@inco/lightning-js 0.0.0-bootstrap.0

package/dist/cjs/attestedcompute/attested-compute.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ATTESTED_COMPUTE_DOMAIN_NAME = void 0;
+exports.attestedCompute = attestedCompute;
+const protobuf_1 = require("@bufbuild/protobuf");
+const viem_1 = require("viem");
+const attested_decrypt_js_1 = require("../attesteddecrypt/attested-decrypt.js");
+const binary_js_1 = require("../binary.js");
+const eip712_js_1 = require("../eip712/eip712.js");
+const kms_service_pb_js_1 = require("../generated/es/inco/kms/lite/v1/kms_service_pb.js");
+const xwing_js_1 = require("../lite/xwing.js");
+const eip712_js_2 = require("../reencryption/eip712.js");
+const types_js_1 = require("./types.js");
+exports.ATTESTED_COMPUTE_DOMAIN_NAME = 'IncoAttestedCompute';
+async function attestedCompute({ executorAddress, lhsHandle, op, rhsPlaintext, backoffConfig, walletClient, kmsQuorumClient, chainId, reencryptPubKey, reencryptKeypair, }) {
+    try {
+        (0, attested_decrypt_js_1.validateHandle)(lhsHandle);
+        if (reencryptPubKey &&
+            reencryptKeypair &&
+            !(0, xwing_js_1.reencryptPublicKeysMatch)(reencryptPubKey, reencryptKeypair)) {
+            throw new types_js_1.AttestedComputeError('reencryptPubKey does not match reencryptKeypair public key');
+        }
+        const rhsPlaintextBig = typeof rhsPlaintext === 'boolean'
+            ? rhsPlaintext
+                ? 1n
+                : 0n
+            : BigInt(rhsPlaintext);
+        const eip712DomainVersion = await (0, eip712_js_1.fetchEip712DomainVersion)(executorAddress, walletClient);
+        // Create the EIP712 payload for the handles to decrypt
+        const eip712Payload = (0, eip712_js_2.createEIP712Payload)({
+            chainId: BigInt(chainId),
+            primaryType: 'AttestedComputeRequest',
+            primaryTypeFields: [
+                { name: 'op', type: 'uint8' },
+                { name: 'lhsHandle', type: 'bytes32' },
+                { name: 'rhsPlaintext', type: 'bytes32' },
+                { name: 'publicKey', type: 'bytes' },
+            ],
+            message: {
+                op: op,
+                lhsHandle: lhsHandle,
+                rhsPlaintext: (0, binary_js_1.bigintToBytes32)(rhsPlaintextBig),
+                publicKey: (0, viem_1.bytesToHex)(reencryptPubKey ? reencryptPubKey : new Uint8Array()),
+            },
+            domainName: exports.ATTESTED_COMPUTE_DOMAIN_NAME,
+            domainVersion: eip712DomainVersion,
+        });
+        // Sign the EIP712 message
+        const eip712Signature = await walletClient.signTypedData(eip712Payload);
+        const attestedComputeRequest = (0, protobuf_1.create)(kms_service_pb_js_1.AttestedComputeRequestSchema, {
+            userAddress: walletClient.account.address,
+            reencryptPubKey: reencryptPubKey ? reencryptPubKey : new Uint8Array(),
+            op: op,
+            lhsHandle: lhsHandle,
+            rhsPlaintext: rhsPlaintextBig.toString(16),
+            eip712Signature: (0, viem_1.hexToBytes)(eip712Signature),
+            aclProof: {
+                proof: {
+                    case: 'incoLiteBasicAclProof',
+                    value: {},
+                },
+            },
+        });
+        // Envelope signatures are verified against the on-chain authorized signer set
+        let decryptionAttestation = await kmsQuorumClient.attestedCompute(attestedComputeRequest, executorAddress, walletClient, backoffConfig, reencryptKeypair);
+        // Decrypt encrypted attestations and verify inner DecryptionAttestation signatures
+        if (reencryptPubKey && reencryptKeypair) {
+            const [decryptedAttestation] = await (0, attested_decrypt_js_1.decryptEncryptedAttestations)([decryptionAttestation], reencryptKeypair);
+            return decryptedAttestation;
+        }
+        return decryptionAttestation;
+    }
+    catch (error) {
+        if (error instanceof types_js_1.AttestedComputeError) {
+            throw error;
+        }
+        throw new types_js_1.AttestedComputeError('Failed to perform attested compute', error);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXR0ZXN0ZWQtY29tcHV0ZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9hdHRlc3RlZGNvbXB1dGUvYXR0ZXN0ZWQtY29tcHV0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUEwSEEsMENBeUhDO0FBblBELGlEQUE0QztBQUU1QywrQkFBOEM7QUFDOUMsZ0ZBR2dEO0FBS2hELDRDQUEwRDtBQUUxRCxtREFBK0Q7QUFLL0QsMEZBRzREO0FBRTVELCtDQUErRTtBQUMvRSx5REFBZ0U7QUFFaEUseUNBQXFFO0FBRXhELFFBQUEsNEJBQTRCLEdBQUcscUJBQXFCLENBQUM7QUE4RjNELEtBQUssVUFBVSxlQUFlLENBQTZCLEVBQ2hFLGVBQWUsRUFDZixTQUFTLEVBQ1QsRUFBRSxFQUNGLFlBQVksRUFDWixhQUFhLEVBQ2IsWUFBWSxFQUNaLGVBQWUsRUFDZixPQUFPLEVBQ1AsZUFBZSxFQUNmLGdCQUFnQixHQVlqQjtJQUlDLElBQUksQ0FBQztRQUNILElBQUEsb0NBQWMsRUFBQyxTQUFTLENBQUMsQ0FBQztRQUUxQixJQUNFLGVBQWU7WUFDZixnQkFBZ0I7WUFDaEIsQ0FBQyxJQUFBLG1DQUF3QixFQUFDLGVBQWUsRUFBRSxnQkFBZ0IsQ0FBQyxFQUM1RCxDQUFDO1lBQ0QsTUFBTSxJQUFJLCtCQUFvQixDQUM1Qiw0REFBNEQsQ0FDN0QsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLGVBQWUsR0FDbkIsT0FBTyxZQUFZLEtBQUssU0FBUztZQUMvQixDQUFDLENBQUMsWUFBWTtnQkFDWixDQUFDLENBQUMsRUFBRTtnQkFDSixDQUFDLENBQUMsRUFBRTtZQUNOLENBQUMsQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUM7UUFFM0IsTUFBTSxtQkFBbUIsR0FBRyxNQUFNLElBQUEsb0NBQXdCLEVBQ3hELGVBQWUsRUFDZixZQUFZLENBQ2IsQ0FBQztRQUVGLHVEQUF1RDtRQUN2RCxNQUFNLGFBQWEsR0FBRyxJQUFBLCtCQUFtQixFQUFDO1lBQ3hDLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxDQUFDO1lBQ3hCLFdBQVcsRUFBRSx3QkFBd0I7WUFDckMsaUJBQWlCLEVBQUU7Z0JBQ2pCLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFO2dCQUM3QixFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRTtnQkFDdEMsRUFBRSxJQUFJLEVBQUUsY0FBYyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUU7Z0JBQ3pDLEVBQUUsSUFBSSxFQUFFLFdBQVcsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFO2FBQ3JDO1lBQ0QsT0FBTyxFQUFFO2dCQUNQLEVBQUUsRUFBRSxFQUFFO2dCQUNOLFNBQVMsRUFBRSxTQUFTO2dCQUNwQixZQUFZLEVBQUUsSUFBQSwyQkFBZSxFQUFDLGVBQWUsQ0FBQztnQkFDOUMsU0FBUyxFQUFFLElBQUEsaUJBQVUsRUFDbkIsZUFBZSxDQUFDLENBQUMsQ0FBQyxlQUFlLENBQUMsQ0FBQyxDQUFDLElBQUksVUFBVSxFQUFFLENBQ3JEO2FBQ0Y7WUFDRCxVQUFVLEVBQUUsb0NBQTRCO1lBQ3hDLGFBQWEsRUFBRSxtQkFBbUI7U0FDbkMsQ0FBQyxDQUFDO1FBRUgsMEJBQTBCO1FBQzFCLE1BQU0sZUFBZSxHQUFHLE1BQU0sWUFBWSxDQUFDLGFBQWEsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUV4RSxNQUFNLHNCQUFzQixHQUEyQixJQUFBLGlCQUFNLEVBQzNELGdEQUE0QixFQUM1QjtZQUNFLFdBQVcsRUFBRSxZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU87WUFDekMsZUFBZSxFQUFFLGVBQWUsQ0FBQyxDQUFDLENBQUMsZUFBZSxDQUFDLENBQUMsQ0FBQyxJQUFJLFVBQVUsRUFBRTtZQUNyRSxFQUFFLEVBQUUsRUFBRTtZQUNOLFNBQVMsRUFBRSxTQUFTO1lBQ3BCLFlBQVksRUFBRSxlQUFlLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUMxQyxlQUFlLEVBQUUsSUFBQSxpQkFBVSxFQUFDLGVBQWUsQ0FBQztZQUM1QyxRQUFRLEVBQUU7Z0JBQ1IsS0FBSyxFQUFFO29CQUNMLElBQUksRUFBRSx1QkFBdUI7b0JBQzdCLEtBQUssRUFBRSxFQUFFO2lCQUNWO2FBQ0Y7U0FDRixDQUNGLENBQUM7UUFFRiw4RUFBOEU7UUFDOUUsSUFBSSxxQkFBcUIsR0FBRyxNQUFNLGVBQWUsQ0FBQyxlQUFlLENBQy9ELHNCQUFzQixFQUN0QixlQUFlLEVBQ2YsWUFBWSxFQUNaLGFBQWEsRUFDYixnQkFBZ0IsQ0FDakIsQ0FBQztRQUVGLG1GQUFtRjtRQUNuRixJQUFJLGVBQWUsSUFBSSxnQkFBZ0IsRUFBRSxDQUFDO1lBQ3hDLE1BQU0sQ0FBQyxvQkFBb0IsQ0FBQyxHQUFHLE1BQU0sSUFBQSxrREFBNEIsRUFDL0QsQ0FBQyxxQkFBcUIsQ0FBQyxFQUN2QixnQkFBZ0IsQ0FDakIsQ0FBQztZQUNGLE9BQU8sb0JBQWtFLENBQUM7UUFDNUUsQ0FBQztRQUVELE9BQU8scUJBRWdELENBQUM7SUFDMUQsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLEtBQUssWUFBWSwrQkFBb0IsRUFBRSxDQUFDO1lBQzFDLE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztRQUNELE1BQU0sSUFBSSwrQkFBb0IsQ0FBQyxvQ0FBb0MsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUM5RSxDQUFDO0FBQ0gsQ0FBQyJ9

package/dist/cjs/attestedcompute/types.d.ts

@@ -0,0 +1,35 @@
+import type { DecryptionAttestation } from '../attesteddecrypt/types.js';
+import { HexString } from '../binary.js';
+import { EncryptionScheme, SupportedTeeType } from '../encryption/encryption.js';
+import { SupportedScalarBinaryOp } from '../generated/es/inco/kms/lite/v1/types_pb.js';
+import type { BackoffConfig } from '../retry.js';
+/**
+ * Supported attested compute operations.
+ */
+export declare const AttestedComputeSupportedOps: {
+    readonly Eq: SupportedScalarBinaryOp.TEE_EQ;
+    readonly Ne: SupportedScalarBinaryOp.TEE_NE;
+    readonly Ge: SupportedScalarBinaryOp.TEE_GE;
+    readonly Gt: SupportedScalarBinaryOp.TEE_GT;
+    readonly Le: SupportedScalarBinaryOp.TEE_LE;
+    readonly Lt: SupportedScalarBinaryOp.TEE_LT;
+};
+/**
+ * This type represents all the supported operations for attested compute.
+ */
+export type AttestedComputeOP = (typeof AttestedComputeSupportedOps)[keyof typeof AttestedComputeSupportedOps];
+/**
+ * Custom error class for attested compute operations.
+ */
+export declare class AttestedComputeError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+export type AttestedCompute<S extends EncryptionScheme> = <T extends SupportedTeeType>(args: AttestedComputeFnArgs<S, T>) => Promise<DecryptionAttestation<S, T>>;
+export type AttestedComputeFnArgs<S extends EncryptionScheme, T extends SupportedTeeType> = {
+    /** The handle to compute on */
+    lhsHandle: HexString;
+    op: AttestedComputeOP;
+    rhsPlaintext: bigint | boolean;
+    backoffConfig?: Partial<BackoffConfig>;
+};

package/dist/cjs/attestedcompute/types.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AttestedComputeError = exports.AttestedComputeSupportedOps = void 0;
+const types_pb_js_1 = require("../generated/es/inco/kms/lite/v1/types_pb.js");
+/**
+ * Supported attested compute operations.
+ */
+exports.AttestedComputeSupportedOps = {
+    /*
+    Add: SupportedScalarBinaryOp.TEE_ADD,
+    Sub: SupportedScalarBinaryOp.TEE_SUB,
+    Mul: SupportedScalarBinaryOp.TEE_MUL,
+    Div: SupportedScalarBinaryOp.TEE_DIV,
+    Rem: SupportedScalarBinaryOp.TEE_REM,
+    BitAnd: SupportedScalarBinaryOp.TEE_BIT_AND,
+    BitOr: SupportedScalarBinaryOp.TEE_BIT_OR,
+    BitXor: SupportedScalarBinaryOp.TEE_BIT_XOR,
+    Shl: SupportedScalarBinaryOp.TEE_SHL,
+    Shr: SupportedScalarBinaryOp.TEE_SHR,
+    Rotl: SupportedScalarBinaryOp.TEE_ROTL,
+    Rotr: SupportedScalarBinaryOp.TEE_ROTR,
+    */
+    Eq: types_pb_js_1.SupportedScalarBinaryOp.TEE_EQ,
+    Ne: types_pb_js_1.SupportedScalarBinaryOp.TEE_NE,
+    Ge: types_pb_js_1.SupportedScalarBinaryOp.TEE_GE,
+    Gt: types_pb_js_1.SupportedScalarBinaryOp.TEE_GT,
+    Le: types_pb_js_1.SupportedScalarBinaryOp.TEE_LE,
+    Lt: types_pb_js_1.SupportedScalarBinaryOp.TEE_LT,
+    /*
+    Min: SupportedScalarBinaryOp.TEE_MIN,
+    Max: SupportedScalarBinaryOp.TEE_MAX,
+    */
+};
+/**
+ * Custom error class for attested compute operations.
+ */
+class AttestedComputeError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = 'AttestedComputeError';
+    }
+}
+exports.AttestedComputeError = AttestedComputeError;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvYXR0ZXN0ZWRjb21wdXRlL3R5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQU1BLDhFQUF1RjtBQUd2Rjs7R0FFRztBQUNVLFFBQUEsMkJBQTJCLEdBQUc7SUFDekM7Ozs7Ozs7Ozs7Ozs7TUFhRTtJQUNGLEVBQUUsRUFBRSxxQ0FBdUIsQ0FBQyxNQUFNO0lBQ2xDLEVBQUUsRUFBRSxxQ0FBdUIsQ0FBQyxNQUFNO0lBQ2xDLEVBQUUsRUFBRSxxQ0FBdUIsQ0FBQyxNQUFNO0lBQ2xDLEVBQUUsRUFBRSxxQ0FBdUIsQ0FBQyxNQUFNO0lBQ2xDLEVBQUUsRUFBRSxxQ0FBdUIsQ0FBQyxNQUFNO0lBQ2xDLEVBQUUsRUFBRSxxQ0FBdUIsQ0FBQyxNQUFNO0lBQ2xDOzs7TUFHRTtDQUNNLENBQUM7QUFRWDs7R0FFRztBQUNILE1BQWEsb0JBQXFCLFNBQVEsS0FBSztJQUczQjtJQUZsQixZQUNFLE9BQWUsRUFDQyxLQUFlO1FBRS9CLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUZDLFVBQUssR0FBTCxLQUFLLENBQVU7UUFHL0IsSUFBSSxDQUFDLElBQUksR0FBRyxzQkFBc0IsQ0FBQztJQUNyQyxDQUFDO0NBQ0Y7QUFSRCxvREFRQyJ9

package/dist/cjs/attesteddecrypt/attested-decrypt.d.ts

@@ -0,0 +1,61 @@
+import type { Account, Chain, Transport, WalletClient } from 'viem';
+import { type HexString } from '../binary.js';
+import { type SupportedChainId } from '../chain.js';
+import { EncryptionScheme, type SupportedTeeType } from '../encryption/encryption.js';
+import { type HandleWithProof } from '../generated/es/inco/kms/lite/v1/types_pb.js';
+import { validateHandle } from '../handle.js';
+import { KmsQuorumClient } from '../kms/quorumClient.js';
+import type { XwingKeypair } from '../lite/xwing.js';
+import type { BackoffConfig } from '../retry.js';
+import { type DecryptionAttestation, type EncryptedDecryptionAttestation } from './types.js';
+export { validateHandle };
+export declare const ATTESTED_DECRYPT_DOMAIN_NAME = "IncoAttestedDecrypt";
+/**
+ * Arguments for creating an attested decrypt request.
+ */
+export interface IncoLiteAttestedDecryptorArgs {
+    /** The wallet used to interact with the blockchain and sign the decrypt request */
+    walletClient: WalletClient<Transport, Chain, Account>;
+    /** The KMS quorum client instance */
+    kmsQuorumClient: KmsQuorumClient;
+    /** The chain ID to use */
+    chainId: SupportedChainId;
+}
+/**
+ * Decrypt multiple handles in a single attested request.
+ * Returns an array of attestations aligned with the response ordering.
+ *
+ * @param args - The arguments for creating the attested decrypt function
+ * @returns A function that can decrypt handles and return an attestation
+ * @throws {AttestedDecryptError} If the creation fails
+ */
+export declare function attestedDecrypt({ handles, backoffConfig, walletClient, chainId, reencryptPubKey, reencryptKeypair, kmsQuorumClient, executorAddress, }: {
+    handles: HexString[];
+    backoffConfig?: Partial<BackoffConfig> | undefined;
+    walletClient: WalletClient<Transport, Chain, Account>;
+    chainId: SupportedChainId;
+    reencryptPubKey: Uint8Array;
+    reencryptKeypair: XwingKeypair;
+    kmsQuorumClient: KmsQuorumClient;
+    executorAddress: HexString;
+}): Promise<Array<DecryptionAttestation<EncryptionScheme, SupportedTeeType>>>;
+/**
+ * Decrypt multiple handles in a single attested request.
+ * Returns an array of attestations aligned with the response ordering.
+ *
+ * @param args - The arguments for creating the attested decrypt function
+ * @returns A function that can decrypt handles and return an attestation
+ * @throws {AttestedDecryptError} If the creation fails
+ */
+export declare function attestedDecrypt({ handles, backoffConfig, walletClient, chainId, reencryptPubKey, kmsQuorumClient, executorAddress, }: {
+    handles: HexString[];
+    backoffConfig?: Partial<BackoffConfig> | undefined;
+    walletClient: WalletClient<Transport, Chain, Account>;
+    chainId: SupportedChainId;
+    reencryptPubKey: Uint8Array;
+    reencryptKeypair?: never;
+    kmsQuorumClient: KmsQuorumClient;
+    executorAddress: HexString;
+}): Promise<Array<EncryptedDecryptionAttestation<EncryptionScheme, SupportedTeeType>>>;
+export declare function buildHandlesWithProofs(handles: HexString[]): Array<HandleWithProof>;
+export declare function decryptEncryptedAttestations(attestations: Array<DecryptionAttestation<EncryptionScheme, SupportedTeeType> | EncryptedDecryptionAttestation<EncryptionScheme, SupportedTeeType>>, reencryptKeypair: XwingKeypair): Promise<Array<DecryptionAttestation<EncryptionScheme, SupportedTeeType>>>;

package/dist/cjs/attesteddecrypt/attested-decrypt.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ATTESTED_DECRYPT_DOMAIN_NAME = exports.validateHandle = void 0;
+exports.attestedDecrypt = attestedDecrypt;
+exports.buildHandlesWithProofs = buildHandlesWithProofs;
+exports.decryptEncryptedAttestations = decryptEncryptedAttestations;
+const protobuf_1 = require("@bufbuild/protobuf");
+const viem_1 = require("viem");
+const binary_js_1 = require("../binary.js");
+const eip712_js_1 = require("../eip712/eip712.js");
+const encryption_js_1 = require("../encryption/encryption.js");
+const kms_service_pb_js_1 = require("../generated/es/inco/kms/lite/v1/kms_service_pb.js");
+const types_pb_js_1 = require("../generated/es/inco/kms/lite/v1/types_pb.js");
+const handle_js_1 = require("../handle.js");
+Object.defineProperty(exports, "validateHandle", { enumerable: true, get: function () { return handle_js_1.validateHandle; } });
+const xwing_js_1 = require("../lite/xwing.js");
+const types_js_1 = require("./types.js");
+exports.ATTESTED_DECRYPT_DOMAIN_NAME = 'IncoAttestedDecrypt';
+/**
+ * Decrypt multiple handles in a single attested request.
+ * Returns an array of attestations aligned with the response ordering.
+ *
+ * @param args - The arguments for creating the attested decrypt function
+ * @returns A function that can decrypt handles and return an attestation
+ * @throws {AttestedDecryptError} If the creation fails
+ */
+async function attestedDecrypt({ handles, backoffConfig, walletClient, chainId, reencryptPubKey, reencryptKeypair, kmsQuorumClient, executorAddress, }) {
+    try {
+        handles.forEach(handle_js_1.validateHandle);
+        if (!reencryptPubKey) {
+            throw new types_js_1.AttestedDecryptError('Reencrypt public key is required');
+        }
+        if (reencryptKeypair &&
+            !(0, xwing_js_1.reencryptPublicKeysMatch)(reencryptPubKey, reencryptKeypair)) {
+            throw new types_js_1.AttestedDecryptError('reencryptPubKey does not match reencryptKeypair public key');
+        }
+        const eip712Payload = await (0, eip712_js_1.buildEip712Payload)({
+            executorAddress,
+            ethClient: walletClient,
+            chainId,
+            handles,
+            reencryptPubKey,
+        });
+        const eip712SignatureHex = await (0, eip712_js_1.signEip712)(walletClient, eip712Payload);
+        const handlesWithProofs = buildHandlesWithProofs(handles);
+        const attestedDecryptRequest = buildAttestedDecryptRequest({
+            userAddress: walletClient.account.address,
+            handlesWithProofs,
+            eip712Signature: (0, viem_1.hexToBytes)(eip712SignatureHex),
+            reencryptPubKey,
+        });
+        // Call quorum client which returns aggregated attestations directly
+        // The quorum client handles retry logic internally for each KMS client
+        // Envelope signatures are verified against the on-chain authorized signer set
+        const response = await kmsQuorumClient.attestedDecrypt(attestedDecryptRequest, executorAddress, walletClient, backoffConfig, reencryptKeypair);
+        // If reencryptPubKey is provided with a keypair, decrypt the encrypted attestations
+        // and verify the inner DecryptionAttestation signatures
+        if (reencryptPubKey !== undefined && reencryptKeypair) {
+            return decryptEncryptedAttestations(response, reencryptKeypair);
+        }
+        return response;
+    }
+    catch (error) {
+        if (error instanceof types_js_1.AttestedDecryptError) {
+            throw error;
+        }
+        throw new types_js_1.AttestedDecryptError('Failed to decrypt handles', error);
+    }
+}
+function buildHandlesWithProofs(handles) {
+    return handles.map((handle) => {
+        return (0, protobuf_1.create)(types_pb_js_1.HandleWithProofSchema, {
+            handle: handle,
+            aclProof: {
+                proof: {
+                    case: 'incoLiteBasicAclProof',
+                    value: {},
+                },
+            },
+        });
+    });
+}
+function buildAttestedDecryptRequest(params) {
+    return (0, protobuf_1.create)(kms_service_pb_js_1.AttestedDecryptRequestSchema, {
+        userAddress: params.userAddress,
+        handlesWithProofs: params.handlesWithProofs,
+        eip712Signature: params.eip712Signature,
+        reencryptPubKey: params.reencryptPubKey ?? new Uint8Array(),
+    });
+}
+async function decryptEncryptedAttestations(attestations, reencryptKeypair) {
+    return Promise.all(attestations.map(async (att) => {
+        // If already a plaintext attestation, return as-is
+        if ('plaintext' in att && att.plaintext !== undefined) {
+            return att;
+        }
+        // Otherwise, decrypt the encrypted attestation
+        if ('encryptedPlaintext' in att && att.encryptedPlaintext !== undefined) {
+            const encryptedAtt = att;
+            const ct = (0, viem_1.hexToBytes)(encryptedAtt.encryptedPlaintext.ciphertext.value);
+            const plaintextBytes = await (0, xwing_js_1.decrypt)(reencryptKeypair, ct);
+            const bigIntValue = (0, binary_js_1.bytesToBigInt)(plaintextBytes);
+            const handleType = (0, handle_js_1.getHandleType)(encryptedAtt.handle);
+            // Decrypt the encrypted signatures (which are signatures for the original plaintext)
+            // The covalidatorSignatures are for the reencryption struct, not the plaintext
+            const decryptedSignatures = await Promise.all(encryptedAtt.encryptedSignatures.map(async (encryptedSig) => {
+                return await (0, xwing_js_1.decrypt)(reencryptKeypair, encryptedSig);
+            }));
+            return {
+                handle: encryptedAtt.handle,
+                plaintext: (0, encryption_js_1.bigintToPlaintext)(encryption_js_1.encryptionSchemes.xwing, handleType, bigIntValue),
+                covalidatorSignatures: decryptedSignatures,
+            };
+        }
+        throw new types_js_1.AttestedDecryptError('Attestation is neither plaintext nor encrypted');
+    }));
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXR0ZXN0ZWQtZGVjcnlwdC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9hdHRlc3RlZGRlY3J5cHQvYXR0ZXN0ZWQtZGVjcnlwdC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFpSEEsMENBbUZDO0FBRUQsd0RBY0M7QUFnQkQsb0VBa0RDO0FBdFJELGlEQUE0QztBQUU1QywrQkFBa0M7QUFDbEMsNENBQTZEO0FBRTdELG1EQUFxRTtBQUNyRSwrREFLcUM7QUFDckMsMEZBRzREO0FBQzVELDhFQUdzRDtBQUN0RCw0Q0FBNkQ7QUFVcEQsK0ZBVmUsMEJBQWMsT0FVZjtBQVB2QiwrQ0FBcUU7QUFFckUseUNBSW9CO0FBR1AsUUFBQSw0QkFBNEIsR0FBRyxxQkFBcUIsQ0FBQztBQXlFbEU7Ozs7Ozs7R0FPRztBQUNJLEtBQUssVUFBVSxlQUFlLENBQUMsRUFDcEMsT0FBTyxFQUNQLGFBQWEsRUFDYixZQUFZLEVBQ1osT0FBTyxFQUNQLGVBQWUsRUFDZixnQkFBZ0IsRUFDaEIsZUFBZSxFQUNmLGVBQWUsR0FVaEI7SUFNQyxJQUFJLENBQUM7UUFDSCxPQUFPLENBQUMsT0FBTyxDQUFDLDBCQUFjLENBQUMsQ0FBQztRQUVoQyxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7WUFDckIsTUFBTSxJQUFJLCtCQUFvQixDQUFDLGtDQUFrQyxDQUFDLENBQUM7UUFDckUsQ0FBQztRQUVELElBQ0UsZ0JBQWdCO1lBQ2hCLENBQUMsSUFBQSxtQ0FBd0IsRUFBQyxlQUFlLEVBQUUsZ0JBQWdCLENBQUMsRUFDNUQsQ0FBQztZQUNELE1BQU0sSUFBSSwrQkFBb0IsQ0FDNUIsNERBQTRELENBQzdELENBQUM7UUFDSixDQUFDO1FBRUQsTUFBTSxhQUFhLEdBQUcsTUFBTSxJQUFBLDhCQUFrQixFQUFDO1lBQzdDLGVBQWU7WUFDZixTQUFTLEVBQUUsWUFBWTtZQUN2QixPQUFPO1lBQ1AsT0FBTztZQUNQLGVBQWU7U0FDaEIsQ0FBQyxDQUFDO1FBRUgsTUFBTSxrQkFBa0IsR0FBRyxNQUFNLElBQUEsc0JBQVUsRUFBQyxZQUFZLEVBQUUsYUFBYSxDQUFDLENBQUM7UUFFekUsTUFBTSxpQkFBaUIsR0FBRyxzQkFBc0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUUxRCxNQUFNLHNCQUFzQixHQUFHLDJCQUEyQixDQUFDO1lBQ3pELFdBQVcsRUFBRSxZQUFZLENBQUMsT0FBTyxDQUFDLE9BQU87WUFDekMsaUJBQWlCO1lBQ2pCLGVBQWUsRUFBRSxJQUFBLGlCQUFVLEVBQUMsa0JBQWtCLENBQUM7WUFDL0MsZUFBZTtTQUNoQixDQUFDLENBQUM7UUFFSCxvRUFBb0U7UUFDcEUsdUVBQXVFO1FBQ3ZFLDhFQUE4RTtRQUM5RSxNQUFNLFFBQVEsR0FBRyxNQUFNLGVBQWUsQ0FBQyxlQUFlLENBQ3BELHNCQUFzQixFQUN0QixlQUFlLEVBQ2YsWUFBWSxFQUNaLGFBQWEsRUFDYixnQkFBZ0IsQ0FDakIsQ0FBQztRQUVGLG9GQUFvRjtRQUNwRix3REFBd0Q7UUFDeEQsSUFBSSxlQUFlLEtBQUssU0FBUyxJQUFJLGdCQUFnQixFQUFFLENBQUM7WUFDdEQsT0FBTyw0QkFBNEIsQ0FBQyxRQUFRLEVBQUUsZ0JBQWdCLENBQUMsQ0FBQztRQUNsRSxDQUFDO1FBRUQsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLEtBQUssWUFBWSwrQkFBb0IsRUFBRSxDQUFDO1lBQzFDLE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztRQUNELE1BQU0sSUFBSSwrQkFBb0IsQ0FBQywyQkFBMkIsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUNyRSxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQWdCLHNCQUFzQixDQUNwQyxPQUFvQjtJQUVwQixPQUFPLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRTtRQUM1QixPQUFPLElBQUEsaUJBQU0sRUFBQyxtQ0FBcUIsRUFBRTtZQUNuQyxNQUFNLEVBQUUsTUFBTTtZQUNkLFFBQVEsRUFBRTtnQkFDUixLQUFLLEVBQUU7b0JBQ0wsSUFBSSxFQUFFLHVCQUF1QjtvQkFDN0IsS0FBSyxFQUFFLEVBQUU7aUJBQ1Y7YUFDRjtTQUNGLENBQUMsQ0FBQztJQUNMLENBQUMsQ0FBQyxDQUFDO0FBQ0wsQ0FBQztBQUVELFNBQVMsMkJBQTJCLENBQUMsTUFLcEM7SUFDQyxPQUFPLElBQUEsaUJBQU0sRUFBQyxnREFBNEIsRUFBRTtRQUMxQyxXQUFXLEVBQUUsTUFBTSxDQUFDLFdBQVc7UUFDL0IsaUJBQWlCLEVBQUUsTUFBTSxDQUFDLGlCQUFpQjtRQUMzQyxlQUFlLEVBQUUsTUFBTSxDQUFDLGVBQWU7UUFDdkMsZUFBZSxFQUFFLE1BQU0sQ0FBQyxlQUFlLElBQUksSUFBSSxVQUFVLEVBQUU7S0FDNUQsQ0FBQyxDQUFDO0FBQ0wsQ0FBQztBQUVNLEtBQUssVUFBVSw0QkFBNEIsQ0FDaEQsWUFHQyxFQUNELGdCQUE4QjtJQUU5QixPQUFPLE9BQU8sQ0FBQyxHQUFHLENBQ2hCLFlBQVksQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLEdBQUcsRUFBRSxFQUFFO1FBQzdCLG1EQUFtRDtRQUNuRCxJQUFJLFdBQVcsSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLFNBQVMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN0RCxPQUFPLEdBQWdFLENBQUM7UUFDMUUsQ0FBQztRQUVELCtDQUErQztRQUMvQyxJQUFJLG9CQUFvQixJQUFJLEdBQUcsSUFBSSxHQUFHLENBQUMsa0JBQWtCLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDeEUsTUFBTSxZQUFZLEdBQUcsR0FHcEIsQ0FBQztZQUNGLE1BQU0sRUFBRSxHQUFHLElBQUEsaUJBQVUsRUFBQyxZQUFZLENBQUMsa0JBQWtCLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBRXhFLE1BQU0sY0FBYyxHQUFHLE1BQU0sSUFBQSxrQkFBTyxFQUFDLGdCQUFnQixFQUFFLEVBQUUsQ0FBQyxDQUFDO1lBQzNELE1BQU0sV0FBVyxHQUFHLElBQUEseUJBQWEsRUFBQyxjQUFjLENBQUMsQ0FBQztZQUNsRCxNQUFNLFVBQVUsR0FBRyxJQUFBLHlCQUFhLEVBQUMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBRXRELHFGQUFxRjtZQUNyRiwrRUFBK0U7WUFDL0UsTUFBTSxtQkFBbUIsR0FBRyxNQUFNLE9BQU8sQ0FBQyxHQUFHLENBQzNDLFlBQVksQ0FBQyxtQkFBbUIsQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLFlBQVksRUFBRSxFQUFFO2dCQUMxRCxPQUFPLE1BQU0sSUFBQSxrQkFBTyxFQUFDLGdCQUFnQixFQUFFLFlBQVksQ0FBQyxDQUFDO1lBQ3ZELENBQUMsQ0FBQyxDQUNILENBQUM7WUFFRixPQUFPO2dCQUNMLE1BQU0sRUFBRSxZQUFZLENBQUMsTUFBTTtnQkFDM0IsU0FBUyxFQUFFLElBQUEsaUNBQWlCLEVBQzFCLGlDQUFpQixDQUFDLEtBQUssRUFDdkIsVUFBOEIsRUFDOUIsV0FBVyxDQUNaO2dCQUNELHFCQUFxQixFQUFFLG1CQUFtQjthQUNrQixDQUFDO1FBQ2pFLENBQUM7UUFFRCxNQUFNLElBQUksK0JBQW9CLENBQzVCLGdEQUFnRCxDQUNqRCxDQUFDO0lBQ0osQ0FBQyxDQUFDLENBQ0gsQ0FBQztBQUNKLENBQUMifQ==

package/dist/cjs/attesteddecrypt/index.d.ts

@@ -0,0 +1 @@
+export * from './types.js';

package/dist/cjs/attesteddecrypt/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./types.js"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvYXR0ZXN0ZWRkZWNyeXB0L2luZGV4LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSw2Q0FBMkIifQ==

package/dist/cjs/attesteddecrypt/types.d.ts

@@ -0,0 +1,27 @@
+import type { HexString } from '../binary.js';
+import type { EncryptionScheme, EncryptResultOf, PlaintextOf, SupportedTeeType } from '../encryption/encryption.js';
+import type { BackoffConfig } from '../retry.js';
+/**
+ * Custom error class for attested decrypt operations.
+ */
+export declare class AttestedDecryptError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+export type DecryptionAttestation<S extends EncryptionScheme, T extends SupportedTeeType> = {
+    handle: HexString;
+    plaintext: PlaintextOf<S, T>;
+    covalidatorSignatures: Uint8Array[];
+};
+export type EncryptedDecryptionAttestation<S extends EncryptionScheme, T extends SupportedTeeType> = {
+    handle: HexString;
+    encryptedPlaintext: EncryptResultOf<S, T>;
+    encryptedSignatures: Uint8Array[];
+    covalidatorSignatures: Uint8Array[];
+};
+export type AttestedDecryptor<S extends EncryptionScheme> = <T extends SupportedTeeType>(args: AttestedDecryptFnArgs<S, T>) => Promise<DecryptionAttestation<S, T>>;
+export type AttestedDecryptFnArgs<S extends EncryptionScheme, T extends SupportedTeeType> = {
+    /** The handle to decrypt */
+    handle: HexString;
+    backoffConfig?: Partial<BackoffConfig>;
+};

package/dist/cjs/attesteddecrypt/types.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AttestedDecryptError = void 0;
+/**
+ * Custom error class for attested decrypt operations.
+ */
+class AttestedDecryptError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = 'AttestedDecryptError';
+    }
+}
+exports.AttestedDecryptError = AttestedDecryptError;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvYXR0ZXN0ZWRkZWNyeXB0L3R5cGVzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7OztBQVNBOztHQUVHO0FBQ0gsTUFBYSxvQkFBcUIsU0FBUSxLQUFLO0lBRzNCO0lBRmxCLFlBQ0UsT0FBZSxFQUNDLEtBQWU7UUFFL0IsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBRkMsVUFBSyxHQUFMLEtBQUssQ0FBVTtRQUcvQixJQUFJLENBQUMsSUFBSSxHQUFHLHNCQUFzQixDQUFDO0lBQ3JDLENBQUM7Q0FDRjtBQVJELG9EQVFDIn0=

package/dist/cjs/attestedreveal/attested-reveal.d.ts

@@ -0,0 +1,21 @@
+import type { Chain, PublicClient, Transport } from 'viem';
+import type { DecryptionAttestation } from '../attesteddecrypt/types.js';
+import type { HexString } from '../binary.js';
+import type { EncryptionScheme, SupportedTeeType } from '../encryption/encryption.js';
+import type { KmsQuorumClient } from '../kms/quorumClient.js';
+import type { BackoffConfig } from '../retry.js';
+/**
+ * Reveal multiple handles in a single attested request without wallet authentication.
+ * Returns an array of plaintext attestations aligned with the response ordering.
+ *
+ * @param args - The arguments for the attested reveal request
+ * @returns An array of decryption attestations
+ * @throws {AttestedRevealError} If the reveal fails
+ */
+export declare function attestedReveal({ handles, kmsQuorumClient, executorAddress, publicClient, backoffConfig, }: {
+    handles: HexString[];
+    kmsQuorumClient: KmsQuorumClient;
+    executorAddress: HexString;
+    publicClient: PublicClient<Transport, Chain>;
+    backoffConfig?: Partial<BackoffConfig> | undefined;
+}): Promise<Array<DecryptionAttestation<EncryptionScheme, SupportedTeeType>>>;

package/dist/cjs/attestedreveal/attested-reveal.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attestedReveal = attestedReveal;
+const protobuf_1 = require("@bufbuild/protobuf");
+const kms_service_pb_js_1 = require("../generated/es/inco/kms/lite/v1/kms_service_pb.js");
+const handle_js_1 = require("../handle.js");
+const types_js_1 = require("./types.js");
+/**
+ * Reveal multiple handles in a single attested request without wallet authentication.
+ * Returns an array of plaintext attestations aligned with the response ordering.
+ *
+ * @param args - The arguments for the attested reveal request
+ * @returns An array of decryption attestations
+ * @throws {AttestedRevealError} If the reveal fails
+ */
+async function attestedReveal({ handles, kmsQuorumClient, executorAddress, publicClient, backoffConfig, }) {
+    try {
+        handles.forEach(handle_js_1.validateHandle);
+        const attestedRevealRequest = (0, protobuf_1.create)(kms_service_pb_js_1.AttestedRevealRequestSchema, {
+            handles,
+        });
+        return (await kmsQuorumClient.attestedReveal(attestedRevealRequest, executorAddress, publicClient, backoffConfig));
+    }
+    catch (error) {
+        if (error instanceof types_js_1.AttestedRevealError) {
+            throw error;
+        }
+        throw new types_js_1.AttestedRevealError('Failed to reveal handles', error);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXR0ZXN0ZWQtcmV2ZWFsLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2F0dGVzdGVkcmV2ZWFsL2F0dGVzdGVkLXJldmVhbC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQXNCQSx3Q0FnQ0M7QUF0REQsaURBQTRDO0FBUTVDLDBGQUFpRztBQUNqRyw0Q0FBOEM7QUFHOUMseUNBQWlEO0FBRWpEOzs7Ozs7O0dBT0c7QUFDSSxLQUFLLFVBQVUsY0FBYyxDQUFDLEVBQ25DLE9BQU8sRUFDUCxlQUFlLEVBQ2YsZUFBZSxFQUNmLFlBQVksRUFDWixhQUFhLEdBT2Q7SUFDQyxJQUFJLENBQUM7UUFDSCxPQUFPLENBQUMsT0FBTyxDQUFDLDBCQUFjLENBQUMsQ0FBQztRQUVoQyxNQUFNLHFCQUFxQixHQUFHLElBQUEsaUJBQU0sRUFBQywrQ0FBMkIsRUFBRTtZQUNoRSxPQUFPO1NBQ1IsQ0FBQyxDQUFDO1FBRUgsT0FBTyxDQUFDLE1BQU0sZUFBZSxDQUFDLGNBQWMsQ0FDMUMscUJBQXFCLEVBQ3JCLGVBQWUsRUFDZixZQUFZLEVBQ1osYUFBYSxDQUNkLENBQXFFLENBQUM7SUFDekUsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixJQUFJLEtBQUssWUFBWSw4QkFBbUIsRUFBRSxDQUFDO1lBQ3pDLE1BQU0sS0FBSyxDQUFDO1FBQ2QsQ0FBQztRQUNELE1BQU0sSUFBSSw4QkFBbUIsQ0FBQywwQkFBMEIsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUNuRSxDQUFDO0FBQ0gsQ0FBQyJ9

package/dist/cjs/attestedreveal/index.d.ts

@@ -0,0 +1,2 @@
+export { attestedReveal } from './attested-reveal.js';
+export * from './types.js';

package/dist/cjs/attestedreveal/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attestedReveal = void 0;
+var attested_reveal_js_1 = require("./attested-reveal.js");
+Object.defineProperty(exports, "attestedReveal", { enumerable: true, get: function () { return attested_reveal_js_1.attestedReveal; } });
+__exportStar(require("./types.js"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvYXR0ZXN0ZWRyZXZlYWwvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwyREFBc0Q7QUFBN0Msb0hBQUEsY0FBYyxPQUFBO0FBQ3ZCLDZDQUEyQiJ9

package/dist/cjs/attestedreveal/types.d.ts

@@ -0,0 +1,4 @@
+export declare class AttestedRevealError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}

package/dist/cjs/attestedreveal/types.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AttestedRevealError = void 0;
+class AttestedRevealError extends Error {
+    cause;
+    constructor(message, cause) {
+        super(message);
+        this.cause = cause;
+        this.name = 'AttestedRevealError';
+    }
+}
+exports.AttestedRevealError = AttestedRevealError;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvYXR0ZXN0ZWRyZXZlYWwvdHlwZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsTUFBYSxtQkFBb0IsU0FBUSxLQUFLO0lBRzFCO0lBRmxCLFlBQ0UsT0FBZSxFQUNDLEtBQWU7UUFFL0IsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBRkMsVUFBSyxHQUFMLEtBQUssQ0FBVTtRQUcvQixJQUFJLENBQUMsSUFBSSxHQUFHLHFCQUFxQixDQUFDO0lBQ3BDLENBQUM7Q0FDRjtBQVJELGtEQVFDIn0=

package/dist/cjs/binary.d.ts

@@ -0,0 +1,104 @@
+import { Schema } from 'effect';
+import { Hex } from 'viem';
+/** Schema for a `0x`-prefixed hex string. */
+export declare const HexString: Schema.TemplateLiteral<`0x${string}`>;
+/** A `0x`-prefixed hex-encoded string (e.g. `"0xdeadbeef"`). */
+export type HexString = typeof HexString.Type;
+/** A value that can represent raw bytes — either a hex string or a `Uint8Array`. */
+export type BytesIsh = string | Uint8Array;
+/**
+ * Converts a `Uint8Array` to a `bigint`. Returns `0n` for empty arrays.
+ * @param byteArray - The byte array to convert.
+ * @returns The unsigned big-endian integer representation of the bytes.
+ */
+export declare function bytesToBigInt(byteArray: Uint8Array): bigint;
+/**
+ * Converts a `Buffer` to a `bigint`.
+ * @param buffer - The buffer to convert.
+ * @returns The unsigned big-endian integer representation of the buffer.
+ */
+export declare function bufferToBigInt(buffer: Buffer): bigint;
+/**
+ * Converts a `bigint` to a 32-byte `Buffer`, zero-padded on the left.
+ * @param value - The bigint to convert.
+ * @returns A 32-byte big-endian buffer.
+ * @throws If the bigint is negative or too large to fit in 32 bytes.
+ */
+export declare function bigintToBytes(value: bigint): Buffer;
+/**
+ * Converts a `bigint` to a {@link Bytes32} hex string, left-padded to 32 bytes.
+ * @param value - The bigint to convert.
+ * @returns A `Bytes32` hex string.
+ * @throws If the bigint is negative or too large to fit in 32 bytes.
+ */
+export declare function bigintToBytes32(value: bigint): Bytes32;
+/**
+ * Left-pads a byte array with zeros to the specified length.
+ * @param bs - The byte array to pad.
+ * @param n - The desired total length in bytes.
+ * @returns A new `Buffer` of length `n` with `bs` right-aligned.
+ * @throws If `bs` is longer than `n` (would require truncation).
+ */
+export declare function padLeft(bs: Uint8Array, n: number): Buffer;
+/**
+ * Parses a {@link BytesIsh} value as a 32-byte value and converts it to a `bigint`.
+ * @param bs - A hex string or `Uint8Array` representing exactly 32 bytes.
+ * @returns The `bigint` representation of the 32-byte value.
+ * @throws If the input is not exactly 32 bytes.
+ */
+export declare function bytes32ToBigint(bs: BytesIsh): bigint;
+/**
+ * Decodes a hex string into a `Buffer`. Handles both `0x`-prefixed and bare hex strings.
+ * @param hexString - The hex string to decode.
+ * @returns A `Buffer` containing the decoded bytes.
+ */
+export declare function bytesFromHexString(hexString: string): Buffer;
+/**
+ * Asserts that a string is a valid `0x`-prefixed hex string and narrows its type to `Hex`.
+ * @param value - The string to validate.
+ * @returns The input typed as `Hex`.
+ * @throws If `value` is not a valid hex string.
+ */
+export declare function mustBeHex(value: string): Hex;
+/**
+ * Normalises a string to a `0x`-prefixed `Hex` value, adding the prefix if missing.
+ * @param value - A hex string, with or without a `0x` prefix.
+ * @returns The `0x`-prefixed `Hex` string.
+ * @throws If the resulting string is not valid hex.
+ */
+export declare function normaliseToHex(value: string): Hex;
+/**
+ * Encodes a `Uint8Array` as a `0x`-prefixed hex string.
+ * @param bs - The byte array to encode.
+ * @returns A `Hex` string representation of the bytes.
+ */
+export declare function bytesToHex(bs: Uint8Array): Hex;
+/** Schema for a 32-byte (66-character with `0x` prefix) hex string, branded as `Bytes32`. Accepts both hex strings and `Uint8Array` inputs. */
+export declare const Bytes32: Schema.brand<Schema.filter<Schema.transformOrFail<Schema.Union<[typeof Schema.String, Schema.refine<object & Uint8Array<ArrayBufferLike>, Schema.Schema<object, object, never>>]>, Schema.TemplateLiteral<`0x${string}`>, never>>, "Bytes32">;
+/**
+ * Parses and validates a {@link BytesIsh} value as a {@link Bytes32}.
+ * @param x - A hex string or `Uint8Array` to parse.
+ * @returns A validated `Bytes32` value.
+ * @throws If the input is not exactly 32 bytes.
+ */
+export declare function asBytes32(x: BytesIsh): Bytes32;
+/** A branded 32-byte hex string type (`0x` + 64 hex characters). */
+export type Bytes32 = typeof Bytes32.Type;
+/** A branded 20-byte Ethereum address type (`0x` + 40 hex characters). */
+export type Address = typeof Address.Type;
+/** Schema for a 20-byte `0x`-prefixed Ethereum address, branded as `Address`. */
+export declare const Address: Schema.brand<Schema.filter<Schema.TemplateLiteral<`0x${string}`>>, "Address">;
+/**
+ * Parses and validates a string as an Ethereum {@link Address} (20-byte, `0x`-prefixed).
+ * @param address - The string to parse.
+ * @returns A validated `Address` value.
+ * @throws If the input is not a valid 20-byte hex address.
+ */
+export declare function parseAddress(address: string): Address;
+/**
+ * Parses and validates a string as a {@link HexString} (`0x`-prefixed).
+ * @param hex - The string to parse.
+ * @returns A validated `HexString` value.
+ * @throws If the input is not a valid `0x`-prefixed hex string.
+ */
+export declare function parseHex(hex: string): HexString;