@fhevm/sdk 1.1.0-alpha.6 → 1.1.0-alpha.8

package/core/modules/relayer/cleartext/fetchUserDecryptV1.ts

@@ -0,0 +1,229 @@
+import type { BytesHex, ChecksummedAddress, Uint32BigInt } from '../../../types/primitives.js';
+import type { FetchUserDecryptResultItem } from '../../../types/relayer.js';
+import type { CleartextEthereumModule } from '../../ethereum/types-ct.js';
+import type { FetchUserDecryptParametersV1, FetchUserDecryptReturnType, RelayerClientWithRuntime } from '../types.js';
+import type { KmsSignersContext } from '../../../types/kmsSignersContext.js';
+import { remove0x } from '../../../base/string.js';
+import { asUint32BigInt, tryParseUintBigIntString, randomUniqueUints } from '../../../base/uint.js';
+import { getTrustedClient } from '../../../runtime/CoreFhevm-p.js';
+import { userDecryptResultToKmsSigncryptedShares } from '../utils.js';
+import { getKmsSignersPrivateKeyMap } from './signers.js';
+import { readCurrentKmsSignersContext } from '../../../host-contracts/readKmsSignersContext-p.js';
+import { isForgeFhevmV1, readPlaintexts, xorMaskWithPublicKey } from './forgeFhevmV1.js';
+
+////////////////////////////////////////////////////////////////////////////////
+// runUserDecryptOffChain
+////////////////////////////////////////////////////////////////////////////////
+
+async function runUserDecryptOffChain(
+  relayerClient: RelayerClientWithRuntime,
+  payload: FetchUserDecryptParametersV1['payload'],
+): Promise<{
+  readonly commonKmsSigncryptedSharePayload: BytesHex;
+  readonly signersAddress: readonly ChecksummedAddress[];
+  readonly threshold: Uint32BigInt;
+  readonly extraData: BytesHex;
+}> {
+  const { kmsDecryptEip712Message } = payload;
+  const pairs = payload.handleContractPairs;
+  const trustedClient = getTrustedClient(relayerClient);
+
+  const rawCleartexts = await readPlaintexts(
+    relayerClient,
+    trustedClient,
+    pairs.map((p) => p.handle),
+  );
+
+  const currentKmsSignersContext: KmsSignersContext = await readCurrentKmsSignersContext(relayerClient, {
+    kmsVerifierAddress: relayerClient.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
+    protocolConfigAddress: relayerClient.chain.fhevm.contracts.protocolConfig?.address as
+      | ChecksummedAddress
+      | undefined,
+  });
+  const signersAddress = currentKmsSignersContext.signers;
+  const threshold = currentKmsSignersContext.threshold;
+
+  const maskedCleartexts = xorMaskWithPublicKey(kmsDecryptEip712Message.publicKey, rawCleartexts);
+
+  // extraData: the permit's message.extraData is already asserted equal to the
+  // current KmsSignersContext extraData by the caller (fetchKmsSigncryptedSharesV1
+  // step 9), so reusing it keeps the shares consistent with that context.
+  const extraData = kmsDecryptEip712Message.extraData;
+
+  const commonKmsSigncryptedSharePayload = relayerClient.runtime.ethereum.encode({
+    types: ['uint256[]', 'bytes'],
+    values: [maskedCleartexts, extraData],
+  });
+
+  return {
+    signersAddress,
+    threshold: BigInt(threshold) as Uint32BigInt,
+    commonKmsSigncryptedSharePayload,
+    extraData,
+  };
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// runUserDecryptOnChain
+////////////////////////////////////////////////////////////////////////////////
+
+const userDecryptAbi = [
+  {
+    type: 'function',
+    name: 'userDecrypt',
+    inputs: [
+      {
+        name: 'pairs',
+        type: 'tuple[]',
+        internalType: 'struct HandleContractPair[]',
+        components: [
+          { name: 'handle', type: 'bytes32', internalType: 'bytes32' },
+          {
+            name: 'contractAddress',
+            type: 'address',
+            internalType: 'address',
+          },
+        ],
+      },
+      { name: 'userAddress', type: 'address', internalType: 'address' },
+      { name: 'publicKey', type: 'bytes', internalType: 'bytes' },
+      {
+        name: 'contractAddresses',
+        type: 'address[]',
+        internalType: 'address[]',
+      },
+      {
+        name: 'startTimestamp',
+        type: 'uint256',
+        internalType: 'uint256',
+      },
+      {
+        name: 'durationDays',
+        type: 'uint256',
+        internalType: 'uint256',
+      },
+      { name: 'userSignature', type: 'bytes', internalType: 'bytes' },
+    ],
+    outputs: [
+      { name: 'payload', type: 'bytes', internalType: 'bytes' },
+      { name: 'signers', type: 'address[]', internalType: 'address[]' },
+      { name: 'threshold', type: 'uint256', internalType: 'uint256' },
+      { name: 'extraData', type: 'bytes', internalType: 'bytes' },
+    ],
+    stateMutability: 'view',
+  },
+] as const;
+
+async function runUserDecryptOnChain(
+  relayerClient: RelayerClientWithRuntime,
+  payload: FetchUserDecryptParametersV1['payload'],
+): Promise<{
+  readonly commonKmsSigncryptedSharePayload: BytesHex;
+  readonly signersAddress: readonly ChecksummedAddress[];
+  readonly threshold: Uint32BigInt;
+  readonly extraData: BytesHex;
+}> {
+  const { kmsDecryptEip712Message, kmsDecryptEip712Signer, kmsDecryptEip712Signature } = payload;
+  const pairs = payload.handleContractPairs;
+  const trustedClient = getTrustedClient(relayerClient);
+  const res = (await relayerClient.runtime.ethereum.readContract(trustedClient, {
+    abi: userDecryptAbi,
+    address: relayerClient.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
+    args: [
+      pairs.map((p) => ({
+        handle: p.handle.bytes32Hex,
+        contractAddress: p.contractAddress,
+      })),
+      kmsDecryptEip712Signer,
+      kmsDecryptEip712Message.publicKey,
+      kmsDecryptEip712Message.contractAddresses,
+      _parseUintBigIntString('kmsDecryptEip712Message.startTimestamp', kmsDecryptEip712Message.startTimestamp),
+      _parseUintBigIntString('kmsDecryptEip712Message.durationDays', kmsDecryptEip712Message.durationDays),
+      kmsDecryptEip712Signature,
+    ],
+    functionName: userDecryptAbi[0].name,
+  })) as unknown[];
+
+  const commonKmsSigncryptedSharePayload = res[0] as BytesHex;
+  const signersAddress = res[1] as readonly ChecksummedAddress[];
+  const threshold = asUint32BigInt(res[2]);
+  const extraData = res[3] as BytesHex;
+
+  return {
+    commonKmsSigncryptedSharePayload,
+    signersAddress,
+    threshold,
+    extraData,
+  };
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+export async function fetchUserDecryptV1(
+  relayerClient: RelayerClientWithRuntime,
+  parameters: FetchUserDecryptParametersV1,
+): Promise<FetchUserDecryptReturnType> {
+  const cleartextEthereumModule = relayerClient.runtime.ethereum as CleartextEthereumModule;
+  const { payload } = parameters;
+  const pairs = payload.handleContractPairs;
+  const contractAddresses = payload.kmsDecryptEip712Message.contractAddresses;
+
+  const authCount = contractAddresses.length;
+  for (const { contractAddress: c } of pairs) {
+    let authorized: boolean = false;
+    for (let i = 0; i < authCount; ++i) {
+      if (contractAddresses[i] == c) {
+        authorized = true;
+        break;
+      }
+    }
+    if (!authorized) {
+      throw new Error(`ContractAddressNotAuthorized: ${c} is not in the EIP-712 authorized contractAddresses list.`);
+    }
+  }
+
+  const offChain = await isForgeFhevmV1(relayerClient);
+
+  let res;
+  if (offChain) {
+    res = await runUserDecryptOffChain(relayerClient, payload);
+  } else {
+    res = await runUserDecryptOnChain(relayerClient, payload);
+  }
+
+  const commonKmsSigncryptedSharePayload = res.commonKmsSigncryptedSharePayload;
+  const extraData = res.extraData;
+  const threshold = res.threshold;
+  const signersAddress = res.signersAddress;
+
+  const signers = getKmsSignersPrivateKeyMap(relayerClient);
+
+  const randomSignersAddress = randomUniqueUints(signersAddress.length, Number(threshold)).map(
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    (i) => signersAddress[i]!,
+  );
+
+  const result: FetchUserDecryptResultItem[] = [];
+
+  for (const signerAddress of randomSignersAddress) {
+    const privateKey = signers.get(signerAddress);
+    if (privateKey === undefined) {
+      throw new Error(`Unable to find KMS signer for address ${signerAddress}`);
+    }
+
+    const signature = await cleartextEthereumModule.sign({ hash: commonKmsSigncryptedSharePayload, privateKey });
+    result.push({ signature: remove0x(signature), payload: remove0x(commonKmsSigncryptedSharePayload), extraData });
+  }
+
+  return userDecryptResultToKmsSigncryptedShares(result);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+function _parseUintBigIntString(label: string, value: string): bigint {
+  const bn = tryParseUintBigIntString(value);
+  if (bn === undefined) {
+    throw new Error(`${label} is not a valid uint string, got ${JSON.stringify(value)}`);
+  }
+  return bn;
+}

package/core/modules/relayer/cleartext/fetchUserDecryptV2.ts

@@ -0,0 +1,11 @@
+import type { FetchUserDecryptParametersV2, FetchUserDecryptReturnType, RelayerClientWithRuntime } from '../types.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+// eslint-disable-next-line @typescript-eslint/require-await
+export async function fetchUserDecryptV2(
+  _relayerClient: RelayerClientWithRuntime,
+  _parameters: FetchUserDecryptParametersV2,
+): Promise<FetchUserDecryptReturnType> {
+  throw new Error('Not yet implemented');
+}

package/core/modules/relayer/cleartext/forgeFhevmV1.ts

@@ -0,0 +1,185 @@
+import type { Address, BytesHex, ChecksummedAddress } from '../../../types/primitives.js';
+import type { Handle } from '../../../types/encryptedTypes-p.js';
+import type { CleartextEthereumModule } from '../../ethereum/types-ct.js';
+import type { TrustedClient } from '../../ethereum/types.js';
+import type { RelayerClientWithRuntime } from '../types.js';
+import type { KmsSignersContext } from '../../../types/kmsSignersContext.js';
+import { remove0x } from '../../../base/string.js';
+import { addressToChecksummedAddress } from '../../../base/address.js';
+import { createCachedFetch } from '../../../base/cachedFetch.js';
+import { getFHEVMExecutorAddressAbi } from '../../../host-contracts/abi-fragments/fragments.js';
+import { readCurrentKmsSignersContext } from '../../../host-contracts/readKmsSignersContext-p.js';
+import { isForgeFhevmV1KmsSigner } from './signers.js';
+
+////////////////////////////////////////////////////////////////////////////////
+//
+// Option B — cleartext "disabled KMSVerifier" plaintext source.
+//
+// The cleartext mock relayer used to read masked cleartexts + the KMS payload
+// from the `Cleartext*KMSVerifier` view. That view required the full `Cleartext*`
+// host set, which partners deploying only forge-fhevm do not have. Instead we
+// read the raw plaintext straight from `CleartextFHEVMExecutor.plaintexts` (the
+// mapping forge-fhevm populates) and rebuild the KMS wire format off-chain,
+// reusing the already-local KMS signing. Only the *plaintext source* moves;
+// everything downstream (masking, signing, reconstruct) is unchanged.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+// CleartextFHEVMExecutor.plaintexts(bytes32) — the handle→cleartext mirror.
+const plaintextsAbi = [
+  {
+    type: 'function',
+    name: 'plaintexts',
+    inputs: [{ name: 'handle', type: 'bytes32', internalType: 'bytes32' }],
+    outputs: [{ name: '', type: 'uint256', internalType: 'uint256' }],
+    stateMutability: 'view',
+  },
+] as const;
+
+////////////////////////////////////////////////////////////////////////////////
+
+export async function isForgeFhevmV1(relayerClient: RelayerClientWithRuntime): Promise<boolean> {
+  const currentKmsSignersContext: KmsSignersContext = await readCurrentKmsSignersContext(relayerClient, {
+    kmsVerifierAddress: relayerClient.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
+    protocolConfigAddress: relayerClient.chain.fhevm.contracts.protocolConfig?.address as
+      | ChecksummedAddress
+      | undefined,
+  });
+  return currentKmsSignersContext.signers.length === 1 && isForgeFhevmV1KmsSigner(currentKmsSignersContext.signers[0]);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+type ReadCleartextExecutorAddressContext = {
+  readonly relayerClient: RelayerClientWithRuntime;
+  readonly trustedClient: TrustedClient;
+};
+
+// ACL → FHEVMExecutor is immutable per deployment, so the lookup is cached
+// permanently (no TTL). Keyed by ACL address (lowercase) + chainId so distinct
+// deployments/chains never collide, and concurrent callers share one in-flight read.
+const cachedReadCleartextExecutorAddress = createCachedFetch<
+  ReadCleartextExecutorAddressContext,
+  Record<string, never>,
+  ChecksummedAddress
+>({
+  executeFn: async ({ relayerClient, trustedClient }) => {
+    const res = await relayerClient.runtime.ethereum.readContract(trustedClient, {
+      abi: getFHEVMExecutorAddressAbi,
+      address: relayerClient.chain.fhevm.contracts.acl.address as ChecksummedAddress,
+      args: [],
+      functionName: getFHEVMExecutorAddressAbi[0].name,
+    });
+    return addressToChecksummedAddress(res as Address);
+  },
+  cacheKeyFn: ({ relayerClient }) =>
+    `${(relayerClient.chain.fhevm.contracts.acl.address as string).toLowerCase()}:${relayerClient.chain.id}`,
+});
+
+async function readCleartextExecutorAddress(
+  relayerClient: RelayerClientWithRuntime,
+  trustedClient: TrustedClient,
+): Promise<ChecksummedAddress> {
+  return cachedReadCleartextExecutorAddress.execute({ relayerClient, trustedClient }, {});
+}
+
+/**
+ * Reads the cleartext uint256 recorded for each handle from
+ * `CleartextFHEVMExecutor.plaintexts`. Authorization (ACL) is enforced by the
+ * decrypt caller before the relayer is invoked, matching the on-chain view which
+ * gated reads through `CleartextACL`.
+ */
+export async function readPlaintexts(
+  relayerClient: RelayerClientWithRuntime,
+  trustedClient: TrustedClient,
+  handles: readonly Handle[],
+): Promise<bigint[]> {
+  const executorAddress = await readCleartextExecutorAddress(relayerClient, trustedClient);
+
+  const cleartexts: bigint[] = [];
+  for (const handle of handles) {
+    const res = await relayerClient.runtime.ethereum.readContract(trustedClient, {
+      abi: plaintextsAbi,
+      address: executorAddress,
+      args: [handle.bytes32Hex],
+      functionName: plaintextsAbi[0].name,
+    });
+    cleartexts.push(res as bigint);
+  }
+  return cleartexts;
+}
+
+// /**
+//  * Reads the registered KMS signer set and threshold from the standard KMSVerifier
+//  * (which forge-fhevm implements). These replace the `signers` / `threshold` the
+//  * `Cleartext*KMSVerifier` view used to return.
+//  */
+// export async function readKmsSignersAndThreshold(
+//   relayerClient: RelayerClientWithRuntime,
+//   trustedClient: TrustedClient,
+// ): Promise<{ signers: readonly ChecksummedAddress[]; threshold: bigint }> {
+//   const kmsVerifierAddress = relayerClient.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress;
+
+//   const signersRes = await relayerClient.runtime.ethereum.readContract(trustedClient, {
+//     abi: getKmsSignersAbi,
+//     address: kmsVerifierAddress,
+//     args: [],
+//     functionName: getKmsSignersAbi[0].name,
+//   });
+
+//   const thresholdRes = await relayerClient.runtime.ethereum.readContract(trustedClient, {
+//     abi: getThresholdAbi,
+//     address: kmsVerifierAddress,
+//     args: [],
+//     functionName: getThresholdAbi[0].name,
+//   });
+
+//   const signers = (signersRes as readonly Address[]).map(addressToChecksummedAddress);
+//   return { signers, threshold: asUint32BigInt(thresholdRes) };
+// }
+
+/**
+ * Reversible mask that replicates `CleartextKMSVerifier._xorMaskWithPublicKey`:
+ * XORs each cleartext with the first 32 bytes of the user's public key. The
+ * client reverses it in `decrypt/mock.ts:_xorUnmaskWithPublicKey` with the same
+ * 32 bytes. NOT real encryption — only the cleartext wire format.
+ */
+export function xorMaskWithPublicKey(publicKey: BytesHex, cleartexts: readonly bigint[]): bigint[] {
+  const hex = remove0x(publicKey);
+  if (hex.length < 64) {
+    throw new Error(`PublicKeyTooShort: publicKey has ${hex.length / 2} bytes, need >= 32`);
+  }
+  const mask = BigInt('0x' + hex.slice(0, 64));
+  return cleartexts.map((c) => c ^ mask);
+}
+
+/**
+ * Replicates `CleartextKMSVerifier._encodeTypedCleartexts`: each cleartext is cast
+ * to its FHE-natural type (bool → 0/1, address → uint160, else uint256) and packed
+ * into a 32-byte word. For these static value types `abi.encode(v0, …, vn)` is
+ * byte-identical to the packed layout, and it round-trips through the proof's
+ * `decode(handle.solidityPrimitiveTypeName[], …)`.
+ */
+export function encodeTypedCleartexts(
+  ethereumModule: CleartextEthereumModule,
+  handles: readonly Handle[],
+  cleartexts: readonly bigint[],
+): BytesHex {
+  const words = handles.map((handle, i) => {
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    const value = cleartexts[i]!;
+    switch (handle.solidityPrimitiveTypeName) {
+      case 'bool':
+        return value !== 0n ? 1n : 0n;
+      case 'address':
+        return value & ((1n << 160n) - 1n);
+      case 'uint256':
+        return value;
+    }
+  });
+
+  return ethereumModule.encode({
+    types: words.map(() => 'uint256'),
+    values: words,
+  });
+}

package/core/modules/relayer/cleartext/mock.ts

@@ -9,7 +9,7 @@ import type {
 import { createDeadbeefBytes } from '../../../base/bytes.js';
 import { fetchUserDecrypt } from './fetchUserDecrypt.js';
 import { fetchPublicDecrypt } from './fetchPublicDecrypt.js';
-import { fetchDelegatedUserDecrypt } from './fetchDelegatedUserDecrypt.js';
+import { fetchDelegatedUserDecrypt } from './fetchDelegatedUserDecryptV1.js';
 import { fetchCoprocessorSignatures } from './fetchCoprocessorSignatures.js';
 
 ////////////////////////////////////////////////////////////////////////////////

package/core/modules/relayer/cleartext/signers.ts

@@ -8,6 +8,36 @@ const FHEVM_TEST_MNEMONIC = 'test test test test test test test future home engi
 const COPROCESSOR_PATH = "0'/2/";
 const KMS_PATH = "0'/3/";
 
+////////////////////////////////////////////////////////////////////////////////
+//
+// forge-fhevm v1
+// --------------
+//
+// forge-fhevm v1 registers a single KMS signer and a single coprocessor signer from
+// these deploy-default private keys (`KMS_SIGNER_PRIVATE_KEY_0` /
+// `COPROCESSOR_SIGNER_PRIVATE_KEY_0` in `deploy-local.sh`). They are NOT derivable
+// from `FHEVM_TEST_MNEMONIC`, so a cleartext client running against a forge-fhevm v1
+// deployment must know them explicitly: the on-chain `getKmsSigners()` returns
+// these addresses and the cleartext relayer signs shares with `map.get(address)`.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+const FORGE_FHEVM_V1_COPROCESSOR_SIGNER: { readonly address: ChecksummedAddress; readonly privateKey: BytesHex } = {
+  address: '0xc9990FEfE0c27D31D0C2aa36196b085c0c4d456c' as ChecksummedAddress,
+  privateKey: '0x7ec8ada6642fc4ccfb7729bc29c17cf8d21b61abd5642d1db992c0b8672ab901' as BytesHex,
+};
+
+const FORGE_FHEVM_V1_KMS_SIGNER: { readonly address: ChecksummedAddress; readonly privateKey: BytesHex } = {
+  address: '0x0971C80fF03B428fD2094dd5354600ab103201C5' as ChecksummedAddress,
+  privateKey: '0x388b7680e4e1afa06efbfd45cdd1fe39f3c6af381df6555a19661f283b97de91' as BytesHex,
+};
+
+export function isForgeFhevmV1KmsSigner(signerAddress: string | undefined): boolean {
+  return signerAddress?.toLowerCase() === FORGE_FHEVM_V1_KMS_SIGNER.address.toLowerCase();
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
 type PrivateKeyMap = Map<ChecksummedAddress, BytesHex>;
 
 const signersPrivateKeyMap: { readonly coprocessor: PrivateKeyMap; readonly kms: PrivateKeyMap } = {
@@ -20,6 +50,10 @@ const signersPrivateKeyMap: { readonly coprocessor: PrivateKeyMap; readonly kms:
 export function getCoprocessorSignersPrivateKeyMap(relayerClient: RelayerClientWithRuntime): PrivateKeyMap {
   if (signersPrivateKeyMap.coprocessor.size === 0) {
     _fillSignersPrivateKey(relayerClient, COPROCESSOR_PATH, 20, signersPrivateKeyMap.coprocessor);
+    signersPrivateKeyMap.coprocessor.set(
+      FORGE_FHEVM_V1_COPROCESSOR_SIGNER.address,
+      FORGE_FHEVM_V1_COPROCESSOR_SIGNER.privateKey,
+    );
   }
   return signersPrivateKeyMap.coprocessor;
 }
@@ -29,6 +63,7 @@ export function getCoprocessorSignersPrivateKeyMap(relayerClient: RelayerClientW
 export function getKmsSignersPrivateKeyMap(relayerClient: RelayerClientWithRuntime): PrivateKeyMap {
   if (signersPrivateKeyMap.kms.size === 0) {
     _fillSignersPrivateKey(relayerClient, KMS_PATH, 20, signersPrivateKeyMap.kms);
+    signersPrivateKeyMap.kms.set(FORGE_FHEVM_V1_KMS_SIGNER.address, FORGE_FHEVM_V1_KMS_SIGNER.privateKey);
   }
   return signersPrivateKeyMap.kms;
 }

package/core/modules/relayer/module/fetchPublicDecrypt.ts

@@ -39,7 +39,7 @@ export async function fetchPublicDecrypt(
 
   return {
     orderedAbiEncodedClearValues: ensure0x(result.decryptedValue),
-    kmsPublicDecryptEIP712Signatures: result.signatures.map(ensure0x) as Bytes65Hex[],
+    kmsPublicDecryptEip712Signatures: result.signatures.map(ensure0x) as Bytes65Hex[],
     extraData: result.extraData,
   };
 }

package/core/modules/relayer/module/fetchUserDecrypt.ts

@@ -1,10 +1,14 @@
-import type { KmsSigncryptedShare } from '../../../types/kms-p.js';
-import type { FetchUserDecryptPayload } from '../../../types/relayer-p.js';
-import type { FetchUserDecryptResult } from '../../../types/relayer.js';
-import type { FetchUserDecryptParameters, FetchUserDecryptReturnType, RelayerClientWithRuntime } from '../types.js';
-import { remove0x } from '../../../base/string.js';
-import { RelayerAsyncRequest } from './RelayerAsyncRequest.js';
-import { buildRelayerUrlString, validateRelayerBaseUrl } from './relayerUrl.js';
+import type {
+  FetchUserDecryptParameters,
+  FetchUserDecryptParametersV1,
+  FetchUserDecryptParametersV2,
+  FetchUserDecryptReturnType,
+  RelayerClientWithRuntime,
+} from '../types.js';
+import { getResolvedProtocolVersion } from '../../../runtime/CoreFhevm-p.js';
+import { isSemverStrictlyBefore } from '../../../base/semver.js';
+import { fetchUserDecryptV1 } from './fetchUserDecryptV1.js';
+import { fetchUserDecryptV2 } from './fetchUserDecryptV2.js';
 
 //////////////////////////////////////////////////////////////////////////////
 // fetchUserDecrypt
@@ -14,56 +18,16 @@ export async function fetchUserDecrypt(
   relayerClient: RelayerClientWithRuntime,
   parameters: FetchUserDecryptParameters,
 ): Promise<FetchUserDecryptReturnType> {
-  const { options, payload } = parameters;
-
-  const firstHandleContractPair = payload.handleContractPairs[0];
-  if (firstHandleContractPair === undefined) {
-    throw new Error('Empty handle contract pairs');
+  const protocolVersion = getResolvedProtocolVersion(relayerClient);
+  if (protocolVersion === undefined) {
+    throw new Error(
+      'Unable to resolve protocol version from context, ensure proper initialization of the FhevmRuntime and FhevmChain.',
+    );
   }
 
-  // retrieve chainId using handles
-  const contractsChainId = firstHandleContractPair.handle.chainId.toString();
-
-  const relayerPayload: FetchUserDecryptPayload = {
-    handleContractPairs: payload.handleContractPairs.map((pair) => {
-      return {
-        handle: pair.handle.bytes32Hex,
-        contractAddress: pair.contractAddress,
-      };
-    }),
-    requestValidity: {
-      startTimestamp: payload.kmsDecryptEip712Message.startTimestamp,
-      durationDays: payload.kmsDecryptEip712Message.durationDays,
-    },
-    contractsChainId,
-    contractAddresses: payload.kmsDecryptEip712Message.contractAddresses,
-    userAddress: payload.kmsDecryptEip712Signer,
-    signature: remove0x(payload.kmsDecryptEip712Signature),
-    extraData: payload.kmsDecryptEip712Message.extraData,
-    publicKey: remove0x(payload.kmsDecryptEip712Message.publicKey),
-  };
-
-  const hasAuth: boolean = options?.auth !== undefined;
-  const relayerBaseUrl: URL = validateRelayerBaseUrl(relayerClient.chain.fhevm.relayerUrl, hasAuth);
-  const url = buildRelayerUrlString(relayerBaseUrl, 'v2/user-decrypt');
-
-  const request = new RelayerAsyncRequest({
-    relayerOperation: 'USER_DECRYPT',
-    url,
-    payload: relayerPayload,
-    options,
-  });
-
-  const result = (await request.run()) as FetchUserDecryptResult;
-
-  const shares: KmsSigncryptedShare[] = result.map((r) => {
-    const share: KmsSigncryptedShare = {
-      signature: r.signature,
-      payload: r.payload,
-      extraData: remove0x(r.extraData),
-    };
-    return share;
-  });
+  if (isSemverStrictlyBefore(protocolVersion.version, '0.14.0')) {
+    return await fetchUserDecryptV1(relayerClient, parameters as FetchUserDecryptParametersV1);
+  }
 
-  return shares;
+  return await fetchUserDecryptV2(relayerClient, parameters as FetchUserDecryptParametersV2);
 }

package/core/modules/relayer/module/fetchUserDecryptV1.ts

@@ -0,0 +1,69 @@
+import type { KmsSigncryptedShare } from '../../../types/kms-p.js';
+import type { FetchUserDecryptPayload as FetchUserDecryptPayloadV1 } from '../../../types/relayer-p.js';
+import type { FetchUserDecryptResult } from '../../../types/relayer.js';
+import type { FetchUserDecryptParametersV1, FetchUserDecryptReturnType, RelayerClientWithRuntime } from '../types.js';
+import { remove0x } from '../../../base/string.js';
+import { RelayerAsyncRequest } from './RelayerAsyncRequest.js';
+import { buildRelayerUrlString, validateRelayerBaseUrl } from './relayerUrl.js';
+
+//////////////////////////////////////////////////////////////////////////////
+// fetchUserDecryptV1 (protocol version < 0.14.0)
+//////////////////////////////////////////////////////////////////////////////
+
+export async function fetchUserDecryptV1(
+  relayerClient: RelayerClientWithRuntime,
+  parameters: FetchUserDecryptParametersV1,
+): Promise<FetchUserDecryptReturnType> {
+  const { options, payload } = parameters;
+
+  const firstHandleContractPair = payload.handleContractPairs[0];
+  if (firstHandleContractPair === undefined) {
+    throw new Error('Empty handle contract pairs');
+  }
+
+  // retrieve chainId using handles
+  const contractsChainId = firstHandleContractPair.handle.chainId.toString();
+
+  const relayerPayload: FetchUserDecryptPayloadV1 = {
+    handleContractPairs: payload.handleContractPairs.map((pair) => {
+      return {
+        handle: pair.handle.bytes32Hex,
+        contractAddress: pair.contractAddress,
+      };
+    }),
+    requestValidity: {
+      startTimestamp: payload.kmsDecryptEip712Message.startTimestamp,
+      durationDays: payload.kmsDecryptEip712Message.durationDays,
+    },
+    contractsChainId,
+    contractAddresses: payload.kmsDecryptEip712Message.contractAddresses,
+    userAddress: payload.kmsDecryptEip712Signer,
+    signature: remove0x(payload.kmsDecryptEip712Signature),
+    extraData: payload.kmsDecryptEip712Message.extraData,
+    publicKey: remove0x(payload.kmsDecryptEip712Message.publicKey),
+  };
+
+  const hasAuth: boolean = options?.auth !== undefined;
+  const relayerBaseUrl: URL = validateRelayerBaseUrl(relayerClient.chain.fhevm.relayerUrl, hasAuth);
+  const url = buildRelayerUrlString(relayerBaseUrl, 'v2/user-decrypt');
+
+  const request = new RelayerAsyncRequest({
+    relayerOperation: 'USER_DECRYPT',
+    url,
+    payload: relayerPayload,
+    options,
+  });
+
+  const result = (await request.run()) as FetchUserDecryptResult;
+
+  const shares: KmsSigncryptedShare[] = result.map((r) => {
+    const share: KmsSigncryptedShare = {
+      signature: r.signature,
+      payload: r.payload,
+      extraData: remove0x(r.extraData),
+    };
+    return share;
+  });
+
+  return shares;
+}