@fhevm/sdk 1.1.0-alpha.6 → 1.1.0-alpha.7

package/_esm/core/kms/SignedDecryptionPermit-p.js

@@ -1,108 +1,9 @@
-var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
-    if (kind === "m") throw new TypeError("Private method is not writable");
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
-    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
-};
-var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
-    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
-    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
-    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
-};
-var _SignedDecryptionPermitBaseImpl_eip712, _SignedDecryptionPermitBaseImpl_signature, _SignedDecryptionPermitBaseImpl_signerAddress;
-import { verifyKmsUserDecryptEip712 } from '../utils-p/decrypt/verifyKmsUserDecryptEip712.js';
-import { verifyKmsDelegatedUserDecryptEip712 } from '../utils-p/decrypt/verifyKmsDelegatedUserDecryptEip712.js';
-import { assertRecordNonNullableProperty } from '../base/record.js';
-import { assertRecordBytes65HexProperty } from '../base/bytes.js';
 import { InvalidTypeError } from '../base/errors/InvalidTypeError.js';
-import { addressToChecksummedAddress, assertIsAddress, assertRecordAddressProperty } from '../base/address.js';
-import { assertIsKmsUserDecryptEip712, createKmsUserDecryptEip712 } from './createKmsUserDecryptEip712.js';
-import { assertIsKmsDelegatedUserDecryptEip712, createKmsDelegatedUserDecryptEip712, } from './createKmsDelegatedUserDecryptEip712.js';
-import { assertRecordStringProperty } from '../base/string.js';
-import { assertIsTransportKeyPair } from './TransportKeyPair-p.js';
-import { assertKmsEIP712DeadlineValidity } from './utils.js';
-import { readKmsSignersContext } from '../host-contracts/readKmsSignersContext-p.js';
-import { kmsSignersContextToExtraData } from '../host-contracts/KmsSignersContext-p.js';
-import { fromKmsExtraData } from './kmsExtraData.js';
-////////////////////////////////////////////////////////////////////////////////
-const PRIVATE_TOKEN = Symbol('SignedDecryptionPermit.token');
-const MAX_USER_DECRYPT_DURATION_DAYS = 365;
-const MAX_USER_DECRYPT_CONTRACT_ADDRESSES = 10;
-////////////////////////////////////////////////////////////////////////////////
-/**
- * Private implementation of {@link SignedDecryptionPermit}.
- * Immutable by design — all fields are stored as private properties
- * and exposed via readonly getters. Instances are only created through
- * SDK-internal factory functions that guarantee the signature has been verified.
- *
- * **Invariant:** Every instance of this class has a verified signature.
- * Construction is only possible through factory functions that validate the
- * signature against the on-chain verifier before returning. If the EIP-712
- * format has changed (e.g. loading a permit serialized by an older SDK version),
- * verification will fail and construction will throw.
- *
- * As a consequence, any code within the SDK that receives a
- * `SignedDecryptionPermit` (verified via `instanceof`) can safely trust
- * its contents without re-verification.
- */
-class SignedDecryptionPermitBaseImpl {
-    constructor(privateToken, parameters) {
-        _SignedDecryptionPermitBaseImpl_eip712.set(this, void 0);
-        _SignedDecryptionPermitBaseImpl_signature.set(this, void 0);
-        _SignedDecryptionPermitBaseImpl_signerAddress.set(this, void 0);
-        if (privateToken !== PRIVATE_TOKEN) {
-            throw new Error('Unauthorized');
-        }
-        __classPrivateFieldSet(this, _SignedDecryptionPermitBaseImpl_eip712, parameters.eip712, "f");
-        __classPrivateFieldSet(this, _SignedDecryptionPermitBaseImpl_signature, parameters.signature, "f");
-        __classPrivateFieldSet(this, _SignedDecryptionPermitBaseImpl_signerAddress, parameters.signerAddress, "f");
-    }
-    get eip712() {
-        return __classPrivateFieldGet(this, _SignedDecryptionPermitBaseImpl_eip712, "f");
-    }
-    get signature() {
-        return __classPrivateFieldGet(this, _SignedDecryptionPermitBaseImpl_signature, "f");
-    }
-    get signerAddress() {
-        return __classPrivateFieldGet(this, _SignedDecryptionPermitBaseImpl_signerAddress, "f");
-    }
-    assertNotExpired() {
-        assertKmsEIP712DeadlineValidity(__classPrivateFieldGet(this, _SignedDecryptionPermitBaseImpl_eip712, "f").message, MAX_USER_DECRYPT_DURATION_DAYS);
-    }
-    /**
-     * Asserts that this permit was signed against the given {@link KmsSignersContext}.
-     *
-     * Compares the `extraData` embedded in the permit's EIP-712 message with the
-     * `extraData` derived from the provided context. A mismatch indicates the permit
-     * was created for a different KMS context (e.g. different context ID or version)
-     * and must not be used for decryption.
-     *
-     * @todo The current check is a strict byte-level comparison. A permit signed
-     *   with the correct `kmsContextId` but a different `extraData` encoding format
-     *   (e.g. a version change in the serialization scheme) will be rejected even
-     *   though the context ID matches. Consider comparing the decoded `kmsContextId`
-     *   instead of the raw `extraData` bytes.
-     *
-     * @param kmsSignersContext - The current KMS signers context to validate against.
-     * @throws If the permit's `extraData` does not match the context's `extraData`.
-     */
-    assertMatchesKmsContext(kmsSignersContext) {
-        const expectedExtraData = kmsSignersContextToExtraData(kmsSignersContext);
-        if (expectedExtraData !== __classPrivateFieldGet(this, _SignedDecryptionPermitBaseImpl_eip712, "f").message.extraData) {
-            throw new Error(`Invalid permit: extraData "${__classPrivateFieldGet(this, _SignedDecryptionPermitBaseImpl_eip712, "f").message.extraData}" does not match expected "${expectedExtraData}" from KmsSignersContext.`);
-        }
-    }
-    get transportPublicKey() {
-        return __classPrivateFieldGet(this, _SignedDecryptionPermitBaseImpl_eip712, "f").message.publicKey;
-    }
-    get kmsContextId() {
-        return fromKmsExtraData(__classPrivateFieldGet(this, _SignedDecryptionPermitBaseImpl_eip712, "f").message.extraData).kmsContextId;
-    }
-    get kmsEpochId() {
-        return fromKmsExtraData(__classPrivateFieldGet(this, _SignedDecryptionPermitBaseImpl_eip712, "f").message.extraData).kmsEpochId;
-    }
-}
-_SignedDecryptionPermitBaseImpl_eip712 = new WeakMap(), _SignedDecryptionPermitBaseImpl_signature = new WeakMap(), _SignedDecryptionPermitBaseImpl_signerAddress = new WeakMap();
+import { getResolvedProtocolVersion } from '../runtime/CoreFhevm-p.js';
+import { isSemverStrictlyBefore } from '../base/semver.js';
+import { isSignedDecryptionPermitV1, parseSignedDecryptionPermitV1, signDecryptionPermitV1, } from './SignedDecryptionPermitV1-p.js';
+import { isSignedDecryptionPermitV2, parseSignedDecryptionPermitV2, signDecryptionPermitV2, } from './SignedDecryptionPermitV2-p.js';
+import { isRecordUintNumberProperty } from '../base/uint.js';
 ////////////////////////////////////////////////////////////////////////////////
 /**
  * Serializes a signed decryption permit to a plain object suitable for
@@ -113,52 +14,32 @@ _SignedDecryptionPermitBaseImpl_eip712 = new WeakMap(), _SignedDecryptionPermitB
  */
 export function serializeSignedDecryptionPermitToJSON(permit) {
     assertIsSignedDecryptionPermit(permit, {});
+    // Defensive check
+    const version = permit.version;
+    if (version !== 1 && version !== 2) {
+        throw new Error(`Unsupported permit version: ${version}. Supported versions are 1 and 2.`);
+    }
+    // This if branch is needed for tsc
+    if (permit.version === 1) {
+        return {
+            version: 1,
+            eip712: permit.eip712,
+            signature: permit.signature,
+            signerAddress: permit.signerAddress,
+        };
+    }
     return {
+        version: 2,
         eip712: permit.eip712,
         signature: permit.signature,
         signerAddress: permit.signerAddress,
     };
 }
 ////////////////////////////////////////////////////////////////////////////////
-// SignedUserDecryptionPermitImpl
-////////////////////////////////////////////////////////////////////////////////
-class SignedSelfDecryptionPermitImpl extends SignedDecryptionPermitBaseImpl {
-    get eip712() {
-        return super.eip712;
-    }
-    get encryptedDataOwnerAddress() {
-        return this.signerAddress;
-    }
-    get isDelegated() {
-        return false;
-    }
-}
-////////////////////////////////////////////////////////////////////////////////
-// SignedDelegatedDecryptionPermitImpl
-////////////////////////////////////////////////////////////////////////////////
-class SignedDelegatedDecryptionPermitImpl extends SignedDecryptionPermitBaseImpl {
-    get eip712() {
-        return super.eip712;
-    }
-    get encryptedDataOwnerAddress() {
-        return this.eip712.message.delegatorAddress;
-    }
-    get isDelegated() {
-        return true;
-    }
-}
-////////////////////////////////////////////////////////////////////////////////
-Object.freeze(SignedDecryptionPermitBaseImpl);
-Object.freeze(SignedDecryptionPermitBaseImpl.prototype);
-Object.freeze(SignedSelfDecryptionPermitImpl);
-Object.freeze(SignedSelfDecryptionPermitImpl.prototype);
-Object.freeze(SignedDelegatedDecryptionPermitImpl);
-Object.freeze(SignedDelegatedDecryptionPermitImpl.prototype);
-////////////////////////////////////////////////////////////////////////////////
 // isSignedDecryptionPermit
 ////////////////////////////////////////////////////////////////////////////////
 export function isSignedDecryptionPermit(value) {
-    return value instanceof SignedDecryptionPermitBaseImpl;
+    return isSignedDecryptionPermitV1(value) || isSignedDecryptionPermitV2(value);
 }
 /** Throws {@link InvalidTypeError} if value is not a valid {@link SignedDecryptionPermit}. */
 export function assertIsSignedDecryptionPermit(value, options) {
@@ -171,120 +52,42 @@ export function assertIsSignedDecryptionPermit(value, options) {
     }
 }
 /**
- * Asserts that every address in {@link contractAddresses} is listed in the
- * permit's `contractAddresses` (case-insensitive comparison).
+ * Creates a signed decryption permit by constructing the EIP-712 typed data
+ * and signing it with the provided signer.
+ *
+ * If `delegatorAddress` is provided, creates a delegated permit that allows the signer
+ * to decrypt encrypted values belonging to the `delegatorAddress` account.
+ * Otherwise, creates a standard permit where the signer decrypts their own values.
+ *
+ * The EIP-712 message includes the key pair's public key, allowing the gateway
+ * to encrypt the decrypted result for this specific key pair.
+ *
+ * @throws If the signer, address, or key pair is invalid.
+ * @throws If the signature verification fails.
  */
-export function assertPermitIncludesContractAddresses(permit, contractAddresses) {
-    const permitAddresses = permit.eip712.message.contractAddresses;
-    for (const address of contractAddresses) {
-        if (!permitAddresses.some((a) => a.toLowerCase() === address.toLowerCase())) {
-            throw Error(`contract address ${address} is not listed in the permit's contractAddresses`);
-        }
-    }
-}
-////////////////////////////////////////////////////////////////////////////////
-// createSignedDecryptionPermit
-////////////////////////////////////////////////////////////////////////////////
-async function _createSignedDecryptionPermit(context, parameters) {
-    const { signerAddress, eip712, signature } = parameters;
-    if (eip712.message.contractAddresses.length === 0) {
-        throw Error('contractAddresses is empty');
-    }
-    if (eip712.message.contractAddresses.length > MAX_USER_DECRYPT_CONTRACT_ADDRESSES) {
-        throw Error(`contractAddresses max length of ${MAX_USER_DECRYPT_CONTRACT_ADDRESSES} exceeded`);
-    }
-    if (Number(eip712.message.durationDays) > MAX_USER_DECRYPT_DURATION_DAYS) {
-        throw Error(`durationDays is above max duration of ${MAX_USER_DECRYPT_DURATION_DAYS}`);
-    }
-    if (eip712.primaryType === 'UserDecryptRequestVerification') {
-        await verifyKmsUserDecryptEip712(context, {
-            signer: signerAddress,
-            message: eip712.message,
-            signature,
-        });
-        return new SignedSelfDecryptionPermitImpl(PRIVATE_TOKEN, parameters);
-    }
-    else {
-        await verifyKmsDelegatedUserDecryptEip712(context, {
-            signer: signerAddress,
-            message: eip712.message,
-            signature,
-        });
-        return new SignedDelegatedDecryptionPermitImpl(PRIVATE_TOKEN, parameters);
-    }
-}
 export async function signDecryptionPermit(context, parameters) {
-    const kmsSignersContext = await readKmsSignersContext(context, {
-        kmsVerifierAddress: context.chain.fhevm.contracts.kmsVerifier.address,
-        protocolConfigAddress: context.chain.fhevm.contracts.protocolConfig?.address,
-    });
-    const extraData = kmsSignersContextToExtraData(kmsSignersContext);
-    const { contractAddresses, startTimestamp, durationDays, signerAddress: signerAddressArg, transportKeyPair: transportKeyPair, signer, delegatorAddress, } = parameters;
-    assertIsTransportKeyPair(transportKeyPair, {});
-    assertIsAddress(signerAddressArg, {});
-    if (delegatorAddress !== undefined) {
-        assertIsAddress(delegatorAddress, {});
-        if (signerAddressArg.toLowerCase() === delegatorAddress.toLowerCase()) {
-            throw new Error('signerAddress and delegatorAddress must be different. ' +
-                'Use a non-delegated permit to decrypt your own values.');
-        }
+    const protocolVersion = getResolvedProtocolVersion(context);
+    if (protocolVersion === undefined) {
+        throw new Error('Unable to resolve protocol version from context, ensure proper initialization of the FhevmRuntime and FhevmChain.');
     }
-    const signerAddress = addressToChecksummedAddress(signerAddressArg);
-    const commonMessage = {
-        verifyingContractAddressDecryption: context.chain.fhevm.gateway.contracts.decryption.address,
-        chainId: context.chain.id,
-        contractAddresses,
-        durationDays,
-        startTimestamp,
-        extraData,
-        publicKey: transportKeyPair.publicKey,
-    };
-    const eip712 = delegatorAddress !== undefined
-        ? createKmsDelegatedUserDecryptEip712({
-            ...commonMessage,
-            delegatorAddress,
-        })
-        : createKmsUserDecryptEip712(commonMessage);
-    const signature = await context.runtime.ethereum.signTypedData(signer, {
-        account: signerAddress,
-        ...eip712,
-    });
-    return await _createSignedDecryptionPermit(context, {
-        signature,
-        signerAddress,
-        eip712,
-    });
+    if (isSemverStrictlyBefore(protocolVersion.version, '0.14.0')) {
+        return await signDecryptionPermitV1(context, parameters);
+    }
+    return await signDecryptionPermitV2(context, parameters);
 }
 ////////////////////////////////////////////////////////////////////////////////
 // parseSignedDecryptionPermit
 ////////////////////////////////////////////////////////////////////////////////
 export async function parseSignedDecryptionPermit(context, transportKeyPair, permit) {
-    assertIsTransportKeyPair(transportKeyPair, {});
-    const permitName = 'permit';
-    const options = {};
-    assertRecordNonNullableProperty(permit, 'eip712', permitName, options);
-    assertRecordBytes65HexProperty(permit, 'signature', permitName, options);
-    assertRecordAddressProperty(permit, 'signerAddress', permitName, options);
-    const eip712 = permit.eip712;
-    assertRecordStringProperty(eip712, 'primaryType', `${permitName}.eip712`, options);
-    const primaryType = eip712.primaryType;
-    if (primaryType === 'UserDecryptRequestVerification') {
-        assertIsKmsUserDecryptEip712(eip712, `${permitName}.eip712`, options);
+    const hasVersion = isRecordUintNumberProperty(permit, 'version');
+    // if no version, interpret as permit v1
+    const version = hasVersion ? permit.version : 1;
+    if (version === 1) {
+        return await parseSignedDecryptionPermitV1(context, transportKeyPair, permit);
     }
-    else if (primaryType === 'DelegatedUserDecryptRequestVerification') {
-        assertIsKmsDelegatedUserDecryptEip712(eip712, `${permitName}.eip712`, options);
+    if (version === 2) {
+        return await parseSignedDecryptionPermitV2(context, transportKeyPair, permit);
     }
-    else {
-        throw new Error(`Unknown permit primaryType: ${primaryType}`);
-    }
-    if (eip712.message.publicKey.toLowerCase() !== transportKeyPair.publicKey.toLowerCase()) {
-        throw new Error("The permit's publicKey does not match the TransportKeyPairKeyPair's publicKey. " +
-            'Ensure the permit was signed with the same key pair.');
-    }
-    return await _createSignedDecryptionPermit(context, {
-        signature: permit.signature,
-        eip712,
-        signerAddress: addressToChecksummedAddress(permit.signerAddress),
-    });
+    throw new Error(`Unsupported permit version: ${version}. Supported versions are 1 and 2.`);
 }
 //# sourceMappingURL=SignedDecryptionPermit-p.js.map

package/_esm/core/kms/SignedDecryptionPermit-p.js.map

@@ -1 +1 @@
-{"version":3,"file":"SignedDecryptionPermit-p.js","sourceRoot":"","sources":["../../../core/kms/SignedDecryptionPermit-p.ts"],"names":[],"mappings":";;;;;;;;;;;;AAmBA,OAAO,EAAE,0BAA0B,EAAE,MAAM,kDAAkD,CAAC;AAC9F,OAAO,EAAE,mCAAmC,EAAE,MAAM,2DAA2D,CAAC;AAChH,OAAO,EAAE,+BAA+B,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,2BAA2B,EAAE,eAAe,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAC/G,OAAO,EAAE,4BAA4B,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC3G,OAAO,EACL,qCAAqC,EACrC,mCAAmC,GACpC,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAyB,MAAM,yBAAyB,CAAC;AAC1F,OAAO,EAAE,+BAA+B,EAAE,MAAM,YAAY,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8CAA8C,CAAC;AACrF,OAAO,EAAE,4BAA4B,EAAE,MAAM,0CAA0C,CAAC;AACxF,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,gFAAgF;AAEhF,MAAM,aAAa,GAAG,MAAM,CAAC,8BAA8B,CAAC,CAAC;AAC7D,MAAM,8BAA8B,GAAG,GAAiB,CAAC;AACzD,MAAM,mCAAmC,GAAG,EAAiB,CAAC;AAE9D,gFAAgF;AAEhF;;;;;;;;;;;;;;;GAeG;AACH,MAAe,8BAA8B;IAK3C,YACE,YAAoB,EACpB,UAIC;QAVM,yDAA8D;QAC9D,4DAAuB;QACvB,gEAAmC;QAU1C,IAAI,YAAY,KAAK,aAAa,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;QAClC,CAAC;QACD,uBAAA,IAAI,0CAAW,UAAU,CAAC,MAAM,MAAA,CAAC;QACjC,uBAAA,IAAI,6CAAc,UAAU,CAAC,SAAS,MAAA,CAAC;QACvC,uBAAA,IAAI,iDAAkB,UAAU,CAAC,aAAa,MAAA,CAAC;IACjD,CAAC;IAED,IAAW,MAAM;QACf,OAAO,uBAAA,IAAI,8CAAQ,CAAC;IACtB,CAAC;IAED,IAAW,SAAS;QAClB,OAAO,uBAAA,IAAI,iDAAW,CAAC;IACzB,CAAC;IAED,IAAW,aAAa;QACtB,OAAO,uBAAA,IAAI,qDAAe,CAAC;IAC7B,CAAC;IAKM,gBAAgB;QACrB,+BAA+B,CAAC,uBAAA,IAAI,8CAAQ,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;IACxF,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,uBAAuB,CAAC,iBAAoC;QACjE,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,iBAAiB,CAAC,CAAC;QAC1E,IAAI,iBAAiB,KAAK,uBAAA,IAAI,8CAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,8BAA8B,uBAAA,IAAI,8CAAQ,CAAC,OAAO,CAAC,SAAS,8BAA8B,iBAAiB,2BAA2B,CACvI,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAW,kBAAkB;QAC3B,OAAO,uBAAA,IAAI,8CAAQ,CAAC,OAAO,CAAC,SAAS,CAAC;IACxC,CAAC;IAED,IAAW,YAAY;QACrB,OAAO,gBAAgB,CAAC,uBAAA,IAAI,8CAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC;IACvE,CAAC;IAED,IAAW,UAAU;QACnB,OAAO,gBAAgB,CAAC,uBAAA,IAAI,8CAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC;IACrE,CAAC;CACF;;AAED,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAA8B;IAKlF,8BAA8B,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,iCAAiC;AACjC,gFAAgF;AAEhF,MAAM,8BAA+B,SAAQ,8BAA8B;IACzE,IAAoB,MAAM;QACxB,OAAO,KAAK,CAAC,MAA8B,CAAC;IAC9C,CAAC;IAED,IAAoB,yBAAyB;QAC3C,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,IAAoB,WAAW;QAC7B,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,gFAAgF;AAChF,sCAAsC;AACtC,gFAAgF;AAEhF,MAAM,mCACJ,SAAQ,8BAA8B;IAGtC,IAAoB,MAAM;QACxB,OAAO,KAAK,CAAC,MAAuC,CAAC;IACvD,CAAC;IAED,IAAoB,yBAAyB;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC;IAC9C,CAAC;IAED,IAAoB,WAAW;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,gFAAgF;AAEhF,MAAM,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;AAC9C,MAAM,CAAC,MAAM,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC;AACxD,MAAM,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAC;AAC9C,MAAM,CAAC,MAAM,CAAC,8BAA8B,CAAC,SAAS,CAAC,CAAC;AACxD,MAAM,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC;AACnD,MAAM,CAAC,MAAM,CAAC,mCAAmC,CAAC,SAAS,CAAC,CAAC;AAE7D,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,KAAK,YAAY,8BAA8B,CAAC;AACzD,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,8BAA8B,CAC5C,KAAc,EACd,OAAmD;IAEnD,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,gBAAgB,CACxB;YACE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,KAAK;YAClB,YAAY,EAAE,wBAAwB;SACvC,EACD,OAAO,CACR,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qCAAqC,CACnD,MAA8B,EAC9B,iBAAoC;IAEpC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAChE,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC5E,MAAM,KAAK,CAAC,oBAAoB,OAAO,kDAAkD,CAAC,CAAC;QAC7F,CAAC;IACH,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,+BAA+B;AAC/B,gFAAgF;AAEhF,KAAK,UAAU,6BAA6B,CAC1C,OAAuE,EACvE,UAIC;IAED,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,UAAU,CAAC;IAExD,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,mCAAmC,EAAE,CAAC;QAClF,MAAM,KAAK,CAAC,mCAAmC,mCAAmC,WAAW,CAAC,CAAC;IACjG,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,8BAA8B,EAAE,CAAC;QACzE,MAAM,KAAK,CAAC,yCAAyC,8BAA8B,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,KAAK,gCAAgC,EAAE,CAAC;QAC5D,MAAM,0BAA0B,CAAC,OAAO,EAAE;YACxC,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS;SACV,CAAC,CAAC;QACH,OAAO,IAAI,8BAA8B,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,MAAM,mCAAmC,CAAC,OAAO,EAAE;YACjD,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,SAAS;SACV,CAAC,CAAC;QACH,OAAO,IAAI,mCAAmC,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAoDD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoC,EACpC,UAA0C;IAE1C,MAAM,iBAAiB,GAAG,MAAM,qBAAqB,CAAC,OAAO,EAAE;QAC7D,kBAAkB,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,CAAC,OAA6B;QAC3F,qBAAqB,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,OAAyC;KAC/G,CAAC,CAAC;IAEH,MAAM,SAAS,GAAa,4BAA4B,CAAC,iBAAiB,CAAC,CAAC;IAE5E,MAAM,EACJ,iBAAiB,EACjB,cAAc,EACd,YAAY,EACZ,aAAa,EAAE,gBAAgB,EAC/B,gBAAgB,EAAE,gBAAgB,EAClC,MAAM,EACN,gBAAgB,GACjB,GAAG,UAAU,CAAC;IAEf,wBAAwB,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAC/C,eAAe,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAEtC,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,eAAe,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;QACtC,IAAI,gBAAgB,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,WAAW,EAAE,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CACb,wDAAwD;gBACtD,wDAAwD,CAC3D,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,2BAA2B,CAAC,gBAAgB,CAAC,CAAC;IAEpE,MAAM,aAAa,GAAG;QACpB,kCAAkC,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,OAA6B;QAClH,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE;QACzB,iBAAiB;QACjB,YAAY;QACZ,cAAc;QACd,SAAS;QACT,SAAS,EAAE,gBAAgB,CAAC,SAAS;KACtC,CAAC;IAEF,MAAM,MAAM,GACV,gBAAgB,KAAK,SAAS;QAC5B,CAAC,CAAC,mCAAmC,CAAC;YAClC,GAAG,aAAa;YAChB,gBAAgB;SACjB,CAAC;QACJ,CAAC,CAAC,0BAA0B,CAAC,aAAa,CAAC,CAAC;IAEhD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,MAAM,EAAE;QACrE,OAAO,EAAE,aAAa;QACtB,GAAG,MAAM;KACV,CAAC,CAAC;IAEH,OAAO,MAAM,6BAA6B,CAAC,OAAO,EAAE;QAClD,SAAS;QACT,aAAa;QACb,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAKC,EACD,gBAAkC,EAClC,MAAe;IAEf,wBAAwB,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IAE/C,MAAM,UAAU,GAAG,QAAQ,CAAC;IAC5B,MAAM,OAAO,GAAG,EAAE,CAAC;IAEnB,+BAA+B,CAAC,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACvE,8BAA8B,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IACzE,2BAA2B,CAAC,MAAM,EAAE,eAAe,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAE1E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,0BAA0B,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,UAAU,SAAS,EAAE,OAAO,CAAC,CAAC;IACnF,MAAM,WAAW,GAAI,MAAkC,CAAC,WAAW,CAAC;IAEpE,IAAI,WAAW,KAAK,gCAAgC,EAAE,CAAC;QACrD,4BAA4B,CAAC,MAAM,EAAE,GAAG,UAAU,SAAS,EAAE,OAAO,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,WAAW,KAAK,yCAAyC,EAAE,CAAC;QACrE,qCAAqC,CAAC,MAAM,EAAE,GAAG,UAAU,SAAS,EAAE,OAAO,CAAC,CAAC;IACjF,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,+BAA+B,WAAW,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CACb,iFAAiF;YAC/E,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,6BAA6B,CAAC,OAAO,EAAE;QAClD,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM;QACN,aAAa,EAAE,2BAA2B,CAAC,MAAM,CAAC,aAAa,CAAC;KACjE,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"SignedDecryptionPermit-p.js","sourceRoot":"","sources":["../../../core/kms/SignedDecryptionPermit-p.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,iBAAiB,CAAC;AAE7D,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,qCAAqC,CAAC,MAA8B;IAalF,8BAA8B,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAE3C,kBAAkB;IAClB,MAAM,OAAO,GAAG,MAAM,CAAC,OAA4B,CAAC;IACpD,IAAI,OAAO,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,mCAAmC,CAAC,CAAC;IAC7F,CAAC;IAED,mCAAmC;IACnC,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,CAAC;YACV,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;SACpC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO,EAAE,CAAC;QACV,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;KACpC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,2BAA2B;AAC3B,gFAAgF;AAEhF,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,0BAA0B,CAAC,KAAK,CAAC,IAAI,0BAA0B,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,8BAA8B,CAC5C,KAAc,EACd,OAAmD;IAEnD,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,gBAAgB,CACxB;YACE,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,KAAK;YAClB,YAAY,EAAE,wBAAwB;SACvC,EACD,OAAO,CACR,CAAC;IACJ,CAAC;AACH,CAAC;AAmBD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAoC,EACpC,UAA0C;IAE1C,MAAM,eAAe,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC5D,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CACb,mHAAmH,CACpH,CAAC;IACJ,CAAC;IAED,IAAI,sBAAsB,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO,MAAM,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,MAAM,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC;AAED,gFAAgF;AAChF,8BAA8B;AAC9B,gFAAgF;AAEhF,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,OAAoC,EACpC,gBAAkC,EAClC,MAAe;IAEf,MAAM,UAAU,GAAG,0BAA0B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAEjE,wCAAwC;IACxC,MAAM,OAAO,GAAW,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAExD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,MAAM,6BAA6B,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAED,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,OAAO,MAAM,6BAA6B,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;IAChF,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,+BAA+B,OAAO,mCAAmC,CAAC,CAAC;AAC7F,CAAC"}

package/_esm/core/kms/SignedDecryptionPermitV1-p.js

@@ -0,0 +1,258 @@
+var __classPrivateFieldSet = (this && this.__classPrivateFieldSet) || function (receiver, state, value, kind, f) {
+    if (kind === "m") throw new TypeError("Private method is not writable");
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+    return (kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value)), value;
+};
+var __classPrivateFieldGet = (this && this.__classPrivateFieldGet) || function (receiver, state, kind, f) {
+    if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+    if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+    return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+};
+var _SignedDecryptionPermitV1Impl_eip712, _SignedDecryptionPermitV1Impl_signature, _SignedDecryptionPermitV1Impl_signerAddress;
+import { verifyKmsUserDecryptEip712V1 } from '../utils-p/decrypt/verifyKmsUserDecryptEip712V1.js';
+import { verifyKmsDelegatedUserDecryptEip712V1 } from '../utils-p/decrypt/verifyKmsDelegatedUserDecryptEip712V1.js';
+import { assertRecordNonNullableProperty } from '../base/record.js';
+import { assertRecordBytes65HexProperty } from '../base/bytes.js';
+import { addressToChecksummedAddress, assertIsAddress, assertRecordAddressProperty } from '../base/address.js';
+import { assertIsKmsUserDecryptEip712V1, createKmsUserDecryptEip712V1 } from './createKmsUserDecryptEip712V1.js';
+import { assertIsKmsDelegatedUserDecryptEip712V1, createKmsDelegatedUserDecryptEip712V1, } from './createKmsDelegatedUserDecryptEip712V1.js';
+import { assertRecordStringProperty } from '../base/string.js';
+import { assertIsTransportKeyPair } from './TransportKeyPair-p.js';
+import { readKmsSignersContext } from '../host-contracts/readKmsSignersContext-p.js';
+import { kmsSignersContextToExtraData } from '../host-contracts/KmsSignersContext-p.js';
+import { fromKmsExtraData } from './kmsExtraData.js';
+////////////////////////////////////////////////////////////////////////////////
+const PRIVATE_TOKEN = Symbol('SignedDecryptionPermitV1.token');
+const MAX_USER_DECRYPT_DURATION_DAYS = 365;
+const MAX_USER_DECRYPT_CONTRACT_ADDRESSES = 10;
+////////////////////////////////////////////////////////////////////////////////
+function assertKmsEip712V1DeadlineValidity({ startTimestamp, durationDays, }, maxDurationDays) {
+    if (durationDays === 0) {
+        throw Error('durationDays is zero');
+    }
+    const durationDaysBigInt = BigInt(durationDays);
+    if (durationDaysBigInt > BigInt(maxDurationDays)) {
+        throw Error(`durationDays is above max duration of ${maxDurationDays}`);
+    }
+    const startTimestampBigInt = BigInt(startTimestamp);
+    const currentTimestamp = BigInt(Math.floor(Date.now() / 1000));
+    if (startTimestampBigInt > currentTimestamp) {
+        throw Error('startTimestamp is set in the future');
+    }
+    const durationInSeconds = durationDaysBigInt * BigInt(24 * 60 * 60);
+    if (startTimestampBigInt + durationInSeconds < currentTimestamp) {
+        throw Error('request has expired');
+    }
+}
+/**
+ * Private implementation of {@link SignedDecryptionPermit}.
+ * Immutable by design — all fields are stored as private properties
+ * and exposed via readonly getters. Instances are only created through
+ * SDK-internal factory functions that guarantee the signature has been verified.
+ *
+ * **Invariant:** Every instance of this class has a verified signature.
+ * Construction is only possible through factory functions that validate the
+ * signature against the on-chain verifier before returning. If the EIP-712
+ * format has changed (e.g. loading a permit serialized by an older SDK version),
+ * verification will fail and construction will throw.
+ *
+ * As a consequence, any code within the SDK that receives a
+ * `SignedDecryptionPermit` (verified via `instanceof`) can safely trust
+ * its contents without re-verification.
+ */
+class SignedDecryptionPermitV1Impl {
+    constructor(privateToken, parameters) {
+        _SignedDecryptionPermitV1Impl_eip712.set(this, void 0);
+        _SignedDecryptionPermitV1Impl_signature.set(this, void 0);
+        _SignedDecryptionPermitV1Impl_signerAddress.set(this, void 0);
+        Object.defineProperty(this, "version", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 1
+        });
+        if (privateToken !== PRIVATE_TOKEN) {
+            throw new Error('Unauthorized');
+        }
+        __classPrivateFieldSet(this, _SignedDecryptionPermitV1Impl_eip712, parameters.eip712, "f");
+        __classPrivateFieldSet(this, _SignedDecryptionPermitV1Impl_signature, parameters.signature, "f");
+        __classPrivateFieldSet(this, _SignedDecryptionPermitV1Impl_signerAddress, parameters.signerAddress, "f");
+    }
+    get eip712() {
+        return __classPrivateFieldGet(this, _SignedDecryptionPermitV1Impl_eip712, "f");
+    }
+    get signature() {
+        return __classPrivateFieldGet(this, _SignedDecryptionPermitV1Impl_signature, "f");
+    }
+    get signerAddress() {
+        return __classPrivateFieldGet(this, _SignedDecryptionPermitV1Impl_signerAddress, "f");
+    }
+    assertNotExpired() {
+        assertKmsEip712V1DeadlineValidity(__classPrivateFieldGet(this, _SignedDecryptionPermitV1Impl_eip712, "f").message, MAX_USER_DECRYPT_DURATION_DAYS);
+    }
+    /**
+     * Asserts that this permit was signed against the given {@link KmsSignersContext}.
+     *
+     * Compares the `extraData` embedded in the permit's EIP-712 message with the
+     * `extraData` derived from the provided context. A mismatch indicates the permit
+     * was created for a different KMS context (e.g. different context ID or version)
+     * and must not be used for decryption.
+     *
+     * @todo The current check is a strict byte-level comparison. A permit signed
+     *   with the correct `kmsContextId` but a different `extraData` encoding format
+     *   (e.g. a version change in the serialization scheme) will be rejected even
+     *   though the context ID matches. Consider comparing the decoded `kmsContextId`
+     *   instead of the raw `extraData` bytes.
+     *
+     * @param kmsSignersContext - The current KMS signers context to validate against.
+     * @throws If the permit's `extraData` does not match the context's `extraData`.
+     */
+    assertMatchesKmsContext(kmsSignersContext) {
+        const expectedExtraData = kmsSignersContextToExtraData(kmsSignersContext);
+        if (expectedExtraData !== __classPrivateFieldGet(this, _SignedDecryptionPermitV1Impl_eip712, "f").message.extraData) {
+            throw new Error(`Invalid permit: extraData "${__classPrivateFieldGet(this, _SignedDecryptionPermitV1Impl_eip712, "f").message.extraData}" does not match expected "${expectedExtraData}" from KmsSignersContext.`);
+        }
+    }
+    get transportPublicKey() {
+        return __classPrivateFieldGet(this, _SignedDecryptionPermitV1Impl_eip712, "f").message.publicKey;
+    }
+    get kmsContextId() {
+        return fromKmsExtraData(__classPrivateFieldGet(this, _SignedDecryptionPermitV1Impl_eip712, "f").message.extraData).kmsContextId;
+    }
+    get kmsEpochId() {
+        return fromKmsExtraData(__classPrivateFieldGet(this, _SignedDecryptionPermitV1Impl_eip712, "f").message.extraData).kmsEpochId;
+    }
+    get encryptedDataOwnerAddress() {
+        if (this.eip712.primaryType === 'DelegatedUserDecryptRequestVerification') {
+            return this.eip712.message.delegatorAddress;
+        }
+        return this.signerAddress;
+    }
+    get isDelegated() {
+        return this.eip712.primaryType === 'DelegatedUserDecryptRequestVerification';
+    }
+}
+_SignedDecryptionPermitV1Impl_eip712 = new WeakMap(), _SignedDecryptionPermitV1Impl_signature = new WeakMap(), _SignedDecryptionPermitV1Impl_signerAddress = new WeakMap();
+////////////////////////////////////////////////////////////////////////////////
+Object.freeze(SignedDecryptionPermitV1Impl);
+Object.freeze(SignedDecryptionPermitV1Impl.prototype);
+////////////////////////////////////////////////////////////////////////////////
+export function isSignedDecryptionPermitV1(value) {
+    return value instanceof SignedDecryptionPermitV1Impl;
+}
+////////////////////////////////////////////////////////////////////////////////
+// _createSignedDecryptionPermitV1
+////////////////////////////////////////////////////////////////////////////////
+async function _createSignedDecryptionPermitV1(context, parameters) {
+    const { signerAddress, eip712, signature } = parameters;
+    if (eip712.message.contractAddresses.length === 0) {
+        throw Error('contractAddresses is empty');
+    }
+    if (eip712.message.contractAddresses.length > MAX_USER_DECRYPT_CONTRACT_ADDRESSES) {
+        throw Error(`contractAddresses max length of ${MAX_USER_DECRYPT_CONTRACT_ADDRESSES} exceeded`);
+    }
+    if (Number(eip712.message.durationDays) > MAX_USER_DECRYPT_DURATION_DAYS) {
+        throw Error(`durationDays is above max duration of ${MAX_USER_DECRYPT_DURATION_DAYS}`);
+    }
+    if (eip712.primaryType === 'UserDecryptRequestVerification') {
+        await verifyKmsUserDecryptEip712V1(context, {
+            signer: signerAddress,
+            message: eip712.message,
+            signature,
+        });
+        return new SignedDecryptionPermitV1Impl(PRIVATE_TOKEN, parameters);
+    }
+    else {
+        await verifyKmsDelegatedUserDecryptEip712V1(context, {
+            signer: signerAddress,
+            message: eip712.message,
+            signature,
+        });
+        return new SignedDecryptionPermitV1Impl(PRIVATE_TOKEN, parameters);
+    }
+}
+////////////////////////////////////////////////////////////////////////////////
+// signDecryptionPermitV1
+////////////////////////////////////////////////////////////////////////////////
+export async function signDecryptionPermitV1(context, parameters) {
+    const kmsSignersContext = await readKmsSignersContext(context, {
+        kmsVerifierAddress: context.chain.fhevm.contracts.kmsVerifier.address,
+        protocolConfigAddress: context.chain.fhevm.contracts.protocolConfig?.address,
+    });
+    const extraData = kmsSignersContextToExtraData(kmsSignersContext);
+    const { contractAddresses, startTimestamp, durationSeconds, signerAddress: signerAddressArg, transportKeyPair: transportKeyPair, signer, delegatorAddress, } = parameters;
+    if (durationSeconds % 86_400 !== 0) {
+        throw new Error(`Protocol v13 requires durationSeconds to be a whole number of days, got ${durationSeconds}`);
+    }
+    const durationDays = durationSeconds / 86_400;
+    assertIsTransportKeyPair(transportKeyPair, {});
+    assertIsAddress(signerAddressArg, {});
+    if (delegatorAddress !== undefined) {
+        assertIsAddress(delegatorAddress, {});
+        if (signerAddressArg.toLowerCase() === delegatorAddress.toLowerCase()) {
+            throw new Error('signerAddress and delegatorAddress must be different. ' +
+                'Use a non-delegated permit to decrypt your own values.');
+        }
+    }
+    const signerAddress = addressToChecksummedAddress(signerAddressArg);
+    const commonMessage = {
+        verifyingContractAddressDecryption: context.chain.fhevm.gateway.contracts.decryption.address,
+        chainId: context.chain.id,
+        contractAddresses,
+        durationDays,
+        startTimestamp,
+        extraData,
+        publicKey: transportKeyPair.publicKey,
+    };
+    const eip712 = delegatorAddress !== undefined
+        ? createKmsDelegatedUserDecryptEip712V1({
+            ...commonMessage,
+            delegatorAddress,
+        })
+        : createKmsUserDecryptEip712V1(commonMessage);
+    const signature = await context.runtime.ethereum.signTypedData(signer, {
+        account: signerAddress,
+        ...eip712,
+    });
+    return await _createSignedDecryptionPermitV1(context, {
+        signature,
+        signerAddress,
+        eip712,
+    });
+}
+////////////////////////////////////////////////////////////////////////////////
+// parseSignedDecryptionPermitV1
+////////////////////////////////////////////////////////////////////////////////
+export async function parseSignedDecryptionPermitV1(context, transportKeyPair, permit) {
+    assertIsTransportKeyPair(transportKeyPair, {});
+    const permitName = 'permit';
+    const options = {};
+    assertRecordNonNullableProperty(permit, 'eip712', permitName, options);
+    assertRecordBytes65HexProperty(permit, 'signature', permitName, options);
+    assertRecordAddressProperty(permit, 'signerAddress', permitName, options);
+    const eip712 = permit.eip712;
+    assertRecordStringProperty(eip712, 'primaryType', `${permitName}.eip712`, options);
+    const primaryType = eip712.primaryType;
+    const signerAddress = addressToChecksummedAddress(permit.signerAddress);
+    if (primaryType === 'UserDecryptRequestVerification') {
+        assertIsKmsUserDecryptEip712V1(eip712, `${permitName}.eip712`, options);
+        if (eip712.message.publicKey.toLowerCase() !== transportKeyPair.publicKey.toLowerCase()) {
+            throw new Error("The permit's publicKey does not match the TransportKeyPair's publicKey. " +
+                'Ensure the permit was signed with the same key pair.');
+        }
+        return await _createSignedDecryptionPermitV1(context, { signature: permit.signature, eip712, signerAddress });
+    }
+    else if (primaryType === 'DelegatedUserDecryptRequestVerification') {
+        assertIsKmsDelegatedUserDecryptEip712V1(eip712, `${permitName}.eip712`, options);
+        if (eip712.message.publicKey.toLowerCase() !== transportKeyPair.publicKey.toLowerCase()) {
+            throw new Error("The permit's publicKey does not match the TransportKeyPair's publicKey. " +
+                'Ensure the permit was signed with the same key pair.');
+        }
+        return await _createSignedDecryptionPermitV1(context, { signature: permit.signature, eip712, signerAddress });
+    }
+    else {
+        throw new Error(`Unknown permit primaryType: ${primaryType}`);
+    }
+}
+//# sourceMappingURL=SignedDecryptionPermitV1-p.js.map