@fhevm/sdk 1.1.0-alpha.5 → 1.1.0-alpha.7

package/core/types/relayer-p.ts

@@ -51,7 +51,7 @@ export type RelayerFetchPublicDecryptPayload = {
 };
 
 // https://github.com/zama-ai/fhevm-relayer/blob/96151ef300f787658c5fbaf1b4471263160032d5/src/http/userdecrypt_http_listener.rs#L33
-export type HandleContractPair = {
+export type HandleContractPairV1 = {
   // Hex encoded bytes32 with 0x prefix.
   readonly handle: HandleBytes32Hex;
   // Hex encoded address with 0x prefix.
@@ -60,7 +60,7 @@ export type HandleContractPair = {
 
 // https://github.com/zama-ai/fhevm-relayer/blob/96151ef300f787658c5fbaf1b4471263160032d5/src/http/userdecrypt_http_listener.rs#L20
 export type FetchUserDecryptPayload = {
-  readonly handleContractPairs: readonly HandleContractPair[];
+  readonly handleContractPairs: readonly HandleContractPairV1[];
   readonly requestValidity: {
     // Number as a string
     readonly startTimestamp: string;
@@ -81,8 +81,45 @@ export type FetchUserDecryptPayload = {
   readonly extraData: BytesHex;
 };
 
+// https://github.com/zama-ai/fhevm-relayer v3 HandleEntryJson (camelCase)
+export type HandleContractPairV2 = {
+  // Hex encoded bytes32 with 0x prefix.
+  readonly ctHandle: HandleBytes32Hex;
+  // Hex encoded address with 0x prefix.
+  readonly contractAddress: ChecksummedAddress;
+  // Hex encoded address with 0x prefix.
+  readonly ownerAddress: ChecksummedAddress;
+};
+
+// https://github.com/zama-ai/fhevm-relayer — v3/user-decrypt (RFC-016 unified struct)
+// POST body: AttestedUserDecryptRequestJson envelope
+export type FetchUserDecryptPayloadV2 = {
+  readonly attestationType: 'eip712-unified-user-decrypt-v1';
+  readonly attestedPayload: {
+    readonly version: '2.0';
+    readonly type: 'user_decryption';
+    readonly handles: readonly HandleContractPairV2[];
+    // Hex encoded address with 0x prefix.
+    readonly userAddress: ChecksummedAddress;
+    // List of hex encoded addresses with 0x prefix (empty = permissive mode)
+    readonly allowedContracts: readonly ChecksummedAddress[];
+    readonly requestValidity: {
+      // Number as a string
+      readonly startTimestamp: string;
+      // Number as a string
+      readonly durationSeconds: string;
+    };
+    // Hex encoded key with 0x prefix.
+    readonly publicKey: BytesHex;
+    // Hex encoded bytes with 0x prefix. Default: 0x00
+    readonly extraData: BytesHex;
+  };
+  // Hex encoded signature with 0x prefix.
+  readonly signature: Bytes65Hex;
+};
+
 export type FetchDelegatedUserDecryptPayload = {
-  readonly handleContractPairs: readonly HandleContractPair[];
+  readonly handleContractPairs: readonly HandleContractPairV1[];
   // Hex encoded uint256 string without prefix
   readonly contractsChainId: string;
   // List of hex encoded addresses with 0x prefix
@@ -318,7 +355,7 @@ export type RelayerApiError400 = RelayerApiError400NoDetails | RelayerApiError40
  * Status: 400 (no details)
  */
 export type RelayerApiError400NoDetails = {
-  label: 'malformed_json' | 'request_error' | 'not_ready_for_decryption';
+  label: 'malformed_json' | 'request_error' | 'not_ready_for_decryption' | 'not_allowed_on_host_acl';
   message: string;
 };
 
@@ -372,7 +409,13 @@ export type RelayerApiError500 = {
  * Status: 503
  */
 export type RelayerApiError503 = {
-  label: 'protocol_paused' | 'gateway_not_reachable' | 'readiness_check_timed_out' | 'response_timed_out';
+  label:
+    | 'protocol_paused'
+    | 'insufficient_balance'
+    | 'insufficient_allowance'
+    | 'gateway_not_reachable'
+    | 'readiness_check_timed_out'
+    | 'response_timed_out';
   message: string;
 };
 

package/core/types/signedDecryptionPermit.ts

@@ -1,11 +1,8 @@
-import type { KmsDelegatedUserDecryptEip712, KmsUserDecryptEip712 } from './kms.js';
+import type { KmsDelegatedUserDecryptEip712V1, KmsUserDecryptEip712V1, KmsUserDecryptEip712V2 } from './kms.js';
 import type { Bytes65Hex, BytesHex, ChecksummedAddress } from './primitives.js';
 
 /**
- * A signed EIP-712 authorization that allows the signer's ephemeral key
- * to request decryption of the signer's own FHE handles from the KMS.
- *
- * Created once, serializable, and reusable across multiple decrypt calls.
+ * Common fields shared by all signed decryption permit versions.
  */
 export type SignedDecryptionPermitBase = {
   /** The EIP-712 signature. */
@@ -15,36 +12,60 @@ export type SignedDecryptionPermitBase = {
   /**
    * The account that owns the encrypted data this permit covers.
    *
-   * - **Self permit:** equals `signerAddress` — the signer authorizes decryption
-   *   of their own data.
-   *
-   * - **Delegated permit:** differs from `signerAddress`. Step by step:
-   *   1. Alice owns encrypted values on-chain (ebool, euint8, etc.).
-   *   2. Alice calls the ACL contract to grant Bob permission to decrypt her data.
-   *   3. Bob signs an EIP-712 delegated decryption permit referencing Alice as the
-   *      `encryptedDataOwnerAddress` (= `delegatorAddress` in the EIP-712 message).
-   *   4. The KMS verifies Bob's signature (`signerAddress`) and that Alice
-   *      (`encryptedDataOwnerAddress`) has granted him on-chain permission.
-   *   5. Bob can now decrypt Alice's encrypted values using this permit.
+   * - **Self permit:** equals `signerAddress`.
+   * - **Delegated permit:** differs from `signerAddress`. The owner has granted
+   *   the signer permission via `FHE.delegateUserDecryption()` on-chain.
    */
   readonly encryptedDataOwnerAddress: ChecksummedAddress;
   /** The E2E transport public key embedded in the EIP-712 message. */
   readonly transportPublicKey: BytesHex;
+  /** `true` when the signer is decrypting on behalf of another account (delegated permit). */
+  readonly isDelegated: boolean;
 
-  /** @throws If the permit has expired based on `startTimestamp` + `durationDays`. */
+  /** @throws If the permit has expired. */
   assertNotExpired(): void;
 };
 
-export type SignedSelfDecryptionPermit = SignedDecryptionPermitBase & {
-  readonly eip712: KmsUserDecryptEip712;
-  /** Always `false` for non-delegated permits. `encryptedDataOwnerAddress === signerAddress`. */
-  readonly isDelegated: false;
+////////////////////////////////////////////////////////////////////////////////
+// V1 — protocol v13 and below (two separate EIP-712 shapes)
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * Signed decryption permit produced by protocol v13 and below.
+ *
+ * Narrow to self vs delegated via `eip712.primaryType`:
+ * - `'UserDecryptRequestVerification'` → self permit (`encryptedDataOwnerAddress === signerAddress`)
+ * - `'DelegatedUserDecryptRequestVerification'` → delegated permit
+ */
+export type SignedDecryptionPermitV1 = SignedDecryptionPermitBase & {
+  readonly version: 1;
+  readonly eip712: KmsUserDecryptEip712V1 | KmsDelegatedUserDecryptEip712V1;
 };
 
-export type SignedDelegatedDecryptionPermit = SignedDecryptionPermitBase & {
-  readonly eip712: KmsDelegatedUserDecryptEip712;
-  /** Always `true` for delegated permits. `v` is the delegated account. (see `SenderCannotBeDelegate` is ACL.sol) */
-  readonly isDelegated: true;
+////////////////////////////////////////////////////////////////////////////////
+// V2 — protocol v14 and above (unified EIP-712 shape)
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * Signed decryption permit produced by protocol v14 and above.
+ *
+ * Uses the unified `KmsUserDecryptEip712V2` EIP-712 shape — there is no longer
+ * a separate delegated variant. The `encryptedDataOwnerAddress` is read from
+ * `eip712.message.userAddress` and may differ from `signerAddress`.
+ *
+ * Discriminate from {@link SignedDecryptionPermitV1} with `permit.version === 2`.
+ */
+export type SignedDecryptionPermitV2 = SignedDecryptionPermitBase & {
+  readonly version: 2;
+  readonly eip712: KmsUserDecryptEip712V2;
 };
 
-export type SignedDecryptionPermit = SignedSelfDecryptionPermit | SignedDelegatedDecryptionPermit;
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * A signed decryption permit, covering all protocol versions.
+ *
+ * Narrow by version: `permit.version === 1` → {@link SignedDecryptionPermitV1},
+ * `permit.version === 2` → {@link SignedDecryptionPermitV2}.
+ */
+export type SignedDecryptionPermit = SignedDecryptionPermitV1 | SignedDecryptionPermitV2;

package/core/types/wasmAssets.ts

@@ -1,3 +1,61 @@
+/*
+ * verified-blob:
+ * --------------
+ * Creates a worker from the configured URL after SHA-256 verification.
+ * 1. Reuse cached verified bytes.
+ * 2. Execute those exact bytes as a Blob worker in browsers.
+ * 3. Execute those exact bytes as an eval worker in Node.
+ *
+ * - Transport: url
+ * - Blob: yes
+ * - SHA256: yes
+ *
+ * precheck-direct-url:
+ * --------------------
+ * Creates a worker by passing the configured URL directly to the runtime, after a pre-flight SHA-256 probe.
+ *
+ * IMPORTANT: this is NOT an integrity check. The SDK fetches the URL once to validate
+ * the hash, then hands the URL to the runtime, which fetches it a SECOND time and
+ * executes those bytes. The two fetches are independent — the executed bytes are
+ * never verified. Use only for fail-fast on misconfigured URLs / build mismatches.
+ *
+ * For an actual integrity guarantee, use `verified-blob` (requires CSP allowing blob: workers).
+ *
+ * 1. Fetch the URL and verify its SHA-256 against __TFHE_WORKER_URL_SHA256_JSON__ — fails fast on mismatch.
+ * 2. Discard the verified bytes.
+ * 3. Let the runtime fetch the same URL again and execute it (no verification on this fetch).
+ *
+ * - Transport: url
+ * - Blob: no
+ * - SHA256: yes
+ *
+ * trusted-direct-url:
+ * -------------------
+ * Creates a worker by passing the configured URL directly to the runtime.
+ * 1. Require a configured worker URL.
+ * 2. Do not perform SDK byte verification.
+ * 3. Let the browser or Node runtime load and execute the URL directly.
+ *
+ * - Transport: url
+ * - Blob: no
+ * - SHA256: no
+ *
+ * embedded-base64:
+ * ----------------
+ * Creates a worker from the SDK-embedded base64 worker source.
+ * 1. Read the base64-encoded JavaScript source baked into this module.
+ * 2. Decode into a Blob URL and create a module Worker in browsers.
+ * 3. Decode into UTF-8 JavaScript and create a worker_threads eval Worker in Node.
+ *
+ * - Transport: base64
+ * - Blob: yes
+ * - SHA256: no
+ *
+ * auto:
+ * -----
+ * if workerUrl is defined, try it using `verified-blob`.
+ * if workerUrl failed or is undefined go for `embedded-base64`
+ */
 export type WasmAssetLoadMode =
   | 'embedded-base64'
   | 'verified-blob'

package/core/utils-p/decrypt/{verifyKmsDelegatedUserDecryptEip712.ts → verifyKmsDelegatedUserDecryptEip712V1.ts}

@@ -1,23 +1,23 @@
 import type { FhevmRuntime } from '../../types/coreFhevmRuntime.js';
 import type { FhevmChain } from '../../types/fhevmChain.js';
-import type { KmsDelegatedUserDecryptEip712, KmsDelegatedUserDecryptEip712Message } from '../../types/kms.js';
+import type { KmsDelegatedUserDecryptEip712V1, KmsDelegatedUserDecryptEip712V1Message } from '../../types/kms.js';
 import type { Bytes65Hex, ChecksummedAddress } from '../../types/primitives.js';
-import { kmsDelegatedUserDecryptEip712Types } from '../../kms/kmsDelegatedUserDecryptEip712Types.js';
+import { kmsDelegatedUserDecryptEip712V1Types } from '../../kms/kmsDelegatedUserDecryptEip712V1Types.js';
 import { ThresholdSignerError, UnknownSignerError } from '../../errors/SignersError.js';
 import { createKmsEip712Domain } from '../../kms/createKmsEip712Domain.js';
 import { recoverSigners } from '../runtime/recoverSigners.js';
 
-export type VerifyKmsDelegatedUserDecryptEip712Parameters = {
+export type VerifyKmsDelegatedUserDecryptEip712V1Parameters = {
   readonly signer: ChecksummedAddress;
-  readonly message: KmsDelegatedUserDecryptEip712Message;
+  readonly message: KmsDelegatedUserDecryptEip712V1Message;
   readonly signature: Bytes65Hex;
 };
 
-export async function verifyKmsDelegatedUserDecryptEip712(
+export async function verifyKmsDelegatedUserDecryptEip712V1(
   context: { readonly chain: FhevmChain; readonly runtime: FhevmRuntime },
-  parameters: VerifyKmsDelegatedUserDecryptEip712Parameters,
+  parameters: VerifyKmsDelegatedUserDecryptEip712V1Parameters,
 ): Promise<void> {
-  // A 'DelegatedUserDecryptRequestVerification' KmsEIP712Domain (for signed permit)
+  // A 'DelegatedUserDecryptRequestVerification' KmsEip712Domain (for signed permit)
   // uses `chain.id` (NOT fhevm.gateway.id!!)
   const domain = createKmsEip712Domain({
     chainId: context.chain.id,
@@ -26,8 +26,8 @@ export async function verifyKmsDelegatedUserDecryptEip712(
 
   const recoveredAddresses = await recoverSigners(context, {
     domain,
-    types: kmsDelegatedUserDecryptEip712Types,
-    primaryType: 'DelegatedUserDecryptRequestVerification' satisfies KmsDelegatedUserDecryptEip712['primaryType'],
+    types: kmsDelegatedUserDecryptEip712V1Types,
+    primaryType: 'DelegatedUserDecryptRequestVerification' satisfies KmsDelegatedUserDecryptEip712V1['primaryType'],
     signatures: [parameters.signature],
     message: parameters.message,
   });

package/core/utils-p/decrypt/{verifyKmsUserDecryptEip712.ts → verifyKmsUserDecryptEip712V1.ts}

@@ -1,23 +1,23 @@
 import type { FhevmRuntime } from '../../types/coreFhevmRuntime.js';
 import type { FhevmChain } from '../../types/fhevmChain.js';
-import type { KmsUserDecryptEip712, KmsUserDecryptEip712Message } from '../../types/kms.js';
+import type { KmsUserDecryptEip712V1, KmsUserDecryptEip712V1Message } from '../../types/kms.js';
 import type { Bytes65Hex, ChecksummedAddress } from '../../types/primitives.js';
 import { ThresholdSignerError, UnknownSignerError } from '../../errors/SignersError.js';
 import { createKmsEip712Domain } from '../../kms/createKmsEip712Domain.js';
-import { kmsUserDecryptEip712Types } from '../../kms/kmsUserDecryptEip712Types.js';
+import { kmsUserDecryptEip712V1Types } from '../../kms/kmsUserDecryptEip712V1Types.js';
 import { recoverSigners } from '../runtime/recoverSigners.js';
 
-export type VerifyKmsUserDecryptEip712Parameters = {
+export type VerifyKmsUserDecryptEip712V1Parameters = {
   readonly signer: ChecksummedAddress;
-  readonly message: KmsUserDecryptEip712Message;
+  readonly message: KmsUserDecryptEip712V1Message;
   readonly signature: Bytes65Hex;
 };
 
-export async function verifyKmsUserDecryptEip712(
+export async function verifyKmsUserDecryptEip712V1(
   context: { readonly chain: FhevmChain; readonly runtime: FhevmRuntime },
-  parameters: VerifyKmsUserDecryptEip712Parameters,
+  parameters: VerifyKmsUserDecryptEip712V1Parameters,
 ): Promise<void> {
-  // A 'UserDecryptRequestVerification' KmsEIP712Domain (for signed permit)
+  // A 'UserDecryptRequestVerification' KmsEip712Domain (for signed permit)
   // uses `chain.id` (NOT fhevm.gateway.id!!)
   const domain = createKmsEip712Domain({
     chainId: context.chain.id,
@@ -26,8 +26,8 @@ export async function verifyKmsUserDecryptEip712(
 
   const recoveredAddresses = await recoverSigners(context, {
     domain,
-    types: kmsUserDecryptEip712Types,
-    primaryType: 'UserDecryptRequestVerification' satisfies KmsUserDecryptEip712['primaryType'],
+    types: kmsUserDecryptEip712V1Types,
+    primaryType: 'UserDecryptRequestVerification' satisfies KmsUserDecryptEip712V1['primaryType'],
     signatures: [parameters.signature],
     message: parameters.message,
   });

package/core/utils-p/decrypt/verifyKmsUserDecryptEip712V2.ts

@@ -0,0 +1,43 @@
+import type { FhevmRuntime } from '../../types/coreFhevmRuntime.js';
+import type { FhevmChain } from '../../types/fhevmChain.js';
+import type { KmsUserDecryptEip712V2, KmsUserDecryptEip712V2Message } from '../../types/kms.js';
+import type { Bytes65Hex, ChecksummedAddress } from '../../types/primitives.js';
+import { ThresholdSignerError, UnknownSignerError } from '../../errors/SignersError.js';
+import { createKmsEip712Domain } from '../../kms/createKmsEip712Domain.js';
+import { kmsUserDecryptEip712V2Types } from '../../kms/kmsUserDecryptEip712V2Types.js';
+import { recoverSigners } from '../runtime/recoverSigners.js';
+
+export type VerifyKmsUserDecryptEip712V2Parameters = {
+  readonly signer: ChecksummedAddress;
+  readonly message: KmsUserDecryptEip712V2Message;
+  readonly signature: Bytes65Hex;
+};
+
+export async function verifyKmsUserDecryptEip712V2(
+  context: { readonly chain: FhevmChain; readonly runtime: FhevmRuntime },
+  parameters: VerifyKmsUserDecryptEip712V2Parameters,
+): Promise<void> {
+  const domain = createKmsEip712Domain({
+    chainId: context.chain.id,
+    verifyingContractAddressDecryption: context.chain.fhevm.gateway.contracts.decryption.address,
+  });
+
+  const recoveredAddresses = await recoverSigners(context, {
+    domain,
+    types: kmsUserDecryptEip712V2Types,
+    primaryType: 'UserDecryptRequestVerification' satisfies KmsUserDecryptEip712V2['primaryType'],
+    signatures: [parameters.signature],
+    message: parameters.message,
+  });
+
+  if (recoveredAddresses.length !== 1) {
+    throw new ThresholdSignerError({ type: 'kms' });
+  }
+
+  if (recoveredAddresses[0] !== parameters.signer) {
+    throw new UnknownSignerError({
+      unknownAddress: recoveredAddresses[0] as unknown as ChecksummedAddress,
+      type: 'kms',
+    });
+  }
+}

package/core/utils-p/runtime/recoverSigners.ts

@@ -3,9 +3,9 @@ import type { FhevmRuntime } from '../../types/coreFhevmRuntime.js';
 import type { Bytes65Hex, ChecksummedAddress } from '../../types/primitives.js';
 import { assertIsBytes65HexArray } from '../../base/bytes.js';
 
-type EIP712TypesType = Record<string, ReadonlyArray<{ name: string; type: string }>>;
+type Eip712TypesType = Record<string, ReadonlyArray<{ name: string; type: string }>>;
 
-export type RecoverSignersParameters<T extends EIP712TypesType> = {
+export type RecoverSignersParameters<T extends Eip712TypesType> = {
   readonly domain: Parameters<RecoverTypedDataAddressModuleFunction['recoverTypedDataAddress']>[0]['domain'];
   readonly types: T;
   readonly primaryType: string & keyof T;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@fhevm/sdk",
   "description": "TypeScript Interface for FHEVM",
-  "version": "1.1.0-alpha.5",
+  "version": "1.1.0-alpha.7",
   "type": "module",
   "main": "./_cjs/index.js",
   "module": "./_esm/index.js",

package/wasm/tfhe/TfheApi.d.ts

@@ -15,32 +15,32 @@ export type {
   ProvenCompactCiphertextList,
   TfheCompactPublicKey,
   ZkComputeLoad,
-} from './v1.6.1/tfhe.js';
+} from './v1.6.2/tfhe.js';
 
 /** The subset you actually use - the runtime contract callers depend on. */
 export interface TfheLibApi {
-  initAsync: typeof import('./v1.6.1/tfhe.js').initAsync;
+  initAsync: typeof import('./v1.6.2/tfhe.js').initAsync;
 
   // --- Free functions used by encrypt/init-p.ts -----------------------------
-  init_panic_hook: typeof import('./v1.6.1/tfhe.js').init_panic_hook;
-  initThreadPool: typeof import('./v1.6.1/tfhe.js').initThreadPool;
-  setWorkerUrlConfig: typeof import('./v1.6.1/tfhe.js').setWorkerUrlConfig;
-  getWasmInfo: typeof import('./v1.6.1/tfhe.js').getWasmInfo;
+  init_panic_hook: typeof import('./v1.6.2/tfhe.js').init_panic_hook;
+  initThreadPool: typeof import('./v1.6.2/tfhe.js').initThreadPool;
+  setWorkerUrlConfig: typeof import('./v1.6.2/tfhe.js').setWorkerUrlConfig;
+  getWasmInfo: typeof import('./v1.6.2/tfhe.js').getWasmInfo;
 
   // --- Class constructors used as values in encrypt/api-p.ts ----------------
   // These are imported as runtime values: instanceof checks, static methods
   // (safe_deserialize), factory calls (CompactCiphertextList.builder()).
-  CompactCiphertextList: typeof import('./v1.6.1/tfhe.js').CompactCiphertextList;
-  CompactPkeCrs: typeof import('./v1.6.1/tfhe.js').CompactPkeCrs;
-  ProvenCompactCiphertextList: typeof import('./v1.6.1/tfhe.js').ProvenCompactCiphertextList;
-  TfheCompactPublicKey: typeof import('./v1.6.1/tfhe.js').TfheCompactPublicKey;
+  CompactCiphertextList: typeof import('./v1.6.2/tfhe.js').CompactCiphertextList;
+  CompactPkeCrs: typeof import('./v1.6.2/tfhe.js').CompactPkeCrs;
+  ProvenCompactCiphertextList: typeof import('./v1.6.2/tfhe.js').ProvenCompactCiphertextList;
+  TfheCompactPublicKey: typeof import('./v1.6.2/tfhe.js').TfheCompactPublicKey;
 
   // --- Enum used as a value (e.g. ZkComputeLoad.Verify) ---------------------
-  ZkComputeLoad: typeof import('./v1.6.1/tfhe.js').ZkComputeLoad;
+  ZkComputeLoad: typeof import('./v1.6.2/tfhe.js').ZkComputeLoad;
 }
 
 // Default version
-export type TfheVersion = '1.5.3' | '1.6.1';
+export type TfheVersion = '1.5.3' | '1.6.2';
 
 export type TfheWasmBase64 = {
   readonly tfheWasmBase64: string;

package/wasm/tfhe/loadTfheLib.js

@@ -8,19 +8,19 @@
 
 ////////////////////////////////////////////////////////////////////////////////
 
-export const TFHE_VERSIONS = Object.freeze(['1.5.3', '1.6.1']);
-export const DEFAULT_TFHE_VERSION = '1.6.1';
+export const TFHE_VERSIONS = Object.freeze(['1.5.3', '1.6.2']);
+export const DEFAULT_TFHE_VERSION = '1.6.2';
 
 const _loaders = {
   '1.5.3': () => import('./v1.5.3/tfhe.js'),
-  '1.6.1': () => import('./v1.6.1/tfhe.js'),
+  '1.6.2': () => import('./v1.6.2/tfhe.js'),
 };
 
 ////////////////////////////////////////////////////////////////////////////////
 
 const _wasmBase64Loaders = {
   '1.5.3': () => import('./v1.5.3/tfhe_bg.wasm.base64.js'),
-  '1.6.1': () => import('./v1.6.1/tfhe_bg.wasm.base64.js'),
+  '1.6.2': () => import('./v1.6.2/tfhe_bg.wasm.base64.js'),
 };
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -38,16 +38,16 @@ const _assets = Object.freeze({
       sha256: '3f93fe86a8dfa6e25ae5fcfe28d19833219cba8f45f81c6dd05c2f3cc5323c52',
     }),
   }),
-  '1.6.1': Object.freeze({
+  '1.6.2': Object.freeze({
     wasm: Object.freeze({
-      filename: 'tfhe_bg.v1.6.1.wasm',
-      localRelativePath: './v1.6.1/tfhe_bg.wasm',
-      sha256: 'd470dc00347cdc83135e29700abe54c6a7ee9ba4ad58449bfc2494dfa4423f38',
+      filename: 'tfhe_bg.v1.6.2.wasm',
+      localRelativePath: './v1.6.2/tfhe_bg.wasm',
+      sha256: 'ecd1841ad42226629c1a665ba784e073f2e780137f7986b00088c9227acb9760',
     }),
     worker: Object.freeze({
-      filename: 'tfhe-worker.v1.6.1.mjs',
-      localRelativePath: './v1.6.1/tfhe-worker.mjs',
-      sha256: '348fe6c2e77bafe0cbfb9c0a512af99b5f97de1119ceadf07cc34620dbc5690e',
+      filename: 'tfhe-worker.v1.6.2.mjs',
+      localRelativePath: './v1.6.2/tfhe-worker.mjs',
+      sha256: '2c648dd89132bb63d37e8b47c6fe1f53b06abb1389faeb9b3f671eea9a0db5dd',
     }),
   }),
 });

package/wasm/tfhe/v1.5.3/startWorkers.js

@@ -57,17 +57,13 @@
  */
 
 ////////////////////////////////////////////////////////////////////////////////
-// Runtime detection and load modes
+// Load modes
 ////////////////////////////////////////////////////////////////////////////////
 
-function __isBrowserLike() {
-  return (
-    typeof Bun === 'undefined' &&
-    typeof process === 'undefined' &&
-    typeof addEventListener === 'function' &&
-    typeof removeEventListener === 'function'
-  );
-}
+// Environment detection (browser vs Node) is NOT done here: the SDK resolves it
+// once on the main thread (via environment.ts isBrowserLike, robust to bundler
+// `process` shims) and injects it through setWorkerUrlConfig({ isBrowserLike }).
+// See `_isBrowserLike` below.
 
 const __wasmAssetLoadModes = ['embedded-base64', 'verified-blob', 'precheck-direct-url', 'trusted-direct-url', 'auto'];
 
@@ -89,7 +85,7 @@ function __bytesToHex(bytes) {
  * @returns {Promise<string>} Lowercase hexadecimal SHA-256 digest without a `0x` prefix.
  */
 async function __sha256(bytes) {
-  if (__isBrowserLike()) {
+  if (_isBrowserLike) {
     if (typeof crypto === 'undefined' || !crypto.subtle || typeof crypto.subtle.digest !== 'function') {
       throw new Error('Web Crypto SHA-256 digest is not available');
     }
@@ -100,7 +96,9 @@ async function __sha256(bytes) {
 
   const nodeModuleName = 'crypto';
   const nodeModuleId = `node:${nodeModuleName}`;
-  const { createHash } = await import(/* @vite-ignore */ nodeModuleId);
+  const { createHash } = await import(
+    /* @vite-ignore */ /* webpackIgnore: true */ /* turbopackIgnore: true */ nodeModuleId
+  );
   return createHash('sha256').update(new Uint8Array(bytes)).digest('hex');
 }
 
@@ -152,13 +150,17 @@ async function __fetchAndVerifyWorkerUrlBytes(url, expectedSha256) {
  * @returns {Promise<ArrayBuffer | Uint8Array>} Raw worker script bytes.
  */
 async function __readWorkerUrlBytes(url) {
-  if (!__isBrowserLike() && url.protocol === 'file:') {
+  if (!_isBrowserLike && url.protocol === 'file:') {
     const fsModuleName = 'fs/promises';
     const fsModuleId = `node:${fsModuleName}`;
     const urlModuleName = 'url';
     const urlModuleId = `node:${urlModuleName}`;
-    const { readFile } = await import(/* @vite-ignore */ fsModuleId);
-    const { fileURLToPath } = await import(/* @vite-ignore */ urlModuleId);
+    const { readFile } = await import(
+      /* @vite-ignore */ /* webpackIgnore: true */ /* turbopackIgnore: true */ fsModuleId
+    );
+    const { fileURLToPath } = await import(
+      /* @vite-ignore */ /* webpackIgnore: true */ /* turbopackIgnore: true */ urlModuleId
+    );
     return await readFile(fileURLToPath(url));
   }
 
@@ -203,7 +205,7 @@ async function __newBrowserWorkerFromBlob(blob) {
  * @returns {Promise<Worker>} Created worker.
  */
 async function __newIsomorphicWorkerFromUrl(url) {
-  if (__isBrowserLike()) {
+  if (_isBrowserLike) {
     return new Worker(url, {
       type: 'module',
       name: 'wasm_bindgen_worker',
@@ -212,14 +214,18 @@ async function __newIsomorphicWorkerFromUrl(url) {
 
   const nodeModuleName = 'worker_threads';
   const nodeModuleId = `node:${nodeModuleName}`;
-  const { Worker: NodeWorker } = await import(/* @vite-ignore */ nodeModuleId);
+  const { Worker: NodeWorker } = await import(
+    /* @vite-ignore */ /* webpackIgnore: true */ /* turbopackIgnore: true */ nodeModuleId
+  );
   return new NodeWorker(url);
 }
 
 async function __newNodeWorkerFromJsCode(jsCode) {
   const nodeModuleName = 'worker_threads';
   const nodeModuleId = `node:${nodeModuleName}`;
-  const { Worker: NodeWorker } = await import(/* @vite-ignore */ nodeModuleId);
+  const { Worker: NodeWorker } = await import(
+    /* @vite-ignore */ /* webpackIgnore: true */ /* turbopackIgnore: true */ nodeModuleId
+  );
   return { worker: new NodeWorker(jsCode, { eval: true }), blobUrl: undefined };
 }
 
@@ -232,7 +238,7 @@ async function __newNodeWorkerFromJsCode(jsCode) {
  * @returns {Promise<{ worker: Worker, blobUrl: string | undefined }>} Created worker and optional Blob URL to revoke.
  */
 async function __newIsomorphicWorkerFromVerifiedJsCodeBytes(verifiedJsCodeBytes) {
-  if (__isBrowserLike()) {
+  if (_isBrowserLike) {
     return await __newBrowserWorkerFromBlob(
       new Blob([verifiedJsCodeBytes], {
         type: 'application/javascript',
@@ -251,7 +257,7 @@ async function __newIsomorphicWorkerFromVerifiedJsCodeBytes(verifiedJsCodeBytes)
  * @returns {Promise<{ worker: Worker, blobUrl: string | undefined }>} Created worker and optional Blob URL to revoke.
  */
 async function __newWorkerFromJsCodeBase64(jsCodeBase64) {
-  if (__isBrowserLike()) {
+  if (_isBrowserLike) {
     const blob = new Blob([atob(jsCodeBase64)], {
       type: 'application/javascript',
     });
@@ -338,6 +344,9 @@ let _terminating;
 let _configSet = false;
 let _workerUrl = undefined;
 let _wasmAssetLoadMode = 'auto';
+// Injected by the SDK (the main thread) via setWorkerUrlConfig — the single
+// source of truth for browser-vs-Node, replacing local detection.
+let _isBrowserLike = undefined;
 const _workerUrlSha256 = "3f93fe86a8dfa6e25ae5fcfe28d19833219cba8f45f81c6dd05c2f3cc5323c52";
 let _verifiedWorkerUrlBytesPromise = undefined;
 let _logger = undefined;
@@ -381,7 +390,18 @@ function setWorkerUrlConfig(parameters = {}) {
     throw new TypeError('setWorkerUrlConfig parameters must be an object');
   }
 
-  const { workerUrl = undefined, wasmAssetLoadMode = 'auto', logger = undefined } = parameters;
+  const {
+    workerUrl = undefined,
+    wasmAssetLoadMode = 'auto',
+    logger = undefined,
+    isBrowserLike = undefined,
+  } = parameters;
+
+  // Check `isBrowserLike` (required: the SDK injects the resolved runtime kind;
+  // the worker bootstrap never detects it itself).
+  if (typeof isBrowserLike !== 'boolean') {
+    throw new TypeError('setWorkerUrlConfig: isBrowserLike (boolean) is required');
+  }
 
   // Check `wasmAssetLoadMode`
   if (!__isWasmAssetLoadMode(wasmAssetLoadMode)) {
@@ -409,6 +429,7 @@ function setWorkerUrlConfig(parameters = {}) {
 
   _wasmAssetLoadMode = wasmAssetLoadMode;
   _logger = logger;
+  _isBrowserLike = isBrowserLike;
   _configSet = true;
 }