@cofhe/sdk 0.6.1 → 0.7.0

package/dist/acps.cjs

@@ -0,0 +1,1081 @@
+'use strict';
+
+var viem = require('viem');
+var nacl = require('tweetnacl');
+var zod = require('zod');
+var vanilla = require('zustand/vanilla');
+var middleware = require('zustand/middleware');
+var immer = require('immer');
+
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var nacl__default = /*#__PURE__*/_interopDefault(nacl);
+
+// acps/acp.ts
+
+// acps/utils.ts
+var fromHexString = (hexString) => {
+  const cleanString = hexString.length % 2 === 1 ? `0${hexString}` : hexString;
+  const arr = cleanString.replace(/^0x/, "").match(/.{1,2}/g);
+  if (!arr)
+    return new Uint8Array();
+  return new Uint8Array(arr.map((byte) => parseInt(byte, 16)));
+};
+var toHexString = (bytes) => bytes.reduce((str, byte) => str + byte.toString(16).padStart(2, "0"), "");
+function toBigInt(value) {
+  if (typeof value === "string") {
+    return BigInt(value);
+  } else if (typeof value === "number") {
+    return BigInt(value);
+  } else if (typeof value === "object") {
+    return BigInt("0x" + toHexString(value));
+  } else {
+    return value;
+  }
+}
+function toBeArray(value) {
+  const bigIntValue = typeof value === "number" ? BigInt(value) : value;
+  const hex = bigIntValue.toString(16);
+  const paddedHex = hex.length % 2 === 0 ? hex : "0" + hex;
+  return fromHexString(paddedHex);
+}
+function isString(value) {
+  if (typeof value !== "string") {
+    throw new Error(`Expected value which is \`string\`, received value of type \`${typeof value}\`.`);
+  }
+}
+function isNumber(value) {
+  const is = typeof value === "number" && !Number.isNaN(value);
+  if (!is) {
+    throw new Error(`Expected value which is \`number\`, received value of type \`${typeof value}\`.`);
+  }
+}
+function isBigIntOrNumber(value) {
+  const is = typeof value === "bigint";
+  if (!is) {
+    try {
+      isNumber(value);
+    } catch (e) {
+      throw new Error(`Value ${value} is not a number or bigint: ${typeof value}`);
+    }
+  }
+}
+
+// acps/sealing.ts
+var KEY_HEX_LENGTH = 64;
+var GenerateSealingKey = () => {
+  const sodiumKeypair = nacl__default.default.box.keyPair();
+  return {
+    privateKey: `0x${toHexString(sodiumKeypair.secretKey)}`,
+    publicKey: `0x${toHexString(sodiumKeypair.publicKey)}`
+  };
+};
+var seal = (value, publicKey) => {
+  isString(publicKey);
+  isBigIntOrNumber(value);
+  assertKeyLength(publicKey, "Public");
+  const ephemeralKeyPair = nacl__default.default.box.keyPair();
+  const nonce = nacl__default.default.randomBytes(nacl__default.default.box.nonceLength);
+  const encryptedMessage = nacl__default.default.box(toBeArray(value), nonce, fromHexString(publicKey), ephemeralKeyPair.secretKey);
+  return {
+    data: encryptedMessage,
+    public_key: ephemeralKeyPair.publicKey,
+    nonce
+  };
+};
+var unsealWithPrivateKey = (privateKey, parsedData) => {
+  assertKeyLength(privateKey, "Private");
+  const nonce = parsedData.nonce instanceof Uint8Array ? parsedData.nonce : new Uint8Array(parsedData.nonce);
+  const ephemPublicKey = parsedData.public_key instanceof Uint8Array ? parsedData.public_key : new Uint8Array(parsedData.public_key);
+  const dataToDecrypt = parsedData.data instanceof Uint8Array ? parsedData.data : new Uint8Array(parsedData.data);
+  const decryptedMessage = nacl__default.default.box.open(dataToDecrypt, nonce, ephemPublicKey, fromHexString(privateKey));
+  if (!decryptedMessage) {
+    throw new Error("Failed to decrypt message");
+  }
+  return toBigInt(decryptedMessage);
+};
+var assertKeyLength = (key, kind) => {
+  const bare = key.startsWith("0x") ? key.slice(2) : key;
+  if (bare.length !== KEY_HEX_LENGTH) {
+    throw new Error(`${kind} key must be of length ${KEY_HEX_LENGTH}`);
+  }
+};
+var ACPScope = {
+  Global: 0,
+  Contract: 1,
+  Handles: 2
+};
+var addressSchema = zod.z.string().refine((val) => viem.isAddress(val), {
+  error: "Invalid address"
+}).transform((val) => viem.getAddress(val));
+var addressNotZeroSchema = addressSchema.refine((val) => val !== viem.zeroAddress, {
+  error: "Must not be zeroAddress"
+});
+var bytesSchema = zod.z.custom(
+  (val) => {
+    return typeof val === "string" && viem.isHex(val);
+  },
+  {
+    message: "Invalid hex value"
+  }
+);
+var bytesNotEmptySchema = bytesSchema.refine((val) => val !== "0x", {
+  error: "Must not be empty"
+});
+var DEFAULT_EXPIRATION_FN = () => Math.round(Date.now() / 1e3) + 7 * 24 * 60 * 60;
+var handlesSchema = zod.z.array(zod.z.string().regex(/^0x[0-9a-fA-F]{64}$/, "Invalid handle: expected 32-byte hex")).optional().default([]);
+var contractsSchema = zod.z.array(addressSchema).optional().default([]);
+var SCOPE_GLOBAL = 0;
+var SCOPE_CONTRACT = 1;
+var SCOPE_HANDLES = 2;
+var ScopeConsistencyRefinement = [
+  (data) => data.scope === SCOPE_GLOBAL && data.contracts.length === 0 && data.handles.length === 0 || data.scope === SCOPE_CONTRACT && data.contracts.length > 0 && data.handles.length === 0 || data.scope === SCOPE_HANDLES && data.handles.length > 0 && data.contracts.length === 0,
+  {
+    error: "ACP scope :: arrays must match the scope mode (Global: both empty; Contract: contracts only; Handles: handles only)",
+    path: ["scope"]
+  }
+];
+var withDerivedScope = (data) => ({
+  ...data,
+  scope: data.scope ?? (data.contracts.length > 0 ? SCOPE_CONTRACT : data.handles.length > 0 ? SCOPE_HANDLES : SCOPE_GLOBAL)
+});
+var zACPWithDefaults = zod.z.object({
+  name: zod.z.string().optional().default("Unnamed ACP"),
+  type: zod.z.enum(["self", "sharing", "recipient"]),
+  issuer: addressNotZeroSchema,
+  expiration: zod.z.int().optional().default(DEFAULT_EXPIRATION_FN),
+  recipient: addressSchema.optional().default(viem.zeroAddress),
+  revokerData: zod.z.int().optional().default(0),
+  revokerContract: addressSchema.optional().default(viem.zeroAddress),
+  scope: zod.z.int().min(0).max(2).optional().default(0),
+  contracts: contractsSchema,
+  handles: handlesSchema,
+  issuerSignature: bytesSchema.optional().default("0x"),
+  recipientSignature: bytesSchema.optional().default("0x")
+});
+var zACPWithSealingKeys = zACPWithDefaults.extend({
+  /** X25519 private key, 0x-prefixed 32-byte hex; never leaves the client */
+  sealingPrivateKey: zod.z.string().regex(/^0x[0-9a-fA-F]{64}$/, "Invalid sealing private key").optional(),
+  sealingKey: zod.z.string().regex(/^0x[0-9a-fA-F]{64}$/, "Invalid sealing key").optional()
+});
+var ExternalValidatorRefinement = [
+  (data) => data.revokerData !== 0 && data.revokerContract !== viem.zeroAddress || data.revokerData === 0 && data.revokerContract === viem.zeroAddress,
+  {
+    error: "ACP external revoker :: revokerData and revokerContract must either both be set or both be unset.",
+    path: ["revokerData", "revokerContract"]
+  }
+];
+var RecipientRefinement = [
+  (data) => data.issuer !== data.recipient,
+  {
+    error: "Sharing acp :: issuer and recipient must not be the same",
+    path: ["issuer", "recipient"]
+  }
+];
+var SelfACPOptionsValidator = zod.z.object({
+  type: zod.z.literal("self").optional().default("self"),
+  issuer: addressNotZeroSchema,
+  name: zod.z.string().optional().default("Unnamed ACP"),
+  expiration: zod.z.int().optional().default(DEFAULT_EXPIRATION_FN),
+  recipient: addressSchema.optional().default(viem.zeroAddress),
+  revokerData: zod.z.int().optional().default(0),
+  revokerContract: addressSchema.optional().default(viem.zeroAddress),
+  scope: zod.z.int().min(0).max(2).optional(),
+  contracts: contractsSchema,
+  handles: handlesSchema,
+  issuerSignature: bytesSchema.optional().default("0x"),
+  recipientSignature: bytesSchema.optional().default("0x")
+}).refine(...ExternalValidatorRefinement).transform(withDerivedScope).refine(...ScopeConsistencyRefinement);
+var SelfACPValidator = zACPWithSealingKeys.refine((data) => data.type === "self", {
+  error: "Type must be 'self'"
+}).refine((data) => data.recipient === viem.zeroAddress, {
+  error: "Recipient must be zeroAddress"
+}).refine((data) => data.issuerSignature !== "0x", {
+  error: "IssuerSignature must be populated"
+}).refine((data) => data.recipientSignature === "0x", {
+  error: "RecipientSignature must be empty"
+}).refine(...ExternalValidatorRefinement);
+var SharingACPOptionsValidator = zod.z.object({
+  type: zod.z.literal("sharing").optional().default("sharing"),
+  issuer: addressNotZeroSchema,
+  recipient: addressNotZeroSchema,
+  name: zod.z.string().optional().default("Unnamed ACP"),
+  expiration: zod.z.int().optional().default(DEFAULT_EXPIRATION_FN),
+  revokerData: zod.z.int().optional().default(0),
+  revokerContract: addressSchema.optional().default(viem.zeroAddress),
+  scope: zod.z.int().min(0).max(2).optional(),
+  contracts: contractsSchema,
+  handles: handlesSchema,
+  issuerSignature: bytesSchema.optional().default("0x"),
+  recipientSignature: bytesSchema.optional().default("0x")
+}).refine(...RecipientRefinement).refine(...ExternalValidatorRefinement).transform(withDerivedScope).refine(...ScopeConsistencyRefinement);
+var SharingACPValidator = zACPWithSealingKeys.refine((data) => data.type === "sharing", {
+  error: "Type must be 'sharing'"
+}).refine((data) => data.recipient !== viem.zeroAddress, {
+  error: "Recipient must not be zeroAddress"
+}).refine((data) => data.issuerSignature !== "0x", {
+  error: "IssuerSignature must be populated"
+}).refine((data) => data.recipientSignature === "0x", {
+  error: "RecipientSignature must be empty"
+}).refine(...ExternalValidatorRefinement);
+var ImportACPOptionsValidator = zod.z.object({
+  type: zod.z.literal("recipient").optional().default("recipient"),
+  issuer: addressNotZeroSchema,
+  recipient: addressNotZeroSchema,
+  name: zod.z.string().optional().default("Unnamed ACP"),
+  expiration: zod.z.int(),
+  revokerData: zod.z.int().optional().default(0),
+  revokerContract: addressSchema.optional().default(viem.zeroAddress),
+  scope: zod.z.int().min(0).max(2).optional(),
+  contracts: contractsSchema,
+  handles: handlesSchema,
+  issuerSignature: bytesNotEmptySchema,
+  recipientSignature: bytesSchema.optional().default("0x")
+}).refine(...ExternalValidatorRefinement).transform(withDerivedScope).refine(...ScopeConsistencyRefinement);
+var ImportACPValidator = zACPWithSealingKeys.refine((data) => data.type === "recipient", {
+  error: "Type must be 'recipient'"
+}).refine((data) => data.recipient !== viem.zeroAddress, {
+  error: "Recipient must not be zeroAddress"
+}).refine((data) => data.issuerSignature !== "0x", {
+  error: "IssuerSignature must be populated"
+}).refine((data) => data.recipientSignature !== "0x", {
+  error: "RecipientSignature must be populated"
+}).refine(...ExternalValidatorRefinement);
+var safeParseAndThrowFormatted = (schema, data, message) => {
+  const result = schema.safeParse(data);
+  if (!result.success) {
+    throw new Error(`${message}: ${zod.z.prettifyError(result.error)}`, { cause: result.error });
+  }
+  return result.data;
+};
+var validateSelfACPOptions = (options) => {
+  return safeParseAndThrowFormatted(SelfACPOptionsValidator, options, "Invalid self acp options");
+};
+var validateSharingACPOptions = (options) => {
+  return safeParseAndThrowFormatted(SharingACPOptionsValidator, options, "Invalid sharing acp options");
+};
+var validateImportACPOptions = (options) => {
+  return safeParseAndThrowFormatted(ImportACPOptionsValidator, options, "Invalid import acp options");
+};
+var validateSelfACP = (acp) => {
+  return safeParseAndThrowFormatted(SelfACPValidator, acp, "Invalid self acp");
+};
+var validateSharingACP = (acp) => {
+  return safeParseAndThrowFormatted(SharingACPValidator, acp, "Invalid sharing acp");
+};
+var validateImportACP = (acp) => {
+  return safeParseAndThrowFormatted(ImportACPValidator, acp, "Invalid import acp");
+};
+var ValidationUtils = {
+  /**
+   * Check if acp is expired
+   */
+  isExpired: (acp) => {
+    return acp.expiration < Math.floor(Date.now() / 1e3);
+  },
+  /**
+   * Check if acp is signed by the active party
+   */
+  isSigned: (acp) => {
+    if (acp.type === "self" || acp.type === "sharing") {
+      return acp.issuerSignature !== "0x";
+    }
+    if (acp.type === "recipient") {
+      return acp.recipientSignature !== "0x";
+    }
+    return false;
+  },
+  /**
+   * Checks that an ACP is signed and not expired.
+   */
+  isSignedAndNotExpired: (acp) => {
+    if (ValidationUtils.isExpired(acp)) {
+      return { valid: false, error: "expired" };
+    }
+    if (!ValidationUtils.isSigned(acp)) {
+      return { valid: false, error: "not-signed" };
+    }
+    return { valid: true, error: null };
+  },
+  /**
+   * Asserts that an ACP is signed and not expired.
+   *
+   * Throws `Error` with message:
+   * - `ACP is expired`
+   * - `ACP is not signed`
+   */
+  assertSignedAndNotExpired: (acp) => {
+    const result = ValidationUtils.isSignedAndNotExpired(acp);
+    if (result.valid)
+      return;
+    if (result.error === "expired") {
+      throw new Error("ACP is expired");
+    }
+    if (result.error === "not-signed") {
+      throw new Error("ACP is not signed");
+    }
+    throw new Error("ACP is invalid");
+  },
+  isValid: (acp) => {
+    const schema = acp.type === "self" ? SelfACPValidator : acp.type === "sharing" ? SharingACPValidator : acp.type === "recipient" ? ImportACPValidator : null;
+    if (schema == null)
+      return { valid: false, error: "invalid-schema" };
+    const schemaResult = schema.safeParse(acp);
+    if (!schemaResult.success)
+      return { valid: false, error: "invalid-schema" };
+    return ValidationUtils.isSignedAndNotExpired(acp);
+  }
+};
+
+// acps/signature.ts
+var ACPSignatureAllFields = [
+  { name: "issuer", type: "address" },
+  { name: "expiration", type: "uint64" },
+  { name: "recipient", type: "address" },
+  { name: "revokerData", type: "uint256" },
+  { name: "revokerContract", type: "address" },
+  { name: "scope", type: "uint8" },
+  { name: "contracts", type: "address[]" },
+  { name: "handles", type: "bytes32[]" },
+  { name: "sealingKey", type: "bytes32" },
+  { name: "issuerSignature", type: "bytes" }
+];
+var SignatureTypes = {
+  ACPIssuerSelf: [
+    "issuer",
+    "expiration",
+    "recipient",
+    "revokerData",
+    "revokerContract",
+    "scope",
+    "contracts",
+    "handles",
+    "sealingKey"
+  ],
+  ACPIssuerShared: [
+    "issuer",
+    "expiration",
+    "recipient",
+    "revokerData",
+    "revokerContract",
+    "scope",
+    "contracts",
+    "handles"
+  ],
+  ACPRecipient: ["sealingKey", "issuerSignature"]
+};
+var getSignatureTypesAndMessage = (primaryType, fields, values) => {
+  const types = {
+    [primaryType]: ACPSignatureAllFields.filter((fieldType) => fields.includes(fieldType.name))
+  };
+  const message = {};
+  fields.forEach((field) => {
+    if (field in values) {
+      message[field] = values[field];
+    }
+  });
+  return { types, primaryType, message };
+};
+var SignatureUtils = {
+  /**
+   * Get signature parameters for an ACP
+   */
+  getSignatureParams: (acp, primaryType) => {
+    return getSignatureTypesAndMessage(primaryType, SignatureTypes[primaryType], acp);
+  },
+  /**
+   * Determine the required signature type based on acp type
+   */
+  getPrimaryType: (acpType) => {
+    if (acpType === "self")
+      return "ACPIssuerSelf";
+    if (acpType === "sharing")
+      return "ACPIssuerShared";
+    if (acpType === "recipient")
+      return "ACPRecipient";
+    throw new Error(`Unknown acp type: ${acpType}`);
+  }
+};
+
+// core/consts.ts
+var TASK_MANAGER_ADDRESS = "0xeA30c4B8b44078Bbf8a6ef5b9f1eC1626C7848D9";
+BigInt(1 << 30);
+
+// acps/onchain-utils.ts
+var getAclAddress = async (publicClient) => {
+  const ACL_IFACE = "function acl() view returns (address)";
+  const aclAbi = viem.parseAbi([ACL_IFACE]);
+  return await publicClient.readContract({
+    address: TASK_MANAGER_ADDRESS,
+    abi: aclAbi,
+    functionName: "acl"
+  });
+};
+var getAclEIP712Domain = async (publicClient) => {
+  const aclAddress = await getAclAddress(publicClient);
+  const EIP712_DOMAIN_IFACE = "function eip712Domain() public view returns (bytes1 fields, string name, string version, uint256 chainId, address verifyingContract, bytes32 salt, uint256[] extensions)";
+  const domainAbi = viem.parseAbi([EIP712_DOMAIN_IFACE]);
+  const domain = await publicClient.readContract({
+    address: aclAddress,
+    abi: domainAbi,
+    functionName: "eip712Domain"
+  });
+  const [_fields, name, version, chainId, verifyingContract, _salt, _extensions] = domain;
+  if (version !== "2") {
+    throw new Error(
+      `Chain ${chainId}'s ACL serves EIP-712 domain version "${version}" \u2014 this SDK requires the upgraded (ACP-era) ACL, which signs as version "2". Pre-upgrade (V2 Permission) chains are not supported.`
+    );
+  }
+  return {
+    name,
+    version,
+    chainId: Number(chainId),
+    verifyingContract
+  };
+};
+var checkACPValidityOnChain = async (acp, publicClient) => {
+  const aclAddress = await getAclAddress(publicClient);
+  try {
+    await publicClient.simulateContract({
+      address: aclAddress,
+      abi: checkACPValidityAbi,
+      functionName: "checkPermissionValidity",
+      args: [
+        {
+          issuer: acp.issuer,
+          expiration: BigInt(acp.expiration),
+          recipient: acp.recipient,
+          revokerData: BigInt(acp.revokerData),
+          revokerContract: acp.revokerContract,
+          scope: acp.scope,
+          contracts: acp.contracts,
+          handles: acp.handles,
+          sealingKey: acp.sealingKey,
+          issuerSignature: acp.issuerSignature,
+          recipientSignature: acp.recipientSignature
+        }
+      ]
+    });
+    return true;
+  } catch (err) {
+    if (err instanceof viem.BaseError) {
+      const revertError = err.walk((err2) => err2 instanceof viem.ContractFunctionRevertedError);
+      if (revertError instanceof viem.ContractFunctionRevertedError) {
+        const errorName = revertError.data?.errorName ?? "";
+        throw new Error(errorName);
+      }
+    }
+    const customErrorName = extractCustomErrorFromDetails(err, checkACPValidityAbi);
+    if (customErrorName) {
+      throw new Error(customErrorName);
+    }
+    const hhDetailsData = extractReturnData(err);
+    if (hhDetailsData != null) {
+      const decoded = viem.decodeErrorResult({
+        abi: checkACPValidityAbi,
+        data: hhDetailsData
+      });
+      throw new Error(decoded.errorName);
+    }
+    throw err;
+  }
+};
+function extractCustomErrorFromDetails(err, abi) {
+  const anyErr = err;
+  const details = anyErr?.details ?? anyErr?.cause?.details;
+  if (typeof details === "string") {
+    const customErrorMatch = details.match(/reverted with custom error '(\w+)\(\)'/);
+    if (customErrorMatch) {
+      const errorName = customErrorMatch[1];
+      const errorExists = abi.some((item) => item.type === "error" && item.name === errorName);
+      if (errorExists) {
+        return errorName;
+      }
+    }
+  }
+  return void 0;
+}
+function extractReturnData(err) {
+  const anyErr = err;
+  const s = anyErr?.details ?? anyErr?.cause?.details ?? anyErr?.shortMessage ?? anyErr?.message ?? String(err);
+  return s.match(/return data:\s*(0x[a-fA-F0-9]+)/)?.[1];
+}
+var checkACPValidityAbi = [
+  {
+    type: "function",
+    name: "checkPermissionValidity",
+    inputs: [
+      {
+        name: "acp",
+        type: "tuple",
+        internalType: "struct ACP",
+        components: [
+          {
+            name: "issuer",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "expiration",
+            type: "uint64",
+            internalType: "uint64"
+          },
+          {
+            name: "recipient",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "revokerData",
+            type: "uint256",
+            internalType: "uint256"
+          },
+          {
+            name: "revokerContract",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "scope",
+            type: "uint8",
+            internalType: "uint8"
+          },
+          {
+            name: "contracts",
+            type: "address[]",
+            internalType: "address[]"
+          },
+          {
+            name: "handles",
+            type: "bytes32[]",
+            internalType: "bytes32[]"
+          },
+          {
+            name: "sealingKey",
+            type: "bytes32",
+            internalType: "bytes32"
+          },
+          {
+            name: "issuerSignature",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "recipientSignature",
+            type: "bytes",
+            internalType: "bytes"
+          }
+        ]
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "bool",
+        internalType: "bool"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "error",
+    name: "PermissionInvalid_Disabled",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "PermissionInvalid_Expired",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "PermissionInvalid_IssuerSignature",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "PermissionInvalid_RecipientSignature",
+    inputs: []
+  }
+];
+
+// acps/acp.ts
+var ACPUtils = {
+  /**
+   * Create a self acp for personal use
+   */
+  createSelf: (options) => {
+    const validation = validateSelfACPOptions(options);
+    const sealingPair = GenerateSealingKey();
+    const acp = {
+      hash: ACPUtils.getHash(validation),
+      ...validation,
+      sealingPrivateKey: sealingPair.privateKey,
+      sealingKey: sealingPair.publicKey,
+      _signedDomain: void 0
+    };
+    return acp;
+  },
+  /**
+   * Create a sharing acp to be shared with another user
+   */
+  createSharing: (options) => {
+    const validation = validateSharingACPOptions(options);
+    const sealingPair = GenerateSealingKey();
+    const acp = {
+      hash: ACPUtils.getHash(validation),
+      ...validation,
+      sealingPrivateKey: sealingPair.privateKey,
+      sealingKey: sealingPair.publicKey,
+      _signedDomain: void 0
+    };
+    return acp;
+  },
+  /**
+   * Import a shared acp from various input formats
+   */
+  importShared: (options) => {
+    let parsedOptions;
+    if (typeof options === "string") {
+      try {
+        parsedOptions = JSON.parse(options);
+      } catch (error) {
+        throw new Error(`Failed to parse JSON string: ${error}`);
+      }
+    } else if (typeof options === "object" && options !== null) {
+      parsedOptions = options;
+    } else {
+      throw new Error("Invalid input type, expected ImportSharedACPOptions, object, or string");
+    }
+    if (parsedOptions.type != null && parsedOptions.type !== "sharing") {
+      throw new Error(`Invalid acp type <${parsedOptions.type}>, must be "sharing"`);
+    }
+    const validation = validateImportACPOptions({ ...parsedOptions, type: "recipient" });
+    const sealingPair = GenerateSealingKey();
+    const acp = {
+      hash: ACPUtils.getHash(validation),
+      ...validation,
+      sealingPrivateKey: sealingPair.privateKey,
+      sealingKey: sealingPair.publicKey,
+      _signedDomain: void 0
+    };
+    return acp;
+  },
+  /**
+   * Sign an ACP with the provided wallet client
+   */
+  sign: async (acp, publicClient, walletClient) => {
+    if (walletClient == null || walletClient.account == null) {
+      throw new Error(
+        "Missing walletClient, you must pass in a `walletClient` for the connected user to create an ACP signature"
+      );
+    }
+    const primaryType = SignatureUtils.getPrimaryType(acp.type);
+    const domain = await getAclEIP712Domain(publicClient);
+    const { types, message } = SignatureUtils.getSignatureParams(ACPUtils.getPublic(acp, true), primaryType);
+    const signature = await walletClient.signTypedData({
+      domain,
+      types,
+      primaryType,
+      message,
+      account: walletClient.account
+    });
+    let updatedACP;
+    if (acp.type === "self" || acp.type === "sharing") {
+      updatedACP = {
+        ...acp,
+        issuerSignature: signature,
+        _signedDomain: domain
+      };
+    } else {
+      updatedACP = {
+        ...acp,
+        recipientSignature: signature,
+        _signedDomain: domain
+      };
+    }
+    return updatedACP;
+  },
+  /**
+   * Create and sign a self acp in one operation
+   */
+  createSelfAndSign: async (options, publicClient, walletClient) => {
+    const acp = ACPUtils.createSelf(options);
+    return ACPUtils.sign(acp, publicClient, walletClient);
+  },
+  /**
+   * Create and sign a sharing acp in one operation
+   */
+  createSharingAndSign: async (options, publicClient, walletClient) => {
+    const acp = ACPUtils.createSharing(options);
+    return ACPUtils.sign(acp, publicClient, walletClient);
+  },
+  /**
+   * Import and sign a shared acp in one operation from various input formats
+   */
+  importSharedAndSign: async (options, publicClient, walletClient) => {
+    const acp = ACPUtils.importShared(options);
+    return ACPUtils.sign(acp, publicClient, walletClient);
+  },
+  /**
+   * Deserialize an ACP from serialized data
+   */
+  deserialize: (data) => {
+    return { ...data };
+  },
+  /**
+   * Serialize an ACP for storage
+   */
+  serialize: (acp) => {
+    return {
+      hash: acp.hash,
+      name: acp.name,
+      type: acp.type,
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles,
+      sealingKey: acp.sealingKey,
+      issuerSignature: acp.issuerSignature,
+      recipientSignature: acp.recipientSignature,
+      _signedDomain: acp._signedDomain,
+      sealingPrivateKey: acp.sealingPrivateKey
+    };
+  },
+  /**
+   * Validate an ACP (schema-level validation)
+   */
+  validateSchema: (acp) => {
+    if (acp.type === "self") {
+      return validateSelfACP(acp);
+    } else if (acp.type === "sharing") {
+      return validateSharingACP(acp);
+    } else if (acp.type === "recipient") {
+      return validateImportACP(acp);
+    } else {
+      throw new Error("Invalid ACP type");
+    }
+  },
+  /**
+   * Validate an ACP (holistic validation).
+   *
+   * This validates:
+   * - ACP schema (shape + invariants)
+   * - ACP is signed
+   * - ACP is not expired
+   *
+   * For schema-only validation, use `validateSchema(acp)`.
+   */
+  validate: (acp) => {
+    const validated = ACPUtils.validateSchema(acp);
+    ValidationUtils.assertSignedAndNotExpired(validated);
+    return validated;
+  },
+  /**
+   * Get the public component of an ACP — the signed struct sent on-chain / to the decryption backend.
+   * Strips the private component (hash, name, type, sealing pair).
+   */
+  getPublic: (acp, skipValidation = false) => {
+    if (!skipValidation) {
+      ACPUtils.validateSchema(acp);
+    }
+    return {
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles,
+      sealingKey: acp.sealingKey,
+      issuerSignature: acp.issuerSignature,
+      recipientSignature: acp.recipientSignature
+    };
+  },
+  /**
+   * Get a stable hash for the acp (used as key in storage)
+   */
+  getHash: (acp) => {
+    const data = JSON.stringify({
+      type: acp.type,
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles
+    });
+    return viem.keccak256(viem.toHex(data));
+  },
+  /**
+   * Export acp data for sharing (strips the private component).
+   * Fixed `SharedACP` shape — every field always present, aligned with
+   * `ACPPublic` and the on-chain sharing payload.
+   */
+  export: (acp) => {
+    if (acp.type !== "sharing") {
+      throw new Error(
+        `Cannot export a '${acp.type}' ACP \u2014 only 'sharing' ACPs are exportable. The export includes the issuer signature.`
+      );
+    }
+    if (acp.issuerSignature === "0x") {
+      throw new Error(
+        "Cannot export an unsigned sharing ACP \u2014 sign it first (the recipient needs the issuer signature)."
+      );
+    }
+    const shared = {
+      name: acp.name,
+      type: acp.type,
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles,
+      issuerSignature: acp.issuerSignature
+    };
+    return JSON.stringify(shared, void 0, 2);
+  },
+  /**
+   * Unseal encrypted data using the acp's sealing key
+   */
+  unseal: (acp, ciphertext) => {
+    return unsealWithPrivateKey(acp.sealingPrivateKey, ciphertext);
+  },
+  /**
+   * Check if acp is expired
+   */
+  isExpired: (acp) => {
+    return ValidationUtils.isExpired(acp);
+  },
+  /**
+   * Check if acp is signed
+   */
+  isSigned: (acp) => {
+    return ValidationUtils.isSigned(acp);
+  },
+  /**
+   * Check if acp is signed and not expired
+   */
+  isSignedAndNotExpired: (acp) => {
+    return ValidationUtils.isSignedAndNotExpired(acp);
+  },
+  /**
+   * Assert that acp is signed and not expired
+   */
+  assertSignedAndNotExpired: (acp) => {
+    return ValidationUtils.assertSignedAndNotExpired(acp);
+  },
+  isValid: (acp) => {
+    return ValidationUtils.isValid(acp);
+  },
+  /**
+   * Update acp name (returns new acp instance)
+   */
+  updateName: (acp, name) => {
+    return { ...acp, name };
+  },
+  /**
+   * Fetch EIP712 domain from the blockchain
+   */
+  fetchEIP712Domain: async (publicClient) => {
+    return getAclEIP712Domain(publicClient);
+  },
+  /**
+   * Check if acp's signed domain matches the provided domain
+   */
+  matchesDomain: (acp, domain) => {
+    return acp._signedDomain?.name === domain.name && acp._signedDomain?.version === domain.version && acp._signedDomain?.verifyingContract === domain.verifyingContract && acp._signedDomain?.chainId === domain.chainId;
+  },
+  /**
+   * Check if acp's signed domain is valid for the current chain
+   */
+  checkSignedDomainValid: async (acp, publicClient) => {
+    if (acp._signedDomain == null)
+      return false;
+    const domain = await getAclEIP712Domain(publicClient);
+    return ACPUtils.matchesDomain(acp, domain);
+  },
+  /**
+   * Check if acp passes the on-chain validation
+   */
+  checkValidityOnChain: async (acp, publicClient) => {
+    const publicAcp = ACPUtils.getPublic(acp);
+    return checkACPValidityOnChain(publicAcp, publicClient);
+  }
+};
+var ACP_STORE_DEFAULTS = {
+  acps: {},
+  activeACPHash: {}
+};
+var ACP_STORE_VERSION = 3;
+var _acpStore = vanilla.createStore()(
+  middleware.persist(() => ACP_STORE_DEFAULTS, {
+    name: "cofhesdk-acps",
+    version: ACP_STORE_VERSION,
+    migrate: (persistedState, version) => {
+      if (version < ACP_STORE_VERSION)
+        return ACP_STORE_DEFAULTS;
+      return persistedState;
+    }
+  })
+);
+var clearStaleStore = () => {
+  const state = _acpStore.getState();
+  const hasExpectedStructure = state && typeof state === "object" && "acps" in state && "activeACPHash" in state && typeof state.acps === "object" && typeof state.activeACPHash === "object";
+  if (hasExpectedStructure)
+    return;
+  _acpStore.setState({ acps: {}, activeACPHash: {} });
+};
+var getACP = (chainId, account, hash) => {
+  clearStaleStore();
+  if (chainId == null || account == null || hash == null)
+    return;
+  const savedACP = _acpStore.getState().acps[chainId]?.[account]?.[hash];
+  if (savedACP == null)
+    return;
+  return ACPUtils.deserialize(savedACP);
+};
+var getActiveACP = (chainId, account) => {
+  clearStaleStore();
+  if (chainId == null || account == null)
+    return;
+  const activeACPHash = _acpStore.getState().activeACPHash[chainId]?.[account];
+  return getACP(chainId, account, activeACPHash);
+};
+var getACPs = (chainId, account) => {
+  clearStaleStore();
+  if (chainId == null || account == null)
+    return {};
+  return Object.entries(_acpStore.getState().acps[chainId]?.[account] ?? {}).reduce(
+    (acc, [hash, acp]) => {
+      if (acp == void 0)
+        return acc;
+      return { ...acc, [hash]: ACPUtils.deserialize(acp) };
+    },
+    {}
+  );
+};
+var setACP = (chainId, account, acp) => {
+  clearStaleStore();
+  _acpStore.setState(
+    immer.produce((state) => {
+      if (state.acps[chainId] == null)
+        state.acps[chainId] = {};
+      if (state.acps[chainId][account] == null)
+        state.acps[chainId][account] = {};
+      state.acps[chainId][account][acp.hash] = ACPUtils.serialize(acp);
+    })
+  );
+};
+var removeACP = (chainId, account, hash) => {
+  clearStaleStore();
+  _acpStore.setState(
+    immer.produce((state) => {
+      if (state.acps[chainId] == null)
+        state.acps[chainId] = {};
+      if (state.activeACPHash[chainId] == null)
+        state.activeACPHash[chainId] = {};
+      const accountACPs = state.acps[chainId][account];
+      if (accountACPs == null)
+        return;
+      if (accountACPs[hash] == null)
+        return;
+      if (state.activeACPHash[chainId][account] === hash) {
+        state.activeACPHash[chainId][account] = void 0;
+      }
+      accountACPs[hash] = void 0;
+    })
+  );
+};
+var getActiveACPHash = (chainId, account) => {
+  clearStaleStore();
+  if (chainId == null || account == null)
+    return void 0;
+  return _acpStore.getState().activeACPHash[chainId]?.[account];
+};
+var setActiveACPHash = (chainId, account, hash) => {
+  clearStaleStore();
+  _acpStore.setState(
+    immer.produce((state) => {
+      if (state.activeACPHash[chainId] == null)
+        state.activeACPHash[chainId] = {};
+      state.activeACPHash[chainId][account] = hash;
+    })
+  );
+};
+var removeActiveACPHash = (chainId, account) => {
+  clearStaleStore();
+  _acpStore.setState(
+    immer.produce((state) => {
+      if (state.activeACPHash[chainId])
+        state.activeACPHash[chainId][account] = void 0;
+    })
+  );
+};
+var resetStore = () => {
+  clearStaleStore();
+  _acpStore.setState({ acps: {}, activeACPHash: {} });
+};
+var acpStore = {
+  store: _acpStore,
+  getACP,
+  getActiveACP,
+  getACPs,
+  setACP,
+  removeACP,
+  getActiveACPHash,
+  setActiveACPHash,
+  removeActiveACPHash,
+  resetStore
+};
+
+exports.ACPScope = ACPScope;
+exports.ACPUtils = ACPUtils;
+exports.ACP_STORE_DEFAULTS = ACP_STORE_DEFAULTS;
+exports.GenerateSealingKey = GenerateSealingKey;
+exports.ImportACPOptionsValidator = ImportACPOptionsValidator;
+exports.ImportACPValidator = ImportACPValidator;
+exports.SelfACPOptionsValidator = SelfACPOptionsValidator;
+exports.SelfACPValidator = SelfACPValidator;
+exports.SharingACPOptionsValidator = SharingACPOptionsValidator;
+exports.SharingACPValidator = SharingACPValidator;
+exports.SignatureTypes = SignatureTypes;
+exports.SignatureUtils = SignatureUtils;
+exports.ValidationUtils = ValidationUtils;
+exports._acpStore = _acpStore;
+exports.acpStore = acpStore;
+exports.addressNotZeroSchema = addressNotZeroSchema;
+exports.addressSchema = addressSchema;
+exports.bytesNotEmptySchema = bytesNotEmptySchema;
+exports.bytesSchema = bytesSchema;
+exports.clearStaleStore = clearStaleStore;
+exports.contractsSchema = contractsSchema;
+exports.getACP = getACP;
+exports.getACPs = getACPs;
+exports.getActiveACP = getActiveACP;
+exports.getActiveACPHash = getActiveACPHash;
+exports.getSignatureTypesAndMessage = getSignatureTypesAndMessage;
+exports.handlesSchema = handlesSchema;
+exports.removeACP = removeACP;
+exports.removeActiveACPHash = removeActiveACPHash;
+exports.resetStore = resetStore;
+exports.seal = seal;
+exports.setACP = setACP;
+exports.setActiveACPHash = setActiveACPHash;
+exports.unsealWithPrivateKey = unsealWithPrivateKey;
+exports.validateImportACP = validateImportACP;
+exports.validateImportACPOptions = validateImportACPOptions;
+exports.validateSelfACP = validateSelfACP;
+exports.validateSelfACPOptions = validateSelfACPOptions;
+exports.validateSharingACP = validateSharingACP;
+exports.validateSharingACPOptions = validateSharingACPOptions;