@fhevm/sdk 1.1.0-alpha.7 → 1.1.0-alpha.8

package/core/modules/relayer/cleartext/fetchUserDecryptV1.ts

@@ -0,0 +1,229 @@
+import type { BytesHex, ChecksummedAddress, Uint32BigInt } from '../../../types/primitives.js';
+import type { FetchUserDecryptResultItem } from '../../../types/relayer.js';
+import type { CleartextEthereumModule } from '../../ethereum/types-ct.js';
+import type { FetchUserDecryptParametersV1, FetchUserDecryptReturnType, RelayerClientWithRuntime } from '../types.js';
+import type { KmsSignersContext } from '../../../types/kmsSignersContext.js';
+import { remove0x } from '../../../base/string.js';
+import { asUint32BigInt, tryParseUintBigIntString, randomUniqueUints } from '../../../base/uint.js';
+import { getTrustedClient } from '../../../runtime/CoreFhevm-p.js';
+import { userDecryptResultToKmsSigncryptedShares } from '../utils.js';
+import { getKmsSignersPrivateKeyMap } from './signers.js';
+import { readCurrentKmsSignersContext } from '../../../host-contracts/readKmsSignersContext-p.js';
+import { isForgeFhevmV1, readPlaintexts, xorMaskWithPublicKey } from './forgeFhevmV1.js';
+
+////////////////////////////////////////////////////////////////////////////////
+// runUserDecryptOffChain
+////////////////////////////////////////////////////////////////////////////////
+
+async function runUserDecryptOffChain(
+  relayerClient: RelayerClientWithRuntime,
+  payload: FetchUserDecryptParametersV1['payload'],
+): Promise<{
+  readonly commonKmsSigncryptedSharePayload: BytesHex;
+  readonly signersAddress: readonly ChecksummedAddress[];
+  readonly threshold: Uint32BigInt;
+  readonly extraData: BytesHex;
+}> {
+  const { kmsDecryptEip712Message } = payload;
+  const pairs = payload.handleContractPairs;
+  const trustedClient = getTrustedClient(relayerClient);
+
+  const rawCleartexts = await readPlaintexts(
+    relayerClient,
+    trustedClient,
+    pairs.map((p) => p.handle),
+  );
+
+  const currentKmsSignersContext: KmsSignersContext = await readCurrentKmsSignersContext(relayerClient, {
+    kmsVerifierAddress: relayerClient.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
+    protocolConfigAddress: relayerClient.chain.fhevm.contracts.protocolConfig?.address as
+      | ChecksummedAddress
+      | undefined,
+  });
+  const signersAddress = currentKmsSignersContext.signers;
+  const threshold = currentKmsSignersContext.threshold;
+
+  const maskedCleartexts = xorMaskWithPublicKey(kmsDecryptEip712Message.publicKey, rawCleartexts);
+
+  // extraData: the permit's message.extraData is already asserted equal to the
+  // current KmsSignersContext extraData by the caller (fetchKmsSigncryptedSharesV1
+  // step 9), so reusing it keeps the shares consistent with that context.
+  const extraData = kmsDecryptEip712Message.extraData;
+
+  const commonKmsSigncryptedSharePayload = relayerClient.runtime.ethereum.encode({
+    types: ['uint256[]', 'bytes'],
+    values: [maskedCleartexts, extraData],
+  });
+
+  return {
+    signersAddress,
+    threshold: BigInt(threshold) as Uint32BigInt,
+    commonKmsSigncryptedSharePayload,
+    extraData,
+  };
+}
+
+////////////////////////////////////////////////////////////////////////////////
+// runUserDecryptOnChain
+////////////////////////////////////////////////////////////////////////////////
+
+const userDecryptAbi = [
+  {
+    type: 'function',
+    name: 'userDecrypt',
+    inputs: [
+      {
+        name: 'pairs',
+        type: 'tuple[]',
+        internalType: 'struct HandleContractPair[]',
+        components: [
+          { name: 'handle', type: 'bytes32', internalType: 'bytes32' },
+          {
+            name: 'contractAddress',
+            type: 'address',
+            internalType: 'address',
+          },
+        ],
+      },
+      { name: 'userAddress', type: 'address', internalType: 'address' },
+      { name: 'publicKey', type: 'bytes', internalType: 'bytes' },
+      {
+        name: 'contractAddresses',
+        type: 'address[]',
+        internalType: 'address[]',
+      },
+      {
+        name: 'startTimestamp',
+        type: 'uint256',
+        internalType: 'uint256',
+      },
+      {
+        name: 'durationDays',
+        type: 'uint256',
+        internalType: 'uint256',
+      },
+      { name: 'userSignature', type: 'bytes', internalType: 'bytes' },
+    ],
+    outputs: [
+      { name: 'payload', type: 'bytes', internalType: 'bytes' },
+      { name: 'signers', type: 'address[]', internalType: 'address[]' },
+      { name: 'threshold', type: 'uint256', internalType: 'uint256' },
+      { name: 'extraData', type: 'bytes', internalType: 'bytes' },
+    ],
+    stateMutability: 'view',
+  },
+] as const;
+
+async function runUserDecryptOnChain(
+  relayerClient: RelayerClientWithRuntime,
+  payload: FetchUserDecryptParametersV1['payload'],
+): Promise<{
+  readonly commonKmsSigncryptedSharePayload: BytesHex;
+  readonly signersAddress: readonly ChecksummedAddress[];
+  readonly threshold: Uint32BigInt;
+  readonly extraData: BytesHex;
+}> {
+  const { kmsDecryptEip712Message, kmsDecryptEip712Signer, kmsDecryptEip712Signature } = payload;
+  const pairs = payload.handleContractPairs;
+  const trustedClient = getTrustedClient(relayerClient);
+  const res = (await relayerClient.runtime.ethereum.readContract(trustedClient, {
+    abi: userDecryptAbi,
+    address: relayerClient.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
+    args: [
+      pairs.map((p) => ({
+        handle: p.handle.bytes32Hex,
+        contractAddress: p.contractAddress,
+      })),
+      kmsDecryptEip712Signer,
+      kmsDecryptEip712Message.publicKey,
+      kmsDecryptEip712Message.contractAddresses,
+      _parseUintBigIntString('kmsDecryptEip712Message.startTimestamp', kmsDecryptEip712Message.startTimestamp),
+      _parseUintBigIntString('kmsDecryptEip712Message.durationDays', kmsDecryptEip712Message.durationDays),
+      kmsDecryptEip712Signature,
+    ],
+    functionName: userDecryptAbi[0].name,
+  })) as unknown[];
+
+  const commonKmsSigncryptedSharePayload = res[0] as BytesHex;
+  const signersAddress = res[1] as readonly ChecksummedAddress[];
+  const threshold = asUint32BigInt(res[2]);
+  const extraData = res[3] as BytesHex;
+
+  return {
+    commonKmsSigncryptedSharePayload,
+    signersAddress,
+    threshold,
+    extraData,
+  };
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+export async function fetchUserDecryptV1(
+  relayerClient: RelayerClientWithRuntime,
+  parameters: FetchUserDecryptParametersV1,
+): Promise<FetchUserDecryptReturnType> {
+  const cleartextEthereumModule = relayerClient.runtime.ethereum as CleartextEthereumModule;
+  const { payload } = parameters;
+  const pairs = payload.handleContractPairs;
+  const contractAddresses = payload.kmsDecryptEip712Message.contractAddresses;
+
+  const authCount = contractAddresses.length;
+  for (const { contractAddress: c } of pairs) {
+    let authorized: boolean = false;
+    for (let i = 0; i < authCount; ++i) {
+      if (contractAddresses[i] == c) {
+        authorized = true;
+        break;
+      }
+    }
+    if (!authorized) {
+      throw new Error(`ContractAddressNotAuthorized: ${c} is not in the EIP-712 authorized contractAddresses list.`);
+    }
+  }
+
+  const offChain = await isForgeFhevmV1(relayerClient);
+
+  let res;
+  if (offChain) {
+    res = await runUserDecryptOffChain(relayerClient, payload);
+  } else {
+    res = await runUserDecryptOnChain(relayerClient, payload);
+  }
+
+  const commonKmsSigncryptedSharePayload = res.commonKmsSigncryptedSharePayload;
+  const extraData = res.extraData;
+  const threshold = res.threshold;
+  const signersAddress = res.signersAddress;
+
+  const signers = getKmsSignersPrivateKeyMap(relayerClient);
+
+  const randomSignersAddress = randomUniqueUints(signersAddress.length, Number(threshold)).map(
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    (i) => signersAddress[i]!,
+  );
+
+  const result: FetchUserDecryptResultItem[] = [];
+
+  for (const signerAddress of randomSignersAddress) {
+    const privateKey = signers.get(signerAddress);
+    if (privateKey === undefined) {
+      throw new Error(`Unable to find KMS signer for address ${signerAddress}`);
+    }
+
+    const signature = await cleartextEthereumModule.sign({ hash: commonKmsSigncryptedSharePayload, privateKey });
+    result.push({ signature: remove0x(signature), payload: remove0x(commonKmsSigncryptedSharePayload), extraData });
+  }
+
+  return userDecryptResultToKmsSigncryptedShares(result);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+function _parseUintBigIntString(label: string, value: string): bigint {
+  const bn = tryParseUintBigIntString(value);
+  if (bn === undefined) {
+    throw new Error(`${label} is not a valid uint string, got ${JSON.stringify(value)}`);
+  }
+  return bn;
+}

package/core/modules/relayer/cleartext/fetchUserDecryptV2.ts

@@ -0,0 +1,11 @@
+import type { FetchUserDecryptParametersV2, FetchUserDecryptReturnType, RelayerClientWithRuntime } from '../types.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+// eslint-disable-next-line @typescript-eslint/require-await
+export async function fetchUserDecryptV2(
+  _relayerClient: RelayerClientWithRuntime,
+  _parameters: FetchUserDecryptParametersV2,
+): Promise<FetchUserDecryptReturnType> {
+  throw new Error('Not yet implemented');
+}

package/core/modules/relayer/cleartext/forgeFhevmV1.ts

@@ -0,0 +1,185 @@
+import type { Address, BytesHex, ChecksummedAddress } from '../../../types/primitives.js';
+import type { Handle } from '../../../types/encryptedTypes-p.js';
+import type { CleartextEthereumModule } from '../../ethereum/types-ct.js';
+import type { TrustedClient } from '../../ethereum/types.js';
+import type { RelayerClientWithRuntime } from '../types.js';
+import type { KmsSignersContext } from '../../../types/kmsSignersContext.js';
+import { remove0x } from '../../../base/string.js';
+import { addressToChecksummedAddress } from '../../../base/address.js';
+import { createCachedFetch } from '../../../base/cachedFetch.js';
+import { getFHEVMExecutorAddressAbi } from '../../../host-contracts/abi-fragments/fragments.js';
+import { readCurrentKmsSignersContext } from '../../../host-contracts/readKmsSignersContext-p.js';
+import { isForgeFhevmV1KmsSigner } from './signers.js';
+
+////////////////////////////////////////////////////////////////////////////////
+//
+// Option B — cleartext "disabled KMSVerifier" plaintext source.
+//
+// The cleartext mock relayer used to read masked cleartexts + the KMS payload
+// from the `Cleartext*KMSVerifier` view. That view required the full `Cleartext*`
+// host set, which partners deploying only forge-fhevm do not have. Instead we
+// read the raw plaintext straight from `CleartextFHEVMExecutor.plaintexts` (the
+// mapping forge-fhevm populates) and rebuild the KMS wire format off-chain,
+// reusing the already-local KMS signing. Only the *plaintext source* moves;
+// everything downstream (masking, signing, reconstruct) is unchanged.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+// CleartextFHEVMExecutor.plaintexts(bytes32) — the handle→cleartext mirror.
+const plaintextsAbi = [
+  {
+    type: 'function',
+    name: 'plaintexts',
+    inputs: [{ name: 'handle', type: 'bytes32', internalType: 'bytes32' }],
+    outputs: [{ name: '', type: 'uint256', internalType: 'uint256' }],
+    stateMutability: 'view',
+  },
+] as const;
+
+////////////////////////////////////////////////////////////////////////////////
+
+export async function isForgeFhevmV1(relayerClient: RelayerClientWithRuntime): Promise<boolean> {
+  const currentKmsSignersContext: KmsSignersContext = await readCurrentKmsSignersContext(relayerClient, {
+    kmsVerifierAddress: relayerClient.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
+    protocolConfigAddress: relayerClient.chain.fhevm.contracts.protocolConfig?.address as
+      | ChecksummedAddress
+      | undefined,
+  });
+  return currentKmsSignersContext.signers.length === 1 && isForgeFhevmV1KmsSigner(currentKmsSignersContext.signers[0]);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+type ReadCleartextExecutorAddressContext = {
+  readonly relayerClient: RelayerClientWithRuntime;
+  readonly trustedClient: TrustedClient;
+};
+
+// ACL → FHEVMExecutor is immutable per deployment, so the lookup is cached
+// permanently (no TTL). Keyed by ACL address (lowercase) + chainId so distinct
+// deployments/chains never collide, and concurrent callers share one in-flight read.
+const cachedReadCleartextExecutorAddress = createCachedFetch<
+  ReadCleartextExecutorAddressContext,
+  Record<string, never>,
+  ChecksummedAddress
+>({
+  executeFn: async ({ relayerClient, trustedClient }) => {
+    const res = await relayerClient.runtime.ethereum.readContract(trustedClient, {
+      abi: getFHEVMExecutorAddressAbi,
+      address: relayerClient.chain.fhevm.contracts.acl.address as ChecksummedAddress,
+      args: [],
+      functionName: getFHEVMExecutorAddressAbi[0].name,
+    });
+    return addressToChecksummedAddress(res as Address);
+  },
+  cacheKeyFn: ({ relayerClient }) =>
+    `${(relayerClient.chain.fhevm.contracts.acl.address as string).toLowerCase()}:${relayerClient.chain.id}`,
+});
+
+async function readCleartextExecutorAddress(
+  relayerClient: RelayerClientWithRuntime,
+  trustedClient: TrustedClient,
+): Promise<ChecksummedAddress> {
+  return cachedReadCleartextExecutorAddress.execute({ relayerClient, trustedClient }, {});
+}
+
+/**
+ * Reads the cleartext uint256 recorded for each handle from
+ * `CleartextFHEVMExecutor.plaintexts`. Authorization (ACL) is enforced by the
+ * decrypt caller before the relayer is invoked, matching the on-chain view which
+ * gated reads through `CleartextACL`.
+ */
+export async function readPlaintexts(
+  relayerClient: RelayerClientWithRuntime,
+  trustedClient: TrustedClient,
+  handles: readonly Handle[],
+): Promise<bigint[]> {
+  const executorAddress = await readCleartextExecutorAddress(relayerClient, trustedClient);
+
+  const cleartexts: bigint[] = [];
+  for (const handle of handles) {
+    const res = await relayerClient.runtime.ethereum.readContract(trustedClient, {
+      abi: plaintextsAbi,
+      address: executorAddress,
+      args: [handle.bytes32Hex],
+      functionName: plaintextsAbi[0].name,
+    });
+    cleartexts.push(res as bigint);
+  }
+  return cleartexts;
+}
+
+// /**
+//  * Reads the registered KMS signer set and threshold from the standard KMSVerifier
+//  * (which forge-fhevm implements). These replace the `signers` / `threshold` the
+//  * `Cleartext*KMSVerifier` view used to return.
+//  */
+// export async function readKmsSignersAndThreshold(
+//   relayerClient: RelayerClientWithRuntime,
+//   trustedClient: TrustedClient,
+// ): Promise<{ signers: readonly ChecksummedAddress[]; threshold: bigint }> {
+//   const kmsVerifierAddress = relayerClient.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress;
+
+//   const signersRes = await relayerClient.runtime.ethereum.readContract(trustedClient, {
+//     abi: getKmsSignersAbi,
+//     address: kmsVerifierAddress,
+//     args: [],
+//     functionName: getKmsSignersAbi[0].name,
+//   });
+
+//   const thresholdRes = await relayerClient.runtime.ethereum.readContract(trustedClient, {
+//     abi: getThresholdAbi,
+//     address: kmsVerifierAddress,
+//     args: [],
+//     functionName: getThresholdAbi[0].name,
+//   });
+
+//   const signers = (signersRes as readonly Address[]).map(addressToChecksummedAddress);
+//   return { signers, threshold: asUint32BigInt(thresholdRes) };
+// }
+
+/**
+ * Reversible mask that replicates `CleartextKMSVerifier._xorMaskWithPublicKey`:
+ * XORs each cleartext with the first 32 bytes of the user's public key. The
+ * client reverses it in `decrypt/mock.ts:_xorUnmaskWithPublicKey` with the same
+ * 32 bytes. NOT real encryption — only the cleartext wire format.
+ */
+export function xorMaskWithPublicKey(publicKey: BytesHex, cleartexts: readonly bigint[]): bigint[] {
+  const hex = remove0x(publicKey);
+  if (hex.length < 64) {
+    throw new Error(`PublicKeyTooShort: publicKey has ${hex.length / 2} bytes, need >= 32`);
+  }
+  const mask = BigInt('0x' + hex.slice(0, 64));
+  return cleartexts.map((c) => c ^ mask);
+}
+
+/**
+ * Replicates `CleartextKMSVerifier._encodeTypedCleartexts`: each cleartext is cast
+ * to its FHE-natural type (bool → 0/1, address → uint160, else uint256) and packed
+ * into a 32-byte word. For these static value types `abi.encode(v0, …, vn)` is
+ * byte-identical to the packed layout, and it round-trips through the proof's
+ * `decode(handle.solidityPrimitiveTypeName[], …)`.
+ */
+export function encodeTypedCleartexts(
+  ethereumModule: CleartextEthereumModule,
+  handles: readonly Handle[],
+  cleartexts: readonly bigint[],
+): BytesHex {
+  const words = handles.map((handle, i) => {
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    const value = cleartexts[i]!;
+    switch (handle.solidityPrimitiveTypeName) {
+      case 'bool':
+        return value !== 0n ? 1n : 0n;
+      case 'address':
+        return value & ((1n << 160n) - 1n);
+      case 'uint256':
+        return value;
+    }
+  });
+
+  return ethereumModule.encode({
+    types: words.map(() => 'uint256'),
+    values: words,
+  });
+}

package/core/modules/relayer/cleartext/mock.ts

@@ -9,7 +9,7 @@ import type {
 import { createDeadbeefBytes } from '../../../base/bytes.js';
 import { fetchUserDecrypt } from './fetchUserDecrypt.js';
 import { fetchPublicDecrypt } from './fetchPublicDecrypt.js';
-import { fetchDelegatedUserDecrypt } from './fetchDelegatedUserDecrypt.js';
+import { fetchDelegatedUserDecrypt } from './fetchDelegatedUserDecryptV1.js';
 import { fetchCoprocessorSignatures } from './fetchCoprocessorSignatures.js';
 
 ////////////////////////////////////////////////////////////////////////////////

package/core/modules/relayer/cleartext/signers.ts

@@ -8,6 +8,36 @@ const FHEVM_TEST_MNEMONIC = 'test test test test test test test future home engi
 const COPROCESSOR_PATH = "0'/2/";
 const KMS_PATH = "0'/3/";
 
+////////////////////////////////////////////////////////////////////////////////
+//
+// forge-fhevm v1
+// --------------
+//
+// forge-fhevm v1 registers a single KMS signer and a single coprocessor signer from
+// these deploy-default private keys (`KMS_SIGNER_PRIVATE_KEY_0` /
+// `COPROCESSOR_SIGNER_PRIVATE_KEY_0` in `deploy-local.sh`). They are NOT derivable
+// from `FHEVM_TEST_MNEMONIC`, so a cleartext client running against a forge-fhevm v1
+// deployment must know them explicitly: the on-chain `getKmsSigners()` returns
+// these addresses and the cleartext relayer signs shares with `map.get(address)`.
+//
+////////////////////////////////////////////////////////////////////////////////
+
+const FORGE_FHEVM_V1_COPROCESSOR_SIGNER: { readonly address: ChecksummedAddress; readonly privateKey: BytesHex } = {
+  address: '0xc9990FEfE0c27D31D0C2aa36196b085c0c4d456c' as ChecksummedAddress,
+  privateKey: '0x7ec8ada6642fc4ccfb7729bc29c17cf8d21b61abd5642d1db992c0b8672ab901' as BytesHex,
+};
+
+const FORGE_FHEVM_V1_KMS_SIGNER: { readonly address: ChecksummedAddress; readonly privateKey: BytesHex } = {
+  address: '0x0971C80fF03B428fD2094dd5354600ab103201C5' as ChecksummedAddress,
+  privateKey: '0x388b7680e4e1afa06efbfd45cdd1fe39f3c6af381df6555a19661f283b97de91' as BytesHex,
+};
+
+export function isForgeFhevmV1KmsSigner(signerAddress: string | undefined): boolean {
+  return signerAddress?.toLowerCase() === FORGE_FHEVM_V1_KMS_SIGNER.address.toLowerCase();
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
 type PrivateKeyMap = Map<ChecksummedAddress, BytesHex>;
 
 const signersPrivateKeyMap: { readonly coprocessor: PrivateKeyMap; readonly kms: PrivateKeyMap } = {
@@ -20,6 +50,10 @@ const signersPrivateKeyMap: { readonly coprocessor: PrivateKeyMap; readonly kms:
 export function getCoprocessorSignersPrivateKeyMap(relayerClient: RelayerClientWithRuntime): PrivateKeyMap {
   if (signersPrivateKeyMap.coprocessor.size === 0) {
     _fillSignersPrivateKey(relayerClient, COPROCESSOR_PATH, 20, signersPrivateKeyMap.coprocessor);
+    signersPrivateKeyMap.coprocessor.set(
+      FORGE_FHEVM_V1_COPROCESSOR_SIGNER.address,
+      FORGE_FHEVM_V1_COPROCESSOR_SIGNER.privateKey,
+    );
   }
   return signersPrivateKeyMap.coprocessor;
 }
@@ -29,6 +63,7 @@ export function getCoprocessorSignersPrivateKeyMap(relayerClient: RelayerClientW
 export function getKmsSignersPrivateKeyMap(relayerClient: RelayerClientWithRuntime): PrivateKeyMap {
   if (signersPrivateKeyMap.kms.size === 0) {
     _fillSignersPrivateKey(relayerClient, KMS_PATH, 20, signersPrivateKeyMap.kms);
+    signersPrivateKeyMap.kms.set(FORGE_FHEVM_V1_KMS_SIGNER.address, FORGE_FHEVM_V1_KMS_SIGNER.privateKey);
   }
   return signersPrivateKeyMap.kms;
 }

package/core/types/kms-p.ts

@@ -2,7 +2,15 @@ import type { TkmsVersion } from '../../wasm/tkms/KmsLibApi.js';
 import type { Handle } from './encryptedTypes-p.js';
 import type { KmsEip712Domain } from './kms.js';
 import type { KmsSignersContext } from './kmsSignersContext.js';
-import type { Bytes65Hex, Bytes65HexNo0x, BytesHexNo0x, ChecksummedAddress } from './primitives.js';
+import type {
+  Bytes65Hex,
+  Bytes65HexNo0x,
+  BytesHex,
+  BytesHexNo0x,
+  ChecksummedAddress,
+  Uint256BigInt,
+  Uint8Number,
+} from './primitives.js';
 
 export interface KmsSigncryptedSharesMetadata {
   readonly kmsSignersContext: KmsSignersContext;
@@ -18,3 +26,10 @@ export interface KmsSigncryptedShare {
   readonly signature: Bytes65HexNo0x;
   readonly extraData: BytesHexNo0x;
 }
+
+export interface KmsExtraData {
+  readonly version: Uint8Number;
+  readonly kmsContextId: Uint256BigInt;
+  readonly kmsEpochId: Uint256BigInt;
+  toBytesHex(): BytesHex;
+}

package/ethers/internal/ethereum-ct.ts

@@ -3,6 +3,8 @@ import type {
   GeneratePrivateKeyReturnType,
   GetPublicKeyParameters,
   GetPublicKeyReturnType,
+  HashTypedDataParameters,
+  HashTypedDataReturnType,
   MnemonicToAccountParameters,
   MnemonicToAccountReturnType,
   RecoverAddressParameters,
@@ -11,6 +13,7 @@ import type {
   SignReturnType,
 } from '../../core/modules/ethereum/types-ct.js';
 import type { BytesHex, ChecksummedAddress } from '../../core/types/primitives.js';
+import type { TypedDataField } from 'ethers';
 import {
   decode,
   encode,
@@ -20,8 +23,9 @@ import {
   recoverTypedDataAddress,
   signTypedData,
 } from './ethereum.js';
-import { SigningKey, HDNodeWallet, Wallet } from 'ethers';
+import { SigningKey, HDNodeWallet, Wallet, TypedDataEncoder } from 'ethers';
 import { sign, recoverAddress } from '../../core/base/sign.js';
+import { asBytes32Hex } from '../../core/base/bytes.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -56,6 +60,16 @@ export const cleartextEthereumModule: CleartextEthereumModuleFactory = () => {
         const recoveredAddress = recoverAddress(parameters);
         return Promise.resolve(recoveredAddress);
       },
+      hashTypedData: (parameters: HashTypedDataParameters): HashTypedDataReturnType => {
+        const primaryTypeFields = parameters.types[parameters.primaryType];
+        if (primaryTypeFields === undefined) {
+          throw new Error(`Primary type "${parameters.primaryType}" not found in types`);
+        }
+        const typesToHash: Record<string, TypedDataField[]> = {
+          [parameters.primaryType]: [...primaryTypeFields],
+        };
+        return asBytes32Hex(TypedDataEncoder.hash(parameters.domain, typesToHash, parameters.message));
+      },
     }),
   });
 };

package/ethers/internal/runtime-ct.ts

@@ -15,14 +15,16 @@ export function getCleartextEthersRuntime(): FhevmRuntime {
     throw new Error('Call setFhevmRuntimeConfig first.');
   }
 
-  const em = cleartextEthereumModule();
-  const rm = cleartextRelayerModule();
+  if (ethersFhevmRuntime === undefined) {
+    const em = cleartextEthereumModule();
+    const rm = cleartextRelayerModule();
 
-  ethersFhevmRuntime ??= createFhevmRuntime({
-    ethereum: em.ethereum,
-    relayer: rm.relayer,
-    config: getFhevmRuntimeConfig(),
-  });
+    ethersFhevmRuntime = createFhevmRuntime({
+      ethereum: em.ethereum,
+      relayer: rm.relayer,
+      config: getFhevmRuntimeConfig(),
+    });
+  }
 
   return ethersFhevmRuntime;
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@fhevm/sdk",
   "description": "TypeScript Interface for FHEVM",
-  "version": "1.1.0-alpha.7",
+  "version": "1.1.0-alpha.8",
   "type": "module",
   "main": "./_cjs/index.js",
   "module": "./_esm/index.js",

package/viem/internal/ethereum-ct.ts

@@ -3,6 +3,8 @@ import type {
   GeneratePrivateKeyReturnType,
   GetPublicKeyParameters,
   GetPublicKeyReturnType,
+  HashTypedDataParameters,
+  HashTypedDataReturnType,
   MnemonicToAccountParameters,
   MnemonicToAccountReturnType,
   RecoverAddressParameters,
@@ -21,8 +23,8 @@ import {
   recoverTypedDataAddress,
   signTypedData,
 } from './ethereum.js';
-import { bytesToHex } from '../../core/base/bytes.js';
-import { recoverAddress } from 'viem';
+import { asBytes32Hex, bytesToHex } from '../../core/base/bytes.js';
+import { hashTypedData, recoverAddress } from 'viem';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -56,6 +58,16 @@ export const cleartextEthereumModule: CleartextEthereumModuleFactory = () => {
       recoverAddress: (parameters: RecoverAddressParameters): Promise<RecoverAddressReturnType> => {
         return recoverAddress(parameters) as Promise<ChecksummedAddress>;
       },
+      hashTypedData: (parameters: HashTypedDataParameters): HashTypedDataReturnType => {
+        return asBytes32Hex(
+          hashTypedData({
+            domain: parameters.domain,
+            types: parameters.types as Record<string, Array<{ name: string; type: string }>>,
+            primaryType: parameters.primaryType,
+            message: parameters.message,
+          }),
+        );
+      },
     }),
   });
 };

package/viem/internal/runtime-ct.ts

@@ -15,14 +15,16 @@ export function getCleartextViemRuntime(): FhevmRuntime {
     throw new Error('Call setFhevmRuntimeConfig first.');
   }
 
-  const em = cleartextEthereumModule();
-  const rm = cleartextRelayerModule();
+  if (viemFhevmRuntime === undefined) {
+    const em = cleartextEthereumModule();
+    const rm = cleartextRelayerModule();
 
-  viemFhevmRuntime ??= createFhevmRuntime({
-    ethereum: em.ethereum,
-    relayer: rm.relayer,
-    config: getFhevmRuntimeConfig(),
-  });
+    viemFhevmRuntime = createFhevmRuntime({
+      ethereum: em.ethereum,
+      relayer: rm.relayer,
+      config: getFhevmRuntimeConfig(),
+    });
+  }
 
   return viemFhevmRuntime;
 }