@cofhe/sdk 0.8.0 → 1.0.0

package/dist/{chunk-UJYOBHYA.js → chunk-3L2IVPMI.js}

@@ -1,5 +1,5 @@
-import { TASK_MANAGER_ID, COFHE_ADDRESS_BOOK_ADDRESS } from './chunk-NMKMCAI3.js';
-import { isAddress, getAddress, zeroAddress, isHex, parseAbi, keccak256, toHex, encodeAbiParameters, decodeErrorResult } from 'viem';
+import { CofheError, TASK_MANAGER_ID, COFHE_ADDRESS_BOOK_ADDRESS } from './chunk-J23FYAI2.js';
+import { isAddress, getAddress, zeroAddress, isHex, parseAbi, keccak256, padHex, numberToHex, concatHex, toFunctionSelector, size, sliceHex, toHex, encodeAbiParameters, hexToBigInt, stringToHex, hexToNumber, toEventSignature, toFunctionSignature, decodeErrorResult, toEventSelector, decodeAbiParameters } from 'viem';
 import nacl from 'tweetnacl';
 import { z } from 'zod';
 import { createStore } from 'zustand/vanilla';
@@ -7,9 +7,14 @@ import { persist } from 'zustand/middleware';
 import { produce } from 'immer';
 
 // acps/utils.ts
+var HEX_BODY_REGEX = /^[0-9a-fA-F]*$/;
 var fromHexString = (hexString) => {
-  const cleanString = hexString.length % 2 === 1 ? `0${hexString}` : hexString;
-  const arr = cleanString.replace(/^0x/, "").match(/.{1,2}/g);
+  const body = hexString.replace(/^0x/, "");
+  if (!HEX_BODY_REGEX.test(body)) {
+    throw new Error("Invalid hex string: contains non-hexadecimal characters");
+  }
+  const padded = body.length % 2 === 1 ? `0${body}` : body;
+  const arr = padded.match(/.{1,2}/g);
   if (!arr)
     return new Uint8Array();
   return new Uint8Array(arr.map((byte) => parseInt(byte, 16)));
@@ -66,7 +71,7 @@ var GenerateSealingKey = () => {
 var seal = (value, publicKey) => {
   isString(publicKey);
   isBigIntOrNumber(value);
-  assertKeyLength(publicKey, "Public");
+  assertSealingKey(publicKey, "Public");
   const ephemeralKeyPair = nacl.box.keyPair();
   const nonce = nacl.randomBytes(nacl.box.nonceLength);
   const encryptedMessage = nacl.box(toBeArray(value), nonce, fromHexString(publicKey), ephemeralKeyPair.secretKey);
@@ -77,21 +82,40 @@ var seal = (value, publicKey) => {
   };
 };
 var unsealWithPrivateKey = (privateKey, parsedData) => {
-  assertKeyLength(privateKey, "Private");
+  assertSealingKey(privateKey, "Private");
   const nonce = parsedData.nonce instanceof Uint8Array ? parsedData.nonce : new Uint8Array(parsedData.nonce);
   const ephemPublicKey = parsedData.public_key instanceof Uint8Array ? parsedData.public_key : new Uint8Array(parsedData.public_key);
   const dataToDecrypt = parsedData.data instanceof Uint8Array ? parsedData.data : new Uint8Array(parsedData.data);
-  const decryptedMessage = nacl.box.open(dataToDecrypt, nonce, ephemPublicKey, fromHexString(privateKey));
+  let decryptedMessage;
+  let cause;
+  try {
+    decryptedMessage = nacl.box.open(dataToDecrypt, nonce, ephemPublicKey, fromHexString(privateKey));
+  } catch (e) {
+    decryptedMessage = null;
+    cause = e instanceof Error ? e : void 0;
+  }
   if (!decryptedMessage) {
-    throw new Error("Failed to decrypt message");
+    throw new CofheError({
+      code: "SEAL_OUTPUT_FAILED" /* SealOutputFailed */,
+      message: "Failed to unseal decrypt response",
+      cause,
+      context: {
+        dataLength: dataToDecrypt.length,
+        nonceLength: nonce.length,
+        publicKeyLength: ephemPublicKey.length
+      }
+    });
   }
   return toBigInt(decryptedMessage);
 };
-var assertKeyLength = (key, kind) => {
+var assertSealingKey = (key, kind) => {
   const bare = key.startsWith("0x") ? key.slice(2) : key;
   if (bare.length !== KEY_HEX_LENGTH) {
     throw new Error(`${kind} key must be of length ${KEY_HEX_LENGTH}`);
   }
+  if (!/^[0-9a-fA-F]+$/.test(bare)) {
+    throw new Error(`${kind} key must contain only hex characters`);
+  }
 };
 var ACPScope = {
   Global: 0,
@@ -144,7 +168,8 @@ var zACPWithDefaults = z.object({
   contracts: contractsSchema,
   handles: handlesSchema,
   issuerSignature: bytesSchema.optional().default("0x"),
-  recipientSignature: bytesSchema.optional().default("0x")
+  recipientSignature: bytesSchema.optional().default("0x"),
+  metadata: bytesSchema.optional()
 });
 var zACPWithSealingKeys = zACPWithDefaults.extend({
   /** X25519 private key, 0x-prefixed 32-byte hex; never leaves the client */
@@ -215,7 +240,6 @@ var ImportACPOptionsValidator = z.object({
   type: z.literal("recipient").optional().default("recipient"),
   issuer: addressNotZeroSchema,
   recipient: addressNotZeroSchema,
-  name: z.string().optional().default("Unnamed ACP"),
   expiration: z.int(),
   revokerData: z.int().optional().default(0),
   revokerContract: addressSchema.optional().default(zeroAddress),
@@ -223,7 +247,9 @@ var ImportACPOptionsValidator = z.object({
   contracts: contractsSchema,
   handles: handlesSchema,
   issuerSignature: bytesNotEmptySchema,
-  recipientSignature: bytesSchema.optional().default("0x")
+  recipientSignature: bytesSchema.optional().default("0x"),
+  /** The share metadata (labels blob); `0x` means none and is dropped */
+  metadata: bytesSchema.optional().transform((val) => val === "0x" ? void 0 : val)
 }).refine(...ExternalValidatorRefinement).transform(withDerivedScope).refine(...ScopeConsistencyRefinement);
 var ImportACPValidator = zACPWithSealingKeys.refine((data) => data.type === "recipient", {
   error: "Type must be 'recipient'"
@@ -389,168 +415,6 @@ var SignatureUtils = {
     throw new Error(`Unknown acp type: ${acpType}`);
   }
 };
-
-// core/error.ts
-var CofheErrorCode = /* @__PURE__ */ ((CofheErrorCode2) => {
-  CofheErrorCode2["InternalError"] = "INTERNAL_ERROR";
-  CofheErrorCode2["UnknownEnvironment"] = "UNKNOWN_ENVIRONMENT";
-  CofheErrorCode2["InitTfheFailed"] = "INIT_TFHE_FAILED";
-  CofheErrorCode2["InitViemFailed"] = "INIT_VIEM_FAILED";
-  CofheErrorCode2["InitEthersFailed"] = "INIT_ETHERS_FAILED";
-  CofheErrorCode2["NotConnected"] = "NOT_CONNECTED";
-  CofheErrorCode2["MissingPublicClient"] = "MISSING_PUBLIC_CLIENT";
-  CofheErrorCode2["MissingWalletClient"] = "MISSING_WALLET_CLIENT";
-  CofheErrorCode2["MissingProviderParam"] = "MISSING_PROVIDER_PARAM";
-  CofheErrorCode2["EmptySecurityZonesParam"] = "EMPTY_SECURITY_ZONES_PARAM";
-  CofheErrorCode2["InvalidACPData"] = "INVALID_ACP_DATA";
-  CofheErrorCode2["InvalidACPDomain"] = "INVALID_ACP_DOMAIN";
-  CofheErrorCode2["ACPNotFound"] = "ACP_NOT_FOUND";
-  CofheErrorCode2["CannotRemoveLastACP"] = "CANNOT_REMOVE_LAST_ACP";
-  CofheErrorCode2["AccountUninitialized"] = "ACCOUNT_UNINITIALIZED";
-  CofheErrorCode2["ChainIdUninitialized"] = "CHAIN_ID_UNINITIALIZED";
-  CofheErrorCode2["ConsumingContractUninitialized"] = "CONSUMING_CONTRACT_UNINITIALIZED";
-  CofheErrorCode2["SealOutputFailed"] = "SEAL_OUTPUT_FAILED";
-  CofheErrorCode2["SealOutputReturnedNull"] = "SEAL_OUTPUT_RETURNED_NULL";
-  CofheErrorCode2["InvalidUtype"] = "INVALID_UTYPE";
-  CofheErrorCode2["DecryptFailed"] = "DECRYPT_FAILED";
-  CofheErrorCode2["DecryptReturnedNull"] = "DECRYPT_RETURNED_NULL";
-  CofheErrorCode2["ZkMocksInsertCtHashesFailed"] = "ZK_MOCKS_INSERT_CT_HASHES_FAILED";
-  CofheErrorCode2["ZkMocksCalcCtHashesFailed"] = "ZK_MOCKS_CALC_CT_HASHES_FAILED";
-  CofheErrorCode2["ZkMocksVerifySignFailed"] = "ZK_MOCKS_VERIFY_SIGN_FAILED";
-  CofheErrorCode2["ZkMocksCreateProofSignatureFailed"] = "ZK_MOCKS_CREATE_PROOF_SIGNATURE_FAILED";
-  CofheErrorCode2["ZkVerifyFailed"] = "ZK_VERIFY_FAILED";
-  CofheErrorCode2["ZkPackFailed"] = "ZK_PACK_FAILED";
-  CofheErrorCode2["ZkProveFailed"] = "ZK_PROVE_FAILED";
-  CofheErrorCode2["EncryptRemainingInItems"] = "ENCRYPT_REMAINING_IN_ITEMS";
-  CofheErrorCode2["ZkUninitialized"] = "ZK_UNINITIALIZED";
-  CofheErrorCode2["ZkVerifierUrlUninitialized"] = "ZK_VERIFIER_URL_UNINITIALIZED";
-  CofheErrorCode2["ThresholdNetworkUrlUninitialized"] = "THRESHOLD_NETWORK_URL_UNINITIALIZED";
-  CofheErrorCode2["MissingConfig"] = "MISSING_CONFIG";
-  CofheErrorCode2["UnsupportedChain"] = "UNSUPPORTED_CHAIN";
-  CofheErrorCode2["MissingZkBuilderAndCrsGenerator"] = "MISSING_ZK_BUILDER_AND_CRS_GENERATOR";
-  CofheErrorCode2["MissingTfhePublicKeyDeserializer"] = "MISSING_TFHE_PUBLIC_KEY_DESERIALIZER";
-  CofheErrorCode2["MissingCompactPkeCrsDeserializer"] = "MISSING_COMPACT_PKE_CRS_DESERIALIZER";
-  CofheErrorCode2["MissingFheKey"] = "MISSING_FHE_KEY";
-  CofheErrorCode2["MissingCrs"] = "MISSING_CRS";
-  CofheErrorCode2["FetchKeysFailed"] = "FETCH_KEYS_FAILED";
-  CofheErrorCode2["PublicWalletGetChainIdFailed"] = "PUBLIC_WALLET_GET_CHAIN_ID_FAILED";
-  CofheErrorCode2["PublicWalletGetAddressesFailed"] = "PUBLIC_WALLET_GET_ADDRESSES_FAILED";
-  CofheErrorCode2["RehydrateKeysStoreFailed"] = "REHYDRATE_KEYS_STORE_FAILED";
-  CofheErrorCode2["TaskManagerUnresolved"] = "TASK_MANAGER_UNRESOLVED";
-  CofheErrorCode2["BadRequest"] = "BAD_REQUEST";
-  CofheErrorCode2["UnknownChain"] = "UNKNOWN_CHAIN";
-  CofheErrorCode2["ACPMalformed"] = "ACP_MALFORMED";
-  CofheErrorCode2["ACPDenied"] = "ACP_DENIED";
-  CofheErrorCode2["ACPExpired"] = "ACP_EXPIRED";
-  CofheErrorCode2["ACPInvalid"] = "ACP_INVALID";
-  CofheErrorCode2["ACPRevoked"] = "ACP_REVOKED";
-  CofheErrorCode2["NotPubliclyAllowed"] = "NOT_PUBLICLY_ALLOWED";
-  CofheErrorCode2["CtNotFound"] = "CT_NOT_FOUND";
-  CofheErrorCode2["UnsupportedSecurityZone"] = "UNSUPPORTED_SECURITY_ZONE";
-  CofheErrorCode2["UnsupportedType"] = "UNSUPPORTED_TYPE";
-  CofheErrorCode2["SigningFailed"] = "SIGNING_FAILED";
-  CofheErrorCode2["CtSourceError"] = "CT_SOURCE_ERROR";
-  CofheErrorCode2["ACPVerifierError"] = "ACP_VERIFIER_ERROR";
-  CofheErrorCode2["CtSourceTimeout"] = "CT_SOURCE_TIMEOUT";
-  CofheErrorCode2["ACPVerifierTimeout"] = "ACP_VERIFIER_TIMEOUT";
-  CofheErrorCode2["ACPRequired"] = "ACP_REQUIRED";
-  CofheErrorCode2["SealFailed"] = "SEAL_FAILED";
-  return CofheErrorCode2;
-})(CofheErrorCode || {});
-var CofheError = class _CofheError extends Error {
-  code;
-  cause;
-  hint;
-  context;
-  apiErrorCode;
-  constructor({ code, message, cause, hint, context, apiErrorCode }) {
-    const fullMessage = cause ? `${message} | Caused by: ${cause.message}` : message;
-    super(fullMessage);
-    this.name = "CofheError";
-    this.code = code;
-    this.cause = cause;
-    this.hint = hint;
-    this.context = context;
-    this.apiErrorCode = apiErrorCode;
-    if (Error.captureStackTrace) {
-      Error.captureStackTrace(this, _CofheError);
-    }
-  }
-  /**
-   * Creates a CofheError from an unknown error
-   * If the error is a CofheError, it is returned unchanged, else a new CofheError is created
-   * If a wrapperError is provided, it is used to create the new CofheError, else a default is used
-   */
-  static fromError(error, wrapperError) {
-    if (isCofheError(error))
-      return error;
-    const cause = error instanceof Error ? error : new Error(`${error}`);
-    return new _CofheError({
-      code: wrapperError?.code ?? "INTERNAL_ERROR" /* InternalError */,
-      message: wrapperError?.message ?? "An internal error occurred",
-      hint: wrapperError?.hint,
-      context: wrapperError?.context,
-      apiErrorCode: wrapperError?.apiErrorCode,
-      cause
-    });
-  }
-  /**
-   * Serializes the error to JSON string with proper handling of Error objects
-   */
-  serialize() {
-    return bigintSafeJsonStringify({
-      name: this.name,
-      code: this.code,
-      message: this.message,
-      hint: this.hint,
-      context: this.context,
-      apiErrorCode: this.apiErrorCode,
-      cause: this.cause ? {
-        name: this.cause.name,
-        message: this.cause.message,
-        stack: this.cause.stack
-      } : void 0,
-      stack: this.stack
-    });
-  }
-  /**
-   * Returns a human-readable string representation of the error
-   */
-  toString() {
-    const codeSuffix = this.apiErrorCode ? ` (api: ${this.apiErrorCode})` : "";
-    const parts = [`${this.name} [${this.code}]${codeSuffix}: ${this.message}`];
-    if (this.hint) {
-      parts.push(`Hint: ${this.hint}`);
-    }
-    if (this.context && Object.keys(this.context).length > 0) {
-      parts.push(`Context: ${bigintSafeJsonStringify(this.context)}`);
-    }
-    if (this.stack) {
-      parts.push(`
-Stack trace:`);
-      parts.push(this.stack);
-    }
-    if (this.cause) {
-      parts.push(`
-Caused by: ${this.cause.name}: ${this.cause.message}`);
-      if (this.cause.stack) {
-        parts.push(this.cause.stack);
-      }
-    }
-    return parts.join("\n");
-  }
-};
-var bigintSafeJsonStringify = (value) => {
-  return JSON.stringify(value, (key, value2) => {
-    if (typeof value2 === "bigint") {
-      return `${value2}n`;
-    }
-    return value2;
-  });
-};
-var isCofheError = (error) => error instanceof CofheError;
-
-// core/taskManager.ts
 var ADDRESS_BOOK_ABI = parseAbi([
   "function getTm(uint256 id) view returns (address)",
   "error TaskManagerNotSet(uint256 id)"
@@ -857,19 +721,229 @@ var getAclServedAddresses = async (publicClient, chainId) => {
   } catch {
     return {};
   }
+  let transient = false;
+  const readServedAddress = (functionName) => publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName }).catch((err) => {
+    if (revertErrorName(err, ACL_SERVED_ADDRESSES_ABI) === void 0)
+      transient = true;
+    return void 0;
+  });
   const [defaultRevoker, shareRegistry] = await Promise.all([
-    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "defaultRevokerContract" }).catch(() => void 0),
-    publicClient.readContract({ address: aclAddress, abi: ACL_SERVED_ADDRESSES_ABI, functionName: "shareRegistry" }).catch(() => void 0)
+    readServedAddress("defaultRevokerContract"),
+    readServedAddress("shareRegistry")
   ]);
   const resolved = {
     defaultRevoker: defaultRevoker != null && defaultRevoker !== zeroAddress ? defaultRevoker : void 0,
     shareRegistry: shareRegistry != null && shareRegistry !== zeroAddress ? shareRegistry : void 0
   };
-  aclServedAddressesCache.set(chainId, resolved);
+  if (!transient)
+    aclServedAddressesCache.set(chainId, resolved);
   return resolved;
 };
 
+// acps/share-metadata/layout.ts
+var LAYOUT_VERSION = 3;
+var ENTRY_KIND = {
+  stored: 0,
+  event: 1,
+  unlabelled: 255
+};
+var ARGS_CODE = {
+  none: 0,
+  issuer: 1,
+  explicit: 255
+};
+var ARG_TAG = {
+  word: 0,
+  issuer: 1
+};
+var APP_KEY_TAG = 1;
+var BYTE_WIDTH = {
+  version: 1,
+  /** Length of a list, and a position in it: at most 255 of each per share. */
+  count: 1,
+  index: 1,
+  address: 20,
+  selector: 4,
+  /** uint32: 4.29 billion blocks. */
+  block: 4,
+  /** uint16: the position of a transaction within its block. */
+  txIndex: 2,
+  /** uint16: the block-wide position of a log (a busy block passes 255 logs). */
+  logIndex: 2,
+  kind: 1,
+  argsCode: 1,
+  returnWord: 1,
+  argTag: 1,
+  word: 32
+};
+
+// acps/share-metadata/encode.ts
+var uint = (value, width) => numberToHex(value, { size: width });
+var BYTES_FIELD = {
+  contract: { width: BYTE_WIDTH.address, name: "a contract address" },
+  selector: { width: BYTE_WIDTH.selector, name: "a selector" },
+  viewCallArgument: { width: BYTE_WIDTH.word, name: "a view call argument" },
+  appKey: { width: BYTE_WIDTH.word, name: "an app key" }
+};
+var bytesField = (field, value) => {
+  const { width, name } = BYTES_FIELD[field];
+  if (!isHex(value, { strict: true }) || size(value) !== width) {
+    throw new Error(`share metadata: ${name} must be ${width} bytes`);
+  }
+  return value.toLowerCase();
+};
+var listOf = (keyOf, what) => {
+  const items = [];
+  const positions = /* @__PURE__ */ new Map();
+  const insert = (item) => {
+    const key = keyOf(item);
+    if (positions.has(key))
+      return;
+    positions.set(key, items.length);
+    items.push(item);
+  };
+  const positionOf = (item) => {
+    const position = positions.get(keyOf(item));
+    if (position === void 0)
+      throw new Error(`share metadata: ${what} ${keyOf(item)} was not collected`);
+    return position;
+  };
+  return { items, insert, positionOf };
+};
+var keyOfContract = (contract) => contract.toLowerCase();
+var keyOfSelector = (selector) => selector.toLowerCase();
+var keyOfTransaction = ({ block, txIndex }) => `${block}:${txIndex}`;
+var transactionOf = ({ block, txIndex }) => ({ block, txIndex });
+var encodeArg = (arg) => {
+  if (arg.type === "issuer")
+    return uint(ARG_TAG.issuer, BYTE_WIDTH.argTag);
+  return concatHex([uint(ARG_TAG.word, BYTE_WIDTH.argTag), bytesField("viewCallArgument", arg.value)]);
+};
+var issuerWordOf = (issuer) => issuer == null ? void 0 : padHex(issuer, { size: BYTE_WIDTH.word }).toLowerCase();
+var asIssuer = (arg, issuerWord) => arg.type === "word" && issuerWord != null && arg.value.toLowerCase() === issuerWord ? { type: "issuer" } : arg;
+var encodeArgs = ({ args: given, returnWord }, issuerWord) => {
+  const args = given.map((arg) => asIssuer(arg, issuerWord));
+  if (returnWord === 0 && args.length === 0)
+    return uint(ARGS_CODE.none, BYTE_WIDTH.argsCode);
+  if (returnWord === 0 && args.length === 1 && args[0].type === "issuer") {
+    return uint(ARGS_CODE.issuer, BYTE_WIDTH.argsCode);
+  }
+  return concatHex([
+    uint(ARGS_CODE.explicit, BYTE_WIDTH.argsCode),
+    uint(returnWord, BYTE_WIDTH.returnWord),
+    uint(args.length, BYTE_WIDTH.count),
+    ...args.map(encodeArg)
+  ]);
+};
+var encodeShareMetadata = (labels, { issuer, appKey } = {}) => {
+  const issuerWord = issuerWordOf(issuer);
+  const contracts = listOf(keyOfContract, "contract");
+  const selectors = listOf(keyOfSelector, "selector");
+  const transactions = listOf(keyOfTransaction, "transaction");
+  for (const label of labels) {
+    if (label.kind === "unlabelled")
+      continue;
+    contracts.insert(label.contract);
+    selectors.insert(label.selector);
+    if (label.kind === "event")
+      transactions.insert(transactionOf(label));
+  }
+  const entries = labels.map((label) => {
+    switch (label.kind) {
+      case "stored":
+        return concatHex([
+          uint(ENTRY_KIND.stored, BYTE_WIDTH.kind),
+          uint(contracts.positionOf(label.contract), BYTE_WIDTH.index),
+          uint(selectors.positionOf(label.selector), BYTE_WIDTH.index),
+          uint(label.block, BYTE_WIDTH.block),
+          encodeArgs(label, issuerWord)
+        ]);
+      case "event":
+        return concatHex([
+          uint(ENTRY_KIND.event, BYTE_WIDTH.kind),
+          uint(contracts.positionOf(label.contract), BYTE_WIDTH.index),
+          uint(transactions.positionOf(transactionOf(label)), BYTE_WIDTH.index),
+          uint(label.logIndex, BYTE_WIDTH.logIndex),
+          uint(selectors.positionOf(label.selector), BYTE_WIDTH.index)
+        ]);
+      case "unlabelled":
+        return uint(ENTRY_KIND.unlabelled, BYTE_WIDTH.kind);
+    }
+  });
+  return concatHex([
+    uint(LAYOUT_VERSION, BYTE_WIDTH.version),
+    uint(contracts.items.length, BYTE_WIDTH.count),
+    ...contracts.items.map((contract) => bytesField("contract", contract)),
+    uint(selectors.items.length, BYTE_WIDTH.count),
+    ...selectors.items.map((selector) => bytesField("selector", selector)),
+    uint(transactions.items.length, BYTE_WIDTH.count),
+    ...transactions.items.map(
+      (tx) => concatHex([uint(tx.block, BYTE_WIDTH.block), uint(tx.txIndex, BYTE_WIDTH.txIndex)])
+    ),
+    ...entries,
+    ...appKey == null ? [] : [uint(APP_KEY_TAG, BYTE_WIDTH.count), bytesField("appKey", appKey)]
+  ]);
+};
+var findViewFunction = (abi, name, arity) => {
+  const named = abi.filter((item) => item.type === "function" && item.name === name);
+  if (named.length === 0)
+    throw new Error(`share metadata: the ABI has no function ${name}`);
+  const fitting = named.filter((fn2) => fn2.inputs.length === arity);
+  if (fitting.length !== 1) {
+    throw new Error(
+      named.length === 1 ? `share metadata: ${name} takes ${named[0].inputs.length} arguments, ${arity} given` : `share metadata: no single overload of ${name} takes ${arity} arguments`
+    );
+  }
+  const [fn] = fitting;
+  if (fn.stateMutability !== "view" && fn.stateMutability !== "pure") {
+    throw new Error(`share metadata: ${name} is not a view function`);
+  }
+  return fn;
+};
+var encodeReadArg = (fn, index, value) => {
+  const input = fn.inputs[index];
+  const word = encodeAbiParameters([input], [value]);
+  if (size(word) !== BYTE_WIDTH.word) {
+    throw new Error(
+      `share metadata: argument ${index} of ${fn.name} is ${input.type}; only arguments of one static 32-byte word can be labelled`
+    );
+  }
+  return { type: "word", value: word };
+};
+var viewFunctionLabel = (options) => {
+  const { contract, block, returnWord = 0 } = options;
+  const values = options.args ?? [];
+  const fn = findViewFunction(options.abi, options.functionName, values.length);
+  return {
+    kind: "stored",
+    contract,
+    selector: toFunctionSelector(fn),
+    args: values.map((value, i) => encodeReadArg(fn, i, value)),
+    returnWord,
+    block
+  };
+};
+var eventLogLabel = (log) => {
+  const { address, blockNumber, transactionIndex, logIndex, topics } = log;
+  const topic0 = topics[0];
+  if (blockNumber == null || transactionIndex == null || logIndex == null) {
+    throw new Error("share metadata: a pending log has no position to label");
+  }
+  if (topic0 == null || size(topic0) !== 32)
+    throw new Error("share metadata: an anonymous log has no event selector");
+  return {
+    kind: "event",
+    contract: address,
+    block: blockNumber,
+    txIndex: transactionIndex,
+    logIndex,
+    selector: sliceHex(topic0, 0, 4)
+  };
+};
+var UNLABELLED = { kind: "unlabelled" };
+
 // acps/acp.ts
+var sharedByName = (issuer) => `Shared by ${issuer.slice(0, 6)}\u2026${issuer.slice(-4)}`;
 var ACPUtils = {
   /**
    * Create a self acp for personal use
@@ -891,10 +965,16 @@ var ACPUtils = {
    */
   createSharing: (options) => {
     const validation = validateSharingACPOptions(options);
+    const { labels, appKey } = options;
+    if (labels != null && labels.length !== validation.handles.length) {
+      throw new Error(`Cannot label a share of ${validation.handles.length} handles with ${labels.length} labels`);
+    }
+    const metadata = labels != null || appKey != null ? encodeShareMetadata(labels ?? validation.handles.map(() => UNLABELLED), { issuer: validation.issuer, appKey }) : void 0;
     const sealingPair = GenerateSealingKey();
     const acp = {
       hash: ACPUtils.getHash(validation),
       ...validation,
+      ...metadata != null && { metadata },
       sealingPrivateKey: sealingPair.privateKey,
       sealingKey: sealingPair.publicKey,
       _signedDomain: void 0
@@ -902,9 +982,10 @@ var ACPUtils = {
     return acp;
   },
   /**
-   * Import a shared acp from various input formats
+   * Import a shared acp from various input formats. The acp is named `name`, or after its issuer
+   * ("Shared by 0x1234…abcd"); a `name` in the share itself is ignored.
    */
-  importShared: (options) => {
+  importShared: (options, { name } = {}) => {
     let parsedOptions;
     if (typeof options === "string") {
       try {
@@ -925,6 +1006,7 @@ var ACPUtils = {
     const acp = {
       hash: ACPUtils.getHash(validation),
       ...validation,
+      name: name?.trim() || sharedByName(validation.issuer),
       sealingPrivateKey: sealingPair.privateKey,
       sealingKey: sealingPair.publicKey,
       _signedDomain: void 0
@@ -983,8 +1065,8 @@ var ACPUtils = {
   /**
    * Import and sign a shared acp in one operation from various input formats
    */
-  importSharedAndSign: async (options, publicClient, walletClient) => {
-    const acp = ACPUtils.importShared(options);
+  importSharedAndSign: async (options, publicClient, walletClient, importOptions = {}) => {
+    const acp = ACPUtils.importShared(options, importOptions);
     return ACPUtils.sign(acp, publicClient, walletClient);
   },
   /**
@@ -1013,7 +1095,8 @@ var ACPUtils = {
       issuerSignature: acp.issuerSignature,
       recipientSignature: acp.recipientSignature,
       _signedDomain: acp._signedDomain,
-      sealingPrivateKey: acp.sealingPrivateKey
+      sealingPrivateKey: acp.sealingPrivateKey,
+      ...acp.metadata != null && { metadata: acp.metadata }
     };
   },
   /**
@@ -1087,7 +1170,7 @@ var ACPUtils = {
   /**
    * Export acp data for sharing (strips the private component).
    * Fixed `SharedACP` shape — every field always present, aligned with
-   * `ACPPublic` and the on-chain sharing payload.
+   * `ACPPublic` and the on-chain sharing payload — plus `metadata` when the acp has labels.
    */
   export: (acp) => {
     if (acp.type !== "sharing") {
@@ -1101,7 +1184,6 @@ var ACPUtils = {
       );
     }
     const shared = {
-      name: acp.name,
       type: acp.type,
       issuer: acp.issuer,
       expiration: acp.expiration,
@@ -1111,7 +1193,8 @@ var ACPUtils = {
       scope: acp.scope,
       contracts: acp.contracts,
       handles: acp.handles,
-      issuerSignature: acp.issuerSignature
+      issuerSignature: acp.issuerSignature,
+      ...acp.metadata != null && acp.metadata !== "0x" && { metadata: acp.metadata }
     };
     return JSON.stringify(shared, void 0, 2);
   },
@@ -1197,11 +1280,14 @@ var ACP_REVOKER_ABI = parseAbi([
 ]);
 var ACP_SHARE_REGISTRY_ABI = parseAbi([
   "struct ACP { address issuer; uint64 expiration; address recipient; uint256 revokerData; address revokerContract; uint8 scope; address[] contracts; bytes32[] handles; bytes32 sealingKey; bytes issuerSignature; bytes recipientSignature; }",
-  "function share(ACP calldata acp) external returns (bytes32)",
+  "struct ShareHeader { address issuer; uint64 expiration; address recipient; uint64 blockNumber; address revokerContract; uint256 revokerData; }",
+  "function share(ACP calldata acp, bytes calldata metadata) external returns (bytes32)",
   "function removeShare(bytes32 shareId) external",
-  "function sharesFor(address recipient) external view returns (ACP[] memory)",
-  "function getShare(bytes32 shareId) external view returns (ACP memory)",
-  "function isShareValid(bytes32 shareId) external view returns (bool)"
+  "function sharesFor(address recipient) external view returns (bytes32[] shareIds, ShareHeader[] headers)",
+  "function getShare(bytes32 shareId) external view returns (ShareHeader memory)",
+  "function isShareValid(bytes32 shareId) external view returns (bool)",
+  "event Shared(address indexed recipient, address indexed issuer, bytes32 indexed shareId, ACP acp, bytes metadata)",
+  "event ShareRemoved(address indexed recipient, address indexed issuer, bytes32 indexed shareId)"
 ]);
 var ACP_SHARE_TUPLE_ABI = [
   {
@@ -1237,11 +1323,393 @@ var computeShareId = (acp) => {
   return keccak256(encodeAbiParameters(ACP_SHARE_TUPLE_ABI, [p]));
 };
 var shareIdOfChainShare = (share) => keccak256(encodeAbiParameters(ACP_SHARE_TUPLE_ABI, [share]));
+var messageOf = (error) => error instanceof Error ? error.message : String(error);
+var readPostedShares = async (publicClient, registry, headers) => {
+  const idsByBlock = /* @__PURE__ */ new Map();
+  for (const { shareId, header } of headers) {
+    idsByBlock.set(header.blockNumber, [...idsByBlock.get(header.blockNumber) ?? [], shareId]);
+  }
+  const found = /* @__PURE__ */ new Map();
+  await Promise.all(
+    [...idsByBlock].map(async ([block, shareIds]) => {
+      let logs;
+      try {
+        logs = await publicClient.getContractEvents({
+          address: registry,
+          abi: ACP_SHARE_REGISTRY_ABI,
+          eventName: "Shared",
+          args: { shareId: shareIds },
+          fromBlock: block,
+          toBlock: block,
+          strict: true
+        });
+      } catch (error) {
+        for (const shareId of shareIds) {
+          found.set(shareId.toLowerCase(), {
+            reason: `the Shared events of block ${block} could not be read: ${messageOf(error)}`
+          });
+        }
+        return;
+      }
+      for (const { args } of logs) {
+        const hashes = shareIdOfChainShare(args.acp).toLowerCase() === args.shareId.toLowerCase();
+        found.set(
+          args.shareId.toLowerCase(),
+          hashes ? { share: args.acp, metadata: args.metadata } : { reason: "the payload in its Shared event does not hash to its id" }
+        );
+      }
+    })
+  );
+  const result = { posted: [], unreadable: [] };
+  for (const { shareId, header } of headers) {
+    const entry = found.get(shareId.toLowerCase());
+    if (entry == null) {
+      result.unreadable.push({
+        shareId,
+        header,
+        reason: `no Shared event in block ${header.blockNumber}, where the registry points`
+      });
+    } else if ("reason" in entry) {
+      result.unreadable.push({ shareId, header, reason: entry.reason });
+    } else {
+      result.posted.push({ shareId, header, ...entry });
+    }
+  }
+  return result;
+};
+var readSharesFor = async (publicClient, registry, recipient) => {
+  const [shareIds, headers] = await publicClient.readContract({
+    address: registry,
+    abi: ACP_SHARE_REGISTRY_ABI,
+    functionName: "sharesFor",
+    args: [recipient]
+  });
+  return readPostedShares(
+    publicClient,
+    registry,
+    shareIds.map((shareId, i) => ({ shareId, header: headers[i] }))
+  );
+};
+var readShare = async (publicClient, registry, shareId) => {
+  const header = await publicClient.readContract({
+    address: registry,
+    abi: ACP_SHARE_REGISTRY_ABI,
+    functionName: "getShare",
+    args: [shareId]
+  });
+  if (header.issuer === "0x0000000000000000000000000000000000000000")
+    return null;
+  const { posted, unreadable } = await readPostedShares(publicClient, registry, [{ shareId, header }]);
+  if (unreadable.length > 0)
+    throw new Error(`Share ${shareId}: ${unreadable[0].reason}`);
+  return posted[0];
+};
+var readerOf = (blob) => {
+  let offset = 0;
+  const take = (width) => {
+    if (offset + width > size(blob))
+      throw new Error("share metadata: the blob ends in the middle of a field");
+    offset += width;
+    return sliceHex(blob, offset - width, offset);
+  };
+  return {
+    take,
+    takeNumber: (width) => hexToNumber(take(width)),
+    done: () => offset === size(blob),
+    remaining: () => size(blob) - offset
+  };
+};
+var takeList = (reader, takeItem) => Array.from({ length: reader.takeNumber(BYTE_WIDTH.count) }, takeItem);
+var takeFrom = (reader, list, what) => {
+  const position = reader.takeNumber(BYTE_WIDTH.index);
+  if (position >= list.length) {
+    throw new Error(`share metadata: ${what} ${position} is outside the ${what} list`);
+  }
+  return list[position];
+};
+var decodeArg = (reader) => {
+  const tag = reader.takeNumber(BYTE_WIDTH.argTag);
+  if (tag === ARG_TAG.issuer)
+    return { type: "issuer" };
+  if (tag === ARG_TAG.word)
+    return { type: "word", value: reader.take(BYTE_WIDTH.word) };
+  throw new Error(`share metadata: unknown argument tag ${tag}`);
+};
+var decodeArgs = (reader) => {
+  const code = reader.takeNumber(BYTE_WIDTH.argsCode);
+  if (code === ARGS_CODE.none)
+    return { args: [], returnWord: 0 };
+  if (code === ARGS_CODE.issuer)
+    return { args: [{ type: "issuer" }], returnWord: 0 };
+  if (code !== ARGS_CODE.explicit)
+    throw new Error(`share metadata: unknown args code ${code}`);
+  const returnWord = reader.takeNumber(BYTE_WIDTH.returnWord);
+  return { args: takeList(reader, () => decodeArg(reader)), returnWord };
+};
+var takeAppKey = (reader) => {
+  if (reader.done())
+    return void 0;
+  const isKey = reader.remaining() === BYTE_WIDTH.count + BYTE_WIDTH.word && reader.takeNumber(BYTE_WIDTH.count) === APP_KEY_TAG;
+  if (!isKey)
+    throw new Error("share metadata: the blob has more entries than the share has ctHashes");
+  return reader.take(BYTE_WIDTH.word);
+};
+var decodeShareMetadataFull = (blob, handles) => {
+  const reader = readerOf(blob);
+  const version = reader.takeNumber(BYTE_WIDTH.version);
+  if (version !== LAYOUT_VERSION)
+    throw new Error(`share metadata: unsupported version ${version}`);
+  const contracts = takeList(reader, () => getAddress(reader.take(BYTE_WIDTH.address)));
+  const selectors = takeList(reader, () => reader.take(BYTE_WIDTH.selector));
+  const transactions = takeList(reader, () => ({
+    block: hexToBigInt(reader.take(BYTE_WIDTH.block)),
+    txIndex: reader.takeNumber(BYTE_WIDTH.txIndex)
+  }));
+  const labels = handles.map(() => {
+    const kind = reader.takeNumber(BYTE_WIDTH.kind);
+    switch (kind) {
+      case ENTRY_KIND.stored: {
+        const contract = takeFrom(reader, contracts, "contract");
+        const selector = takeFrom(reader, selectors, "selector");
+        const block = hexToBigInt(reader.take(BYTE_WIDTH.block));
+        return { kind: "stored", contract, selector, ...decodeArgs(reader), block };
+      }
+      case ENTRY_KIND.event: {
+        const contract = takeFrom(reader, contracts, "contract");
+        const { block, txIndex } = takeFrom(reader, transactions, "transaction");
+        const logIndex = reader.takeNumber(BYTE_WIDTH.logIndex);
+        const selector = takeFrom(reader, selectors, "selector");
+        return { kind: "event", contract, block, txIndex, logIndex, selector };
+      }
+      case ENTRY_KIND.unlabelled:
+        return { kind: "unlabelled" };
+      default:
+        throw new Error(`share metadata: unknown entry kind ${kind}`);
+    }
+  });
+  const appKey = takeAppKey(reader);
+  if (!reader.done())
+    throw new Error("share metadata: the blob has more entries than the share has ctHashes");
+  return { labels, appKey };
+};
+var decodeShareMetadata = (blob, handles) => decodeShareMetadataFull(blob, handles).labels;
+var decodeShareAppKey = (metadata, handles) => metadata == null || metadata === "0x" ? void 0 : decodeShareMetadataFull(metadata, handles).appKey;
+var sameWord = (a, b) => a.toLowerCase() === b.toLowerCase();
+var wordsOf = (data) => {
+  const count = Math.floor(size(data) / BYTE_WIDTH.word);
+  return Array.from(
+    { length: count },
+    (_, index) => sliceHex(data, index * BYTE_WIDTH.word, (index + 1) * BYTE_WIDTH.word)
+  );
+};
+var storedCallData = (label, issuer) => concatHex([
+  label.selector,
+  ...label.args.map((arg) => arg.type === "issuer" ? padHex(issuer, { size: BYTE_WIDTH.word }) : arg.value)
+]);
+var checkStored = (label, handle, data) => {
+  const found = data ? wordsOf(data)[label.returnWord] : void 0;
+  return found && sameWord(found, handle) ? "verified" : "mismatch";
+};
+var checkEvent = (label, handle, logs) => {
+  const log = logs.find((l) => l.logIndex === label.logIndex);
+  if (log == null)
+    return "mismatch";
+  if (log.transactionIndex !== label.txIndex)
+    return "mismatch";
+  const topic0 = log.topics[0];
+  if (topic0 == null || !topic0.toLowerCase().startsWith(label.selector.toLowerCase()))
+    return "mismatch";
+  const carried = [...log.topics.slice(1), ...wordsOf(log.data)].some((word) => word != null && sameWord(word, handle));
+  return carried ? "verified" : "mismatch";
+};
+var callAt = async (publicClient, to, data, blockNumber) => (await publicClient.call({ to, data, blockNumber })).data;
+var logsAt = (publicClient, address, block) => publicClient.getLogs({ address, fromBlock: block, toBlock: block });
+var verifyShareLabel = async (label, handle, publicClient, issuer) => {
+  try {
+    switch (label.kind) {
+      case "stored":
+        return checkStored(
+          label,
+          handle,
+          await callAt(publicClient, label.contract, storedCallData(label, issuer), label.block)
+        );
+      case "event":
+        return checkEvent(label, handle, await logsAt(publicClient, label.contract, label.block));
+      case "unlabelled":
+        return "unverifiable";
+    }
+  } catch {
+    return "unverifiable";
+  }
+};
+var verifyShareLabels = async ({
+  labels,
+  handles,
+  issuer,
+  publicClient,
+  verify = "all"
+}) => {
+  if (labels.length !== handles.length) {
+    throw new Error(`share metadata: ${labels.length} labels for ${handles.length} ctHashes`);
+  }
+  const requests = /* @__PURE__ */ new Map();
+  const once = (key, request) => {
+    if (!requests.has(key))
+      requests.set(key, request());
+    return requests.get(key);
+  };
+  return Promise.all(
+    labels.map(async (label, i) => {
+      const handle = handles[i];
+      try {
+        switch (label.kind) {
+          case "stored": {
+            if (verify !== "all")
+              return "skipped";
+            const data = storedCallData(label, issuer);
+            const key = `call:${label.contract.toLowerCase()}:${label.block}:${data}`;
+            return checkStored(
+              label,
+              handle,
+              await once(key, () => callAt(publicClient, label.contract, data, label.block))
+            );
+          }
+          case "event": {
+            if (verify === "none")
+              return "skipped";
+            const key = `logs:${label.contract.toLowerCase()}:${label.block}`;
+            return checkEvent(label, handle, await once(key, () => logsAt(publicClient, label.contract, label.block)));
+          }
+          case "unlabelled":
+            return verify === "none" ? "skipped" : "unverifiable";
+        }
+      } catch {
+        return "unverifiable";
+      }
+    })
+  );
+};
+var abiOf = (abis, contract) => {
+  const wanted = contract.toLowerCase();
+  const key = Object.keys(abis).find((address) => address.toLowerCase() === wanted);
+  return key ? abis[key] : void 0;
+};
+var paramOf = ({ name, type, ...rest }) => {
+  const param = { type };
+  if (name)
+    param.name = name;
+  if ("indexed" in rest && typeof rest.indexed === "boolean")
+    param.indexed = rest.indexed;
+  return param;
+};
+var findFunction = (abi, selector) => abi?.find(
+  (item) => item.type === "function" && toFunctionSelector(item).toLowerCase() === selector.toLowerCase()
+);
+var findEvent = (abi, selector) => abi?.find(
+  (item) => item.type === "event" && toEventSelector(item).toLowerCase().startsWith(selector.toLowerCase())
+);
+var decodeWord = (input, raw) => {
+  if (input == null)
+    return raw;
+  try {
+    return decodeAbiParameters([input], raw)[0];
+  } catch {
+    return raw;
+  }
+};
+var describeStored = (base, label, abis, issuer) => {
+  const fn = findFunction(abiOf(abis, label.contract), label.selector);
+  const args = label.args.map((arg, i) => {
+    const input = fn?.inputs[i];
+    const param = input ? paramOf(input) : { type: "bytes32" };
+    if (arg.type === "issuer") {
+      return {
+        ...param,
+        isIssuer: true,
+        raw: issuer ? padHex(issuer, { size: 32 }) : void 0,
+        value: issuer
+      };
+    }
+    return { ...param, isIssuer: false, raw: arg.value, value: decodeWord(input, arg.value) };
+  });
+  const output = fn?.outputs[label.returnWord];
+  return {
+    ...base,
+    kind: "stored",
+    label,
+    contract: label.contract,
+    block: label.block,
+    selector: label.selector,
+    function: fn ? { name: fn.name, signature: toFunctionSignature(fn), inputs: fn.inputs.map(paramOf) } : null,
+    args,
+    output: output ? paramOf(output) : null
+  };
+};
+var describeEvent = (base, label, abis) => {
+  const event = findEvent(abiOf(abis, label.contract), label.selector);
+  return {
+    ...base,
+    kind: "event",
+    label,
+    contract: label.contract,
+    block: label.block,
+    txIndex: label.txIndex,
+    logIndex: label.logIndex,
+    selector: label.selector,
+    event: event ? { name: event.name, signature: toEventSignature(event), inputs: event.inputs.map(paramOf) } : null
+  };
+};
+var describeShareLabels = (labels, handles, abis = {}, options = {}) => labels.map((label, index) => {
+  const base = { index, handle: handles[index] };
+  switch (label.kind) {
+    case "stored":
+      return describeStored(base, label, abis, options.issuer);
+    case "event":
+      return describeEvent(base, label, abis);
+    case "unlabelled":
+      return { ...base, kind: "unlabelled", label };
+  }
+});
+var describeShareMetadata = (share, abis = {}) => {
+  const { issuer, handles, metadata } = share;
+  if (metadata == null || metadata === "0x")
+    return null;
+  return describeShareLabels(decodeShareMetadata(metadata, handles), handles, abis, { issuer });
+};
+
+// acps/share-metadata/erc7984.ts
+var ERC7984_ABI = [
+  {
+    type: "function",
+    name: "confidentialBalanceOf",
+    stateMutability: "view",
+    inputs: [{ name: "account", type: "address", internalType: "address" }],
+    outputs: [{ name: "", type: "bytes32", internalType: "euint64" }]
+  },
+  {
+    type: "event",
+    name: "ConfidentialTransfer",
+    anonymous: false,
+    inputs: [
+      { name: "from", type: "address", indexed: true, internalType: "address" },
+      { name: "to", type: "address", indexed: true, internalType: "address" },
+      { name: "amount", type: "bytes32", indexed: true, internalType: "euint64" }
+    ]
+  }
+];
+var shareAppKey = (app) => keccak256(stringToHex(app));
 var ACP_STORE_DEFAULTS = {
   acps: {},
   activeACPHash: {}
 };
 var ACP_STORE_VERSION = 3;
+var isRecord = (value) => value != null && typeof value === "object" && !Array.isArray(value);
+var resolveAccountKey = (records, account) => {
+  if (records == null || account in records)
+    return account;
+  const lower = account.toLowerCase();
+  return Object.keys(records).find((key) => key.toLowerCase() === lower) ?? account;
+};
 var _acpStore = createStore()(
   persist(() => ACP_STORE_DEFAULTS, {
     name: "cofhesdk-acps",
@@ -1250,12 +1718,23 @@ var _acpStore = createStore()(
       if (version < ACP_STORE_VERSION)
         return ACP_STORE_DEFAULTS;
       return persistedState;
+    },
+    // Runs on every rehydrate, including a corrupt state saved at the current version that
+    // `migrate` passes through unchanged. Consumers that read the raw snapshot (e.g. the React
+    // hooks) never go through `clearStaleStore`, so the shape has to be fixed here.
+    merge: (persistedState, currentState) => {
+      const persisted = isRecord(persistedState) ? persistedState : {};
+      return {
+        ...currentState,
+        acps: isRecord(persisted.acps) ? persisted.acps : currentState.acps,
+        activeACPHash: isRecord(persisted.activeACPHash) ? persisted.activeACPHash : currentState.activeACPHash
+      };
     }
   })
 );
 var clearStaleStore = () => {
   const state = _acpStore.getState();
-  const hasExpectedStructure = state && typeof state === "object" && "acps" in state && "activeACPHash" in state && typeof state.acps === "object" && typeof state.activeACPHash === "object";
+  const hasExpectedStructure = isRecord(state) && isRecord(state.acps) && isRecord(state.activeACPHash);
   if (hasExpectedStructure)
     return;
   _acpStore.setState({ acps: {}, activeACPHash: {} });
@@ -1264,7 +1743,8 @@ var getACP = (chainId, account, hash) => {
   clearStaleStore();
   if (chainId == null || account == null || hash == null)
     return;
-  const savedACP = _acpStore.getState().acps[chainId]?.[account]?.[hash];
+  const accountACPs = _acpStore.getState().acps[chainId];
+  const savedACP = accountACPs?.[resolveAccountKey(accountACPs, account)]?.[hash];
   if (savedACP == null)
     return;
   return ACPUtils.deserialize(savedACP);
@@ -1273,14 +1753,16 @@ var getActiveACP = (chainId, account) => {
   clearStaleStore();
   if (chainId == null || account == null)
     return;
-  const activeACPHash = _acpStore.getState().activeACPHash[chainId]?.[account];
+  const activeHashes = _acpStore.getState().activeACPHash[chainId];
+  const activeACPHash = activeHashes?.[resolveAccountKey(activeHashes, account)];
   return getACP(chainId, account, activeACPHash);
 };
 var getACPs = (chainId, account) => {
   clearStaleStore();
   if (chainId == null || account == null)
     return {};
-  return Object.entries(_acpStore.getState().acps[chainId]?.[account] ?? {}).reduce(
+  const accountACPs = _acpStore.getState().acps[chainId];
+  return Object.entries(accountACPs?.[resolveAccountKey(accountACPs, account)] ?? {}).reduce(
     (acc, [hash, acp]) => {
       if (acp == void 0)
         return acc;
@@ -1295,9 +1777,10 @@ var setACP = (chainId, account, acp) => {
     produce((state) => {
       if (state.acps[chainId] == null)
         state.acps[chainId] = {};
-      if (state.acps[chainId][account] == null)
-        state.acps[chainId][account] = {};
-      state.acps[chainId][account][acp.hash] = ACPUtils.serialize(acp);
+      const key = resolveAccountKey(state.acps[chainId], account);
+      if (state.acps[chainId][key] == null)
+        state.acps[chainId][key] = {};
+      state.acps[chainId][key][acp.hash] = ACPUtils.serialize(acp);
     })
   );
 };
@@ -1309,13 +1792,14 @@ var removeACP = (chainId, account, hash) => {
         state.acps[chainId] = {};
       if (state.activeACPHash[chainId] == null)
         state.activeACPHash[chainId] = {};
-      const accountACPs = state.acps[chainId][account];
+      const accountACPs = state.acps[chainId][resolveAccountKey(state.acps[chainId], account)];
       if (accountACPs == null)
         return;
       if (accountACPs[hash] == null)
         return;
-      if (state.activeACPHash[chainId][account] === hash) {
-        state.activeACPHash[chainId][account] = void 0;
+      const activeKey = resolveAccountKey(state.activeACPHash[chainId], account);
+      if (state.activeACPHash[chainId][activeKey] === hash) {
+        state.activeACPHash[chainId][activeKey] = void 0;
       }
       accountACPs[hash] = void 0;
     })
@@ -1325,7 +1809,8 @@ var getActiveACPHash = (chainId, account) => {
   clearStaleStore();
   if (chainId == null || account == null)
     return void 0;
-  return _acpStore.getState().activeACPHash[chainId]?.[account];
+  const activeHashes = _acpStore.getState().activeACPHash[chainId];
+  return activeHashes?.[resolveAccountKey(activeHashes, account)];
 };
 var setActiveACPHash = (chainId, account, hash) => {
   clearStaleStore();
@@ -1333,7 +1818,7 @@ var setActiveACPHash = (chainId, account, hash) => {
     produce((state) => {
       if (state.activeACPHash[chainId] == null)
         state.activeACPHash[chainId] = {};
-      state.activeACPHash[chainId][account] = hash;
+      state.activeACPHash[chainId][resolveAccountKey(state.activeACPHash[chainId], account)] = hash;
     })
   );
 };
@@ -1342,7 +1827,7 @@ var removeActiveACPHash = (chainId, account) => {
   _acpStore.setState(
     produce((state) => {
       if (state.activeACPHash[chainId])
-        state.activeACPHash[chainId][account] = void 0;
+        state.activeACPHash[chainId][resolveAccountKey(state.activeACPHash[chainId], account)] = void 0;
     })
   );
 };
@@ -1363,4 +1848,4 @@ var acpStore = {
   resetStore
 };
 
-export { ACPScope, ACPUtils, ACP_REVOKER_ABI, ACP_SHARE_REGISTRY_ABI, ACP_SHARE_TUPLE_ABI, ACP_STORE_DEFAULTS, CofheError, CofheErrorCode, GenerateSealingKey, ImportACPOptionsValidator, ImportACPValidator, SelfACPOptionsValidator, SelfACPValidator, SharingACPOptionsValidator, SharingACPValidator, SignatureTypes, SignatureUtils, ValidationUtils, _acpStore, acpStore, addressNotZeroSchema, addressSchema, bytesNotEmptySchema, bytesSchema, clearAclServedAddresses, clearStaleStore, computeShareId, contractsSchema, getACP, getACPs, getAclAddress, getAclServedAddresses, getActiveACP, getActiveACPHash, getSignatureTypesAndMessage, getTaskManagerAddress, handlesSchema, isCofheError, removeACP, removeActiveACPHash, resetStore, seal, setACP, setActiveACPHash, shareIdOfChainShare, toChainShare, unsealWithPrivateKey, validateImportACP, validateImportACPOptions, validateSelfACP, validateSelfACPOptions, validateSharingACP, validateSharingACPOptions };
+export { ACPScope, ACPUtils, ACP_REVOKER_ABI, ACP_SHARE_REGISTRY_ABI, ACP_SHARE_TUPLE_ABI, ACP_STORE_DEFAULTS, ERC7984_ABI, GenerateSealingKey, ImportACPOptionsValidator, ImportACPValidator, LAYOUT_VERSION, SelfACPOptionsValidator, SelfACPValidator, SharingACPOptionsValidator, SharingACPValidator, SignatureTypes, SignatureUtils, UNLABELLED, ValidationUtils, _acpStore, acpStore, addressNotZeroSchema, addressSchema, bytesNotEmptySchema, bytesSchema, clearAclServedAddresses, clearStaleStore, computeShareId, contractsSchema, decodeShareAppKey, decodeShareMetadata, decodeShareMetadataFull, describeShareLabels, describeShareMetadata, encodeShareMetadata, eventLogLabel, getACP, getACPs, getAclAddress, getAclServedAddresses, getActiveACP, getActiveACPHash, getSignatureTypesAndMessage, getTaskManagerAddress, handlesSchema, readPostedShares, readShare, readSharesFor, removeACP, removeActiveACPHash, resetStore, seal, setACP, setActiveACPHash, shareAppKey, shareIdOfChainShare, toChainShare, unsealWithPrivateKey, validateImportACP, validateImportACPOptions, validateSelfACP, validateSelfACPOptions, validateSharingACP, validateSharingACPOptions, verifyShareLabel, verifyShareLabels, viewFunctionLabel };