@fhevm/sdk 1.1.0-alpha.5 → 1.1.0-alpha.6

package/{wasm/tfhe/v1.6.1 → _types/wasm/tfhe/v1.6.2}/tfhe.d.ts

@@ -3405,9 +3405,87 @@ export function wbg_rayon_start_worker(receiver: number): void;
 export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembly.Module;
 
 export interface InitOutput {
+    readonly __wbg_boolean_free: (a: number, b: number) => void;
+    readonly __wbg_booleanciphertext_free: (a: number, b: number) => void;
+    readonly __wbg_booleanclientkey_free: (a: number, b: number) => void;
+    readonly __wbg_booleancompressedciphertext_free: (a: number, b: number) => void;
+    readonly __wbg_booleancompressedserverkey_free: (a: number, b: number) => void;
+    readonly __wbg_booleannoisedistribution_free: (a: number, b: number) => void;
+    readonly __wbg_booleanparameters_free: (a: number, b: number) => void;
+    readonly __wbg_booleanpublickey_free: (a: number, b: number) => void;
+    readonly __wbg_tfheclientkey_free: (a: number, b: number) => void;
+    readonly __wbg_tfhecompactpublickey_free: (a: number, b: number) => void;
+    readonly __wbg_tfhecompressedcompactpublickey_free: (a: number, b: number) => void;
+    readonly __wbg_tfhecompressedpublickey_free: (a: number, b: number) => void;
+    readonly __wbg_tfhecompressedserverkey_free: (a: number, b: number) => void;
+    readonly __wbg_tfhepublickey_free: (a: number, b: number) => void;
+    readonly __wbg_tfheserverkey_free: (a: number, b: number) => void;
+    readonly boolean_decompress_ciphertext: (a: number) => number;
+    readonly boolean_decrypt: (a: number, b: number) => number;
+    readonly boolean_deserialize_ciphertext: (a: number, b: number) => [number, number, number];
+    readonly boolean_deserialize_client_key: (a: number, b: number) => [number, number, number];
+    readonly boolean_deserialize_compressed_ciphertext: (a: number, b: number) => [number, number, number];
+    readonly boolean_deserialize_compressed_server_key: (a: number, b: number) => [number, number, number];
+    readonly boolean_deserialize_public_key: (a: number, b: number) => [number, number, number];
+    readonly boolean_encrypt: (a: number, b: number) => number;
+    readonly boolean_encrypt_compressed: (a: number, b: number) => number;
+    readonly boolean_encrypt_with_public_key: (a: number, b: number) => number;
+    readonly boolean_get_parameters: (a: number) => [number, number, number];
+    readonly boolean_new_client_key: (a: number) => number;
+    readonly boolean_new_client_key_from_seed_and_parameters: (a: bigint, b: bigint, c: number) => number;
+    readonly boolean_new_compressed_server_key: (a: number) => number;
+    readonly boolean_new_gaussian_from_std_dev: (a: number) => number;
+    readonly boolean_new_parameters: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, j: number) => number;
+    readonly boolean_new_public_key: (a: number) => number;
+    readonly boolean_serialize_ciphertext: (a: number) => [number, number, number, number];
+    readonly boolean_serialize_client_key: (a: number) => [number, number, number, number];
+    readonly boolean_serialize_compressed_ciphertext: (a: number) => [number, number, number, number];
+    readonly boolean_serialize_compressed_server_key: (a: number) => [number, number, number, number];
+    readonly boolean_serialize_public_key: (a: number) => [number, number, number, number];
+    readonly boolean_trivial_encrypt: (a: number) => number;
+    readonly boolean_try_new_t_uniform: (a: number) => [number, number, number];
+    readonly init_panic_hook: () => void;
+    readonly set_server_key: (a: number) => [number, number];
+    readonly tfheclientkey_deserialize: (a: number, b: number) => [number, number, number];
+    readonly tfheclientkey_generate: (a: number) => [number, number, number];
+    readonly tfheclientkey_generate_with_seed: (a: number, b: any) => [number, number, number];
+    readonly tfheclientkey_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
+    readonly tfheclientkey_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
+    readonly tfheclientkey_serialize: (a: number) => [number, number, number, number];
+    readonly tfhecompactpublickey_deserialize: (a: number, b: number) => [number, number, number];
+    readonly tfhecompactpublickey_new: (a: number) => [number, number, number];
+    readonly tfhecompactpublickey_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
+    readonly tfhecompactpublickey_safe_deserialize_conformant: (a: number, b: number, c: bigint, d: number) => [number, number, number];
+    readonly tfhecompactpublickey_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
+    readonly tfhecompactpublickey_serialize: (a: number) => [number, number, number, number];
+    readonly tfhecompressedcompactpublickey_decompress: (a: number) => [number, number, number];
+    readonly tfhecompressedcompactpublickey_deserialize: (a: number, b: number) => [number, number, number];
+    readonly tfhecompressedcompactpublickey_new: (a: number) => [number, number, number];
+    readonly tfhecompressedcompactpublickey_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
+    readonly tfhecompressedcompactpublickey_safe_deserialize_conformant: (a: number, b: number, c: bigint, d: number) => [number, number, number];
+    readonly tfhecompressedcompactpublickey_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
+    readonly tfhecompressedcompactpublickey_serialize: (a: number) => [number, number, number, number];
+    readonly tfhecompressedpublickey_decompress: (a: number) => [number, number, number];
+    readonly tfhecompressedpublickey_deserialize: (a: number, b: number) => [number, number, number];
+    readonly tfhecompressedpublickey_new: (a: number) => [number, number, number];
+    readonly tfhecompressedpublickey_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
+    readonly tfhecompressedpublickey_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
+    readonly tfhecompressedpublickey_serialize: (a: number) => [number, number, number, number];
+    readonly tfhecompressedserverkey_deserialize: (a: number, b: number) => [number, number, number];
+    readonly tfhecompressedserverkey_new: (a: number) => [number, number, number];
+    readonly tfhecompressedserverkey_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
+    readonly tfhecompressedserverkey_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
+    readonly tfhecompressedserverkey_serialize: (a: number) => [number, number, number, number];
+    readonly tfhepublickey_deserialize: (a: number, b: number) => [number, number, number];
+    readonly tfhepublickey_new: (a: number) => [number, number, number];
+    readonly tfhepublickey_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
+    readonly tfhepublickey_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
+    readonly tfhepublickey_serialize: (a: number) => [number, number, number, number];
+    readonly tfheserverkey_new: (a: number) => [number, number, number];
     readonly __wbg_compactciphertextlist_free: (a: number, b: number) => void;
     readonly __wbg_compactciphertextlistbuilder_free: (a: number, b: number) => void;
     readonly __wbg_compactciphertextlistexpander_free: (a: number, b: number) => void;
+    readonly __wbg_compactpkecrs_free: (a: number, b: number) => void;
     readonly __wbg_compressedfhebool_free: (a: number, b: number) => void;
     readonly __wbg_compressedfheint1024_free: (a: number, b: number) => void;
     readonly __wbg_compressedfheint104_free: (a: number, b: number) => void;
@@ -3585,15 +3663,8 @@ export interface InitOutput {
     readonly __wbg_shortintnoisedistribution_free: (a: number, b: number) => void;
     readonly __wbg_shortintparameters_free: (a: number, b: number) => void;
     readonly __wbg_shortintpublickey_free: (a: number, b: number) => void;
-    readonly __wbg_tfheclientkey_free: (a: number, b: number) => void;
-    readonly __wbg_tfhecompactpublickey_free: (a: number, b: number) => void;
-    readonly __wbg_tfhecompressedcompactpublickey_free: (a: number, b: number) => void;
-    readonly __wbg_tfhecompressedpublickey_free: (a: number, b: number) => void;
-    readonly __wbg_tfhecompressedserverkey_free: (a: number, b: number) => void;
     readonly __wbg_tfheconfig_free: (a: number, b: number) => void;
     readonly __wbg_tfheconfigbuilder_free: (a: number, b: number) => void;
-    readonly __wbg_tfhepublickey_free: (a: number, b: number) => void;
-    readonly __wbg_tfheserverkey_free: (a: number, b: number) => void;
     readonly compactciphertextlist_builder: (a: number) => [number, number, number];
     readonly compactciphertextlist_deserialize: (a: number, b: number) => [number, number, number];
     readonly compactciphertextlist_eq: (a: number, b: number) => number;
@@ -3778,6 +3849,13 @@ export interface InitOutput {
     readonly compactciphertextlistexpander_get_uint96: (a: number, b: number) => [number, number, number];
     readonly compactciphertextlistexpander_is_empty: (a: number) => number;
     readonly compactciphertextlistexpander_len: (a: number) => number;
+    readonly compactpkecrs_deserialize: (a: number, b: number) => [number, number, number];
+    readonly compactpkecrs_deserialize_from_public_params: (a: number, b: number) => [number, number, number];
+    readonly compactpkecrs_from_config: (a: number, b: number) => [number, number, number];
+    readonly compactpkecrs_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
+    readonly compactpkecrs_safe_deserialize_from_public_params: (a: number, b: number, c: bigint) => [number, number, number];
+    readonly compactpkecrs_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
+    readonly compactpkecrs_serialize: (a: number, b: number) => [number, number, number, number];
     readonly compressedfhebool_decompress: (a: number) => [number, number, number];
     readonly compressedfhebool_deserialize: (a: number, b: number) => [number, number, number];
     readonly compressedfhebool_encrypt_with_client_key: (a: number, b: number) => [number, number, number];
@@ -4940,7 +5018,6 @@ export interface InitOutput {
     readonly fheuint96_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
     readonly fheuint96_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
     readonly fheuint96_serialize: (a: number) => [number, number, number, number];
-    readonly init_panic_hook: () => void;
     readonly provencompactciphertextlist_builder: (a: number) => [number, number, number];
     readonly provencompactciphertextlist_deserialize: (a: number, b: number) => [number, number, number];
     readonly provencompactciphertextlist_eq: (a: number, b: number) => number;
@@ -4950,7 +5027,6 @@ export interface InitOutput {
     readonly provencompactciphertextlist_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
     readonly provencompactciphertextlist_serialize: (a: number) => [number, number, number, number];
     readonly provencompactciphertextlist_verify_and_expand: (a: number, b: number, c: number, d: number, e: number) => [number, number, number];
-    readonly set_server_key: (a: number) => [number, number];
     readonly shortint_decompress_ciphertext: (a: number) => number;
     readonly shortint_decrypt: (a: number, b: number) => bigint;
     readonly shortint_deserialize_ciphertext: (a: number, b: number) => [number, number, number];
@@ -5005,90 +5081,14 @@ export interface InitOutput {
     readonly shortintparameters_set_pbs_base_log: (a: number, b: number) => void;
     readonly shortintparameters_set_pbs_level: (a: number, b: number) => void;
     readonly shortintparameters_set_polynomial_size: (a: number, b: number) => void;
-    readonly tfheclientkey_deserialize: (a: number, b: number) => [number, number, number];
-    readonly tfheclientkey_generate: (a: number) => [number, number, number];
-    readonly tfheclientkey_generate_with_seed: (a: number, b: any) => [number, number, number];
-    readonly tfheclientkey_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
-    readonly tfheclientkey_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
-    readonly tfheclientkey_serialize: (a: number) => [number, number, number, number];
-    readonly tfhecompactpublickey_deserialize: (a: number, b: number) => [number, number, number];
-    readonly tfhecompactpublickey_new: (a: number) => [number, number, number];
-    readonly tfhecompactpublickey_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
-    readonly tfhecompactpublickey_safe_deserialize_conformant: (a: number, b: number, c: bigint, d: number) => [number, number, number];
-    readonly tfhecompactpublickey_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
-    readonly tfhecompactpublickey_serialize: (a: number) => [number, number, number, number];
-    readonly tfhecompressedcompactpublickey_decompress: (a: number) => [number, number, number];
-    readonly tfhecompressedcompactpublickey_deserialize: (a: number, b: number) => [number, number, number];
-    readonly tfhecompressedcompactpublickey_new: (a: number) => [number, number, number];
-    readonly tfhecompressedcompactpublickey_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
-    readonly tfhecompressedcompactpublickey_safe_deserialize_conformant: (a: number, b: number, c: bigint, d: number) => [number, number, number];
-    readonly tfhecompressedcompactpublickey_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
-    readonly tfhecompressedcompactpublickey_serialize: (a: number) => [number, number, number, number];
-    readonly tfhecompressedpublickey_decompress: (a: number) => [number, number, number];
-    readonly tfhecompressedpublickey_deserialize: (a: number, b: number) => [number, number, number];
-    readonly tfhecompressedpublickey_new: (a: number) => [number, number, number];
-    readonly tfhecompressedpublickey_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
-    readonly tfhecompressedpublickey_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
-    readonly tfhecompressedpublickey_serialize: (a: number) => [number, number, number, number];
-    readonly tfhecompressedserverkey_deserialize: (a: number, b: number) => [number, number, number];
-    readonly tfhecompressedserverkey_new: (a: number) => [number, number, number];
-    readonly tfhecompressedserverkey_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
-    readonly tfhecompressedserverkey_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
-    readonly tfhecompressedserverkey_serialize: (a: number) => [number, number, number, number];
     readonly tfheconfigbuilder_build: (a: number) => number;
     readonly tfheconfigbuilder_default: () => number;
     readonly tfheconfigbuilder_use_custom_parameters: (a: number, b: number) => number;
     readonly tfheconfigbuilder_use_dedicated_compact_public_key_parameters: (a: number, b: number) => number;
     readonly tfheconfigbuilder_with_custom_parameters: (a: number) => number;
-    readonly tfhepublickey_deserialize: (a: number, b: number) => [number, number, number];
-    readonly tfhepublickey_new: (a: number) => [number, number, number];
-    readonly tfhepublickey_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
-    readonly tfhepublickey_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
-    readonly tfhepublickey_serialize: (a: number) => [number, number, number, number];
-    readonly tfheserverkey_new: (a: number) => [number, number, number];
     readonly provencompactciphertextlist_len: (a: number) => number;
     readonly provencompactciphertextlist_is_empty: (a: number) => number;
     readonly shortintparameters_lwe_noise_distribution: (a: number) => number;
-    readonly __wbg_boolean_free: (a: number, b: number) => void;
-    readonly __wbg_booleanciphertext_free: (a: number, b: number) => void;
-    readonly __wbg_booleanclientkey_free: (a: number, b: number) => void;
-    readonly __wbg_booleancompressedciphertext_free: (a: number, b: number) => void;
-    readonly __wbg_booleancompressedserverkey_free: (a: number, b: number) => void;
-    readonly __wbg_booleannoisedistribution_free: (a: number, b: number) => void;
-    readonly __wbg_booleanparameters_free: (a: number, b: number) => void;
-    readonly __wbg_booleanpublickey_free: (a: number, b: number) => void;
-    readonly __wbg_compactpkecrs_free: (a: number, b: number) => void;
-    readonly boolean_decompress_ciphertext: (a: number) => number;
-    readonly boolean_decrypt: (a: number, b: number) => number;
-    readonly boolean_deserialize_ciphertext: (a: number, b: number) => [number, number, number];
-    readonly boolean_deserialize_client_key: (a: number, b: number) => [number, number, number];
-    readonly boolean_deserialize_compressed_ciphertext: (a: number, b: number) => [number, number, number];
-    readonly boolean_deserialize_compressed_server_key: (a: number, b: number) => [number, number, number];
-    readonly boolean_deserialize_public_key: (a: number, b: number) => [number, number, number];
-    readonly boolean_encrypt: (a: number, b: number) => number;
-    readonly boolean_encrypt_compressed: (a: number, b: number) => number;
-    readonly boolean_encrypt_with_public_key: (a: number, b: number) => number;
-    readonly boolean_get_parameters: (a: number) => [number, number, number];
-    readonly boolean_new_client_key: (a: number) => number;
-    readonly boolean_new_client_key_from_seed_and_parameters: (a: bigint, b: bigint, c: number) => number;
-    readonly boolean_new_compressed_server_key: (a: number) => number;
-    readonly boolean_new_gaussian_from_std_dev: (a: number) => number;
-    readonly boolean_new_parameters: (a: number, b: number, c: number, d: number, e: number, f: number, g: number, h: number, i: number, j: number) => number;
-    readonly boolean_new_public_key: (a: number) => number;
-    readonly boolean_serialize_ciphertext: (a: number) => [number, number, number, number];
-    readonly boolean_serialize_client_key: (a: number) => [number, number, number, number];
-    readonly boolean_serialize_compressed_ciphertext: (a: number) => [number, number, number, number];
-    readonly boolean_serialize_compressed_server_key: (a: number) => [number, number, number, number];
-    readonly boolean_serialize_public_key: (a: number) => [number, number, number, number];
-    readonly boolean_trivial_encrypt: (a: number) => number;
-    readonly boolean_try_new_t_uniform: (a: number) => [number, number, number];
-    readonly compactpkecrs_deserialize: (a: number, b: number) => [number, number, number];
-    readonly compactpkecrs_deserialize_from_public_params: (a: number, b: number) => [number, number, number];
-    readonly compactpkecrs_from_config: (a: number, b: number) => [number, number, number];
-    readonly compactpkecrs_safe_deserialize: (a: number, b: number, c: bigint) => [number, number, number];
-    readonly compactpkecrs_safe_deserialize_from_public_params: (a: number, b: number, c: bigint) => [number, number, number];
-    readonly compactpkecrs_safe_serialize: (a: number, b: bigint) => [number, number, number, number];
-    readonly compactpkecrs_serialize: (a: number, b: number) => [number, number, number, number];
     readonly __wbg_tfhe_free: (a: number, b: number) => void;
     readonly __wbg_wbg_rayon_poolbuilder_free: (a: number, b: number) => void;
     readonly wbg_rayon_poolbuilder_build: (a: number) => void;
@@ -5159,6 +5159,9 @@ export type WasmAssetLoadMode =
 export function setWorkerUrlConfig(parameters?: {
   readonly workerUrl?: URL | undefined;
   readonly wasmAssetLoadMode?: WasmAssetLoadMode | undefined;
+  // Required: the SDK injects the resolved runtime kind (browser vs Node); the
+  // worker bootstrap no longer detects it itself.
+  readonly isBrowserLike: boolean;
   readonly logger?:
     | {
         debug: (message: string) => void;

package/core/_version.ts

@@ -1,3 +1,3 @@
 // This file is auto-generated
-export const version: string = '1.1.0-alpha.5';
+export const version: string = '1.1.0-alpha.6';
 export const sdkName: string = '@fhevm/sdk';

package/core/base/bytes.ts

@@ -37,6 +37,7 @@ import { is0x, isNo0x, remove0x } from './string.js';
 import { InvalidPropertyError } from './errors/InvalidPropertyError.js';
 import { InvalidTypeError } from './errors/InvalidTypeError.js';
 import { isUintForByteLength } from './uint.js';
+import { Sha256VerificationError } from './errors/Sha256VerificationError.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -1446,7 +1447,7 @@ export async function verifySha256(
 
   if (actual !== expected) {
     const subject = options?.subject ?? 'bytes';
-    throw new Error(`SHA-256 mismatch for ${subject}: expected ${expected}, got ${actual}`);
+    throw new Sha256VerificationError({ subject, expected, actual }, {});
   }
 }
 

package/core/base/environment.ts

@@ -0,0 +1,210 @@
+/**
+ * JS-runtime environment detection and capability probes.
+ *
+ * Everything in this file answers one of two questions about the host
+ * environment the SDK happens to be running in:
+ *
+ * - *Which* runtime is this? — {@link isNodeLike}, {@link isBrowserLike}
+ * - *What* does it support? — {@link getNodeBuffer}
+ *
+ * Detection is intentionally capability-leaning rather than UA-based: edge
+ * runtimes (Vercel Edge, Cloudflare Workers, Next.js edge) are neither Node nor
+ * browser, so probes return the safe answer (`false` / `undefined`) and callers
+ * fall back to web-standard APIs.
+ */
+
+export function isNodeLike(): boolean {
+  return (
+    // eslint-disable-next-line no-restricted-globals
+    typeof process !== 'undefined' &&
+    // eslint-disable-next-line no-restricted-globals, @typescript-eslint/no-unnecessary-condition
+    typeof process.versions?.node === 'string'
+  );
+}
+
+export function isBrowserLike(): boolean {
+  return (
+    // @ts-expect-error - Bun is a runtime global only under Bun
+    typeof Bun === 'undefined' &&
+    !isNodeLike() &&
+    typeof location !== 'undefined' &&
+    typeof location.href === 'string' &&
+    typeof addEventListener === 'function' &&
+    typeof removeEventListener === 'function'
+  );
+}
+
+/**
+ * Imports a Node built-in module by name, returning `undefined` when it isn't
+ * importable (browsers, and edge runtimes: Vercel Edge, Cloudflare Workers,
+ * Next.js edge). The id is built indirectly so bundlers don't statically
+ * resolve/polyfill the module (a polyfill would bloat browser bundles).
+ *
+ * Every major bundler must be told NOT to analyze this computed dynamic import,
+ * each via its own magic comment, or it errors at build/runtime:
+ * - `@vite-ignore` — Vite.
+ * - `webpackIgnore` — webpack.
+ * - `turbopackIgnore` — Turbopack (Next.js). Without it, Turbopack can't analyze
+ *   the parameter-derived specifier, can't bundle a `node:` builtin as a
+ *   candidate, and replaces the call with a stub that throws
+ *   `Cannot find module 'unknown'` — which silently disabled the Node
+ *   `worker_threads` backend (→ single-threaded TFHE) in Next server components.
+ *
+ * Each comment instructs its bundler to emit a plain native `import()` that the
+ * runtime resolves; in the browser that throws and is caught below (→ undefined).
+ * Each capability accessor below wraps this and memoizes its result.
+ */
+async function _importNodeModule<mod>(name: string): Promise<mod | undefined> {
+  try {
+    const id = `node:${name}`;
+    return (await import(/* @vite-ignore */ /* webpackIgnore: true */ /* turbopackIgnore: true */ id)) as mod;
+  } catch {
+    return undefined;
+  }
+}
+
+type NodeBuffer = { from(str: string, encoding: string): BufferSource };
+
+let _nodeBufferPromise: Promise<NodeBuffer | undefined> | undefined;
+
+/**
+ * Resolves Node's `Buffer` if `node:buffer` is importable, else `undefined`.
+ *
+ * Memoized — the answer can't change within a process lifetime. Returns the
+ * `Buffer` reference (not a boolean) because `Buffer` is not a global: the
+ * caller needs the actual constructor, so probing and use share one import.
+ *
+ * Returns `undefined` in non-Node runtimes that also lack `node:buffer`
+ * (browsers, and edge runtimes: Vercel Edge, Cloudflare Workers, Next.js edge).
+ */
+export function getNodeBuffer(): Promise<NodeBuffer | undefined> {
+  _nodeBufferPromise ??= (async () => {
+    const mod = await _importNodeModule<{ Buffer?: NodeBuffer }>('buffer');
+    return typeof mod?.Buffer?.from === 'function' ? mod.Buffer : undefined;
+  })();
+  return _nodeBufferPromise;
+}
+
+// Node's `readFile` returns a `Buffer`, which extends `Uint8Array` but whose
+// `.buffer` TS 5.7+ widens to `ArrayBufferLike` (includes `SharedArrayBuffer`),
+// making it incompatible with `BufferSource`. At runtime a `Buffer` is always
+// backed by an `ArrayBuffer`, so typing the result as `BufferSource` here is a
+// safe cast that lets callers pass the bytes to `WebAssembly.compile` directly.
+type NodeFs = {
+  readFile(path: string): Promise<BufferSource>;
+  access(path: string): Promise<void>;
+};
+
+let _nodeFsPromise: Promise<NodeFs | undefined> | undefined;
+
+/**
+ * Resolves Node's `fs/promises` (`readFile`, `access`) if importable, else
+ * `undefined` (browsers and edge runtimes). Memoized. See {@link getNodeBuffer}
+ * for why this returns the module reference rather than a boolean.
+ */
+export function getNodeFs(): Promise<NodeFs | undefined> {
+  _nodeFsPromise ??= (async () => {
+    const mod = await _importNodeModule<NodeFs>('fs/promises');
+    return typeof mod?.readFile === 'function' ? mod : undefined;
+  })();
+  return _nodeFsPromise;
+}
+
+type NodeUrl = { fileURLToPath(url: URL | string): string };
+
+let _nodeUrlPromise: Promise<NodeUrl | undefined> | undefined;
+
+/**
+ * Resolves Node's `url` (`fileURLToPath`) if importable, else `undefined`
+ * (browsers and edge runtimes). Memoized. See {@link getNodeBuffer} for why
+ * this returns the module reference rather than a boolean.
+ */
+export function getNodeUrl(): Promise<NodeUrl | undefined> {
+  _nodeUrlPromise ??= (async () => {
+    const mod = await _importNodeModule<NodeUrl>('url');
+    return typeof mod?.fileURLToPath === 'function' ? mod : undefined;
+  })();
+  return _nodeUrlPromise;
+}
+
+/**
+ * Returns whether the Web Worker API is available (browsers, Deno, and other
+ * web-standard runtimes). Synchronous — checks for the required globals only.
+ */
+export function supportsWebWorkerApi(): boolean {
+  return (
+    typeof Worker === 'function' &&
+    typeof Blob === 'function' &&
+    typeof URL !== 'undefined' &&
+    typeof URL.createObjectURL === 'function'
+  );
+}
+
+let _decompressionStreamSupported: boolean | undefined;
+
+/**
+ * Returns whether `DecompressionStream` is actually *usable* (plus the `Blob`
+ * pipeline it feeds). Needed to inflate compressed embedded WASM.
+ *
+ * A `typeof` presence check is insufficient: some runtimes — notably the Next.js
+ * Edge Runtime — expose `DecompressionStream` as a global **stub that throws on
+ * construction**, so presence is a false positive that crashes later inside the
+ * compile path. We therefore *construct* one (synchronous, cheap) and memoize the
+ * result (support can't change within a process lifetime).
+ *
+ * Returns `false` on older browsers (Firefox <113, Safari <16.4) and edge runtimes,
+ * so callers fall back (uncompressed / URL-based / JS-inflate WASM loading).
+ */
+export function supportsDecompressionStream(): boolean {
+  if (_decompressionStreamSupported === undefined) {
+    if (typeof DecompressionStream !== 'function' || typeof Blob !== 'function') {
+      _decompressionStreamSupported = false;
+    } else {
+      try {
+        // Construction is the probe — the Next.js Edge stub throws here; a real
+        // implementation does not. Assigned (not bare `new`) so it reads as a value
+        // probe, and discarded.
+        const probe = new DecompressionStream('gzip');
+        void probe;
+        _decompressionStreamSupported = true;
+      } catch {
+        _decompressionStreamSupported = false;
+      }
+    }
+  }
+  return _decompressionStreamSupported;
+}
+
+/** Message envelope exchanged with a Node `worker_threads` worker. */
+export interface MessageData {
+  type: string;
+  [key: string]: unknown;
+}
+
+/** Shape of a Node `worker_threads` worker instance the SDK relies on. */
+export interface NodeMessagePort {
+  on(event: 'error', listener: (error: Error) => void): void;
+  on(event: 'exit', listener: (code: number) => void): void;
+  on(event: string, listener: (data: MessageData) => void): void;
+  off(event: string, listener: (data: MessageData) => void): void;
+  postMessage(value: unknown): void;
+  terminate(): Promise<number>;
+}
+
+type NodeWorkerConstructor = new (code: string | URL, options?: Record<string, unknown>) => NodeMessagePort;
+
+let _nodeWorkerPromise: Promise<NodeWorkerConstructor | undefined> | undefined;
+
+/**
+ * Resolves Node's `worker_threads` `Worker` constructor if importable, else
+ * `undefined` (browser, sandboxed Electron renderer, edge runtimes). Memoized.
+ * See {@link getNodeBuffer} for why this returns the constructor rather than a
+ * boolean.
+ */
+export function getNodeWorker(): Promise<NodeWorkerConstructor | undefined> {
+  _nodeWorkerPromise ??= (async () => {
+    const mod = await _importNodeModule<{ Worker?: NodeWorkerConstructor }>('worker_threads');
+    return typeof mod?.Worker === 'function' ? mod.Worker : undefined;
+  })();
+  return _nodeWorkerPromise;
+}

package/core/base/errors/Sha256VerificationError.ts

@@ -0,0 +1,22 @@
+import type { ErrorMetadataParams } from './ErrorBase.js';
+import { ErrorBase } from './ErrorBase.js';
+
+export type Sha256VerificationErrorType = Sha256VerificationError & {
+  name: 'Sha256VerificationError';
+};
+
+export type Sha256VerificationErrorParams = Readonly<{
+  subject: string;
+  expected: string;
+  actual: string;
+}>;
+
+export class Sha256VerificationError extends ErrorBase {
+  constructor(params: Sha256VerificationErrorParams, options: ErrorMetadataParams) {
+    super({
+      ...options,
+      message: `SHA-256 mismatch for ${params.subject}: expected ${params.expected}, got ${params.actual}`,
+      name: 'Sha256VerificationError',
+    });
+  }
+}