@zama-fhe/sdk 3.5.0-alpha.9 → 3.5.1-alpha.1

package/README.md

@@ -65,7 +65,7 @@ Browser apps should proxy relayer requests through their backend so the relayer
 - `WrappedToken` extends `Token` with ERC-7984 ERC-20 wrapper operations: shield, unshield, allowance, and unwrap orchestration.
 - Adapter-specific `createConfig` helpers are available from `@zama-fhe/sdk/viem` and `@zama-fhe/sdk/ethers`.
 - Relayer factories are split by runtime: browser `web()` comes from `@zama-fhe/sdk/web`, Node.js `node()` comes from `@zama-fhe/sdk/node`, and local `cleartext()` comes from `@zama-fhe/sdk`.
-- Chain presets such as `sepolia`, `mainnet`, `polygonAmoy`, `hoodi`, `hardhat`, and `anvil` are available from `@zama-fhe/sdk/chains`.
+- Chain presets such as `sepolia`, `mainnet`, `polygon`, `polygonAmoy`, `hoodi`, `hardhat`, and `anvil` are available from `@zama-fhe/sdk/chains`.
 
 ## Documentation
 

package/dist/cjs/base-signer.cjs

@@ -1,2 +1,2 @@
-const e=require("./relayer.cjs"),t=require("./sdk-events.cjs"),n=require("./chains.cjs");let r=require("@fhevm/sdk/viem"),i=require("viem"),a=require("zod/mini");var o=class{#e=null;#t=null;#n;#r;#i;constructor(e=`CredentialStore`,t=1,n=`credentials`){this.#n=e,this.#r=t,this.#i=n}#a(){return this.#e?Promise.resolve(this.#e):(this.#t||=new Promise((e,t)=>{let n=indexedDB.open(this.#n,this.#r);n.onupgradeneeded=()=>{let e=n.result;e.objectStoreNames.contains(this.#i)||e.createObjectStore(this.#i,{keyPath:`key`})},n.onsuccess=()=>{this.#e=n.result,this.#t=null,this.#e.onversionchange=()=>{this.#e?.close(),this.#e=null,this.#t=null},this.#e.onclose=()=>{this.#e=null,this.#t=null},e(this.#e)},n.onerror=()=>{this.#e=null,this.#t=null,t(n.error)}}),this.#t)}async#o(e,t){let n=await this.#a();return new Promise((r,i)=>{let a=n.transaction(this.#i,e);a.onabort=()=>i(a.error??Error(`Transaction aborted`));let o=t(a.objectStore(this.#i));e===`readonly`?o.onsuccess=()=>r(o.result):a.oncomplete=()=>r(o.result),o.onerror=()=>i(o.error)})}async get(e){return(await this.#o(`readonly`,t=>t.get(e)))?.value??null}async set(e,t){await this.#o(`readwrite`,n=>n.put({key:e,value:t}))}async delete(e){await this.#o(`readwrite`,t=>t.delete(e))}async clear(){await this.#o(`readwrite`,e=>e.clear())}};const s=new o;var c=class{#e=new Map;async get(e){return this.#e.get(e)??null}async set(e,t){this.#e.set(e,t)}async delete(e){this.#e.delete(e)}};const l=new c;function u(){return typeof window<`u`?new o(`CredentialStore`):new c}function d(e=u(),t=e){return{storage:e,permitStorage:t}}function f(t,n){let r=new Map(t.map(e=>[e.id,e]));if(r.size!==t.length){let n=t.map(e=>e.id);throw new e.t(`Duplicate chain id(s) [${[...new Set(n.filter((e,t)=>n.indexOf(e)!==t))].join(`, `)}] in the chains array. Each chain id must appear only once. Note: hardhat and anvil are aliases (both use 31337).`)}let i=new Map(Object.entries(n)),a=new Map;for(let t of r.keys()){let n=r.get(t),o=i.get(String(t));if(!o)throw new e.t(`Chain ${t} has no relayer configured. Add a relayer entry: relayers: { [${t}]: web() }`);if(!n)throw new e.t(`Chain ${t} has a relayer configured but no entry in the chains array. Add the chain config to the chains array.`);a.set(t,{chain:n,relayerConfig:o})}let o=new Set(Object.keys(n).map(Number)),s=new Set([...o].filter(e=>!r.has(e)));if(s.size>0)throw new e.t(`Relayer entries for chain(s) [${[...s].join(`, `)}] have no matching entry in the chains array. Remove them or add the corresponding chain config.`);return a}var p=class{#e;#t;#n;constructor(t,n){if(t.length===0)throw new e.t(`At least one chain is required.`);this.#e=new Map(t.map(e=>[e.id,e])),this.#n=t[0].id;let r=new Map;for(let[e,{relayerConfig:i,chain:a}]of f(t,n))r.set(e,i.createRelayer(a));this.#t=r}get chains(){return[...this.#e.values()]}get chain(){let t=this.#e.get(this.#n);if(t===void 0)throw new e.t(`Chain ${this.#n} is not configured. Add it to the chains array.`);return t}switchChain(e){this.#n=e}get relayer(){let t=this.#t.get(this.chain.id);if(t===void 0)throw new e.t(`No relayer configured for chain ${this.#n}. Add it to the relayers object.`);return t}};function m(e){return(0,i.getAddress)(e)}const h=a.z.custom(e=>typeof e==`string`&&(0,i.isHex)(e,{strict:!0}),`expected 0x-prefixed hex string`),g=a.z.custom(e=>typeof e==`string`&&(0,i.isAddress)(e,{strict:!1}),`expected EVM address`),_=a.z.pipe(g,a.z.transform(m)),v=a.z.int().check(a.z.nonnegative()),y=a.z.int().check(a.z.positive()),ee=a.z.int().check(a.z.nonnegative()),te=a.z.int().check(a.z.positive());a.z.int().check(a.z.positive());const b={version:1,info:`zama-sdk-keypair-wrapping-v1`,ivLengthBytes:12,tagLengthBytes:16};function x(e){return new Uint8Array(e)}function S(e){return x(new TextEncoder().encode(JSON.stringify([e.publicKey,e.createdAt,e.expiresAt,e.tkmsVersion??null])))}function C(e){return typeof e==`string`?new TextEncoder().encode(e):x(e)}var w=class{#e;#t;constructor(e){this.#e=e}async baseKey(){return this.#t??=this.#n(this.#e),this.#t}async#n(e){let t=C(e),n=await crypto.subtle.importKey(`raw`,t,`HKDF`,!1,[`deriveKey`]);return t.fill(0),e instanceof Uint8Array&&e.fill(0),this.#e=void 0,n}};async function T(e,t){let n=await e.baseKey();return crypto.subtle.deriveKey({name:`HKDF`,hash:`SHA-256`,salt:new TextEncoder().encode(t),info:new TextEncoder().encode(b.info)},n,{name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}async function ne(e,t,n,r){let a=await T(t,n),o=crypto.getRandomValues(new Uint8Array(b.ivLengthBytes)),s=await crypto.subtle.encrypt({name:`AES-GCM`,iv:o,additionalData:S(r)},a,x((0,i.toBytes)(e)));return{wrappedPrivateKey:(0,i.toHex)(new Uint8Array(s)),iv:(0,i.toHex)(o)}}async function re(e,t,n,r){let a=await T(t,n),o=await crypto.subtle.decrypt({name:`AES-GCM`,iv:x((0,i.toBytes)(e.iv)),additionalData:S(r)},a,x((0,i.toBytes)(e.wrappedPrivateKey)));return(0,i.toHex)(new Uint8Array(o))}function ie(e){return typeof e==`object`&&!!e&&`name`in e&&e.name===`OperationError`}const E=86400;function D(){return Math.floor(Date.now()/1e3)}function O(e){return[...new Set(e.map(m))].sort()}const k=`transportKeyPairTTL must be a positive integer number of seconds`,A=`permitTTL must be a positive integer number of days`,j=`transportKeyPairScope must be a non-empty string`,M=`transportKeyPairDerivationSecret must be a Uint8Array of at least 32 bytes or a string of at least 64 characters (256 bits of entropy): source it from a CSPRNG or secrets manager, not a human-memorable passphrase`,N=365*E,ae=a.z.int({error:k}).check(a.z.positive({error:k}),a.z.maximum(N,`transportKeyPairTTL must not exceed the fhevm ACL maximum of ${N}s (365 days)`)),oe=a.z.int({error:A}).check(a.z.positive({error:A})),se=a.z.string({error:j}).check(a.z.minLength(1,j)),ce=a.z.union([a.z.string({error:M}).check(a.z.minLength(64,M)),a.z.instanceof(Uint8Array,{error:M}).check(a.z.refine(e=>e.byteLength>=32,{error:M}))],{error:M}),le=a.z.object({publicKey:h,privateKey:h,createdAt:v,expiresAt:y,tkmsVersion:a.z.optional(a.z.string())}),ue=a.z.object({domain:a.z.record(a.z.string(),a.z.unknown()),primaryType:a.z.optional(a.z.string()),types:a.z.record(a.z.string(),a.z.array(a.z.object({name:a.z.string(),type:a.z.string()}))),message:a.z.record(a.z.string(),a.z.unknown())}),P=a.z.object({version:a.z.int().check(a.z.positive()),eip712:ue,signature:h,signerAddress:_}),F=a.z.object({keypairPublicKey:h,contractAddresses:a.z.array(_).check(a.z.maxLength(10)),serializedPermit:P,startTimestamp:v,durationDays:te}),de=a.z.array(F),fe=a.z.array(a.z.string()),I=`iv must be a ${b.ivLengthBytes}-byte hex string`,L=`wrappedPrivateKey must be a whole number of bytes and at least ${b.tagLengthBytes} bytes (the AES-GCM authentication tag)`;function R(e){return(e.length-2)/2}const z=a.z.object({wrappingVersion:a.z.literal(b.version,{error:`wrappingVersion must be a wrapping scheme this SDK can read`}),publicKey:h,wrappedPrivateKey:h.check(a.z.refine(e=>e.length%2==0&&R(e)>=b.tagLengthBytes,{error:L})),iv:h.check(a.z.refine(e=>R(e)===b.ivLengthBytes,{error:I})),createdAt:v,expiresAt:y,tkmsVersion:a.z.optional(a.z.string())});function B(e){let t={publicKey:e.publicKey,createdAt:e.createdAt,expiresAt:e.expiresAt};return e.tkmsVersion&&(t.tkmsVersion=e.tkmsVersion),t}const V={version:b.version,schema:z,async encode(e,t,n){let{wrappedPrivateKey:r,iv:i}=await ne(e.privateKey,t,n,B(e)),a={wrappingVersion:b.version,publicKey:e.publicKey,wrappedPrivateKey:r,iv:i,createdAt:e.createdAt,expiresAt:e.expiresAt};return e.tkmsVersion&&(a.tkmsVersion=e.tkmsVersion),a},async decode(e,t,n){let r=await re({wrappedPrivateKey:e.wrappedPrivateKey,iv:e.iv},t,n,B(e)),i={publicKey:e.publicKey,privateKey:r,createdAt:e.createdAt,expiresAt:e.expiresAt};return e.tkmsVersion&&(i.tkmsVersion=e.tkmsVersion),i}},pe=new Map([[V.version,V]]),me=V;function he(e){let t=e;return t.wrappingVersion!==void 0||t.wrappedPrivateKey!==void 0&&t.iv!==void 0}function ge(e){if(typeof e!=`object`||!e||!he(e)){let t=le.safeParse(e);return t.success?{kind:`plaintext`,keyPair:t.data}:{kind:`unrecognized`}}let t=e.wrappingVersion,n=typeof t==`number`?pe.get(t):void 0;if(n===void 0)return{kind:`unsupported-version`,version:t};let r=n.schema.safeParse(e);if(!r.success)return{kind:`corrupt-wrapped`};let i=r.data;return{kind:`wrapped`,expiresAt:i.expiresAt,decode:(e,t)=>n.decode(i,e,t)}}function _e(e,t,n){return me.encode(e,t,n)}function H(e){return`keypair:${e}`}function U(e){return`keypair:scope:${e}`}function W(e){return`permits:${e.signerAddress}:${e.chainId}:${e.delegatorAddress}`}function G(e){return`permits-index:${e}`}function K(e){return`scope:${e}`}function ve(e,t){return{"wrapped-without-secret":`Transport key pair for scope "${t}" is wrapped, but this instance has no transportKeyPairDerivationSecret configured. Every instance sharing this scope must use the same transportKeyPairDerivationSecret; once they do, call permits.revokeTransportKeyPair() to rotate the entry.`,"unwrapped-under-secret":`Transport key pair for scope "${t}" is stored unwrapped, but this instance is configured with a transportKeyPairDerivationSecret. A peer instance sharing this scope is running without the secret: configure the same transportKeyPairDerivationSecret everywhere, then call permits.revokeTransportKeyPair() to migrate the scope to a wrapped entry.`,"unwrap-failed":`Transport key pair for scope "${t}" failed to unwrap. This usually means another instance created it with a different transportKeyPairDerivationSecret: every instance sharing this scope must use the same secret. It can also mean the stored entry is corrupted.`,"corrupt-wrapped":`Transport key pair for scope "${t}" is wrapped but structurally invalid: the stored iv or ciphertext is not a shape this wrapping scheme can produce. This usually means the stored entry is corrupted, or instances sharing this scope are running mismatched wrapping-scheme versions.`}[e]}const ye={"unwrapped-under-secret":`unwrapped transport key pair entry found while a transportKeyPairDerivationSecret is configured`,"unwrap-failed":`transport key pair entry failed to unwrap (wrong transportKeyPairDerivationSecret?)`,"corrupt-wrapped":`structurally invalid wrapped transport key pair entry`};function be(e,t){let n=typeof e==`number`?`wrappingVersion ${e}`:`no wrappingVersion this build recognizes`;return`Transport key pair ${t===void 0?`for this signer`:`for scope "${t}"`} was written under a wrapping scheme this SDK build cannot read (${n}). The entry is preserved instead of regenerated, since an instance that understands the scheme may still be using it: ${t===void 0?`run a build that supports it, or call permits.clear() to discard the entry deliberately`:`run a build that supports it everywhere, or call permits.revokeTransportKeyPair() to rotate the scope`}.`}var xe=class{#e;#t;#n;#r;#i;#a;#o=new Map;#s=new Map;constructor(e){this.#e=e.generator,this.#t=e.storage,this.#n=e.ttl,this.#r=e.logger,this.#i=e.scope,this.#a=e.derivationSecret}#c(e){return this.#i===void 0?`signer:${e}`:K(this.#i)}#l(e){return this.#i===void 0?H(e):U(this.#i)}async readStored(e){return this.#u(this.#l(e),this.#c(e))}async#u(e,n){let r=await this.#t.get(e);if(r==null)return null;let i=ge(r);if(i.kind===`unsupported-version`)throw this.#f(e,be(i.version,this.#i));if(i.kind===`unrecognized`)return await this.#m(e,`malformed transport key pair entry`),null;let a=this.#a;if(a===void 0)return i.kind===`plaintext`?await this.#p(e,i.keyPair.expiresAt)?null:i.keyPair:this.#d(e,`wrapped-without-secret`);if(i.kind===`plaintext`)return this.#d(e,`unwrapped-under-secret`);if(i.kind===`corrupt-wrapped`)return this.#d(e,`corrupt-wrapped`);if(await this.#p(e,i.expiresAt))return null;try{return await i.decode(a,n)}catch(n){if(!ie(n))throw this.#r.error(`transport key pair unwrap failed unexpectedly`,{key:e,error:n}),new t.X(`Transport key pair unwrap failed unexpectedly.`,{cause:n});return this.#d(e,`unwrap-failed`,n)}}async#d(e,t,n){if(this.#i!==void 0)throw this.#f(e,ve(t,this.#i),n);if(t===`wrapped-without-secret`)throw this.#f(e,`Transport key pair for this signer is wrapped, but this instance has no transportKeyPairDerivationSecret configured. Configure the same transportKeyPairDerivationSecret the entry was written with. To downgrade to plaintext at rest on purpose, discard the stored entry first by calling permits.clear(), then run without the secret.`,n);let r=ye[t];return this.#r.warn(r,{key:e}),await this.#m(e,r),null}#f(e,n,r){return this.#r.error(n,{key:e}),new t.X(n,{cause:r})}async#p(e,t){return D()<t?!1:(await this.#m(e,`expired transport key pair entry`),!0)}async#m(e,n){this.#r.debug(`discarding transport key pair entry`,{key:e,reason:n}),await t.z(`delete transport key pair entry`,()=>this.#t.delete(e),this.#r)}async getOrCreate(e){return this.#h(this.#l(e),this.#c(e))}async#h(e,n,r){let i=r?.strict??!1,a=`${e}::${i}`,o=this.#o.get(a);if(o)return o;let s=this.#s.get(e)??0,c=(async()=>{let r=await this.#u(e,n);if(r!==null)return r;let a=await this.#e(),o=D(),c=o+this.#n,l={publicKey:a.publicKey,privateKey:a.privateKey,createdAt:o,expiresAt:c};a.tkmsVersion&&(l.tkmsVersion=a.tkmsVersion);let u=l;if(this.#a!==void 0)try{u=await _e(l,this.#a,n)}catch(n){let r=`Failed to wrap the transport private key for at-rest storage.`;throw this.#r.error(r,{key:e,error:n}),new t.X(r,{cause:n})}return(this.#s.get(e)??0)===s&&(i?await this.#t.set(e,u):await t.z(`persist transport key pair`,()=>this.#t.set(e,u),this.#r)),l})().finally(()=>{this.#o.delete(a)});return this.#o.set(a,c),c}async clear(e){let n=H(e);await t.z(`delete transport key pair entry`,()=>this.#t.delete(n),this.#r)}async evict(e){let n=this.#l(e);await t.z(`evict transport key pair entry`,()=>this.#t.delete(n),this.#r)}async clearScope(){if(this.#i===void 0)return;let e=U(this.#i);this.#s.set(e,(this.#s.get(e)??0)+1),await this.#t.delete(e)}async warmScope(){this.#i!==void 0&&await this.#h(U(this.#i),K(this.#i),{strict:!0})}};function q(e,t){let n=new Set(e.flatMap(e=>e.contractAddresses));return t.filter(e=>!n.has(e))}function Se(e){let t=[];for(let n=0;n<e.length;n+=10)t.push(e.slice(n,n+10));return t}function Ce(e,t,n){return e.filter(e=>e.keypairPublicKey===t&&n<e.startTimestamp+e.durationDays*86400)}function we(e,t){let n=new Set(t);return e.filter(e=>!e.contractAddresses.some(e=>n.has(e)))}function Te(e,t){return[...new Set([...e,...t])].sort()}function Ee(e,t,n){let r=new Set(n),i=e.filter(e=>new Set([...e.contractAddresses,...t]).size<=10);if(i.length===0)return null;function a(e){return e.contractAddresses.reduce((e,t)=>e+ +!!r.has(t),0)}let o=Math.max(...i.map(a));return i.filter(e=>a(e)===o).reduce((e,t)=>t.startTimestamp>e.startTimestamp?t:e)}var De=class{#e;#t;constructor(e){this.#e=e.storage,this.#t=e.logger}async list(e){let t=W(e),n=await this.#e.get(t);if(n==null)return[];let r=de.safeParse(n);return r.success?r.data:(await this.#a(t),await this.#i(e),[])}async listUsableAndPrune(e,n){let r=await this.list(e),i=Ce(r,n,Math.floor(Date.now()/1e3));if(i.length!==r.length){let n=W(e);i.length===0?(await this.#a(n),await this.#i(e)):await t.z(`update permit entry`,()=>this.#e.set(n,i),this.#t)}return i}async append(e,t){if(t.length===0)return;let n=t.map(e=>F.parse(e)),r=await this.list(e);await this.#e.set(W(e),[...r,...n]),await this.#r(e)}async replace(e,t,n){let r=F.parse(n),i=(await this.list(e)).filter(e=>e.serializedPermit.signature!==t);await this.#e.set(W(e),[...i,r]),await this.#r(e)}async deletePermitsTouching(e,t){let n=await this.list(e);if(n.length===0)return;let r=W(e),i=we(n,t);i.length===0?(await this.#a(r),await this.#i(e)):await this.#e.set(r,i)}async clearAllForSigner(e){let n=G(e),r=await this.#n(n);await Promise.all(r.map(e=>this.#a(e))),await t.z(`delete permit index`,()=>this.#e.delete(n),this.#t)}async#n(e){let n=await this.#e.get(e);if(n==null)return[];let r=fe.safeParse(n);return r.success?r.data:(await t.z(`delete permit index`,()=>this.#e.delete(e),this.#t),[])}async#r(e){let t=G(e.signerAddress),n=W(e),r=await this.#n(t);r.includes(n)||await this.#e.set(t,[...r,n])}async#i(e){let n=G(e.signerAddress),r=W(e),i=await this.#n(n),a=i.filter(e=>e!==r);a.length!==i.length&&(a.length===0?await t.z(`delete permit index`,()=>this.#e.delete(n),this.#t):await t.z(`update permit index`,()=>this.#e.set(n,a),this.#t))}async#a(e){await t.z(`delete permit entry`,()=>this.#e.delete(e),this.#t)}},Oe=class{#e;#t;#n;#r;#i;#a;#o;constructor(e){this.#e=new xe({generator:async()=>{let t=e.router.relayer,n=await t.generateTransportKeyPair();return t.serializeTransportKeyPair({transportKeyPair:n})},storage:e.storage,ttl:e.transportKeyPairTTL,logger:e.logger,scope:e.scope,derivationSecret:e.derivationSecret}),this.#t=new De({storage:e.permitStorage??e.storage,logger:e.logger}),this.#n=e.router,this.#r=e.signer,this.#i=e.permitTTL,this.#a=e.logger,this.#o=e.scope}#s(e){if(!this.#r)throw new t.B(e);return this.#r}async grantPermit(e,n){let r=m(this.#s(`grantPermit`).requireWalletAccount(`grantPermit`).address),i=O(e),a=await this.#e.getOrCreate(r);if(i.length===0)return{keypair:a,permissions:[]};let o={signerAddress:r,chainId:this.#n.chain.id,delegatorAddress:n?m(n):r},s=await this.#t.listUsableAndPrune(o,a.publicKey),c=q(s,i);if(c.length>0){let e=Ee(s,c,i);if(e!==null){let n=Te(e.contractAddresses,c),r=await this.#c({chunk:n,keypair:a,scope:o});await t.z(`replace permit`,()=>this.#t.replace(o,e.serializedPermit.signature,r),this.#a),s[s.indexOf(e)]=r}else for(let e of Se(c)){let n=await this.#c({chunk:e,keypair:a,scope:o});s.push(n),await t.z(`persist permit`,()=>this.#t.append(o,[n]),this.#a)}}let l=new Set(i);return{keypair:a,permissions:s.filter(e=>e.contractAddresses.some(e=>l.has(e)))}}async hasPermit(e,n){if(e.length===0)return!0;let r=this.#r?.walletAccount.getSnapshot();if(!r)return!1;let i=m(r.address),a;try{a=await this.#e.readStored(i)}catch(e){if(!(e instanceof t.X))throw e;return!1}if(a===null)return!1;let o={signerAddress:i,chainId:this.#n.chain.id,delegatorAddress:n?m(n):i};return q(await this.#t.listUsableAndPrune(o,a.publicKey),O(e)).length===0}async revokePermits(e){let t=m(this.#s(`revokePermits`).requireWalletAccount(`revokePermits`).address);if(e===void 0){await this.#t.clearAllForSigner(t);return}let n=O(e);if(n.length===0)return;let r=this.#n.chain.id;await this.#t.deletePermitsTouching({signerAddress:t,chainId:r,delegatorAddress:t},n)}async clearCredentials(){let e=m(this.#s(`clearCredentials`).requireWalletAccount(`clearCredentials`).address);await this.#e.clear(e),await this.#t.clearAllForSigner(e)}async revokeTransportKeyPair(t){if(this.#o===void 0)throw new e.t(`revokeTransportKeyPair() requires a transportKeyPairScope to be configured on this SDK instance — there is no shared key pair to revoke.`);if(t!==this.#o)throw new e.t(`revokeTransportKeyPair("${t}") does not match the configured scope ("${this.#o}").`);await this.#e.clearScope()}async warmTransportKeyPair(e){await this.#e.getOrCreate(m(e))}async warmTransportKeyPairScope(t){if(this.#o===void 0)throw new e.t(`warmTransportKeyPairScope() requires a transportKeyPairScope to be configured on this SDK instance — there is no shared key pair to warm.`);if(t!==this.#o)throw new e.t(`warmTransportKeyPairScope("${t}") does not match the configured scope ("${this.#o}").`);await this.#e.warmScope()}async handleWalletAccountChange(e,t){let n=e?m(e.address):void 0;n!==(t?m(t.address):void 0)&&n&&(await this.#e.clear(n),await this.#t.clearAllForSigner(n))}async#c(n){let{chunk:r,keypair:i,scope:a}=n,o=D(),s=a.delegatorAddress!==a.signerAddress,c=this.#n.relayer;try{let e={transportKeyPair:await c.parseTransportKeyPair(i),contractAddresses:r,startTimestamp:o,durationSeconds:this.#i*E,signerAddress:a.signerAddress,signer:this.#s(`signPermit`)},t=s?await c.signDecryptionPermit({...e,delegatorAddress:a.delegatorAddress}):await c.signDecryptionPermit(e),n=P.parse(await c.serializeSignedDecryptionPermit({signedPermit:t}));return{keypairPublicKey:i.publicKey,contractAddresses:r,serializedPermit:n,startTimestamp:o,durationDays:this.#i}}catch(n){throw n instanceof e.r?n:(n instanceof Error&&e.d(n.message)&&await this.#e.evict(a.signerAddress),t.J(n,`Credential signing failed`))}}async evictTransportKeyPair(){let e=this.#r?.walletAccount.getSnapshot();e&&await this.#e.evict(m(e.address))}},ke=class{#e;#t=`[zama-sdk]`;constructor(e){this.#e=e}error(e,t){this.#e?.error(`${this.#t} ${e}`,t)}warn(e,t){this.#e?.warn(`${this.#t} ${e}`,t)}info(e,t){this.#e?.info(`${this.#t} ${e}`,t)}debug(e,t){this.#e?.debug(`${this.#t} ${e}`,t)}};function J(t,n){let r=a.z.safeParse(t,n);if(r.success)return r.data;throw new e.t(a.z.prettifyError(r.error),{cause:r.error})}const Y={[n.s.id]:n.s.registryAddress,[n.l.id]:n.l.registryAddress,[n.c.id]:n.c.registryAddress,[n.a.id]:n.a.registryAddress,[n.o.id]:n.o.registryAddress,[n.n.id]:n.n.registryAddress},Ae=a.z.record(a.z.string().check(a.z.regex(/^\d+$/,`expected numeric chain id key`)),_),X=ee,Z=300*1e3;var je=class{provider;#e;#t;#n=new Map;constructor(e){this.provider=e.provider,this.#e=Object.assign({},Y,J(a.z.optional(Ae),e.registryAddresses)),this.#t=J(X,e.registryTTL??86400)*1e3}getAddress(e){return this.#e[e]}#r(e){let t=this.#n.get(e);if(t){if(Date.now()>=t.expiresAt){this.#n.delete(e);return}return t.data}}#i(e,t,n=this.#t){return this.#n.set(e,{data:t,expiresAt:Date.now()+n}),t}refresh(){this.#n.clear()}get ttlMs(){return this.#t}async getRegistryAddress(){let t=await this.provider.getChainId(),n=this.#e[t];if(!n)throw new e.t(`No wrappers registry address configured for chain ${t}.\nPass a registryAddresses entry for this chain.`);return(0,i.getAddress)(n)}async listPairs(n={}){let r=n.page??1,i=n.pageSize??100,a=n.metadata??!1;if(r<1)throw new e.t(`page must be >= 1, got ${r}`);if(i<1)throw new e.t(`pageSize must be >= 1, got ${i}`);let o=await this.getRegistryAddress(),s=`total:${o}`,c=this.#r(s);if(c===void 0){let e=await this.provider.readContract(t.s(o));c=this.#i(s,Number(e))}let l=BigInt((r-1)*i),u=l+BigInt(i)>BigInt(c)?BigInt(c):l+BigInt(i);if(l>=BigInt(c))return{items:[],total:c,page:r,pageSize:i};let d=`slice:${o}:${l}:${u}`,f=this.#r(d);if(f===void 0){let e=await this.provider.readContract(t.c(o,l,u));f=this.#i(d,[...e])}if(!a)return{items:f,total:c,page:r,pageSize:i};let p=`metadata:${o}:${l}:${u}`,m=this.#r(p);if(m===void 0){let e=await Promise.allSettled(f.map(e=>this.#a(e))),t=e.some(e=>e.status===`rejected`),n=e.map((e,t)=>e.status===`fulfilled`?e.value:Object.assign({},f[t],{metadataFailed:!0,underlying:{name:`Unknown`,symbol:`???`,decimals:0,totalSupply:0n},confidential:{name:`Unknown`,symbol:`???`,decimals:0}}));m=this.#i(p,n,t?Z:void 0)}return{items:m,total:c,page:r,pageSize:i}}async#a(e){let[n,r,i,a,o,s,c]=await Promise.all([this.provider.readContract(t.S(e.tokenAddress)),this.provider.readContract(t.C(e.tokenAddress)),this.provider.readContract(t.b(e.tokenAddress)),this.provider.readContract(t.x(e.tokenAddress)),this.provider.readContract(t.S(e.confidentialTokenAddress)),this.provider.readContract(t.C(e.confidentialTokenAddress)),this.provider.readContract(t.b(e.confidentialTokenAddress))]);return{...e,underlying:{name:n,symbol:r,decimals:i,totalSupply:a},confidential:{name:o,symbol:s,decimals:c}}}async getConfidentialToken(e){let n=await this.getRegistryAddress(),r=(0,i.getAddress)(e),a=`ct:${n}:${r}`,o=this.#r(a);if(o!==void 0)return o;let[s,c]=await this.provider.readContract(t.r(n,r));return c===i.zeroAddress?this.#i(a,null,Z):this.#i(a,{confidentialTokenAddress:c,isValid:s})}async getUnderlyingToken(e){let n=await this.getRegistryAddress(),r=(0,i.getAddress)(e),a=`ut:${n}:${r}`,o=this.#r(a);if(o!==void 0)return o;let[s,c]=await this.provider.readContract(t.i(n,r));return c===i.zeroAddress?this.#i(a,null,Z):this.#i(a,{tokenAddress:c,isValid:s})}async getTokenPairs(){let e=await this.getRegistryAddress();return this.provider.readContract(t.o(e))}async getTokenPairsLength(){let e=await this.getRegistryAddress();return this.provider.readContract(t.s(e))}async getTokenPairsSlice(e,n){let r=await this.getRegistryAddress();return this.provider.readContract(t.c(r,e,n))}async getTokenPair(e){let n=await this.getRegistryAddress();return this.provider.readContract(t.a(n,e))}async getConfidentialTokenAddress(e){let n=await this.getRegistryAddress();return this.provider.readContract(t.r(n,(0,i.getAddress)(e)))}async getTokenAddress(e){let n=await this.getRegistryAddress();return this.provider.readContract(t.i(n,(0,i.getAddress)(e)))}async isConfidentialTokenValid(e){let n=await this.getRegistryAddress();return this.provider.readContract(t.l(n,(0,i.getAddress)(e)))}};function Q(e,t,n){let i=new ke(n.logger),a=n.logger;if((0,r.hasFhevmRuntimeConfig)()){let e=`runtime configuration is already set and cannot be changed.`;n.runtime===void 0?i.debug(e):i.warn(e)}else(0,r.setFhevmRuntimeConfig)({wasmAssetLoadMode:`auto`,moduleVersions:`auto`,logger:{error:(e,t)=>a?.error(e,{cause:t}),warn:e=>a?.warn(e),debug:e=>a?.debug(e)},...n.runtime});let{storage:o,permitStorage:s}=d(n.storage,n.permitStorage),c=new p(n.chains,n.relayers);return{chains:n.chains,router:c,provider:t,signer:e,storage:o,permitStorage:s,transportKeyPairTTL:J(ae,n.transportKeyPairTTL??2592e3),permitTTL:J(oe,n.permitTTL??30),transportKeyPairScope:n.transportKeyPairScope===void 0?void 0:J(se,n.transportKeyPairScope),registryTTL:J(X,n.registryTTL??86400),logger:i,onEvent:n.onEvent}}function Me(e,t){return e?.address===t?.address&&e?.chainId===t?.chainId}var $=class{#e=new Set;#t;#n;constructor(e){this.#t=e,this.#n=e!==void 0}getSnapshot(){return this.#t}isReady(){return this.#n}setSnapshot(e){this.#n=!0;let t=this.#t;Me(t,e)||(this.#t=e,this.#r({previous:t,next:e}))}subscribe(e){this.#e.add(e);let t=this.#t;return t&&e({previous:void 0,next:t}),()=>{this.#e.delete(e)}}#r(e){for(let t of this.#e)t(e)}};function Ne(e){return new $(e)}var Pe=class{walletAccount;#e=!1;constructor(e){this.walletAccount=new $(e)}requireWalletAccount(e){let n=this.walletAccount.getSnapshot();if(!n)throw new t.U(e);return n}dispose(){this.#e||(this.#e=!0,this.onDispose())}[Symbol.dispose](){this.dispose()}onDispose(){}};Object.defineProperty(exports,"_",{enumerable:!0,get:function(){return o}}),Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return Y}}),Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return Oe}}),Object.defineProperty(exports,"d",{enumerable:!0,get:function(){return m}}),Object.defineProperty(exports,"f",{enumerable:!0,get:function(){return _}}),Object.defineProperty(exports,"g",{enumerable:!0,get:function(){return l}}),Object.defineProperty(exports,"h",{enumerable:!0,get:function(){return c}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return Q}}),Object.defineProperty(exports,"l",{enumerable:!0,get:function(){return ce}}),Object.defineProperty(exports,"m",{enumerable:!0,get:function(){return v}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return $}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return je}}),Object.defineProperty(exports,"p",{enumerable:!0,get:function(){return h}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Ne}}),Object.defineProperty(exports,"s",{enumerable:!0,get:function(){return J}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return Pe}}),Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return w}}),Object.defineProperty(exports,"v",{enumerable:!0,get:function(){return s}});
+const e=require("./relayer.cjs"),t=require("./sdk-events.cjs"),n=require("./chains.cjs");let r=require("@fhevm/sdk/viem"),i=require("viem"),a=require("zod/mini");var o=class{#e=null;#t=null;#n;#r;#i;constructor(e=`CredentialStore`,t=1,n=`credentials`){this.#n=e,this.#r=t,this.#i=n}#a(){return this.#e?Promise.resolve(this.#e):(this.#t||=new Promise((e,t)=>{let n=indexedDB.open(this.#n,this.#r);n.onupgradeneeded=()=>{let e=n.result;e.objectStoreNames.contains(this.#i)||e.createObjectStore(this.#i,{keyPath:`key`})},n.onsuccess=()=>{this.#e=n.result,this.#t=null,this.#e.onversionchange=()=>{this.#e?.close(),this.#e=null,this.#t=null},this.#e.onclose=()=>{this.#e=null,this.#t=null},e(this.#e)},n.onerror=()=>{this.#e=null,this.#t=null,t(n.error)}}),this.#t)}async#o(e,t){let n=await this.#a();return new Promise((r,i)=>{let a=n.transaction(this.#i,e);a.onabort=()=>i(a.error??Error(`Transaction aborted`));let o=t(a.objectStore(this.#i));e===`readonly`?o.onsuccess=()=>r(o.result):a.oncomplete=()=>r(o.result),o.onerror=()=>i(o.error)})}async get(e){return(await this.#o(`readonly`,t=>t.get(e)))?.value??null}async set(e,t){await this.#o(`readwrite`,n=>n.put({key:e,value:t}))}async delete(e){await this.#o(`readwrite`,t=>t.delete(e))}async clear(){await this.#o(`readwrite`,e=>e.clear())}};const s=new o;var c=class{#e=new Map;async get(e){return this.#e.get(e)??null}async set(e,t){this.#e.set(e,t)}async delete(e){this.#e.delete(e)}};const l=new c;function u(){return typeof window<`u`?new o(`CredentialStore`):new c}function d(e=u(),t=e){return{storage:e,permitStorage:t}}function f(t,n){let r=new Map(t.map(e=>[e.id,e]));if(r.size!==t.length){let n=t.map(e=>e.id);throw new e.t(`Duplicate chain id(s) [${[...new Set(n.filter((e,t)=>n.indexOf(e)!==t))].join(`, `)}] in the chains array. Each chain id must appear only once. Note: hardhat and anvil are aliases (both use 31337).`)}let i=new Map(Object.entries(n)),a=new Map;for(let t of r.keys()){let n=r.get(t),o=i.get(String(t));if(!o)throw new e.t(`Chain ${t} has no relayer configured. Add a relayer entry: relayers: { [${t}]: web() }`);if(!n)throw new e.t(`Chain ${t} has a relayer configured but no entry in the chains array. Add the chain config to the chains array.`);a.set(t,{chain:n,relayerConfig:o})}let o=new Set(Object.keys(n).map(Number)),s=new Set([...o].filter(e=>!r.has(e)));if(s.size>0)throw new e.t(`Relayer entries for chain(s) [${[...s].join(`, `)}] have no matching entry in the chains array. Remove them or add the corresponding chain config.`);return a}var p=class{#e;#t;#n;constructor(t,n){if(t.length===0)throw new e.t(`At least one chain is required.`);this.#e=new Map(t.map(e=>[e.id,e])),this.#n=t[0].id;let r=new Map;for(let[e,{relayerConfig:i,chain:a}]of f(t,n))r.set(e,i.createRelayer(a));this.#t=r}get chains(){return[...this.#e.values()]}get chain(){let t=this.#e.get(this.#n);if(t===void 0)throw new e.t(`Chain ${this.#n} is not configured. Add it to the chains array.`);return t}switchChain(e){this.#n=e}get relayer(){let t=this.#t.get(this.chain.id);if(t===void 0)throw new e.t(`No relayer configured for chain ${this.#n}. Add it to the relayers object.`);return t}};function m(e){return(0,i.getAddress)(e)}const h=a.z.custom(e=>typeof e==`string`&&(0,i.isHex)(e,{strict:!0}),`expected 0x-prefixed hex string`),g=a.z.custom(e=>typeof e==`string`&&(0,i.isAddress)(e,{strict:!1}),`expected EVM address`),_=a.z.pipe(g,a.z.transform(m)),v=a.z.int().check(a.z.nonnegative()),y=a.z.int().check(a.z.positive()),ee=a.z.int().check(a.z.nonnegative()),te=a.z.int().check(a.z.positive());a.z.int().check(a.z.positive());function b(t,n){let r=a.z.safeParse(t,n);if(r.success)return r.data;throw new e.t(a.z.prettifyError(r.error),{cause:r.error})}const x={version:1,info:`zama-sdk-keypair-wrapping-v1`,ivLengthBytes:12,tagLengthBytes:16};function S(e){return new Uint8Array(e)}function C(e){return S(new TextEncoder().encode(JSON.stringify([e.publicKey,e.createdAt,e.expiresAt,e.tkmsVersion??null])))}function w(e){return typeof e==`string`?new TextEncoder().encode(e):S(e)}var ne=class{#e;#t;constructor(e){this.#e=e}async baseKey(){return this.#t??=this.#n(this.#e),this.#t}async#n(e){let t=w(e),n=await crypto.subtle.importKey(`raw`,t,`HKDF`,!1,[`deriveKey`]);return t.fill(0),e instanceof Uint8Array&&e.fill(0),this.#e=void 0,n}};async function T(e,t){let n=await e.baseKey();return crypto.subtle.deriveKey({name:`HKDF`,hash:`SHA-256`,salt:new TextEncoder().encode(t),info:new TextEncoder().encode(x.info)},n,{name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}async function re(e,t,n,r){let a=await T(t,n),o=crypto.getRandomValues(new Uint8Array(x.ivLengthBytes)),s=await crypto.subtle.encrypt({name:`AES-GCM`,iv:o,additionalData:C(r)},a,S((0,i.toBytes)(e)));return{wrappedPrivateKey:(0,i.toHex)(new Uint8Array(s)),iv:(0,i.toHex)(o)}}async function ie(e,t,n,r){let a=await T(t,n),o=await crypto.subtle.decrypt({name:`AES-GCM`,iv:S((0,i.toBytes)(e.iv)),additionalData:C(r)},a,S((0,i.toBytes)(e.wrappedPrivateKey)));return(0,i.toHex)(new Uint8Array(o))}function ae(e){return typeof e==`object`&&!!e&&`name`in e&&e.name===`OperationError`}const E=86400;function D(){return Math.floor(Date.now()/1e3)}function O(e){return[...new Set(e.map(m))].sort()}function oe(e){let{chainId:t}=e.domain;return typeof t==`bigint`?{...e,domain:{...e.domain,chainId:t.toString()}}:e}const k=`transportKeyPairTTL must be a positive integer number of seconds`,A=`permitTTL must be a positive integer number of days`,j=`transportKeyPairScope must be a non-empty string`,M=`transportKeyPairDerivationSecret must be a Uint8Array of at least 32 bytes or a string of at least 64 characters (256 bits of entropy): source it from a CSPRNG or secrets manager, not a human-memorable passphrase`,N=365*E,se=a.z.int({error:k}).check(a.z.positive({error:k}),a.z.maximum(N,`transportKeyPairTTL must not exceed the fhevm ACL maximum of ${N}s (365 days)`)),P=a.z.int({error:A}).check(a.z.positive({error:A}),a.z.maximum(365,`permitTTL must not exceed the V1 permit maximum of 365 days`)),ce=a.z.string({error:j}).check(a.z.minLength(1,j)),le=a.z.union([a.z.string({error:M}).check(a.z.minLength(64,M)),a.z.instanceof(Uint8Array,{error:M}).check(a.z.refine(e=>e.byteLength>=32,{error:M}))],{error:M}),ue=a.z.object({publicKey:h,privateKey:h,createdAt:v,expiresAt:y,tkmsVersion:a.z.optional(a.z.string())}),F=a.z.object({domain:a.z.record(a.z.string(),a.z.unknown()),primaryType:a.z.optional(a.z.string()),types:a.z.record(a.z.string(),a.z.array(a.z.object({name:a.z.string(),type:a.z.string()}))),message:a.z.record(a.z.string(),a.z.unknown())}),I=a.z.object({version:a.z.int().check(a.z.positive()),eip712:F,signature:h,signerAddress:_}),L=a.z.object({keypairPublicKey:h,contractAddresses:a.z.array(_).check(a.z.maxLength(10)),serializedPermit:I,startTimestamp:v,durationDays:te}),de=a.z.array(L),fe=a.z.array(a.z.string()),pe=a.z.object({version:a.z.literal(1),eip712:F,signerAddress:_}),me=`iv must be a ${x.ivLengthBytes}-byte hex string`,R=`wrappedPrivateKey must be a whole number of bytes and at least ${x.tagLengthBytes} bytes (the AES-GCM authentication tag)`;function z(e){return(e.length-2)/2}const he=a.z.object({wrappingVersion:a.z.literal(x.version,{error:`wrappingVersion must be a wrapping scheme this SDK can read`}),publicKey:h,wrappedPrivateKey:h.check(a.z.refine(e=>e.length%2==0&&z(e)>=x.tagLengthBytes,{error:R})),iv:h.check(a.z.refine(e=>z(e)===x.ivLengthBytes,{error:me})),createdAt:v,expiresAt:y,tkmsVersion:a.z.optional(a.z.string())});function B(e){let t={publicKey:e.publicKey,createdAt:e.createdAt,expiresAt:e.expiresAt};return e.tkmsVersion&&(t.tkmsVersion=e.tkmsVersion),t}const V={version:x.version,schema:he,async encode(e,t,n){let{wrappedPrivateKey:r,iv:i}=await re(e.privateKey,t,n,B(e)),a={wrappingVersion:x.version,publicKey:e.publicKey,wrappedPrivateKey:r,iv:i,createdAt:e.createdAt,expiresAt:e.expiresAt};return e.tkmsVersion&&(a.tkmsVersion=e.tkmsVersion),a},async decode(e,t,n){let r=await ie({wrappedPrivateKey:e.wrappedPrivateKey,iv:e.iv},t,n,B(e)),i={publicKey:e.publicKey,privateKey:r,createdAt:e.createdAt,expiresAt:e.expiresAt};return e.tkmsVersion&&(i.tkmsVersion=e.tkmsVersion),i}},ge=new Map([[V.version,V]]),_e=V;function ve(e){let t=e;return t.wrappingVersion!==void 0||t.wrappedPrivateKey!==void 0&&t.iv!==void 0}function ye(e){if(typeof e!=`object`||!e||!ve(e)){let t=ue.safeParse(e);return t.success?{kind:`plaintext`,keyPair:t.data}:{kind:`unrecognized`}}let t=e.wrappingVersion,n=typeof t==`number`?ge.get(t):void 0;if(n===void 0)return{kind:`unsupported-version`,version:t};let r=n.schema.safeParse(e);if(!r.success)return{kind:`corrupt-wrapped`};let i=r.data;return{kind:`wrapped`,expiresAt:i.expiresAt,decode:(e,t)=>n.decode(i,e,t)}}function be(e,t,n){return _e.encode(e,t,n)}function H(e){return`keypair:${e}`}function U(e){return`keypair:scope:${e}`}function W(e){return`permits:${e.signerAddress}:${e.chainId}:${e.delegatorAddress}`}function G(e){return`permits-index:${e}`}function K(e){return`scope:${e}`}function xe(e,t){return{"wrapped-without-secret":`Transport key pair for scope "${t}" is wrapped, but this instance has no transportKeyPairDerivationSecret configured. Every instance sharing this scope must use the same transportKeyPairDerivationSecret; once they do, call permits.revokeTransportKeyPair() to rotate the entry.`,"unwrapped-under-secret":`Transport key pair for scope "${t}" is stored unwrapped, but this instance is configured with a transportKeyPairDerivationSecret. A peer instance sharing this scope is running without the secret: configure the same transportKeyPairDerivationSecret everywhere, then call permits.revokeTransportKeyPair() to migrate the scope to a wrapped entry.`,"unwrap-failed":`Transport key pair for scope "${t}" failed to unwrap. This usually means another instance created it with a different transportKeyPairDerivationSecret: every instance sharing this scope must use the same secret. It can also mean the stored entry is corrupted.`,"corrupt-wrapped":`Transport key pair for scope "${t}" is wrapped but structurally invalid: the stored iv or ciphertext is not a shape this wrapping scheme can produce. This usually means the stored entry is corrupted, or instances sharing this scope are running mismatched wrapping-scheme versions.`}[e]}const Se={"unwrapped-under-secret":`unwrapped transport key pair entry found while a transportKeyPairDerivationSecret is configured`,"unwrap-failed":`transport key pair entry failed to unwrap (wrong transportKeyPairDerivationSecret?)`,"corrupt-wrapped":`structurally invalid wrapped transport key pair entry`};function Ce(e,t){let n=typeof e==`number`?`wrappingVersion ${e}`:`no wrappingVersion this build recognizes`;return`Transport key pair ${t===void 0?`for this signer`:`for scope "${t}"`} was written under a wrapping scheme this SDK build cannot read (${n}). The entry is preserved instead of regenerated, since an instance that understands the scheme may still be using it: ${t===void 0?`run a build that supports it, or call permits.clear() to discard the entry deliberately`:`run a build that supports it everywhere, or call permits.revokeTransportKeyPair() to rotate the scope`}.`}var we=class{#e;#t;#n;#r;#i;#a;#o=new Map;#s=new Map;constructor(e){this.#e=e.generator,this.#t=e.storage,this.#n=e.ttl,this.#r=e.logger,this.#i=e.scope,this.#a=e.derivationSecret}#c(e){return this.#i===void 0?`signer:${e}`:K(this.#i)}#l(e){return this.#i===void 0?H(e):U(this.#i)}async readStored(e){return this.#u(this.#l(e),this.#c(e))}async#u(e,n){let r=await this.#t.get(e);if(r==null)return null;let i=ye(r);if(i.kind===`unsupported-version`)throw this.#f(e,Ce(i.version,this.#i));if(i.kind===`unrecognized`)return await this.#m(e,`malformed transport key pair entry`),null;let a=this.#a;if(a===void 0)return i.kind===`plaintext`?await this.#p(e,i.keyPair.expiresAt)?null:i.keyPair:this.#d(e,`wrapped-without-secret`);if(i.kind===`plaintext`)return this.#d(e,`unwrapped-under-secret`);if(i.kind===`corrupt-wrapped`)return this.#d(e,`corrupt-wrapped`);if(await this.#p(e,i.expiresAt))return null;try{return await i.decode(a,n)}catch(n){if(!ae(n))throw this.#r.error(`transport key pair unwrap failed unexpectedly`,{key:e,error:n}),new t.X(`Transport key pair unwrap failed unexpectedly.`,{cause:n});return this.#d(e,`unwrap-failed`,n)}}async#d(e,t,n){if(this.#i!==void 0)throw this.#f(e,xe(t,this.#i),n);if(t===`wrapped-without-secret`)throw this.#f(e,`Transport key pair for this signer is wrapped, but this instance has no transportKeyPairDerivationSecret configured. Configure the same transportKeyPairDerivationSecret the entry was written with. To downgrade to plaintext at rest on purpose, discard the stored entry first by calling permits.clear(), then run without the secret.`,n);let r=Se[t];return this.#r.warn(r,{key:e}),await this.#m(e,r),null}#f(e,n,r){return this.#r.error(n,{key:e}),new t.X(n,{cause:r})}async#p(e,t){return D()<t?!1:(await this.#m(e,`expired transport key pair entry`),!0)}async#m(e,n){this.#r.debug(`discarding transport key pair entry`,{key:e,reason:n}),await t.z(`delete transport key pair entry`,()=>this.#t.delete(e),this.#r)}async getOrCreate(e,t){return this.#h(this.#l(e),this.#c(e),{strict:t?.strict})}async#h(e,n,r){let i=r?.strict??!1,a=`${e}::${i}`,o=this.#o.get(a);if(o)return o;let s=this.#s.get(e)??0,c=(async()=>{let r=await this.#u(e,n);if(r!==null)return r;let a=await this.#e(),o=D(),c=o+this.#n,l={publicKey:a.publicKey,privateKey:a.privateKey,createdAt:o,expiresAt:c};a.tkmsVersion&&(l.tkmsVersion=a.tkmsVersion);let u=l;if(this.#a!==void 0)try{u=await be(l,this.#a,n)}catch(n){let r=`Failed to wrap the transport private key for at-rest storage.`;throw this.#r.error(r,{key:e,error:n}),new t.X(r,{cause:n})}if((this.#s.get(e)??0)===s)i?await this.#t.set(e,u):await t.z(`persist transport key pair`,()=>this.#t.set(e,u),this.#r);else if(i)throw new t.tt(`The transport key pair was rotated while it was being generated, so the freshly generated key pair could not be persisted. Retry.`);return l})().finally(()=>{this.#o.delete(a)});return this.#o.set(a,c),c}async clear(e){let n=H(e);await t.z(`delete transport key pair entry`,()=>this.#t.delete(n),this.#r)}async evict(e){let n=this.#l(e);await t.z(`evict transport key pair entry`,()=>this.#t.delete(n),this.#r)}async clearScope(){if(this.#i===void 0)return;let e=U(this.#i);this.#s.set(e,(this.#s.get(e)??0)+1),await this.#t.delete(e)}async warmScope(){this.#i!==void 0&&await this.#h(U(this.#i),K(this.#i),{strict:!0})}};function q(e,t){let n=new Set(e.flatMap(e=>e.contractAddresses));return t.filter(e=>!n.has(e))}function Te(e){let t=[];for(let n=0;n<e.length;n+=10)t.push(e.slice(n,n+10));return t}function Ee(e,t,n){return e.filter(e=>e.keypairPublicKey===t&&n<e.startTimestamp+e.durationDays*86400)}function De(e,t){let n=new Set(t);return e.filter(e=>!e.contractAddresses.some(e=>n.has(e)))}function J(e,t){return[...new Set([...e,...t])].sort()}function Oe(e,t,n){let r=new Set(n),i=e.filter(e=>new Set([...e.contractAddresses,...t]).size<=10);if(i.length===0)return null;function a(e){return e.contractAddresses.reduce((e,t)=>e+ +!!r.has(t),0)}let o=Math.max(...i.map(a));return i.filter(e=>a(e)===o).reduce((e,t)=>t.startTimestamp>e.startTimestamp?t:e)}var ke=class{#e;#t;constructor(e){this.#e=e.storage,this.#t=e.logger}async list(e){let t=W(e),n=await this.#e.get(t);if(n==null)return[];let r=de.safeParse(n);return r.success?r.data:(await this.clearScope(e),[])}async listUsableAndPrune(e,n){let r=await this.list(e),i=Ee(r,n,Math.floor(Date.now()/1e3));return i.length!==r.length&&(i.length===0?await this.clearScope(e):await t.z(`update permit entry`,()=>this.#e.set(W(e),i),this.#t)),i}async append(e,t){if(t.length===0)return;let n=t.map(e=>L.parse(e)),r=await this.list(e);await this.#e.set(W(e),[...r,...n]),await this.#r(e)}async replace(e,t,n){let r=L.parse(n),i=(await this.list(e)).filter(e=>e.serializedPermit.signature!==t);await this.#e.set(W(e),[...i,r]),await this.#r(e)}async deletePermitsTouching(e,t){let n=await this.list(e);if(n.length===0)return;let r=De(n,t);r.length===0?await this.clearScope(e):await this.#e.set(W(e),r)}async clearScope(e){await this.#a(W(e)),await this.#i(e)}async clearAllForSigner(e){let n=G(e),r=await this.#n(n);await Promise.all(r.map(e=>this.#a(e))),await t.z(`delete permit index`,()=>this.#e.delete(n),this.#t)}async#n(e){let n=await this.#e.get(e);if(n==null)return[];let r=fe.safeParse(n);return r.success?r.data:(await t.z(`delete permit index`,()=>this.#e.delete(e),this.#t),[])}async#r(e){let t=G(e.signerAddress),n=W(e),r=await this.#n(t);r.includes(n)||await this.#e.set(t,[...r,n])}async#i(e){let n=G(e.signerAddress),r=W(e),i=await this.#n(n),a=i.filter(e=>e!==r);a.length!==i.length&&(a.length===0?await t.z(`delete permit index`,()=>this.#e.delete(n),this.#t):await t.z(`update permit index`,()=>this.#e.set(n,a),this.#t))}async#a(e){await t.z(`delete permit entry`,()=>this.#e.delete(e),this.#t)}},Y=class{#e;#t;#n;#r;#i;#a;#o;#s=new Map;constructor(e){this.#e=new we({generator:async()=>{let t=e.router.relayer,n=await t.generateTransportKeyPair();return t.serializeTransportKeyPair({transportKeyPair:n})},storage:e.storage,ttl:e.transportKeyPairTTL,logger:e.logger,scope:e.scope,derivationSecret:e.derivationSecret}),this.#t=new ke({storage:e.permitStorage??e.storage,logger:e.logger}),this.#n=e.router,this.#r=e.signer,this.#i=e.permitTTL,this.#a=e.logger,this.#o=e.scope}#c(e){if(!this.#r)throw new t.B(e);return this.#r}async grantPermit(e,n){let r=m(this.#c(`grantPermit`).requireWalletAccount(`grantPermit`).address),i=O(e),a=await this.#e.getOrCreate(r);if(i.length===0)return{keypair:a,permissions:[]};let o=this.#l(r,n),s=await this.#t.listUsableAndPrune(o,a.publicKey),c=q(s,i);if(c.length>0){let e=Oe(s,c,i);if(e!==null){let n=J(e.contractAddresses,c),r=await this.#u({chunk:n,keypair:a,scope:o});await t.z(`replace permit`,()=>this.#t.replace(o,e.serializedPermit.signature,r),this.#a),s[s.indexOf(e)]=r}else for(let e of Te(c)){let n=await this.#u({chunk:e,keypair:a,scope:o});s.push(n),await t.z(`persist permit`,()=>this.#t.append(o,[n]),this.#a)}}let l=new Set(i);return{keypair:a,permissions:s.filter(e=>e.contractAddresses.some(e=>l.has(e)))}}async preparePermit(t){let n=m(t.signer),r=O(t.contracts);if(r.length===0)throw new e.t(`preparePermit: request.contracts must not be empty.`);if(r.length>10)throw new e.t(`preparePermit: request.contracts must not exceed 10 addresses per call (got ${r.length}) — grantPermit chunks automatically, preparePermit does not.`);let i=t.delegator?m(t.delegator):void 0;if(i!==void 0&&i===n)throw new e.t(`preparePermit: request.delegator must differ from request.signer — self-delegation is not allowed.`);let a=t.durationDays===void 0?this.#i:b(P,t.durationDays),o=this.#n.relayer,s=await this.#e.getOrCreate(n,{strict:!0}),c=await o.parseTransportKeyPair(s),l=D();return{version:1,eip712:oe(F.parse(await o.createUnsignedLegacyDecryptionPermitEip712({transportKeyPair:c,contractAddresses:r,startTimestamp:l,durationSeconds:a*E,...i&&{delegatorAddress:i}}))),signerAddress:n}}async registerPermit(n,r){let i=b(pe,n),a=this.#n.relayer,o=this.#n.chain.id,{domain:s,message:c}=i.eip712,l=Number(s.chainId);if(l!==o)throw new t.Q({preparedChainId:l,activeChainId:o});let u=Number(c.startTimestamp),d=Number(c.durationDays);if(D()>=u+d*86400)throw new t.$(`registerPermit: the prepared permit's validity window (starting ${u}, ${d}d) has already elapsed — call preparePermit again.`);let f=i.signerAddress,p=await this.#e.readStored(f);if(p===null||p.publicKey!==c.publicKey)throw new t.tt(`registerPermit: the transport key pair changed since preparePermit ran — call preparePermit again to rebind the signature request to the current key pair.`);let h=await a.parseTransportKeyPair(p),g;try{g=await a.parseSignedDecryptionPermit({serializedPermit:{version:i.version,eip712:i.eip712,signature:r,signerAddress:f},transportKeyPair:h})}catch(n){throw n instanceof e.r?n:t.J(n,`registerPermit: signature verification failed`)}if(g.version!==1)throw new e.t(`registerPermit: expected a V1 signed permit, got version ${g.version}.`);let _=I.parse(await a.serializeSignedDecryptionPermit({signedPermit:g})),v={keypairPublicKey:p.publicKey,contractAddresses:O(g.eip712.message.contractAddresses),serializedPermit:_,startTimestamp:Number(g.eip712.message.startTimestamp),durationDays:Number(g.eip712.message.durationDays)},y={signerAddress:f,chainId:o,delegatorAddress:m(g.encryptedDataOwnerAddress)};await this.#t.replace(y,_.signature,v)}async hasPermit(e,n){if(e.length===0)return!0;let r=this.#r?.walletAccount.getSnapshot();if(!r)return!1;let i=m(r.address),a;try{a=await this.#e.readStored(i)}catch(e){if(!(e instanceof t.X))throw e;return!1}if(a===null)return!1;let o=this.#l(i,n);return q(await this.#t.listUsableAndPrune(o,a.publicKey),O(e)).length===0}async revokePermits(e){let t=m(this.#c(`revokePermits`).requireWalletAccount(`revokePermits`).address);if(e===void 0){await this.#t.clearAllForSigner(t);return}let n=O(e);n.length!==0&&await this.#t.deletePermitsTouching(this.#l(t),n)}#l(e,t){return{signerAddress:e,chainId:this.#n.chain.id,delegatorAddress:t?m(t):e}}async clearCredentials(){let e=m(this.#c(`clearCredentials`).requireWalletAccount(`clearCredentials`).address);await this.#e.clear(e),await this.#t.clearAllForSigner(e)}async revokeTransportKeyPair(t){if(this.#o===void 0)throw new e.t(`revokeTransportKeyPair() requires a transportKeyPairScope to be configured on this SDK instance — there is no shared key pair to revoke.`);if(t!==this.#o)throw new e.t(`revokeTransportKeyPair("${t}") does not match the configured scope ("${this.#o}").`);await this.#e.clearScope()}async warmTransportKeyPair(e){await this.#e.getOrCreate(m(e))}async warmTransportKeyPairScope(t){if(this.#o===void 0)throw new e.t(`warmTransportKeyPairScope() requires a transportKeyPairScope to be configured on this SDK instance — there is no shared key pair to warm.`);if(t!==this.#o)throw new e.t(`warmTransportKeyPairScope("${t}") does not match the configured scope ("${this.#o}").`);await this.#e.warmScope()}async handleWalletAccountChange(e,t){let n=e?m(e.address):void 0;n!==(t?m(t.address):void 0)&&n&&(await this.#e.clear(n),await this.#t.clearAllForSigner(n))}async#u(n){let{chunk:r,keypair:i,scope:a}=n,o=D(),s=a.delegatorAddress!==a.signerAddress,c=this.#n.relayer;try{let e={transportKeyPair:await c.parseTransportKeyPair(i),contractAddresses:r,startTimestamp:o,durationSeconds:this.#i*E,signerAddress:a.signerAddress,signer:this.#c(`signPermit`)},t=s?await c.signDecryptionPermit({...e,delegatorAddress:a.delegatorAddress}):await c.signDecryptionPermit(e),n=I.parse(await c.serializeSignedDecryptionPermit({signedPermit:t}));return{keypairPublicKey:i.publicKey,contractAddresses:r,serializedPermit:n,startTimestamp:o,durationDays:this.#i}}catch(n){throw n instanceof e.r?n:(n instanceof Error&&e.d(n.message)&&await this.#e.evict(a.signerAddress),t.J(n,`Credential signing failed`))}}async evictTransportKeyPair(){let e=this.#r?.walletAccount.getSnapshot();e&&await this.#e.evict(m(e.address))}async recoverPermits(e,t,n){let r=this.#c(`recoverPermits`).requireWalletAccount(`recoverPermits`),i=this.#l(m(r.address),t),a=W(i),o=this.#s.get(a);if(o)return await o,this.grantPermit(e,t);let s=await this.#d(i),c=this.#s.get(a);if(c)return await c,this.grantPermit(e,t);if(s===null)return this.grantPermit(e,t);let l=new Set(n??[]);if(l.size>0&&!s.some(e=>l.has(e.serializedPermit.signature)))return this.grantPermit(e,t);let u=s.filter(e=>!l.has(e.serializedPermit.signature)),d=s.flatMap(e=>e.contractAddresses),f=this.#f(i,d,e,u,t).finally(()=>{this.#s.delete(a)});return this.#s.set(a,f),await f,this.grantPermit(e,t)}async#d(e){try{return await this.#t.list(e)}catch(e){return this.#a.warn(`read permits for recovery failed`,{error:e}),null}}async#f(e,n,r,i,a){await t.z(`evict revoked permits`,()=>this.#t.clearScope(e),this.#a);try{await this.grantPermit(J(n,O(r)),a)}catch(n){throw i.length>0&&await t.z(`restore surviving permits`,async()=>{let t=await this.#t.list(e),n=new Set(t.map(e=>e.serializedPermit.signature)),r=i.filter(e=>!n.has(e.serializedPermit.signature));r.length>0&&await this.#t.append(e,r)},this.#a),n}}},Ae=class{#e;#t=`[zama-sdk]`;constructor(e){this.#e=e}error(e,t){this.#e?.error(`${this.#t} ${e}`,t)}warn(e,t){this.#e?.warn(`${this.#t} ${e}`,t)}info(e,t){this.#e?.info(`${this.#t} ${e}`,t)}debug(e,t){this.#e?.debug(`${this.#t} ${e}`,t)}};const X={[n.s.id]:n.s.registryAddress,[n.c.id]:n.c.registryAddress,[n.u.id]:n.u.registryAddress,[n.l.id]:n.l.registryAddress,[n.a.id]:n.a.registryAddress,[n.o.id]:n.o.registryAddress,[n.n.id]:n.n.registryAddress},je=a.z.record(a.z.string().check(a.z.regex(/^\d+$/,`expected numeric chain id key`)),_),Z=ee,Q=300*1e3;var Me=class{provider;#e;#t;#n=new Map;constructor(e){this.provider=e.provider,this.#e=Object.assign({},X,b(a.z.optional(je),e.registryAddresses)),this.#t=b(Z,e.registryTTL??86400)*1e3}getAddress(e){return this.#e[e]}#r(e){let t=this.#n.get(e);if(t){if(Date.now()>=t.expiresAt){this.#n.delete(e);return}return t.data}}#i(e,t,n=this.#t){return this.#n.set(e,{data:t,expiresAt:Date.now()+n}),t}refresh(){this.#n.clear()}get ttlMs(){return this.#t}async getRegistryAddress(){let t=await this.provider.getChainId(),n=this.#e[t];if(!n)throw new e.t(`No wrappers registry address configured for chain ${t}.\nPass a registryAddresses entry for this chain.`);return(0,i.getAddress)(n)}async listPairs(n={}){let r=n.page??1,i=n.pageSize??100,a=n.metadata??!1;if(r<1)throw new e.t(`page must be >= 1, got ${r}`);if(i<1)throw new e.t(`pageSize must be >= 1, got ${i}`);let o=await this.getRegistryAddress(),s=`total:${o}`,c=this.#r(s);if(c===void 0){let e=await this.provider.readContract(t.s(o));c=this.#i(s,Number(e))}let l=BigInt((r-1)*i),u=l+BigInt(i)>BigInt(c)?BigInt(c):l+BigInt(i);if(l>=BigInt(c))return{items:[],total:c,page:r,pageSize:i};let d=`slice:${o}:${l}:${u}`,f=this.#r(d);if(f===void 0){let e=await this.provider.readContract(t.c(o,l,u));f=this.#i(d,[...e])}if(!a)return{items:f,total:c,page:r,pageSize:i};let p=`metadata:${o}:${l}:${u}`,m=this.#r(p);if(m===void 0){let e=await Promise.allSettled(f.map(e=>this.#a(e))),t=e.some(e=>e.status===`rejected`),n=e.map((e,t)=>e.status===`fulfilled`?e.value:Object.assign({},f[t],{metadataFailed:!0,underlying:{name:`Unknown`,symbol:`???`,decimals:0,totalSupply:0n},confidential:{name:`Unknown`,symbol:`???`,decimals:0}}));m=this.#i(p,n,t?Q:void 0)}return{items:m,total:c,page:r,pageSize:i}}async#a(e){let[n,r,i,a,o,s,c]=await Promise.all([this.provider.readContract(t.S(e.tokenAddress)),this.provider.readContract(t.C(e.tokenAddress)),this.provider.readContract(t.b(e.tokenAddress)),this.provider.readContract(t.x(e.tokenAddress)),this.provider.readContract(t.S(e.confidentialTokenAddress)),this.provider.readContract(t.C(e.confidentialTokenAddress)),this.provider.readContract(t.b(e.confidentialTokenAddress))]);return{...e,underlying:{name:n,symbol:r,decimals:i,totalSupply:a},confidential:{name:o,symbol:s,decimals:c}}}async getConfidentialToken(e){let n=await this.getRegistryAddress(),r=(0,i.getAddress)(e),a=`ct:${n}:${r}`,o=this.#r(a);if(o!==void 0)return o;let[s,c]=await this.provider.readContract(t.r(n,r));return c===i.zeroAddress?this.#i(a,null,Q):this.#i(a,{confidentialTokenAddress:c,isValid:s})}async getUnderlyingToken(e){let n=await this.getRegistryAddress(),r=(0,i.getAddress)(e),a=`ut:${n}:${r}`,o=this.#r(a);if(o!==void 0)return o;let[s,c]=await this.provider.readContract(t.i(n,r));return c===i.zeroAddress?this.#i(a,null,Q):this.#i(a,{tokenAddress:c,isValid:s})}async getTokenPairs(){let e=await this.getRegistryAddress();return this.provider.readContract(t.o(e))}async getTokenPairsLength(){let e=await this.getRegistryAddress();return this.provider.readContract(t.s(e))}async getTokenPairsSlice(e,n){let r=await this.getRegistryAddress();return this.provider.readContract(t.c(r,e,n))}async getTokenPair(e){let n=await this.getRegistryAddress();return this.provider.readContract(t.a(n,e))}async getConfidentialTokenAddress(e){let n=await this.getRegistryAddress();return this.provider.readContract(t.r(n,(0,i.getAddress)(e)))}async getTokenAddress(e){let n=await this.getRegistryAddress();return this.provider.readContract(t.i(n,(0,i.getAddress)(e)))}async isConfidentialTokenValid(e){let n=await this.getRegistryAddress();return this.provider.readContract(t.l(n,(0,i.getAddress)(e)))}};function Ne(e,t,n){let i=new Ae(n.logger),a=n.logger;if((0,r.hasFhevmRuntimeConfig)()){let e=`runtime configuration is already set and cannot be changed.`;n.runtime===void 0?i.debug(e):i.warn(e)}else(0,r.setFhevmRuntimeConfig)({wasmAssetLoadMode:`auto`,moduleVersions:`auto`,logger:{error:(e,t)=>a?.error(e,{cause:t}),warn:e=>a?.warn(e),debug:e=>a?.debug(e)},...n.runtime});let{storage:o,permitStorage:s}=d(n.storage,n.permitStorage),c=new p(n.chains,n.relayers);return{chains:n.chains,router:c,provider:t,signer:e,storage:o,permitStorage:s,transportKeyPairTTL:b(se,n.transportKeyPairTTL??2592e3),permitTTL:b(P,n.permitTTL??30),transportKeyPairScope:n.transportKeyPairScope===void 0?void 0:b(ce,n.transportKeyPairScope),registryTTL:b(Z,n.registryTTL??86400),logger:i,onEvent:n.onEvent}}function Pe(e,t){return e?.address===t?.address&&e?.chainId===t?.chainId}var $=class{#e=new Set;#t;#n;constructor(e){this.#t=e,this.#n=e!==void 0}getSnapshot(){return this.#t}isReady(){return this.#n}setSnapshot(e){this.#n=!0;let t=this.#t;Pe(t,e)||(this.#t=e,this.#r({previous:t,next:e}))}subscribe(e){this.#e.add(e);let t=this.#t;return t&&e({previous:void 0,next:t}),()=>{this.#e.delete(e)}}#r(e){for(let t of this.#e)t(e)}};function Fe(e){return new $(e)}var Ie=class{walletAccount;#e=!1;constructor(e){this.walletAccount=new $(e)}requireWalletAccount(e){let n=this.walletAccount.getSnapshot();if(!n)throw new t.U(e);return n}dispose(){this.#e||(this.#e=!0,this.onDispose())}[Symbol.dispose](){this.dispose()}onDispose(){}};Object.defineProperty(exports,"_",{enumerable:!0,get:function(){return o}}),Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return X}}),Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return le}}),Object.defineProperty(exports,"d",{enumerable:!0,get:function(){return m}}),Object.defineProperty(exports,"f",{enumerable:!0,get:function(){return _}}),Object.defineProperty(exports,"g",{enumerable:!0,get:function(){return l}}),Object.defineProperty(exports,"h",{enumerable:!0,get:function(){return c}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return Ne}}),Object.defineProperty(exports,"l",{enumerable:!0,get:function(){return ne}}),Object.defineProperty(exports,"m",{enumerable:!0,get:function(){return v}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return $}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return Me}}),Object.defineProperty(exports,"p",{enumerable:!0,get:function(){return h}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Fe}}),Object.defineProperty(exports,"s",{enumerable:!0,get:function(){return Y}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return Ie}}),Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return b}}),Object.defineProperty(exports,"v",{enumerable:!0,get:function(){return s}});
 //# sourceMappingURL=base-signer.cjs.map