@cofhe/sdk 0.7.0 → 0.8.0

package/dist/web.cjs

@@ -112,7 +112,8 @@ var bigintSafeJsonStringify = (value) => {
 var isCofheError = (error) => error instanceof CofheError;
 
 // core/consts.ts
-var TASK_MANAGER_ADDRESS = "0xeA30c4B8b44078Bbf8a6ef5b9f1eC1626C7848D9";
+var COFHE_ADDRESS_BOOK_ADDRESS = "0xC0F4e00E531a2B086492Ae3DCC1515038307196b";
+var TASK_MANAGER_ID = 1n;
 var MOCKS_ZK_VERIFIER_ADDRESS = "0x0000000000000000000000000000000000005001";
 var MOCKS_THRESHOLD_NETWORK_ADDRESS = "0x0000000000000000000000000000000000005002";
 var MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY = "0x6C8D7F768A6BB4AAFE85E8A2F5A9680355239C7E14646ED62B044E39DE154512";
@@ -748,6 +749,8 @@ var CofheConfigSchema = zod.z.object({
   }).or(zod.z.null()).default(null),
   /** Whether to use Web Workers for ZK proof generation (web platform only) */
   useWorkers: zod.z.boolean().optional().default(true),
+  /** How many threads tfhe's rayon pool may use for ZK proof generation (web platform only) */
+  tfheThreads: zod.z.union([zod.z.number().int().positive(), zod.z.literal("auto"), zod.z.literal(false)]).optional().default("auto"),
   /** ACP acp defaults */
   acp: zod.z.object({
     defaultRevoker: zod.z.custom().optional(),
@@ -853,6 +856,9 @@ var DEFAULT_KEYS_STORE = {
   fhe: {},
   crs: {}
 };
+function isSecurityZoneRecord(value) {
+  return value != null && typeof value === "object";
+}
 function isStoreWithPersist(store) {
   return "persist" in store;
 }
@@ -867,10 +873,10 @@ function createKeysStore(storage) {
     const stored = keysStore.getState().fhe[chainId]?.[securityZone];
     return stored;
   };
-  const getCrs = (chainId) => {
-    if (chainId == null)
+  const getCrs = (chainId, securityZone = 0) => {
+    if (chainId == null || securityZone == null)
       return void 0;
-    const stored = keysStore.getState().crs[chainId];
+    const stored = keysStore.getState().crs[chainId]?.[securityZone];
     return stored;
   };
   const setFheKey = (chainId, securityZone, key) => {
@@ -882,10 +888,12 @@ function createKeysStore(storage) {
       })
     );
   };
-  const setCrs = (chainId, crs) => {
+  const setCrs = (chainId, securityZone, crs) => {
     keysStore.setState(
       immer.produce((state) => {
-        state.crs[chainId] = crs;
+        if (state.crs[chainId] == null)
+          state.crs[chainId] = {};
+        state.crs[chainId][securityZone] = crs;
       })
     );
   };
@@ -933,7 +941,13 @@ function createStoreWithPersit(storage) {
           const currentZones = current.fhe[chainId] || {};
           mergedFhe[chainId] = { ...persistedZones, ...currentZones };
         }
-        const mergedCrs = { ...persisted.crs, ...current.crs };
+        const mergedCrs = {};
+        const allCrsChainIds = /* @__PURE__ */ new Set([...Object.keys(current.crs), ...Object.keys(persisted.crs)]);
+        for (const chainId of allCrsChainIds) {
+          const persistedZones = isSecurityZoneRecord(persisted.crs[chainId]) ? persisted.crs[chainId] : {};
+          const currentZones = isSecurityZoneRecord(current.crs[chainId]) ? current.crs[chainId] : {};
+          mergedCrs[chainId] = { ...persistedZones, ...currentZones };
+        }
         return {
           fhe: mergedFhe,
           crs: mergedCrs
@@ -995,7 +1009,7 @@ var fetchFhePublicKey = async (coFheUrl, chainId, securityZone, tfhePublicKeyDes
   return [pk_data, true];
 };
 var fetchCrs = async (coFheUrl, chainId, securityZone, compactPkeCrsDeserializer2, keysStorage) => {
-  const storedKey = keysStorage?.getCrs(chainId);
+  const storedKey = keysStorage?.getCrs(chainId, securityZone);
   const [storedKeyValid] = checkKeyValidity(storedKey, compactPkeCrsDeserializer2);
   if (storedKeyValid)
     return [storedKey, false];
@@ -1022,7 +1036,7 @@ var fetchCrs = async (coFheUrl, chainId, securityZone, compactPkeCrsDeserializer
     console.error(`Error serializing CRS ${err}`);
     throw new Error(`Error serializing CRS; ${err}`);
   }
-  keysStorage?.setCrs(chainId, crs_data);
+  keysStorage?.setCrs(chainId, securityZone, crs_data);
   return [crs_data, true];
 };
 var fetchKeys = async (config, chainId, securityZone = 0, tfhePublicKeyDeserializer2, compactPkeCrsDeserializer2, keysStorage) => {
@@ -1134,6 +1148,7 @@ var EncryptInputsBuilder = class extends BaseBuilder {
   zkBuilderAndCrsGenerator;
   initTfhe;
   zkProveWorkerFn;
+  beforeMainThreadProve;
   keysStorage;
   // Worker configuration (from config, overrideable)
   useWorker;
@@ -1191,6 +1206,7 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     this.zkBuilderAndCrsGenerator = params.zkBuilderAndCrsGenerator;
     this.initTfhe = params.initTfhe;
     this.zkProveWorkerFn = params.zkProveWorkerFn;
+    this.beforeMainThreadProve = params.beforeMainThreadProve;
     this.keysStorage = params.keysStorage;
     this.useWorker = params.config?.useWorkers ?? true;
   }
@@ -1481,6 +1497,7 @@ var EncryptInputsBuilder = class extends BaseBuilder {
       }
     }
     if (proof == null) {
+      await this.beforeMainThreadProve?.();
       proof = await zkProve(zkBuilder, zkCrs, metadata);
       usedWorker = false;
     }
@@ -1877,11 +1894,40 @@ var SignatureUtils = {
     throw new Error(`Unknown acp type: ${acpType}`);
   }
 };
+var ADDRESS_BOOK_ABI = viem.parseAbi([
+  "function getTm(uint256 id) view returns (address)",
+  "error TaskManagerNotSet(uint256 id)"
+]);
+var taskManagerAddressCache = /* @__PURE__ */ new Map();
+var getTaskManagerAddress = async (publicClient, chainId) => {
+  const id = chainId ?? publicClient.chain?.id ?? await publicClient.getChainId();
+  const cached = taskManagerAddressCache.get(id);
+  if (cached != null)
+    return cached;
+  const pending = publicClient.readContract({
+    address: COFHE_ADDRESS_BOOK_ADDRESS,
+    abi: ADDRESS_BOOK_ABI,
+    functionName: "getTm",
+    args: [TASK_MANAGER_ID]
+  }).catch((error) => {
+    taskManagerAddressCache.delete(id);
+    throw CofheError.fromError(error, {
+      code: "TASK_MANAGER_UNRESOLVED" /* TaskManagerUnresolved */,
+      message: `Failed to resolve the Task Manager from the CoFHEAddressBook on chain ${id}`,
+      hint: "Ensure CoFHE is deployed on this chain. On a local hardhat / anvil chain, deploy the CoFHE mocks first.",
+      context: { chainId: id, addressBook: COFHE_ADDRESS_BOOK_ADDRESS, taskManagerId: TASK_MANAGER_ID }
+    });
+  });
+  taskManagerAddressCache.set(id, pending);
+  return pending;
+};
+
+// acps/onchain-utils.ts
 var getAclAddress = async (publicClient) => {
   const ACL_IFACE = "function acl() view returns (address)";
   const aclAbi = viem.parseAbi([ACL_IFACE]);
   return await publicClient.readContract({
-    address: TASK_MANAGER_ADDRESS,
+    address: await getTaskManagerAddress(publicClient),
     abi: aclAbi,
     functionName: "acl"
   });
@@ -1908,6 +1954,34 @@ var getAclEIP712Domain = async (publicClient) => {
     verifyingContract
   };
 };
+var toACPTuple = (acp) => ({
+  issuer: acp.issuer,
+  expiration: BigInt(acp.expiration),
+  recipient: acp.recipient,
+  revokerData: BigInt(acp.revokerData),
+  revokerContract: acp.revokerContract,
+  scope: acp.scope,
+  contracts: acp.contracts,
+  handles: acp.handles,
+  sealingKey: acp.sealingKey,
+  issuerSignature: acp.issuerSignature,
+  recipientSignature: acp.recipientSignature
+});
+function revertErrorName(err, abi) {
+  const walk = err?.walk;
+  if (typeof walk === "function") {
+    const revertError = walk.call(err, (e) => e?.name === "ContractFunctionRevertedError");
+    if (revertError)
+      return revertError.data?.errorName ?? "";
+  }
+  const customErrorName = extractCustomErrorFromDetails(err, abi);
+  if (customErrorName)
+    return customErrorName;
+  const hhDetailsData = extractReturnData(err);
+  if (hhDetailsData != null)
+    return viem.decodeErrorResult({ abi, data: hhDetailsData }).errorName;
+  return void 0;
+}
 var checkACPValidityOnChain = async (acp, publicClient) => {
   const aclAddress = await getAclAddress(publicClient);
   try {
@@ -1915,43 +1989,54 @@ var checkACPValidityOnChain = async (acp, publicClient) => {
       address: aclAddress,
       abi: checkACPValidityAbi,
       functionName: "checkPermissionValidity",
-      args: [
-        {
-          issuer: acp.issuer,
-          expiration: BigInt(acp.expiration),
-          recipient: acp.recipient,
-          revokerData: BigInt(acp.revokerData),
-          revokerContract: acp.revokerContract,
-          scope: acp.scope,
-          contracts: acp.contracts,
-          handles: acp.handles,
-          sealingKey: acp.sealingKey,
-          issuerSignature: acp.issuerSignature,
-          recipientSignature: acp.recipientSignature
-        }
-      ]
+      args: [toACPTuple(acp)]
     });
     return true;
   } catch (err) {
-    if (err instanceof viem.BaseError) {
-      const revertError = err.walk((err2) => err2 instanceof viem.ContractFunctionRevertedError);
-      if (revertError instanceof viem.ContractFunctionRevertedError) {
-        const errorName = revertError.data?.errorName ?? "";
-        throw new Error(errorName);
-      }
-    }
-    const customErrorName = extractCustomErrorFromDetails(err, checkACPValidityAbi);
-    if (customErrorName) {
-      throw new Error(customErrorName);
-    }
-    const hhDetailsData = extractReturnData(err);
-    if (hhDetailsData != null) {
-      const decoded = viem.decodeErrorResult({
-        abi: checkACPValidityAbi,
-        data: hhDetailsData
+    const errorName = revertErrorName(err, checkACPValidityAbi);
+    if (errorName !== void 0)
+      throw new Error(errorName);
+    throw err;
+  }
+};
+var PERMISSION_ERROR_STATUS = {
+  PermissionInvalid_Expired: "expired",
+  PermissionInvalid_Disabled: "revoked",
+  PermissionInvalid_IssuerSignature: "invalid-issuer-signature",
+  PermissionInvalid_RecipientSignature: "invalid-recipient-signature"
+};
+var getACPAccessStatusOnChain = async (acp, publicClient, handle) => {
+  const aclAddress = await getAclAddress(publicClient);
+  try {
+    if (handle === void 0) {
+      await publicClient.simulateContract({
+        address: aclAddress,
+        abi: acpAccessAbi,
+        functionName: "checkPermissionValidity",
+        args: [toACPTuple(acp)]
       });
-      throw new Error(decoded.errorName);
+      return "valid";
     }
+    const ctHash = BigInt(handle);
+    const allowed = await publicClient.readContract({
+      address: aclAddress,
+      abi: acpAccessAbi,
+      functionName: "isAllowedWithPermission",
+      args: [toACPTuple(acp), ctHash]
+    });
+    if (allowed)
+      return "allowed";
+    const issuerAllowed = await publicClient.readContract({
+      address: aclAddress,
+      abi: acpAccessAbi,
+      functionName: "isAllowed",
+      args: [ctHash, acp.issuer]
+    });
+    return issuerAllowed ? "out-of-scope" : "issuer-not-allowed";
+  } catch (err) {
+    const status = PERMISSION_ERROR_STATUS[revertErrorName(err, acpAccessAbi) ?? ""];
+    if (status)
+      return status;
     throw err;
   }
 };
@@ -1973,7 +2058,8 @@ function extractCustomErrorFromDetails(err, abi) {
 function extractReturnData(err) {
   const anyErr = err;
   const s = anyErr?.details ?? anyErr?.cause?.details ?? anyErr?.shortMessage ?? anyErr?.message ?? String(err);
-  return s.match(/return data:\s*(0x[a-fA-F0-9]+)/)?.[1];
+  const match = s.match(/return data:\s*(0x[a-fA-F0-9]+)/) ?? s.match(/custom error (0x[a-fA-F0-9]{8,})/);
+  return match?.[1];
 }
 var checkACPValidityAbi = [
   {
@@ -2073,6 +2159,58 @@ var checkACPValidityAbi = [
     inputs: []
   }
 ];
+var acpAccessAbi = [
+  ...checkACPValidityAbi,
+  {
+    type: "function",
+    name: "isAllowedWithPermission",
+    inputs: [checkACPValidityAbi[0].inputs[0], { name: "handle", type: "uint256", internalType: "uint256" }],
+    outputs: [{ name: "", type: "bool", internalType: "bool" }],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "isAllowed",
+    inputs: [
+      { name: "handle", type: "uint256", internalType: "uint256" },
+      { name: "account", type: "address", internalType: "address" }
+    ],
+    outputs: [{ name: "", type: "bool", internalType: "bool" }],
+    stateMutability: "view"
+  }
+];
+var ACL_SERVED_ADDRESSES_ABI = viem.parseAbi([
+  "function acl() view returns (address)",
+  "function defaultRevokerContract() view returns (address)",
+  "function shareRegistry() view returns (address)"
+]);
+var aclServedAddressesCache = /* @__PURE__ */ new Map();
+var clearAclServedAddresses = () => aclServedAddressesCache.clear();
+var getAclServedAddresses = async (publicClient, chainId) => {
+  const cached = aclServedAddressesCache.get(chainId);
+  if (cached != null)
+    return cached;
+  let aclAddress;
+  try {
+    aclAddress = await publicClient.readContract({
+      address: await getTaskManagerAddress(publicClient, chainId),
+      abi: ACL_SERVED_ADDRESSES_ABI,
+      functionName: "acl"
+    });
+  } catch {
+    return {};
+  }
+  const [defaultRevoker, shareRegistry] = await Promise.all([
+    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "defaultRevokerContract" }).catch(() => void 0),
+    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "shareRegistry" }).catch(() => void 0)
+  ]);
+  const resolved = {
+    defaultRevoker: defaultRevoker != null && defaultRevoker !== viem.zeroAddress ? defaultRevoker : void 0,
+    shareRegistry: shareRegistry != null && shareRegistry !== viem.zeroAddress ? shareRegistry : void 0
+  };
+  aclServedAddressesCache.set(chainId, resolved);
+  return resolved;
+};
 
 // acps/acp.ts
 var ACPUtils = {
@@ -2386,8 +2524,62 @@ var ACPUtils = {
   checkValidityOnChain: async (acp, publicClient) => {
     const publicAcp = ACPUtils.getPublic(acp);
     return checkACPValidityOnChain(publicAcp, publicClient);
+  },
+  /**
+   * The acp on-chain status as a value instead of a revert: 'valid' or why not, and given a
+   * handle, whether the acp may read it (see `ACPAccessStatus`).
+   */
+  checkAccessOnChain: async (acp, publicClient, handle) => {
+    return getACPAccessStatusOnChain(ACPUtils.getPublic(acp), publicClient, handle);
   }
 };
+var ACP_REVOKER_ABI = viem.parseAbi([
+  "function revokeSingle(uint256 id)",
+  "function revokeAllExisting()",
+  "function disabled(address issuer, uint256 id) view returns (bool)"
+]);
+var ACP_SHARE_REGISTRY_ABI = viem.parseAbi([
+  "struct ACP { address issuer; uint64 expiration; address recipient; uint256 revokerData; address revokerContract; uint8 scope; address[] contracts; bytes32[] handles; bytes32 sealingKey; bytes issuerSignature; bytes recipientSignature; }",
+  "function share(ACP calldata acp) external returns (bytes32)",
+  "function removeShare(bytes32 shareId) external",
+  "function sharesFor(address recipient) external view returns (ACP[] memory)",
+  "function getShare(bytes32 shareId) external view returns (ACP memory)",
+  "function isShareValid(bytes32 shareId) external view returns (bool)"
+]);
+var ACP_SHARE_TUPLE_ABI = [
+  {
+    type: "tuple",
+    components: [
+      { name: "issuer", type: "address" },
+      { name: "expiration", type: "uint64" },
+      { name: "recipient", type: "address" },
+      { name: "revokerData", type: "uint256" },
+      { name: "revokerContract", type: "address" },
+      { name: "scope", type: "uint8" },
+      { name: "contracts", type: "address[]" },
+      { name: "handles", type: "bytes32[]" },
+      { name: "sealingKey", type: "bytes32" },
+      { name: "issuerSignature", type: "bytes" },
+      { name: "recipientSignature", type: "bytes" }
+    ]
+  }
+];
+var ZERO_BYTES32 = `0x${"0".repeat(64)}`;
+var toChainShare = (acp) => {
+  const pub = ACPUtils.getPublic(acp, true);
+  return {
+    ...pub,
+    expiration: BigInt(pub.expiration),
+    revokerData: BigInt(pub.revokerData),
+    sealingKey: ZERO_BYTES32,
+    recipientSignature: "0x"
+  };
+};
+var computeShareId = (acp) => {
+  const p = toChainShare(acp);
+  return viem.keccak256(viem.encodeAbiParameters(ACP_SHARE_TUPLE_ABI, [p]));
+};
+var shareIdOfChainShare = (share) => viem.keccak256(viem.encodeAbiParameters(ACP_SHARE_TUPLE_ABI, [share]));
 var ACP_STORE_DEFAULTS = {
   acps: {},
   activeACPHash: {}
@@ -2513,11 +2705,6 @@ var acpStore = {
   removeActiveACPHash,
   resetStore
 };
-var ACP_VALIDATOR_ABI = viem.parseAbi([
-  "function revokeSingle(uint256 id)",
-  "function revokeAllExisting()",
-  "function disabled(address issuer, uint256 id) view returns (bool)"
-]);
 var storeACP = async (acp, publicClient, walletClient) => {
   const chainId = await publicClient.getChainId();
   const account = walletClient.account.address;
@@ -2544,8 +2731,8 @@ var createSelf = async (options, publicClient, walletClient) => {
 var createSharing = async (options, publicClient, walletClient) => {
   return createACPWithSign(options, publicClient, walletClient, ACPUtils.createSharingAndSign, false);
 };
-var importShared = async (options, publicClient, walletClient) => {
-  return createACPWithSign(options, publicClient, walletClient, ACPUtils.importSharedAndSign);
+var importShared = async (options, publicClient, walletClient, { activate = true } = {}) => {
+  return createACPWithSign(options, publicClient, walletClient, ACPUtils.importSharedAndSign, activate);
 };
 var getHash = (acp) => {
   return ACPUtils.getHash(acp);
@@ -2607,38 +2794,6 @@ var applyACPDefaults = (options, acpConfig, chainId) => {
   }
   return result;
 };
-var ACL_SERVED_ADDRESSES_ABI = viem.parseAbi([
-  "function acl() view returns (address)",
-  "function defaultRevokerContract() view returns (address)",
-  "function shareRegistry() view returns (address)"
-]);
-var aclServedAddressesCache = /* @__PURE__ */ new Map();
-var clearAclServedAddresses = () => aclServedAddressesCache.clear();
-var getAclServedAddresses = async (publicClient, chainId) => {
-  const cached = aclServedAddressesCache.get(chainId);
-  if (cached != null)
-    return cached;
-  let aclAddress;
-  try {
-    aclAddress = await publicClient.readContract({
-      address: TASK_MANAGER_ADDRESS,
-      abi: ACL_SERVED_ADDRESSES_ABI,
-      functionName: "acl"
-    });
-  } catch {
-    return {};
-  }
-  const [defaultRevoker, shareRegistry] = await Promise.all([
-    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "defaultRevokerContract" }).catch(() => void 0),
-    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "shareRegistry" }).catch(() => void 0)
-  ]);
-  const resolved = {
-    defaultRevoker: defaultRevoker != null && defaultRevoker !== viem.zeroAddress ? defaultRevoker : void 0,
-    shareRegistry: shareRegistry != null && shareRegistry !== viem.zeroAddress ? shareRegistry : void 0
-  };
-  aclServedAddressesCache.set(chainId, resolved);
-  return resolved;
-};
 var applyACPDefaultsFromChain = async (options, acpConfig, publicClient, chainId) => {
   const hasExplicitRevoker = acpConfig?.defaultRevoker?.[chainId] != null || options.revokerData != null || options.revokerContract != null;
   if (hasExplicitRevoker)
@@ -2658,7 +2813,7 @@ var revokeACP = async (acp, walletClient) => {
   }
   return walletClient.writeContract({
     address: acp.revokerContract,
-    abi: ACP_VALIDATOR_ABI,
+    abi: ACP_REVOKER_ABI,
     functionName: "revokeSingle",
     args: [BigInt(acp.revokerData)],
     account: walletClient.account,
@@ -2679,64 +2834,31 @@ var revokeAllACPs = async (walletClient, publicClient, revokerContract) => {
   }
   return walletClient.writeContract({
     address: revoker,
-    abi: ACP_VALIDATOR_ABI,
+    abi: ACP_REVOKER_ABI,
     functionName: "revokeAllExisting",
     args: [],
     account: walletClient.account,
     chain: walletClient.chain
   });
 };
+var checkAccess = async (acp, publicClient, handle) => {
+  if (acp.type === "sharing" && handle === void 0) {
+    if (ACPUtils.isExpired(acp))
+      return "expired";
+    return await isACPRevoked(acp, publicClient) ? "revoked" : "valid";
+  }
+  return ACPUtils.checkAccessOnChain(acp, publicClient, handle);
+};
 var isACPRevoked = async (acp, publicClient) => {
   if (acp.revokerContract === viem.zeroAddress || acp.revokerData === 0)
     return false;
   return publicClient.readContract({
     address: acp.revokerContract,
-    abi: ACP_VALIDATOR_ABI,
+    abi: ACP_REVOKER_ABI,
     functionName: "disabled",
     args: [acp.issuer, BigInt(acp.revokerData)]
   });
 };
-var ACP_SHARE_REGISTRY_ABI = viem.parseAbi([
-  "struct ACP { address issuer; uint64 expiration; address recipient; uint256 revokerData; address revokerContract; uint8 scope; address[] contracts; bytes32[] handles; bytes32 sealingKey; bytes issuerSignature; bytes recipientSignature; }",
-  "function share(ACP calldata acp) external returns (bytes32)",
-  "function removeShare(bytes32 shareId) external",
-  "function sharesFor(address recipient) external view returns (ACP[] memory)",
-  "function getShare(bytes32 shareId) external view returns (ACP memory)",
-  "function isShareValid(bytes32 shareId) external view returns (bool)"
-]);
-var ACP_TUPLE = [
-  {
-    type: "tuple",
-    components: [
-      { name: "issuer", type: "address" },
-      { name: "expiration", type: "uint64" },
-      { name: "recipient", type: "address" },
-      { name: "revokerData", type: "uint256" },
-      { name: "revokerContract", type: "address" },
-      { name: "scope", type: "uint8" },
-      { name: "contracts", type: "address[]" },
-      { name: "handles", type: "bytes32[]" },
-      { name: "sealingKey", type: "bytes32" },
-      { name: "issuerSignature", type: "bytes" },
-      { name: "recipientSignature", type: "bytes" }
-    ]
-  }
-];
-var ZERO_BYTES32 = `0x${"0".repeat(64)}`;
-var toChainShare = (acp) => {
-  const pub = ACPUtils.getPublic(acp, true);
-  return {
-    ...pub,
-    expiration: BigInt(pub.expiration),
-    revokerData: BigInt(pub.revokerData),
-    sealingKey: ZERO_BYTES32,
-    recipientSignature: "0x"
-  };
-};
-var computeShareId = (acp) => {
-  const p = toChainShare(acp);
-  return viem.keccak256(viem.encodeAbiParameters(ACP_TUPLE, [p]));
-};
 var shareOnChain = async (acp, walletClient, registry) => {
   if (acp.type !== "sharing") {
     throw new Error(`Cannot share a '${acp.type}' ACP on-chain \u2014 only 'sharing' ACPs are shareable.`);
@@ -2767,7 +2889,7 @@ var getIncomingShares = async (publicClient, registry, recipient) => {
     args: [recipient]
   });
   return raw.map((s) => ({
-    shareId: viem.keccak256(viem.encodeAbiParameters(ACP_TUPLE, [s])),
+    shareId: shareIdOfChainShare(s),
     issuer: s.issuer,
     expiration: Number(s.expiration),
     recipient: s.recipient,
@@ -2779,9 +2901,9 @@ var getIncomingShares = async (publicClient, registry, recipient) => {
     issuerSignature: s.issuerSignature
   }));
 };
-var importFromChain = async (share, publicClient, walletClient) => {
+var importFromChain = async (share, publicClient, walletClient, importOptions = {}) => {
   const { shareId: _shareId, ...options } = share;
-  return importShared({ ...options, type: "sharing" }, publicClient, walletClient);
+  return importShared({ ...options, type: "sharing" }, publicClient, walletClient, importOptions);
 };
 var removeShareOnChain = async (shareId, walletClient, registry) => {
   if (walletClient.account == null)
@@ -2819,6 +2941,7 @@ var acps = {
   revokeACP,
   revokeAllACPs,
   isACPRevoked,
+  checkAccess,
   shareOnChain,
   getIncomingShares,
   importFromChain,
@@ -4531,7 +4654,7 @@ var buildDecryptResultHash = (ctHash, cleartext, chainId) => {
 async function verifyDecryptResult(handle, cleartext, signature, publicClient) {
   const chainId = publicClient.chain?.id ?? await publicClient.getChainId();
   const expectedSigner = await publicClient.readContract({
-    address: TASK_MANAGER_ADDRESS,
+    address: await getTaskManagerAddress(publicClient, chainId),
     abi: decryptResultSignerAbi,
     functionName: "decryptResultSigner",
     args: []
@@ -4651,6 +4774,7 @@ function createCofheClientBase(opts) {
       zkBuilderAndCrsGenerator: opts.zkBuilderAndCrsGenerator,
       initTfhe: opts.initTfhe,
       zkProveWorkerFn: opts.zkProveWorkerFn,
+      beforeMainThreadProve: opts.beforeMainThreadProve,
       keysStorage,
       requireConnected: _requireConnected
     });
@@ -4727,10 +4851,11 @@ function createCofheClientBase(opts) {
         walletClient
       );
     },
-    importShared: async (options, clients) => {
+    importShared: async (options, importOptions = {}) => {
       _requireConnected();
-      const { publicClient, walletClient } = clients ?? connectStore.getState();
-      return acps.importShared(options, publicClient, walletClient);
+      const { activate, ...clients } = importOptions;
+      const { publicClient, walletClient } = clients.publicClient ? clients : connectStore.getState();
+      return acps.importShared(options, publicClient, walletClient, { activate });
     },
     // Get or create methods (require connection)
     getOrCreateSelfACP: async (chainId, account, options) => {
@@ -4773,6 +4898,11 @@ function createCofheClientBase(opts) {
       const { publicClient } = connectStore.getState();
       return acps.isACPRevoked(acp, publicClient);
     },
+    checkAccess: async (acp, handle) => {
+      _requireConnected();
+      const { publicClient } = connectStore.getState();
+      return acps.checkAccess(acp, publicClient, handle);
+    },
     // On-chain sharing (require connection + config.acp.sharingRegistry)
     shareOnChain: async (acp) => {
       _requireConnected();
@@ -4789,10 +4919,10 @@ function createCofheClientBase(opts) {
       const sharingRegistry = await _resolveSharingRegistry(publicClient, chainId);
       return acps.getIncomingShares(publicClient, sharingRegistry, account);
     },
-    importFromChain: async (share) => {
+    importFromChain: async (share, options) => {
       _requireConnected();
       const { publicClient, walletClient } = connectStore.getState();
-      return acps.importFromChain(share, publicClient, walletClient);
+      return acps.importFromChain(share, publicClient, walletClient, options);
     },
     dismissShare: async (shareId) => {
       _requireConnected();
@@ -5004,7 +5134,7 @@ var ZkProveWorkerManager = class {
   /**
    * Submit a proof generation request to the worker
    */
-  async submitProof(fheKeyHex, crsHex, items, metadata) {
+  async submitProof(fheKeyHex, crsHex, items, metadata, tfheThreads) {
     await this.initializeWorker();
     const id = `zkprove-${Date.now()}-${this.requestCounter++}`;
     return new Promise((resolve, reject) => {
@@ -5019,7 +5149,8 @@ var ZkProveWorkerManager = class {
         fheKeyHex,
         crsHex,
         items,
-        metadata: Array.from(metadata)
+        metadata: Array.from(metadata),
+        tfheThreads
       };
       this.worker.postMessage(message);
     });
@@ -5064,17 +5195,91 @@ function areWorkersAvailable() {
   return typeof Worker !== "undefined";
 }
 
+// web/tfheThreadPool.ts
+var MAX_AUTO_THREADS = 8;
+function resolveThreadCount(setting = "auto") {
+  if (setting === false)
+    return 1;
+  if (typeof setting === "number") {
+    return Number.isFinite(setting) && setting >= 1 ? Math.floor(setting) : 1;
+  }
+  const cores = globalThis.navigator?.hardwareConcurrency ?? 1;
+  if (!Number.isFinite(cores) || cores < 1)
+    return 1;
+  return Math.min(Math.floor(cores), MAX_AUTO_THREADS);
+}
+function isCrossOriginIsolated() {
+  return globalThis.crossOriginIsolated === true;
+}
+async function initTfheThreadPool(mod, setting = "auto") {
+  if (setting === false) {
+    return { enabled: false, threads: 1, reason: "disabled via config.tfheThreads" };
+  }
+  if (typeof mod.initThreadPool !== "function") {
+    return { enabled: false, threads: 1, reason: "tfhe build has no initThreadPool (single-threaded wasm)" };
+  }
+  if (typeof Worker === "undefined") {
+    return { enabled: false, threads: 1, reason: "Worker is unavailable" };
+  }
+  if (!isCrossOriginIsolated()) {
+    return {
+      enabled: false,
+      threads: 1,
+      reason: "not cross-origin isolated \u2014 serve the page with Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp (or credentialless) to enable multi-threaded proving"
+    };
+  }
+  const threads = resolveThreadCount(setting);
+  if (threads <= 1) {
+    return { enabled: false, threads: 1, reason: "resolved to a single thread" };
+  }
+  try {
+    await mod.initThreadPool(threads);
+    return { enabled: true, threads };
+  } catch (error) {
+    return {
+      enabled: false,
+      threads: 1,
+      reason: `initThreadPool failed: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+
 // web/index.ts
 var tfheModule = null;
 var tfheInitialized = false;
-async function initTfhe() {
+var tfheInitPromise = null;
+var threadPoolPromise = null;
+var threadPoolResult = null;
+function getTfheThreadPoolStatus() {
+  return threadPoolResult;
+}
+var initTfhe = async () => {
   if (tfheInitialized)
     return false;
-  tfheModule = await import('tfhe');
-  await tfheModule.default();
-  await tfheModule.init_panic_hook();
-  tfheInitialized = true;
+  if (tfheInitPromise) {
+    await tfheInitPromise;
+    return false;
+  }
+  tfheInitPromise = (async () => {
+    const mod = await import('tfhe');
+    await mod.default();
+    await mod.init_panic_hook();
+    tfheModule = mod;
+    tfheInitialized = true;
+  })();
+  try {
+    await tfheInitPromise;
+  } catch (error) {
+    tfheInitPromise = null;
+    throw error;
+  }
   return true;
+};
+function createStartMainThreadPool(tfheThreads) {
+  return async () => {
+    threadPoolPromise ??= initTfheThreadPool(requireTfhe(), tfheThreads);
+    threadPoolResult = await threadPoolPromise;
+  };
 }
 function requireTfhe() {
   if (!tfheModule) {
@@ -5110,13 +5315,15 @@ var zkBuilderAndCrsGenerator = (fhe, crs) => {
   const zkCrs = _deserializeCompactPkeCrs(crs);
   return { zkBuilder, zkCrs };
 };
-async function zkProveWithWorker2(fheKeyHex, crsHex, items, metadata) {
-  const serializedItems = items.map((item) => ({
-    utype: fheTypeToString(item.utype),
-    data: typeof item.data === "bigint" ? item.data.toString() : item.data
-  }));
-  const workerManager2 = getWorkerManager();
-  return await workerManager2.submitProof(fheKeyHex, crsHex, serializedItems, metadata);
+function createZkProveWithWorker(tfheThreads) {
+  return async function zkProveWithWorker2(fheKeyHex, crsHex, items, metadata) {
+    const serializedItems = items.map((item) => ({
+      utype: fheTypeToString(item.utype),
+      data: typeof item.data === "bigint" ? item.data.toString() : item.data
+    }));
+    const workerManager2 = getWorkerManager();
+    return await workerManager2.submitProof(fheKeyHex, crsHex, serializedItems, metadata, tfheThreads);
+  };
 }
 function createCofheConfig(config) {
   return createCofheConfigBase({
@@ -5132,9 +5339,10 @@ function createCofheClient(config) {
     tfhePublicKeyDeserializer,
     compactPkeCrsDeserializer,
     initTfhe,
+    beforeMainThreadProve: createStartMainThreadPool(config.tfheThreads),
     // Always provide the worker function if available - config.useWorkers controls usage
     // areWorkersAvailable will return true if the Worker API is available and false in Node.js
-    zkProveWorkerFn: areWorkersAvailable() ? zkProveWithWorker2 : void 0
+    zkProveWorkerFn: areWorkersAvailable() ? createZkProveWithWorker(config.tfheThreads) : void 0
   });
 }
 function createCofheClientWithCustomWorker(config, customZkProveWorkerFn) {
@@ -5144,6 +5352,7 @@ function createCofheClientWithCustomWorker(config, customZkProveWorkerFn) {
     tfhePublicKeyDeserializer,
     compactPkeCrsDeserializer,
     initTfhe,
+    beforeMainThreadProve: createStartMainThreadPool(config.tfheThreads),
     zkProveWorkerFn: customZkProveWorkerFn
   });
 }
@@ -5153,5 +5362,6 @@ exports.createCofheClient = createCofheClient;
 exports.createCofheClientWithCustomWorker = createCofheClientWithCustomWorker;
 exports.createCofheConfig = createCofheConfig;
 exports.createSsrStorage = createSsrStorage;
+exports.getTfheThreadPoolStatus = getTfheThreadPoolStatus;
 exports.hasDOM = hasDOM;
 exports.terminateWorker = terminateWorker;