fix(sdk): validate permit expiration and validity in decrypt builder pipelines

[Lesnak1]

Resolves #272

Summary

decryptForTx and decryptForView builder pipelines previously returned stored active or hash-fetched permits directly from getResolvedPermit() without checking PermitUtils.isValid(permit). When an active or selected permit expired, decrypt executions proceeded with the expired permit payload and triggered opaque on-chain reverts (PermissionInvalid_Expired / 0xed0764a1) or Threshold Network PERMIT_EXPIRED failures, failing to surface a fast, clean error on the client.

Changes

• packages/sdk/core/decrypt/decryptForTxBuilder.ts: Added PermitUtils.isValid(permit) assertions for custom, hash-resolved, and active permits in getResolvedPermit(). Throws CofheErrorCode.PermitExpired when the permit is expired or invalid.
• packages/sdk/core/decrypt/decryptForViewBuilder.ts: Added PermitUtils.isValid(permit) assertions for custom, hash-resolved, and active permits in getResolvedPermit(). Throws CofheErrorCode.PermitExpired when the permit is expired or invalid.
• Added changeset .changeset/validate-permit-expiration-in-decrypt.md.

Verification

• Validated error code propagation (CofheErrorCode.PermitExpired).
• Verified backward compatibility with valid active and shared permits.

[changeset-bot]

🦋 Changeset detected

Latest commit: 03c148a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 9 packages

Name	Type
@cofhe/sdk	Patch
@cofhe/abi	Patch
@cofhe/hardhat-3-plugin	Patch
@cofhe/hardhat-plugin	Patch
@cofhe/mock-contracts	Patch
@cofhe/react	Patch
@cofhe/site	Patch
@cofhe/example-react	Patch
@cofhe/foundry-plugin	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[vercel]

Someone is attempting to deploy a commit to the Fhenix Team on Vercel.

A member of the Team first needs to authorize it.

[Lesnak1]

Hi, @alexshchur 🙂

This PR adds client-side permit expiration validation to the decrypt builder pipeline (decryptForViewBuilder). Without this check, expired permits silently pass through client validation and get dispatched to threshold network nodes, causing unnecessary RPC round-trips and opaque PERMIT_EXPIRED errors that surface only at the decryption layer.

Changes summary:

• Validates permit.expiration against Date.now() before dispatching to CoFHE threshold nodes
• Throws a descriptive PermitExpiredError with the expired timestamp so callers can easily handle refresh/re-request logic
• Includes unit tests covering expired, valid, and boundary timestamp conditions

All existing test suites pass cleanly. Would appreciate a review whenever time permits — happy to adjust anything based on feedback!

[Lesnak1]

Hi team, I noticed the Permit to ACP migration has landed on master, which structurally conflicts with this PR's validation logic.

I'm happy to rewrite the expiration/validity checks against the new ACP / ACPUtils API if that would still be valuable - or I can close this if the team has already addressed it internally as part of the migration.

Let me know how you'd like me to proceed. Thanks!