@fhevm/sdk 1.1.0-alpha.6 → 1.1.0-alpha.8

package/core/kms/{createKmsDelegatedUserDecryptEip712.ts → createKmsDelegatedUserDecryptEip712V1.ts}

@@ -1,40 +1,41 @@
-import type { KmsDelegatedUserDecryptEip712 } from '../types/kms.js';
+import type { KmsDelegatedUserDecryptEip712V1 } from '../types/kms.js';
 import type { BytesHex } from '../types/primitives.js';
 import type { ErrorMetadataParams } from '../base/errors/ErrorBase.js';
+import type { KmsExtraData } from '../types/kms-p.js';
 import {
   addressToChecksummedAddress,
   assertIsAddress,
   assertIsAddressArray,
   assertRecordChecksummedAddressProperty,
 } from '../base/address.js';
-import { asBytesHex, assertIsBytesHex, bytesToHexLarge } from '../base/bytes.js';
+import { asBytesHex, bytesToHexLarge } from '../base/bytes.js';
 import { ensure0x } from '../base/string.js';
 import { assertIsUintNumber } from '../base/uint.js';
 import { createKmsEip712Domain } from './createKmsEip712Domain.js';
-import { _assertIsKmsUserDecryptEip712Base } from './createKmsUserDecryptEip712.js';
-import { kmsDelegatedUserDecryptEip712Types } from './kmsDelegatedUserDecryptEip712Types.js';
-import { assertIsKmsExtraData } from './kmsExtraData.js';
+import { _assertIsKmsUserDecryptEip712V1Base } from './createKmsUserDecryptEip712V1.js';
+import { kmsDelegatedUserDecryptEip712V1Types } from './kmsDelegatedUserDecryptEip712V1Types.js';
+import { assertIsKmsExtraData } from './kmsExtraData-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
-export type CreateKmsDelegatedUserDecryptEip712Parameters = {
+export type CreateKmsDelegatedUserDecryptEip712V1Parameters = {
   readonly verifyingContractAddressDecryption: string;
   readonly chainId: number | bigint;
   readonly publicKey: string | Uint8Array;
   readonly contractAddresses: readonly string[];
   readonly startTimestamp: number;
   readonly durationDays: number;
-  readonly extraData: string;
+  readonly extraData: KmsExtraData;
   readonly delegatorAddress: string;
 };
 
 ////////////////////////////////////////////////////////////////////////////////
-// createKmsDelegatedUserDecryptEip712
+// createKmsDelegatedUserDecryptEip712V1
 ////////////////////////////////////////////////////////////////////////////////
 
-export function createKmsDelegatedUserDecryptEip712(
-  parameters: CreateKmsDelegatedUserDecryptEip712Parameters,
-): KmsDelegatedUserDecryptEip712 {
+export function createKmsDelegatedUserDecryptEip712V1(
+  parameters: CreateKmsDelegatedUserDecryptEip712V1Parameters,
+): KmsDelegatedUserDecryptEip712V1 {
   const {
     verifyingContractAddressDecryption,
     chainId,
@@ -50,7 +51,6 @@ export function createKmsDelegatedUserDecryptEip712(
   assertIsAddressArray(contractAddresses, {});
   assertIsUintNumber(startTimestamp, {});
   assertIsUintNumber(durationDays, {});
-  assertIsBytesHex(extraData, {});
   assertIsAddress(delegatorAddress, {});
   assertIsKmsExtraData(extraData, {});
 
@@ -58,15 +58,15 @@ export function createKmsDelegatedUserDecryptEip712(
 
   const checksummedDelegatorAddress = addressToChecksummedAddress(delegatorAddress);
 
-  const primaryType: KmsDelegatedUserDecryptEip712['primaryType'] = 'DelegatedUserDecryptRequestVerification';
+  const primaryType: KmsDelegatedUserDecryptEip712V1['primaryType'] = 'DelegatedUserDecryptRequestVerification';
 
   const domain = createKmsEip712Domain({
     chainId,
     verifyingContractAddressDecryption,
   });
 
-  const eip712: KmsDelegatedUserDecryptEip712 = {
-    types: kmsDelegatedUserDecryptEip712Types,
+  const eip712: KmsDelegatedUserDecryptEip712V1 = {
+    types: kmsDelegatedUserDecryptEip712V1Types,
     primaryType,
     domain,
     message: {
@@ -75,7 +75,7 @@ export function createKmsDelegatedUserDecryptEip712(
       delegatorAddress: checksummedDelegatorAddress,
       startTimestamp: startTimestamp.toString(),
       durationDays: durationDays.toString(),
-      extraData,
+      extraData: extraData.toBytesHex(),
     },
   };
 
@@ -92,21 +92,21 @@ export function createKmsDelegatedUserDecryptEip712(
 
 ////////////////////////////////////////////////////////////////////////////////
 
-export function assertIsKmsDelegatedUserDecryptEip712(
+export function assertIsKmsDelegatedUserDecryptEip712V1(
   value: unknown,
   name: string,
   options: ErrorMetadataParams,
-): asserts value is KmsDelegatedUserDecryptEip712 {
-  _assertIsKmsUserDecryptEip712Base(
+): asserts value is KmsDelegatedUserDecryptEip712V1 {
+  _assertIsKmsUserDecryptEip712V1Base(
     value,
     name,
-    'DelegatedUserDecryptRequestVerification' satisfies KmsDelegatedUserDecryptEip712['primaryType'],
+    'DelegatedUserDecryptRequestVerification' satisfies KmsDelegatedUserDecryptEip712V1['primaryType'],
     options,
   );
 
   assertRecordChecksummedAddressProperty(
     value.message,
-    'delegatorAddress' satisfies keyof KmsDelegatedUserDecryptEip712['message'],
+    'delegatorAddress' satisfies keyof KmsDelegatedUserDecryptEip712V1['message'],
     `${name}.message`,
     options,
   );

package/core/kms/createKmsPublicDecryptEip712.ts

@@ -16,7 +16,7 @@ export type CreateKmsPublicDecryptEip712Parameters = {
 };
 
 ////////////////////////////////////////////////////////////////////////////////
-// createKmsPublicDecryptEIP712
+// createKmsPublicDecryptEip712
 ////////////////////////////////////////////////////////////////////////////////
 
 export function createKmsPublicDecryptEip712(

package/core/kms/{createKmsUserDecryptEip712.ts → createKmsUserDecryptEip712V1.ts}

@@ -1,7 +1,8 @@
 import type { ErrorMetadataParams } from '../base/errors/ErrorBase.js';
-import type { KmsEip712Domain, KmsUserDecryptEip712 } from '../types/kms.js';
+import type { KmsEip712Domain, KmsUserDecryptEip712V1 } from '../types/kms.js';
 import type { BytesHex } from '../types/primitives.js';
-import type { KmsUserDecryptEip712Message } from '../types/kms.js';
+import type { KmsUserDecryptEip712V1Message } from '../types/kms.js';
+import type { KmsExtraData } from '../types/kms-p.js';
 import {
   addressToChecksummedAddress,
   assertIsAddress,
@@ -9,32 +10,34 @@ import {
   assertRecordChecksummedAddressArrayProperty,
 } from '../base/address.js';
 import { assertIsKmsEip712Domain, createKmsEip712Domain } from './createKmsEip712Domain.js';
-import { asBytesHex, assertIsBytesHex, assertRecordBytesHexProperty, bytesToHexLarge } from '../base/bytes.js';
+import { asBytesHex, assertRecordBytesHexProperty, bytesToHexLarge } from '../base/bytes.js';
 import { assertRecordNonNullableProperty } from '../base/record.js';
 import { assertRecordStringProperty, ensure0x } from '../base/string.js';
-import { assertIsUint64, assertIsUintNumber } from '../base/uint.js';
-import { assertIsKmsExtraData } from './kmsExtraData.js';
-import { kmsUserDecryptEip712Types } from './kmsUserDecryptEip712Types.js';
+import { assertIsUint64, assertIsUintNumber, assertIsUintString, MAX_UINT256 } from '../base/uint.js';
+import { kmsUserDecryptEip712V1Types } from './kmsUserDecryptEip712V1Types.js';
+import { kmsDelegatedUserDecryptEip712V1Types } from './kmsDelegatedUserDecryptEip712V1Types.js';
 import { isDeepEqual } from '../base/object.js';
-import { kmsDelegatedUserDecryptEip712Types } from './kmsDelegatedUserDecryptEip712Types.js';
+import { assertIsKmsExtraData, assertIsKmsExtraDataBytesHex } from './kmsExtraData-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
-export type CreateKmsUserDecryptEip712Parameters = {
+export type CreateKmsUserDecryptEip712V1Parameters = {
   readonly verifyingContractAddressDecryption: string;
   readonly chainId: number | bigint;
   readonly publicKey: string | Uint8Array;
   readonly contractAddresses: readonly string[];
   readonly startTimestamp: number;
   readonly durationDays: number;
-  readonly extraData: string;
+  readonly extraData: KmsExtraData;
 };
 
 ////////////////////////////////////////////////////////////////////////////////
-// createKmsUserDecryptEip712
+// createKmsUserDecryptEip712V1
 ////////////////////////////////////////////////////////////////////////////////
 
-export function createKmsUserDecryptEip712(parameters: CreateKmsUserDecryptEip712Parameters): KmsUserDecryptEip712 {
+export function createKmsUserDecryptEip712V1(
+  parameters: CreateKmsUserDecryptEip712V1Parameters,
+): KmsUserDecryptEip712V1 {
   const {
     verifyingContractAddressDecryption,
     chainId,
@@ -51,12 +54,11 @@ export function createKmsUserDecryptEip712(parameters: CreateKmsUserDecryptEip71
   assertIsAddressArray(contractAddresses, {});
   assertIsUintNumber(startTimestamp, {});
   assertIsUintNumber(durationDays, {});
-  assertIsBytesHex(extraData, {});
   assertIsKmsExtraData(extraData, {});
 
   const checksummedContractAddresses = contractAddresses.map(addressToChecksummedAddress);
 
-  const primaryType: KmsUserDecryptEip712['primaryType'] = 'UserDecryptRequestVerification';
+  const primaryType: KmsUserDecryptEip712V1['primaryType'] = 'UserDecryptRequestVerification';
 
   const domain = createKmsEip712Domain({
     chainId,
@@ -65,14 +67,14 @@ export function createKmsUserDecryptEip712(parameters: CreateKmsUserDecryptEip71
 
   const eip712 = {
     domain,
-    types: kmsUserDecryptEip712Types,
+    types: kmsUserDecryptEip712V1Types,
     primaryType,
     message: {
       publicKey: publicKeyBytesHex,
       contractAddresses: checksummedContractAddresses,
       startTimestamp: startTimestamp.toString(),
       durationDays: durationDays.toString(),
-      extraData,
+      extraData: extraData.toBytesHex(),
     },
   };
 
@@ -89,25 +91,25 @@ export function createKmsUserDecryptEip712(parameters: CreateKmsUserDecryptEip71
 
 ////////////////////////////////////////////////////////////////////////////////
 
-export function assertIsKmsUserDecryptEip712(
+export function assertIsKmsUserDecryptEip712V1(
   value: unknown,
   name: string,
   options: ErrorMetadataParams,
-): asserts value is KmsUserDecryptEip712 {
-  _assertIsKmsUserDecryptEip712Base(
+): asserts value is KmsUserDecryptEip712V1 {
+  _assertIsKmsUserDecryptEip712V1Base(
     value,
     name,
-    'UserDecryptRequestVerification' satisfies KmsUserDecryptEip712['primaryType'],
+    'UserDecryptRequestVerification' satisfies KmsUserDecryptEip712V1['primaryType'],
     options,
   );
 }
 
 /**
  * Validates the common structure shared by both
- * {@link KmsUserDecryptEip712} and {@link KmsDelegatedUserDecryptEIP712}:
+ * {@link KmsUserDecryptEip712V1} and {@link KmsDelegatedUserDecryptEip712V1}:
  * domain, types, primaryType, and base message fields.
  */
-export function _assertIsKmsUserDecryptEip712Base(
+export function _assertIsKmsUserDecryptEip712V1Base(
   value: unknown,
   name: string,
   primaryType: string,
@@ -116,7 +118,7 @@ export function _assertIsKmsUserDecryptEip712Base(
   readonly domain: KmsEip712Domain;
   readonly types: object;
   readonly primaryType: string;
-  readonly message: KmsUserDecryptEip712Message;
+  readonly message: KmsUserDecryptEip712V1Message;
 } {
   assertRecordNonNullableProperty(value, 'domain', name, options);
   assertIsKmsEip712Domain((value as Record<string, unknown>).domain, `${name}.domain`, options);
@@ -125,11 +127,11 @@ export function _assertIsKmsUserDecryptEip712Base(
 
   const expectedTypes =
     primaryType === 'DelegatedUserDecryptRequestVerification'
-      ? kmsDelegatedUserDecryptEip712Types
-      : kmsUserDecryptEip712Types;
+      ? kmsDelegatedUserDecryptEip712V1Types
+      : kmsUserDecryptEip712V1Types;
 
   if (!isDeepEqual(value.types, expectedTypes)) {
-    throw new Error('Unexpected KmsUserDecryptEip712Types');
+    throw new Error('Unexpected KmsUserDecryptEip712V1Types');
   }
 
   assertRecordStringProperty(value, 'primaryType', name, {
@@ -139,25 +141,27 @@ export function _assertIsKmsUserDecryptEip712Base(
 
   assertRecordNonNullableProperty(value, 'message', name, options);
   const msg = (value as Record<string, unknown>).message as Record<string, unknown>;
-  _assertIsKmsUserDecryptEip712Message(msg, `${name}.message`, options);
+  _assertIsKmsUserDecryptEip712V1Message(msg, `${name}.message`, options);
 }
 
 /**
  * Validates the common message fields shared by both
- * {@link KmsUserDecryptEip712} and {@link KmsDelegatedUserDecryptEIP712}.
+ * {@link KmsUserDecryptEip712V1} and {@link KmsDelegatedUserDecryptEip712V1}.
  */
-function _assertIsKmsUserDecryptEip712Message(
+function _assertIsKmsUserDecryptEip712V1Message(
   msg: unknown,
   msgName: string,
   options: ErrorMetadataParams,
-): asserts msg is KmsUserDecryptEip712Message {
-  type MessageType = KmsUserDecryptEip712['message'];
+): asserts msg is KmsUserDecryptEip712V1Message {
+  type MessageType = KmsUserDecryptEip712V1['message'];
   assertRecordBytesHexProperty(msg, 'publicKey' satisfies keyof MessageType, msgName, options);
   assertRecordChecksummedAddressArrayProperty(msg, 'contractAddresses' satisfies keyof MessageType, msgName, options);
   assertRecordStringProperty(msg, 'startTimestamp' satisfies keyof MessageType, msgName, options);
   assertRecordStringProperty(msg, 'durationDays' satisfies keyof MessageType, msgName, options);
   assertRecordBytesHexProperty(msg, 'extraData' satisfies keyof MessageType, msgName, options);
-  assertIsKmsExtraData(msg.extraData, options);
+  assertIsKmsExtraDataBytesHex(msg.extraData, options);
+  assertIsUintString(msg.startTimestamp, { max: MAX_UINT256 });
+  assertIsUintString(msg.durationDays, { max: MAX_UINT256 });
 }
 
 ////////////////////////////////////////////////////////////////////////////////

package/core/kms/createKmsUserDecryptEip712V2.ts

@@ -2,6 +2,7 @@ import type { ErrorMetadataParams } from '../base/errors/ErrorBase.js';
 import type { KmsUserDecryptEip712V2 } from '../types/kms.js';
 import type { BytesHex } from '../types/primitives.js';
 import type { KmsUserDecryptEip712V2Message } from '../types/kms.js';
+import type { KmsExtraData } from '../types/kms-p.js';
 import {
   addressToChecksummedAddress,
   assertIsAddress,
@@ -10,13 +11,13 @@ import {
   assertRecordChecksummedAddressArrayProperty,
 } from '../base/address.js';
 import { assertIsKmsEip712Domain, createKmsEip712Domain } from './createKmsEip712Domain.js';
-import { asBytesHex, assertIsBytesHex, assertRecordBytesHexProperty, bytesToHexLarge } from '../base/bytes.js';
+import { asBytesHex, assertRecordBytesHexProperty, bytesToHexLarge } from '../base/bytes.js';
 import { isDeepEqual } from '../base/object.js';
 import { assertRecordNonNullableProperty } from '../base/record.js';
 import { assertRecordStringProperty, ensure0x } from '../base/string.js';
 import { assertIsUint256, assertIsUint64, assertIsUintString, MAX_UINT256 } from '../base/uint.js';
-import { assertIsKmsExtraData } from './kmsExtraData.js';
 import { kmsUserDecryptEip712V2Types } from './kmsUserDecryptEip712V2Types.js';
+import { assertIsKmsExtraData, assertIsKmsExtraDataBytesHex } from './kmsExtraData-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -27,8 +28,8 @@ export type CreateKmsUserDecryptEip712V2Parameters = {
   readonly publicKey: string | Uint8Array;
   readonly allowedContracts: readonly string[];
   readonly startTimestamp: number | bigint;
-  readonly durationSeconds: number | bigint;
-  readonly extraData: string;
+  readonly durationSeconds: bigint;
+  readonly extraData: KmsExtraData;
 };
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -56,7 +57,6 @@ export function createKmsUserDecryptEip712V2(
   assertIsAddressArray(allowedContracts, {});
   assertIsUint256(startTimestamp, {});
   assertIsUint256(durationSeconds, {});
-  assertIsBytesHex(extraData, {});
   assertIsKmsExtraData(extraData, {});
 
   const checksummedUserAddress = addressToChecksummedAddress(userAddress);
@@ -79,7 +79,7 @@ export function createKmsUserDecryptEip712V2(
       allowedContracts: checksummedContractAddresses,
       startTimestamp: startTimestamp.toString(),
       durationSeconds: durationSeconds.toString(),
-      extraData,
+      extraData: extraData.toBytesHex(),
     } satisfies KmsUserDecryptEip712V2Message,
   };
 
@@ -131,7 +131,7 @@ function _assertIsKmsUserDecryptEip712V2Message(
   assertRecordStringProperty(msg, 'startTimestamp' satisfies keyof MessageType, msgName, options);
   assertRecordStringProperty(msg, 'durationSeconds' satisfies keyof MessageType, msgName, options);
   assertRecordBytesHexProperty(msg, 'extraData' satisfies keyof MessageType, msgName, options);
-  assertIsKmsExtraData(msg.extraData, options);
+  assertIsKmsExtraDataBytesHex(msg.extraData, options);
   assertIsUintString(msg.startTimestamp, { max: MAX_UINT256 });
   assertIsUintString(msg.durationSeconds, { max: MAX_UINT256 });
 }

package/core/kms/decryptValuesFromPairs.ts

@@ -7,10 +7,13 @@ import type { FhevmChain } from '../types/fhevmChain.js';
 import type { KmsSigncryptedShares } from '../types/kms.js';
 import type { ChecksummedAddress, TypedValue } from '../types/primitives.js';
 import type { RelayerDelegatedUserDecryptOptions, RelayerUserDecryptOptions } from '../types/relayer.js';
-import type { SignedDelegatedDecryptionPermit, SignedSelfDecryptionPermit } from '../types/signedDecryptionPermit.js';
+import type { SignedDecryptionPermit } from '../types/signedDecryptionPermit.js';
 import type { TransportKeyPair } from './TransportKeyPair-p.js';
+import { isSemverStrictlyBefore } from '../base/semver.js';
+import { getResolvedProtocolVersion } from '../runtime/CoreFhevm-p.js';
 import { decryptKmsSigncryptedShares } from './decryptKmsSigncryptedShares-p.js';
-import { fetchKmsSigncryptedShares } from './fetchKmsSigncryptedShares-p.js';
+import { fetchKmsSigncryptedSharesV1 } from './fetchKmsSigncryptedSharesV1-p.js';
+import { fetchKmsSigncryptedSharesV2 } from './fetchKmsSigncryptedSharesV2-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -22,25 +25,19 @@ type Context = {
   readonly options: { readonly batchRpcCalls: boolean };
 };
 
-type Parameters =
-  | {
-      readonly pairs: ReadonlyArray<{
-        readonly handle: Handle;
-        readonly contractAddress: ChecksummedAddress;
-      }>;
-      readonly signedPermit: SignedSelfDecryptionPermit;
-      readonly transportKeyPair: TransportKeyPair;
-      readonly options?: RelayerUserDecryptOptions | undefined;
-    }
-  | {
-      readonly pairs: ReadonlyArray<{
-        readonly handle: Handle;
-        readonly contractAddress: ChecksummedAddress;
-      }>;
-      readonly signedPermit: SignedDelegatedDecryptionPermit;
-      readonly transportKeyPair: TransportKeyPair;
-      readonly options?: RelayerDelegatedUserDecryptOptions | undefined;
-    };
+type Parameters = {
+  readonly pairs: ReadonlyArray<{
+    readonly handle: Handle;
+    readonly contractAddress: ChecksummedAddress;
+    // ownerAddress is only relevant for V2 (protocol >= 0.14.0). When omitted,
+    // fetchKmsSigncryptedSharesV2 defaults to userAddress (direct-access path).
+    // Provide it explicitly only for delegated handles where ownerAddress !== userAddress.
+    readonly ownerAddress?: ChecksummedAddress | undefined;
+  }>;
+  readonly signedPermit: SignedDecryptionPermit;
+  readonly transportKeyPair: TransportKeyPair;
+  readonly options?: RelayerUserDecryptOptions | RelayerDelegatedUserDecryptOptions | undefined;
+};
 
 export type ReturnType = readonly TypedValue[];
 
@@ -49,7 +46,22 @@ export type ReturnType = readonly TypedValue[];
 export async function decryptValuesFromPairs(fhevm: Context, parameters: Parameters): Promise<ReturnType> {
   const { transportKeyPair: transportKeyPair } = parameters;
 
-  const kmsSigncryptedShares: KmsSigncryptedShares = await fetchKmsSigncryptedShares(fhevm, parameters);
+  const protocolVersion = getResolvedProtocolVersion(fhevm);
+  if (protocolVersion === undefined) {
+    throw new Error(
+      'Unable to resolve protocol version from context, ensure proper initialization of the FhevmRuntime and FhevmChain.',
+    );
+  }
+
+  let kmsSigncryptedShares: KmsSigncryptedShares;
+  if (isSemverStrictlyBefore(protocolVersion.version, '0.14.0')) {
+    kmsSigncryptedShares = await fetchKmsSigncryptedSharesV1(fhevm, parameters);
+  } else {
+    kmsSigncryptedShares = await fetchKmsSigncryptedSharesV2(fhevm, {
+      ...parameters,
+      options: parameters.options as RelayerUserDecryptOptions | undefined,
+    });
+  }
 
   // Using the `KmsSigncryptedShares` decrypt and reconstruct clear values
   return decryptKmsSigncryptedShares(fhevm, {

package/core/kms/{fetchKmsSigncryptedShares-p.ts → fetchKmsSigncryptedSharesV1-p.ts}

@@ -5,12 +5,12 @@ import type { KmsSignersContext } from '../types/kmsSignersContext.js';
 import type { ChecksummedAddress, Uint64BigInt } from '../types/primitives.js';
 import type { FhevmChain } from '../types/fhevmChain.js';
 import type { RelayerDelegatedUserDecryptOptions, RelayerUserDecryptOptions } from '../types/relayer.js';
-import type { SignedDelegatedDecryptionPermit, SignedSelfDecryptionPermit } from '../types/signedDecryptionPermit.js';
+import type { SignedDecryptionPermit, SignedDecryptionPermitV1 } from '../types/signedDecryptionPermit.js';
 import type { Handle } from '../types/encryptedTypes-p.js';
 import { assertHandlesBelongToSameChainId } from '../handle/FhevmHandle.js';
-import { createKmsSigncryptedShares } from '../kms/KmsSigncryptedShares-p.js';
-import { readKmsSignersContext } from '../host-contracts/readKmsSignersContext-p.js';
-import { assertIsSignedDecryptionPermit, assertPermitIncludesContractAddresses } from './SignedDecryptionPermit-p.js';
+import { createKmsSigncryptedShares } from './KmsSigncryptedShares-p.js';
+import { readCurrentKmsSignersContext } from '../host-contracts/readKmsSignersContext-p.js';
+import { assertIsSignedDecryptionPermit } from './SignedDecryptionPermit-p.js';
 import { assertKmsDecryptionBitLimit } from './utils.js';
 import { checkPersistAllowed } from '../host-contracts/checkPersistAllowed.js';
 import { assertExtraDataMatchesKmsSingersContext } from '../host-contracts/KmsSignersContext-p.js';
@@ -18,19 +18,6 @@ import { createKmsEip712Domain } from './createKmsEip712Domain.js';
 import { checkDelegation } from '../host-contracts/checkDelegation.js';
 import { resolveFhevmTkmsVersion } from '../runtime/resolveFhevmVersions-p.js';
 
-/*
-    See: in KMS (eip712Domain)
-    json.response[i].signature is an eip712 sig potentially on this message:
-
-    struct UserDecryptResponseVerification {
-        bytes publicKey;
-        bytes32[] ctHandles;
-        bytes userDecryptedShare;
-        bytes extraData;
-    }
-}    
-*/
-
 ////////////////////////////////////////////////////////////////////////////////
 
 type Context = {
@@ -40,23 +27,14 @@ type Context = {
   readonly options: { readonly batchRpcCalls: boolean };
 };
 
-type Parameters =
-  | {
-      readonly pairs: ReadonlyArray<{
-        readonly handle: Handle;
-        readonly contractAddress: ChecksummedAddress;
-      }>;
-      readonly signedPermit: SignedSelfDecryptionPermit;
-      readonly options?: RelayerUserDecryptOptions | undefined;
-    }
-  | {
-      readonly pairs: ReadonlyArray<{
-        readonly handle: Handle;
-        readonly contractAddress: ChecksummedAddress;
-      }>;
-      readonly signedPermit: SignedDelegatedDecryptionPermit;
-      readonly options?: RelayerDelegatedUserDecryptOptions | undefined;
-    };
+type Parameters = {
+  readonly pairs: ReadonlyArray<{
+    readonly handle: Handle;
+    readonly contractAddress: ChecksummedAddress;
+  }>;
+  readonly signedPermit: SignedDecryptionPermit;
+  readonly options?: RelayerUserDecryptOptions | RelayerDelegatedUserDecryptOptions | undefined;
+};
 
 type ReturnType = KmsSigncryptedShares;
 
@@ -64,19 +42,36 @@ type ReturnType = KmsSigncryptedShares;
 
 const MAX_USER_DECRYPT_CONTRACT_ADDRESSES = 10;
 
+/**
+ * Asserts that every address in {@link contractAddresses} is listed in the
+ * permit's `contractAddresses` (case-insensitive comparison).
+ */
+export function assertPermitV1IncludesContractAddresses(
+  permit: SignedDecryptionPermitV1,
+  contractAddresses: readonly string[],
+): void {
+  const permitAddresses = permit.eip712.message.contractAddresses;
+  for (const address of contractAddresses) {
+    if (!permitAddresses.some((a) => a.toLowerCase() === address.toLowerCase())) {
+      throw Error(`contract address ${address} is not listed in the permit's contractAddresses`);
+    }
+  }
+}
+
 ////////////////////////////////////////////////////////////////////////////////
-// fetchKmsSigncryptedShares
+// fetchKmsSigncryptedSharesV1
 ////////////////////////////////////////////////////////////////////////////////
 
-export async function fetchKmsSigncryptedShares(context: Context, parameters: Parameters): Promise<ReturnType> {
-  const { signedPermit, options, pairs } = parameters;
+export async function fetchKmsSigncryptedSharesV1(context: Context, parameters: Parameters): Promise<ReturnType> {
+  const { options, pairs } = parameters;
+  const signedPermit = parameters.signedPermit as SignedDecryptionPermitV1;
 
   // This helper must support base clients, where TKMS is not mandatory
   // and tkmsVersion may not be initialized in the CoreFhevm instance yet.
   const tkmsVersion = await resolveFhevmTkmsVersion(context);
 
   // Check: every requested contractAddress is listed in the permit
-  assertPermitIncludesContractAddresses(
+  assertPermitV1IncludesContractAddresses(
     signedPermit,
     pairs.map((p) => p.contractAddress),
   );
@@ -124,7 +119,7 @@ export async function fetchKmsSigncryptedShares(context: Context, parameters: Pa
   signedPermit.assertNotExpired();
 
   // 7. Check: ACL permissions (user is signer or delegatorAddress)
-  if (signedPermit.isDelegated) {
+  if (signedPermit.eip712.primaryType === 'DelegatedUserDecryptRequestVerification') {
     await checkDelegation(context, {
       aclAddress: context.chain.fhevm.contracts.acl.address as ChecksummedAddress,
       delegate: signerAddress,
@@ -139,7 +134,7 @@ export async function fetchKmsSigncryptedShares(context: Context, parameters: Pa
     });
   }
 
-  // 8. Verify the EIP712 signature
+  // 8. Verify the Eip712 signature
   // Not required because a signedPermit is guaranteed to be verified.
 
   // 9. Fetch `KmsSignersContext` on-chain (cached)
@@ -156,7 +151,7 @@ export async function fetchKmsSigncryptedShares(context: Context, parameters: Pa
   // (e.g. a version change in the serialization scheme) will be rejected even
   // though the context ID matches. Consider comparing the decoded `kmsContextId`
   // instead of the raw `extraData` bytes.
-  const requestedKmsSignersContext: KmsSignersContext = await readKmsSignersContext(context, {
+  const requestedKmsSignersContext: KmsSignersContext = await readCurrentKmsSignersContext(context, {
     kmsVerifierAddress: context.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
     protocolConfigAddress: context.chain.fhevm.contracts.protocolConfig?.address as ChecksummedAddress | undefined,
   });
@@ -170,12 +165,9 @@ export async function fetchKmsSigncryptedShares(context: Context, parameters: Pa
   );
 
   // 10. Fetch `KmsSigncryptedShares` from the relayer
-  // Safe casts: the discriminated union on parameters guarantees
-  // that options type matches signedPermit type, but TS can't prove
-  // it after destructuring (nested discriminant limitation).
   let shares: readonly KmsSigncryptedShare[];
 
-  if (signedPermit.isDelegated) {
+  if (signedPermit.eip712.primaryType === 'DelegatedUserDecryptRequestVerification') {
     shares = await context.runtime.relayer.fetchDelegatedUserDecrypt(context, {
       payload: {
         handleContractPairs,
@@ -210,6 +202,31 @@ export async function fetchKmsSigncryptedShares(context: Context, parameters: Pa
     tkmsVersion,
   };
 
+  /*
+
+    ----------------------------------------------------------------------------
+    KMS response-signature verification.
+
+    Each share's signature is an EIP-712 signature over the
+    `UserDecryptResponseVerification` struct (see `verifyKmsSigncryptedShare` and
+    gateway `Decryption.sol`). This check is already performed inside the tkms WASM
+    during reconstruction (verify=true); the call below is an equivalent JS-only
+    pass, kept for testing / debugging. To fully check, loop over every share.
+    ----------------------------------------------------------------------------
+
+    for (const share of shares) {
+      await verifyKmsSigncryptedShare(
+        context, 
+        {
+          metadata: sharesMetadata,
+          share,
+          transportPublicKey: signedPermit.transportPublicKey,
+        }
+      );
+    }
+
+  */
+
   // 12. The returned KmsSigncryptedShares is guaranteed to be fully verified:
   // uniform extraData across shares, valid extraData format, and consistency
   // with the KmsSignersContext (see KmsSigncryptedSharesImpl invariants).