: unknown } } } | null | undefined
-  )?.eip712?.message?.extraData;
-  if (typeof extraData !== 'string') {
-    return undefined;
-  }
-  try {
-    return createKmsExtraDataFromBytesHex(extraData as BytesHex).version;
-  } catch {
-    return undefined;
-  }
-}
-
 export async function parseSignedDecryptionPermit(
   context: KmsSignDecryptionPermitContext,
   parameters: {
@@ -271,26 +237,6 @@ export async function parseSignedDecryptionPermit(
   // version is 1 or 2
   const version: 1 | 2 = sanitizedVersion as 1 | 2;
 
-  // Enforce the SDK protocol-API cap (see the CRITICAL RULE in readKmsSignersContext-p.ts):
-  // a v13-capped SDK must never accept a v2 permit, because a v13 relayer rejects it.
-  // A v2 can arrive two independent ways; each is rejected here with its own message,
-  // up front, instead of an opaque relayer 400 later (mirrors decryptValuesFromPairs).
-  if (SDK_PROTOCOL_API_MAJOR_VERSION === 0 && SDK_PROTOCOL_API_MINOR_VERSION <= 13) {
-    // (a) A V2-format permit.
-    if (version > 1) {
-      throw new Error(
-        `Refusing to parse a V2-format decryption permit (version ${version}): this SDK is capped at protocol API v0.${SDK_PROTOCOL_API_MINOR_VERSION} and only supports V1 permits. V2 permits require an SDK on protocol API v0.14.0 or later.`,
-      );
-    }
-    const extraDataVersion = _parsePermitExtraDataVersion(sanitizedPermit);
-    // (b) A v2 extraData — including one carried inside a V1-format permit.
-    if (extraDataVersion !== undefined && extraDataVersion >= EXTRA_DATA_V2) {
-      throw new Error(
-        `Refusing to parse a permit carrying extraData v2: this SDK is capped at protocol API v0.${SDK_PROTOCOL_API_MINOR_VERSION} and only accepts extraData v0/v1 (a v13 relayer rejects extraData v2). Use an SDK on protocol API v0.14.0 or later.`,
-      );
-    }
-  }
-
   if (version === 1) {
     return await parseSignedDecryptionPermitV1(context, { transportKeyPair, permit: sanitizedPermit, fhevmContext });
   }