@zama-fhe/sdk 3.0.1 → 3.1.0-alpha.2

package/dist/cjs/web/index.cjs

@@ -0,0 +1,515 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require(`../validation.cjs`),t=require(`../assertions.cjs`);let n=require(`zod/mini`);var r=class{#e=null;async ensureInit(){return this.#e||=this.init().catch(e=>{throw this.#e=null,e}),this.#e}resetInit(){this.#e=null}async getAclAddress(){return this.chain.aclContractAddress}};const i=n.z.object({artifactUrl:n.z.optional(n.z.string()),etag:n.z.optional(n.z.string()),lastModified:n.z.optional(n.z.string()),lastValidatedAt:n.z._default(n.z.optional(n.z.number().check(n.z.nonnegative())),0)}),a=n.z.extend(i,{publicKeyId:n.z.string(),publicKey:n.z.string()}),o=n.z.extend(i,{publicParamsId:n.z.string(),publicParams:n.z.string()}),s=n.z.array(n.z.int().check(n.z.nonnegative())),c=n.z.object({status:n.z.literal(`succeeded`),response:n.z.object({fheKeyInfo:n.z.array(n.z.object({fhePublicKey:n.z.object({urls:n.z.array(n.z.string()).check(n.z.minLength(1))})})).check(n.z.minLength(1)),crs:n.z.record(n.z.string(),n.z.object({urls:n.z.array(n.z.string()).check(n.z.minLength(1))}))})}),l=8192,u=300*1e3;function d(e){let t=[];for(let n=0;n<e.length;n+=l)t.push(String.fromCharCode(...e.subarray(n,n+l)));return btoa(t.join(``))}function f(e){let t;try{t=atob(e)}catch{throw Error(`Invalid base64 data (length: ${e.length})`)}if(t.length===0)throw Error(`Decoded artifact is empty`);let n=new Uint8Array(t.length);for(let e=0;e<t.length;e++)n[e]=t.charCodeAt(e);return n}function p(e){return`fhe:pubkey:${e}`}function m(e,t){return`fhe:params:${e}:${t}`}function h(e){return`fhe:params-index:${e}`}var g=class{#e;#t;#n;#r;#i;#a;#o=new Map;#s=null;#c=new Map;#l=null;#u=null;constructor(e){this.#e=e.storage,this.#t=e.chainId,this.#n=e.relayerUrl,this.#r=(e.ttl??86400)*1e3,this.#i=e.logger??console}async getPublicKey(e){if(this.#a!==void 0)return this.#a;if(this.#s)return this.#s;this.#s=this.#d(e);try{return await this.#s}finally{this.#s=null}}async#d(e){let n=p(this.#t),r=await this.#g(n,a,`public key`,`Failed to read public key from persistent storage, falling back to network fetch`);if(r)try{let e={publicKeyId:r.publicKeyId,publicKey:f(r.publicKey)};return this.#a=e,e}catch(e){await this.#y(n,`public key`,{error:t.s(e).message})}let i=await e();if(i===null)return null;this.#a=i;try{let e={publicKeyId:i.publicKeyId,publicKey:d(i.publicKey),lastValidatedAt:Date.now()};await this.#e.set(n,e)}catch(e){this.#i.warn(`Failed to persist public key to storage`,{chainId:this.#t,error:t.s(e).message})}return i}async getPublicParams(e,t){let n=this.#o.get(e);if(n!==void 0)return n;let r=this.#c.get(e);if(r)return r;let i=this.#f(e,t);this.#c.set(e,i);try{return await i}finally{this.#c.delete(e)}}async#f(e,n){let r=m(this.#t,e),i=await this.#g(r,o,`params`,`Failed to read public params from persistent storage, falling back to network fetch`,{bits:e});if(i)try{let t={publicParamsId:i.publicParamsId,publicParams:f(i.publicParams)};return this.#o.set(e,t),t}catch(n){await this.#y(r,`params`,{bits:e,error:t.s(n).message})}let a=await n();if(a===null)return null;this.#o.set(e,a);try{let t={publicParamsId:a.publicParamsId,publicParams:d(a.publicParams),lastValidatedAt:Date.now()};await this.#e.set(r,t);let n=h(this.#t),i=await this.#v(`Failed to read params index from storage`);i.includes(e)||await this.#e.set(n,[...i,e])}catch(n){this.#i.warn(`Failed to persist public params to storage`,{chainId:this.#t,bits:e,error:t.s(n).message})}return a}async revalidateIfDue(){if(this.#l)return this.#l;this.#l=this.#p();try{return await this.#l}finally{this.#l=null}}async#p(){let e=Date.now();if(this.#u!==null&&e-this.#u<this.#r||!this.#n)return!1;let r=p(this.#t),i=null,o=[];try{let[s,l]=await Promise.all([this.#e.get(r),this.#h()]);if(s!=null&&(i=await this.#_(r,s,a,`public key`)),o=l,!i)return!1;if([i,...o.map(e=>e.data)].every(t=>e-t.lastValidatedAt<this.#r))return this.#u=e,!1;let d=await globalThis.fetch(`${this.#n}/keyurl`);if(!d.ok){let t=e-this.#r+u;return this.#i.warn(`Manifest fetch failed during revalidation, retrying in 5 min`,{status:d.status,relayerUrl:this.#n}),await this.#S(r,{...i,lastValidatedAt:t},o.map(e=>({...e,data:{...e.data,lastValidatedAt:t}}))),this.#u=t,!1}let f=c.safeParse(await d.json());if(!f.success){this.#i.error(`Relayer manifest has unexpected shape — check relayer URL and API version`,{relayerUrl:this.#n,error:n.z.prettifyError(f.error)});let t=e-this.#r+u;return await this.#S(r,{...i,lastValidatedAt:t},o.map(e=>({...e,data:{...e.data,lastValidatedAt:t}}))),this.#u=t,!1}let p=f.data.response,m=p.fheKeyInfo[0];t.r(m,`manifest.response.fheKeyInfo[0]`);let h=m.fhePublicKey.urls[0];if(i.artifactUrl&&h&&h!==i.artifactUrl)return await this.#x(r,o),this.#u=null,!0;let g={...i,lastValidatedAt:e};if(h){let e=await this.#m(h,i);if(!e.fresh)return await this.#x(r,o),this.#u=null,!0;g={...g,artifactUrl:h,etag:e.etag,lastModified:e.lastModified}}let _=[];for(let t of o){let n=p.crs[String(t.bits)]?.urls[0];if(t.data.artifactUrl&&n&&n!==t.data.artifactUrl)return await this.#x(r,o),this.#u=null,!0;let i={...t.data,lastValidatedAt:e};if(n){let e=await this.#m(n,t.data);if(!e.fresh)return await this.#x(r,o),this.#u=null,!0;i={...i,artifactUrl:n,etag:e.etag,lastModified:e.lastModified}}_.push({...t,data:i})}return await this.#S(r,g,_),this.#u=e,!1}catch(n){let a=t.s(n),s=n instanceof TypeError||n instanceof ReferenceError||n instanceof RangeError||n instanceof SyntaxError,c=s?`error`:`warn`;this.#i[c](s?`Unexpected error during revalidation (possible bug)`:`Revalidation failed, using cached artifacts (fail-open)`,{chainId:this.#t,relayerUrl:this.#n,error:a.message});let l=e-this.#r+u;try{i&&await this.#S(r,{...i,lastValidatedAt:l},o.map(e=>({...e,data:{...e.data,lastValidatedAt:l}})))}catch(e){this.#i.warn(`Failed to update validation timestamps after revalidation error`,{chainId:this.#t,error:t.s(e).message})}return this.#u=l,!1}}async#m(e,t){let n=!!(t.etag||t.lastModified),r={};t.etag&&(r[`If-None-Match`]=t.etag),t.lastModified&&(r[`If-Modified-Since`]=t.lastModified);let i=await globalThis.fetch(e,{method:`HEAD`,headers:r});if(i.status===405&&(i=await globalThis.fetch(e,{headers:r})),!i.ok&&i.status!==304)throw Error(`Artifact freshness check failed: HEAD ${e} returned ${i.status}`);let a=i.headers.get(`etag`)??void 0,o=i.headers.get(`last-modified`)??void 0;return i.status===304?{fresh:!0,etag:a??t.etag,lastModified:o??t.lastModified}:n?{fresh:!1,etag:a,lastModified:o}:{fresh:!0,etag:a,lastModified:o}}async#h(){let e=await this.#v(`Failed to read params index, CRS revalidation may be incomplete`),n=new Set([...this.#o.keys(),...e]),r=Array.from(n);return(await Promise.all(r.map(async e=>{let n=m(this.#t,e),r;try{r=await this.#e.get(n)}catch(n){return this.#i.warn(`Failed to read cached params entry during revalidation`,{chainId:this.#t,bits:e,error:t.s(n).message}),null}if(r==null)return null;let i=await this.#_(n,r,o,`params`,{bits:e});return i?{bits:e,key:n,data:i}:null}))).filter(e=>e!==null)}async#g(e,n,r,i,a={}){let o;try{o=await this.#e.get(e)}catch(e){return this.#i.warn(i,{chainId:this.#t,...a,error:t.s(e).message}),null}return o==null?null:this.#_(e,o,n,r,a)}async#_(e,t,r,i,a={}){let o=n.z.safeParse(r,t);return o.success?o.data:(await this.#y(e,i,{...a,error:n.z.prettifyError(o.error)}),null)}async#v(e){let t=h(this.#t);return await this.#g(t,s,`params index`,e)??[]}async#y(e,t,n={}){await this.#b(e),this.#i.warn(`Corrupt ${t} cache entry detected, deleting`,{chainId:this.#t,...n})}async#b(e){await this.#e.delete(e).catch(n=>{this.#i.warn(`Failed to delete cache entry`,{chainId:this.#t,key:e,error:t.s(n).message})})}async#x(e,n){let r=h(this.#t);try{await Promise.all([this.#e.delete(e),this.#e.delete(r),...n.map(e=>this.#e.delete(e.key))])}catch(e){this.#i.warn(`Failed to clear stale artifacts from persistent storage`,{chainId:this.#t,error:t.s(e).message})}this.#a=void 0,this.#o.clear()}async#S(e,n,r){let i=[this.#e.set(e,n).catch(e=>{this.#i.warn(`Failed to update public key validation timestamp`,{chainId:this.#t,error:t.s(e).message})}),...r.map(e=>this.#e.set(e.key,e.data).catch(e=>{this.#i.warn(`Failed to update params validation timestamp`,{chainId:this.#t,error:t.s(e).message})}))];await Promise.all(i)}};async function _(e,t=2){let n;for(let r=0;r<=t;r++)try{return await e()}catch(e){if(n=e,r<t&&v(e)){await y(500*2**r);continue}throw e}throw n}function v(e){if(!(e instanceof Error))return!1;let t=e.message.toLowerCase();return t.includes(`timed out`)||t.includes(`timeout`)||t.includes(`econnreset`)||t.includes(`econnrefused`)||t.includes(`network`)||t.includes(`fetch failed`)||t.includes(`socket hang up`)||t.includes(`502`)||t.includes(`503`)||t.includes(`504`)}function y(e){return new Promise(t=>setTimeout(t,e))}var b=class extends r{#e=null;#t=null;#n;constructor(e){super(),this.#n=e}get chain(){return this.#n.chain}async init(){await this.#r.initWorker()}get#r(){return this.#n.worker}#i(){return this.#e||=(this.#t||=this.#n.fheArtifactStorage??new e.n(`FheArtifactCache`,1,`artifacts`),new g({storage:this.#t,chainId:this.chain.id,relayerUrl:this.chain.relayerUrl,ttl:this.#n.fheArtifactCacheTTL,logger:this.#n.logger})),this.#e}terminate(){this.#e=null,this.resetInit()}[Symbol.dispose](){this.terminate()}async#a(){let e=this.#n.security?.getCsrfToken?.()??``;e&&await this.#r.updateCsrf(e)}async generateKeypair(){await this.ensureInit();let e=this.chain.id,t=await this.#r.generateKeypair({chainId:e});return{publicKey:t.publicKey,privateKey:t.privateKey}}async createEIP712(e,t,n,r=7){await this.ensureInit();let i=this.chain.id;return this.#r.createEIP712({chainId:i,publicKey:e,contractAddresses:t,startTimestamp:n,durationDays:r})}async encrypt(e){let{values:t,contractAddress:n,userAddress:r}=e;await this.ensureInit();let i=this.chain.id;return _(async()=>{await this.#a();let e=await this.#r.encrypt({chainId:i,values:t,contractAddress:n,userAddress:r});return{handles:e.handles,inputProof:e.inputProof}})}async userDecrypt(e){await this.ensureInit();let t=this.chain.id;return _(async()=>(await this.#a(),(await this.#r.userDecrypt({chainId:t,...e})).clearValues))}async publicDecrypt(e){await this.ensureInit();let t=this.chain.id;return _(async()=>{await this.#a();let n=await this.#r.publicDecrypt({chainId:t,encryptedValues:e});return{clearValues:n.clearValues,abiEncodedClearValues:n.abiEncodedClearValues,decryptionProof:n.decryptionProof}})}async createDelegatedUserDecryptEIP712(e,t,n,r,i=7){await this.ensureInit();let a=this.chain.id;return this.#r.createDelegatedUserDecryptEIP712({chainId:a,publicKey:e,contractAddresses:t,delegatorAddress:n,startTimestamp:r,durationDays:i})}async delegatedUserDecrypt(e){await this.ensureInit();let t=this.chain.id;return _(async()=>(await this.#a(),(await this.#r.delegatedUserDecrypt({chainId:t,...e})).clearValues))}async requestZKProofVerification(e){await this.ensureInit();let t=this.chain.id;return _(async()=>(await this.#a(),this.#r.requestZKProofVerification({chainId:t,zkProof:e})))}async getPublicKey(){await this.ensureInit();let e=this.chain.id;return this.#i().getPublicKey(async()=>(await this.#r.getPublicKey({chainId:e})).result)}async getPublicParams(e){await this.ensureInit();let t=this.chain.id;return this.#i().getPublicParams(e,async()=>(await this.#r.getPublicParams({chainId:t,bits:e})).result)}};const x=3e4;var S=class{#e=null;#t=new Map;#n=null;config;logger;constructor(e,t){this.config=e,this.logger=t}async initWorker(){return this.#e?this.#e:(this.#n||=this.#r().catch(e=>{throw this.#n=null,e}),this.#n)}async#r(){let e=this.createWorker();this.wireEvents(e);try{let{type:t,payload:n}=this.getInitPayload();await this.sendRequestTo(e,t,n,6e4),this.onWorkerReady?.(e),this.#e=e}catch(t){throw this.terminateWorker(e),t}return this.#e}terminate(){if(this.#e){for(let[e,t]of this.#t)clearTimeout(t.timeoutId),t.reject(Error(`Worker terminated`)),this.#t.delete(e);this.terminateWorker(this.#e),this.#e=null}this.#n=null}handleResponse(e){let t=this.#t.get(e.id);if(!t){this.logger?.warn(`[WorkerClient] Received response for unknown request`,{id:e.id});return}let n=Math.round(performance.now()-t.startTime);if(clearTimeout(t.timeoutId),this.#t.delete(e.id),e.success)this.logger?.debug(`[WorkerClient] ← ${t.type} OK`,{id:e.id,elapsed:n}),t.resolve(e.data);else{this.logger?.error(`[WorkerClient] ← ${t.type} FAILED`,{id:e.id,elapsed:n,error:e.error});let r=Error(e.error);`statusCode`in e&&typeof e.statusCode==`number`&&(r.statusCode=e.statusCode),t.reject(r)}}handleWorkerError(e){this.logger?.error(`[WorkerClient] Worker error`,{error:e});let t=this.#e;this.#e=null,this.#i(`Worker error: ${e}`),t&&this.terminateWorker(t)}handleWorkerMessageError(){this.logger?.error(`[WorkerClient] Message deserialization failed`);let e=this.#e;this.#e=null,this.#i(`Worker message deserialization failed`),e&&this.terminateWorker(e)}sendRequestTo(e,t,n,r=x){return new Promise((i,a)=>{let o=this.generateRequestId(),s=performance.now();this.logger?.debug(`[WorkerClient] → ${t}`,{id:o});let c=setTimeout(()=>{this.#t.delete(o);let e=Math.round(performance.now()-s);this.logger?.error(`[WorkerClient] ${t} timed out after ${r}ms`,{id:o,elapsed:e}),a(Error(`Request ${t} timed out after ${r}ms`))},r);this.#t.set(o,{resolve:i,reject:a,timeoutId:c,startTime:s,type:t});let l={id:o,type:t,payload:n};this.postMessage(e,l)})}async sendRequest(e,t,n=x){let r=await this.initWorker();return this.sendRequestTo(r,e,t,n)}async generateKeypair(e){return this.sendRequest(`GENERATE_KEYPAIR`,e)}async createEIP712(e){return this.sendRequest(`CREATE_EIP712`,e)}async encrypt(e){return this.sendRequest(`ENCRYPT`,e)}async userDecrypt(e){return this.sendRequest(`USER_DECRYPT`,e)}async publicDecrypt(e){return this.sendRequest(`PUBLIC_DECRYPT`,e)}async createDelegatedUserDecryptEIP712(e){return this.sendRequest(`CREATE_DELEGATED_EIP712`,e)}async delegatedUserDecrypt(e){return this.sendRequest(`DELEGATED_USER_DECRYPT`,e)}async requestZKProofVerification(e){return this.sendRequest(`REQUEST_ZK_PROOF_VERIFICATION`,e)}async getPublicKey(e){return this.sendRequest(`GET_PUBLIC_KEY`,e)}async getPublicParams(e){return this.sendRequest(`GET_PUBLIC_PARAMS`,e)}#i(e){for(let[t,n]of this.#t)clearTimeout(n.timeoutId),n.reject(Error(e)),this.#t.delete(t)}};function C(e){try{return t.i(e,`runtime`),t.a(e,`id`,`runtime.id`),t.n(e,`getURL`,`runtime.getURL`),!0}catch{return!1}}function w(){let e=globalThis;for(let n of[e.chrome,e.browser])try{if(t.i(n,`ns`),C(n.runtime))return n.runtime}catch{continue}}var T=class extends S{env=`web`;constructor(e){super(e,e.logger)}createWorker(){let e=w();if(e)return new Worker(e.getURL(`relayer-sdk.worker.js`));let t=URL.createObjectURL(new Blob([`(function() {
+	//#region src/utils/assertions.ts
+	function assertObject(value, context) {
+		if (typeof value !== "object" || value === null || Array.isArray(value)) throw new TypeError(\`\${context} must be an object, got \${typeof value}\`);
+	}
+	function assertString(value, context) {
+		if (typeof value !== "string") throw new TypeError(\`\${context} must be a string, got \${typeof value}\`);
+	}
+	function assertFunction(value, context) {
+		if (typeof value !== "function") throw new TypeError(\`\${context} must be a function, got \${typeof value}\`);
+	}
+	/** Assert that \`obj[key]\` is a string. Narrows \`obj\` to include \`{ [key]: string }\`. */
+	function assertStringProp(obj, key, context) {
+		assertString(obj[key], context);
+	}
+	/** Assert that \`obj[key]\` is a function. Narrows \`obj\` to include \`{ [key]: F }\`. */
+	function assertFunctionProp(obj, key, context) {
+		assertFunction(obj[key], context);
+	}
+	function assertCondition(condition, message) {
+		if (!condition) throw new TypeError(message);
+	}
+	//#endregion
+	//#region src/utils/hex.ts
+	/** Normalize a un-prefixed hex payload to a 0x-prefixed \`Hex\` value. */
+	function prefixHex(value) {
+		return value.startsWith("0x") ? value : \`0x\${value}\`;
+	}
+	/** Convert a public \`Hex\` value back an unprefixed format. */
+	function unprefixHex(value) {
+		assertCondition(value.startsWith("0x"), \`Expected 0x-prefixed hex, got: \${value}\`);
+		return value.slice(2);
+	}
+	//#endregion
+	//#region src/worker/browser-extension.ts
+	function isValidRuntime(runtime) {
+		try {
+			assertObject(runtime, "runtime");
+			assertStringProp(runtime, "id", "runtime.id");
+			assertFunctionProp(runtime, "getURL", "runtime.getURL");
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	/**
+	* Return the browser extension runtime object, or \`undefined\` outside extensions.
+	* Works across Chrome/Edge (\`chrome.runtime\`) and Firefox/Safari (\`browser.runtime\`).
+	* Extensions have restricted CSP that blocks \`blob:\` URLs, so callers use
+	* this to detect the environment and resolve file URLs via \`runtime.getURL\`.
+	*/
+	function getBrowserExtensionRuntime() {
+		const g = globalThis;
+		for (const ns of [g.chrome, g.browser]) try {
+			assertObject(ns, "ns");
+			if (isValidRuntime(ns.runtime)) return ns.runtime;
+		} catch {
+			continue;
+		}
+	}
+	//#endregion
+	//#region src/worker/relayer-sdk.worker.ts
+	const instances = /* @__PURE__ */ new Map();
+	const pending = /* @__PURE__ */ new Map();
+	const configs = /* @__PURE__ */ new Map();
+	/** Convert an FheChain to the FhevmInstanceConfig shape expected by createInstance. */
+	function toInstanceConfig(chain) {
+		return {
+			...chain,
+			chainId: chain.id
+		};
+	}
+	let sdkGlobal = null;
+	/**
+	* Get or lazily create an FhevmInstance for the given chain.
+	*/
+	async function getInstance(chainId) {
+		const existing = instances.get(chainId);
+		if (existing) return existing;
+		const inflight = pending.get(chainId);
+		if (inflight) return inflight;
+		const config = configs.get(chainId);
+		if (!config) throw new Error(\`No config for chain \${chainId}. Available: [\${[...configs.keys()].join(", ")}]\`);
+		if (!sdkGlobal) throw new Error("Relayer SDK is not initialized. Call INIT first.");
+		const promise = sdkGlobal.createInstance({
+			...toInstanceConfig(config),
+			batchRpcCalls: false
+		}).then((instance) => {
+			instances.set(chainId, instance);
+			pending.delete(chainId);
+			return instance;
+		}).catch((err) => {
+			pending.delete(chainId);
+			throw err;
+		});
+		pending.set(chainId, promise);
+		return promise;
+	}
+	function unreachableFheType(_) {
+		throw new Error("Unsupported FHE type");
+	}
+	const relayerUrls = /* @__PURE__ */ new Set();
+	let csrfTokenBase = "";
+	const CSRF_HEADER_NAME = "x-csrf-token";
+	const MUTATING_METHODS = new Set([
+		"POST",
+		"PUT",
+		"DELETE",
+		"PATCH"
+	]);
+	/**
+	* Register relayer URLs from chain configs for fetch interception.
+	*/
+	function registerRelayerUrls(chainConfigs) {
+		for (const c of chainConfigs) if (c.relayerUrl) relayerUrls.add(c.relayerUrl);
+	}
+	/**
+	* Send a success response back to the main thread.
+	* Optionally transfers ArrayBuffers for zero-copy performance.
+	*/
+	function sendSuccess(id, type, data, transfer) {
+		const response = {
+			id,
+			type,
+			success: true,
+			data
+		};
+		return transfer ? self.postMessage(response, transfer) : self.postMessage(response);
+	}
+	/**
+	* Send an error response back to the main thread.
+	*/
+	function sendError(id, type, error, statusCode) {
+		const response = {
+			id,
+			type,
+			success: false,
+			error
+		};
+		if (statusCode !== void 0) response.statusCode = statusCode;
+		self.postMessage(response);
+	}
+	const originalFetch = fetch;
+	/** Allowed CDN hostnames for loading the relayer SDK script. */
+	const ALLOWED_CDN_HOSTS = new Set(["cdn.zama.org"]);
+	/**
+	* Validate the CDN URL supplied by the caller.
+	* Ensures only HTTPS URLs from approved hosts are used when loading
+	* SDK code into the worker.
+	*/
+	function validateCdnUrl(rawUrl) {
+		let url;
+		try {
+			url = new URL(rawUrl);
+		} catch {
+			throw new Error("Invalid CDN URL");
+		}
+		if (url.protocol !== "https:") throw new Error("CDN URL must use https");
+		if (!ALLOWED_CDN_HOSTS.has(url.hostname)) throw new Error(\`CDN URL host is not allowed: \${url.hostname}\`);
+		return url.toString();
+	}
+	/**
+	* Set up fetch interceptor to add credentials and CSRF token for relayer requests.
+	* Workers don't automatically include cookies, so we intercept fetch calls
+	* targeting our relayer proxy to inject credentials and CSRF headers.
+	*/
+	function setupFetchInterceptor() {
+		globalThis.fetch = async (input, init) => {
+			const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+			const method = init?.method?.toUpperCase() ?? "GET";
+			if (relayerUrls.size > 0 && [...relayerUrls].some((base) => url.startsWith(base))) {
+				const headers = new Headers(init?.headers);
+				if (MUTATING_METHODS.has(method) && csrfTokenBase) headers.set(CSRF_HEADER_NAME, csrfTokenBase);
+				return originalFetch(input, {
+					...init,
+					headers,
+					credentials: "include"
+				});
+			}
+			return originalFetch(input, init);
+		};
+	}
+	/**
+	* Verify a fetched script's SHA-384 hash matches the expected integrity value.
+	*/
+	async function verifyIntegrity(content, expectedHash) {
+		const encoder = new TextEncoder();
+		const hashBuffer = await crypto.subtle.digest("SHA-384", encoder.encode(content));
+		const hashHex = [...new Uint8Array(hashBuffer)].map((b) => b.toString(16).padStart(2, "0")).join("");
+		if (hashHex !== expectedHash) throw new Error(\`CDN integrity check failed: expected SHA-384 \${expectedHash}, got \${hashHex}\`);
+	}
+	/**
+	* Load SDK script from CDN.
+	* Uses two strategies depending on the environment:
+	* - **Web apps (default):** fetch + blob URL + importScripts. Avoids MIME-type
+	*   rejections (some CDNs serve .cjs as \`application/node\`) and CSP
+	*   \`unsafe-eval\` violations.
+	* - **Browser extensions (Chrome/Firefox/Safari):** importScripts directly.
+	*   Blob URLs are blocked by extension CSP, but the CDN must be allowed
+	*   in the extension's manifest CSP.
+	*
+	* Integrity is always verified when a hash is provided, regardless of strategy.
+	*/
+	async function fetchScript(cdnUrl) {
+		const response = await originalFetch(cdnUrl);
+		if (!response.ok) throw new Error(\`Failed to fetch SDK: \${response.status} \${response.statusText}\`);
+		return response.text();
+	}
+	async function loadSdkScript(cdnUrl, integrity) {
+		const validatedUrl = validateCdnUrl(cdnUrl);
+		if (getBrowserExtensionRuntime()) {
+			if (integrity) await verifyIntegrity(await fetchScript(validatedUrl), integrity);
+			return self.importScripts(validatedUrl);
+		}
+		const scriptContent = await fetchScript(validatedUrl);
+		if (integrity) await verifyIntegrity(scriptContent, integrity);
+		const blob = new Blob([scriptContent], { type: "application/javascript" });
+		const blobUrl = URL.createObjectURL(blob);
+		try {
+			self.importScripts(blobUrl);
+		} finally {
+			URL.revokeObjectURL(blobUrl);
+		}
+	}
+	/**
+	* Handle INIT request - load SDK WASM and register chain configs (instances are lazy).
+	*/
+	async function handleInit(request) {
+		const { id, type, payload } = request;
+		try {
+			if (payload.env !== "web") throw new Error(\`Web worker received unexpected env: \${payload.env}\`);
+			const { cdnUrl, csrfToken, integrity, thread } = payload;
+			csrfTokenBase = csrfToken;
+			setupFetchInterceptor();
+			await loadSdkScript(cdnUrl, integrity);
+			if (!self.relayerSDK) throw new Error("Failed to load relayerSDK from CDN");
+			sdkGlobal = self.relayerSDK;
+			await sdkGlobal.initSDK(thread !== null && thread !== void 0 ? { thread } : void 0);
+			registerRelayerUrls(payload.chains);
+			for (const chain of payload.chains) configs.set(chain.id, chain);
+			sendSuccess(id, type, { initialized: true });
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			console.error("[Worker] Init error:", message);
+			sendError(id, type, message);
+		}
+	}
+	/** Coerce a boolean to bigint for numeric FHE types. */
+	function toBigInt(value) {
+		return typeof value === "boolean" ? value ? 1n : 0n : value;
+	}
+	/**
+	* Add a single typed value to the encrypted input builder.
+	*/
+	function addTypedValue(input, entry) {
+		const { value, type: fheType } = entry;
+		switch (fheType) {
+			case "ebool":
+				input.addBool(typeof value === "boolean" ? value : value !== 0n);
+				break;
+			case "euint8":
+				input.add8(toBigInt(value));
+				break;
+			case "euint16":
+				input.add16(toBigInt(value));
+				break;
+			case "euint32":
+				input.add32(toBigInt(value));
+				break;
+			case "euint64":
+				input.add64(toBigInt(value));
+				break;
+			case "euint128":
+				input.add128(toBigInt(value));
+				break;
+			case "euint256":
+				input.add256(toBigInt(value));
+				break;
+			case "eaddress":
+				input.addAddress(value);
+				break;
+			default: unreachableFheType(fheType);
+		}
+	}
+	/**
+	* Handle ENCRYPT request.
+	*/
+	async function handleEncrypt(request) {
+		const { id, type, payload } = request;
+		const { values, contractAddress, userAddress } = payload;
+		try {
+			const input = (await getInstance(payload.chainId)).createEncryptedInput(contractAddress, userAddress);
+			for (const entry of values) addTypedValue(input, entry);
+			const encrypted = await input.encrypt();
+			sendSuccess(id, type, {
+				handles: encrypted.handles,
+				inputProof: encrypted.inputProof
+			}, [encrypted.inputProof.buffer, ...encrypted.handles.map((h) => h.buffer)]);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			console.error("[Worker] Encrypt error:", message);
+			sendError(id, type, message);
+		}
+	}
+	/**
+	* Handle USER_DECRYPT request.
+	*/
+	async function handleUserDecrypt(request) {
+		const { id, type, payload } = request;
+		try {
+			const instance = await getInstance(payload.chainId);
+			const handleContractPairs = payload.encryptedValues.map((encryptedValue) => ({
+				handle: encryptedValue,
+				contractAddress: payload.contractAddress
+			}));
+			sendSuccess(id, type, { clearValues: await instance.userDecrypt(handleContractPairs, unprefixHex(payload.privateKey), unprefixHex(payload.publicKey), payload.signature, payload.signedContractAddresses, payload.signerAddress, payload.startTimestamp, payload.durationDays) });
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			const statusCode = extractHttpStatus(error);
+			console.error("[Worker] UserDecrypt error:", message);
+			sendError(id, type, message, statusCode);
+		}
+	}
+	/**
+	* Extract an HTTP status code from an error, if present.
+	* Relayer SDK errors may carry a \`status\` or \`statusCode\` property.
+	*/
+	function extractHttpStatus(error) {
+		if (error === null || error === void 0 || typeof error !== "object") return;
+		const e = error;
+		if (typeof e.statusCode === "number") return e.statusCode;
+		if (typeof e.status === "number") return e.status;
+		if (e.cause !== null && e.cause !== void 0 && typeof e.cause === "object") {
+			const cause = e.cause;
+			if (typeof cause.statusCode === "number") return cause.statusCode;
+			if (typeof cause.status === "number") return cause.status;
+		}
+	}
+	/**
+	* Handle PUBLIC_DECRYPT request.
+	*/
+	async function handlePublicDecrypt(request) {
+		const { id, type, payload } = request;
+		try {
+			sendSuccess(id, type, { ...await (await getInstance(payload.chainId)).publicDecrypt(payload.encryptedValues) });
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			console.error("[Worker] PublicDecrypt error:", message);
+			sendError(id, type, message);
+		}
+	}
+	/**
+	* Handle GENERATE_KEYPAIR request.
+	*/
+	async function handleGenerateKeypair(request) {
+		const { id, type, payload } = request;
+		try {
+			const keypair = (await getInstance(payload.chainId)).generateKeypair();
+			sendSuccess(id, type, {
+				publicKey: prefixHex(keypair.publicKey),
+				privateKey: prefixHex(keypair.privateKey)
+			});
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			console.error("[Worker] GenerateKeypair error:", message);
+			sendError(id, type, message);
+		}
+	}
+	/**
+	* Handle CREATE_EIP712 request.
+	*/
+	async function handleCreateEIP712(request) {
+		const { id, type, payload } = request;
+		try {
+			sendSuccess(id, type, (await getInstance(payload.chainId)).createEIP712(unprefixHex(payload.publicKey), payload.contractAddresses, payload.startTimestamp, payload.durationDays));
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			console.error("[Worker] CreateEIP712 error:", message);
+			sendError(id, type, message);
+		}
+	}
+	/**
+	* Handle CREATE_DELEGATED_EIP712 request.
+	*/
+	async function handleCreateDelegatedEIP712(request) {
+		const { id, type, payload } = request;
+		try {
+			sendSuccess(id, type, (await getInstance(payload.chainId)).createDelegatedUserDecryptEIP712(unprefixHex(payload.publicKey), payload.contractAddresses, payload.delegatorAddress, payload.startTimestamp, payload.durationDays));
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			console.error("[Worker] CreateDelegatedEIP712 error:", message);
+			sendError(id, type, message);
+		}
+	}
+	/**
+	* Handle DELEGATED_USER_DECRYPT request.
+	*/
+	async function handleDelegatedUserDecrypt(request) {
+		const { id, type, payload } = request;
+		try {
+			const instance = await getInstance(payload.chainId);
+			const handleContractPairs = payload.encryptedValues.map((encryptedValue) => ({
+				handle: encryptedValue,
+				contractAddress: payload.contractAddress
+			}));
+			sendSuccess(id, type, { clearValues: await instance.delegatedUserDecrypt(handleContractPairs, unprefixHex(payload.privateKey), unprefixHex(payload.publicKey), payload.signature, payload.signedContractAddresses, payload.delegatorAddress, payload.delegateAddress, payload.startTimestamp, payload.durationDays) });
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			const statusCode = extractHttpStatus(error);
+			console.error("[Worker] DelegatedUserDecrypt error:", message);
+			sendError(id, type, message, statusCode);
+		}
+	}
+	/**
+	* Handle REQUEST_ZK_PROOF_VERIFICATION request.
+	*/
+	async function handleRequestZKProofVerification(request) {
+		const { id, type, payload } = request;
+		try {
+			const result = await (await getInstance(payload.chainId)).requestZKProofVerification(payload.zkProof);
+			sendSuccess(id, type, result, [result.inputProof.buffer, ...result.handles.map((h) => h.buffer)]);
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			console.error("[Worker] RequestZKProofVerification error:", message);
+			sendError(id, type, message);
+		}
+	}
+	/**
+	* Handle GET_PUBLIC_KEY request.
+	*/
+	async function handleGetPublicKey(request) {
+		const { id, type, payload } = request;
+		try {
+			sendSuccess(id, type, { result: (await getInstance(payload.chainId)).getPublicKey() });
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			console.error("[Worker] GetPublicKey error:", message);
+			sendError(id, type, message);
+		}
+	}
+	/**
+	* Handle GET_PUBLIC_PARAMS request.
+	*/
+	async function handleGetPublicParams(request) {
+		const { id, type, payload } = request;
+		try {
+			sendSuccess(id, type, { result: (await getInstance(payload.chainId)).getPublicParams(payload.bits) });
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			console.error("[Worker] GetPublicParams error:", message);
+			sendError(id, type, message);
+		}
+	}
+	/**
+	* Handle UPDATE_CSRF request - update the stored CSRF token.
+	*/
+	function handleUpdateCsrf(request) {
+		const { id, type, payload } = request;
+		csrfTokenBase = payload.csrfToken;
+		sendSuccess(id, type, { updated: true });
+	}
+	/**
+	* Main message handler.
+	*/
+	self.onmessage = async (event) => {
+		const request = event.data;
+		try {
+			switch (request.type) {
+				case "INIT":
+					await handleInit(request);
+					break;
+				case "UPDATE_CSRF":
+					handleUpdateCsrf(request);
+					break;
+				case "ENCRYPT":
+					await handleEncrypt(request);
+					break;
+				case "USER_DECRYPT":
+					await handleUserDecrypt(request);
+					break;
+				case "PUBLIC_DECRYPT":
+					await handlePublicDecrypt(request);
+					break;
+				case "GENERATE_KEYPAIR":
+					await handleGenerateKeypair(request);
+					break;
+				case "CREATE_EIP712":
+					await handleCreateEIP712(request);
+					break;
+				case "CREATE_DELEGATED_EIP712":
+					await handleCreateDelegatedEIP712(request);
+					break;
+				case "DELEGATED_USER_DECRYPT":
+					await handleDelegatedUserDecrypt(request);
+					break;
+				case "REQUEST_ZK_PROOF_VERIFICATION":
+					await handleRequestZKProofVerification(request);
+					break;
+				case "GET_PUBLIC_KEY":
+					await handleGetPublicKey(request);
+					break;
+				case "GET_PUBLIC_PARAMS":
+					await handleGetPublicParams(request);
+					break;
+				default: console.error("[Worker] Unknown request type:", request.type);
+			}
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			sendError(request?.id ?? "unknown", request?.type ?? "UNKNOWN", message);
+		}
+	};
+	//#endregion
+})();
+`],{type:`application/javascript`}));try{return new Worker(t)}finally{URL.revokeObjectURL(t)}}wireEvents(e){e.onmessage=e=>this.handleResponse(e.data),e.onerror=e=>this.handleWorkerError(e.message),e.onmessageerror=()=>this.handleWorkerMessageError()}postMessage(e,t){e.postMessage(t)}terminateWorker(e){e.terminate()}generateRequestId(){return crypto.randomUUID()}getInitPayload(){let{cdnUrl:e,chains:t,csrfToken:n,integrity:r,thread:i}=this.config;return{type:`INIT`,payload:{env:`web`,cdnUrl:e,chains:t,csrfToken:n,integrity:r,thread:i}}}async updateCsrf(e){await this.sendRequest(`UPDATE_CSRF`,{csrfToken:e})}};const E=n.z.object({threads:n.z.optional(n.z.int().check(n.z.positive())),fheArtifactCacheTTL:n.z.optional(n.z.int().check(n.z.nonnegative()))});function D(t){return t!==void 0&&e.t(E,t),{type:`web`,createWorker:e=>new T({cdnUrl:`https://cdn.zama.org/relayer-sdk-js/0.4.2/relayer-sdk-js.umd.cjs`,chains:e,csrfToken:t?.security?.getCsrfToken?.()??``,integrity:t?.security?.integrityCheck===!1?void 0:`114438b01d518b53a447fa3e8bfbe6e71031cb42ac43219bb9f53488456fdfa4bbc8989628366d436e68f6526c7647eb`,logger:t?.logger,thread:t?.threads}),createRelayer:(e,n)=>new b({chain:e,worker:n,...t})}}exports.RelayerWeb=b,exports.web=D;
+//# sourceMappingURL=index.cjs.map