@cofhe/sdk 0.7.1 → 1.0.0-alpha.0

package/dist/{chunk-43USWPEH.js → chunk-OL3DZN7A.js}

@@ -1,391 +1,15 @@
-import { hardhat as hardhat$1 } from './chunk-N6IDQRRU.js';
-import { acpStore, ACPUtils } from './chunk-Q7CBWGQX.js';
-import { TFHE_RS_KEY_VERSION, TASK_MANAGER_ADDRESS, TFHE_RS_ZK_MAX_BITS, TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT, MOCKS_THRESHOLD_NETWORK_ADDRESS, MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY, MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY, MOCKS_ZK_VERIFIER_ADDRESS } from './chunk-ESMZCFJY.js';
+import { hardhat as hardhat$1 } from './chunk-UKQAJK4N.js';
+import { acpStore, clearAclServedAddresses, getAclServedAddresses, computeShareId, ACPUtils, getTaskManagerAddress, verifyShareLabels, decodeShareMetadata, shareAppKey, ACP_SHARE_REGISTRY_ABI, readShare, readSharesFor, toChainShare, ACP_REVOKER_ABI, decodeShareAppKey, encodeShareMetadata } from './chunk-BQWHPIYU.js';
+import { sleep, getPublicClientChainID, getWalletClientAccount, validateBigIntInRange, toBigIntOrThrow, hexToBytes, toHexString, FheUintUTypes } from './chunk-6ZW76ZKB.js';
+import { TFHE_RS_KEY_VERSION, CofheError, TFHE_RS_ZK_MAX_BITS, TFHE_RS_SAFE_SERIALIZATION_SIZE_LIMIT, MOCKS_THRESHOLD_NETWORK_ADDRESS, MOCKS_DECRYPT_RESULT_SIGNER_PRIVATE_KEY, MOCKS_ZK_VERIFIER_SIGNER_PRIVATE_KEY, MOCKS_ZK_VERIFIER_ADDRESS } from './chunk-XQ32JG3T.js';
 import { createStore } from 'zustand/vanilla';
-import { parseAbi, isAddressEqual, zeroAddress, recoverAddress, keccak256, encodeAbiParameters, encodePacked, createWalletClient, http, getAddress, parseSignature, serializeSignature } from 'viem';
+import { parseAbi, isAddressEqual, zeroAddress, recoverAddress, encodePacked, keccak256, createWalletClient, http, getAddress, parseSignature, serializeSignature } from 'viem';
 import { hardhat } from 'viem/chains';
 import { sign, privateKeyToAccount } from 'viem/accounts';
 import { z } from 'zod';
 import { persist, createJSONStorage } from 'zustand/middleware';
 import { produce } from 'immer';
 
-// core/error.ts
-var CofheErrorCode = /* @__PURE__ */ ((CofheErrorCode2) => {
-  CofheErrorCode2["InternalError"] = "INTERNAL_ERROR";
-  CofheErrorCode2["UnknownEnvironment"] = "UNKNOWN_ENVIRONMENT";
-  CofheErrorCode2["InitTfheFailed"] = "INIT_TFHE_FAILED";
-  CofheErrorCode2["InitViemFailed"] = "INIT_VIEM_FAILED";
-  CofheErrorCode2["InitEthersFailed"] = "INIT_ETHERS_FAILED";
-  CofheErrorCode2["NotConnected"] = "NOT_CONNECTED";
-  CofheErrorCode2["MissingPublicClient"] = "MISSING_PUBLIC_CLIENT";
-  CofheErrorCode2["MissingWalletClient"] = "MISSING_WALLET_CLIENT";
-  CofheErrorCode2["MissingProviderParam"] = "MISSING_PROVIDER_PARAM";
-  CofheErrorCode2["EmptySecurityZonesParam"] = "EMPTY_SECURITY_ZONES_PARAM";
-  CofheErrorCode2["InvalidACPData"] = "INVALID_ACP_DATA";
-  CofheErrorCode2["InvalidACPDomain"] = "INVALID_ACP_DOMAIN";
-  CofheErrorCode2["ACPNotFound"] = "ACP_NOT_FOUND";
-  CofheErrorCode2["CannotRemoveLastACP"] = "CANNOT_REMOVE_LAST_ACP";
-  CofheErrorCode2["AccountUninitialized"] = "ACCOUNT_UNINITIALIZED";
-  CofheErrorCode2["ChainIdUninitialized"] = "CHAIN_ID_UNINITIALIZED";
-  CofheErrorCode2["ConsumingContractUninitialized"] = "CONSUMING_CONTRACT_UNINITIALIZED";
-  CofheErrorCode2["SealOutputFailed"] = "SEAL_OUTPUT_FAILED";
-  CofheErrorCode2["SealOutputReturnedNull"] = "SEAL_OUTPUT_RETURNED_NULL";
-  CofheErrorCode2["InvalidUtype"] = "INVALID_UTYPE";
-  CofheErrorCode2["DecryptFailed"] = "DECRYPT_FAILED";
-  CofheErrorCode2["DecryptReturnedNull"] = "DECRYPT_RETURNED_NULL";
-  CofheErrorCode2["ZkMocksInsertCtHashesFailed"] = "ZK_MOCKS_INSERT_CT_HASHES_FAILED";
-  CofheErrorCode2["ZkMocksCalcCtHashesFailed"] = "ZK_MOCKS_CALC_CT_HASHES_FAILED";
-  CofheErrorCode2["ZkMocksVerifySignFailed"] = "ZK_MOCKS_VERIFY_SIGN_FAILED";
-  CofheErrorCode2["ZkMocksCreateProofSignatureFailed"] = "ZK_MOCKS_CREATE_PROOF_SIGNATURE_FAILED";
-  CofheErrorCode2["ZkVerifyFailed"] = "ZK_VERIFY_FAILED";
-  CofheErrorCode2["ZkPackFailed"] = "ZK_PACK_FAILED";
-  CofheErrorCode2["ZkProveFailed"] = "ZK_PROVE_FAILED";
-  CofheErrorCode2["EncryptRemainingInItems"] = "ENCRYPT_REMAINING_IN_ITEMS";
-  CofheErrorCode2["ZkUninitialized"] = "ZK_UNINITIALIZED";
-  CofheErrorCode2["ZkVerifierUrlUninitialized"] = "ZK_VERIFIER_URL_UNINITIALIZED";
-  CofheErrorCode2["ThresholdNetworkUrlUninitialized"] = "THRESHOLD_NETWORK_URL_UNINITIALIZED";
-  CofheErrorCode2["MissingConfig"] = "MISSING_CONFIG";
-  CofheErrorCode2["UnsupportedChain"] = "UNSUPPORTED_CHAIN";
-  CofheErrorCode2["MissingZkBuilderAndCrsGenerator"] = "MISSING_ZK_BUILDER_AND_CRS_GENERATOR";
-  CofheErrorCode2["MissingTfhePublicKeyDeserializer"] = "MISSING_TFHE_PUBLIC_KEY_DESERIALIZER";
-  CofheErrorCode2["MissingCompactPkeCrsDeserializer"] = "MISSING_COMPACT_PKE_CRS_DESERIALIZER";
-  CofheErrorCode2["MissingFheKey"] = "MISSING_FHE_KEY";
-  CofheErrorCode2["MissingCrs"] = "MISSING_CRS";
-  CofheErrorCode2["FetchKeysFailed"] = "FETCH_KEYS_FAILED";
-  CofheErrorCode2["PublicWalletGetChainIdFailed"] = "PUBLIC_WALLET_GET_CHAIN_ID_FAILED";
-  CofheErrorCode2["PublicWalletGetAddressesFailed"] = "PUBLIC_WALLET_GET_ADDRESSES_FAILED";
-  CofheErrorCode2["RehydrateKeysStoreFailed"] = "REHYDRATE_KEYS_STORE_FAILED";
-  CofheErrorCode2["BadRequest"] = "BAD_REQUEST";
-  CofheErrorCode2["UnknownChain"] = "UNKNOWN_CHAIN";
-  CofheErrorCode2["ACPMalformed"] = "ACP_MALFORMED";
-  CofheErrorCode2["ACPDenied"] = "ACP_DENIED";
-  CofheErrorCode2["ACPExpired"] = "ACP_EXPIRED";
-  CofheErrorCode2["ACPInvalid"] = "ACP_INVALID";
-  CofheErrorCode2["ACPRevoked"] = "ACP_REVOKED";
-  CofheErrorCode2["NotPubliclyAllowed"] = "NOT_PUBLICLY_ALLOWED";
-  CofheErrorCode2["CtNotFound"] = "CT_NOT_FOUND";
-  CofheErrorCode2["UnsupportedSecurityZone"] = "UNSUPPORTED_SECURITY_ZONE";
-  CofheErrorCode2["UnsupportedType"] = "UNSUPPORTED_TYPE";
-  CofheErrorCode2["SigningFailed"] = "SIGNING_FAILED";
-  CofheErrorCode2["CtSourceError"] = "CT_SOURCE_ERROR";
-  CofheErrorCode2["ACPVerifierError"] = "ACP_VERIFIER_ERROR";
-  CofheErrorCode2["CtSourceTimeout"] = "CT_SOURCE_TIMEOUT";
-  CofheErrorCode2["ACPVerifierTimeout"] = "ACP_VERIFIER_TIMEOUT";
-  CofheErrorCode2["ACPRequired"] = "ACP_REQUIRED";
-  CofheErrorCode2["SealFailed"] = "SEAL_FAILED";
-  return CofheErrorCode2;
-})(CofheErrorCode || {});
-var CofheError = class _CofheError extends Error {
-  code;
-  cause;
-  hint;
-  context;
-  apiErrorCode;
-  constructor({ code, message, cause, hint, context, apiErrorCode }) {
-    const fullMessage = cause ? `${message} | Caused by: ${cause.message}` : message;
-    super(fullMessage);
-    this.name = "CofheError";
-    this.code = code;
-    this.cause = cause;
-    this.hint = hint;
-    this.context = context;
-    this.apiErrorCode = apiErrorCode;
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, _CofheError);
-    }
-  }
-  /**
-   * Creates a CofheError from an unknown error
-   * If the error is a CofheError, it is returned unchanged, else a new CofheError is created
-   * If a wrapperError is provided, it is used to create the new CofheError, else a default is used
-   */
-  static fromError(error, wrapperError) {
-    if (isCofheError(error))
-      return error;
-    const cause = error instanceof Error ? error : new Error(`${error}`);
-    return new _CofheError({
-      code: wrapperError?.code ?? "INTERNAL_ERROR" /* InternalError */,
-      message: wrapperError?.message ?? "An internal error occurred",
-      hint: wrapperError?.hint,
-      context: wrapperError?.context,
-      apiErrorCode: wrapperError?.apiErrorCode,
-      cause
-    });
-  }
-  /**
-   * Serializes the error to JSON string with proper handling of Error objects
-   */
-  serialize() {
-    return bigintSafeJsonStringify({
-      name: this.name,
-      code: this.code,
-      message: this.message,
-      hint: this.hint,
-      context: this.context,
-      apiErrorCode: this.apiErrorCode,
-      cause: this.cause ? {
-        name: this.cause.name,
-        message: this.cause.message,
-        stack: this.cause.stack
-      } : void 0,
-      stack: this.stack
-    });
-  }
-  /**
-   * Returns a human-readable string representation of the error
-   */
-  toString() {
-    const codeSuffix = this.apiErrorCode ? ` (api: ${this.apiErrorCode})` : "";
-    const parts = [`${this.name} [${this.code}]${codeSuffix}: ${this.message}`];
-    if (this.hint) {
-      parts.push(`Hint: ${this.hint}`);
-    }
-    if (this.context && Object.keys(this.context).length > 0) {
-      parts.push(`Context: ${bigintSafeJsonStringify(this.context)}`);
-    }
-    if (this.stack) {
-      parts.push(`
-Stack trace:`);
-      parts.push(this.stack);
-    }
-    if (this.cause) {
-      parts.push(`
-Caused by: ${this.cause.name}: ${this.cause.message}`);
-      if (this.cause.stack) {
-        parts.push(this.cause.stack);
-      }
-    }
-    return parts.join("\n");
-  }
-};
-var bigintSafeJsonStringify = (value) => {
-  return JSON.stringify(value, (key, value2) => {
-    if (typeof value2 === "bigint") {
-      return `${value2}n`;
-    }
-    return value2;
-  });
-};
-var isCofheError = (error) => error instanceof CofheError;
-
-// core/types.ts
-var FheTypes = /* @__PURE__ */ ((FheTypes2) => {
-  FheTypes2[FheTypes2["Bool"] = 0] = "Bool";
-  FheTypes2[FheTypes2["Uint4"] = 1] = "Uint4";
-  FheTypes2[FheTypes2["Uint8"] = 2] = "Uint8";
-  FheTypes2[FheTypes2["Uint16"] = 3] = "Uint16";
-  FheTypes2[FheTypes2["Uint32"] = 4] = "Uint32";
-  FheTypes2[FheTypes2["Uint64"] = 5] = "Uint64";
-  FheTypes2[FheTypes2["Uint128"] = 6] = "Uint128";
-  FheTypes2[FheTypes2["Uint160"] = 7] = "Uint160";
-  FheTypes2[FheTypes2["Uint256"] = 8] = "Uint256";
-  FheTypes2[FheTypes2["Uint512"] = 9] = "Uint512";
-  FheTypes2[FheTypes2["Uint1024"] = 10] = "Uint1024";
-  FheTypes2[FheTypes2["Uint2048"] = 11] = "Uint2048";
-  FheTypes2[FheTypes2["Uint2"] = 12] = "Uint2";
-  FheTypes2[FheTypes2["Uint6"] = 13] = "Uint6";
-  FheTypes2[FheTypes2["Uint10"] = 14] = "Uint10";
-  FheTypes2[FheTypes2["Uint12"] = 15] = "Uint12";
-  FheTypes2[FheTypes2["Uint14"] = 16] = "Uint14";
-  FheTypes2[FheTypes2["Int2"] = 17] = "Int2";
-  FheTypes2[FheTypes2["Int4"] = 18] = "Int4";
-  FheTypes2[FheTypes2["Int6"] = 19] = "Int6";
-  FheTypes2[FheTypes2["Int8"] = 20] = "Int8";
-  FheTypes2[FheTypes2["Int10"] = 21] = "Int10";
-  FheTypes2[FheTypes2["Int12"] = 22] = "Int12";
-  FheTypes2[FheTypes2["Int14"] = 23] = "Int14";
-  FheTypes2[FheTypes2["Int16"] = 24] = "Int16";
-  FheTypes2[FheTypes2["Int32"] = 25] = "Int32";
-  FheTypes2[FheTypes2["Int64"] = 26] = "Int64";
-  FheTypes2[FheTypes2["Int128"] = 27] = "Int128";
-  FheTypes2[FheTypes2["Int160"] = 28] = "Int160";
-  FheTypes2[FheTypes2["Int256"] = 29] = "Int256";
-  return FheTypes2;
-})(FheTypes || {});
-var FheUintUTypes = [
-  2 /* Uint8 */,
-  3 /* Uint16 */,
-  4 /* Uint32 */,
-  5 /* Uint64 */,
-  6 /* Uint128 */
-  // [U256-DISABLED]
-  // FheTypes.Uint256,
-];
-var FheAllUTypes = [
-  0 /* Bool */,
-  2 /* Uint8 */,
-  3 /* Uint16 */,
-  4 /* Uint32 */,
-  5 /* Uint64 */,
-  6 /* Uint128 */,
-  // [U256-DISABLED]
-  // FheTypes.Uint256,
-  7 /* Uint160 */
-];
-var EncryptableFactoriesImpl = {
-  bool: (data, securityZone = 0) => ({ data, securityZone, utype: 0 /* Bool */ }),
-  address: (data, securityZone = 0) => ({ data, securityZone, utype: 7 /* Uint160 */ }),
-  uint8: (data, securityZone = 0) => ({ data, securityZone, utype: 2 /* Uint8 */ }),
-  uint16: (data, securityZone = 0) => ({ data, securityZone, utype: 3 /* Uint16 */ }),
-  uint32: (data, securityZone = 0) => ({ data, securityZone, utype: 4 /* Uint32 */ }),
-  uint64: (data, securityZone = 0) => ({ data, securityZone, utype: 5 /* Uint64 */ }),
-  uint128: (data, securityZone = 0) => ({ data, securityZone, utype: 6 /* Uint128 */ })
-  // [U256-DISABLED]
-  // uint256: (data: EncryptableUint256['data'], securityZone = 0) =>
-  //   ({ data, securityZone, utype: FheTypes.Uint256 }) as EncryptableUint256,
-};
-function createEncryptableByLiteral(type, data, securityZone = 0) {
-  switch (type) {
-    case "bool": {
-      if (typeof data !== "boolean")
-        throw new Error("Bool encryptable data must be boolean");
-      return EncryptableFactoriesImpl.bool(data, securityZone);
-    }
-    case "address":
-    case "uint8":
-    case "uint16":
-    case "uint32":
-    case "uint64":
-    case "uint128": {
-      if (typeof data === "boolean")
-        throw new Error("Uint encryptable data must be string or bigint");
-      return EncryptableFactoriesImpl[type](data, securityZone);
-    }
-    default: {
-      const _exhaustive = type;
-      throw new Error(`Unsupported encryptable type: ${_exhaustive}`);
-    }
-  }
-}
-var Encryptable = {
-  ...EncryptableFactoriesImpl,
-  create: createEncryptableByLiteral
-};
-function isEncryptableItem(value) {
-  return (
-    // Is object and exists
-    typeof value === "object" && value !== null && // Has securityZone
-    "securityZone" in value && typeof value.securityZone === "number" && // Has utype
-    "utype" in value && FheAllUTypes.includes(value.utype) && // Has data
-    "data" in value && ["string", "number", "bigint", "boolean"].includes(typeof value.data)
-  );
-}
-var EncryptStep = /* @__PURE__ */ ((EncryptStep2) => {
-  EncryptStep2["InitTfhe"] = "initTfhe";
-  EncryptStep2["FetchKeys"] = "fetchKeys";
-  EncryptStep2["Pack"] = "pack";
-  EncryptStep2["Prove"] = "prove";
-  EncryptStep2["Verify"] = "verify";
-  return EncryptStep2;
-})(EncryptStep || {});
-function isLastEncryptionStep(step) {
-  return step === "verify" /* Verify */;
-}
-var toHexString = (bytes) => bytes.reduce((str, byte) => str + byte.toString(16).padStart(2, "0"), "");
-var toBigIntOrThrow = (value) => {
-  if (typeof value === "bigint") {
-    return value;
-  }
-  try {
-    return BigInt(value);
-  } catch (error) {
-    throw new Error("Invalid input: Unable to convert to bigint");
-  }
-};
-var validateBigIntInRange = (value, max, min = 0n) => {
-  if (typeof value !== "bigint") {
-    throw new Error("Value must be of type bigint");
-  }
-  if (value > max || value < min) {
-    throw new Error(`Value out of range: ${max} - ${min}, try a different uint type`);
-  }
-};
-var hexToBytes = (hex) => {
-  const bytes = new Uint8Array(hex.length / 2);
-  for (let i = 0; i < hex.length; i += 2) {
-    bytes[i / 2] = parseInt(hex.substr(i, 2), 16);
-  }
-  return bytes;
-};
-var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
-async function getPublicClientChainID(publicClient) {
-  let chainId = null;
-  try {
-    chainId = publicClient.chain?.id ?? await publicClient.getChainId();
-  } catch (e) {
-    throw new CofheError({
-      code: "PUBLIC_WALLET_GET_CHAIN_ID_FAILED" /* PublicWalletGetChainIdFailed */,
-      message: "getting chain ID from public client failed",
-      cause: e instanceof Error ? e : void 0
-    });
-  }
-  if (chainId === null) {
-    throw new CofheError({
-      code: "PUBLIC_WALLET_GET_CHAIN_ID_FAILED" /* PublicWalletGetChainIdFailed */,
-      message: "chain ID from public client is null"
-    });
-  }
-  return chainId;
-}
-async function getWalletClientAccount(walletClient) {
-  let address;
-  try {
-    address = walletClient.account?.address;
-    if (!address) {
-      address = (await walletClient.getAddresses())?.[0];
-    }
-  } catch (e) {
-    throw new CofheError({
-      code: "PUBLIC_WALLET_GET_ADDRESSES_FAILED" /* PublicWalletGetAddressesFailed */,
-      message: "getting address from wallet client failed",
-      cause: e instanceof Error ? e : void 0
-    });
-  }
-  if (!address) {
-    throw new CofheError({
-      code: "PUBLIC_WALLET_GET_ADDRESSES_FAILED" /* PublicWalletGetAddressesFailed */,
-      message: "address from wallet client is null"
-    });
-  }
-  return address;
-}
-function fheTypeToString(utype) {
-  switch (utype) {
-    case 0 /* Bool */:
-      return "bool";
-    case 1 /* Uint4 */:
-      return "uint4";
-    case 2 /* Uint8 */:
-      return "uint8";
-    case 3 /* Uint16 */:
-      return "uint16";
-    case 4 /* Uint32 */:
-      return "uint32";
-    case 5 /* Uint64 */:
-      return "uint64";
-    case 6 /* Uint128 */:
-      return "uint128";
-    case 7 /* Uint160 */:
-      return "uint160";
-    case 8 /* Uint256 */:
-      return "uint256";
-    case 9 /* Uint512 */:
-      return "uint512";
-    case 10 /* Uint1024 */:
-      return "uint1024";
-    case 11 /* Uint2048 */:
-      return "uint2048";
-    case 12 /* Uint2 */:
-      return "uint2";
-    case 13 /* Uint6 */:
-      return "uint6";
-    case 14 /* Uint10 */:
-      return "uint10";
-    default:
-      throw new Error(`Unknown FheType: ${utype}`);
-  }
-}
-
 // core/encrypt/zkPackProveVerify.ts
 var MAX_UINT8 = 255n;
 var MAX_UINT16 = 65535n;
@@ -674,26 +298,32 @@ async function cofheMocksCheckEncryptableBits(items) {
         break;
       }
       case 2 /* Uint8 */: {
+        validateBigIntInRange(toBigIntOrThrow(item.data), MAX_UINT8);
         totalBits += 8;
         break;
       }
       case 3 /* Uint16 */: {
+        validateBigIntInRange(toBigIntOrThrow(item.data), MAX_UINT16);
         totalBits += 16;
         break;
       }
       case 4 /* Uint32 */: {
+        validateBigIntInRange(toBigIntOrThrow(item.data), MAX_UINT32);
         totalBits += 32;
         break;
       }
       case 5 /* Uint64 */: {
+        validateBigIntInRange(toBigIntOrThrow(item.data), MAX_UINT64);
         totalBits += 64;
         break;
       }
       case 6 /* Uint128 */: {
+        validateBigIntInRange(toBigIntOrThrow(item.data), MAX_UINT128);
         totalBits += 128;
         break;
       }
       case 7 /* Uint160 */: {
+        validateBigIntInRange(toBigIntOrThrow(item.data), MAX_UINT160);
         totalBits += 160;
         break;
       }
@@ -862,11 +492,14 @@ var CofheConfigSchema = z.object({
   }).or(z.null()).default(null),
   /** Whether to use Web Workers for ZK proof generation (web platform only) */
   useWorkers: z.boolean().optional().default(true),
+  /** How many threads tfhe's rayon pool may use for ZK proof generation (web platform only) */
+  tfheThreads: z.union([z.number().int().positive(), z.literal("auto"), z.literal(false)]).optional().default("auto"),
   /** ACP acp defaults */
   acp: z.object({
     defaultRevoker: z.custom().optional(),
     defaultContractScopes: z.custom().optional(),
-    sharingRegistry: z.custom().optional()
+    sharingRegistry: z.custom().optional(),
+    app: z.string().min(1).optional()
   }).optional().default({}),
   /** Mocks configs */
   mocks: z.object({
@@ -970,6 +603,9 @@ var DEFAULT_KEYS_STORE = {
   fhe: {},
   crs: {}
 };
+function isSecurityZoneRecord(value) {
+  return value != null && typeof value === "object";
+}
 function isStoreWithPersist(store) {
   return "persist" in store;
 }
@@ -984,10 +620,10 @@ function createKeysStore(storage) {
     const stored = keysStore.getState().fhe[chainId]?.[securityZone];
     return stored;
   };
-  const getCrs = (chainId) => {
-    if (chainId == null)
+  const getCrs = (chainId, securityZone = 0) => {
+    if (chainId == null || securityZone == null)
       return void 0;
-    const stored = keysStore.getState().crs[chainId];
+    const stored = keysStore.getState().crs[chainId]?.[securityZone];
     return stored;
   };
   const setFheKey = (chainId, securityZone, key) => {
@@ -999,10 +635,12 @@ function createKeysStore(storage) {
       })
     );
   };
-  const setCrs = (chainId, crs) => {
+  const setCrs = (chainId, securityZone, crs) => {
     keysStore.setState(
       produce((state) => {
-        state.crs[chainId] = crs;
+        if (state.crs[chainId] == null)
+          state.crs[chainId] = {};
+        state.crs[chainId][securityZone] = crs;
       })
     );
   };
@@ -1050,7 +688,13 @@ function createStoreWithPersit(storage) {
           const currentZones = current.fhe[chainId] || {};
           mergedFhe[chainId] = { ...persistedZones, ...currentZones };
         }
-        const mergedCrs = { ...persisted.crs, ...current.crs };
+        const mergedCrs = {};
+        const allCrsChainIds = /* @__PURE__ */ new Set([...Object.keys(current.crs), ...Object.keys(persisted.crs)]);
+        for (const chainId of allCrsChainIds) {
+          const persistedZones = isSecurityZoneRecord(persisted.crs[chainId]) ? persisted.crs[chainId] : {};
+          const currentZones = isSecurityZoneRecord(current.crs[chainId]) ? current.crs[chainId] : {};
+          mergedCrs[chainId] = { ...persistedZones, ...currentZones };
+        }
         return {
           fhe: mergedFhe,
           crs: mergedCrs
@@ -1112,7 +756,7 @@ var fetchFhePublicKey = async (coFheUrl, chainId, securityZone, tfhePublicKeyDes
   return [pk_data, true];
 };
 var fetchCrs = async (coFheUrl, chainId, securityZone, compactPkeCrsDeserializer, keysStorage) => {
-  const storedKey = keysStorage?.getCrs(chainId);
+  const storedKey = keysStorage?.getCrs(chainId, securityZone);
   const [storedKeyValid] = checkKeyValidity(storedKey, compactPkeCrsDeserializer);
   if (storedKeyValid)
     return [storedKey, false];
@@ -1139,7 +783,7 @@ var fetchCrs = async (coFheUrl, chainId, securityZone, compactPkeCrsDeserializer
     console.error(`Error serializing CRS ${err}`);
     throw new Error(`Error serializing CRS; ${err}`);
   }
-  keysStorage?.setCrs(chainId, crs_data);
+  keysStorage?.setCrs(chainId, securityZone, crs_data);
   return [crs_data, true];
 };
 var fetchKeys = async (config, chainId, securityZone = 0, tfhePublicKeyDeserializer, compactPkeCrsDeserializer, keysStorage) => {
@@ -1251,6 +895,7 @@ var EncryptInputsBuilder = class extends BaseBuilder {
   zkBuilderAndCrsGenerator;
   initTfhe;
   zkProveWorkerFn;
+  beforeMainThreadProve;
   keysStorage;
   // Worker configuration (from config, overrideable)
   useWorker;
@@ -1308,6 +953,7 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     this.zkBuilderAndCrsGenerator = params.zkBuilderAndCrsGenerator;
     this.initTfhe = params.initTfhe;
     this.zkProveWorkerFn = params.zkProveWorkerFn;
+    this.beforeMainThreadProve = params.beforeMainThreadProve;
     this.keysStorage = params.keysStorage;
     this.useWorker = params.config?.useWorkers ?? true;
   }
@@ -1598,6 +1244,7 @@ var EncryptInputsBuilder = class extends BaseBuilder {
       }
     }
     if (proof == null) {
+      await this.beforeMainThreadProve?.();
       proof = await zkProve(zkBuilder, zkCrs, metadata);
       usedWorker = false;
     }
@@ -1655,11 +1302,6 @@ var EncryptInputsBuilder = class extends BaseBuilder {
     return this.buildBatchResult(result);
   }
 };
-var ACP_VALIDATOR_ABI = parseAbi([
-  "function revokeSingle(uint256 id)",
-  "function revokeAllExisting()",
-  "function disabled(address issuer, uint256 id) view returns (bool)"
-]);
 var storeACP = async (acp, publicClient, walletClient) => {
   const chainId = await publicClient.getChainId();
   const account = walletClient.account.address;
@@ -1686,8 +1328,14 @@ var createSelf = async (options, publicClient, walletClient) => {
 var createSharing = async (options, publicClient, walletClient) => {
   return createACPWithSign(options, publicClient, walletClient, ACPUtils.createSharingAndSign, false);
 };
-var importShared = async (options, publicClient, walletClient) => {
-  return createACPWithSign(options, publicClient, walletClient, ACPUtils.importSharedAndSign);
+var importShared = async (options, publicClient, walletClient, { activate = true, name } = {}) => {
+  return createACPWithSign(
+    options,
+    publicClient,
+    walletClient,
+    (o, pc, wc) => ACPUtils.importSharedAndSign(o, pc, wc, { name }),
+    activate
+  );
 };
 var getHash = (acp) => {
   return ACPUtils.getHash(acp);
@@ -1734,13 +1382,15 @@ var getOrCreateSharingACP = async (publicClient, walletClient, options, chainId,
   }
   return createSharing(options, publicClient, walletClient);
 };
-var applyACPDefaults = (options, acpConfig, chainId) => {
+var applyACPDefaultsFromChain = async (options, acpConfig, publicClient, chainId) => {
   const result = { ...options };
-  const defaultRevoker = acpConfig?.defaultRevoker?.[chainId];
-  const hasValidatorOptions = options.revokerData != null || options.revokerContract != null;
-  if (defaultRevoker != null && !hasValidatorOptions) {
-    result.revokerContract = defaultRevoker;
-    result.revokerData = Math.round(Date.now() / 1e3) - 60;
+  const hasRevokerOptions = options.revokerData != null || options.revokerContract != null;
+  if (!hasRevokerOptions) {
+    const defaultRevoker = acpConfig?.defaultRevoker?.[chainId] ?? (await getAclServedAddresses(publicClient, chainId)).defaultRevoker;
+    if (defaultRevoker != null) {
+      result.revokerContract = defaultRevoker;
+      result.revokerData = await getBlockRevokerData(publicClient);
+    }
   }
   const defaultContracts = acpConfig?.defaultContractScopes?.[chainId];
   const hasScopeOptions = options.scope != null || options.contracts != null || options.handles != null;
@@ -1749,45 +1399,15 @@ var applyACPDefaults = (options, acpConfig, chainId) => {
   }
   return result;
 };
-var ACL_SERVED_ADDRESSES_ABI = parseAbi([
-  "function acl() view returns (address)",
-  "function defaultRevokerContract() view returns (address)",
-  "function shareRegistry() view returns (address)"
-]);
-var aclServedAddressesCache = /* @__PURE__ */ new Map();
-var clearAclServedAddresses = () => aclServedAddressesCache.clear();
-var getAclServedAddresses = async (publicClient, chainId) => {
-  const cached = aclServedAddressesCache.get(chainId);
-  if (cached != null)
-    return cached;
-  let aclAddress;
-  try {
-    aclAddress = await publicClient.readContract({
-      address: TASK_MANAGER_ADDRESS,
-      abi: ACL_SERVED_ADDRESSES_ABI,
-      functionName: "acl"
-    });
-  } catch {
-    return {};
+var getBlockRevokerData = async (publicClient) => {
+  const block = await publicClient.getBlock();
+  const revokerData = Number(block.timestamp);
+  if (!Number.isSafeInteger(revokerData)) {
+    throw new Error(
+      `ACP revokerData cannot represent the chain block timestamp ${block.timestamp.toString()} as a safe integer`
+    );
   }
-  const [defaultRevoker, shareRegistry] = await Promise.all([
-    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "defaultRevokerContract" }).catch(() => void 0),
-    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "shareRegistry" }).catch(() => void 0)
-  ]);
-  const resolved = {
-    defaultRevoker: defaultRevoker != null && defaultRevoker !== zeroAddress ? defaultRevoker : void 0,
-    shareRegistry: shareRegistry != null && shareRegistry !== zeroAddress ? shareRegistry : void 0
-  };
-  aclServedAddressesCache.set(chainId, resolved);
-  return resolved;
-};
-var applyACPDefaultsFromChain = async (options, acpConfig, publicClient, chainId) => {
-  const hasExplicitRevoker = acpConfig?.defaultRevoker?.[chainId] != null || options.revokerData != null || options.revokerContract != null;
-  if (hasExplicitRevoker)
-    return applyACPDefaults(options, acpConfig, chainId);
-  const served = await getAclServedAddresses(publicClient, chainId);
-  const effectiveConfig = served.defaultRevoker != null ? { ...acpConfig, defaultRevoker: { ...acpConfig?.defaultRevoker, [chainId]: served.defaultRevoker } } : acpConfig;
-  return applyACPDefaults(options, effectiveConfig, chainId);
+  return revokerData;
 };
 var revokeACP = async (acp, walletClient) => {
   if (acp.revokerContract === zeroAddress || acp.revokerData === 0) {
@@ -1800,7 +1420,7 @@ var revokeACP = async (acp, walletClient) => {
   }
   return walletClient.writeContract({
     address: acp.revokerContract,
-    abi: ACP_VALIDATOR_ABI,
+    abi: ACP_REVOKER_ABI,
     functionName: "revokeSingle",
     args: [BigInt(acp.revokerData)],
     account: walletClient.account,
@@ -1821,65 +1441,42 @@ var revokeAllACPs = async (walletClient, publicClient, revokerContract) => {
   }
   return walletClient.writeContract({
     address: revoker,
-    abi: ACP_VALIDATOR_ABI,
+    abi: ACP_REVOKER_ABI,
     functionName: "revokeAllExisting",
     args: [],
     account: walletClient.account,
     chain: walletClient.chain
   });
 };
+var checkAccess = async (acp, publicClient, handle) => {
+  if (acp.type === "sharing" && handle === void 0) {
+    if (ACPUtils.isExpired(acp))
+      return "expired";
+    return await isACPRevoked(acp, publicClient) ? "revoked" : "valid";
+  }
+  return ACPUtils.checkAccessOnChain(acp, publicClient, handle);
+};
 var isACPRevoked = async (acp, publicClient) => {
   if (acp.revokerContract === zeroAddress || acp.revokerData === 0)
     return false;
   return publicClient.readContract({
     address: acp.revokerContract,
-    abi: ACP_VALIDATOR_ABI,
+    abi: ACP_REVOKER_ABI,
     functionName: "disabled",
     args: [acp.issuer, BigInt(acp.revokerData)]
   });
 };
-var ACP_SHARE_REGISTRY_ABI = parseAbi([
-  "struct ACP { address issuer; uint64 expiration; address recipient; uint256 revokerData; address revokerContract; uint8 scope; address[] contracts; bytes32[] handles; bytes32 sealingKey; bytes issuerSignature; bytes recipientSignature; }",
-  "function share(ACP calldata acp) external returns (bytes32)",
-  "function removeShare(bytes32 shareId) external",
-  "function sharesFor(address recipient) external view returns (ACP[] memory)",
-  "function getShare(bytes32 shareId) external view returns (ACP memory)",
-  "function isShareValid(bytes32 shareId) external view returns (bool)"
-]);
-var ACP_TUPLE = [
-  {
-    type: "tuple",
-    components: [
-      { name: "issuer", type: "address" },
-      { name: "expiration", type: "uint64" },
-      { name: "recipient", type: "address" },
-      { name: "revokerData", type: "uint256" },
-      { name: "revokerContract", type: "address" },
-      { name: "scope", type: "uint8" },
-      { name: "contracts", type: "address[]" },
-      { name: "handles", type: "bytes32[]" },
-      { name: "sealingKey", type: "bytes32" },
-      { name: "issuerSignature", type: "bytes" },
-      { name: "recipientSignature", type: "bytes" }
-    ]
-  }
-];
-var ZERO_BYTES32 = `0x${"0".repeat(64)}`;
-var toChainShare = (acp) => {
-  const pub = ACPUtils.getPublic(acp, true);
-  return {
-    ...pub,
-    expiration: BigInt(pub.expiration),
-    revokerData: BigInt(pub.revokerData),
-    sealingKey: ZERO_BYTES32,
-    recipientSignature: "0x"
-  };
-};
-var computeShareId = (acp) => {
-  const p = toChainShare(acp);
-  return keccak256(encodeAbiParameters(ACP_TUPLE, [p]));
+var metadataOf = (acp, { labels, metadata, appKey }) => {
+  if (labels != null && metadata != null)
+    throw new Error("Pass either labels or metadata, not both");
+  if (labels == null)
+    return metadata ?? acp.metadata ?? "0x";
+  if (labels.length !== acp.handles.length) {
+    throw new Error(`Cannot label a share of ${acp.handles.length} handles with ${labels.length} labels`);
+  }
+  return encodeShareMetadata(labels, { issuer: acp.issuer, appKey });
 };
-var shareOnChain = async (acp, walletClient, registry) => {
+var shareOnChain = async (acp, walletClient, registry, options = {}) => {
   if (acp.type !== "sharing") {
     throw new Error(`Cannot share a '${acp.type}' ACP on-chain \u2014 only 'sharing' ACPs are shareable.`);
   }
@@ -1891,39 +1488,49 @@ var shareOnChain = async (acp, walletClient, registry) => {
   if (walletClient.account.address.toLowerCase() !== acp.issuer.toLowerCase()) {
     throw new Error("Only the ACP issuer can share it on-chain");
   }
+  const metadata = metadataOf(acp, options);
   const txHash = await walletClient.writeContract({
     address: registry,
     abi: ACP_SHARE_REGISTRY_ABI,
     functionName: "share",
-    args: [toChainShare(acp)],
+    args: [toChainShare(acp), metadata],
     account: walletClient.account,
     chain: walletClient.chain ?? null
   });
   return { txHash, shareId: computeShareId(acp) };
 };
-var getIncomingShares = async (publicClient, registry, recipient) => {
-  const raw = await publicClient.readContract({
-    address: registry,
-    abi: ACP_SHARE_REGISTRY_ABI,
-    functionName: "sharesFor",
-    args: [recipient]
-  });
-  return raw.map((s) => ({
-    shareId: keccak256(encodeAbiParameters(ACP_TUPLE, [s])),
-    issuer: s.issuer,
-    expiration: Number(s.expiration),
-    recipient: s.recipient,
-    revokerData: Number(s.revokerData),
-    revokerContract: s.revokerContract,
-    scope: Number(s.scope),
-    contracts: [...s.contracts],
-    handles: [...s.handles],
-    issuerSignature: s.issuerSignature
-  }));
+var toIncomingShare = ({ shareId, share: s, metadata }) => ({
+  shareId,
+  issuer: s.issuer,
+  expiration: Number(s.expiration),
+  recipient: s.recipient,
+  revokerData: Number(s.revokerData),
+  revokerContract: s.revokerContract,
+  scope: Number(s.scope),
+  contracts: [...s.contracts],
+  handles: [...s.handles],
+  issuerSignature: s.issuerSignature,
+  metadata,
+  ...appKeyOf(metadata, s.handles) && { appKey: appKeyOf(metadata, s.handles) }
+});
+var appKeyOf = (metadata, handles) => {
+  try {
+    return decodeShareAppKey(metadata, handles);
+  } catch {
+    return void 0;
+  }
+};
+var getIncomingShares = async (publicClient, registry, recipient, { appKey } = {}) => {
+  const shares = (await readSharesFor(publicClient, registry, recipient)).posted.map(toIncomingShare);
+  return appKey == null ? shares : shares.filter((share) => share.appKey === appKey);
 };
-var importFromChain = async (share, publicClient, walletClient) => {
-  const { shareId: _shareId, ...options } = share;
-  return importShared({ ...options, type: "sharing" }, publicClient, walletClient);
+var getShareFromChain = async (publicClient, registry, shareId) => {
+  const posted = await readShare(publicClient, registry, shareId);
+  return posted && toIncomingShare(posted);
+};
+var importFromChain = async (share, publicClient, walletClient, importOptions = {}) => {
+  const { shareId: _shareId, appKey: _appKey, ...options } = share;
+  return importShared({ ...options, type: "sharing" }, publicClient, walletClient, importOptions);
 };
 var removeShareOnChain = async (shareId, walletClient, registry) => {
   if (walletClient.account == null)
@@ -1961,12 +1568,13 @@ var acps = {
   revokeACP,
   revokeAllACPs,
   isACPRevoked,
+  checkAccess,
   shareOnChain,
   getIncomingShares,
+  getShareFromChain,
   importFromChain,
   removeShareOnChain,
   computeShareId,
-  applyACPDefaults,
   applyACPDefaultsFromChain,
   getAclServedAddresses,
   clearAclServedAddresses
@@ -2273,7 +1881,7 @@ var BACKEND_ERROR_CODE_TO_COFHE_ERROR_CODE = {
   seal_failed: "SEAL_FAILED" /* SealFailed */
 };
 function isBackendApiErrorCode(value) {
-  return value in BACKEND_ERROR_CODE_TO_COFHE_ERROR_CODE;
+  return Object.prototype.hasOwnProperty.call(BACKEND_ERROR_CODE_TO_COFHE_ERROR_CODE, value);
 }
 async function parseApiErrorResponseBody(response) {
   let errorMessage = `HTTP ${response.status}`;
@@ -3680,13 +3288,13 @@ var buildDecryptResultHash = (ctHash, cleartext, chainId) => {
 async function verifyDecryptResult(handle, cleartext, signature, publicClient) {
   const chainId = publicClient.chain?.id ?? await publicClient.getChainId();
   const expectedSigner = await publicClient.readContract({
-    address: TASK_MANAGER_ADDRESS,
+    address: await getTaskManagerAddress(publicClient, chainId),
     abi: decryptResultSignerAbi,
     functionName: "decryptResultSigner",
     args: []
   });
   if (isAddressEqual(expectedSigner, zeroAddress))
-    return true;
+    return false;
   const ctHash = BigInt(handle);
   const messageHash = buildDecryptResultHash(ctHash, cleartext, chainId);
   try {
@@ -3714,6 +3322,7 @@ function createCofheClientBase(opts) {
   const updateConnectState = (partial) => {
     connectStore.setState((state) => ({ ...state, ...partial }));
   };
+  const withAppKey = () => opts.config.acp?.app == null ? {} : { appKey: shareAppKey(opts.config.acp.app) };
   const _resolveSharingRegistry = async (publicClient, chainId) => {
     const configured = opts.config.acp?.sharingRegistry?.[chainId];
     if (configured != null)
@@ -3800,6 +3409,7 @@ function createCofheClientBase(opts) {
       zkBuilderAndCrsGenerator: opts.zkBuilderAndCrsGenerator,
       initTfhe: opts.initTfhe,
       zkProveWorkerFn: opts.zkProveWorkerFn,
+      beforeMainThreadProve: opts.beforeMainThreadProve,
       keysStorage,
       requireConnected: _requireConnected
     });
@@ -3871,15 +3481,16 @@ function createCofheClientBase(opts) {
       const { publicClient, walletClient } = clients ?? connectStore.getState();
       const chainId = await publicClient.getChainId();
       return acps.createSharing(
-        await acps.applyACPDefaultsFromChain(options, opts.config.acp, publicClient, chainId),
+        await acps.applyACPDefaultsFromChain({ ...withAppKey(), ...options }, opts.config.acp, publicClient, chainId),
         publicClient,
         walletClient
       );
     },
-    importShared: async (options, clients) => {
+    importShared: async (options, importOptions = {}) => {
       _requireConnected();
-      const { publicClient, walletClient } = clients ?? connectStore.getState();
-      return acps.importShared(options, publicClient, walletClient);
+      const { activate, name, ...clients } = importOptions;
+      const { publicClient, walletClient } = clients.publicClient ? clients : connectStore.getState();
+      return acps.importShared(options, publicClient, walletClient, { activate, name });
     },
     // Get or create methods (require connection)
     getOrCreateSelfACP: async (chainId, account, options) => {
@@ -3901,7 +3512,7 @@ function createCofheClientBase(opts) {
       return acps.getOrCreateSharingACP(
         publicClient,
         walletClient,
-        await acps.applyACPDefaultsFromChain(options, opts.config.acp, publicClient, _chainId),
+        await acps.applyACPDefaultsFromChain({ ...withAppKey(), ...options }, opts.config.acp, publicClient, _chainId),
         _chainId,
         _account
       );
@@ -3922,13 +3533,18 @@ function createCofheClientBase(opts) {
       const { publicClient } = connectStore.getState();
       return acps.isACPRevoked(acp, publicClient);
     },
+    checkAccess: async (acp, handle) => {
+      _requireConnected();
+      const { publicClient } = connectStore.getState();
+      return acps.checkAccess(acp, publicClient, handle);
+    },
     // On-chain sharing (require connection + config.acp.sharingRegistry)
-    shareOnChain: async (acp) => {
+    shareOnChain: async (acp, options) => {
       _requireConnected();
       const { publicClient, walletClient } = connectStore.getState();
       const chainId = await publicClient.getChainId();
       const sharingRegistry = await _resolveSharingRegistry(publicClient, chainId);
-      return acps.shareOnChain(acp, walletClient, sharingRegistry);
+      return acps.shareOnChain(acp, walletClient, sharingRegistry, { ...withAppKey(), ...options });
     },
     getIncomingShares: async () => {
       _requireConnected();
@@ -3936,12 +3552,32 @@ function createCofheClientBase(opts) {
       const chainId = await publicClient.getChainId();
       const account = walletClient.account.address;
       const sharingRegistry = await _resolveSharingRegistry(publicClient, chainId);
-      return acps.getIncomingShares(publicClient, sharingRegistry, account);
+      return acps.getIncomingShares(publicClient, sharingRegistry, account, withAppKey());
+    },
+    getShareFromChain: async (shareId) => {
+      _requireConnected();
+      const { publicClient } = connectStore.getState();
+      const chainId = await publicClient.getChainId();
+      const sharingRegistry = await _resolveSharingRegistry(publicClient, chainId);
+      return acps.getShareFromChain(publicClient, sharingRegistry, shareId);
+    },
+    verifyShareLabels: async (share, options) => {
+      _requireConnected();
+      const { publicClient } = connectStore.getState();
+      if (share.metadata == null || share.metadata === "0x")
+        return null;
+      return verifyShareLabels({
+        labels: decodeShareMetadata(share.metadata, share.handles),
+        handles: share.handles,
+        issuer: share.issuer,
+        publicClient,
+        verify: options?.verify
+      });
     },
-    importFromChain: async (share) => {
+    importFromChain: async (share, options) => {
       _requireConnected();
       const { publicClient, walletClient } = connectStore.getState();
-      return acps.importFromChain(share, publicClient, walletClient);
+      return acps.importFromChain(share, publicClient, walletClient, options);
     },
     dismissShare: async (shareId) => {
       _requireConnected();
@@ -4029,4 +3665,4 @@ function createCofheClientBase(opts) {
   };
 }
 
-export { CofheError, CofheErrorCode, DecryptForTxBuilder, DecryptForViewBuilder, EncryptInputsBuilder, EncryptStep, Encryptable, FheAllUTypes, FheTypes, FheUintUTypes, InitialConnectStore, assertNoRenamedConfigKeys, cofheFetch, createCofheClientBase, createCofheConfigBase, createKeysStore, fetchKeys, fheTypeToString, getCofheConfigItem, getCofheDebugInterceptors, isCofheError, isEncryptableItem, isLastEncryptionStep, setCofheDebugInterceptors, verifyDecryptResult, zkProveWithWorker };
+export { DecryptForTxBuilder, DecryptForViewBuilder, EncryptInputsBuilder, InitialConnectStore, assertNoRenamedConfigKeys, cofheFetch, createCofheClientBase, createCofheConfigBase, createKeysStore, fetchKeys, getCofheConfigItem, getCofheDebugInterceptors, setCofheDebugInterceptors, verifyDecryptResult, zkProveWithWorker };