@fhevm/sdk 1.1.0-alpha.6 → 1.1.0-alpha.7

package/core/clients/decorators/base.ts

@@ -1,19 +1,12 @@
 import type { Fhevm, FhevmBase, FhevmExtension } from '../../types/coreFhevmClient.js';
 import type { FhevmChain } from '../../types/fhevmChain.js';
-import type {
-  SignedSelfDecryptionPermit,
-  SignedDelegatedDecryptionPermit,
-} from '../../types/signedDecryptionPermit.js';
+import type { SignedDecryptionPermit } from '../../types/signedDecryptionPermit.js';
 import type {
   SerializeTransportKeyPairParameters,
   SerializeTransportKeyPairReturnType,
 } from '../../actions/chain/serializeTransportKeyPair.js';
 import { assertIsFhevmBaseClient } from '../../runtime/CoreFhevm-p.js';
-import {
-  signDecryptionPermit,
-  type SignSelfDecryptionPermitParameters,
-  type SignDelegatedDecryptionPermitParameters,
-} from '../../actions/base/signDecryptionPermit.js';
+import { signDecryptionPermit, type SignDecryptionPermitParameters } from '../../actions/base/signDecryptionPermit.js';
 import {
   parseTransportKeyPair,
   type ParseTransportKeyPairParameters,
@@ -127,27 +120,16 @@ export type BaseActions = {
   readonly decryptPublicValuesWithSignatures: (
     parameters: DecryptPublicValuesWithSignaturesParameters,
   ) => Promise<DecryptPublicValuesWithSignaturesReturnType>;
-  readonly signDecryptionPermit: {
-    /**
-     * Signs a self decryption permit — Alice decrypts her own encrypted values.
-     *
-     * 1. Alice signs a permit saying "I, Alice, want to decrypt my own handles."
-     * 2. Alice calls `decrypt` with this permit.
-     * 3. The KMS verifies Alice's signature and releases decrypted shares to her.
-     *
-     * No `delegatorAddress` needed — the signer is the owner.
-     */
-    (parameters: SignSelfDecryptionPermitParameters): Promise<SignedSelfDecryptionPermit>;
-    /**
-     * Signs a delegated decryption permit — Bob decrypts Alice's (`delegatorAddress`) encrypted values.
-     *
-     * 1. Alice calls `FHE.delegateUserDecryption()` on-chain, giving Bob permission to decrypt her handles.
-     * 2. Bob signs a permit with `delegatorAddress: Alice`, saying "I, Bob, want to decrypt Alice's handles."
-     * 3. Bob calls `decrypt` with this permit.
-     * 4. The KMS authenticates Bob via his signature, then checks the on-chain ACL to verify Alice delegated to Bob.
-     */
-    (parameters: SignDelegatedDecryptionPermitParameters): Promise<SignedDelegatedDecryptionPermit>;
-  };
+  /**
+   * Signs a decryption permit.
+   *
+   * - Without `delegatorAddress`: Alice signs to decrypt her own encrypted values.
+   * - With `delegatorAddress`: Bob signs to decrypt values belonging to `delegatorAddress` (Alice),
+   *   after Alice has granted permission via `FHE.delegateUserDecryption()` on-chain.
+   *
+   * Inspect `isDelegated` on the returned permit to distinguish the two cases.
+   */
+  readonly signDecryptionPermit: (parameters: SignDecryptionPermitParameters) => Promise<SignedDecryptionPermit>;
   /** Deserializes a previously serialized e2e transport key pair back into a usable key pair. */
   readonly parseTransportKeyPair: (
     parameters: ParseTransportKeyPairParameters,
@@ -177,13 +159,7 @@ function _baseActions(fhevm: Fhevm<FhevmChain>): BaseActions {
     decryptPublicValue: (parameters) => decryptPublicValue(fhevm, parameters),
     decryptPublicValues: (parameters) => decryptPublicValues(fhevm, parameters),
     decryptPublicValuesWithSignatures: (parameters) => decryptPublicValuesWithSignatures(fhevm, parameters),
-    // Preserve the original action overloads on the decorated client API.
-    // Runtime behavior is unchanged: this is a direct pass-through wrapper.
-    signDecryptionPermit: ((parameters: SignSelfDecryptionPermitParameters | SignDelegatedDecryptionPermitParameters) =>
-      signDecryptionPermit(
-        fhevm,
-        parameters as SignSelfDecryptionPermitParameters,
-      )) as BaseActions['signDecryptionPermit'],
+    signDecryptionPermit: (parameters) => signDecryptionPermit(fhevm, parameters),
     parseTransportKeyPair: (parameters) => parseTransportKeyPair(fhevm, parameters),
     serializeTransportKeyPair: (parameters) => serializeTransportKeyPair(fhevm, parameters),
     serializeSignedDecryptionPermit: (parameters) => serializeSignedDecryptionPermit(fhevm, parameters),

package/core/coprocessor/coprocessorEip712Types.ts

@@ -5,7 +5,7 @@ import type { CoprocessorEip712Types } from '../types/coprocessor.js';
 ////////////////////////////////////////////////////////////////////////////////
 
 /*
-    const EIP712DomainType = [
+    const Eip712DomainType = [
       { name: 'name', type: 'string' },
       { name: 'version', type: 'string' },
       { name: 'chainId', type: 'uint256' },
@@ -16,7 +16,7 @@ import type { CoprocessorEip712Types } from '../types/coprocessor.js';
 export const coprocessorEip712PrimaryType = 'CiphertextVerification' satisfies keyof CoprocessorEip712Types;
 
 export const coprocessorEip712Types: CoprocessorEip712Types = {
-  // EIP712Domain: [
+  // Eip712Domain: [
   //   { name: 'name', type: 'string' },
   //   { name: 'version', type: 'string' },
   //   { name: 'chainId', type: 'uint256' },

package/core/host-contracts/canDecryptValuesFromPairs.ts

@@ -1,15 +1,13 @@
 import type { FhevmChain } from '../types/fhevmChain.js';
-import type { SignedDelegatedDecryptionPermit, SignedSelfDecryptionPermit } from '../types/signedDecryptionPermit.js';
+import type { SignedDecryptionPermit } from '../types/signedDecryptionPermit.js';
 import type { TransportKeyPair } from '../kms/TransportKeyPair-p.js';
 import type { ChecksummedAddress, Uint64BigInt } from '../types/primitives.js';
 import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
 import type { Handle } from '../types/encryptedTypes-p.js';
 import { addressToChecksummedAddress, assertIsAddress } from '../base/address.js';
 import { assertHandlesBelongToSameChainId } from '../handle/FhevmHandle.js';
-import {
-  assertIsSignedDecryptionPermit,
-  assertPermitIncludesContractAddresses,
-} from '../kms/SignedDecryptionPermit-p.js';
+import { assertIsSignedDecryptionPermit } from '../kms/SignedDecryptionPermit-p.js';
+import { assertPermitV1IncludesContractAddresses } from '../kms/fetchKmsSigncryptedSharesV1-p.js';
 import { assertPermitMatchesKeyPair } from '../utils-p/decrypt/assertPermitMatchesKeyPair.js';
 import { isUserDecryptable } from '../host-contracts/isUserDecryptable.js';
 
@@ -29,7 +27,7 @@ type Parameters =
     }
   | {
       readonly pairs: ReadonlyArray<{ readonly handle: Handle; readonly contractAddress: ChecksummedAddress }>;
-      readonly signedPermit: SignedSelfDecryptionPermit | SignedDelegatedDecryptionPermit;
+      readonly signedPermit: SignedDecryptionPermit;
       readonly transportKeyPair?: TransportKeyPair | undefined;
     };
 
@@ -64,7 +62,9 @@ export async function canDecryptValuesFromPairs(context: Context, parameters: Pa
 
     assertIsSignedDecryptionPermit(signedPermit, { subject: 'signedPermit' });
     signedPermit.assertNotExpired();
-    assertPermitIncludesContractAddresses(signedPermit, contractAddresses);
+    if (signedPermit.version === 1) {
+      assertPermitV1IncludesContractAddresses(signedPermit, contractAddresses);
+    }
 
     if (parameters.transportKeyPair !== undefined) {
       assertPermitMatchesKeyPair(signedPermit, parameters.transportKeyPair);

package/core/host-contracts/getCoprocessorContextSignersAndThreshold-p.ts

@@ -5,7 +5,7 @@ import { asUint8Number, isUint8 } from '../base/uint.js';
 import { executeWithBatching } from '../base/promise.js';
 import { getTrustedClient } from '../runtime/CoreFhevm-p.js';
 import { getCoprocessorSignersAbi, getThresholdAbi } from './abi-fragments/fragments.js';
-import { CACHE_TTL_24H, createCachedFetch } from '../base/cachedFetch.js';
+import { CACHE_TTL_15MIN, createCachedFetch } from '../base/cachedFetch.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -30,7 +30,7 @@ const cachedGetCoprocessorContextSignersAndThreshold = createCachedFetch<Context
   executeFn: _getCoprocessorContextSignersAndThreshold,
   cacheKeyFn: (context, params) => `${context.runtime.uid.toLowerCase()}:${params.address.toLowerCase()}`,
   // Signers are not Use long TTL
-  ttlMs: CACHE_TTL_24H,
+  ttlMs: CACHE_TTL_15MIN,
 });
 
 ////////////////////////////////////////////////////////////////////////////////

package/core/host-contracts/getCurrentKmsContextAndEpoch-p.ts

@@ -4,7 +4,7 @@ import { getCurrentKmsContextAndEpochAbi } from './abi-fragments/fragments.js';
 import { getTrustedClient } from '../runtime/CoreFhevm-p.js';
 import { getHostContractVersion, isVersionStrictlyBefore } from './HostContractVersion-p.js';
 import { assertIsUint256 } from '../base/uint.js';
-import { CACHE_TTL_24H, createCachedFetch } from '../base/cachedFetch.js';
+import { CACHE_TTL_15MIN, createCachedFetch } from '../base/cachedFetch.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -25,7 +25,7 @@ const cachedGetCurrentKmsContextAndEpoch = createCachedFetch<Context, Parameters
   executeFn: _getCurrentKmsContextAndEpoch,
   cacheKeyFn: (context, params) => `${context.runtime.uid.toLowerCase()}:${params.protocolConfigAddress.toLowerCase()}`,
   // Host contract values are immutable per deployment, so a long TTL is safe.
-  ttlMs: CACHE_TTL_24H,
+  ttlMs: CACHE_TTL_15MIN,
 });
 
 /**

package/core/host-contracts/getCurrentKmsContextId-p.ts

@@ -4,7 +4,7 @@ import { getCurrentKmsContextIdAbi } from './abi-fragments/fragments.js';
 import { getTrustedClient } from '../runtime/CoreFhevm-p.js';
 import { getHostContractVersion, isVersionStrictlyBefore } from './HostContractVersion-p.js';
 import { assertIsUint256 } from '../base/uint.js';
-import { CACHE_TTL_24H, createCachedFetch } from '../base/cachedFetch.js';
+import { CACHE_TTL_15MIN, createCachedFetch } from '../base/cachedFetch.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -25,7 +25,7 @@ const cachedGetCurrentKmsContextId = createCachedFetch<Context, Parameters, Retu
   executeFn: _getCurrentKmsContextId,
   cacheKeyFn: (context, params) => `${context.runtime.uid.toLowerCase()}:${params.kmsVerifierAddress.toLowerCase()}`,
   // Host contract versions are immutable per deployment, so a long TTL is safe.
-  ttlMs: CACHE_TTL_24H,
+  ttlMs: CACHE_TTL_15MIN,
 });
 
 /**

package/core/host-contracts/getKmsContextSignersAndThreshold-p.ts

@@ -7,7 +7,7 @@ import { isVersionStrictlyBefore } from '../host-contracts/HostContractVersion-p
 import { executeWithBatching } from '../base/promise.js';
 import { getTrustedClient } from '../runtime/CoreFhevm-p.js';
 import { getKmsSignersAbi, getThresholdAbi } from './abi-fragments/fragments.js';
-import { CACHE_TTL_24H, createCachedFetch } from '../base/cachedFetch.js';
+import { CACHE_TTL_15MIN, createCachedFetch } from '../base/cachedFetch.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -32,7 +32,7 @@ const cachedGetKmsContextSignersAndThreshold = createCachedFetch<Context, Parame
   executeFn: _getKmsContextSignersAndThreshold,
   cacheKeyFn: (context, params) => `${context.runtime.uid.toLowerCase()}:${params.kmsVerifierAddress.toLowerCase()}`,
   // Host contract versions are immutable per deployment, so a long TTL is safe.
-  ttlMs: CACHE_TTL_24H,
+  ttlMs: CACHE_TTL_15MIN,
 });
 
 ////////////////////////////////////////////////////////////////////////////////

package/core/kms/PublicDecryptionProof-p.ts

@@ -89,7 +89,7 @@ type Parameters = {
   readonly originToken: symbol;
   readonly orderedHandles: readonly Handle[];
   readonly orderedAbiEncodedClearValues: BytesHex;
-  readonly kmsPublicDecryptEIP712Signatures: readonly Bytes65Hex[];
+  readonly kmsPublicDecryptEip712Signatures: readonly Bytes65Hex[];
   readonly kmsSignersContext: KmsSignersContext;
 };
 
@@ -108,7 +108,7 @@ export async function createPublicDecryptionProof(
   const {
     orderedHandles: orderedEncryptedValues,
     orderedAbiEncodedClearValues,
-    kmsPublicDecryptEIP712Signatures,
+    kmsPublicDecryptEip712Signatures,
     kmsSignersContext,
     originToken,
   } = parameters;
@@ -133,12 +133,12 @@ export async function createPublicDecryptionProof(
 
   const packedNumSigners: BytesHex = context.runtime.ethereum.encodePacked({
     types: ['uint8'],
-    values: [kmsPublicDecryptEIP712Signatures.length],
+    values: [kmsPublicDecryptEip712Signatures.length],
   });
 
   const packedSignatures = context.runtime.ethereum.encodePacked({
-    types: Array(kmsPublicDecryptEIP712Signatures.length).fill('bytes') as string[],
-    values: kmsPublicDecryptEIP712Signatures,
+    types: Array(kmsPublicDecryptEip712Signatures.length).fill('bytes') as string[],
+    values: kmsPublicDecryptEip712Signatures,
   });
 
   const decryptionProof: BytesHex = concatBytesHex([packedNumSigners, packedSignatures, signedExtraData]);