@cofhe/sdk 0.7.1 → 1.0.0-alpha.0

package/dist/chunk-BQWHPIYU.js

@@ -0,0 +1,1828 @@
+import { TASK_MANAGER_ID, COFHE_ADDRESS_BOOK_ADDRESS, CofheError } from './chunk-XQ32JG3T.js';
+import { isAddress, getAddress, zeroAddress, isHex, parseAbi, keccak256, padHex, numberToHex, concatHex, toFunctionSelector, size, sliceHex, toHex, encodeAbiParameters, hexToBigInt, stringToHex, hexToNumber, toEventSignature, toFunctionSignature, decodeErrorResult, toEventSelector, decodeAbiParameters } from 'viem';
+import nacl from 'tweetnacl';
+import { z } from 'zod';
+import { createStore } from 'zustand/vanilla';
+import { persist } from 'zustand/middleware';
+import { produce } from 'immer';
+
+// acps/utils.ts
+var HEX_BODY_REGEX = /^[0-9a-fA-F]*$/;
+var fromHexString = (hexString) => {
+  const body = hexString.replace(/^0x/, "");
+  if (!HEX_BODY_REGEX.test(body)) {
+    throw new Error("Invalid hex string: contains non-hexadecimal characters");
+  }
+  const padded = body.length % 2 === 1 ? `0${body}` : body;
+  const arr = padded.match(/.{1,2}/g);
+  if (!arr)
+    return new Uint8Array();
+  return new Uint8Array(arr.map((byte) => parseInt(byte, 16)));
+};
+var toHexString = (bytes) => bytes.reduce((str, byte) => str + byte.toString(16).padStart(2, "0"), "");
+function toBigInt(value) {
+  if (typeof value === "string") {
+    return BigInt(value);
+  } else if (typeof value === "number") {
+    return BigInt(value);
+  } else if (typeof value === "object") {
+    return BigInt("0x" + toHexString(value));
+  } else {
+    return value;
+  }
+}
+function toBeArray(value) {
+  const bigIntValue = typeof value === "number" ? BigInt(value) : value;
+  const hex = bigIntValue.toString(16);
+  const paddedHex = hex.length % 2 === 0 ? hex : "0" + hex;
+  return fromHexString(paddedHex);
+}
+function isString(value) {
+  if (typeof value !== "string") {
+    throw new Error(`Expected value which is \`string\`, received value of type \`${typeof value}\`.`);
+  }
+}
+function isNumber(value) {
+  const is = typeof value === "number" && !Number.isNaN(value);
+  if (!is) {
+    throw new Error(`Expected value which is \`number\`, received value of type \`${typeof value}\`.`);
+  }
+}
+function isBigIntOrNumber(value) {
+  const is = typeof value === "bigint";
+  if (!is) {
+    try {
+      isNumber(value);
+    } catch (e) {
+      throw new Error(`Value ${value} is not a number or bigint: ${typeof value}`);
+    }
+  }
+}
+
+// acps/sealing.ts
+var KEY_HEX_LENGTH = 64;
+var GenerateSealingKey = () => {
+  const sodiumKeypair = nacl.box.keyPair();
+  return {
+    privateKey: `0x${toHexString(sodiumKeypair.secretKey)}`,
+    publicKey: `0x${toHexString(sodiumKeypair.publicKey)}`
+  };
+};
+var seal = (value, publicKey) => {
+  isString(publicKey);
+  isBigIntOrNumber(value);
+  assertSealingKey(publicKey, "Public");
+  const ephemeralKeyPair = nacl.box.keyPair();
+  const nonce = nacl.randomBytes(nacl.box.nonceLength);
+  const encryptedMessage = nacl.box(toBeArray(value), nonce, fromHexString(publicKey), ephemeralKeyPair.secretKey);
+  return {
+    data: encryptedMessage,
+    public_key: ephemeralKeyPair.publicKey,
+    nonce
+  };
+};
+var unsealWithPrivateKey = (privateKey, parsedData) => {
+  assertSealingKey(privateKey, "Private");
+  const nonce = parsedData.nonce instanceof Uint8Array ? parsedData.nonce : new Uint8Array(parsedData.nonce);
+  const ephemPublicKey = parsedData.public_key instanceof Uint8Array ? parsedData.public_key : new Uint8Array(parsedData.public_key);
+  const dataToDecrypt = parsedData.data instanceof Uint8Array ? parsedData.data : new Uint8Array(parsedData.data);
+  const decryptedMessage = nacl.box.open(dataToDecrypt, nonce, ephemPublicKey, fromHexString(privateKey));
+  if (!decryptedMessage) {
+    throw new Error("Failed to decrypt message");
+  }
+  return toBigInt(decryptedMessage);
+};
+var assertSealingKey = (key, kind) => {
+  const bare = key.startsWith("0x") ? key.slice(2) : key;
+  if (bare.length !== KEY_HEX_LENGTH) {
+    throw new Error(`${kind} key must be of length ${KEY_HEX_LENGTH}`);
+  }
+  if (!/^[0-9a-fA-F]+$/.test(bare)) {
+    throw new Error(`${kind} key must contain only hex characters`);
+  }
+};
+var ACPScope = {
+  Global: 0,
+  Contract: 1,
+  Handles: 2
+};
+var addressSchema = z.string().refine((val) => isAddress(val), {
+  error: "Invalid address"
+}).transform((val) => getAddress(val));
+var addressNotZeroSchema = addressSchema.refine((val) => val !== zeroAddress, {
+  error: "Must not be zeroAddress"
+});
+var bytesSchema = z.custom(
+  (val) => {
+    return typeof val === "string" && isHex(val);
+  },
+  {
+    message: "Invalid hex value"
+  }
+);
+var bytesNotEmptySchema = bytesSchema.refine((val) => val !== "0x", {
+  error: "Must not be empty"
+});
+var DEFAULT_EXPIRATION_FN = () => Math.round(Date.now() / 1e3) + 7 * 24 * 60 * 60;
+var handlesSchema = z.array(z.string().regex(/^0x[0-9a-fA-F]{64}$/, "Invalid handle: expected 32-byte hex")).optional().default([]);
+var contractsSchema = z.array(addressSchema).optional().default([]);
+var SCOPE_GLOBAL = 0;
+var SCOPE_CONTRACT = 1;
+var SCOPE_HANDLES = 2;
+var ScopeConsistencyRefinement = [
+  (data) => data.scope === SCOPE_GLOBAL && data.contracts.length === 0 && data.handles.length === 0 || data.scope === SCOPE_CONTRACT && data.contracts.length > 0 && data.handles.length === 0 || data.scope === SCOPE_HANDLES && data.handles.length > 0 && data.contracts.length === 0,
+  {
+    error: "ACP scope :: arrays must match the scope mode (Global: both empty; Contract: contracts only; Handles: handles only)",
+    path: ["scope"]
+  }
+];
+var withDerivedScope = (data) => ({
+  ...data,
+  scope: data.scope ?? (data.contracts.length > 0 ? SCOPE_CONTRACT : data.handles.length > 0 ? SCOPE_HANDLES : SCOPE_GLOBAL)
+});
+var zACPWithDefaults = z.object({
+  name: z.string().optional().default("Unnamed ACP"),
+  type: z.enum(["self", "sharing", "recipient"]),
+  issuer: addressNotZeroSchema,
+  expiration: z.int().optional().default(DEFAULT_EXPIRATION_FN),
+  recipient: addressSchema.optional().default(zeroAddress),
+  revokerData: z.int().optional().default(0),
+  revokerContract: addressSchema.optional().default(zeroAddress),
+  scope: z.int().min(0).max(2).optional().default(0),
+  contracts: contractsSchema,
+  handles: handlesSchema,
+  issuerSignature: bytesSchema.optional().default("0x"),
+  recipientSignature: bytesSchema.optional().default("0x"),
+  metadata: bytesSchema.optional()
+});
+var zACPWithSealingKeys = zACPWithDefaults.extend({
+  /** X25519 private key, 0x-prefixed 32-byte hex; never leaves the client */
+  sealingPrivateKey: z.string().regex(/^0x[0-9a-fA-F]{64}$/, "Invalid sealing private key").optional(),
+  sealingKey: z.string().regex(/^0x[0-9a-fA-F]{64}$/, "Invalid sealing key").optional()
+});
+var ExternalValidatorRefinement = [
+  (data) => data.revokerData !== 0 && data.revokerContract !== zeroAddress || data.revokerData === 0 && data.revokerContract === zeroAddress,
+  {
+    error: "ACP external revoker :: revokerData and revokerContract must either both be set or both be unset.",
+    path: ["revokerData", "revokerContract"]
+  }
+];
+var RecipientRefinement = [
+  (data) => data.issuer !== data.recipient,
+  {
+    error: "Sharing acp :: issuer and recipient must not be the same",
+    path: ["issuer", "recipient"]
+  }
+];
+var SelfACPOptionsValidator = z.object({
+  type: z.literal("self").optional().default("self"),
+  issuer: addressNotZeroSchema,
+  name: z.string().optional().default("Unnamed ACP"),
+  expiration: z.int().optional().default(DEFAULT_EXPIRATION_FN),
+  recipient: addressSchema.optional().default(zeroAddress),
+  revokerData: z.int().optional().default(0),
+  revokerContract: addressSchema.optional().default(zeroAddress),
+  scope: z.int().min(0).max(2).optional(),
+  contracts: contractsSchema,
+  handles: handlesSchema,
+  issuerSignature: bytesSchema.optional().default("0x"),
+  recipientSignature: bytesSchema.optional().default("0x")
+}).refine(...ExternalValidatorRefinement).transform(withDerivedScope).refine(...ScopeConsistencyRefinement);
+var SelfACPValidator = zACPWithSealingKeys.refine((data) => data.type === "self", {
+  error: "Type must be 'self'"
+}).refine((data) => data.recipient === zeroAddress, {
+  error: "Recipient must be zeroAddress"
+}).refine((data) => data.issuerSignature !== "0x", {
+  error: "IssuerSignature must be populated"
+}).refine((data) => data.recipientSignature === "0x", {
+  error: "RecipientSignature must be empty"
+}).refine(...ExternalValidatorRefinement);
+var SharingACPOptionsValidator = z.object({
+  type: z.literal("sharing").optional().default("sharing"),
+  issuer: addressNotZeroSchema,
+  recipient: addressNotZeroSchema,
+  name: z.string().optional().default("Unnamed ACP"),
+  expiration: z.int().optional().default(DEFAULT_EXPIRATION_FN),
+  revokerData: z.int().optional().default(0),
+  revokerContract: addressSchema.optional().default(zeroAddress),
+  scope: z.int().min(0).max(2).optional(),
+  contracts: contractsSchema,
+  handles: handlesSchema,
+  issuerSignature: bytesSchema.optional().default("0x"),
+  recipientSignature: bytesSchema.optional().default("0x")
+}).refine(...RecipientRefinement).refine(...ExternalValidatorRefinement).transform(withDerivedScope).refine(...ScopeConsistencyRefinement);
+var SharingACPValidator = zACPWithSealingKeys.refine((data) => data.type === "sharing", {
+  error: "Type must be 'sharing'"
+}).refine((data) => data.recipient !== zeroAddress, {
+  error: "Recipient must not be zeroAddress"
+}).refine((data) => data.issuerSignature !== "0x", {
+  error: "IssuerSignature must be populated"
+}).refine((data) => data.recipientSignature === "0x", {
+  error: "RecipientSignature must be empty"
+}).refine(...ExternalValidatorRefinement);
+var ImportACPOptionsValidator = z.object({
+  type: z.literal("recipient").optional().default("recipient"),
+  issuer: addressNotZeroSchema,
+  recipient: addressNotZeroSchema,
+  expiration: z.int(),
+  revokerData: z.int().optional().default(0),
+  revokerContract: addressSchema.optional().default(zeroAddress),
+  scope: z.int().min(0).max(2).optional(),
+  contracts: contractsSchema,
+  handles: handlesSchema,
+  issuerSignature: bytesNotEmptySchema,
+  recipientSignature: bytesSchema.optional().default("0x"),
+  /** The share metadata (labels blob); `0x` means none and is dropped */
+  metadata: bytesSchema.optional().transform((val) => val === "0x" ? void 0 : val)
+}).refine(...ExternalValidatorRefinement).transform(withDerivedScope).refine(...ScopeConsistencyRefinement);
+var ImportACPValidator = zACPWithSealingKeys.refine((data) => data.type === "recipient", {
+  error: "Type must be 'recipient'"
+}).refine((data) => data.recipient !== zeroAddress, {
+  error: "Recipient must not be zeroAddress"
+}).refine((data) => data.issuerSignature !== "0x", {
+  error: "IssuerSignature must be populated"
+}).refine((data) => data.recipientSignature !== "0x", {
+  error: "RecipientSignature must be populated"
+}).refine(...ExternalValidatorRefinement);
+var safeParseAndThrowFormatted = (schema, data, message) => {
+  const result = schema.safeParse(data);
+  if (!result.success) {
+    throw new Error(`${message}: ${z.prettifyError(result.error)}`, { cause: result.error });
+  }
+  return result.data;
+};
+var validateSelfACPOptions = (options) => {
+  return safeParseAndThrowFormatted(SelfACPOptionsValidator, options, "Invalid self acp options");
+};
+var validateSharingACPOptions = (options) => {
+  return safeParseAndThrowFormatted(SharingACPOptionsValidator, options, "Invalid sharing acp options");
+};
+var validateImportACPOptions = (options) => {
+  return safeParseAndThrowFormatted(ImportACPOptionsValidator, options, "Invalid import acp options");
+};
+var validateSelfACP = (acp) => {
+  return safeParseAndThrowFormatted(SelfACPValidator, acp, "Invalid self acp");
+};
+var validateSharingACP = (acp) => {
+  return safeParseAndThrowFormatted(SharingACPValidator, acp, "Invalid sharing acp");
+};
+var validateImportACP = (acp) => {
+  return safeParseAndThrowFormatted(ImportACPValidator, acp, "Invalid import acp");
+};
+var ValidationUtils = {
+  /**
+   * Check if acp is expired
+   */
+  isExpired: (acp) => {
+    return acp.expiration < Math.floor(Date.now() / 1e3);
+  },
+  /**
+   * Check if acp is signed by the active party
+   */
+  isSigned: (acp) => {
+    if (acp.type === "self" || acp.type === "sharing") {
+      return acp.issuerSignature !== "0x";
+    }
+    if (acp.type === "recipient") {
+      return acp.recipientSignature !== "0x";
+    }
+    return false;
+  },
+  /**
+   * Checks that an ACP is signed and not expired.
+   */
+  isSignedAndNotExpired: (acp) => {
+    if (ValidationUtils.isExpired(acp)) {
+      return { valid: false, error: "expired" };
+    }
+    if (!ValidationUtils.isSigned(acp)) {
+      return { valid: false, error: "not-signed" };
+    }
+    return { valid: true, error: null };
+  },
+  /**
+   * Asserts that an ACP is signed and not expired.
+   *
+   * Throws `Error` with message:
+   * - `ACP is expired`
+   * - `ACP is not signed`
+   */
+  assertSignedAndNotExpired: (acp) => {
+    const result = ValidationUtils.isSignedAndNotExpired(acp);
+    if (result.valid)
+      return;
+    if (result.error === "expired") {
+      throw new Error("ACP is expired");
+    }
+    if (result.error === "not-signed") {
+      throw new Error("ACP is not signed");
+    }
+    throw new Error("ACP is invalid");
+  },
+  isValid: (acp) => {
+    const schema = acp.type === "self" ? SelfACPValidator : acp.type === "sharing" ? SharingACPValidator : acp.type === "recipient" ? ImportACPValidator : null;
+    if (schema == null)
+      return { valid: false, error: "invalid-schema" };
+    const schemaResult = schema.safeParse(acp);
+    if (!schemaResult.success)
+      return { valid: false, error: "invalid-schema" };
+    return ValidationUtils.isSignedAndNotExpired(acp);
+  }
+};
+
+// acps/signature.ts
+var ACPSignatureAllFields = [
+  { name: "issuer", type: "address" },
+  { name: "expiration", type: "uint64" },
+  { name: "recipient", type: "address" },
+  { name: "revokerData", type: "uint256" },
+  { name: "revokerContract", type: "address" },
+  { name: "scope", type: "uint8" },
+  { name: "contracts", type: "address[]" },
+  { name: "handles", type: "bytes32[]" },
+  { name: "sealingKey", type: "bytes32" },
+  { name: "issuerSignature", type: "bytes" }
+];
+var SignatureTypes = {
+  ACPIssuerSelf: [
+    "issuer",
+    "expiration",
+    "recipient",
+    "revokerData",
+    "revokerContract",
+    "scope",
+    "contracts",
+    "handles",
+    "sealingKey"
+  ],
+  ACPIssuerShared: [
+    "issuer",
+    "expiration",
+    "recipient",
+    "revokerData",
+    "revokerContract",
+    "scope",
+    "contracts",
+    "handles"
+  ],
+  ACPRecipient: ["sealingKey", "issuerSignature"]
+};
+var getSignatureTypesAndMessage = (primaryType, fields, values) => {
+  const types = {
+    [primaryType]: ACPSignatureAllFields.filter((fieldType) => fields.includes(fieldType.name))
+  };
+  const message = {};
+  fields.forEach((field) => {
+    if (field in values) {
+      message[field] = values[field];
+    }
+  });
+  return { types, primaryType, message };
+};
+var SignatureUtils = {
+  /**
+   * Get signature parameters for an ACP
+   */
+  getSignatureParams: (acp, primaryType) => {
+    return getSignatureTypesAndMessage(primaryType, SignatureTypes[primaryType], acp);
+  },
+  /**
+   * Determine the required signature type based on acp type
+   */
+  getPrimaryType: (acpType) => {
+    if (acpType === "self")
+      return "ACPIssuerSelf";
+    if (acpType === "sharing")
+      return "ACPIssuerShared";
+    if (acpType === "recipient")
+      return "ACPRecipient";
+    throw new Error(`Unknown acp type: ${acpType}`);
+  }
+};
+var ADDRESS_BOOK_ABI = parseAbi([
+  "function getTm(uint256 id) view returns (address)",
+  "error TaskManagerNotSet(uint256 id)"
+]);
+var taskManagerAddressCache = /* @__PURE__ */ new Map();
+var getTaskManagerAddress = async (publicClient, chainId) => {
+  const id = chainId ?? publicClient.chain?.id ?? await publicClient.getChainId();
+  const cached = taskManagerAddressCache.get(id);
+  if (cached != null)
+    return cached;
+  const pending = publicClient.readContract({
+    address: COFHE_ADDRESS_BOOK_ADDRESS,
+    abi: ADDRESS_BOOK_ABI,
+    functionName: "getTm",
+    args: [TASK_MANAGER_ID]
+  }).catch((error) => {
+    taskManagerAddressCache.delete(id);
+    throw CofheError.fromError(error, {
+      code: "TASK_MANAGER_UNRESOLVED" /* TaskManagerUnresolved */,
+      message: `Failed to resolve the Task Manager from the CoFHEAddressBook on chain ${id}`,
+      hint: "Ensure CoFHE is deployed on this chain. On a local hardhat / anvil chain, deploy the CoFHE mocks first.",
+      context: { chainId: id, addressBook: COFHE_ADDRESS_BOOK_ADDRESS, taskManagerId: TASK_MANAGER_ID }
+    });
+  });
+  taskManagerAddressCache.set(id, pending);
+  return pending;
+};
+
+// acps/onchain-utils.ts
+var getAclAddress = async (publicClient) => {
+  const ACL_IFACE = "function acl() view returns (address)";
+  const aclAbi = parseAbi([ACL_IFACE]);
+  return await publicClient.readContract({
+    address: await getTaskManagerAddress(publicClient),
+    abi: aclAbi,
+    functionName: "acl"
+  });
+};
+var getAclEIP712Domain = async (publicClient) => {
+  const aclAddress = await getAclAddress(publicClient);
+  const EIP712_DOMAIN_IFACE = "function eip712Domain() public view returns (bytes1 fields, string name, string version, uint256 chainId, address verifyingContract, bytes32 salt, uint256[] extensions)";
+  const domainAbi = parseAbi([EIP712_DOMAIN_IFACE]);
+  const domain = await publicClient.readContract({
+    address: aclAddress,
+    abi: domainAbi,
+    functionName: "eip712Domain"
+  });
+  const [_fields, name, version, chainId, verifyingContract, _salt, _extensions] = domain;
+  if (version !== "2") {
+    throw new Error(
+      `Chain ${chainId}'s ACL serves EIP-712 domain version "${version}" \u2014 this SDK requires the upgraded (ACP-era) ACL, which signs as version "2". Pre-upgrade (V2 Permission) chains are not supported.`
+    );
+  }
+  return {
+    name,
+    version,
+    chainId: Number(chainId),
+    verifyingContract
+  };
+};
+var toACPTuple = (acp) => ({
+  issuer: acp.issuer,
+  expiration: BigInt(acp.expiration),
+  recipient: acp.recipient,
+  revokerData: BigInt(acp.revokerData),
+  revokerContract: acp.revokerContract,
+  scope: acp.scope,
+  contracts: acp.contracts,
+  handles: acp.handles,
+  sealingKey: acp.sealingKey,
+  issuerSignature: acp.issuerSignature,
+  recipientSignature: acp.recipientSignature
+});
+function revertErrorName(err, abi) {
+  const walk = err?.walk;
+  if (typeof walk === "function") {
+    const revertError = walk.call(err, (e) => e?.name === "ContractFunctionRevertedError");
+    if (revertError)
+      return revertError.data?.errorName ?? "";
+  }
+  const customErrorName = extractCustomErrorFromDetails(err, abi);
+  if (customErrorName)
+    return customErrorName;
+  const hhDetailsData = extractReturnData(err);
+  if (hhDetailsData != null)
+    return decodeErrorResult({ abi, data: hhDetailsData }).errorName;
+  return void 0;
+}
+var checkACPValidityOnChain = async (acp, publicClient) => {
+  const aclAddress = await getAclAddress(publicClient);
+  try {
+    await publicClient.simulateContract({
+      address: aclAddress,
+      abi: checkACPValidityAbi,
+      functionName: "checkPermissionValidity",
+      args: [toACPTuple(acp)]
+    });
+    return true;
+  } catch (err) {
+    const errorName = revertErrorName(err, checkACPValidityAbi);
+    if (errorName !== void 0)
+      throw new Error(errorName);
+    throw err;
+  }
+};
+var PERMISSION_ERROR_STATUS = {
+  PermissionInvalid_Expired: "expired",
+  PermissionInvalid_Disabled: "revoked",
+  PermissionInvalid_IssuerSignature: "invalid-issuer-signature",
+  PermissionInvalid_RecipientSignature: "invalid-recipient-signature"
+};
+var getACPAccessStatusOnChain = async (acp, publicClient, handle) => {
+  const aclAddress = await getAclAddress(publicClient);
+  try {
+    if (handle === void 0) {
+      await publicClient.simulateContract({
+        address: aclAddress,
+        abi: acpAccessAbi,
+        functionName: "checkPermissionValidity",
+        args: [toACPTuple(acp)]
+      });
+      return "valid";
+    }
+    const ctHash = BigInt(handle);
+    const allowed = await publicClient.readContract({
+      address: aclAddress,
+      abi: acpAccessAbi,
+      functionName: "isAllowedWithPermission",
+      args: [toACPTuple(acp), ctHash]
+    });
+    if (allowed)
+      return "allowed";
+    const issuerAllowed = await publicClient.readContract({
+      address: aclAddress,
+      abi: acpAccessAbi,
+      functionName: "isAllowed",
+      args: [ctHash, acp.issuer]
+    });
+    return issuerAllowed ? "out-of-scope" : "issuer-not-allowed";
+  } catch (err) {
+    const status = PERMISSION_ERROR_STATUS[revertErrorName(err, acpAccessAbi) ?? ""];
+    if (status)
+      return status;
+    throw err;
+  }
+};
+function extractCustomErrorFromDetails(err, abi) {
+  const anyErr = err;
+  const details = anyErr?.details ?? anyErr?.cause?.details;
+  if (typeof details === "string") {
+    const customErrorMatch = details.match(/reverted with custom error '(\w+)\(\)'/);
+    if (customErrorMatch) {
+      const errorName = customErrorMatch[1];
+      const errorExists = abi.some((item) => item.type === "error" && item.name === errorName);
+      if (errorExists) {
+        return errorName;
+      }
+    }
+  }
+  return void 0;
+}
+function extractReturnData(err) {
+  const anyErr = err;
+  const s = anyErr?.details ?? anyErr?.cause?.details ?? anyErr?.shortMessage ?? anyErr?.message ?? String(err);
+  const match = s.match(/return data:\s*(0x[a-fA-F0-9]+)/) ?? s.match(/custom error (0x[a-fA-F0-9]{8,})/);
+  return match?.[1];
+}
+var checkACPValidityAbi = [
+  {
+    type: "function",
+    name: "checkPermissionValidity",
+    inputs: [
+      {
+        name: "acp",
+        type: "tuple",
+        internalType: "struct ACP",
+        components: [
+          {
+            name: "issuer",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "expiration",
+            type: "uint64",
+            internalType: "uint64"
+          },
+          {
+            name: "recipient",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "revokerData",
+            type: "uint256",
+            internalType: "uint256"
+          },
+          {
+            name: "revokerContract",
+            type: "address",
+            internalType: "address"
+          },
+          {
+            name: "scope",
+            type: "uint8",
+            internalType: "uint8"
+          },
+          {
+            name: "contracts",
+            type: "address[]",
+            internalType: "address[]"
+          },
+          {
+            name: "handles",
+            type: "bytes32[]",
+            internalType: "bytes32[]"
+          },
+          {
+            name: "sealingKey",
+            type: "bytes32",
+            internalType: "bytes32"
+          },
+          {
+            name: "issuerSignature",
+            type: "bytes",
+            internalType: "bytes"
+          },
+          {
+            name: "recipientSignature",
+            type: "bytes",
+            internalType: "bytes"
+          }
+        ]
+      }
+    ],
+    outputs: [
+      {
+        name: "",
+        type: "bool",
+        internalType: "bool"
+      }
+    ],
+    stateMutability: "view"
+  },
+  {
+    type: "error",
+    name: "PermissionInvalid_Disabled",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "PermissionInvalid_Expired",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "PermissionInvalid_IssuerSignature",
+    inputs: []
+  },
+  {
+    type: "error",
+    name: "PermissionInvalid_RecipientSignature",
+    inputs: []
+  }
+];
+var acpAccessAbi = [
+  ...checkACPValidityAbi,
+  {
+    type: "function",
+    name: "isAllowedWithPermission",
+    inputs: [checkACPValidityAbi[0].inputs[0], { name: "handle", type: "uint256", internalType: "uint256" }],
+    outputs: [{ name: "", type: "bool", internalType: "bool" }],
+    stateMutability: "view"
+  },
+  {
+    type: "function",
+    name: "isAllowed",
+    inputs: [
+      { name: "handle", type: "uint256", internalType: "uint256" },
+      { name: "account", type: "address", internalType: "address" }
+    ],
+    outputs: [{ name: "", type: "bool", internalType: "bool" }],
+    stateMutability: "view"
+  }
+];
+var ACL_SERVED_ADDRESSES_ABI = parseAbi([
+  "function acl() view returns (address)",
+  "function defaultRevokerContract() view returns (address)",
+  "function shareRegistry() view returns (address)"
+]);
+var aclServedAddressesCache = /* @__PURE__ */ new Map();
+var clearAclServedAddresses = () => aclServedAddressesCache.clear();
+var getAclServedAddresses = async (publicClient, chainId) => {
+  const cached = aclServedAddressesCache.get(chainId);
+  if (cached != null)
+    return cached;
+  let aclAddress;
+  try {
+    aclAddress = await publicClient.readContract({
+      address: await getTaskManagerAddress(publicClient, chainId),
+      abi: ACL_SERVED_ADDRESSES_ABI,
+      functionName: "acl"
+    });
+  } catch {
+    return {};
+  }
+  const [defaultRevoker, shareRegistry] = await Promise.all([
+    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "defaultRevokerContract" }).catch(() => void 0),
+    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "shareRegistry" }).catch(() => void 0)
+  ]);
+  const resolved = {
+    defaultRevoker: defaultRevoker != null && defaultRevoker !== zeroAddress ? defaultRevoker : void 0,
+    shareRegistry: shareRegistry != null && shareRegistry !== zeroAddress ? shareRegistry : void 0
+  };
+  aclServedAddressesCache.set(chainId, resolved);
+  return resolved;
+};
+
+// acps/share-metadata/layout.ts
+var LAYOUT_VERSION = 3;
+var ENTRY_KIND = {
+  stored: 0,
+  event: 1,
+  unlabelled: 255
+};
+var ARGS_CODE = {
+  none: 0,
+  issuer: 1,
+  explicit: 255
+};
+var ARG_TAG = {
+  word: 0,
+  issuer: 1
+};
+var APP_KEY_TAG = 1;
+var BYTE_WIDTH = {
+  version: 1,
+  /** Length of a list, and a position in it: at most 255 of each per share. */
+  count: 1,
+  index: 1,
+  address: 20,
+  selector: 4,
+  /** uint32: 4.29 billion blocks. */
+  block: 4,
+  /** uint16: the position of a transaction within its block. */
+  txIndex: 2,
+  /** uint16: the block-wide position of a log (a busy block passes 255 logs). */
+  logIndex: 2,
+  kind: 1,
+  argsCode: 1,
+  returnWord: 1,
+  argTag: 1,
+  word: 32
+};
+
+// acps/share-metadata/encode.ts
+var uint = (value, width) => numberToHex(value, { size: width });
+var BYTES_FIELD = {
+  contract: { width: BYTE_WIDTH.address, name: "a contract address" },
+  selector: { width: BYTE_WIDTH.selector, name: "a selector" },
+  viewCallArgument: { width: BYTE_WIDTH.word, name: "a view call argument" },
+  appKey: { width: BYTE_WIDTH.word, name: "an app key" }
+};
+var bytesField = (field, value) => {
+  const { width, name } = BYTES_FIELD[field];
+  if (!isHex(value, { strict: true }) || size(value) !== width) {
+    throw new Error(`share metadata: ${name} must be ${width} bytes`);
+  }
+  return value.toLowerCase();
+};
+var listOf = (keyOf, what) => {
+  const items = [];
+  const positions = /* @__PURE__ */ new Map();
+  const insert = (item) => {
+    const key = keyOf(item);
+    if (positions.has(key))
+      return;
+    positions.set(key, items.length);
+    items.push(item);
+  };
+  const positionOf = (item) => {
+    const position = positions.get(keyOf(item));
+    if (position === void 0)
+      throw new Error(`share metadata: ${what} ${keyOf(item)} was not collected`);
+    return position;
+  };
+  return { items, insert, positionOf };
+};
+var keyOfContract = (contract) => contract.toLowerCase();
+var keyOfSelector = (selector) => selector.toLowerCase();
+var keyOfTransaction = ({ block, txIndex }) => `${block}:${txIndex}`;
+var transactionOf = ({ block, txIndex }) => ({ block, txIndex });
+var encodeArg = (arg) => {
+  if (arg.type === "issuer")
+    return uint(ARG_TAG.issuer, BYTE_WIDTH.argTag);
+  return concatHex([uint(ARG_TAG.word, BYTE_WIDTH.argTag), bytesField("viewCallArgument", arg.value)]);
+};
+var issuerWordOf = (issuer) => issuer == null ? void 0 : padHex(issuer, { size: BYTE_WIDTH.word }).toLowerCase();
+var asIssuer = (arg, issuerWord) => arg.type === "word" && issuerWord != null && arg.value.toLowerCase() === issuerWord ? { type: "issuer" } : arg;
+var encodeArgs = ({ args: given, returnWord }, issuerWord) => {
+  const args = given.map((arg) => asIssuer(arg, issuerWord));
+  if (returnWord === 0 && args.length === 0)
+    return uint(ARGS_CODE.none, BYTE_WIDTH.argsCode);
+  if (returnWord === 0 && args.length === 1 && args[0].type === "issuer") {
+    return uint(ARGS_CODE.issuer, BYTE_WIDTH.argsCode);
+  }
+  return concatHex([
+    uint(ARGS_CODE.explicit, BYTE_WIDTH.argsCode),
+    uint(returnWord, BYTE_WIDTH.returnWord),
+    uint(args.length, BYTE_WIDTH.count),
+    ...args.map(encodeArg)
+  ]);
+};
+var encodeShareMetadata = (labels, { issuer, appKey } = {}) => {
+  const issuerWord = issuerWordOf(issuer);
+  const contracts = listOf(keyOfContract, "contract");
+  const selectors = listOf(keyOfSelector, "selector");
+  const transactions = listOf(keyOfTransaction, "transaction");
+  for (const label of labels) {
+    if (label.kind === "unlabelled")
+      continue;
+    contracts.insert(label.contract);
+    selectors.insert(label.selector);
+    if (label.kind === "event")
+      transactions.insert(transactionOf(label));
+  }
+  const entries = labels.map((label) => {
+    switch (label.kind) {
+      case "stored":
+        return concatHex([
+          uint(ENTRY_KIND.stored, BYTE_WIDTH.kind),
+          uint(contracts.positionOf(label.contract), BYTE_WIDTH.index),
+          uint(selectors.positionOf(label.selector), BYTE_WIDTH.index),
+          uint(label.block, BYTE_WIDTH.block),
+          encodeArgs(label, issuerWord)
+        ]);
+      case "event":
+        return concatHex([
+          uint(ENTRY_KIND.event, BYTE_WIDTH.kind),
+          uint(contracts.positionOf(label.contract), BYTE_WIDTH.index),
+          uint(transactions.positionOf(transactionOf(label)), BYTE_WIDTH.index),
+          uint(label.logIndex, BYTE_WIDTH.logIndex),
+          uint(selectors.positionOf(label.selector), BYTE_WIDTH.index)
+        ]);
+      case "unlabelled":
+        return uint(ENTRY_KIND.unlabelled, BYTE_WIDTH.kind);
+    }
+  });
+  return concatHex([
+    uint(LAYOUT_VERSION, BYTE_WIDTH.version),
+    uint(contracts.items.length, BYTE_WIDTH.count),
+    ...contracts.items.map((contract) => bytesField("contract", contract)),
+    uint(selectors.items.length, BYTE_WIDTH.count),
+    ...selectors.items.map((selector) => bytesField("selector", selector)),
+    uint(transactions.items.length, BYTE_WIDTH.count),
+    ...transactions.items.map(
+      (tx) => concatHex([uint(tx.block, BYTE_WIDTH.block), uint(tx.txIndex, BYTE_WIDTH.txIndex)])
+    ),
+    ...entries,
+    ...appKey == null ? [] : [uint(APP_KEY_TAG, BYTE_WIDTH.count), bytesField("appKey", appKey)]
+  ]);
+};
+var findViewFunction = (abi, name, arity) => {
+  const named = abi.filter((item) => item.type === "function" && item.name === name);
+  if (named.length === 0)
+    throw new Error(`share metadata: the ABI has no function ${name}`);
+  const fitting = named.filter((fn2) => fn2.inputs.length === arity);
+  if (fitting.length !== 1) {
+    throw new Error(
+      named.length === 1 ? `share metadata: ${name} takes ${named[0].inputs.length} arguments, ${arity} given` : `share metadata: no single overload of ${name} takes ${arity} arguments`
+    );
+  }
+  const [fn] = fitting;
+  if (fn.stateMutability !== "view" && fn.stateMutability !== "pure") {
+    throw new Error(`share metadata: ${name} is not a view function`);
+  }
+  return fn;
+};
+var encodeReadArg = (fn, index, value) => {
+  const input = fn.inputs[index];
+  const word = encodeAbiParameters([input], [value]);
+  if (size(word) !== BYTE_WIDTH.word) {
+    throw new Error(
+      `share metadata: argument ${index} of ${fn.name} is ${input.type}; only arguments of one static 32-byte word can be labelled`
+    );
+  }
+  return { type: "word", value: word };
+};
+var viewFunctionLabel = (options) => {
+  const { contract, block, returnWord = 0 } = options;
+  const values = options.args ?? [];
+  const fn = findViewFunction(options.abi, options.functionName, values.length);
+  return {
+    kind: "stored",
+    contract,
+    selector: toFunctionSelector(fn),
+    args: values.map((value, i) => encodeReadArg(fn, i, value)),
+    returnWord,
+    block
+  };
+};
+var eventLogLabel = (log) => {
+  const { address, blockNumber, transactionIndex, logIndex, topics } = log;
+  const topic0 = topics[0];
+  if (blockNumber == null || transactionIndex == null || logIndex == null) {
+    throw new Error("share metadata: a pending log has no position to label");
+  }
+  if (topic0 == null || size(topic0) !== 32)
+    throw new Error("share metadata: an anonymous log has no event selector");
+  return {
+    kind: "event",
+    contract: address,
+    block: blockNumber,
+    txIndex: transactionIndex,
+    logIndex,
+    selector: sliceHex(topic0, 0, 4)
+  };
+};
+var UNLABELLED = { kind: "unlabelled" };
+
+// acps/acp.ts
+var sharedByName = (issuer) => `Shared by ${issuer.slice(0, 6)}\u2026${issuer.slice(-4)}`;
+var ACPUtils = {
+  /**
+   * Create a self acp for personal use
+   */
+  createSelf: (options) => {
+    const validation = validateSelfACPOptions(options);
+    const sealingPair = GenerateSealingKey();
+    const acp = {
+      hash: ACPUtils.getHash(validation),
+      ...validation,
+      sealingPrivateKey: sealingPair.privateKey,
+      sealingKey: sealingPair.publicKey,
+      _signedDomain: void 0
+    };
+    return acp;
+  },
+  /**
+   * Create a sharing acp to be shared with another user
+   */
+  createSharing: (options) => {
+    const validation = validateSharingACPOptions(options);
+    const { labels, appKey } = options;
+    if (labels != null && labels.length !== validation.handles.length) {
+      throw new Error(`Cannot label a share of ${validation.handles.length} handles with ${labels.length} labels`);
+    }
+    const metadata = labels != null || appKey != null ? encodeShareMetadata(labels ?? validation.handles.map(() => UNLABELLED), { issuer: validation.issuer, appKey }) : void 0;
+    const sealingPair = GenerateSealingKey();
+    const acp = {
+      hash: ACPUtils.getHash(validation),
+      ...validation,
+      ...metadata != null && { metadata },
+      sealingPrivateKey: sealingPair.privateKey,
+      sealingKey: sealingPair.publicKey,
+      _signedDomain: void 0
+    };
+    return acp;
+  },
+  /**
+   * Import a shared acp from various input formats. The acp is named `name`, or after its issuer
+   * ("Shared by 0x1234…abcd"); a `name` in the share itself is ignored.
+   */
+  importShared: (options, { name } = {}) => {
+    let parsedOptions;
+    if (typeof options === "string") {
+      try {
+        parsedOptions = JSON.parse(options);
+      } catch (error) {
+        throw new Error(`Failed to parse JSON string: ${error}`);
+      }
+    } else if (typeof options === "object" && options !== null) {
+      parsedOptions = options;
+    } else {
+      throw new Error("Invalid input type, expected ImportSharedACPOptions, object, or string");
+    }
+    if (parsedOptions.type != null && parsedOptions.type !== "sharing") {
+      throw new Error(`Invalid acp type <${parsedOptions.type}>, must be "sharing"`);
+    }
+    const validation = validateImportACPOptions({ ...parsedOptions, type: "recipient" });
+    const sealingPair = GenerateSealingKey();
+    const acp = {
+      hash: ACPUtils.getHash(validation),
+      ...validation,
+      name: name?.trim() || sharedByName(validation.issuer),
+      sealingPrivateKey: sealingPair.privateKey,
+      sealingKey: sealingPair.publicKey,
+      _signedDomain: void 0
+    };
+    return acp;
+  },
+  /**
+   * Sign an ACP with the provided wallet client
+   */
+  sign: async (acp, publicClient, walletClient) => {
+    if (walletClient == null || walletClient.account == null) {
+      throw new Error(
+        "Missing walletClient, you must pass in a `walletClient` for the connected user to create an ACP signature"
+      );
+    }
+    const primaryType = SignatureUtils.getPrimaryType(acp.type);
+    const domain = await getAclEIP712Domain(publicClient);
+    const { types, message } = SignatureUtils.getSignatureParams(ACPUtils.getPublic(acp, true), primaryType);
+    const signature = await walletClient.signTypedData({
+      domain,
+      types,
+      primaryType,
+      message,
+      account: walletClient.account
+    });
+    let updatedACP;
+    if (acp.type === "self" || acp.type === "sharing") {
+      updatedACP = {
+        ...acp,
+        issuerSignature: signature,
+        _signedDomain: domain
+      };
+    } else {
+      updatedACP = {
+        ...acp,
+        recipientSignature: signature,
+        _signedDomain: domain
+      };
+    }
+    return updatedACP;
+  },
+  /**
+   * Create and sign a self acp in one operation
+   */
+  createSelfAndSign: async (options, publicClient, walletClient) => {
+    const acp = ACPUtils.createSelf(options);
+    return ACPUtils.sign(acp, publicClient, walletClient);
+  },
+  /**
+   * Create and sign a sharing acp in one operation
+   */
+  createSharingAndSign: async (options, publicClient, walletClient) => {
+    const acp = ACPUtils.createSharing(options);
+    return ACPUtils.sign(acp, publicClient, walletClient);
+  },
+  /**
+   * Import and sign a shared acp in one operation from various input formats
+   */
+  importSharedAndSign: async (options, publicClient, walletClient, importOptions = {}) => {
+    const acp = ACPUtils.importShared(options, importOptions);
+    return ACPUtils.sign(acp, publicClient, walletClient);
+  },
+  /**
+   * Deserialize an ACP from serialized data
+   */
+  deserialize: (data) => {
+    return { ...data };
+  },
+  /**
+   * Serialize an ACP for storage
+   */
+  serialize: (acp) => {
+    return {
+      hash: acp.hash,
+      name: acp.name,
+      type: acp.type,
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles,
+      sealingKey: acp.sealingKey,
+      issuerSignature: acp.issuerSignature,
+      recipientSignature: acp.recipientSignature,
+      _signedDomain: acp._signedDomain,
+      sealingPrivateKey: acp.sealingPrivateKey,
+      ...acp.metadata != null && { metadata: acp.metadata }
+    };
+  },
+  /**
+   * Validate an ACP (schema-level validation)
+   */
+  validateSchema: (acp) => {
+    if (acp.type === "self") {
+      return validateSelfACP(acp);
+    } else if (acp.type === "sharing") {
+      return validateSharingACP(acp);
+    } else if (acp.type === "recipient") {
+      return validateImportACP(acp);
+    } else {
+      throw new Error("Invalid ACP type");
+    }
+  },
+  /**
+   * Validate an ACP (holistic validation).
+   *
+   * This validates:
+   * - ACP schema (shape + invariants)
+   * - ACP is signed
+   * - ACP is not expired
+   *
+   * For schema-only validation, use `validateSchema(acp)`.
+   */
+  validate: (acp) => {
+    const validated = ACPUtils.validateSchema(acp);
+    ValidationUtils.assertSignedAndNotExpired(validated);
+    return validated;
+  },
+  /**
+   * Get the public component of an ACP — the signed struct sent on-chain / to the decryption backend.
+   * Strips the private component (hash, name, type, sealing pair).
+   */
+  getPublic: (acp, skipValidation = false) => {
+    if (!skipValidation) {
+      ACPUtils.validateSchema(acp);
+    }
+    return {
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles,
+      sealingKey: acp.sealingKey,
+      issuerSignature: acp.issuerSignature,
+      recipientSignature: acp.recipientSignature
+    };
+  },
+  /**
+   * Get a stable hash for the acp (used as key in storage)
+   */
+  getHash: (acp) => {
+    const data = JSON.stringify({
+      type: acp.type,
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles
+    });
+    return keccak256(toHex(data));
+  },
+  /**
+   * Export acp data for sharing (strips the private component).
+   * Fixed `SharedACP` shape — every field always present, aligned with
+   * `ACPPublic` and the on-chain sharing payload — plus `metadata` when the acp has labels.
+   */
+  export: (acp) => {
+    if (acp.type !== "sharing") {
+      throw new Error(
+        `Cannot export a '${acp.type}' ACP \u2014 only 'sharing' ACPs are exportable. The export includes the issuer signature.`
+      );
+    }
+    if (acp.issuerSignature === "0x") {
+      throw new Error(
+        "Cannot export an unsigned sharing ACP \u2014 sign it first (the recipient needs the issuer signature)."
+      );
+    }
+    const shared = {
+      type: acp.type,
+      issuer: acp.issuer,
+      expiration: acp.expiration,
+      recipient: acp.recipient,
+      revokerData: acp.revokerData,
+      revokerContract: acp.revokerContract,
+      scope: acp.scope,
+      contracts: acp.contracts,
+      handles: acp.handles,
+      issuerSignature: acp.issuerSignature,
+      ...acp.metadata != null && acp.metadata !== "0x" && { metadata: acp.metadata }
+    };
+    return JSON.stringify(shared, void 0, 2);
+  },
+  /**
+   * Unseal encrypted data using the acp's sealing key
+   */
+  unseal: (acp, ciphertext) => {
+    return unsealWithPrivateKey(acp.sealingPrivateKey, ciphertext);
+  },
+  /**
+   * Check if acp is expired
+   */
+  isExpired: (acp) => {
+    return ValidationUtils.isExpired(acp);
+  },
+  /**
+   * Check if acp is signed
+   */
+  isSigned: (acp) => {
+    return ValidationUtils.isSigned(acp);
+  },
+  /**
+   * Check if acp is signed and not expired
+   */
+  isSignedAndNotExpired: (acp) => {
+    return ValidationUtils.isSignedAndNotExpired(acp);
+  },
+  /**
+   * Assert that acp is signed and not expired
+   */
+  assertSignedAndNotExpired: (acp) => {
+    return ValidationUtils.assertSignedAndNotExpired(acp);
+  },
+  isValid: (acp) => {
+    return ValidationUtils.isValid(acp);
+  },
+  /**
+   * Update acp name (returns new acp instance)
+   */
+  updateName: (acp, name) => {
+    return { ...acp, name };
+  },
+  /**
+   * Fetch EIP712 domain from the blockchain
+   */
+  fetchEIP712Domain: async (publicClient) => {
+    return getAclEIP712Domain(publicClient);
+  },
+  /**
+   * Check if acp's signed domain matches the provided domain
+   */
+  matchesDomain: (acp, domain) => {
+    return acp._signedDomain?.name === domain.name && acp._signedDomain?.version === domain.version && acp._signedDomain?.verifyingContract === domain.verifyingContract && acp._signedDomain?.chainId === domain.chainId;
+  },
+  /**
+   * Check if acp's signed domain is valid for the current chain
+   */
+  checkSignedDomainValid: async (acp, publicClient) => {
+    if (acp._signedDomain == null)
+      return false;
+    const domain = await getAclEIP712Domain(publicClient);
+    return ACPUtils.matchesDomain(acp, domain);
+  },
+  /**
+   * Check if acp passes the on-chain validation
+   */
+  checkValidityOnChain: async (acp, publicClient) => {
+    const publicAcp = ACPUtils.getPublic(acp);
+    return checkACPValidityOnChain(publicAcp, publicClient);
+  },
+  /**
+   * The acp on-chain status as a value instead of a revert: 'valid' or why not, and given a
+   * handle, whether the acp may read it (see `ACPAccessStatus`).
+   */
+  checkAccessOnChain: async (acp, publicClient, handle) => {
+    return getACPAccessStatusOnChain(ACPUtils.getPublic(acp), publicClient, handle);
+  }
+};
+var ACP_REVOKER_ABI = parseAbi([
+  "function revokeSingle(uint256 id)",
+  "function revokeAllExisting()",
+  "function disabled(address issuer, uint256 id) view returns (bool)"
+]);
+var ACP_SHARE_REGISTRY_ABI = parseAbi([
+  "struct ACP { address issuer; uint64 expiration; address recipient; uint256 revokerData; address revokerContract; uint8 scope; address[] contracts; bytes32[] handles; bytes32 sealingKey; bytes issuerSignature; bytes recipientSignature; }",
+  "struct ShareHeader { address issuer; uint64 expiration; address recipient; uint64 blockNumber; address revokerContract; uint256 revokerData; }",
+  "function share(ACP calldata acp, bytes calldata metadata) external returns (bytes32)",
+  "function removeShare(bytes32 shareId) external",
+  "function sharesFor(address recipient) external view returns (bytes32[] shareIds, ShareHeader[] headers)",
+  "function getShare(bytes32 shareId) external view returns (ShareHeader memory)",
+  "function isShareValid(bytes32 shareId) external view returns (bool)",
+  "event Shared(address indexed recipient, address indexed issuer, bytes32 indexed shareId, ACP acp, bytes metadata)",
+  "event ShareRemoved(address indexed recipient, address indexed issuer, bytes32 indexed shareId)"
+]);
+var ACP_SHARE_TUPLE_ABI = [
+  {
+    type: "tuple",
+    components: [
+      { name: "issuer", type: "address" },
+      { name: "expiration", type: "uint64" },
+      { name: "recipient", type: "address" },
+      { name: "revokerData", type: "uint256" },
+      { name: "revokerContract", type: "address" },
+      { name: "scope", type: "uint8" },
+      { name: "contracts", type: "address[]" },
+      { name: "handles", type: "bytes32[]" },
+      { name: "sealingKey", type: "bytes32" },
+      { name: "issuerSignature", type: "bytes" },
+      { name: "recipientSignature", type: "bytes" }
+    ]
+  }
+];
+var ZERO_BYTES32 = `0x${"0".repeat(64)}`;
+var toChainShare = (acp) => {
+  const pub = ACPUtils.getPublic(acp, true);
+  return {
+    ...pub,
+    expiration: BigInt(pub.expiration),
+    revokerData: BigInt(pub.revokerData),
+    sealingKey: ZERO_BYTES32,
+    recipientSignature: "0x"
+  };
+};
+var computeShareId = (acp) => {
+  const p = toChainShare(acp);
+  return keccak256(encodeAbiParameters(ACP_SHARE_TUPLE_ABI, [p]));
+};
+var shareIdOfChainShare = (share) => keccak256(encodeAbiParameters(ACP_SHARE_TUPLE_ABI, [share]));
+var messageOf = (error) => error instanceof Error ? error.message : String(error);
+var readPostedShares = async (publicClient, registry, headers) => {
+  const idsByBlock = /* @__PURE__ */ new Map();
+  for (const { shareId, header } of headers) {
+    idsByBlock.set(header.blockNumber, [...idsByBlock.get(header.blockNumber) ?? [], shareId]);
+  }
+  const found = /* @__PURE__ */ new Map();
+  await Promise.all(
+    [...idsByBlock].map(async ([block, shareIds]) => {
+      let logs;
+      try {
+        logs = await publicClient.getContractEvents({
+          address: registry,
+          abi: ACP_SHARE_REGISTRY_ABI,
+          eventName: "Shared",
+          args: { shareId: shareIds },
+          fromBlock: block,
+          toBlock: block,
+          strict: true
+        });
+      } catch (error) {
+        for (const shareId of shareIds) {
+          found.set(shareId.toLowerCase(), {
+            reason: `the Shared events of block ${block} could not be read: ${messageOf(error)}`
+          });
+        }
+        return;
+      }
+      for (const { args } of logs) {
+        const hashes = shareIdOfChainShare(args.acp).toLowerCase() === args.shareId.toLowerCase();
+        found.set(
+          args.shareId.toLowerCase(),
+          hashes ? { share: args.acp, metadata: args.metadata } : { reason: "the payload in its Shared event does not hash to its id" }
+        );
+      }
+    })
+  );
+  const result = { posted: [], unreadable: [] };
+  for (const { shareId, header } of headers) {
+    const entry = found.get(shareId.toLowerCase());
+    if (entry == null) {
+      result.unreadable.push({
+        shareId,
+        header,
+        reason: `no Shared event in block ${header.blockNumber}, where the registry points`
+      });
+    } else if ("reason" in entry) {
+      result.unreadable.push({ shareId, header, reason: entry.reason });
+    } else {
+      result.posted.push({ shareId, header, ...entry });
+    }
+  }
+  return result;
+};
+var readSharesFor = async (publicClient, registry, recipient) => {
+  const [shareIds, headers] = await publicClient.readContract({
+    address: registry,
+    abi: ACP_SHARE_REGISTRY_ABI,
+    functionName: "sharesFor",
+    args: [recipient]
+  });
+  return readPostedShares(
+    publicClient,
+    registry,
+    shareIds.map((shareId, i) => ({ shareId, header: headers[i] }))
+  );
+};
+var readShare = async (publicClient, registry, shareId) => {
+  const header = await publicClient.readContract({
+    address: registry,
+    abi: ACP_SHARE_REGISTRY_ABI,
+    functionName: "getShare",
+    args: [shareId]
+  });
+  if (header.issuer === "0x0000000000000000000000000000000000000000")
+    return null;
+  const { posted, unreadable } = await readPostedShares(publicClient, registry, [{ shareId, header }]);
+  if (unreadable.length > 0)
+    throw new Error(`Share ${shareId}: ${unreadable[0].reason}`);
+  return posted[0];
+};
+var readerOf = (blob) => {
+  let offset = 0;
+  const take = (width) => {
+    if (offset + width > size(blob))
+      throw new Error("share metadata: the blob ends in the middle of a field");
+    offset += width;
+    return sliceHex(blob, offset - width, offset);
+  };
+  return {
+    take,
+    takeNumber: (width) => hexToNumber(take(width)),
+    done: () => offset === size(blob),
+    remaining: () => size(blob) - offset
+  };
+};
+var takeList = (reader, takeItem) => Array.from({ length: reader.takeNumber(BYTE_WIDTH.count) }, takeItem);
+var takeFrom = (reader, list, what) => {
+  const position = reader.takeNumber(BYTE_WIDTH.index);
+  if (position >= list.length) {
+    throw new Error(`share metadata: ${what} ${position} is outside the ${what} list`);
+  }
+  return list[position];
+};
+var decodeArg = (reader) => {
+  const tag = reader.takeNumber(BYTE_WIDTH.argTag);
+  if (tag === ARG_TAG.issuer)
+    return { type: "issuer" };
+  if (tag === ARG_TAG.word)
+    return { type: "word", value: reader.take(BYTE_WIDTH.word) };
+  throw new Error(`share metadata: unknown argument tag ${tag}`);
+};
+var decodeArgs = (reader) => {
+  const code = reader.takeNumber(BYTE_WIDTH.argsCode);
+  if (code === ARGS_CODE.none)
+    return { args: [], returnWord: 0 };
+  if (code === ARGS_CODE.issuer)
+    return { args: [{ type: "issuer" }], returnWord: 0 };
+  if (code !== ARGS_CODE.explicit)
+    throw new Error(`share metadata: unknown args code ${code}`);
+  const returnWord = reader.takeNumber(BYTE_WIDTH.returnWord);
+  return { args: takeList(reader, () => decodeArg(reader)), returnWord };
+};
+var takeAppKey = (reader) => {
+  if (reader.done())
+    return void 0;
+  const isKey = reader.remaining() === BYTE_WIDTH.count + BYTE_WIDTH.word && reader.takeNumber(BYTE_WIDTH.count) === APP_KEY_TAG;
+  if (!isKey)
+    throw new Error("share metadata: the blob has more entries than the share has ctHashes");
+  return reader.take(BYTE_WIDTH.word);
+};
+var decodeShareMetadataFull = (blob, handles) => {
+  const reader = readerOf(blob);
+  const version = reader.takeNumber(BYTE_WIDTH.version);
+  if (version !== LAYOUT_VERSION)
+    throw new Error(`share metadata: unsupported version ${version}`);
+  const contracts = takeList(reader, () => getAddress(reader.take(BYTE_WIDTH.address)));
+  const selectors = takeList(reader, () => reader.take(BYTE_WIDTH.selector));
+  const transactions = takeList(reader, () => ({
+    block: hexToBigInt(reader.take(BYTE_WIDTH.block)),
+    txIndex: reader.takeNumber(BYTE_WIDTH.txIndex)
+  }));
+  const labels = handles.map(() => {
+    const kind = reader.takeNumber(BYTE_WIDTH.kind);
+    switch (kind) {
+      case ENTRY_KIND.stored: {
+        const contract = takeFrom(reader, contracts, "contract");
+        const selector = takeFrom(reader, selectors, "selector");
+        const block = hexToBigInt(reader.take(BYTE_WIDTH.block));
+        return { kind: "stored", contract, selector, ...decodeArgs(reader), block };
+      }
+      case ENTRY_KIND.event: {
+        const contract = takeFrom(reader, contracts, "contract");
+        const { block, txIndex } = takeFrom(reader, transactions, "transaction");
+        const logIndex = reader.takeNumber(BYTE_WIDTH.logIndex);
+        const selector = takeFrom(reader, selectors, "selector");
+        return { kind: "event", contract, block, txIndex, logIndex, selector };
+      }
+      case ENTRY_KIND.unlabelled:
+        return { kind: "unlabelled" };
+      default:
+        throw new Error(`share metadata: unknown entry kind ${kind}`);
+    }
+  });
+  const appKey = takeAppKey(reader);
+  if (!reader.done())
+    throw new Error("share metadata: the blob has more entries than the share has ctHashes");
+  return { labels, appKey };
+};
+var decodeShareMetadata = (blob, handles) => decodeShareMetadataFull(blob, handles).labels;
+var decodeShareAppKey = (metadata, handles) => metadata == null || metadata === "0x" ? void 0 : decodeShareMetadataFull(metadata, handles).appKey;
+var sameWord = (a, b) => a.toLowerCase() === b.toLowerCase();
+var wordsOf = (data) => {
+  const count = Math.floor(size(data) / BYTE_WIDTH.word);
+  return Array.from(
+    { length: count },
+    (_, index) => sliceHex(data, index * BYTE_WIDTH.word, (index + 1) * BYTE_WIDTH.word)
+  );
+};
+var storedCallData = (label, issuer) => concatHex([
+  label.selector,
+  ...label.args.map((arg) => arg.type === "issuer" ? padHex(issuer, { size: BYTE_WIDTH.word }) : arg.value)
+]);
+var checkStored = (label, handle, data) => {
+  const found = data ? wordsOf(data)[label.returnWord] : void 0;
+  return found && sameWord(found, handle) ? "verified" : "mismatch";
+};
+var checkEvent = (label, handle, logs) => {
+  const log = logs.find((l) => l.logIndex === label.logIndex);
+  if (log == null)
+    return "mismatch";
+  if (log.transactionIndex !== label.txIndex)
+    return "mismatch";
+  const topic0 = log.topics[0];
+  if (topic0 == null || !topic0.toLowerCase().startsWith(label.selector.toLowerCase()))
+    return "mismatch";
+  const carried = [...log.topics.slice(1), ...wordsOf(log.data)].some((word) => word != null && sameWord(word, handle));
+  return carried ? "verified" : "mismatch";
+};
+var callAt = async (publicClient, to, data, blockNumber) => (await publicClient.call({ to, data, blockNumber })).data;
+var logsAt = (publicClient, address, block) => publicClient.getLogs({ address, fromBlock: block, toBlock: block });
+var verifyShareLabel = async (label, handle, publicClient, issuer) => {
+  try {
+    switch (label.kind) {
+      case "stored":
+        return checkStored(
+          label,
+          handle,
+          await callAt(publicClient, label.contract, storedCallData(label, issuer), label.block)
+        );
+      case "event":
+        return checkEvent(label, handle, await logsAt(publicClient, label.contract, label.block));
+      case "unlabelled":
+        return "unverifiable";
+    }
+  } catch {
+    return "unverifiable";
+  }
+};
+var verifyShareLabels = async ({
+  labels,
+  handles,
+  issuer,
+  publicClient,
+  verify = "all"
+}) => {
+  if (labels.length !== handles.length) {
+    throw new Error(`share metadata: ${labels.length} labels for ${handles.length} ctHashes`);
+  }
+  const requests = /* @__PURE__ */ new Map();
+  const once = (key, request) => {
+    if (!requests.has(key))
+      requests.set(key, request());
+    return requests.get(key);
+  };
+  return Promise.all(
+    labels.map(async (label, i) => {
+      const handle = handles[i];
+      try {
+        switch (label.kind) {
+          case "stored": {
+            if (verify !== "all")
+              return "skipped";
+            const data = storedCallData(label, issuer);
+            const key = `call:${label.contract.toLowerCase()}:${label.block}:${data}`;
+            return checkStored(
+              label,
+              handle,
+              await once(key, () => callAt(publicClient, label.contract, data, label.block))
+            );
+          }
+          case "event": {
+            if (verify === "none")
+              return "skipped";
+            const key = `logs:${label.contract.toLowerCase()}:${label.block}`;
+            return checkEvent(label, handle, await once(key, () => logsAt(publicClient, label.contract, label.block)));
+          }
+          case "unlabelled":
+            return verify === "none" ? "skipped" : "unverifiable";
+        }
+      } catch {
+        return "unverifiable";
+      }
+    })
+  );
+};
+var abiOf = (abis, contract) => {
+  const wanted = contract.toLowerCase();
+  const key = Object.keys(abis).find((address) => address.toLowerCase() === wanted);
+  return key ? abis[key] : void 0;
+};
+var paramOf = ({ name, type, ...rest }) => {
+  const param = { type };
+  if (name)
+    param.name = name;
+  if ("indexed" in rest && typeof rest.indexed === "boolean")
+    param.indexed = rest.indexed;
+  return param;
+};
+var findFunction = (abi, selector) => abi?.find(
+  (item) => item.type === "function" && toFunctionSelector(item).toLowerCase() === selector.toLowerCase()
+);
+var findEvent = (abi, selector) => abi?.find(
+  (item) => item.type === "event" && toEventSelector(item).toLowerCase().startsWith(selector.toLowerCase())
+);
+var decodeWord = (input, raw) => {
+  if (input == null)
+    return raw;
+  try {
+    return decodeAbiParameters([input], raw)[0];
+  } catch {
+    return raw;
+  }
+};
+var describeStored = (base, label, abis, issuer) => {
+  const fn = findFunction(abiOf(abis, label.contract), label.selector);
+  const args = label.args.map((arg, i) => {
+    const input = fn?.inputs[i];
+    const param = input ? paramOf(input) : { type: "bytes32" };
+    if (arg.type === "issuer") {
+      return {
+        ...param,
+        isIssuer: true,
+        raw: issuer ? padHex(issuer, { size: 32 }) : void 0,
+        value: issuer
+      };
+    }
+    return { ...param, isIssuer: false, raw: arg.value, value: decodeWord(input, arg.value) };
+  });
+  const output = fn?.outputs[label.returnWord];
+  return {
+    ...base,
+    kind: "stored",
+    label,
+    contract: label.contract,
+    block: label.block,
+    selector: label.selector,
+    function: fn ? { name: fn.name, signature: toFunctionSignature(fn), inputs: fn.inputs.map(paramOf) } : null,
+    args,
+    output: output ? paramOf(output) : null
+  };
+};
+var describeEvent = (base, label, abis) => {
+  const event = findEvent(abiOf(abis, label.contract), label.selector);
+  return {
+    ...base,
+    kind: "event",
+    label,
+    contract: label.contract,
+    block: label.block,
+    txIndex: label.txIndex,
+    logIndex: label.logIndex,
+    selector: label.selector,
+    event: event ? { name: event.name, signature: toEventSignature(event), inputs: event.inputs.map(paramOf) } : null
+  };
+};
+var describeShareLabels = (labels, handles, abis = {}, options = {}) => labels.map((label, index) => {
+  const base = { index, handle: handles[index] };
+  switch (label.kind) {
+    case "stored":
+      return describeStored(base, label, abis, options.issuer);
+    case "event":
+      return describeEvent(base, label, abis);
+    case "unlabelled":
+      return { ...base, kind: "unlabelled", label };
+  }
+});
+var describeShareMetadata = (share, abis = {}) => {
+  const { issuer, handles, metadata } = share;
+  if (metadata == null || metadata === "0x")
+    return null;
+  return describeShareLabels(decodeShareMetadata(metadata, handles), handles, abis, { issuer });
+};
+
+// acps/share-metadata/erc7984.ts
+var ERC7984_ABI = [
+  {
+    type: "function",
+    name: "confidentialBalanceOf",
+    stateMutability: "view",
+    inputs: [{ name: "account", type: "address", internalType: "address" }],
+    outputs: [{ name: "", type: "bytes32", internalType: "euint64" }]
+  },
+  {
+    type: "event",
+    name: "ConfidentialTransfer",
+    anonymous: false,
+    inputs: [
+      { name: "from", type: "address", indexed: true, internalType: "address" },
+      { name: "to", type: "address", indexed: true, internalType: "address" },
+      { name: "amount", type: "bytes32", indexed: true, internalType: "euint64" }
+    ]
+  }
+];
+var shareAppKey = (app) => keccak256(stringToHex(app));
+var ACP_STORE_DEFAULTS = {
+  acps: {},
+  activeACPHash: {}
+};
+var ACP_STORE_VERSION = 3;
+var isRecord = (value) => value != null && typeof value === "object" && !Array.isArray(value);
+var resolveAccountKey = (records, account) => {
+  if (records == null || account in records)
+    return account;
+  const lower = account.toLowerCase();
+  return Object.keys(records).find((key) => key.toLowerCase() === lower) ?? account;
+};
+var _acpStore = createStore()(
+  persist(() => ACP_STORE_DEFAULTS, {
+    name: "cofhesdk-acps",
+    version: ACP_STORE_VERSION,
+    migrate: (persistedState, version) => {
+      if (version < ACP_STORE_VERSION)
+        return ACP_STORE_DEFAULTS;
+      return persistedState;
+    },
+    // Runs on every rehydrate, including a corrupt state saved at the current version that
+    // `migrate` passes through unchanged. Consumers that read the raw snapshot (e.g. the React
+    // hooks) never go through `clearStaleStore`, so the shape has to be fixed here.
+    merge: (persistedState, currentState) => {
+      const persisted = isRecord(persistedState) ? persistedState : {};
+      return {
+        ...currentState,
+        acps: isRecord(persisted.acps) ? persisted.acps : currentState.acps,
+        activeACPHash: isRecord(persisted.activeACPHash) ? persisted.activeACPHash : currentState.activeACPHash
+      };
+    }
+  })
+);
+var clearStaleStore = () => {
+  const state = _acpStore.getState();
+  const hasExpectedStructure = isRecord(state) && isRecord(state.acps) && isRecord(state.activeACPHash);
+  if (hasExpectedStructure)
+    return;
+  _acpStore.setState({ acps: {}, activeACPHash: {} });
+};
+var getACP = (chainId, account, hash) => {
+  clearStaleStore();
+  if (chainId == null || account == null || hash == null)
+    return;
+  const accountACPs = _acpStore.getState().acps[chainId];
+  const savedACP = accountACPs?.[resolveAccountKey(accountACPs, account)]?.[hash];
+  if (savedACP == null)
+    return;
+  return ACPUtils.deserialize(savedACP);
+};
+var getActiveACP = (chainId, account) => {
+  clearStaleStore();
+  if (chainId == null || account == null)
+    return;
+  const activeHashes = _acpStore.getState().activeACPHash[chainId];
+  const activeACPHash = activeHashes?.[resolveAccountKey(activeHashes, account)];
+  return getACP(chainId, account, activeACPHash);
+};
+var getACPs = (chainId, account) => {
+  clearStaleStore();
+  if (chainId == null || account == null)
+    return {};
+  const accountACPs = _acpStore.getState().acps[chainId];
+  return Object.entries(accountACPs?.[resolveAccountKey(accountACPs, account)] ?? {}).reduce(
+    (acc, [hash, acp]) => {
+      if (acp == void 0)
+        return acc;
+      return { ...acc, [hash]: ACPUtils.deserialize(acp) };
+    },
+    {}
+  );
+};
+var setACP = (chainId, account, acp) => {
+  clearStaleStore();
+  _acpStore.setState(
+    produce((state) => {
+      if (state.acps[chainId] == null)
+        state.acps[chainId] = {};
+      const key = resolveAccountKey(state.acps[chainId], account);
+      if (state.acps[chainId][key] == null)
+        state.acps[chainId][key] = {};
+      state.acps[chainId][key][acp.hash] = ACPUtils.serialize(acp);
+    })
+  );
+};
+var removeACP = (chainId, account, hash) => {
+  clearStaleStore();
+  _acpStore.setState(
+    produce((state) => {
+      if (state.acps[chainId] == null)
+        state.acps[chainId] = {};
+      if (state.activeACPHash[chainId] == null)
+        state.activeACPHash[chainId] = {};
+      const accountACPs = state.acps[chainId][resolveAccountKey(state.acps[chainId], account)];
+      if (accountACPs == null)
+        return;
+      if (accountACPs[hash] == null)
+        return;
+      const activeKey = resolveAccountKey(state.activeACPHash[chainId], account);
+      if (state.activeACPHash[chainId][activeKey] === hash) {
+        state.activeACPHash[chainId][activeKey] = void 0;
+      }
+      accountACPs[hash] = void 0;
+    })
+  );
+};
+var getActiveACPHash = (chainId, account) => {
+  clearStaleStore();
+  if (chainId == null || account == null)
+    return void 0;
+  const activeHashes = _acpStore.getState().activeACPHash[chainId];
+  return activeHashes?.[resolveAccountKey(activeHashes, account)];
+};
+var setActiveACPHash = (chainId, account, hash) => {
+  clearStaleStore();
+  _acpStore.setState(
+    produce((state) => {
+      if (state.activeACPHash[chainId] == null)
+        state.activeACPHash[chainId] = {};
+      state.activeACPHash[chainId][resolveAccountKey(state.activeACPHash[chainId], account)] = hash;
+    })
+  );
+};
+var removeActiveACPHash = (chainId, account) => {
+  clearStaleStore();
+  _acpStore.setState(
+    produce((state) => {
+      if (state.activeACPHash[chainId])
+        state.activeACPHash[chainId][resolveAccountKey(state.activeACPHash[chainId], account)] = void 0;
+    })
+  );
+};
+var resetStore = () => {
+  clearStaleStore();
+  _acpStore.setState({ acps: {}, activeACPHash: {} });
+};
+var acpStore = {
+  store: _acpStore,
+  getACP,
+  getActiveACP,
+  getACPs,
+  setACP,
+  removeACP,
+  getActiveACPHash,
+  setActiveACPHash,
+  removeActiveACPHash,
+  resetStore
+};
+
+export { ACPScope, ACPUtils, ACP_REVOKER_ABI, ACP_SHARE_REGISTRY_ABI, ACP_SHARE_TUPLE_ABI, ACP_STORE_DEFAULTS, ERC7984_ABI, GenerateSealingKey, ImportACPOptionsValidator, ImportACPValidator, LAYOUT_VERSION, SelfACPOptionsValidator, SelfACPValidator, SharingACPOptionsValidator, SharingACPValidator, SignatureTypes, SignatureUtils, UNLABELLED, ValidationUtils, _acpStore, acpStore, addressNotZeroSchema, addressSchema, bytesNotEmptySchema, bytesSchema, clearAclServedAddresses, clearStaleStore, computeShareId, contractsSchema, decodeShareAppKey, decodeShareMetadata, decodeShareMetadataFull, describeShareLabels, describeShareMetadata, encodeShareMetadata, eventLogLabel, getACP, getACPs, getAclAddress, getAclServedAddresses, getActiveACP, getActiveACPHash, getSignatureTypesAndMessage, getTaskManagerAddress, handlesSchema, readPostedShares, readShare, readSharesFor, removeACP, removeActiveACPHash, resetStore, seal, setACP, setActiveACPHash, shareAppKey, shareIdOfChainShare, toChainShare, unsealWithPrivateKey, validateImportACP, validateImportACPOptions, validateSelfACP, validateSelfACPOptions, validateSharingACP, validateSharingACPOptions, verifyShareLabel, verifyShareLabels, viewFunctionLabel };