@nucypher/taco 0.7.0-alpha.2 → 0.7.0-dev.viem

package/dist/cjs/taco.js

@@ -1,101 +1,43 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decrypt = exports.encryptWithPublicKey = exports.encrypt = void 0;
+exports.encrypt = encrypt;
+exports.encryptWithPublicKey = encryptWithPublicKey;
+exports.decrypt = decrypt;
 const nucypher_core_1 = require("@nucypher/nucypher-core");
 const shared_1 = require("@nucypher/shared");
-const utils_1 = require("ethers/lib/utils");
-const condition_expr_1 = require("./conditions/condition-expr");
-const dkg_1 = require("./dkg");
-const tdec_1 = require("./tdec");
-/**
- * Encrypts a message under given conditions using a public key from an active DKG ritual.
- *
- * @export
- * @param {ethers.providers.Provider} provider - Instance of ethers provider which is used to interact with
- * your selected network.
- * @param {Domain} domain - Represents the logical network in which the encryption will be performed.
- * Must match the `ritualId`.
- * @param {Uint8Array | string} message  - The message to be encrypted.
- * @param {Condition} condition - Condition under which the message will be encrypted. Those conditions must be
- * satisfied in order to decrypt the message.
- * @param {number} ritualId - The ID of the DKG Ritual to be used for encryption. The message will be encrypted
- * under the public key of this ritual.
- * @param {ethers.Signer} authSigner - The signer that will be used to sign the encrypter authorization.
- *
- * @returns {Promise<ThresholdMessageKit>} Returns Promise that resolves with an instance of ThresholdMessageKit.
- * It represents the encrypted message.
- *
- * @throws {Error} If the active DKG Ritual cannot be retrieved an error is thrown.
- */
-const encrypt = async (provider, domain, message, condition, ritualId, authSigner) => {
-    // TODO(#264): Enable ritual initialization
-    // if (ritualId === undefined) {
-    //   ritualId = await DkgClient.initializeRitual(
-    //     provider,
-    //     this.cohort.ursulaAddresses,
-    //     true
-    //   );
-    // }
-    // if (ritualId === undefined) {
-    //   // Given that we just initialized the ritual, this should never happen
-    //   throw new Error('Ritual ID is undefined');
-    // }
-    const dkgRitual = await dkg_1.DkgClient.getActiveRitual(provider, domain, ritualId);
-    return await (0, exports.encryptWithPublicKey)(message, condition, dkgRitual.dkgPublicKey, authSigner);
-};
-exports.encrypt = encrypt;
-/**
- * Encrypts a message with the given DKG public key under a specified condition.
- *
- * @export
- * @param {Uint8Array | string} message  - The message to be encrypted.
- * @param {Condition} condition - Condition under which the message will be encrypted. Those conditions must be
- * satisfied in order to decrypt the message.
- * @param {DkgPublicKey} dkgPublicKey - The public key of an active DKG Ritual to be used for encryption
- * @param {ethers.Signer} authSigner - The signer that will be used to sign the encrypter authorization.
- *
- * @returns {Promise<ThresholdMessageKit>} Returns Promise that resolves with an instance of ThresholdMessageKit.
- * It represents the encrypted message.
- *
- * @throws {Error} If the encryption process throws an error, an error is thrown.
- */
-const encryptWithPublicKey = async (message, condition, dkgPublicKey, authSigner) => {
+const ethers_1 = require("ethers");
+const condition_expr_js_1 = require("./conditions/condition-expr.js");
+const dkg_js_1 = require("./dkg.js");
+const tdec_js_1 = require("./tdec.js");
+async function encrypt(providerLike, domain, message, condition, ritualId, signerLike) {
+    // Create TACo provider and signer adapters from viem objects
+    const providerAdapter = (0, shared_1.toEthersProvider)(providerLike);
+    const dkgRitual = await dkg_js_1.DkgClient.getActiveRitual(providerAdapter, domain, ritualId);
+    return await encryptWithPublicKey(message, condition, dkgRitual.dkgPublicKey, 
+    // Casting is needed because with the function definition of encryptWithPublicKey,
+    // this param can be either a Signer or a viem signer account. But not a type that is the union of both.
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    signerLike);
+}
+async function encryptWithPublicKey(message, condition, dkgPublicKey, signerLike) {
     if (typeof message === 'string') {
         message = (0, shared_1.toBytes)(message);
     }
-    const conditionExpr = new condition_expr_1.ConditionExpression(condition);
+    const signer = (0, shared_1.toTacoSigner)(signerLike);
+    const conditionExpr = new condition_expr_js_1.ConditionExpression(condition);
     const [ciphertext, authenticatedData] = (0, nucypher_core_1.encryptForDkg)(message, dkgPublicKey, conditionExpr.toCoreCondition());
-    const headerHash = (0, utils_1.keccak256)(ciphertext.header.toBytes());
-    const authorization = await authSigner.signMessage((0, shared_1.fromHexString)(headerHash));
+    const headerHash = ethers_1.ethers.utils.keccak256(ciphertext.header.toBytes());
+    const authorization = await signer.signMessage((0, shared_1.fromHexString)(headerHash));
     const acp = new nucypher_core_1.AccessControlPolicy(authenticatedData, (0, shared_1.fromHexString)(authorization));
     return new nucypher_core_1.ThresholdMessageKit(ciphertext, acp);
-};
-exports.encryptWithPublicKey = encryptWithPublicKey;
-/**
- * Decrypts an encrypted message.
- *
- * @export
- * @param {ethers.providers.Provider} provider - Instance of ethers provider which is used to interact with
- * your selected network.
- * @param {Domain} domain - Represents the logical network in which the decryption will be performed.
- * Must match the `ritualId`.
- * @param {ThresholdMessageKit} messageKit - The kit containing the message to be decrypted
- * @param {ConditionContext} context - Optional context data used for decryption time values for the condition(s) within the `messageKit`.
- * @param {string[]} [porterUris] - Optional URI(s) for the Porter service. If not provided, a value will be obtained
- * from the Domain
- *
- * @returns {Promise<Uint8Array>} Returns Promise that resolves with a decrypted message
- *
- * @throws {Error} If the active DKG Ritual cannot be retrieved or decryption process throws an error,
- * an error is thrown.
- */
-const decrypt = async (provider, domain, messageKit, context, porterUris) => {
+}
+async function decrypt(providerLike, domain, messageKit, context, porterUris) {
     const porterUrisFull = porterUris
         ? porterUris
         : await (0, shared_1.getPorterUris)(domain);
     const porter = new shared_1.PorterClient(porterUrisFull);
-    const ritualId = await shared_1.DkgCoordinatorAgent.getRitualIdFromPublicKey(provider, domain, messageKit.acp.publicKey);
-    return (0, tdec_1.retrieveAndDecrypt)(provider, domain, porter, messageKit, ritualId, context);
-};
-exports.decrypt = decrypt;
+    const providerAdapter = (0, shared_1.toEthersProvider)(providerLike);
+    const ritualId = await shared_1.DkgCoordinatorAgent.getRitualIdFromPublicKey(providerAdapter, domain, messageKit.acp.publicKey);
+    return (0, tdec_js_1.retrieveAndDecrypt)(providerAdapter, domain, porter, messageKit, ritualId, context);
+}
 //# sourceMappingURL=taco.js.map

package/dist/cjs/taco.js.map

@@ -1 +1 @@
-{"version":3,"file":"taco.js","sourceRoot":"","sources":["../../src/taco.ts"],"names":[],"mappings":";;;AAAA,2DAKiC;AACjC,6CAO0B;AAE1B,4CAA6C;AAG7C,gEAAkE;AAElE,+BAAkC;AAClC,iCAA4C;AAE5C;;;;;;;;;;;;;;;;;;;GAmBG;AACI,MAAM,OAAO,GAAG,KAAK,EAC1B,QAAmC,EACnC,MAAc,EACd,OAA4B,EAC5B,SAAoB,EACpB,QAAgB,EAChB,UAAyB,EACK,EAAE;IAChC,2CAA2C;IAC3C,gCAAgC;IAChC,iDAAiD;IACjD,gBAAgB;IAChB,mCAAmC;IACnC,WAAW;IACX,OAAO;IACP,IAAI;IACJ,gCAAgC;IAChC,2EAA2E;IAC3E,+CAA+C;IAC/C,IAAI;IACJ,MAAM,SAAS,GAAG,MAAM,eAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE9E,OAAO,MAAM,IAAA,4BAAoB,EAC/B,OAAO,EACP,SAAS,EACT,SAAS,CAAC,YAAY,EACtB,UAAU,CACX,CAAC;AACJ,CAAC,CAAC;AA5BW,QAAA,OAAO,WA4BlB;AAEF;;;;;;;;;;;;;;GAcG;AACI,MAAM,oBAAoB,GAAG,KAAK,EACvC,OAA4B,EAC5B,SAAoB,EACpB,YAA0B,EAC1B,UAAyB,EACK,EAAE;IAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,GAAG,IAAA,gBAAO,EAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,oCAAmB,CAAC,SAAS,CAAC,CAAC;IAEzD,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,GAAG,IAAA,6BAAa,EACnD,OAAO,EACP,YAAY,EACZ,aAAa,CAAC,eAAe,EAAE,CAChC,CAAC;IAEF,MAAM,UAAU,GAAG,IAAA,iBAAS,EAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,IAAA,sBAAa,EAAC,UAAU,CAAC,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,IAAI,mCAAmB,CACjC,iBAAiB,EACjB,IAAA,sBAAa,EAAC,aAAa,CAAC,CAC7B,CAAC;IAEF,OAAO,IAAI,mCAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC,CAAC;AA1BW,QAAA,oBAAoB,wBA0B/B;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACI,MAAM,OAAO,GAAG,KAAK,EAC1B,QAAmC,EACnC,MAAc,EACd,UAA+B,EAC/B,OAA0B,EAC1B,UAAqB,EACA,EAAE;IACvB,MAAM,cAAc,GAAa,UAAU;QACzC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,MAAM,IAAA,sBAAa,EAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,qBAAY,CAAC,cAAc,CAAC,CAAC;IAEhD,MAAM,QAAQ,GAAG,MAAM,4BAAmB,CAAC,wBAAwB,CACjE,QAAQ,EACR,MAAM,EACN,UAAU,CAAC,GAAG,CAAC,SAAS,CACzB,CAAC;IACF,OAAO,IAAA,yBAAkB,EACvB,QAAQ,EACR,MAAM,EACN,MAAM,EACN,UAAU,EACV,QAAQ,EACR,OAAO,CACR,CAAC;AACJ,CAAC,CAAC;AAzBW,QAAA,OAAO,WAyBlB"}
+{"version":3,"file":"taco.js","sourceRoot":"","sources":["../../src/taco.ts"],"names":[],"mappings":";;AAkFA,0BA0BC;AA0CD,oDA4BC;AA8CD,0BA2BC;AA3PD,2DAKiC;AACjC,6CAa0B;AAC1B,mCAAgC;AAEhC,sEAAqE;AAGrE,qCAAqC;AACrC,uCAA+C;AAwDxC,KAAK,UAAU,OAAO,CAC3B,YAA0B,EAC1B,MAAc,EACd,OAA4B,EAC5B,SAAoB,EACpB,QAAgB,EAChB,UAAsB;IAEtB,6DAA6D;IAC7D,MAAM,eAAe,GAAG,IAAA,yBAAgB,EAAC,YAAY,CAAC,CAAC;IAEvD,MAAM,SAAS,GAAG,MAAM,kBAAS,CAAC,eAAe,CAC/C,eAAe,EACf,MAAM,EACN,QAAQ,CACT,CAAC;IAEF,OAAO,MAAM,oBAAoB,CAC/B,OAAO,EACP,SAAS,EACT,SAAS,CAAC,YAAY;IACtB,kFAAkF;IAClF,wGAAwG;IACxG,8DAA8D;IAC9D,UAAiB,CAClB,CAAC;AACJ,CAAC;AA0CM,KAAK,UAAU,oBAAoB,CACxC,OAA4B,EAC5B,SAAoB,EACpB,YAA0B,EAC1B,UAAsB;IAEtB,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,GAAG,IAAA,gBAAO,EAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,UAAU,CAAC,CAAC;IAExC,MAAM,aAAa,GAAG,IAAI,uCAAmB,CAAC,SAAS,CAAC,CAAC;IAEzD,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,GAAG,IAAA,6BAAa,EACnD,OAAO,EACP,YAAY,EACZ,aAAa,CAAC,eAAe,EAAE,CAChC,CAAC;IAEF,MAAM,UAAU,GAAG,eAAM,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,IAAA,sBAAa,EAAC,UAAU,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,mCAAmB,CACjC,iBAAiB,EACjB,IAAA,sBAAa,EAAC,aAAa,CAAC,CAC7B,CAAC;IAEF,OAAO,IAAI,mCAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AA8CM,KAAK,UAAU,OAAO,CAC3B,YAA0B,EAC1B,MAAc,EACd,UAA+B,EAC/B,OAA0B,EAC1B,UAAqB;IAErB,MAAM,cAAc,GAAa,UAAU;QACzC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,MAAM,IAAA,sBAAa,EAAC,MAAM,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,IAAI,qBAAY,CAAC,cAAc,CAAC,CAAC;IAEhD,MAAM,eAAe,GAAG,IAAA,yBAAgB,EAAC,YAAY,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,MAAM,4BAAmB,CAAC,wBAAwB,CACjE,eAAe,EACf,MAAM,EACN,UAAU,CAAC,GAAG,CAAC,SAAS,CACzB,CAAC;IACF,OAAO,IAAA,4BAAkB,EACvB,eAAe,EACf,MAAM,EACN,MAAM,EACN,UAAU,EACV,QAAQ,EACR,OAAO,CACR,CAAC;AACJ,CAAC"}

package/dist/cjs/tdec.d.ts

@@ -1,7 +1,7 @@
 import { DkgPublicKey, ThresholdMessageKit } from '@nucypher/nucypher-core';
 import { Domain, PorterClient } from '@nucypher/shared';
 import { ethers } from 'ethers';
-import { ConditionExpression } from './conditions/condition-expr';
-import { ConditionContext } from './conditions/context';
+import { ConditionExpression } from './conditions/condition-expr.js';
+import { ConditionContext } from './conditions/context/index.js';
 export declare const encryptMessage: (plaintext: Uint8Array | string, encryptingKey: DkgPublicKey, conditions: ConditionExpression, authSigner: ethers.Signer) => Promise<ThresholdMessageKit>;
 export declare const retrieveAndDecrypt: (provider: ethers.providers.Provider, domain: Domain, porter: PorterClient, thresholdMessageKit: ThresholdMessageKit, ritualId: number, context?: ConditionContext) => Promise<Uint8Array>;

package/dist/cjs/tdec.js

@@ -3,15 +3,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.retrieveAndDecrypt = exports.encryptMessage = void 0;
 const nucypher_core_1 = require("@nucypher/nucypher-core");
 const shared_1 = require("@nucypher/shared");
-const utils_1 = require("ethers/lib/utils");
-const context_1 = require("./conditions/context");
-const dkg_1 = require("./dkg");
+const ethers_1 = require("ethers");
+const index_js_1 = require("./conditions/context/index.js");
+const dkg_js_1 = require("./dkg.js");
 const ERR_DECRYPTION_FAILED = (errors) => `Threshold of responses not met; TACo decryption failed with errors: ${JSON.stringify(errors)}`;
 const ERR_RITUAL_ID_MISMATCH = (expectedRitualId, ritualIds) => `Ritual id mismatch. Expected ${expectedRitualId}, got ${ritualIds}`;
 const encryptMessage = async (plaintext, encryptingKey, conditions, authSigner) => {
     const [ciphertext, authenticatedData] = (0, nucypher_core_1.encryptForDkg)(plaintext instanceof Uint8Array ? plaintext : (0, shared_1.toBytes)(plaintext), encryptingKey, conditions.toCoreCondition());
-    const headerHash = (0, utils_1.keccak256)(ciphertext.header.toBytes());
-    const authorization = await authSigner.signMessage((0, utils_1.arrayify)(headerHash));
+    const headerHash = ethers_1.ethers.utils.keccak256(ciphertext.header.toBytes());
+    const authorization = await authSigner.signMessage(ethers_1.ethers.utils.arrayify(headerHash));
     const acp = new nucypher_core_1.AccessControlPolicy(authenticatedData, (0, shared_1.toBytes)(authorization));
     return new nucypher_core_1.ThresholdMessageKit(ciphertext, acp);
 };
@@ -25,11 +25,11 @@ const retrieveAndDecrypt = async (provider, domain, porter, thresholdMessageKit,
 exports.retrieveAndDecrypt = retrieveAndDecrypt;
 // Retrieve decryption shares
 const retrieve = async (provider, domain, porter, thresholdMessageKit, ritualId, context) => {
-    const ritual = await dkg_1.DkgClient.getActiveRitual(provider, domain, ritualId);
+    const ritual = await dkg_js_1.DkgClient.getActiveRitual(provider, domain, ritualId);
     const dkgParticipants = await shared_1.DkgCoordinatorAgent.getParticipants(provider, domain, ritualId, ritual.sharesNum);
     const conditionContext = context
         ? context
-        : context_1.ConditionContext.fromMessageKit(thresholdMessageKit);
+        : index_js_1.ConditionContext.fromMessageKit(thresholdMessageKit);
     const { sharedSecrets, encryptedRequests } = await makeDecryptionRequests(ritualId, conditionContext, dkgParticipants, thresholdMessageKit);
     const { encryptedResponses, errors } = await porter.tacoDecrypt(encryptedRequests, ritual.threshold);
     if (Object.keys(encryptedResponses).length < ritual.threshold) {

package/dist/cjs/tdec.js.map

@@ -1 +1 @@
-{"version":3,"file":"tdec.js","sourceRoot":"","sources":["../../src/tdec.ts"],"names":[],"mappings":";;;AAAA,2DAaiC;AACjC,6CAM0B;AAE1B,4CAAuD;AAGvD,kDAAwD;AACxD,+BAAkC;AAElC,MAAM,qBAAqB,GAAG,CAAC,MAAe,EAAE,EAAE,CAChD,uEAAuE,IAAI,CAAC,SAAS,CACnF,MAAM,CACP,EAAE,CAAC;AACN,MAAM,sBAAsB,GAAG,CAC7B,gBAAwB,EACxB,SAAmB,EACnB,EAAE,CAAC,gCAAgC,gBAAgB,SAAS,SAAS,EAAE,CAAC;AAEnE,MAAM,cAAc,GAAG,KAAK,EACjC,SAA8B,EAC9B,aAA2B,EAC3B,UAA+B,EAC/B,UAAyB,EACK,EAAE;IAChC,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,GAAG,IAAA,6BAAa,EACnD,SAAS,YAAY,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,gBAAO,EAAC,SAAS,CAAC,EAChE,aAAa,EACb,UAAU,CAAC,eAAe,EAAE,CAC7B,CAAC;IAEF,MAAM,UAAU,GAAG,IAAA,iBAAS,EAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1D,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,IAAA,gBAAQ,EAAC,UAAU,CAAC,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,mCAAmB,CACjC,iBAAiB,EACjB,IAAA,gBAAO,EAAC,aAAa,CAAC,CACvB,CAAC;IAEF,OAAO,IAAI,mCAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC,CAAC;AApBW,QAAA,cAAc,kBAoBzB;AAEF,0EAA0E;AACnE,MAAM,kBAAkB,GAAG,KAAK,EACrC,QAAmC,EACnC,MAAc,EACd,MAAoB,EACpB,mBAAwC,EACxC,QAAgB,EAChB,OAA0B,EACL,EAAE;IACvB,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CACrC,QAAQ,EACR,MAAM,EACN,MAAM,EACN,mBAAmB,EACnB,QAAQ,EACR,OAAO,CACR,CAAC;IACF,MAAM,YAAY,GAAG,IAAA,6CAA6B,EAAC,gBAAgB,CAAC,CAAC;IACrE,OAAO,mBAAmB,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;AACnE,CAAC,CAAC;AAlBW,QAAA,kBAAkB,sBAkB7B;AAEF,6BAA6B;AAC7B,MAAM,QAAQ,GAAG,KAAK,EACpB,QAAmC,EACnC,MAAc,EACd,MAAoB,EACpB,mBAAwC,EACxC,QAAgB,EAChB,OAA0B,EACQ,EAAE;IACpC,MAAM,MAAM,GAAG,MAAM,eAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE3E,MAAM,eAAe,GAAG,MAAM,4BAAmB,CAAC,eAAe,CAC/D,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,MAAM,CAAC,SAAS,CACjB,CAAC;IACF,MAAM,gBAAgB,GAAG,OAAO;QAC9B,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,0BAAgB,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;IAEzD,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,MAAM,sBAAsB,CACvE,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,mBAAmB,CACpB,CAAC;IAEF,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAC7D,iBAAiB,EACjB,MAAM,CAAC,SAAS,CACjB,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,oBAAoB,CAAC,kBAAkB,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;AAC3E,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,kBAAwE,EACxE,mBAAwD,EACxD,gBAAwB,EACxB,EAAE;IACF,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAC/D,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACtE,CAAC;IAEF,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IACrE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,gBAAgB,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,CACpD,qCAAqB,CAAC,SAAS,CAAC,eAAe,CAAC,CACjD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,KAAK,EAClC,QAAgB,EAChB,gBAAkC,EAClC,eAAsC,EACtC,mBAAwC,EAIvC,EAAE;IACH,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE,CAAC;IAC3D,MAAM,iBAAiB,GAAG,IAAI,0CAA0B,CACtD,QAAQ,EACR,6BAAa,CAAC,MAAM,EACpB,mBAAmB,CAAC,gBAAgB,EACpC,mBAAmB,CAAC,GAAG,EACvB,WAAW,CACZ,CAAC;IAEF,MAAM,mBAAmB,GAAG,cAAc,EAAE,CAAC;IAE7C,8CAA8C;IAC9C,MAAM,aAAa,GAAwC,MAAM,CAAC,WAAW,CAC3E,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,0BAA0B,EAAE,EAAE,EAAE;QAC/D,MAAM,YAAY,GAAG,mBAAmB,CAAC,kBAAkB,CACzD,0BAA0B,CAC3B,CAAC;QACF,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClC,CAAC,CAAC,CACH,CAAC;IAEF,iDAAiD;IACjD,MAAM,iBAAiB,GACrB,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,mBAAmB,CAAC,EAAE,EAAE;QACpE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAChD,mBAAmB,EACnB,mBAAmB,CAAC,SAAS,EAAE,CAChC,CAAC;QACF,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACtC,CAAC,CAAC,CACH,CAAC;IAEJ,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;AAC9C,CAAC,CAAC;AAEF,0DAA0D;AAC1D,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,mCAAmB,CAAC,MAAM,EAAE,CAAC"}
+{"version":3,"file":"tdec.js","sourceRoot":"","sources":["../../src/tdec.ts"],"names":[],"mappings":";;;AAAA,2DAaiC;AACjC,6CAM0B;AAC1B,mCAAgC;AAGhC,4DAAiE;AACjE,qCAAqC;AAErC,MAAM,qBAAqB,GAAG,CAAC,MAAe,EAAE,EAAE,CAChD,uEAAuE,IAAI,CAAC,SAAS,CACnF,MAAM,CACP,EAAE,CAAC;AACN,MAAM,sBAAsB,GAAG,CAC7B,gBAAwB,EACxB,SAAmB,EACnB,EAAE,CAAC,gCAAgC,gBAAgB,SAAS,SAAS,EAAE,CAAC;AAEnE,MAAM,cAAc,GAAG,KAAK,EACjC,SAA8B,EAC9B,aAA2B,EAC3B,UAA+B,EAC/B,UAAyB,EACK,EAAE;IAChC,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,GAAG,IAAA,6BAAa,EACnD,SAAS,YAAY,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,gBAAO,EAAC,SAAS,CAAC,EAChE,aAAa,EACb,UAAU,CAAC,eAAe,EAAE,CAC7B,CAAC;IAEF,MAAM,UAAU,GAAG,eAAM,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACvE,MAAM,aAAa,GAAG,MAAM,UAAU,CAAC,WAAW,CAChD,eAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAClC,CAAC;IACF,MAAM,GAAG,GAAG,IAAI,mCAAmB,CACjC,iBAAiB,EACjB,IAAA,gBAAO,EAAC,aAAa,CAAC,CACvB,CAAC;IAEF,OAAO,IAAI,mCAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC,CAAC;AAtBW,QAAA,cAAc,kBAsBzB;AAEF,0EAA0E;AACnE,MAAM,kBAAkB,GAAG,KAAK,EACrC,QAAmC,EACnC,MAAc,EACd,MAAoB,EACpB,mBAAwC,EACxC,QAAgB,EAChB,OAA0B,EACL,EAAE;IACvB,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CACrC,QAAQ,EACR,MAAM,EACN,MAAM,EACN,mBAAmB,EACnB,QAAQ,EACR,OAAO,CACR,CAAC;IACF,MAAM,YAAY,GAAG,IAAA,6CAA6B,EAAC,gBAAgB,CAAC,CAAC;IACrE,OAAO,mBAAmB,CAAC,uBAAuB,CAAC,YAAY,CAAC,CAAC;AACnE,CAAC,CAAC;AAlBW,QAAA,kBAAkB,sBAkB7B;AAEF,6BAA6B;AAC7B,MAAM,QAAQ,GAAG,KAAK,EACpB,QAAmC,EACnC,MAAc,EACd,MAAoB,EACpB,mBAAwC,EACxC,QAAgB,EAChB,OAA0B,EACQ,EAAE;IACpC,MAAM,MAAM,GAAG,MAAM,kBAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAE3E,MAAM,eAAe,GAAG,MAAM,4BAAmB,CAAC,eAAe,CAC/D,QAAQ,EACR,MAAM,EACN,QAAQ,EACR,MAAM,CAAC,SAAS,CACjB,CAAC;IACF,MAAM,gBAAgB,GAAG,OAAO;QAC9B,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,2BAAgB,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;IAEzD,MAAM,EAAE,aAAa,EAAE,iBAAiB,EAAE,GAAG,MAAM,sBAAsB,CACvE,QAAQ,EACR,gBAAgB,EAChB,eAAe,EACf,mBAAmB,CACpB,CAAC;IAEF,MAAM,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAC7D,iBAAiB,EACjB,MAAM,CAAC,SAAS,CACjB,CAAC;IACF,IAAI,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,oBAAoB,CAAC,kBAAkB,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;AAC3E,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAC3B,kBAAwE,EACxE,mBAAwD,EACxD,gBAAwB,EACxB,EAAE;IACF,MAAM,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAC/D,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CACtE,CAAC;IAEF,MAAM,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;IACrE,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,gBAAgB,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE,CACpD,qCAAqB,CAAC,SAAS,CAAC,eAAe,CAAC,CACjD,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,KAAK,EAClC,QAAgB,EAChB,gBAAkC,EAClC,eAAsC,EACtC,mBAAwC,EAIvC,EAAE;IACH,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,aAAa,EAAE,CAAC;IAC3D,MAAM,iBAAiB,GAAG,IAAI,0CAA0B,CACtD,QAAQ,EACR,6BAAa,CAAC,MAAM,EACpB,mBAAmB,CAAC,gBAAgB,EACpC,mBAAmB,CAAC,GAAG,EACvB,WAAW,CACZ,CAAC;IAEF,MAAM,mBAAmB,GAAG,cAAc,EAAE,CAAC;IAE7C,8CAA8C;IAC9C,MAAM,aAAa,GAAwC,MAAM,CAAC,WAAW,CAC3E,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,0BAA0B,EAAE,EAAE,EAAE;QAC/D,MAAM,YAAY,GAAG,mBAAmB,CAAC,kBAAkB,CACzD,0BAA0B,CAC3B,CAAC;QACF,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IAClC,CAAC,CAAC,CACH,CAAC;IAEF,iDAAiD;IACjD,MAAM,iBAAiB,GACrB,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,mBAAmB,CAAC,EAAE,EAAE;QACpE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,OAAO,CAChD,mBAAmB,EACnB,mBAAmB,CAAC,SAAS,EAAE,CAChC,CAAC;QACF,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC;IACtC,CAAC,CAAC,CACH,CAAC;IAEJ,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC;AAC9C,CAAC,CAAC;AAEF,0DAA0D;AAC1D,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC,mCAAmB,CAAC,MAAM,EAAE,CAAC"}

package/dist/cjs/types.d.ts

@@ -1,2 +1 @@
 export { Conditions as CoreConditions, Context as CoreContext, } from '@nucypher/nucypher-core';
-export type { UserOperation } from '@nucypher/shared';

package/dist/es/access-client/client.d.ts

@@ -0,0 +1,237 @@
+import { DkgPublicKey, ThresholdMessageKit } from '@nucypher/nucypher-core';
+import { SignerAccount } from '@nucypher/shared';
+import { ethers } from 'ethers';
+import { Condition } from '../conditions/condition.js';
+import { ConditionContext } from '../conditions/context/index.js';
+import { type AccessClientConfig } from './config.js';
+/**
+ * AccessClient provides an object-oriented interface for TACo cryptographic operations
+ *
+ * This class encapsulates TACo access-control configuration and provides simplified methods
+ * for encryption and decryption operations. It handles configuration validation,
+ * automatic WASM initialization, and provides enhanced error messages.
+ *
+ * @example Using with viem:
+ * ```typescript
+ * import { AccessClient, DOMAIN_NAMES } from '@nucypher/taco';
+ * import { createPublicClient, http } from 'viem';
+ * import { polygonAmoy } from 'viem/chains';
+ * import { privateKeyToAccount } from 'viem/accounts';
+ *
+ * // Create viem client and account
+ * const viemClient = createPublicClient({
+ *   chain: polygonAmoy,
+ *   transport: http()
+ * });
+ * const viemAccount = privateKeyToAccount('0x...');
+ *
+ * // Create AccessClient - WASM initializes automatically
+ * const accessClient = new AccessClient({
+ *   domain: DOMAIN_NAMES.TESTNET, // 'tapir'
+ *   ritualId: 6,
+ *   viemClient
+ * });
+ *
+ * // Pass signer to encrypt operation
+ * const messageKit = await accessClient.encrypt('Hello, secret!', condition, viemAccount);
+ * // Decrypt doesn't require signer
+ * const decrypted = await accessClient.decrypt(messageKit, conditionContext);
+ * ```
+ *
+ * @example Using with ethers.js:
+ * ```typescript
+ * import { AccessClient, DOMAIN_NAMES } from '@nucypher/taco';
+ * import { ethers } from 'ethers';
+ *
+ * // Create ethers provider and signer
+ * const ethersProvider = new ethers.providers.JsonRpcProvider('https://rpc-amoy.polygon.technology');
+ * const ethersSigner = new ethers.Wallet('0x...', ethersProvider);
+ *
+ * // Create AccessClient - WASM initializes automatically
+ * const accessClient = new AccessClient({
+ *   domain: DOMAIN_NAMES.TESTNET,
+ *   ritualId: 6,
+ *   ethersProvider
+ * });
+ *
+ * // Pass signer to encrypt operation
+ * const messageKit = await accessClient.encrypt('Hello, secret!', condition, ethersSigner);
+ * // Decrypt doesn't require signer
+ * const decrypted = await accessClient.decrypt(messageKit, conditionContext);
+ * ```
+ */
+export declare class AccessClient {
+    private config;
+    private static initializationPromise;
+    /**
+     * Initialize TACo WASM globally (singleton pattern)
+     *
+     * This method ensures TACo WASM is initialized exactly once across all AccessClient instances.
+     * Initialization happens automatically when creating clients or calling operations, but you can
+     * call this explicitly for performance optimization or error handling.
+     *
+     * @returns {Promise<void>} Promise that resolves when TACo WASM is initialized
+     *
+     * @example
+     * ```typescript
+     * // Optional: Pre-initialize for better performance
+     * await AccessClient.initialize();
+     *
+     * // All AccessClient instances share the same initialization
+     * const client1 = new AccessClient(config1);
+     * const client2 = new AccessClient(config2);
+     *
+     * // Operations automatically wait for initialization
+     * const encrypted = await client1.encrypt(data, condition);
+     * ```
+     */
+    static initialize(): Promise<void>;
+    /**
+     * Create a new AccessClient instance
+     *
+     * @param {AccessClientConfig} config - Configuration for the AccessClient
+     * @throws {Error} If configuration is invalid
+     */
+    constructor(config: AccessClientConfig);
+    /**
+     * Fully validate the configuration including network provider checks
+     *
+     * This method performs comprehensive validation including:
+     * - Domain and ritual ID validation
+     * - Provider/signer configuration validation
+     * - Network compatibility check (calls provider to verify chain ID matches domain)
+     *
+     * @returns {Promise<ValidationResult>} Promise resolving to validation result with isValid boolean and errors array
+     * @throws {Error} If configuration validation fails
+     *
+     * @example
+     * ```typescript
+     * try {
+     *   await accessClient.validateConfig();
+     *   console.log('Configuration is valid.');
+     * } catch (error) {
+     *   console.error('Configuration validation failed:', error.message);
+     * }
+     * ```
+     */
+    validateConfig(): Promise<void>;
+    /**
+     * Encrypt data with the given access condition.
+     *
+     * Use this overload when your application uses ethers.js.
+     *
+     * @export
+     * @param {string | Uint8Array} data - String or Uint8Array to encrypt
+     * @param {Condition} accessCondition - Access condition (single or composite) that must be satisfied at decryption time.
+     * @param {ethers.Signer} authSigner - Signer used to identify encryptor and verify authorization.
+     *
+     * @returns {Promise<ThresholdMessageKit>} Encrypted message kit representing the ciphertext and associated metadata.
+     *
+     * @throws {Error} If the ritual cannot be retrieved or encryption fails.
+     *
+     * @example
+     * ```typescript
+     * const messageKit = await accessClient.encrypt('Hello, secret!', condition, authSigner);
+     * ```
+     */
+    encrypt(data: string | Uint8Array, accessCondition: Condition, authSigner: ethers.Signer): Promise<ThresholdMessageKit>;
+    /**
+     * Encrypt data with the given access condition.
+     *
+     * Use this overload when your application uses viem.
+     *
+     * @export
+     * @param {string | Uint8Array} data - String or Uint8Array to encrypt
+     * @param {Condition} accessCondition - Access condition (single or composite) that must be satisfied at decryption time.
+     * @param {SignerAccount} authAccount - Viem account used to identify encryptor and verify authorization.
+     *
+     * @returns {Promise<ThresholdMessageKit>} Encrypted message kit representing the ciphertext and associated metadata.
+     *
+     * @throws {Error} If the ritual cannot be retrieved or encryption fails.
+     * @example
+     * ```typescript
+     * const messageKit = await accessClient.encrypt('Hello, secret!', condition, authAccount);
+     * ```
+     */
+    encrypt(data: string | Uint8Array, accessCondition: Condition, authAccount: SignerAccount): Promise<ThresholdMessageKit>;
+    /**
+     * Encrypt data with a provided DKG public key under a specified condition
+     *
+     * This method can be used offline since it doesn't require network access to fetch
+     * the DKG public key (unlike the `encrypt` method which fetches it from the ritual).
+     *
+     * Use this overload when your application uses ethers.js.
+     *
+     * @export
+     * @param {string | Uint8Array} data - String or Uint8Array to encrypt
+     * @param {Condition} condition - Access condition (single or composite) that must be satisfied at decryption time.
+     * @param {DkgPublicKey} dkgPublicKey - The public key of an active DKG Ritual to be used for encryption
+     * @param {ethers.Signer} authSigner - ethers.Signer used to identify encryptor and verify authorization.
+     *
+     * @returns {Promise<ThresholdMessageKit>} Encrypted message kit representing the ciphertext and associated metadata.
+     *
+     * @throws {Error} If encryption fails
+     *
+     * @example
+     * ```typescript
+     * // Get DKG public key from ritual or cache
+     * const dkgPublicKey = await getDkgPublicKey(domain, ritualId);
+     *
+     * // Encrypt offline using the public key
+     * const messageKit = await accessClient.encryptWithPublicKey('Hello, secret!', condition, dkgPublicKey, authSigner);
+     * ```
+     */
+    encryptWithPublicKey(data: Uint8Array | string, condition: Condition, dkgPublicKey: DkgPublicKey, authSigner: ethers.Signer): Promise<ThresholdMessageKit>;
+    /**
+     * Encrypt data with a provided DKG public key under a specified condition
+     *
+     * This method can be used offline since it doesn't require network access to fetch
+     * the DKG public key (unlike the `encrypt` method which fetches it from the ritual).
+     *
+     * Use this overload when your application uses viem.
+     *
+     * @export
+     * @param {string | Uint8Array} data - String or Uint8Array to encrypt
+     * @param {Condition} condition - Access condition (single or composite) that must be satisfied at decryption time.
+     * @param {DkgPublicKey} dkgPublicKey - The public key of an active DKG Ritual to be used for encryption
+     * @param {SignerAccount} authAccount - Viem signer account used to identify encryptor and verify authorization.
+     *
+     * @returns {Promise<ThresholdMessageKit>} Encrypted message kit representing the ciphertext and associated metadata.
+     *
+     * @throws {Error} If encryption fails
+     *
+     * @example
+     * ```typescript
+     * // Get DKG public key from ritual or cache
+     * const dkgPublicKey = await getDkgPublicKey(domain, ritualId);
+     *
+     * // Encrypt offline using the public key
+     * const messageKit = await accessClient.encryptWithPublicKey('Hello, secret!', condition, dkgPublicKey, authAccount);
+     * ```
+     */
+    encryptWithPublicKey(data: Uint8Array | string, condition: Condition, dkgPublicKey: DkgPublicKey, authAccount: SignerAccount): Promise<ThresholdMessageKit>;
+    /**
+     * Decrypt data using TACo
+     *
+     * @param {ThresholdMessageKit | Uint8Array} encryptedData - Either a ThresholdMessageKit or encrypted bytes (Uint8Array)
+     * @param {ConditionContext} [conditionContext] - Optional condition context for time-based conditions
+     * @returns {Promise<Uint8Array>} Decrypted data
+     * @throws {Error} If decryption fails
+     *
+     * @example
+     * ```typescript
+     * // With messageKit
+     * const decrypted = await accessClient.decrypt(messageKit, conditionContext);
+     *
+     * // With encrypted bytes
+     * const decrypted = await accessClient.decrypt(encryptedBytes, conditionContext);
+     * ```
+     */
+    decrypt(encryptedData: ThresholdMessageKit | Uint8Array, conditionContext?: ConditionContext): Promise<Uint8Array>;
+    /**
+     * Get current client configuration
+     *
+     * @returns {Readonly<AccessClientConfig>} Client configuration
+     */
+    getConfig(): Readonly<AccessClientConfig>;
+}

package/dist/es/access-client/client.js

@@ -0,0 +1,192 @@
+import { initialize, ThresholdMessageKit, } from '@nucypher/nucypher-core';
+import { decrypt, encrypt, encryptWithPublicKey } from '../taco.js';
+import { AccessConfigValidator } from './config-validator.js';
+/**
+ * AccessClient provides an object-oriented interface for TACo cryptographic operations
+ *
+ * This class encapsulates TACo access-control configuration and provides simplified methods
+ * for encryption and decryption operations. It handles configuration validation,
+ * automatic WASM initialization, and provides enhanced error messages.
+ *
+ * @example Using with viem:
+ * ```typescript
+ * import { AccessClient, DOMAIN_NAMES } from '@nucypher/taco';
+ * import { createPublicClient, http } from 'viem';
+ * import { polygonAmoy } from 'viem/chains';
+ * import { privateKeyToAccount } from 'viem/accounts';
+ *
+ * // Create viem client and account
+ * const viemClient = createPublicClient({
+ *   chain: polygonAmoy,
+ *   transport: http()
+ * });
+ * const viemAccount = privateKeyToAccount('0x...');
+ *
+ * // Create AccessClient - WASM initializes automatically
+ * const accessClient = new AccessClient({
+ *   domain: DOMAIN_NAMES.TESTNET, // 'tapir'
+ *   ritualId: 6,
+ *   viemClient
+ * });
+ *
+ * // Pass signer to encrypt operation
+ * const messageKit = await accessClient.encrypt('Hello, secret!', condition, viemAccount);
+ * // Decrypt doesn't require signer
+ * const decrypted = await accessClient.decrypt(messageKit, conditionContext);
+ * ```
+ *
+ * @example Using with ethers.js:
+ * ```typescript
+ * import { AccessClient, DOMAIN_NAMES } from '@nucypher/taco';
+ * import { ethers } from 'ethers';
+ *
+ * // Create ethers provider and signer
+ * const ethersProvider = new ethers.providers.JsonRpcProvider('https://rpc-amoy.polygon.technology');
+ * const ethersSigner = new ethers.Wallet('0x...', ethersProvider);
+ *
+ * // Create AccessClient - WASM initializes automatically
+ * const accessClient = new AccessClient({
+ *   domain: DOMAIN_NAMES.TESTNET,
+ *   ritualId: 6,
+ *   ethersProvider
+ * });
+ *
+ * // Pass signer to encrypt operation
+ * const messageKit = await accessClient.encrypt('Hello, secret!', condition, ethersSigner);
+ * // Decrypt doesn't require signer
+ * const decrypted = await accessClient.decrypt(messageKit, conditionContext);
+ * ```
+ */
+export class AccessClient {
+    config;
+    static initializationPromise;
+    /**
+     * Initialize TACo WASM globally (singleton pattern)
+     *
+     * This method ensures TACo WASM is initialized exactly once across all AccessClient instances.
+     * Initialization happens automatically when creating clients or calling operations, but you can
+     * call this explicitly for performance optimization or error handling.
+     *
+     * @returns {Promise<void>} Promise that resolves when TACo WASM is initialized
+     *
+     * @example
+     * ```typescript
+     * // Optional: Pre-initialize for better performance
+     * await AccessClient.initialize();
+     *
+     * // All AccessClient instances share the same initialization
+     * const client1 = new AccessClient(config1);
+     * const client2 = new AccessClient(config2);
+     *
+     * // Operations automatically wait for initialization
+     * const encrypted = await client1.encrypt(data, condition);
+     * ```
+     */
+    static async initialize() {
+        if (!AccessClient.initializationPromise) {
+            AccessClient.initializationPromise = (async () => {
+                try {
+                    await initialize();
+                }
+                catch (error) {
+                    console.error(`TACo initialization failed: ${error}`);
+                    throw error; // Re-throw to maintain error propagation
+                }
+            })();
+        }
+        return AccessClient.initializationPromise;
+    }
+    /**
+     * Create a new AccessClient instance
+     *
+     * @param {AccessClientConfig} config - Configuration for the AccessClient
+     * @throws {Error} If configuration is invalid
+     */
+    constructor(config) {
+        // Validate configuration using AccessConfig
+        const result = AccessConfigValidator.validateFast(config);
+        if (!result.isValid) {
+            throw new Error(`Invalid configuration: ${result.errors.join(', ')}`);
+        }
+        this.config = config;
+        AccessClient.initialize();
+    }
+    /**
+     * Fully validate the configuration including network provider checks
+     *
+     * This method performs comprehensive validation including:
+     * - Domain and ritual ID validation
+     * - Provider/signer configuration validation
+     * - Network compatibility check (calls provider to verify chain ID matches domain)
+     *
+     * @returns {Promise<ValidationResult>} Promise resolving to validation result with isValid boolean and errors array
+     * @throws {Error} If configuration validation fails
+     *
+     * @example
+     * ```typescript
+     * try {
+     *   await accessClient.validateConfig();
+     *   console.log('Configuration is valid.');
+     * } catch (error) {
+     *   console.error('Configuration validation failed:', error.message);
+     * }
+     * ```
+     */
+    async validateConfig() {
+        const validationResult = await AccessConfigValidator.validate(this.config);
+        if (!validationResult.isValid) {
+            throw new Error(`Invalid configuration: ${validationResult.errors.join(', ')}`);
+        }
+    }
+    async encrypt(data, accessCondition, signerLike) {
+        await AccessClient.initialize();
+        const messageKit = await encrypt(this.config.ethersProvider ||
+            this.config.viemClient, this.config.domain, data, accessCondition, this.config.ritualId, 
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        signerLike);
+        return messageKit;
+    }
+    async encryptWithPublicKey(data, accessCondition, dkgPublicKey, signerLike) {
+        await AccessClient.initialize();
+        const messageKit = await encryptWithPublicKey(data, accessCondition, dkgPublicKey, 
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        signerLike);
+        return messageKit;
+    }
+    /**
+     * Decrypt data using TACo
+     *
+     * @param {ThresholdMessageKit | Uint8Array} encryptedData - Either a ThresholdMessageKit or encrypted bytes (Uint8Array)
+     * @param {ConditionContext} [conditionContext] - Optional condition context for time-based conditions
+     * @returns {Promise<Uint8Array>} Decrypted data
+     * @throws {Error} If decryption fails
+     *
+     * @example
+     * ```typescript
+     * // With messageKit
+     * const decrypted = await accessClient.decrypt(messageKit, conditionContext);
+     *
+     * // With encrypted bytes
+     * const decrypted = await accessClient.decrypt(encryptedBytes, conditionContext);
+     * ```
+     */
+    async decrypt(encryptedData, conditionContext) {
+        await AccessClient.initialize();
+        // Handle both messageKit and encrypted bytes
+        const messageKit = encryptedData instanceof ThresholdMessageKit
+            ? encryptedData
+            : ThresholdMessageKit.fromBytes(encryptedData);
+        const decrypted = await decrypt(this.config.ethersProvider ||
+            this.config.viemClient, this.config.domain, messageKit, conditionContext, this.config.porterUris);
+        return decrypted;
+    }
+    /**
+     * Get current client configuration
+     *
+     * @returns {Readonly<AccessClientConfig>} Client configuration
+     */
+    getConfig() {
+        return Object.freeze({ ...this.config });
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/es/access-client/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/access-client/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,UAAU,EACV,mBAAmB,GACpB,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAO9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AACH,MAAM,OAAO,YAAY;IACf,MAAM,CAAqB;IAC3B,MAAM,CAAC,qBAAqB,CAAgB;IAEpD;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,MAAM,CAAC,KAAK,CAAC,UAAU;QACrB,IAAI,CAAC,YAAY,CAAC,qBAAqB,EAAE,CAAC;YACxC,YAAY,CAAC,qBAAqB,GAAG,CAAC,KAAK,IAAI,EAAE;gBAC/C,IAAI,CAAC;oBACH,MAAM,UAAU,EAAE,CAAC;gBACrB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;oBACtD,MAAM,KAAK,CAAC,CAAC,yCAAyC;gBACxD,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;QACP,CAAC;QACD,OAAO,YAAY,CAAC,qBAAqB,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,YAAY,MAA0B;QACpC,4CAA4C;QAC5C,MAAM,MAAM,GAAG,qBAAqB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,YAAY,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,gBAAgB,GAAG,MAAM,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3E,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,0BAA0B,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC/D,CAAC;QACJ,CAAC;IACH,CAAC;IAmDD,KAAK,CAAC,OAAO,CACX,IAAyB,EACzB,eAA0B,EAC1B,UAAsB;QAEtB,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC;QAEhC,MAAM,UAAU,GAAG,MAAM,OAAO,CAC7B,IAAI,CAAC,MAAmC,CAAC,cAAc;YACrD,IAAI,CAAC,MAAiC,CAAC,UAAU,EACpD,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,IAAI,EACJ,eAAe,EACf,IAAI,CAAC,MAAM,CAAC,QAAQ;QACpB,8DAA8D;QAC9D,UAAiB,CAClB,CAAC;QAEF,OAAO,UAAU,CAAC;IACpB,CAAC;IAsED,KAAK,CAAC,oBAAoB,CACxB,IAAyB,EACzB,eAA0B,EAC1B,YAA0B,EAC1B,UAAsB;QAEtB,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC;QAEhC,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAC3C,IAAI,EACJ,eAAe,EACf,YAAY;QACZ,8DAA8D;QAC9D,UAAiB,CAClB,CAAC;QAEF,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,OAAO,CACX,aAA+C,EAC/C,gBAAmC;QAEnC,MAAM,YAAY,CAAC,UAAU,EAAE,CAAC;QAEhC,6CAA6C;QAC7C,MAAM,UAAU,GACd,aAAa,YAAY,mBAAmB;YAC1C,CAAC,CAAC,aAAa;YACf,CAAC,CAAC,mBAAmB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;QAEnD,MAAM,SAAS,GAAG,MAAM,OAAO,CAC5B,IAAI,CAAC,MAAmC,CAAC,cAAc;YACrD,IAAI,CAAC,MAAiC,CAAC,UAAU,EACpD,IAAI,CAAC,MAAM,CAAC,MAAM,EAClB,UAAU,EACV,gBAAgB,EAChB,IAAI,CAAC,MAAM,CAAC,UAAU,CACvB,CAAC;QAEF,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,SAAS;QACP,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,CAAC;CACF"}