@fhevm/sdk 1.1.0-alpha.6 → 1.1.0-alpha.8

package/core/kms/publicDecrypt.ts

@@ -1,13 +1,14 @@
 import type { RelayerPublicDecryptOptions } from '../types/relayer.js';
 import type { FhevmChain } from '../types/fhevmChain.js';
-import type { BytesHex, ChecksummedAddress, Uint64BigInt } from '../types/primitives.js';
+import type { ChecksummedAddress, Uint64BigInt } from '../types/primitives.js';
 import type { PublicDecryptionProof } from '../types/publicDecryptionProof-p.js';
 import type { KmsSignersContext } from '../types/kmsSignersContext.js';
 import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
 import type { Handle } from '../types/encryptedTypes-p.js';
+import type { KmsExtraData } from '../types/kms-p.js';
 import { assertHandlesBelongToSameChainId } from '../handle/FhevmHandle.js';
 import { assertKmsDecryptionBitLimit } from '../kms/utils.js';
-import { readKmsSignersContext, reconcileKmsSignersContext } from '../host-contracts/readKmsSignersContext-p.js';
+import { readCurrentKmsSignersContext, reconcileKmsSignersContext } from '../host-contracts/readKmsSignersContext-p.js';
 import { kmsSignersContextToExtraData } from '../host-contracts/KmsSignersContext-p.js';
 import { createPublicDecryptionProof } from '../kms/PublicDecryptionProof-p.js';
 import { checkAllowedForDecryption } from '../host-contracts/checkAllowedForDecryption.js';
@@ -38,12 +39,12 @@ export async function publicDecrypt(context: Context, parameters: Parameters): P
   // Contrary to the userDecrypt flow, the publicDecrypt doesn't require for an
   // EIP-712 signature from the user, so the SDK can safely fetch the current
   // context ID and build the extraData transparently to the user.
-  const requestedKmsSignersContext = await readKmsSignersContext(context, {
+  const requestedKmsSignersContext = await readCurrentKmsSignersContext(context, {
     kmsVerifierAddress: context.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
     protocolConfigAddress: context.chain.fhevm.contracts.protocolConfig?.address as ChecksummedAddress | undefined,
   });
 
-  const requestedExtraData: BytesHex = kmsSignersContextToExtraData(requestedKmsSignersContext);
+  const requestedExtraData: KmsExtraData = kmsSignersContextToExtraData(requestedKmsSignersContext);
 
   const orderedHandles = handles;
 
@@ -73,12 +74,12 @@ export async function publicDecrypt(context: Context, parameters: Parameters): P
   // 5. Call relayer
   const {
     orderedAbiEncodedClearValues,
-    kmsPublicDecryptEIP712Signatures,
-    extraData: relayerExtraData,
+    kmsPublicDecryptEip712Signatures,
+    extraData: relayerExtraDataBytesHex,
   } = await context.runtime.relayer.fetchPublicDecrypt(context, {
     payload: {
       orderedHandles,
-      extraData: requestedExtraData,
+      extraData: requestedExtraData.toBytesHex(),
     },
     options: relayerOptions,
   });
@@ -87,7 +88,7 @@ export async function publicDecrypt(context: Context, parameters: Parameters): P
   const reconciledKmsSignersContext: KmsSignersContext = await reconcileKmsSignersContext(context, {
     kmsVerifierAddress: context.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
     protocolConfigAddress: context.chain.fhevm.contracts.protocolConfig?.address as ChecksummedAddress | undefined,
-    relayerExtraData,
+    relayerKmsExtraDataBytesHex: relayerExtraDataBytesHex,
     requestedKmsSignersContext: requestedKmsSignersContext,
     mode: 'loose',
   });
@@ -97,7 +98,7 @@ export async function publicDecrypt(context: Context, parameters: Parameters): P
     originToken,
     orderedHandles: orderedHandles,
     orderedAbiEncodedClearValues,
-    kmsPublicDecryptEIP712Signatures,
+    kmsPublicDecryptEip712Signatures,
     kmsSignersContext: reconciledKmsSignersContext,
   });
 

package/core/kms/utils.ts

@@ -26,35 +26,3 @@ export function assertKmsDecryptionBitLimit(handles: readonly Handle[]): UintNum
 
   return total as UintNumber;
 }
-
-export function assertKmsEIP712DeadlineValidity(
-  {
-    startTimestamp,
-    durationDays,
-  }: {
-    startTimestamp: bigint | number | string;
-    durationDays: bigint | number | string;
-  },
-  maxDurationDays: UintNumber,
-): void {
-  if (durationDays === 0) {
-    throw Error('durationDays is zero');
-  }
-
-  const durationDaysBigInt = BigInt(durationDays);
-  if (durationDaysBigInt > BigInt(maxDurationDays)) {
-    throw Error(`durationDays is above max duration of ${maxDurationDays}`);
-  }
-
-  const startTimestampBigInt = BigInt(startTimestamp);
-
-  const currentTimestamp = BigInt(Math.floor(Date.now() / 1000));
-  if (startTimestampBigInt > currentTimestamp) {
-    throw Error('startTimestamp is set in the future');
-  }
-
-  const durationInSeconds = durationDaysBigInt * BigInt(24 * 60 * 60);
-  if (startTimestampBigInt + durationInSeconds < currentTimestamp) {
-    throw Error('request has expired');
-  }
-}

package/core/kms/verifyKmsPublicDecryptEip712-p.ts

@@ -4,10 +4,12 @@ import type { KmsPublicDecryptEip712Message } from '../types/kms.js';
 import type { KmsSignersContext } from '../types/kmsSignersContext.js';
 import type { Bytes32Hex, Bytes65Hex, BytesHex } from '../types/primitives.js';
 import type { Handle } from '../types/encryptedTypes-p.js';
+import type { KmsExtraData } from '../types/kms-p.js';
 import { recoverSigners } from '../utils-p/runtime/recoverSigners.js';
 import { assertKmsSignerThreshold, kmsSignersContextToExtraData } from '../host-contracts/KmsSignersContext-p.js';
 import { createKmsEip712Domain } from './createKmsEip712Domain.js';
 import { kmsPublicDecryptEip712Types } from './kmsPublicDecryptEip712Types.js';
+import { EXTRA_DATA_V0 } from './kmsExtraData-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -19,7 +21,7 @@ type Context = {
 type Parameters = {
   readonly orderedHandles: readonly Handle[];
   readonly orderedAbiEncodedClearValues: BytesHex;
-  readonly kmsPublicDecryptEIP712Signatures: readonly Bytes65Hex[];
+  readonly kmsPublicDecryptEip712Signatures: readonly Bytes65Hex[];
   readonly kmsSignersContext: KmsSignersContext;
 };
 
@@ -28,18 +30,18 @@ type Parameters = {
 export async function verifyKmsPublicDecryptEip712(context: Context, parameters: Parameters): Promise<void> {
   const { kmsSignersContext, orderedHandles: orderedEncryptedValues, orderedAbiEncodedClearValues } = parameters;
 
-  // TODO:  use createKmsPublicDecryptEIP712 instead!
+  // TODO:  use createKmsPublicDecryptEip712 instead!
 
-  const extraData: BytesHex = kmsSignersContextToExtraData(kmsSignersContext);
+  const extraData: KmsExtraData = kmsSignersContextToExtraData(kmsSignersContext);
 
   ////////////////////////////////////////////////////////////////////////////
   //
   // Warning!!!! Do not use '0x00' here!! Only '0x' is permitted!
   //
   ////////////////////////////////////////////////////////////////////////////
-  let signedExtraData: BytesHex = extraData;
-  if (extraData === ('0x00' as BytesHex)) {
-    signedExtraData = '0x' as BytesHex;
+  let signedExtraDataBytesHex: BytesHex = extraData.toBytesHex();
+  if (extraData.version === EXTRA_DATA_V0) {
+    signedExtraDataBytesHex = '0x' as BytesHex;
   }
 
   const handlesBytes32Hex: readonly Bytes32Hex[] = orderedEncryptedValues.map((h) => h.bytes32Hex);
@@ -47,7 +49,7 @@ export async function verifyKmsPublicDecryptEip712(context: Context, parameters:
   const message: KmsPublicDecryptEip712Message = {
     ctHandles: handlesBytes32Hex,
     decryptedResult: orderedAbiEncodedClearValues,
-    extraData: signedExtraData,
+    extraData: signedExtraDataBytesHex,
   };
 
   //////////////////////////////////////////////////////////////////////////////
@@ -66,7 +68,7 @@ export async function verifyKmsPublicDecryptEip712(context: Context, parameters:
     domain,
     types: kmsPublicDecryptEip712Types,
     primaryType: 'PublicDecryptVerification',
-    signatures: parameters.kmsPublicDecryptEIP712Signatures,
+    signatures: parameters.kmsPublicDecryptEip712Signatures,
     message,
   });
 

package/core/modules/decrypt/mock.ts

@@ -17,12 +17,12 @@ import type { TkmsPrivateKey } from '../../types/tkms-p.js';
 import type { BytesHex } from '../../types/primitives.js';
 import type { KmsSigncryptedShare, KmsSigncryptedSharesMetadata } from '../../types/kms-p.js';
 import type { ClearValue } from '../../types/encryptedTypes-p.js';
-import { assertIsKmsExtraData } from '../../kms/kmsExtraData.js';
 import { ensure0x, remove0x } from '../../base/string.js';
 import { getMetadata, getShares } from '../../kms/KmsSigncryptedShares-p.js';
 import { asBytesHex, bytesToHex, hexToBytes } from '../../base/bytes.js';
 import { bigintToClearValueType } from '../../handle/FheType.js';
 import { createClearValue } from '../../handle/ClearValue.js';
+import { assertIsKmsExtraDataBytesHex } from '../../kms/kmsExtraData-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -71,8 +71,8 @@ export async function decryptAndReconstruct(
     }
   }
 
-  const extraData: BytesHex = ensure0x(firstExtraData);
-  assertIsKmsExtraData(extraData, {});
+  const extraDataBytesHex: BytesHex = ensure0x(firstExtraData);
+  assertIsKmsExtraDataBytesHex(extraDataBytesHex, {});
 
   for (let i = 0; i < sharesArray.length; ++i) {
     const s = sharesArray[i];
@@ -100,13 +100,13 @@ export async function decryptAndReconstruct(
   }
 
   const maskedCleartexts = decoded[0] as bigint[];
-  const signedExtraData = decoded[1] as BytesHex;
+  const signedExtraDataBytesHex = decoded[1] as BytesHex;
 
   const cleartexts: bigint[] = _xorUnmaskWithPublicKey(publicKeySecp256k1, maskedCleartexts);
 
-  if (extraData !== signedExtraData) {
+  if (extraDataBytesHex !== signedExtraDataBytesHex) {
     throw new Error(
-      `extraData mismatch: share extraData="${extraData}" does not match the signed payload's extraData="${signedExtraData}".`,
+      `extraData mismatch: share extraData="${extraDataBytesHex}" does not match the signed payload's extraData="${signedExtraDataBytesHex}".`,
     );
   }
 

package/core/modules/decrypt/module/api-p.ts

@@ -31,10 +31,10 @@ import { uint32ToBytes32 } from '../../../base/uint.js';
 import { createClearValue } from '../../../handle/ClearValue.js';
 import { bytesToClearValueType } from '../../../handle/FheType.js';
 import { ensure0x, remove0x } from '../../../base/string.js';
-import { assertIsKmsExtraData } from '../../../kms/kmsExtraData.js';
 import { bytesToHexLarge } from '../../../base/bytes.js';
 import { initTkmsModule } from './init-p.js';
 import { getMetadata, getShares } from '../../../kms/KmsSigncryptedShares-p.js';
+import { assertIsKmsExtraDataBytesHex } from '../../../kms/kmsExtraData-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -76,7 +76,7 @@ type TypedPlaintextWasmType = TypedPlaintext & {
   readonly [__TypedPlaintextWasm]: never;
 };
 
-type KmsEIP712DomainWasmType = Readonly<
+type KmsEip712DomainWasmType = Readonly<
   Omit<KmsEip712Domain, 'chainId' | 'verifyingContract'> & {
     readonly chain_id: Uint8Array;
     readonly verifying_contract: ChecksummedAddress;
@@ -256,18 +256,18 @@ export async function decryptAndReconstruct(
     throw new Error('Expected at least one signcrypted share.');
   }
 
-  const firstExtraData = firstShare.extraData;
+  const firstExtraDataBytesHex = firstShare.extraData;
   for (let i = 1; i < sharesArray.length; i++) {
     const share = sharesArray[i];
-    if (share !== undefined && share.extraData !== firstExtraData) {
+    if (share !== undefined && share.extraData !== firstExtraDataBytesHex) {
       throw new Error(
-        `Mismatched extraData across shares: share[0]="${firstExtraData}" vs share[${i}]="${share.extraData}".`,
+        `Mismatched extraData across shares: share[0]="${firstExtraDataBytesHex}" vs share[${i}]="${share.extraData}".`,
       );
     }
   }
 
-  const extraData: BytesHex = ensure0x(firstExtraData);
-  assertIsKmsExtraData(extraData, {});
+  const extraDataBytesHex: BytesHex = ensure0x(firstExtraDataBytesHex);
+  assertIsKmsExtraDataBytesHex(extraDataBytesHex, {});
 
   const aggRespWasmArg: ReadonlyArray<Omit<KmsSigncryptedShare, 'extraData'> & { extra_data: BytesHexNo0x }> =
     sharesArray.map((s) => {
@@ -297,16 +297,16 @@ export async function decryptAndReconstruct(
     kmsLib,
   );
 
-  // KmsEIP712Domain
-  const kmsEIP712Domain: KmsEip712Domain = metadata.eip712Domain;
+  // KmsEip712Domain
+  const kmsEip712Domain: KmsEip712Domain = metadata.eip712Domain;
   const clientAddress: ChecksummedAddress = metadata.eip712SignerAddress;
 
   // To be modified! use uint64ToBytes32 instead
-  const eip712DomainWasmArg: KmsEIP712DomainWasmType = {
-    name: kmsEIP712Domain.name,
-    version: kmsEIP712Domain.version,
-    chain_id: uint32ToBytes32(kmsEIP712Domain.chainId), // gateway chainId
-    verifying_contract: kmsEIP712Domain.verifyingContract,
+  const eip712DomainWasmArg: KmsEip712DomainWasmType = {
+    name: kmsEip712Domain.name,
+    version: kmsEip712Domain.version,
+    chain_id: uint32ToBytes32(kmsEip712Domain.chainId), // gateway chainId
+    verifying_contract: kmsEip712Domain.verifyingContract,
     salt: null,
   };
 
@@ -333,7 +333,7 @@ export async function decryptAndReconstruct(
     enc_key: remove0x(publicEncKeyMlKem512WasmBytesHex),
     ciphertext_handles: metadata.handles.map((h) => h.bytes32HexNo0x),
     eip712_verifying_contract: metadata.eip712Domain.verifyingContract,
-    extra_data: remove0x(extraData),
+    extra_data: remove0x(extraDataBytesHex),
   };
 
   //

package/core/modules/decrypt/module/init-p.ts

@@ -90,21 +90,21 @@ async function _resolveKmsAssets(
 function _logResolvedKmsAssets(resolvedAssets: ResolvedKmsAssets, logger: FhevmRuntimeConfig['logger']): void {
   const { wasm } = resolvedAssets;
   if (wasm.resolution === 'user') {
-    logger?.debug(`resolve tkms wasm filename using 'locateFile' function: ${wasm.filename} -> url: ${wasm.url}`);
+    logger?.debug?.(`resolve tkms wasm filename using 'locateFile' function: ${wasm.filename} -> url: ${wasm.url}`);
   } else if (wasm.resolution === 'node') {
     if (wasm.url === undefined) {
       // Auto-derived assets were missing on disk (e.g. a bundler such as Turbopack
       // relocated the package) and were cleared by _resolveTkmsAssets -> base64.
-      logger?.debug(
+      logger?.debug?.(
         `tkms auto-derived assets not found on disk (bundler relocation?); using embedded base64 ` +
           `(wasm: ${wasm.localRelativePath})`,
       );
     } else {
-      logger?.debug(`resolve tkms wasm local path: ${wasm.localRelativePath} -> url: ${wasm.url}`);
+      logger?.debug?.(`resolve tkms wasm local path: ${wasm.localRelativePath} -> url: ${wasm.url}`);
     }
   } else {
     // 'none': browser zero-config (no 'locateFile', not Node) -> embedded base64.
-    logger?.debug(`resolve tkms assets using embedded base64 (browser, no 'locateFile')`);
+    logger?.debug?.(`resolve tkms assets using embedded base64 (browser, no 'locateFile')`);
   }
 }
 
@@ -170,7 +170,7 @@ async function _resolveTkmsModuleConfig(
     logger: parameters.logger,
   };
 
-  parameters.logger?.debug(JSON.stringify(cfg, null, 2));
+  //parameters.logger?.debug?.(JSON.stringify(cfg, null, 2));
 
   return cfg;
 }
@@ -226,11 +226,11 @@ async function _compileWasmModule(cfg: ResolvedTkmsModuleConfig): Promise<WebAss
   let wasmModule;
 
   if (cfg.assets.wasm.url !== undefined) {
-    cfg.logger?.debug(`compile tkms verified wasm at: ${cfg.assets.wasm.url}`);
+    cfg.logger?.debug?.(`compile tkms verified wasm at: ${cfg.assets.wasm.url}`);
     wasmModule = await isomorphicCompileVerifiedWasm(cfg.assets.wasm.url, cfg.assets.wasm.sha256);
   } else {
     const { tkmsWasmBase64, tkmsWasmBase64CompressionFormat } = await loadKmsWasmBase64(cfg.version);
-    cfg.logger?.debug(
+    cfg.logger?.debug?.(
       `compile tkms wasm from embedded base64 (compression:${tkmsWasmBase64CompressionFormat ?? 'none'})`,
     );
     wasmModule = await isomorphicCompileWasmFromBase64(tkmsWasmBase64, tkmsWasmBase64CompressionFormat);

package/core/modules/encrypt/module/init-p.ts

@@ -208,23 +208,25 @@ async function _resolveTfheAssets(
 function _logResolvedTfheAssets(resolvedAssets: ResolvedTfheAssets, logger: FhevmRuntimeConfig['logger']): void {
   const { wasm, worker } = resolvedAssets;
   if (wasm.resolution === 'user') {
-    logger?.debug(`resolve tfhe wasm filename using 'locateFile' function: ${wasm.filename} -> url: ${wasm.url}`);
-    logger?.debug(`resolve tfhe worker filename using 'locateFile' function: ${worker.filename} -> url: ${worker.url}`);
+    logger?.debug?.(`resolve tfhe wasm filename using 'locateFile' function: ${wasm.filename} -> url: ${wasm.url}`);
+    logger?.debug?.(
+      `resolve tfhe worker filename using 'locateFile' function: ${worker.filename} -> url: ${worker.url}`,
+    );
   } else if (wasm.resolution === 'node') {
     if (wasm.url === undefined) {
       // Auto-derived assets were missing on disk (e.g. a bundler such as Turbopack
       // relocated the package) and were cleared by _resolveTfheAssets -> base64.
-      logger?.debug(
+      logger?.debug?.(
         `tfhe auto-derived assets not found on disk (bundler relocation?); using embedded base64 ` +
           `(wasm: ${wasm.localRelativePath}, worker: ${worker.localRelativePath})`,
       );
     } else {
-      logger?.debug(`resolve tfhe wasm local path: ${wasm.localRelativePath} -> url: ${wasm.url}`);
-      logger?.debug(`resolve tfhe worker local path: ${worker.localRelativePath} -> url: ${worker.url}`);
+      logger?.debug?.(`resolve tfhe wasm local path: ${wasm.localRelativePath} -> url: ${wasm.url}`);
+      logger?.debug?.(`resolve tfhe worker local path: ${worker.localRelativePath} -> url: ${worker.url}`);
     }
   } else {
     // 'none': browser zero-config (no 'locateFile', not Node) -> embedded base64.
-    logger?.debug(`resolve tfhe assets using embedded base64 (browser, no 'locateFile')`);
+    logger?.debug?.(`resolve tfhe assets using embedded base64 (browser, no 'locateFile')`);
   }
 }
 
@@ -475,7 +477,10 @@ async function _resolveTfheModuleConfig(
     // Single source of truth for browser-vs-Node, resolved on the main thread
     // (robust to bundler `process` shims) — the worker bootstrap no longer detects it.
     isBrowserLike: isBrowserLike(),
-    logger: parameters.logger,
+    logger:
+      parameters.logger?.debug !== undefined && parameters.logger.error !== undefined
+        ? { debug: parameters.logger.debug, error: parameters.logger.error }
+        : undefined,
   });
 
   const cfg = {
@@ -488,7 +493,7 @@ async function _resolveTfheModuleConfig(
     supportsThreads,
   };
 
-  parameters.logger?.debug(JSON.stringify(cfg, null, 2));
+  //parameters.logger?.debug?.(JSON.stringify(cfg, null, 2));
 
   return cfg;
 }
@@ -572,11 +577,11 @@ async function _compileWasmModule(cfg: ResolvedTfheModuleConfig): Promise<WebAss
   let wasmModule;
 
   if (cfg.assets.wasm.url !== undefined) {
-    cfg.logger?.debug(`compile verified wasm at: ${cfg.assets.wasm.url}`);
+    cfg.logger?.debug?.(`compile verified wasm at: ${cfg.assets.wasm.url}`);
     wasmModule = await isomorphicCompileVerifiedWasm(cfg.assets.wasm.url, cfg.assets.wasm.sha256);
   } else {
     const { tfheWasmBase64, tfheWasmBase64CompressionFormat } = await loadTfheWasmBase64(cfg.version);
-    cfg.logger?.debug(`compile wasm from embedded base64 (compression:${tfheWasmBase64CompressionFormat ?? 'none'})`);
+    cfg.logger?.debug?.(`compile wasm from embedded base64 (compression:${tfheWasmBase64CompressionFormat ?? 'none'})`);
     wasmModule = await isomorphicCompileWasmFromBase64(tfheWasmBase64, tfheWasmBase64CompressionFormat);
   }
 
@@ -599,7 +604,7 @@ async function _initTfheModule(cfg: ResolvedTfheModuleConfig): Promise<TfheLibAp
 
   // 4. Spawn Web Workers for parallel FHE operations (skipped when single-threaded)
   if (!cfg.singleThread) {
-    cfg.logger?.debug(`initThreadPool(${cfg.numberOfThreads})`);
+    cfg.logger?.debug?.(`initThreadPool(${cfg.numberOfThreads})`);
     await tfheLib.initThreadPool(cfg.numberOfThreads);
   }
 

package/core/modules/ethereum/types-ct.ts

@@ -1,4 +1,4 @@
-import type { Bytes65Hex, BytesHex, ChecksummedAddress } from '../../types/primitives.js';
+import type { Bytes32Hex, Bytes65Hex, BytesHex, ChecksummedAddress, Uint256 } from '../../types/primitives.js';
 import type { Prettify } from '../../types/utils.js';
 import type { EthereumModule } from './types.js';
 
@@ -32,6 +32,28 @@ export type SignModuleFunction = {
   sign(parameters: SignParameters): Promise<SignReturnType>;
 };
 
+////////////////////////////////////////////////////////////////////////////////
+// hashTypedData
+////////////////////////////////////////////////////////////////////////////////
+
+export type HashTypedDataParameters = Readonly<{
+  domain: {
+    readonly chainId: Uint256;
+    readonly name: string;
+    readonly verifyingContract: ChecksummedAddress;
+    readonly version: string;
+  };
+  types: Readonly<Record<string, ReadonlyArray<{ name: string; type: string }>>>;
+  primaryType: string;
+  message: Readonly<Record<string, unknown>>;
+}>;
+
+export type HashTypedDataReturnType = Bytes32Hex;
+
+export type HashTypedDataModuleFunction = {
+  hashTypedData(parameters: HashTypedDataParameters): HashTypedDataReturnType;
+};
+
 ////////////////////////////////////////////////////////////////////////////////
 // generatePrivateKey
 ////////////////////////////////////////////////////////////////////////////////
@@ -81,7 +103,8 @@ export type CleartextEthereumModule = EthereumModule &
       SignModuleFunction &
       GeneratePrivateKeyModuleFunction &
       GetPublicKeyModuleFunction &
-      RecoverAddressModuleFunction
+      RecoverAddressModuleFunction &
+      HashTypedDataModuleFunction
   >;
 
 export type CleartextEthereumModuleFactory = () => {

package/core/modules/relayer/cleartext/fetchCoprocessorSignatures.ts

@@ -1,22 +1,23 @@
-import type { Bytes65Hex, BytesHex, ChecksummedAddress } from '../../../types/primitives.js';
+import type { Bytes65Hex, BytesHex, ChecksummedAddress, Uint32BigInt } from '../../../types/primitives.js';
 import type { CleartextEthereumModule } from '../../ethereum/types-ct.js';
 import type {
   FetchCoprocessorSignaturesParameters,
   FetchCoprocessorSignaturesReturnType,
   RelayerClientWithRuntime,
 } from '../types.js';
-import { asUint32BigInt, randomUniqueUints } from '../../../base/uint.js';
+import type { CoprocessorSignersContext } from '../../../types/coprocessorSignersContext.js';
+import { asUint32BigInt, asUint64BigInt, randomUniqueUints } from '../../../base/uint.js';
 import { getTrustedClient } from '../../../runtime/CoreFhevm-p.js';
 import { getCoprocessorSignersPrivateKeyMap } from './signers.js';
+import { isForgeFhevmV1 } from './forgeFhevmV1.js';
+import { createCoprocessorEip712Domain } from '../../../coprocessor/createCoprocessorEip712Domain.js';
+import { coprocessorEip712PrimaryType, coprocessorEip712Types } from '../../../coprocessor/coprocessorEip712Types.js';
+import { readCoprocessorSignersContext } from '../../../host-contracts/readCoprocessorSignersContext-p.js';
 
-/*
-export type FetchCoprocessorSignaturesReturnType = {
-  readonly handles: readonly InputHandle[];
-  readonly coprocessorEip712Signatures: readonly Bytes65Hex[];
-  readonly extraData: BytesHex;
-};
+////////////////////////////////////////////////////////////////////////////////
+// runInputProofOnChain
+////////////////////////////////////////////////////////////////////////////////
 
-*/
 const inputProofAbi = [
   {
     type: 'function',
@@ -44,13 +45,14 @@ const inputProofAbi = [
   },
 ] as const;
 
-export async function fetchCoprocessorSignatures(
+async function runInputProofOnChain(
   relayerClient: RelayerClientWithRuntime,
-  parameters: FetchCoprocessorSignaturesParameters,
-): Promise<FetchCoprocessorSignaturesReturnType> {
-  const cleartextEthereumModule = relayerClient.runtime.ethereum as CleartextEthereumModule;
-  const { payload } = parameters;
-
+  payload: FetchCoprocessorSignaturesParameters['payload'],
+): Promise<{
+  readonly digest: BytesHex;
+  readonly signersAddress: readonly ChecksummedAddress[];
+  readonly threshold: Uint32BigInt;
+}> {
   const trustedClient = getTrustedClient(relayerClient);
   const res = (await relayerClient.runtime.ethereum.readContract(trustedClient, {
     abi: inputProofAbi,
@@ -67,6 +69,87 @@ export async function fetchCoprocessorSignatures(
   const digest = res[0] as BytesHex;
   const signersAddress = res[1] as ChecksummedAddress[];
   const threshold = asUint32BigInt(res[2]);
+
+  return {
+    digest,
+    signersAddress,
+    threshold,
+  };
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// runInputProofOffChain
+////////////////////////////////////////////////////////////////////////////////
+
+async function runInputProofOffChain(
+  relayerClient: RelayerClientWithRuntime,
+  payload: FetchCoprocessorSignaturesParameters['payload'],
+): Promise<{
+  readonly digest: BytesHex;
+  readonly signersAddress: readonly ChecksummedAddress[];
+  readonly threshold: Uint32BigInt;
+}> {
+  const cleartextEthereumModule = relayerClient.runtime.ethereum as CleartextEthereumModule;
+  const { zkProof } = payload;
+
+  // Read the coprocessor signer set + threshold from the InputVerifier's on-chain
+  // storage. In the forge-fhevm-v1 setup only the `inputProof` view is missing;
+  // the signers/threshold and the EIP-712 material are still readable, so we
+  // recompute the digest off-chain below (mirroring CleartextInputVerifier.inputProof).
+  const coprocessorSignersContext: CoprocessorSignersContext = await readCoprocessorSignersContext(relayerClient, {
+    address: relayerClient.chain.fhevm.contracts.inputVerifier.address as ChecksummedAddress,
+  });
+
+  // The 'InputVerification' domain uses the gateway chainId + gateway
+  // inputVerification address (same as verifyHandlesCoprocessorSignatures).
+  const domain = createCoprocessorEip712Domain({
+    gatewayChainId: relayerClient.chain.fhevm.gateway.id,
+    verifyingContractAddressInputVerification: relayerClient.chain.fhevm.gateway.contracts.inputVerification.address,
+  });
+
+  // Mirror CleartextInputVerifier.inputProof: hash the CiphertextVerification
+  // struct with contractChainId = block.chainid (the host chain), and extraData
+  // taken verbatim from the ZK proof (as the on-chain view would receive it).
+  const digest: BytesHex = cleartextEthereumModule.hashTypedData({
+    domain,
+    types: coprocessorEip712Types,
+    primaryType: coprocessorEip712PrimaryType,
+    message: {
+      ctHandles: zkProof.getInputHandles().map((h) => h.bytes32Hex),
+      userAddress: zkProof.userAddress,
+      contractAddress: zkProof.contractAddress,
+      contractChainId: asUint64BigInt(BigInt(relayerClient.chain.id)),
+      extraData: zkProof.getExtraData(),
+    },
+  });
+
+  return {
+    digest,
+    signersAddress: coprocessorSignersContext.signers,
+    threshold: asUint32BigInt(BigInt(coprocessorSignersContext.threshold)),
+  };
+}
+
+export async function fetchCoprocessorSignatures(
+  relayerClient: RelayerClientWithRuntime,
+  parameters: FetchCoprocessorSignaturesParameters,
+): Promise<FetchCoprocessorSignaturesReturnType> {
+  const cleartextEthereumModule = relayerClient.runtime.ethereum as CleartextEthereumModule;
+  const { payload } = parameters;
+
+  const offChain = await isForgeFhevmV1(relayerClient);
+
+  let res;
+  if (offChain) {
+    res = await runInputProofOffChain(relayerClient, payload);
+  } else {
+    res = await runInputProofOnChain(relayerClient, payload);
+  }
+
+  const digest = res.digest;
+  const signersAddress = res.signersAddress;
+  const threshold = res.threshold;
+
   const signers = getCoprocessorSignersPrivateKeyMap(relayerClient);
 
   const randomSignersAddress = randomUniqueUints(signersAddress.length, Number(threshold)).map(