@cofhe/sdk 0.7.1 → 0.8.0

package/dist/{chunk-43USWPEH.js → chunk-GGI7Y6AW.js}

@@ -1,173 +1,14 @@
-import { hardhat as hardhat$1 } from './chunk-N6IDQRRU.js';
-import { acpStore, ACPUtils } from './chunk-Q7CBWGQX.js';
-import { TFHE_RS_KEY_VERSION, TASK_MANAGER_ADDRESS, TFHE_RS_ZK_MAX_BITS, TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT, MOCKS_THRESHOLD_NETWORK_ADDRESS, MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY, MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY, MOCKS_ZK_VERIFIER_ADDRESS } from './chunk-ESMZCFJY.js';
+import { hardhat as hardhat$1 } from './chunk-UKQAJK4N.js';
+import { acpStore, CofheError, clearAclServedAddresses, getAclServedAddresses, computeShareId, ACPUtils, getTaskManagerAddress, ACP_SHARE_REGISTRY_ABI, shareIdOfChainShare, toChainShare, ACP_REVOKER_ABI } from './chunk-UJYOBHYA.js';
+import { TFHE_RS_KEY_VERSION, TFHE_RS_ZK_MAX_BITS, TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT, MOCKS_THRESHOLD_NETWORK_ADDRESS, MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY, MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY, MOCKS_ZK_VERIFIER_ADDRESS } from './chunk-NMKMCAI3.js';
 import { createStore } from 'zustand/vanilla';
-import { parseAbi, isAddressEqual, zeroAddress, recoverAddress, keccak256, encodeAbiParameters, encodePacked, createWalletClient, http, getAddress, parseSignature, serializeSignature } from 'viem';
+import { parseAbi, isAddressEqual, zeroAddress, recoverAddress, encodePacked, keccak256, createWalletClient, http, getAddress, parseSignature, serializeSignature } from 'viem';
 import { hardhat } from 'viem/chains';
 import { sign, privateKeyToAccount } from 'viem/accounts';
 import { z } from 'zod';
 import { persist, createJSONStorage } from 'zustand/middleware';
 import { produce } from 'immer';
 
-// core/error.ts
-var CofheErrorCode = /* @__PURE__ */ ((CofheErrorCode2) => {
-  CofheErrorCode2["InternalError"] = "INTERNAL_ERROR";
-  CofheErrorCode2["UnknownEnvironment"] = "UNKNOWN_ENVIRONMENT";
-  CofheErrorCode2["InitTfheFailed"] = "INIT_TFHE_FAILED";
-  CofheErrorCode2["InitViemFailed"] = "INIT_VIEM_FAILED";
-  CofheErrorCode2["InitEthersFailed"] = "INIT_ETHERS_FAILED";
-  CofheErrorCode2["NotConnected"] = "NOT_CONNECTED";
-  CofheErrorCode2["MissingPublicClient"] = "MISSING_PUBLIC_CLIENT";
-  CofheErrorCode2["MissingWalletClient"] = "MISSING_WALLET_CLIENT";
-  CofheErrorCode2["MissingProviderParam"] = "MISSING_PROVIDER_PARAM";
-  CofheErrorCode2["EmptySecurityZonesParam"] = "EMPTY_SECURITY_ZONES_PARAM";
-  CofheErrorCode2["InvalidACPData"] = "INVALID_ACP_DATA";
-  CofheErrorCode2["InvalidACPDomain"] = "INVALID_ACP_DOMAIN";
-  CofheErrorCode2["ACPNotFound"] = "ACP_NOT_FOUND";
-  CofheErrorCode2["CannotRemoveLastACP"] = "CANNOT_REMOVE_LAST_ACP";
-  CofheErrorCode2["AccountUninitialized"] = "ACCOUNT_UNINITIALIZED";
-  CofheErrorCode2["ChainIdUninitialized"] = "CHAIN_ID_UNINITIALIZED";
-  CofheErrorCode2["ConsumingContractUninitialized"] = "CONSUMING_CONTRACT_UNINITIALIZED";
-  CofheErrorCode2["SealOutputFailed"] = "SEAL_OUTPUT_FAILED";
-  CofheErrorCode2["SealOutputReturnedNull"] = "SEAL_OUTPUT_RETURNED_NULL";
-  CofheErrorCode2["InvalidUtype"] = "INVALID_UTYPE";
-  CofheErrorCode2["DecryptFailed"] = "DECRYPT_FAILED";
-  CofheErrorCode2["DecryptReturnedNull"] = "DECRYPT_RETURNED_NULL";
-  CofheErrorCode2["ZkMocksInsertCtHashesFailed"] = "ZK_MOCKS_INSERT_CT_HASHES_FAILED";
-  CofheErrorCode2["ZkMocksCalcCtHashesFailed"] = "ZK_MOCKS_CALC_CT_HASHES_FAILED";
-  CofheErrorCode2["ZkMocksVerifySignFailed"] = "ZK_MOCKS_VERIFY_SIGN_FAILED";
-  CofheErrorCode2["ZkMocksCreateProofSignatureFailed"] = "ZK_MOCKS_CREATE_PROOF_SIGNATURE_FAILED";
-  CofheErrorCode2["ZkVerifyFailed"] = "ZK_VERIFY_FAILED";
-  CofheErrorCode2["ZkPackFailed"] = "ZK_PACK_FAILED";
-  CofheErrorCode2["ZkProveFailed"] = "ZK_PROVE_FAILED";
-  CofheErrorCode2["EncryptRemainingInItems"] = "ENCRYPT_REMAINING_IN_ITEMS";
-  CofheErrorCode2["ZkUninitialized"] = "ZK_UNINITIALIZED";
-  CofheErrorCode2["ZkVerifierUrlUninitialized"] = "ZK_VERIFIER_URL_UNINITIALIZED";
-  CofheErrorCode2["ThresholdNetworkUrlUninitialized"] = "THRESHOLD_NETWORK_URL_UNINITIALIZED";
-  CofheErrorCode2["MissingConfig"] = "MISSING_CONFIG";
-  CofheErrorCode2["UnsupportedChain"] = "UNSUPPORTED_CHAIN";
-  CofheErrorCode2["MissingZkBuilderAndCrsGenerator"] = "MISSING_ZK_BUILDER_AND_CRS_GENERATOR";
-  CofheErrorCode2["MissingTfhePublicKeyDeserializer"] = "MISSING_TFHE_PUBLIC_KEY_DESERIALIZER";
-  CofheErrorCode2["MissingCompactPkeCrsDeserializer"] = "MISSING_COMPACT_PKE_CRS_DESERIALIZER";
-  CofheErrorCode2["MissingFheKey"] = "MISSING_FHE_KEY";
-  CofheErrorCode2["MissingCrs"] = "MISSING_CRS";
-  CofheErrorCode2["FetchKeysFailed"] = "FETCH_KEYS_FAILED";
-  CofheErrorCode2["PublicWalletGetChainIdFailed"] = "PUBLIC_WALLET_GET_CHAIN_ID_FAILED";
-  CofheErrorCode2["PublicWalletGetAddressesFailed"] = "PUBLIC_WALLET_GET_ADDRESSES_FAILED";
-  CofheErrorCode2["RehydrateKeysStoreFailed"] = "REHYDRATE_KEYS_STORE_FAILED";
-  CofheErrorCode2["BadRequest"] = "BAD_REQUEST";
-  CofheErrorCode2["UnknownChain"] = "UNKNOWN_CHAIN";
-  CofheErrorCode2["ACPMalformed"] = "ACP_MALFORMED";
-  CofheErrorCode2["ACPDenied"] = "ACP_DENIED";
-  CofheErrorCode2["ACPExpired"] = "ACP_EXPIRED";
-  CofheErrorCode2["ACPInvalid"] = "ACP_INVALID";
-  CofheErrorCode2["ACPRevoked"] = "ACP_REVOKED";
-  CofheErrorCode2["NotPubliclyAllowed"] = "NOT_PUBLICLY_ALLOWED";
-  CofheErrorCode2["CtNotFound"] = "CT_NOT_FOUND";
-  CofheErrorCode2["UnsupportedSecurityZone"] = "UNSUPPORTED_SECURITY_ZONE";
-  CofheErrorCode2["UnsupportedType"] = "UNSUPPORTED_TYPE";
-  CofheErrorCode2["SigningFailed"] = "SIGNING_FAILED";
-  CofheErrorCode2["CtSourceError"] = "CT_SOURCE_ERROR";
-  CofheErrorCode2["ACPVerifierError"] = "ACP_VERIFIER_ERROR";
-  CofheErrorCode2["CtSourceTimeout"] = "CT_SOURCE_TIMEOUT";
-  CofheErrorCode2["ACPVerifierTimeout"] = "ACP_VERIFIER_TIMEOUT";
-  CofheErrorCode2["ACPRequired"] = "ACP_REQUIRED";
-  CofheErrorCode2["SealFailed"] = "SEAL_FAILED";
-  return CofheErrorCode2;
-})(CofheErrorCode || {});
-var CofheError = class _CofheError extends Error {
-  code;
-  cause;
-  hint;
-  context;
-  apiErrorCode;
-  constructor({ code, message, cause, hint, context, apiErrorCode }) {
-    const fullMessage = cause ? `${message} | Caused by: ${cause.message}` : message;
-    super(fullMessage);
-    this.name = "CofheError";
-    this.code = code;
-    this.cause = cause;
-    this.hint = hint;
-    this.context = context;
-    this.apiErrorCode = apiErrorCode;
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, _CofheError);
-    }
-  }
-  /**
-   * Creates a CofheError from an unknown error
-   * If the error is a CofheError, it is returned unchanged, else a new CofheError is created
-   * If a wrapperError is provided, it is used to create the new CofheError, else a default is used
-   */
-  static fromError(error, wrapperError) {
-    if (isCofheError(error))
-      return error;
-    const cause = error instanceof Error ? error : new Error(`${error}`);
-    return new _CofheError({
-      code: wrapperError?.code ?? "INTERNAL_ERROR" /* InternalError */,
-      message: wrapperError?.message ?? "An internal error occurred",
-      hint: wrapperError?.hint,
-      context: wrapperError?.context,
-      apiErrorCode: wrapperError?.apiErrorCode,
-      cause
-    });
-  }
-  /**
-   * Serializes the error to JSON string with proper handling of Error objects
-   */
-  serialize() {
-    return bigintSafeJsonStringify({
-      name: this.name,
-      code: this.code,
-      message: this.message,
-      hint: this.hint,
-      context: this.context,
-      apiErrorCode: this.apiErrorCode,
-      cause: this.cause ? {
-        name: this.cause.name,
-        message: this.cause.message,
-        stack: this.cause.stack
-      } : void 0,
-      stack: this.stack
-    });
-  }
-  /**
-   * Returns a human-readable string representation of the error
-   */
-  toString() {
-    const codeSuffix = this.apiErrorCode ? ` (api: ${this.apiErrorCode})` : "";
-    const parts = [`${this.name} [${this.code}]${codeSuffix}: ${this.message}`];
-    if (this.hint) {
-      parts.push(`Hint: ${this.hint}`);
-    }
-    if (this.context && Object.keys(this.context).length > 0) {
-      parts.push(`Context: ${bigintSafeJsonStringify(this.context)}`);
-    }
-    if (this.stack) {
-      parts.push(`
-Stack trace:`);
-      parts.push(this.stack);
-    }
-    if (this.cause) {
-      parts.push(`
-Caused by: ${this.cause.name}: ${this.cause.message}`);
-      if (this.cause.stack) {
-        parts.push(this.cause.stack);
-      }
-    }
-    return parts.join("\n");
-  }
-};
-var bigintSafeJsonStringify = (value) => {
-  return JSON.stringify(value, (key, value2) => {
-    if (typeof value2 === "bigint") {
-      return `${value2}n`;
-    }
-    return value2;
-  });
-};
-var isCofheError = (error) => error instanceof CofheError;
-
 // core/types.ts
 var FheTypes = /* @__PURE__ */ ((FheTypes2) => {
   FheTypes2[FheTypes2["Bool"] = 0] = "Bool";
@@ -862,6 +703,8 @@ var CofheConfigSchema = z.object({
   }).or(z.null()).default(null),
   /** Whether to use Web Workers for ZK proof generation (web platform only) */
   useWorkers: z.boolean().optional().default(true),
+  /** How many threads tfhe's rayon pool may use for ZK proof generation (web platform only) */
+  tfheThreads: z.union([z.number().int().positive(), z.literal("auto"), z.literal(false)]).optional().default("auto"),
   /** ACP acp defaults */
   acp: z.object({
     defaultRevoker: z.custom().optional(),
@@ -970,6 +813,9 @@ var DEFAULT_KEYS_STORE = {
   fhe: {},
   crs: {}
 };
+function isSecurityZoneRecord(value) {
+  return value != null && typeof value === "object";
+}
 function isStoreWithPersist(store) {
   return "persist" in store;
 }
@@ -984,10 +830,10 @@ function createKeysStore(storage) {
     const stored = keysStore.getState().fhe[chainId]?.[securityZone];
     return stored;
   };
-  const getCrs = (chainId) => {
-    if (chainId == null)
+  const getCrs = (chainId, securityZone = 0) => {
+    if (chainId == null || securityZone == null)
       return void 0;
-    const stored = keysStore.getState().crs[chainId];
+    const stored = keysStore.getState().crs[chainId]?.[securityZone];
     return stored;
   };
   const setFheKey = (chainId, securityZone, key) => {
@@ -999,10 +845,12 @@ function createKeysStore(storage) {
       })
     );
   };
-  const setCrs = (chainId, crs) => {
+  const setCrs = (chainId, securityZone, crs) => {
     keysStore.setState(
       produce((state) => {
-        state.crs[chainId] = crs;
+        if (state.crs[chainId] == null)
+          state.crs[chainId] = {};
+        state.crs[chainId][securityZone] = crs;
       })
     );
   };
@@ -1050,7 +898,13 @@ function createStoreWithPersit(storage) {
           const currentZones = current.fhe[chainId] || {};
           mergedFhe[chainId] = { ...persistedZones, ...currentZones };
         }
-        const mergedCrs = { ...persisted.crs, ...current.crs };
+        const mergedCrs = {};
+        const allCrsChainIds = /* @__PURE__ */ new Set([...Object.keys(current.crs), ...Object.keys(persisted.crs)]);
+        for (const chainId of allCrsChainIds) {
+          const persistedZones = isSecurityZoneRecord(persisted.crs[chainId]) ? persisted.crs[chainId] : {};
+          const currentZones = isSecurityZoneRecord(current.crs[chainId]) ? current.crs[chainId] : {};
+          mergedCrs[chainId] = { ...persistedZones, ...currentZones };
+        }
         return {
           fhe: mergedFhe,
           crs: mergedCrs
@@ -1112,7 +966,7 @@ var fetchFhePublicKey = async (coFheUrl, chainId, securityZone, tfhePublicKeyDes
   return [pk_data, true];
 };
 var fetchCrs = async (coFheUrl, chainId, securityZone, compactPkeCrsDeserializer, keysStorage) => {
-  const storedKey = keysStorage?.getCrs(chainId);
+  const storedKey = keysStorage?.getCrs(chainId, securityZone);
   const [storedKeyValid] = checkKeyValidity(storedKey, compactPkeCrsDeserializer);
   if (storedKeyValid)
     return [storedKey, false];
@@ -1139,7 +993,7 @@ var fetchCrs = async (coFheUrl, chainId, securityZone, compactPkeCrsDeserializer
     console.error(`Error serializing CRS ${err}`);
     throw new Error(`Error serializing CRS; ${err}`);
   }
-  keysStorage?.setCrs(chainId, crs_data);
+  keysStorage?.setCrs(chainId, securityZone, crs_data);
   return [crs_data, true];
 };
 var fetchKeys = async (config, chainId, securityZone = 0, tfhePublicKeyDeserializer, compactPkeCrsDeserializer, keysStorage) => {
@@ -1251,6 +1105,7 @@ var EncryptInputsBuilder = class extends BaseBuilder {
   zkBuilderAndCrsGenerator;
   initTfhe;
   zkProveWorkerFn;
+  beforeMainThreadProve;
   keysStorage;
   // Worker configuration (from config, overrideable)
   useWorker;
@@ -1308,6 +1163,7 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     this.zkBuilderAndCrsGenerator = params.zkBuilderAndCrsGenerator;
     this.initTfhe = params.initTfhe;
     this.zkProveWorkerFn = params.zkProveWorkerFn;
+    this.beforeMainThreadProve = params.beforeMainThreadProve;
     this.keysStorage = params.keysStorage;
     this.useWorker = params.config?.useWorkers ?? true;
   }
@@ -1598,6 +1454,7 @@ var EncryptInputsBuilder = class extends BaseBuilder {
       }
     }
     if (proof == null) {
+      await this.beforeMainThreadProve?.();
       proof = await zkProve(zkBuilder, zkCrs, metadata);
       usedWorker = false;
     }
@@ -1655,11 +1512,6 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     return this.buildBatchResult(result);
   }
 };
-var ACP_VALIDATOR_ABI = parseAbi([
-  "function revokeSingle(uint256 id)",
-  "function revokeAllExisting()",
-  "function disabled(address issuer, uint256 id) view returns (bool)"
-]);
 var storeACP = async (acp, publicClient, walletClient) => {
   const chainId = await publicClient.getChainId();
   const account = walletClient.account.address;
@@ -1686,8 +1538,8 @@ var createSelf = async (options, publicClient, walletClient) => {
 var createSharing = async (options, publicClient, walletClient) => {
   return createACPWithSign(options, publicClient, walletClient, ACPUtils.createSharingAndSign, false);
 };
-var importShared = async (options, publicClient, walletClient) => {
-  return createACPWithSign(options, publicClient, walletClient, ACPUtils.importSharedAndSign);
+var importShared = async (options, publicClient, walletClient, { activate = true } = {}) => {
+  return createACPWithSign(options, publicClient, walletClient, ACPUtils.importSharedAndSign, activate);
 };
 var getHash = (acp) => {
   return ACPUtils.getHash(acp);
@@ -1749,38 +1601,6 @@ var applyACPDefaults = (options, acpConfig, chainId) => {
   }
   return result;
 };
-var ACL_SERVED_ADDRESSES_ABI = parseAbi([
-  "function acl() view returns (address)",
-  "function defaultRevokerContract() view returns (address)",
-  "function shareRegistry() view returns (address)"
-]);
-var aclServedAddressesCache = /* @__PURE__ */ new Map();
-var clearAclServedAddresses = () => aclServedAddressesCache.clear();
-var getAclServedAddresses = async (publicClient, chainId) => {
-  const cached = aclServedAddressesCache.get(chainId);
-  if (cached != null)
-    return cached;
-  let aclAddress;
-  try {
-    aclAddress = await publicClient.readContract({
-      address: TASK_MANAGER_ADDRESS,
-      abi: ACL_SERVED_ADDRESSES_ABI,
-      functionName: "acl"
-    });
-  } catch {
-    return {};
-  }
-  const [defaultRevoker, shareRegistry] = await Promise.all([
-    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "defaultRevokerContract" }).catch(() => void 0),
-    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "shareRegistry" }).catch(() => void 0)
-  ]);
-  const resolved = {
-    defaultRevoker: defaultRevoker != null && defaultRevoker !== zeroAddress ? defaultRevoker : void 0,
-    shareRegistry: shareRegistry != null && shareRegistry !== zeroAddress ? shareRegistry : void 0
-  };
-  aclServedAddressesCache.set(chainId, resolved);
-  return resolved;
-};
 var applyACPDefaultsFromChain = async (options, acpConfig, publicClient, chainId) => {
   const hasExplicitRevoker = acpConfig?.defaultRevoker?.[chainId] != null || options.revokerData != null || options.revokerContract != null;
   if (hasExplicitRevoker)
@@ -1800,7 +1620,7 @@ var revokeACP = async (acp, walletClient) => {
   }
   return walletClient.writeContract({
     address: acp.revokerContract,
-    abi: ACP_VALIDATOR_ABI,
+    abi: ACP_REVOKER_ABI,
     functionName: "revokeSingle",
     args: [BigInt(acp.revokerData)],
     account: walletClient.account,
@@ -1821,64 +1641,31 @@ var revokeAllACPs = async (walletClient, publicClient, revokerContract) => {
   }
   return walletClient.writeContract({
     address: revoker,
-    abi: ACP_VALIDATOR_ABI,
+    abi: ACP_REVOKER_ABI,
     functionName: "revokeAllExisting",
     args: [],
     account: walletClient.account,
     chain: walletClient.chain
   });
 };
+var checkAccess = async (acp, publicClient, handle) => {
+  if (acp.type === "sharing" && handle === void 0) {
+    if (ACPUtils.isExpired(acp))
+      return "expired";
+    return await isACPRevoked(acp, publicClient) ? "revoked" : "valid";
+  }
+  return ACPUtils.checkAccessOnChain(acp, publicClient, handle);
+};
 var isACPRevoked = async (acp, publicClient) => {
   if (acp.revokerContract === zeroAddress || acp.revokerData === 0)
     return false;
   return publicClient.readContract({
     address: acp.revokerContract,
-    abi: ACP_VALIDATOR_ABI,
+    abi: ACP_REVOKER_ABI,
     functionName: "disabled",
     args: [acp.issuer, BigInt(acp.revokerData)]
   });
 };
-var ACP_SHARE_REGISTRY_ABI = parseAbi([
-  "struct ACP { address issuer; uint64 expiration; address recipient; uint256 revokerData; address revokerContract; uint8 scope; address[] contracts; bytes32[] handles; bytes32 sealingKey; bytes issuerSignature; bytes recipientSignature; }",
-  "function share(ACP calldata acp) external returns (bytes32)",
-  "function removeShare(bytes32 shareId) external",
-  "function sharesFor(address recipient) external view returns (ACP[] memory)",
-  "function getShare(bytes32 shareId) external view returns (ACP memory)",
-  "function isShareValid(bytes32 shareId) external view returns (bool)"
-]);
-var ACP_TUPLE = [
-  {
-    type: "tuple",
-    components: [
-      { name: "issuer", type: "address" },
-      { name: "expiration", type: "uint64" },
-      { name: "recipient", type: "address" },
-      { name: "revokerData", type: "uint256" },
-      { name: "revokerContract", type: "address" },
-      { name: "scope", type: "uint8" },
-      { name: "contracts", type: "address[]" },
-      { name: "handles", type: "bytes32[]" },
-      { name: "sealingKey", type: "bytes32" },
-      { name: "issuerSignature", type: "bytes" },
-      { name: "recipientSignature", type: "bytes" }
-    ]
-  }
-];
-var ZERO_BYTES32 = `0x${"0".repeat(64)}`;
-var toChainShare = (acp) => {
-  const pub = ACPUtils.getPublic(acp, true);
-  return {
-    ...pub,
-    expiration: BigInt(pub.expiration),
-    revokerData: BigInt(pub.revokerData),
-    sealingKey: ZERO_BYTES32,
-    recipientSignature: "0x"
-  };
-};
-var computeShareId = (acp) => {
-  const p = toChainShare(acp);
-  return keccak256(encodeAbiParameters(ACP_TUPLE, [p]));
-};
 var shareOnChain = async (acp, walletClient, registry) => {
   if (acp.type !== "sharing") {
     throw new Error(`Cannot share a '${acp.type}' ACP on-chain \u2014 only 'sharing' ACPs are shareable.`);
@@ -1909,7 +1696,7 @@ var getIncomingShares = async (publicClient, registry, recipient) => {
     args: [recipient]
   });
   return raw.map((s) => ({
-    shareId: keccak256(encodeAbiParameters(ACP_TUPLE, [s])),
+    shareId: shareIdOfChainShare(s),
     issuer: s.issuer,
     expiration: Number(s.expiration),
     recipient: s.recipient,
@@ -1921,9 +1708,9 @@ var getIncomingShares = async (publicClient, registry, recipient) => {
     issuerSignature: s.issuerSignature
   }));
 };
-var importFromChain = async (share, publicClient, walletClient) => {
+var importFromChain = async (share, publicClient, walletClient, importOptions = {}) => {
   const { shareId: _shareId, ...options } = share;
-  return importShared({ ...options, type: "sharing" }, publicClient, walletClient);
+  return importShared({ ...options, type: "sharing" }, publicClient, walletClient, importOptions);
 };
 var removeShareOnChain = async (shareId, walletClient, registry) => {
   if (walletClient.account == null)
@@ -1961,6 +1748,7 @@ var acps = {
   revokeACP,
   revokeAllACPs,
   isACPRevoked,
+  checkAccess,
   shareOnChain,
   getIncomingShares,
   importFromChain,
@@ -3680,7 +3468,7 @@ var buildDecryptResultHash = (ctHash, cleartext, chainId) => {
 async function verifyDecryptResult(handle, cleartext, signature, publicClient) {
   const chainId = publicClient.chain?.id ?? await publicClient.getChainId();
   const expectedSigner = await publicClient.readContract({
-    address: TASK_MANAGER_ADDRESS,
+    address: await getTaskManagerAddress(publicClient, chainId),
     abi: decryptResultSignerAbi,
     functionName: "decryptResultSigner",
     args: []
@@ -3800,6 +3588,7 @@ function createCofheClientBase(opts) {
       zkBuilderAndCrsGenerator: opts.zkBuilderAndCrsGenerator,
       initTfhe: opts.initTfhe,
       zkProveWorkerFn: opts.zkProveWorkerFn,
+      beforeMainThreadProve: opts.beforeMainThreadProve,
       keysStorage,
       requireConnected: _requireConnected
     });
@@ -3876,10 +3665,11 @@ function createCofheClientBase(opts) {
         walletClient
       );
     },
-    importShared: async (options, clients) => {
+    importShared: async (options, importOptions = {}) => {
       _requireConnected();
-      const { publicClient, walletClient } = clients ?? connectStore.getState();
-      return acps.importShared(options, publicClient, walletClient);
+      const { activate, ...clients } = importOptions;
+      const { publicClient, walletClient } = clients.publicClient ? clients : connectStore.getState();
+      return acps.importShared(options, publicClient, walletClient, { activate });
     },
     // Get or create methods (require connection)
     getOrCreateSelfACP: async (chainId, account, options) => {
@@ -3922,6 +3712,11 @@ function createCofheClientBase(opts) {
       const { publicClient } = connectStore.getState();
       return acps.isACPRevoked(acp, publicClient);
     },
+    checkAccess: async (acp, handle) => {
+      _requireConnected();
+      const { publicClient } = connectStore.getState();
+      return acps.checkAccess(acp, publicClient, handle);
+    },
     // On-chain sharing (require connection + config.acp.sharingRegistry)
     shareOnChain: async (acp) => {
       _requireConnected();
@@ -3938,10 +3733,10 @@ function createCofheClientBase(opts) {
       const sharingRegistry = await _resolveSharingRegistry(publicClient, chainId);
       return acps.getIncomingShares(publicClient, sharingRegistry, account);
     },
-    importFromChain: async (share) => {
+    importFromChain: async (share, options) => {
       _requireConnected();
       const { publicClient, walletClient } = connectStore.getState();
-      return acps.importFromChain(share, publicClient, walletClient);
+      return acps.importFromChain(share, publicClient, walletClient, options);
     },
     dismissShare: async (shareId) => {
       _requireConnected();
@@ -4029,4 +3824,4 @@ function createCofheClientBase(opts) {
   };
 }
 
-export { CofheError, CofheErrorCode, DecryptForTxBuilder, DecryptForViewBuilder, EncryptInputsBuilder, EncryptStep, Encryptable, FheAllUTypes, FheTypes, FheUintUTypes, InitialConnectStore, assertNoRenamedConfigKeys, cofheFetch, createCofheClientBase, createCofheConfigBase, createKeysStore, fetchKeys, fheTypeToString, getCofheConfigItem, getCofheDebugInterceptors, isCofheError, isEncryptableItem, isLastEncryptionStep, setCofheDebugInterceptors, verifyDecryptResult, zkProveWithWorker };
+export { DecryptForTxBuilder, DecryptForViewBuilder, EncryptInputsBuilder, EncryptStep, Encryptable, FheAllUTypes, FheTypes, FheUintUTypes, InitialConnectStore, assertNoRenamedConfigKeys, cofheFetch, createCofheClientBase, createCofheConfigBase, createKeysStore, fetchKeys, fheTypeToString, getCofheConfigItem, getCofheDebugInterceptors, isEncryptableItem, isLastEncryptionStep, setCofheDebugInterceptors, verifyDecryptResult, zkProveWithWorker };

package/dist/chunk-KSOV5B4B.js

@@ -0,0 +1,50 @@
+// web/tfheThreadPool.ts
+var MAX_AUTO_THREADS = 8;
+function resolveThreadCount(setting = "auto") {
+  if (setting === false)
+    return 1;
+  if (typeof setting === "number") {
+    return Number.isFinite(setting) && setting >= 1 ? Math.floor(setting) : 1;
+  }
+  const cores = globalThis.navigator?.hardwareConcurrency ?? 1;
+  if (!Number.isFinite(cores) || cores < 1)
+    return 1;
+  return Math.min(Math.floor(cores), MAX_AUTO_THREADS);
+}
+function isCrossOriginIsolated() {
+  return globalThis.crossOriginIsolated === true;
+}
+async function initTfheThreadPool(mod, setting = "auto") {
+  if (setting === false) {
+    return { enabled: false, threads: 1, reason: "disabled via config.tfheThreads" };
+  }
+  if (typeof mod.initThreadPool !== "function") {
+    return { enabled: false, threads: 1, reason: "tfhe build has no initThreadPool (single-threaded wasm)" };
+  }
+  if (typeof Worker === "undefined") {
+    return { enabled: false, threads: 1, reason: "Worker is unavailable" };
+  }
+  if (!isCrossOriginIsolated()) {
+    return {
+      enabled: false,
+      threads: 1,
+      reason: "not cross-origin isolated \u2014 serve the page with Cross-Origin-Opener-Policy: same-origin and Cross-Origin-Embedder-Policy: require-corp (or credentialless) to enable multi-threaded proving"
+    };
+  }
+  const threads = resolveThreadCount(setting);
+  if (threads <= 1) {
+    return { enabled: false, threads: 1, reason: "resolved to a single thread" };
+  }
+  try {
+    await mod.initThreadPool(threads);
+    return { enabled: true, threads };
+  } catch (error) {
+    return {
+      enabled: false,
+      threads: 1,
+      reason: `initThreadPool failed: ${error instanceof Error ? error.message : String(error)}`
+    };
+  }
+}
+
+export { initTfheThreadPool };

package/dist/{chunk-ESMZCFJY.js → chunk-NMKMCAI3.js}

@@ -1,5 +1,7 @@
 // core/consts.ts
-var TASK_MANAGER_ADDRESS = "0xeA30c4B8b44078Bbf8a6ef5b9f1eC1626C7848D9";
+var COFHE_ADDRESS_BOOK_ADDRESS = "0xC0F4e00E531a2B086492Ae3DCC1515038307196b";
+var TASK_MANAGER_ID = 1n;
+var MOCKS_TASK_MANAGER_ADDRESS = "0x0000000000000000000000000000000000005000";
 var MOCKS_ZK_VERIFIER_ADDRESS = "0x0000000000000000000000000000000000005001";
 var MOCKS_THRESHOLD_NETWORK_ADDRESS = "0x0000000000000000000000000000000000005002";
 var MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY = "0x6C8D7F768A6BB4AAFE85E8A2F5A9680355239C7E14646ED62B044E39DE154512";
@@ -9,4 +11,4 @@ var TFHE_RS_ZK_MAX_BITS = 2048;
 var TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT = BigInt(1 << 30);
 var TFHE_RS_KEY_VERSION = 2;
 
-export { MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY, MOCKS_THRESHOLD_NETWORK_ADDRESS, MOCKS_ZK_VERIFIER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY, TASK_MANAGER_ADDRESS, TFHE_RS_KEY_VERSION, TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT, TFHE_RS_ZK_MAX_BITS };
+export { COFHE_ADDRESS_BOOK_ADDRESS, MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY, MOCKS_TASK_MANAGER_ADDRESS, MOCKS_THRESHOLD_NETWORK_ADDRESS, MOCKS_ZK_VERIFIER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_ADDRESS, MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY, TASK_MANAGER_ID, TFHE_RS_KEY_VERSION, TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT, TFHE_RS_ZK_MAX_BITS };