@zama-fhe/sdk 3.7.0-beta.3 → 3.7.0-beta.4

package/dist/esm/{fhevm-relayer-CtrnKjJf.js.map → fhevm-relayer-Y5XYNOcs.js.map}

@@ -1 +1 @@
-{"version":3,"file":"fhevm-relayer-CtrnKjJf.js","names":["#config","#progressListeners","#generation","#withActive","#initOnce","#dispatch","#releaseRequested","#releaseIfIdle","#degradePromise","#pinnedInline","#degrade","#crashes","#sequence","#overBoundary","#spawn","#warnCallbackThrew","#teardown","#active","#createWorker","#raceReady","#armCrashHandler","#classifyDegrade","#warnDegraded","#chain","#base","#decrypt","#encrypt","#defaultOptions","#buildEncryptBackend","#encryptInitPromise","#initEncrypt","createUnsignedLegacyDecryptionPermitEip712Action"],"sources":["../../src/chains/to-fhevm-chain.ts","../../../../node_modules/.pnpm/comlink@4.4.2/node_modules/comlink/dist/esm/comlink.mjs","../../src/worker/protocol.ts","../../src/worker/spawn.ts","../../src/worker/encrypt-worker-client.ts","../../src/relayer/fhevm-relayer.ts"],"sourcesContent":["import type { FhevmChain } from \"@fhevm/sdk/chains\";\nimport type { FheChain } from \"./types\";\n\n/**\n * Derive an `@fhevm/sdk` {@link FhevmChain} from zama-sdk's richer\n * {@link FheChain}.\n *\n * `FheChain` carries fields `@fhevm/sdk` does not model (RPC `network`,\n * `registryAddress`, `executorAddress`, cleartext signer keys); those stay on\n * `FheChain` for the token layer. This adapter projects only the subset the\n * FHE runtime needs: contract addresses, relayer URL, and gateway.\n */\nexport function toFhevmChain(chain: FheChain): FhevmChain {\n  return {\n    id: chain.id,\n    fhevm: {\n      contracts: {\n        acl: { address: chain.aclContractAddress },\n        inputVerifier: { address: chain.inputVerifierContractAddress },\n        kmsVerifier: { address: chain.kmsContractAddress },\n        protocolConfig: undefined,\n      },\n      relayerUrl: chain.relayerUrl,\n      gateway: {\n        id: chain.gatewayChainId,\n        contracts: {\n          decryption: { address: chain.verifyingContractAddressDecryption },\n          inputVerification: { address: chain.verifyingContractAddressInputVerification },\n        },\n      },\n    },\n  } satisfies FhevmChain;\n}\n","/**\n * @license\n * Copyright 2019 Google LLC\n * SPDX-License-Identifier: Apache-2.0\n */\nconst proxyMarker = Symbol(\"Comlink.proxy\");\nconst createEndpoint = Symbol(\"Comlink.endpoint\");\nconst releaseProxy = Symbol(\"Comlink.releaseProxy\");\nconst finalizer = Symbol(\"Comlink.finalizer\");\nconst throwMarker = Symbol(\"Comlink.thrown\");\nconst isObject = (val) => (typeof val === \"object\" && val !== null) || typeof val === \"function\";\n/**\n * Internal transfer handle to handle objects marked to proxy.\n */\nconst proxyTransferHandler = {\n    canHandle: (val) => isObject(val) && val[proxyMarker],\n    serialize(obj) {\n        const { port1, port2 } = new MessageChannel();\n        expose(obj, port1);\n        return [port2, [port2]];\n    },\n    deserialize(port) {\n        port.start();\n        return wrap(port);\n    },\n};\n/**\n * Internal transfer handler to handle thrown exceptions.\n */\nconst throwTransferHandler = {\n    canHandle: (value) => isObject(value) && throwMarker in value,\n    serialize({ value }) {\n        let serialized;\n        if (value instanceof Error) {\n            serialized = {\n                isError: true,\n                value: {\n                    message: value.message,\n                    name: value.name,\n                    stack: value.stack,\n                },\n            };\n        }\n        else {\n            serialized = { isError: false, value };\n        }\n        return [serialized, []];\n    },\n    deserialize(serialized) {\n        if (serialized.isError) {\n            throw Object.assign(new Error(serialized.value.message), serialized.value);\n        }\n        throw serialized.value;\n    },\n};\n/**\n * Allows customizing the serialization of certain values.\n */\nconst transferHandlers = new Map([\n    [\"proxy\", proxyTransferHandler],\n    [\"throw\", throwTransferHandler],\n]);\nfunction isAllowedOrigin(allowedOrigins, origin) {\n    for (const allowedOrigin of allowedOrigins) {\n        if (origin === allowedOrigin || allowedOrigin === \"*\") {\n            return true;\n        }\n        if (allowedOrigin instanceof RegExp && allowedOrigin.test(origin)) {\n            return true;\n        }\n    }\n    return false;\n}\nfunction expose(obj, ep = globalThis, allowedOrigins = [\"*\"]) {\n    ep.addEventListener(\"message\", function callback(ev) {\n        if (!ev || !ev.data) {\n            return;\n        }\n        if (!isAllowedOrigin(allowedOrigins, ev.origin)) {\n            console.warn(`Invalid origin '${ev.origin}' for comlink proxy`);\n            return;\n        }\n        const { id, type, path } = Object.assign({ path: [] }, ev.data);\n        const argumentList = (ev.data.argumentList || []).map(fromWireValue);\n        let returnValue;\n        try {\n            const parent = path.slice(0, -1).reduce((obj, prop) => obj[prop], obj);\n            const rawValue = path.reduce((obj, prop) => obj[prop], obj);\n            switch (type) {\n                case \"GET\" /* MessageType.GET */:\n                    {\n                        returnValue = rawValue;\n                    }\n                    break;\n                case \"SET\" /* MessageType.SET */:\n                    {\n                        parent[path.slice(-1)[0]] = fromWireValue(ev.data.value);\n                        returnValue = true;\n                    }\n                    break;\n                case \"APPLY\" /* MessageType.APPLY */:\n                    {\n                        returnValue = rawValue.apply(parent, argumentList);\n                    }\n                    break;\n                case \"CONSTRUCT\" /* MessageType.CONSTRUCT */:\n                    {\n                        const value = new rawValue(...argumentList);\n                        returnValue = proxy(value);\n                    }\n                    break;\n                case \"ENDPOINT\" /* MessageType.ENDPOINT */:\n                    {\n                        const { port1, port2 } = new MessageChannel();\n                        expose(obj, port2);\n                        returnValue = transfer(port1, [port1]);\n                    }\n                    break;\n                case \"RELEASE\" /* MessageType.RELEASE */:\n                    {\n                        returnValue = undefined;\n                    }\n                    break;\n                default:\n                    return;\n            }\n        }\n        catch (value) {\n            returnValue = { value, [throwMarker]: 0 };\n        }\n        Promise.resolve(returnValue)\n            .catch((value) => {\n            return { value, [throwMarker]: 0 };\n        })\n            .then((returnValue) => {\n            const [wireValue, transferables] = toWireValue(returnValue);\n            ep.postMessage(Object.assign(Object.assign({}, wireValue), { id }), transferables);\n            if (type === \"RELEASE\" /* MessageType.RELEASE */) {\n                // detach and deactive after sending release response above.\n                ep.removeEventListener(\"message\", callback);\n                closeEndPoint(ep);\n                if (finalizer in obj && typeof obj[finalizer] === \"function\") {\n                    obj[finalizer]();\n                }\n            }\n        })\n            .catch((error) => {\n            // Send Serialization Error To Caller\n            const [wireValue, transferables] = toWireValue({\n                value: new TypeError(\"Unserializable return value\"),\n                [throwMarker]: 0,\n            });\n            ep.postMessage(Object.assign(Object.assign({}, wireValue), { id }), transferables);\n        });\n    });\n    if (ep.start) {\n        ep.start();\n    }\n}\nfunction isMessagePort(endpoint) {\n    return endpoint.constructor.name === \"MessagePort\";\n}\nfunction closeEndPoint(endpoint) {\n    if (isMessagePort(endpoint))\n        endpoint.close();\n}\nfunction wrap(ep, target) {\n    const pendingListeners = new Map();\n    ep.addEventListener(\"message\", function handleMessage(ev) {\n        const { data } = ev;\n        if (!data || !data.id) {\n            return;\n        }\n        const resolver = pendingListeners.get(data.id);\n        if (!resolver) {\n            return;\n        }\n        try {\n            resolver(data);\n        }\n        finally {\n            pendingListeners.delete(data.id);\n        }\n    });\n    return createProxy(ep, pendingListeners, [], target);\n}\nfunction throwIfProxyReleased(isReleased) {\n    if (isReleased) {\n        throw new Error(\"Proxy has been released and is not useable\");\n    }\n}\nfunction releaseEndpoint(ep) {\n    return requestResponseMessage(ep, new Map(), {\n        type: \"RELEASE\" /* MessageType.RELEASE */,\n    }).then(() => {\n        closeEndPoint(ep);\n    });\n}\nconst proxyCounter = new WeakMap();\nconst proxyFinalizers = \"FinalizationRegistry\" in globalThis &&\n    new FinalizationRegistry((ep) => {\n        const newCount = (proxyCounter.get(ep) || 0) - 1;\n        proxyCounter.set(ep, newCount);\n        if (newCount === 0) {\n            releaseEndpoint(ep);\n        }\n    });\nfunction registerProxy(proxy, ep) {\n    const newCount = (proxyCounter.get(ep) || 0) + 1;\n    proxyCounter.set(ep, newCount);\n    if (proxyFinalizers) {\n        proxyFinalizers.register(proxy, ep, proxy);\n    }\n}\nfunction unregisterProxy(proxy) {\n    if (proxyFinalizers) {\n        proxyFinalizers.unregister(proxy);\n    }\n}\nfunction createProxy(ep, pendingListeners, path = [], target = function () { }) {\n    let isProxyReleased = false;\n    const proxy = new Proxy(target, {\n        get(_target, prop) {\n            throwIfProxyReleased(isProxyReleased);\n            if (prop === releaseProxy) {\n                return () => {\n                    unregisterProxy(proxy);\n                    releaseEndpoint(ep);\n                    pendingListeners.clear();\n                    isProxyReleased = true;\n                };\n            }\n            if (prop === \"then\") {\n                if (path.length === 0) {\n                    return { then: () => proxy };\n                }\n                const r = requestResponseMessage(ep, pendingListeners, {\n                    type: \"GET\" /* MessageType.GET */,\n                    path: path.map((p) => p.toString()),\n                }).then(fromWireValue);\n                return r.then.bind(r);\n            }\n            return createProxy(ep, pendingListeners, [...path, prop]);\n        },\n        set(_target, prop, rawValue) {\n            throwIfProxyReleased(isProxyReleased);\n            // FIXME: ES6 Proxy Handler `set` methods are supposed to return a\n            // boolean. To show good will, we return true asynchronously ¯\\_(ツ)_/¯\n            const [value, transferables] = toWireValue(rawValue);\n            return requestResponseMessage(ep, pendingListeners, {\n                type: \"SET\" /* MessageType.SET */,\n                path: [...path, prop].map((p) => p.toString()),\n                value,\n            }, transferables).then(fromWireValue);\n        },\n        apply(_target, _thisArg, rawArgumentList) {\n            throwIfProxyReleased(isProxyReleased);\n            const last = path[path.length - 1];\n            if (last === createEndpoint) {\n                return requestResponseMessage(ep, pendingListeners, {\n                    type: \"ENDPOINT\" /* MessageType.ENDPOINT */,\n                }).then(fromWireValue);\n            }\n            // We just pretend that `bind()` didn’t happen.\n            if (last === \"bind\") {\n                return createProxy(ep, pendingListeners, path.slice(0, -1));\n            }\n            const [argumentList, transferables] = processArguments(rawArgumentList);\n            return requestResponseMessage(ep, pendingListeners, {\n                type: \"APPLY\" /* MessageType.APPLY */,\n                path: path.map((p) => p.toString()),\n                argumentList,\n            }, transferables).then(fromWireValue);\n        },\n        construct(_target, rawArgumentList) {\n            throwIfProxyReleased(isProxyReleased);\n            const [argumentList, transferables] = processArguments(rawArgumentList);\n            return requestResponseMessage(ep, pendingListeners, {\n                type: \"CONSTRUCT\" /* MessageType.CONSTRUCT */,\n                path: path.map((p) => p.toString()),\n                argumentList,\n            }, transferables).then(fromWireValue);\n        },\n    });\n    registerProxy(proxy, ep);\n    return proxy;\n}\nfunction myFlat(arr) {\n    return Array.prototype.concat.apply([], arr);\n}\nfunction processArguments(argumentList) {\n    const processed = argumentList.map(toWireValue);\n    return [processed.map((v) => v[0]), myFlat(processed.map((v) => v[1]))];\n}\nconst transferCache = new WeakMap();\nfunction transfer(obj, transfers) {\n    transferCache.set(obj, transfers);\n    return obj;\n}\nfunction proxy(obj) {\n    return Object.assign(obj, { [proxyMarker]: true });\n}\nfunction windowEndpoint(w, context = globalThis, targetOrigin = \"*\") {\n    return {\n        postMessage: (msg, transferables) => w.postMessage(msg, targetOrigin, transferables),\n        addEventListener: context.addEventListener.bind(context),\n        removeEventListener: context.removeEventListener.bind(context),\n    };\n}\nfunction toWireValue(value) {\n    for (const [name, handler] of transferHandlers) {\n        if (handler.canHandle(value)) {\n            const [serializedValue, transferables] = handler.serialize(value);\n            return [\n                {\n                    type: \"HANDLER\" /* WireValueType.HANDLER */,\n                    name,\n                    value: serializedValue,\n                },\n                transferables,\n            ];\n        }\n    }\n    return [\n        {\n            type: \"RAW\" /* WireValueType.RAW */,\n            value,\n        },\n        transferCache.get(value) || [],\n    ];\n}\nfunction fromWireValue(value) {\n    switch (value.type) {\n        case \"HANDLER\" /* WireValueType.HANDLER */:\n            return transferHandlers.get(value.name).deserialize(value.value);\n        case \"RAW\" /* WireValueType.RAW */:\n            return value.value;\n    }\n}\nfunction requestResponseMessage(ep, pendingListeners, msg, transfers) {\n    return new Promise((resolve) => {\n        const id = generateUUID();\n        pendingListeners.set(id, resolve);\n        if (ep.start) {\n            ep.start();\n        }\n        ep.postMessage(Object.assign({ id }, msg), transfers);\n    });\n}\nfunction generateUUID() {\n    return new Array(4)\n        .fill(0)\n        .map(() => Math.floor(Math.random() * Number.MAX_SAFE_INTEGER).toString(16))\n        .join(\"-\");\n}\n\nexport { createEndpoint, expose, finalizer, proxy, proxyMarker, releaseProxy, transfer, transferHandlers, windowEndpoint, wrap };\n//# sourceMappingURL=comlink.mjs.map\n","/**\n * Shared contract between the main-thread encrypt client and the encrypt\n * worker, spoken over Comlink. Every payload must survive `structuredClone`:\n * no `AbortSignal`, no class instances; callbacks cross as Comlink proxies.\n */\n\nimport type { FhevmChain } from \"@fhevm/sdk/chains\";\nimport type {\n  FhevmClientOptions,\n  FhevmEncryptBackend,\n  FhevmRelayerOptions,\n  WireRuntimeConfig,\n} from \"../relayer/types\";\nimport { isValidRetryAfterSeconds, readRetryAfterHeader } from \"../utils/error\";\n\ntype EncryptParameters = Parameters<FhevmEncryptBackend[\"encryptValue\"]>[0];\ntype EncryptsParameters = Parameters<FhevmEncryptBackend[\"encryptValues\"]>[0];\n\n/**\n * What the worker offloads, and all the encrypt client's surface the worker\n * client implements. Key fetches stay on the calling thread, where the chain's\n * auth applies and the key never crosses back out.\n */\nexport type EncryptOffloadBackend = Pick<\n  FhevmEncryptBackend,\n  \"init\" | \"encryptValue\" | \"encryptValues\"\n>;\n\n/** Per-request options minus `signal`, the one non-cloneable member of the set. */\nexport type WireRequestOptions = Omit<FhevmRelayerOptions, \"signal\">;\n\nexport type WireProgressEvent = Parameters<\n  NonNullable<NonNullable<EncryptParameters[\"options\"]>[\"onProgress\"]>\n>[0];\n\nexport type WireInitPayload = {\n  readonly chain: FhevmChain;\n  /** RPC URL for host-chain reads; absent when reads proxy through `rpcRequest`. */\n  readonly rpcUrl: string | undefined;\n  /** Carries `fheEncryptionKey`, prefetched on the main thread so the worker skips the download. */\n  readonly clientOptions: FhevmClientOptions;\n  readonly runtime: WireRuntimeConfig;\n};\n\n/** Main-thread callback the worker uses for host-chain reads when the chain's network is an injected provider. */\nexport type WireRpcRequest = (args: { method: string; params?: unknown }) => Promise<unknown>;\n\n/**\n * Main-thread callback receiving every operation's progress events, routed on\n * `id`. One channel per worker avoids minting a `MessageChannel` per call, whose\n * local port and listener would linger until garbage collection after terminate.\n * Returns `unknown`: a Comlink proxy call answers with a promise.\n */\nexport type WireProgressCallback = (id: number, event: WireProgressEvent) => unknown;\n\nexport type WireLogCallback = (level: \"debug\" | \"warn\" | \"error\", message: string) => unknown;\n\n/**\n * The API the worker exposes over Comlink. `id` correlates an in-flight\n * operation with `abort` and with its progress events, since neither an\n * `AbortSignal` nor a per-call callback can cross the boundary cheaply. The\n * `init` callback parameters must be passed as Comlink proxies (or `null`).\n */\nexport type EncryptWorkerApi = {\n  init(\n    payload: WireInitPayload,\n    rpcRequest: WireRpcRequest | null,\n    log: WireLogCallback,\n    onProgress: WireProgressCallback,\n  ): Promise<void>;\n  encryptValue(\n    id: number,\n    parameters: {\n      readonly value: EncryptParameters[\"value\"];\n      readonly contractAddress: string;\n      readonly userAddress: string;\n      readonly options: WireRequestOptions | undefined;\n    },\n  ): ReturnType<FhevmEncryptBackend[\"encryptValue\"]>;\n  encryptValues(\n    id: number,\n    parameters: {\n      readonly values: EncryptsParameters[\"values\"];\n      readonly contractAddress: string;\n      readonly userAddress: string;\n      readonly options: WireRequestOptions | undefined;\n    },\n  ): ReturnType<FhevmEncryptBackend[\"encryptValues\"]>;\n  abort(id: number): void;\n};\n\n/** Raw message the worker posts once its module graph has loaded, before Comlink traffic. */\nexport const WORKER_READY_MESSAGE = \"zama-encrypt-worker-ready\";\n\n/**\n * An `Error` flattened for the boundary crossing, thrown by the worker as a\n * plain object so it survives structured clone intact. `props` carries the\n * fields the SDK's duck-typed classifiers read (`statusCode`, `retryAfter`,\n * `code`, …); a cloned `Error` instance would drop them with the prototype.\n * Reading them through the prototype chain is deliberate: upstream's `status`\n * and `relayerApiError` are prototype getters, not own fields.\n */\nexport type WireError = {\n  readonly wireError: true;\n  readonly name: string;\n  readonly message: string;\n  readonly stack: string | undefined;\n  readonly props: Record<string, unknown>;\n  readonly cause: WireError | undefined;\n};\n\nexport function isWireError(value: unknown): value is WireError {\n  // Exact `true`, not presence: an `Error` subclass carrying the key must not be\n  // rehydrated as a flattened one.\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    (value as { wireError?: unknown }).wireError === true\n  );\n}\n\n/**\n * Fields preserved across the boundary: what the error classifiers read off\n * `@fhevm/sdk`, relayer, and JSON-RPC errors, plus the `error`/`info` nesting\n * keys those classifiers walk alongside `cause`.\n */\nconst WIRE_ERROR_PROPS = [\n  \"statusCode\",\n  \"status\",\n  \"retryAfter\",\n  \"timeoutMs\",\n  \"relayerApiError\",\n  \"code\",\n  \"data\",\n  \"shortMessage\",\n  \"details\",\n  \"error\",\n  \"info\",\n] as const;\n\nconst MAX_CAUSE_DEPTH = 6;\n\n/** A probe is exact where a structural walk only approximates. */\nfunction isCloneSafe(value: unknown): boolean {\n  try {\n    structuredClone(value);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The `Retry-After` header survives as a plain number of seconds; the\n * `Response` object it lives on cannot cross the boundary.\n */\nfunction retryAfterFromResponse(error: object): number | undefined {\n  const response = (error as { response?: { headers?: unknown } }).response;\n  return readRetryAfterHeader(response?.headers);\n}\n\n/**\n * `JSON.stringify` throws instead of returning `undefined` on a bigint or a\n * circular value; a non-Error thrown value must never fail error handling itself.\n */\nfunction stringifyNonError(error: unknown): string {\n  try {\n    return JSON.stringify(error) ?? String(error);\n  } catch {\n    return String(error);\n  }\n}\n\n/** The classifier fields readable off one thrown value, `Error` or plain object alike. */\nfunction extractWireProps(source: object): Record<string, unknown> {\n  const props: Record<string, unknown> = {};\n  for (const key of WIRE_ERROR_PROPS) {\n    const value = (source as Record<string, unknown>)[key];\n    if (value !== undefined && isCloneSafe(value)) {\n      props[key] = value;\n    }\n  }\n  // The header wins over a malformed own delay (`0`, negative, `NaN`), as the\n  // inline extractor in `utils/error.ts` decides it.\n  if (!isValidRetryAfterSeconds(props[\"retryAfter\"])) {\n    const fromHeader = retryAfterFromResponse(source);\n    if (fromHeader !== undefined) {\n      props[\"retryAfter\"] = fromHeader;\n    }\n  }\n  return props;\n}\n\nexport function toWireError(error: unknown, depth: number = MAX_CAUSE_DEPTH): WireError {\n  if (isWireError(error)) {\n    return error;\n  }\n  const nest = (cause: unknown): WireError | undefined =>\n    depth > 0 && cause !== undefined ? toWireError(cause, depth - 1) : undefined;\n  if (error instanceof Error) {\n    return {\n      wireError: true,\n      name: error.name,\n      message: error.message,\n      stack: error.stack,\n      props: extractWireProps(error),\n      cause: nest(error.cause),\n    };\n  }\n  if (typeof error === \"object\" && error !== null) {\n    // Wallets reject with a plain `{ code, message, data }`; dropping `code`\n    // would break viem's classification inside the worker.\n    const { message, cause } = error as { message?: unknown; cause?: unknown };\n    return {\n      wireError: true,\n      name: \"Error\",\n      message: typeof message === \"string\" ? message : stringifyNonError(error),\n      stack: undefined,\n      props: extractWireProps(error),\n      cause: nest(cause),\n    };\n  }\n  return {\n    wireError: true,\n    name: \"Error\",\n    message: typeof error === \"string\" ? error : stringifyNonError(error),\n    stack: undefined,\n    props: {},\n    cause: undefined,\n  };\n}\n\n/**\n * Rebuilds a plain `Error` carrying the original `name`, own fields, and cause\n * chain, so name-based classification and status/retry-after extraction behave\n * as if the error had been thrown on this thread.\n */\nexport function fromWireError(wire: WireError): Error {\n  const error = new Error(wire.message, wire.cause ? { cause: fromWireError(wire.cause) } : {});\n  error.name = wire.name;\n  if (wire.stack !== undefined) {\n    error.stack = wire.stack;\n  }\n  Object.assign(error, wire.props);\n  return error;\n}\n","/** Isolated so the CJS build can replace worker construction with an inert stub. */\n\n/** False in the CJS stub, which ships no worker chunk; a caller-supplied `offloadWorker` source works in either build. */\nexport const BUNDLED_ENCRYPT_WORKER = true;\n\nexport function createEncryptWorker(): Worker {\n  // Keep the `new Worker(new URL(...))` expression exactly in this inline\n  // form: bundlers detect it statically to emit and rewrite the worker chunk,\n  // and lose it if the URL is hoisted into a variable.\n  return new Worker(new URL(\"./encrypt.worker.js\", import.meta.url), {\n    type: \"module\",\n    name: \"zama-fhe-encrypt\",\n  });\n}\n","import { proxy, transfer, wrap, type Remote } from \"comlink\";\nimport type { EIP1193Provider } from \"viem\";\nimport { EncryptOffloadUnavailableError } from \"../errors/encryption\";\nimport type { FhevmClientOptions } from \"../relayer/types\";\nimport type { LoggerService } from \"../services/logger-service\";\nimport type {\n  EncryptOffloadBackend,\n  EncryptWorkerApi,\n  WireInitPayload,\n  WireProgressEvent,\n  WireRequestOptions,\n} from \"./protocol\";\nimport { WORKER_READY_MESSAGE, fromWireError, isWireError, toWireError } from \"./protocol\";\nimport { createEncryptWorker } from \"./spawn\";\n\n/**\n * Watchdog deadlines, in milliseconds, for worker lifecycle steps: each is a\n * ceiling on \"the worker never answered\", not on legitimate slow work. Encrypt\n * operations themselves are not watched: nothing bounds local WASM compute, so\n * a proof may run for as long as it needs.\n */\nexport type EncryptWorkerTimeouts = {\n  /** Worker startup + module-graph load; a bundler that mishandled the worker URL fails here. */\n  readonly spawn: number;\n  /** Client init inside the worker realm: chain reads and WASM compilation. */\n  readonly init: number;\n};\n\nexport const DEFAULT_ENCRYPT_WORKER_TIMEOUTS: EncryptWorkerTimeouts = {\n  spawn: 10_000,\n  init: 300_000,\n};\n\n/** Second crash pins the client to the calling thread. */\nconst CRASH_PIN_THRESHOLD = 2;\n\n/** Stable prefix of every degrade warning. */\nexport const ENCRYPT_OFFLOAD_WARN_PREFIX = \"Encrypt offload unavailable\";\n\n/** Workers already returned by an `offloadWorker` factory, to catch a factory that hands out one worker forever. */\nconst handedOutWorkers = new WeakSet<Worker>();\n\n/** Internal signal: the worker infrastructure failed; the operation itself was not rejected. */\nclass WorkerUnavailableError extends Error {\n  /** True when a worker that had already signalled ready died under us, so a respawn is worth trying. */\n  readonly crashed: boolean;\n\n  constructor(message: string, options?: ErrorOptions & { readonly crashed?: boolean }) {\n    super(message, options);\n    this.name = \"WorkerUnavailableError\";\n    this.crashed = options?.crashed ?? false;\n  }\n}\n\n/**\n * A payload Comlink could not clone into the worker (`DataCloneError`) or could\n * not return out of it (its own `TypeError`): a boundary failure, so it degrades\n * rather than reaching the caller as an application error.\n */\nfunction isCloneFailure(error: unknown): boolean {\n  if (typeof error !== \"object\" || error === null) {\n    return false;\n  }\n  const { name, message } = error as { name?: unknown; message?: unknown };\n  return (\n    name === \"DataCloneError\" ||\n    (name === \"TypeError\" &&\n      typeof message === \"string\" &&\n      message.includes(\"Unserializable return value\"))\n  );\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted) {\n    throw signal.reason ?? new DOMException(\"The operation was aborted.\", \"AbortError\");\n  }\n}\n\n/** What the client remembers about worker crashes, dropped whole by a worker answer and by a release. */\ntype CrashHistory = {\n  readonly count: number;\n  /** The crash that killed the current worker, so a call landing after it degrades as a crash too. */\n  readonly last: WorkerUnavailableError | undefined;\n  /** Crash count the degrade warning was last emitted for, so one failure warns once. */\n  readonly warnedFor: number;\n};\n\nconst NO_CRASHES: CrashHistory = { count: 0, last: undefined, warnedFor: -1 };\n\n/**\n * The key copied for the crossing plus the buffers to transfer, so the wire copy\n * is moved instead of cloned. Anything but the known binary shape crosses\n * unchanged.\n */\nfunction keyForTransfer(key: FhevmClientOptions[\"fheEncryptionKey\"]): {\n  readonly key: FhevmClientOptions[\"fheEncryptionKey\"];\n  readonly transfers: Transferable[];\n} {\n  if (key === undefined) {\n    return { key, transfers: [] };\n  }\n  const publicKeyBytes = key.publicKeyBytes.bytes;\n  const crsBytes = key.crsBytes.bytes;\n  if (!(publicKeyBytes instanceof Uint8Array) || !(crsBytes instanceof Uint8Array)) {\n    return { key, transfers: [] };\n  }\n  // `slice` yields a fresh exactly-sized buffer, so transferring it leaves this\n  // thread's cached key intact.\n  const publicKeyCopy = publicKeyBytes.slice();\n  const crsCopy = crsBytes.slice();\n  return {\n    key: {\n      ...key,\n      publicKeyBytes: { ...key.publicKeyBytes, bytes: publicKeyCopy },\n      crsBytes: { ...key.crsBytes, bytes: crsCopy },\n    },\n    transfers: [publicKeyCopy.buffer as ArrayBuffer, crsCopy.buffer as ArrayBuffer],\n  };\n}\n\n/**\n * Per-call options: `signal` is forwarded as an `abort` call, `onProgress` is\n * served from the worker's shared progress channel, and `never` keeps the\n * callback contravariantly compatible with each operation's own event type.\n */\ntype CallOptions = WireRequestOptions & {\n  readonly signal?: AbortSignal;\n  readonly onProgress?: (args: never) => void;\n};\n\n/**\n * Everything scoped to one spawned worker, created by the init that spawns it\n * and dropped whole by a teardown. A late event carrying its own generation can\n * therefore only settle that generation, never the worker running in its place.\n */\ntype WorkerGeneration = {\n  /** Memoized bring-up for this worker; it dies with the generation, so the next call re-runs it. */\n  initPromise: Promise<void> | undefined;\n  worker: Worker | undefined;\n  api: Remote<EncryptWorkerApi> | undefined;\n  /** Never resolves; teardown rejects it, and every boundary crossing races it so all of them settle together. */\n  readonly doomed: Promise<never>;\n  /** Rejects `doomed` with the teardown's `WorkerUnavailableError`. */\n  readonly doom: (error: WorkerUnavailableError) => void;\n};\n\nfunction createWorkerGeneration(): WorkerGeneration {\n  let doom!: (error: WorkerUnavailableError) => void;\n  const doomed = new Promise<never>((_resolve, reject) => {\n    doom = reject;\n  });\n  // An idle teardown dooms a generation with no crossing racing it; this\n  // handler keeps that from surfacing as an unhandled rejection.\n  doomed.catch(() => {});\n  return { initPromise: undefined, worker: undefined, api: undefined, doomed, doom };\n}\n\nexport type EncryptWorkerClientConfig = {\n  readonly initPayload: Omit<WireInitPayload, \"rpcUrl\">;\n  /** The chain's RPC endpoint: a URL crosses into the worker; a provider is proxied per request. */\n  readonly network: EIP1193Provider | string;\n  /** Fetches the FHE key on the calling thread, where the chain's auth applies; the worker realm never downloads it itself. */\n  readonly prefetchKey: () => Promise<FhevmClientOptions[\"fheEncryptionKey\"]>;\n  readonly createInlineClient: () => EncryptOffloadBackend;\n  readonly logger: LoggerService;\n  readonly timeouts: EncryptWorkerTimeouts;\n  /** A string or `URL` is spawned with the SDK's worker options; a factory is called for the worker itself. */\n  readonly workerSource?: string | URL | (() => Worker);\n  /**\n   * A pre-known reason offload cannot work in this session: init degrades with\n   * it immediately, so strict rejects at call time rather than at config time.\n   */\n  readonly blockedReason?: string;\n  /**\n   * Strict offload (`offloadEncrypt: true`): never run encryption on the\n   * calling thread. Every path that would degrade rejects with\n   * {@link EncryptOffloadUnavailableError} instead.\n   */\n  readonly strict: boolean;\n};\n\n/**\n * Encrypt backend that runs `@fhevm/sdk` in a dedicated module worker so proof\n * generation never blocks the main thread. Only infrastructure failure degrades\n * to inline (or rejects under `strict`); worker-reported errors are rethrown,\n * since inline would fail the same way.\n */\nexport class EncryptWorkerClient implements EncryptOffloadBackend {\n  readonly #config: EncryptWorkerClientConfig;\n  /** Resources of the worker currently being brought up or served; undefined while none runs. */\n  #generation: WorkerGeneration | undefined;\n  /** True once the client runs inline for the rest of its life, with no further spawn attempts. */\n  #pinnedInline = false;\n  #crashes: CrashHistory = NO_CRASHES;\n  /** Wire ids, allocated across generations so a late reply can never be read as a live operation. */\n  #sequence = 0;\n  /** Per-operation `onProgress`, keyed by wire id and routed over one channel registered at init: one channel per worker avoids minting a `MessageChannel` per call, whose local port and listener would linger until garbage collection after terminate. */\n  readonly #progressListeners = new Map<number, (event: WireProgressEvent) => void>();\n  /** Memoized inline backend. Kept, with its key copy, across a worker recovery so a later degrade skips the refetch. */\n  #degradePromise: Promise<EncryptOffloadBackend> | undefined;\n  /** Operations that must drain before a requested release terminates the worker. */\n  #active = 0;\n  #releaseRequested = false;\n\n  constructor(config: EncryptWorkerClientConfig) {\n    this.#config = config;\n  }\n\n  init = (): Promise<void> => {\n    // A call landing mid-drain rides the worker being released rather than\n    // canceling the release: the drain still completes, and the call after it\n    // spawns a fresh worker.\n    const generation = (this.#generation ??= createWorkerGeneration());\n    if (generation.initPromise === undefined) {\n      // Only a successful cycle is memoized: a failure a retry could clear must\n      // not be replayed to every later call.\n      const attempt: Promise<void> = this.#withActive(() => this.#initOnce(generation)).catch(\n        (error: unknown) => {\n          if (generation.initPromise === attempt) {\n            generation.initPromise = undefined;\n          }\n          throw error;\n        },\n      );\n      generation.initPromise = attempt;\n    }\n    return generation.initPromise;\n  };\n\n  encryptValue: EncryptOffloadBackend[\"encryptValue\"] = (parameters) =>\n    this.#withActive(() =>\n      this.#dispatch(\n        (backend) => backend.encryptValue(parameters),\n        // Spread, so a field upstream adds to the parameters still crosses; the\n        // stripped `options` replaces the caller's, which carries `signal`.\n        (api, id, options) => api.encryptValue(id, { ...parameters, options }),\n        parameters.options,\n      ),\n    );\n\n  encryptValues: EncryptOffloadBackend[\"encryptValues\"] = (parameters) =>\n    this.#withActive(() =>\n      this.#dispatch(\n        (backend) => backend.encryptValues(parameters),\n        (api, id, options) => api.encryptValues(id, { ...parameters, options }),\n        parameters.options,\n      ),\n    );\n\n  /**\n   * Releases the worker without changing what callers observe: in-flight\n   * operations (an init included) run to completion over the worker, and the\n   * worker is terminated as soon as the last one settles, immediately if the\n   * client is idle. The client is not spent: the release resets it whole, so a\n   * later call re-fetches the key and spawns a fresh worker exactly like the\n   * first one, even if the client had degraded to the calling thread. The drain\n   * is not bounded: a worker wedged inside an operation is only terminated once\n   * that operation settles.\n   */\n  dispose(): void {\n    this.#releaseRequested = true;\n    this.#releaseIfIdle();\n  }\n\n  /**\n   * The one place that decides between the worker and the calling thread:\n   * inline once pinned or while no worker is running; otherwise the worker,\n   * falling back to inline on infrastructure failure while application errors\n   * pass through.\n   */\n  async #dispatch<T>(\n    invoke: (backend: EncryptOffloadBackend) => Promise<T>,\n    overWorker: (\n      api: Remote<EncryptWorkerApi>,\n      id: number,\n      options: WireRequestOptions,\n    ) => Promise<T>,\n    callOptions: CallOptions | undefined,\n  ): Promise<T> {\n    const { signal, onProgress, ...options } = callOptions ?? {};\n    // The worker dequeues an abort only after the proof, so a dispatched call always runs whole.\n    throwIfAborted(signal);\n    await this.init();\n    // A listener added after the abort never fires, so an abort during init needs this recheck.\n    throwIfAborted(signal);\n    const generation = this.#generation;\n    const api = generation?.api;\n    // An existing degrade attempt already carries the decision that created it,\n    // and its inline backend caches the key, so reuse it rather than degrading again.\n    if (this.#degradePromise !== undefined && (this.#pinnedInline || api === undefined)) {\n      return invoke(await this.#degradePromise);\n    }\n    if (generation === undefined || api === undefined) {\n      return invoke(\n        await this.#degrade(\n          generation,\n          this.#crashes.last ?? new WorkerUnavailableError(\"Encrypt worker not running.\"),\n        ),\n      );\n    }\n    const id = this.#sequence++;\n    const onAbort = () => void api.abort(id).catch(() => {});\n    signal?.addEventListener(\"abort\", onAbort, { once: true });\n    if (onProgress) {\n      this.#progressListeners.set(id, onProgress as (event: WireProgressEvent) => void);\n    }\n    try {\n      const result = await this.#overBoundary(generation, overWorker(api, id, options));\n      // A worker operation that answered clears the crash history: two unrelated\n      // crashes far apart must not add up to a permanent degrade.\n      this.#crashes = NO_CRASHES;\n      return result;\n    } catch (error) {\n      if (error instanceof WorkerUnavailableError) {\n        return invoke(await this.#degrade(generation, error));\n      }\n      throw error;\n    } finally {\n      this.#progressListeners.delete(id);\n      signal?.removeEventListener(\"abort\", onAbort);\n    }\n  }\n\n  async #initOnce(generation: WorkerGeneration): Promise<void> {\n    if (this.#pinnedInline) {\n      // The degrade that pinned the client already initialized the backend every call now runs on.\n      return;\n    }\n    const blockedReason = this.#config.blockedReason;\n    if (blockedReason !== undefined) {\n      // Handled before any resource is spent: non-strict callers never get here\n      // (the relayer inlines directly), and strict throws out of the degrade.\n      await this.#degrade(generation, new WorkerUnavailableError(blockedReason));\n      return;\n    }\n    // Outside the degrade guard: a failed key fetch is an application/network\n    // error, and the inline backend would refetch the same key from the same\n    // relayer. It rejects out of init exactly as the inline arm's would.\n    const fheEncryptionKey = await this.#config.prefetchKey();\n    try {\n      const api = await this.#spawn(generation);\n      const network = this.#config.network;\n      const rpcRequest =\n        typeof network === \"string\"\n          ? null\n          : proxy(async (args: { method: string; params?: unknown }) => {\n              try {\n                return await network.request(args as Parameters<EIP1193Provider[\"request\"]>[0]);\n              } catch (error) {\n                // Comlink keeps only name/message/stack on a thrown error, which\n                // would strip the provider's `code` (4001, -32005) the worker's\n                // classifiers read; flatten it so those fields cross.\n                throw toWireError(error);\n              }\n            });\n      // A callback that throws would reject the Comlink proxy call back in the\n      // worker realm, where nothing can report it, so it is contained here.\n      const log = proxy((level: \"debug\" | \"warn\" | \"error\", message: string) => {\n        try {\n          this.#config.logger[level](message);\n        } catch (error) {\n          this.#warnCallbackThrew(\"logger\", error);\n        }\n      });\n      const onProgress = proxy((id: number, event: WireProgressEvent) => {\n        try {\n          this.#progressListeners.get(id)?.(event);\n        } catch (error) {\n          this.#warnCallbackThrew(\"onProgress\", error);\n        }\n      });\n      // The copy stays on this thread so a later degrade to inline reuses the\n      // key instead of refetching; transferring the wire copy avoids a third\n      // in-transit copy of it.\n      const wireKey = keyForTransfer(fheEncryptionKey);\n      await this.#overBoundary(\n        generation,\n        api.init(\n          transfer(\n            {\n              ...this.#config.initPayload,\n              clientOptions: {\n                ...this.#config.initPayload.clientOptions,\n                fheEncryptionKey: wireKey.key,\n              },\n              rpcUrl: typeof network === \"string\" ? network : undefined,\n            },\n            wireKey.transfers,\n          ),\n          rpcRequest,\n          log,\n          onProgress,\n        ),\n        { ms: this.#config.timeouts.init, operation: \"init\" },\n      );\n      generation.api = api;\n      this.#crashes = { ...this.#crashes, last: undefined };\n    } catch (error) {\n      // Only \"the worker never answered or crashed\" is infrastructure. An error\n      // the worker itself reported (a chain read, bad key material) would fail\n      // the same way inline, so it reaches the caller unchanged.\n      if (!(error instanceof WorkerUnavailableError)) {\n        this.#teardown(generation, new WorkerUnavailableError(\"Encrypt worker init failed.\"));\n        throw error;\n      }\n      await this.#degrade(generation, error);\n    }\n  }\n\n  /** Reports a caller callback that threw; the reporting itself must not throw back into the worker. */\n  #warnCallbackThrew(callback: string, error: unknown): void {\n    const reason = error instanceof Error ? error.message : String(error);\n    try {\n      this.#config.logger.warn(`Encrypt offload ${callback} callback threw: ${reason}`);\n    } catch {\n      // A logger that throws on its own warning leaves nowhere left to report.\n    }\n  }\n\n  /**\n   * The count spans a whole public entry, its init included, so a release\n   * requested mid-call cannot terminate the worker between the init and the\n   * operation.\n   */\n  async #withActive<T>(work: () => Promise<T>): Promise<T> {\n    this.#active++;\n    try {\n      return await work();\n    } finally {\n      this.#active--;\n      this.#releaseIfIdle();\n    }\n  }\n\n  #releaseIfIdle(): void {\n    if (!this.#releaseRequested || this.#active > 0) {\n      return;\n    }\n    this.#releaseRequested = false;\n    this.#generation?.worker?.terminate();\n    // A full reset, so a release is the recovery lever for a degraded client:\n    // the next call re-fetches the key and spawns a fresh worker either way.\n    this.#generation = undefined;\n    this.#degradePromise = undefined;\n    this.#pinnedInline = false;\n    this.#crashes = NO_CRASHES;\n  }\n\n  #createWorker(): Worker {\n    const source = this.#config.workerSource;\n    if (source === undefined) {\n      return createEncryptWorker();\n    }\n    if (typeof source === \"function\") {\n      const worker = source();\n      // A memoized factory would hand the client a worker it already terminated,\n      // so the contract is one fresh Worker per call.\n      if (handedOutWorkers.has(worker)) {\n        this.#config.logger.warnAlways(\n          \"The offloadWorker factory returned a worker it already handed out; each call must construct a fresh Worker.\",\n        );\n      }\n      handedOutWorkers.add(worker);\n      return worker;\n    }\n    return new Worker(source, { type: \"module\", name: \"zama-fhe-encrypt\" });\n  }\n\n  /** Resolves once the worker's module graph has loaded. */\n  async #spawn(generation: WorkerGeneration): Promise<Remote<EncryptWorkerApi>> {\n    let worker: Worker;\n    try {\n      worker = this.#createWorker();\n    } catch (error) {\n      // A blocked construction is infrastructure, so it must reach the\n      // degrade path as such rather than as the raw thrown error.\n      throw new WorkerUnavailableError(error instanceof Error ? error.message : String(error), {\n        cause: error,\n      });\n    }\n    generation.worker = worker;\n    const api = await this.#raceReady(generation, worker);\n    this.#armCrashHandler(generation, worker);\n    return api;\n  }\n\n  /** Resolves with the Comlink API on the worker's ready message; rejects on the spawn deadline or a pre-ready error. */\n  #raceReady(generation: WorkerGeneration, worker: Worker): Promise<Remote<EncryptWorkerApi>> {\n    return new Promise<Remote<EncryptWorkerApi>>((resolve, reject) => {\n      const settle = () => {\n        clearTimeout(timer);\n        worker.removeEventListener(\"message\", onReady);\n        worker.removeEventListener(\"error\", onError);\n      };\n      const timer = setTimeout(() => {\n        settle();\n        reject(\n          new WorkerUnavailableError(\n            `Encrypt worker did not start within ${this.#config.timeouts.spawn}ms.`,\n          ),\n        );\n      }, this.#config.timeouts.spawn);\n      const onReady = (event: MessageEvent) => {\n        if (event.data === WORKER_READY_MESSAGE) {\n          settle();\n          resolve(wrap<EncryptWorkerApi>(worker));\n        }\n      };\n      const onError = (event: ErrorEvent) => {\n        settle();\n        const message = event.message || \"Encrypt worker error.\";\n        // A worker that never came up is not worth respawning per call, so\n        // this failure is not flagged as a crash.\n        reject(new WorkerUnavailableError(message));\n        this.#teardown(generation, new WorkerUnavailableError(message));\n      };\n      worker.addEventListener(\"message\", onReady);\n      worker.addEventListener(\"error\", onError);\n    });\n  }\n\n  /** Permanent crash detector, armed only after ready so a pre-ready failure never counts as a crash. */\n  #armCrashHandler(generation: WorkerGeneration, worker: Worker): void {\n    worker.addEventListener(\"error\", (event: ErrorEvent) => {\n      // A generation already torn down cannot crash the client again: nothing\n      // is waiting on it, and the worker running in its place is unaffected.\n      if (this.#generation !== generation) {\n        return;\n      }\n      // A ready worker died under us: the teardown drops the memoized init so\n      // the next call spawns a fresh one, and the operations it took down\n      // finish inline.\n      const crash = new WorkerUnavailableError(event.message || \"Encrypt worker error.\", {\n        crashed: true,\n      });\n      this.#crashes = { ...this.#crashes, count: this.#crashes.count + 1, last: crash };\n      this.#teardown(generation, crash);\n    });\n  }\n\n  /**\n   * Awaits one promise crossing the worker boundary, racing the generation's\n   * `doomed` promise so a teardown settles it with the teardown's\n   * `WorkerUnavailableError`, which degrades it inline. Without a `deadline` it\n   * settles whenever the worker answers; a `deadline` bounds a lifecycle step,\n   * and missing it means the worker is presumed stuck, so the generation is\n   * torn down whole.\n   */\n  async #overBoundary<T>(\n    generation: WorkerGeneration,\n    work: Promise<T>,\n    deadline?: { readonly ms: number; readonly operation: string },\n  ): Promise<T> {\n    const timer =\n      deadline === undefined\n        ? undefined\n        : setTimeout(() => {\n            this.#teardown(\n              generation,\n              new WorkerUnavailableError(\n                `Encrypt worker ${deadline.operation} timed out after ${deadline.ms}ms.`,\n              ),\n            );\n          }, deadline.ms);\n    try {\n      return await Promise.race([\n        work.catch((error: unknown) => {\n          const failure = isWireError(error) ? fromWireError(error) : (error as Error);\n          // A payload Comlink could not carry is infrastructure, so it degrades\n          // instead of reaching the caller as the operation's own failure.\n          throw isCloneFailure(failure)\n            ? new WorkerUnavailableError(failure.message, { cause: failure })\n            : failure;\n        }),\n        generation.doomed,\n      ]);\n    } finally {\n      if (timer !== undefined) {\n        clearTimeout(timer);\n      }\n    }\n  }\n\n  /**\n   * Rejects and drops one generation whole: its worker, its memoized init, and\n   * every crossing racing its `doomed` promise. The next call therefore re-runs\n   * the cycle on a fresh generation, so a spurious teardown costs a respawn\n   * rather than a permanent degrade.\n   */\n  #teardown(generation: WorkerGeneration | undefined, error: WorkerUnavailableError): void {\n    if (generation === undefined) {\n      return;\n    }\n    if (this.#generation === generation) {\n      this.#generation = undefined;\n    }\n    generation.worker?.terminate();\n    generation.worker = undefined;\n    generation.api = undefined;\n    generation.initPromise = undefined;\n    generation.doom(error);\n  }\n\n  async #degrade(\n    generation: WorkerGeneration | undefined,\n    cause: unknown,\n  ): Promise<EncryptOffloadBackend> {\n    const reason = cause instanceof Error ? cause.message : String(cause);\n    if (this.#config.strict) {\n      this.#teardown(generation, new WorkerUnavailableError(\"Encrypt worker unavailable.\"));\n      throw new EncryptOffloadUnavailableError(\n        `Encrypt offload required (offloadEncrypt: true) but unavailable: ${reason}`,\n        { cause },\n      );\n    }\n    const { transient, pinning } = this.#classifyDegrade(cause);\n    this.#pinnedInline ||= !transient;\n    this.#teardown(generation, new WorkerUnavailableError(\"Encrypt worker degraded to inline.\"));\n    this.#warnDegraded(reason, transient, pinning);\n    if (this.#degradePromise === undefined) {\n      // Only a live backend is memoized: an inline init is a key refetch, and a\n      // transient failure there must not close the degrade path for the session.\n      const attempt: Promise<EncryptOffloadBackend> = (async () => {\n        const inline = this.#config.createInlineClient();\n        await inline.init();\n        return inline;\n      })().catch((error: unknown) => {\n        if (this.#degradePromise === attempt) {\n          this.#degradePromise = undefined;\n        }\n        this.#config.logger.warnAlways(\n          `Encrypt inline fallback failed to initialize: ${error instanceof Error ? error.message : String(error)}`,\n        );\n        throw error;\n      });\n      this.#degradePromise = attempt;\n    }\n    return this.#degradePromise;\n  }\n\n  /**\n   * How one failure degrades, read off the state before the degrade mutates it:\n   * `transient` diverts only this call, `pinning` settles the client inline now.\n   * One crash is treated as transient; a repeat crash, or a worker that never\n   * came up, settles the client inline rather than spawning a replacement per call.\n   */\n  #classifyDegrade(cause: unknown): { readonly transient: boolean; readonly pinning: boolean } {\n    const transient =\n      cause instanceof WorkerUnavailableError &&\n      cause.crashed &&\n      this.#crashes.count < CRASH_PIN_THRESHOLD;\n    return { transient, pinning: !transient && !this.#pinnedInline };\n  }\n\n  /** One warning per failure, whether it pins the client inline or only diverts this call. */\n  #warnDegraded(reason: string, transient: boolean, pinning: boolean): void {\n    if (!pinning && this.#crashes.warnedFor === this.#crashes.count) {\n      return;\n    }\n    this.#crashes = { ...this.#crashes, warnedFor: this.#crashes.count };\n    const scope = transient ? \"in-flight encryption falls back\" : \"encryption falls back\";\n    // Always on the console: a silent return to main-thread encryption is the\n    // freeze this offload prevents.\n    this.#config.logger.warnAlways(\n      `${ENCRYPT_OFFLOAD_WARN_PREFIX}, ${scope} to the calling thread: ${reason}`,\n    );\n  }\n}\n","import { createUnsignedLegacyDecryptionPermitEip712 as createUnsignedLegacyDecryptionPermitEip712Action } from \"@fhevm/sdk/actions/base\";\nimport {\n  createFhevmBaseClient,\n  createFhevmDecryptClient,\n  createFhevmEncryptClient,\n  hasFhevmRuntimeConfig,\n} from \"@fhevm/sdk/viem\";\nimport {\n  createFhevmCleartextBaseClient,\n  createFhevmCleartextDecryptClient,\n  createFhevmCleartextEncryptClient,\n} from \"@fhevm/sdk/viem/cleartext\";\nimport { createPublicClient, custom, http } from \"viem\";\nimport { toFhevmChain } from \"../chains/to-fhevm-chain\";\nimport type { FheChain } from \"../chains/types\";\nimport { ConfigurationError } from \"../errors\";\nimport { getAppliedWireRuntime, hasAppliedLocateFile } from \"./applied-runtime\";\nimport type { LoggerService } from \"../services/logger-service\";\nimport {\n  DEFAULT_ENCRYPT_WORKER_TIMEOUTS,\n  EncryptWorkerClient,\n  type EncryptWorkerClientConfig,\n  type EncryptWorkerTimeouts,\n} from \"../worker/encrypt-worker-client\";\nimport { BUNDLED_ENCRYPT_WORKER } from \"../worker/spawn\";\nimport type {\n  FhevmBaseClient,\n  FhevmClient,\n  FhevmDecryptClient,\n  FhevmEncryptBackend,\n  FhevmRelayerOptions,\n  RelayerSDK,\n  RelayerOptions,\n  WireRuntimeConfig,\n} from \"./types\";\n\n/** The `@fhevm/sdk` client inputs the worker realm rebuilds its own client from. */\ntype EncryptInitPayload = EncryptWorkerClientConfig[\"initPayload\"];\n\n/** Construction config for {@link FhevmRelayer}. */\nexport interface FhevmRelayerConfig {\n  /** FHE chain configuration. */\n  chain: FheChain;\n  /**\n   * Cleartext mode for local dev/test chains without FHE infrastructure — reads\n   * mock cleartexts from the on-chain executor (discovered automatically)\n   * instead of calling the relayer.\n   */\n  cleartext?: boolean;\n  /**\n   * Per-transport {@link RelayerOptions}: `@fhevm/sdk` client options plus a\n   * default request `timeout` applied to every relayer round-trip on the chain.\n   */\n  options?: RelayerOptions;\n  /** Encrypt-worker offload mode; see `web()`'s `offloadEncrypt` option. */\n  offloadEncrypt?: \"auto\" | boolean;\n  /** Watchdog deadlines for the encrypt worker; `web()` defaults every field before it gets here. */\n  offloadTimeouts?: EncryptWorkerTimeouts;\n  /** Custom source for the encrypt worker; see `web()`'s `offloadWorker` option. */\n  offloadWorker?: string | URL | (() => Worker);\n  /** Receives worker log lines and offload-fallback warnings. */\n  logger: LoggerService;\n}\n\n/**\n * Single-chain FHE backend that drives `@fhevm/sdk` on the calling thread with\n * capability-scoped lazy initialization.\n * EIP-712 signing is done by the signer layer; this backend builds the typed\n * data and, on decrypt, reassembles the new SDK's signed permit from the\n * interface's params + the previously returned signature.\n *\n * @remarks\n * Each method delegates to the narrowest base, decrypt, or encrypt client,\n * adding two cross-cutting behaviors that the delegated signatures don't\n * express:\n *\n * - **Lazy init.** Each operation initializes only the capability it requires.\n *   Public decrypt avoids WASM, private decrypt loads TKMS only, and encryption\n *   alone loads TFHE and the FHE encryption key.\n * - **Option merging.** The chain's default options (`auth`, `timeout`, `debug`)\n *   are spread in first, then the per-call `options`, so a per-call value always\n *   wins over the chain default. Serialization helpers make no relayer\n *   round-trip, so they inject no options.\n *\n * @internal\n */\nexport class FhevmRelayer implements RelayerSDK {\n  readonly #chain: FheChain;\n  readonly #base: FhevmBaseClient;\n  readonly #decrypt: FhevmDecryptClient;\n  readonly #encrypt: FhevmEncryptBackend;\n  readonly #defaultOptions: Partial<FhevmRelayerOptions>;\n  #encryptInitPromise: Promise<void> | undefined;\n\n  /**\n   * Builds capability-scoped `@fhevm/sdk` clients for the chain and captures\n   * the chain's `auth`/`timeout`/`debug` as request defaults. Construction is\n   * cheap; each client's one-time init is deferred to its first operation.\n   */\n  constructor(config: FhevmRelayerConfig) {\n    this.#chain = config.chain;\n    const { timeout, debug, batchRpcCalls, moduleVersions, fheEncryptionKey } =\n      config.options ?? {};\n    const auth = this.#chain.auth ? toFhevmAuth(this.#chain.auth) : undefined;\n    const transport =\n      typeof this.#chain.network === \"string\"\n        ? http(this.#chain.network)\n        : custom(this.#chain.network);\n    const params = {\n      publicClient: createPublicClient({ transport }),\n      chain: toFhevmChain(this.#chain),\n      options: { batchRpcCalls, moduleVersions, fheEncryptionKey },\n    };\n    this.#defaultOptions = {\n      ...(auth !== undefined && { auth }),\n      ...(timeout !== undefined && { timeout }),\n      ...(debug !== undefined && { debug }),\n    };\n    // The FHE key is always fetched here, on the calling thread, so the chain's\n    // default request options (auth in particular) apply; a worker realm has no\n    // access to them.\n    const prefetchKey = () =>\n      this.#base.fetchFheEncryptionKeyBytes({ options: this.#defaultOptions });\n    // Re-listed rather than spread: the upstream client exposes an enumerable\n    // `ready` getter, and a spread would call it, starting init at construction.\n    const withInlineInit = (client: FhevmEncryptBackend): FhevmEncryptBackend => ({\n      init: async () => {\n        await prefetchKey();\n        await client.init();\n      },\n      encryptValue: (parameters) => client.encryptValue(parameters),\n      encryptValues: (parameters) => client.encryptValues(parameters),\n      fetchFheEncryptionKeyBytes: (parameters) => client.fetchFheEncryptionKeyBytes(parameters),\n    });\n    if (config.cleartext) {\n      this.#base = createFhevmCleartextBaseClient(params);\n      this.#decrypt = createFhevmCleartextDecryptClient(params);\n      this.#encrypt = withInlineInit(createFhevmCleartextEncryptClient(params));\n    } else {\n      this.#base = createFhevmBaseClient(params);\n      this.#decrypt = createFhevmDecryptClient(params);\n      this.#encrypt = this.#buildEncryptBackend(config, params, {\n        prefetchKey,\n        createInlineClient: () => withInlineInit(createFhevmEncryptClient(params)),\n      });\n    }\n  }\n\n  /**\n   * Picks the encrypt backend for a non-cleartext chain: the worker client when\n   * offload is on and reachable, the inline calling-thread client otherwise.\n   */\n  #buildEncryptBackend(\n    config: FhevmRelayerConfig,\n    params: { chain: EncryptInitPayload[\"chain\"]; options: EncryptInitPayload[\"clientOptions\"] },\n    inline: {\n      prefetchKey: EncryptWorkerClientConfig[\"prefetchKey\"];\n      createInlineClient: () => FhevmEncryptBackend;\n    },\n  ): FhevmEncryptBackend {\n    const offload = config.offloadEncrypt ?? false;\n    const strict = offload === true;\n    const workerAvailable =\n      typeof Worker === \"function\" &&\n      (config.offloadWorker !== undefined || BUNDLED_ENCRYPT_WORKER);\n    // Silent both ways: offload off is what the caller asked for, and a realm\n    // with no Worker is an environment fact that would warn on every SSR\n    // render. Strict skips the capability check, since construction runs during\n    // that render and the failure must surface at call time instead.\n    if (offload === false || !(strict || workerAvailable)) {\n      return inline.createInlineClient();\n    }\n    const runtime = getAppliedWireRuntime();\n    const blocker = encryptOffloadBlocker(runtime);\n    if (blocker !== undefined && !strict) {\n      // Always on the console: the alternative is an opaque rejection at\n      // encrypt time, or WASM assets silently resolved from the default URLs.\n      config.logger.warnAlways(`Encryption runs on the calling thread: ${blocker}.`);\n      return inline.createInlineClient();\n    }\n    const workerClient = new EncryptWorkerClient({\n      initPayload: { chain: params.chain, clientOptions: params.options, runtime: runtime ?? {} },\n      network: this.#chain.network,\n      prefetchKey: inline.prefetchKey,\n      createInlineClient: inline.createInlineClient,\n      logger: config.logger,\n      timeouts: config.offloadTimeouts ?? DEFAULT_ENCRYPT_WORKER_TIMEOUTS,\n      workerSource: config.offloadWorker,\n      // Strict with a blocker: the client degrades at init, which rejects at\n      // call time rather than at config time.\n      blockedReason: blocker,\n      strict,\n    });\n    return {\n      init: () => workerClient.init(),\n      encryptValue: (parameters) => workerClient.encryptValue(parameters),\n      encryptValues: (parameters) => workerClient.encryptValues(parameters),\n      // Served from the calling thread: routing it through the worker would\n      // structured-clone the ~50 MB key back out on every call. `ignoreCache`\n      // therefore refreshes this thread's cache, not the worker's seeded key.\n      fetchFheEncryptionKeyBytes: (parameters) => this.#base.fetchFheEncryptionKeyBytes(parameters),\n      dispose: () => workerClient.dispose(),\n    };\n  }\n\n  /** The FHE chain this backend is bound to. */\n  get chain() {\n    return this.#chain;\n  }\n\n  // Only a fulfilled init is memoized: a rejection clears the memo so the next\n  // encryption retries instead of inheriting a transient key-fetch failure.\n  #initEncrypt = (): Promise<void> => {\n    this.#encryptInitPromise ??= this.#encrypt.init().catch((error: unknown) => {\n      this.#encryptInitPromise = undefined;\n      throw error;\n    });\n    return this.#encryptInitPromise;\n  };\n\n  /**\n   * Releases the encrypt worker once in-flight encryptions settle and drops the\n   * memoized init; the next encryption spawns a fresh worker and re-initializes.\n   */\n  dispose = (): void => {\n    this.#encryptInitPromise = undefined;\n    this.#encrypt.dispose?.();\n  };\n\n  /**\n   * Decrypts a single publicly-decryptable value — one whose contract granted\n   * public access, so no permit or key pair is needed — into its typed clear\n   * value.\n   *\n   * @example\n   * ```ts\n   * const { type, value } = await relayer.decryptPublicValue({\n   *   encryptedValue: handle, // a bytes32 ciphertext reference\n   * });\n   * ```\n   */\n  decryptPublicValue: FhevmClient[\"decryptPublicValue\"] = async (parameters) => {\n    await this.#base.init();\n    return this.#base.decryptPublicValue({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * Batch form of {@link decryptPublicValue}: decrypts many publicly-decryptable\n   * values in one relayer round-trip, returning their typed clear values in\n   * order.\n   *\n   * @example\n   * ```ts\n   * const values = await relayer.decryptPublicValues({\n   *   encryptedValues: [handleA, handleB],\n   * });\n   * ```\n   */\n  decryptPublicValues: FhevmClient[\"decryptPublicValues\"] = async (parameters) => {\n    await this.#base.init();\n    return this.#base.decryptPublicValues({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * Like {@link decryptPublicValues}, but also returns the KMS signature bundle —\n   * the handles list, ABI-encoded cleartexts, and decryption proof — needed to\n   * verify or replay the result on-chain.\n   *\n   * @example\n   * ```ts\n   * const { clearValues, checkSignaturesArgs } =\n   *   await relayer.decryptPublicValuesWithSignatures({ encryptedValues: [handle] });\n   * // checkSignaturesArgs: { handlesList, abiEncodedCleartexts, decryptionProof }\n   * ```\n   */\n  decryptPublicValuesWithSignatures: FhevmClient[\"decryptPublicValuesWithSignatures\"] = async (\n    parameters,\n  ) => {\n    await this.#base.init();\n    return this.#base.decryptPublicValuesWithSignatures({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * Encrypts one typed input under the chain's FHE key, bound to the contract it\n   * targets and the user submitting it, and returns the ciphertext handle plus\n   * the input proof the contract verifies on-chain. `type` is the FHE type\n   * with the `e` prefix (`\"euint64\"`, `\"ebool\"`, `\"eaddress\"`).\n   *\n   * @example\n   * ```ts\n   * const { encryptedValue, inputProof } = await relayer.encryptValue({\n   *   value: { type: \"euint64\", value: 1000n },\n   *   contractAddress: \"0xToken…\",\n   *   userAddress: \"0xUser…\",\n   * });\n   * ```\n   */\n  encryptValue: FhevmClient[\"encryptValue\"] = async (parameters) => {\n    await this.#initEncrypt();\n    return this.#encrypt.encryptValue({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * Batch form of {@link encryptValue}: encrypts several inputs for the same\n   * contract and user in one call, returning all ciphertext handles under a\n   * single shared input proof.\n   *\n   * @example\n   * ```ts\n   * const { encryptedValues, inputProof } = await relayer.encryptValues({\n   *   values: [\n   *     { type: \"euint64\", value: 1000n },\n   *     { type: \"ebool\", value: true },\n   *   ],\n   *   contractAddress: \"0xToken…\",\n   *   userAddress: \"0xUser…\",\n   * });\n   * ```\n   */\n  encryptValues: FhevmClient[\"encryptValues\"] = async (parameters) => {\n    await this.#initEncrypt();\n    return this.#encrypt.encryptValues({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * User-decrypts a single access-controlled value: the relayer re-encrypts it\n   * to the ephemeral transport key pair, gated by the signed permit, and this\n   * returns the typed clear value. Build the key pair with\n   * {@link generateTransportKeyPair} and the permit with\n   * {@link signDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const { type, value } = await relayer.decryptValue({\n   *   encryptedValue: handle,\n   *   contractAddress: \"0xToken…\",\n   *   transportKeyPair,\n   *   signedPermit,\n   * });\n   * ```\n   */\n  decryptValue: FhevmClient[\"decryptValue\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.decryptValue({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * Batch form of {@link decryptValue} for values that all belong to the same\n   * contract; returns the typed clear values positionally. For values spanning\n   * multiple contracts, use {@link decryptValuesFromPairs}.\n   *\n   * @example\n   * ```ts\n   * const values = await relayer.decryptValues({\n   *   encryptedValues: [handleA, handleB],\n   *   contractAddress: \"0xToken…\",\n   *   transportKeyPair,\n   *   signedPermit,\n   * });\n   * ```\n   */\n  decryptValues: FhevmClient[\"decryptValues\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.decryptValues({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * User-decrypts values that span multiple contracts: each pair carries its own\n   * `contractAddress`, so one permit covering those contracts decrypts them all\n   * in a single round-trip. Returns the typed clear values positionally.\n   *\n   * @example\n   * ```ts\n   * const values = await relayer.decryptValuesFromPairs({\n   *   pairs: [\n   *     { encryptedValue: handleA, contractAddress: \"0xTokenA…\" },\n   *     { encryptedValue: handleB, contractAddress: \"0xTokenB…\" },\n   *   ],\n   *   transportKeyPair,\n   *   signedPermit,\n   * });\n   * ```\n   */\n  decryptValuesFromPairs: FhevmClient[\"decryptValuesFromPairs\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.decryptValuesFromPairs({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * Fetches the chain's raw FHE public-key bytes — the key encryption uses —\n   * served from cache unless `ignoreCache` forces a refetch. Rarely called\n   * directly: {@link encryptValue}/{@link encryptValues} fetch the key for you.\n   *\n   * @example\n   * ```ts\n   * const keyBytes = await relayer.fetchFheEncryptionKeyBytes();\n   * const fresh = await relayer.fetchFheEncryptionKeyBytes({ ignoreCache: true });\n   * ```\n   */\n  fetchFheEncryptionKeyBytes: FhevmClient[\"fetchFheEncryptionKeyBytes\"] = async (parameters) => {\n    // Served from the base client, which shares the key cache with the encrypt\n    // client: initializing encryption here would spawn the encrypt worker and\n    // wait out its bring-up for a key this thread fetches itself.\n    await this.#base.init();\n    return this.#base.fetchFheEncryptionKeyBytes({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters?.options },\n    });\n  };\n\n  /**\n   * Builds the EIP-712 user-decrypt permit and signs it with the given signer,\n   * authorizing the transport key pair to decrypt the listed contracts' values\n   * for `durationSeconds` starting at `startTimestamp`. Pass `delegatorAddress`\n   * to sign a delegated permit — decrypting values owned by that account instead\n   * of the signer's own. Persist the result via\n   * {@link serializeSignedDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const signedPermit = await relayer.signDecryptionPermit({\n   *   transportKeyPair,\n   *   contractAddresses: [\"0xToken…\"],\n   *   startTimestamp: Math.floor(Date.now() / 1000),\n   *   durationSeconds: 60 * 60 * 24,\n   *   signerAddress: \"0xUser…\",\n   *   signer,\n   *   // delegatorAddress: \"0xOwner…\", // omit for a self permit\n   * });\n   * ```\n   */\n  signDecryptionPermit: FhevmClient[\"signDecryptionPermit\"] = async (parameters) => {\n    await this.#base.init();\n    return this.#base.signDecryptionPermit(parameters);\n  };\n\n  /**\n   * Builds the unsigned EIP-712 typed data for a V1 decryption permit, without\n   * signing it — the signer-less counterpart to {@link signDecryptionPermit}.\n   * Hand the result to an out-of-process signer for `eth_signTypedData_v4`,\n   * then verify the returned signature via {@link parseSignedDecryptionPermit}.\n   *\n   * Not on `@fhevm/sdk`'s client decorator, so it's called directly against\n   * the base client rather than through a decorated method.\n   *\n   * @example\n   * ```ts\n   * const eip712 = await relayer.createUnsignedLegacyDecryptionPermitEip712({\n   *   transportKeyPair,\n   *   contractAddresses: [\"0xToken…\"],\n   *   startTimestamp: Math.floor(Date.now() / 1000),\n   *   durationSeconds: 60 * 60 * 24,\n   *   // delegatorAddress: \"0xOwner…\", // omit for a self permit\n   * });\n   * ```\n   */\n  createUnsignedLegacyDecryptionPermitEip712: RelayerSDK[\"createUnsignedLegacyDecryptionPermitEip712\"] =\n    (parameters) => createUnsignedLegacyDecryptionPermitEip712Action(this.#base, parameters);\n\n  // Permit/key-pair helpers carry no request options. Parsing explicitly\n  // initializes the capability that validates the restored value; serialization\n  // resolves the frozen context internally (via initPublicAction), which reads\n  // on-chain state.\n\n  /**\n   * Serializes a transport key pair to a hex `{ publicKey, privateKey }` pair for\n   * storage or transport, so a decryption session can resume without regenerating\n   * keys. Reverse of {@link parseTransportKeyPair}.\n   *\n   * @example\n   * ```ts\n   * const stored = await relayer.serializeTransportKeyPair({ transportKeyPair });\n   * // { publicKey: \"0x…\", privateKey: \"0x…\" }\n   * ```\n   */\n  serializeTransportKeyPair: FhevmClient[\"serializeTransportKeyPair\"] = (parameters) =>\n    this.#decrypt.serializeTransportKeyPair(parameters);\n\n  /**\n   * Serializes a signed permit to a plain, JSON-stringifiable object (version,\n   * EIP-712 payload, signature, signer) for caching or transport. Reverse of\n   * {@link parseSignedDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const serialized = await relayer.serializeSignedDecryptionPermit({ signedPermit });\n   * localStorage.setItem(\"permit\", JSON.stringify(serialized));\n   * ```\n   */\n  serializeSignedDecryptionPermit: FhevmClient[\"serializeSignedDecryptionPermit\"] = (parameters) =>\n    this.#base.serializeSignedDecryptionPermit(parameters);\n\n  /**\n   * Rebuilds a transport key pair from its serialized hex\n   * `{ publicKey, privateKey }` form. Reverse of {@link serializeTransportKeyPair}.\n   *\n   * @example\n   * ```ts\n   * const transportKeyPair = await relayer.parseTransportKeyPair({\n   *   publicKey: stored.publicKey,\n   *   privateKey: stored.privateKey,\n   * });\n   * ```\n   */\n  parseTransportKeyPair: FhevmClient[\"parseTransportKeyPair\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.parseTransportKeyPair(parameters);\n  };\n\n  /**\n   * Rebuilds a signed permit from its serialized form and validates it: checks\n   * the EIP-712 structure, verifies the signature against the on-chain verifier,\n   * and confirms the permit's public key matches `transportKeyPair`. Reverse of\n   * {@link serializeSignedDecryptionPermit}.\n   *\n   * @throws if the permit is malformed, expired, or its signature is invalid.\n   *\n   * @example\n   * ```ts\n   * const signedPermit = await relayer.parseSignedDecryptionPermit({\n   *   serializedPermit,\n   *   transportKeyPair,\n   * });\n   * ```\n   */\n  parseSignedDecryptionPermit: FhevmClient[\"parseSignedDecryptionPermit\"] = async (parameters) => {\n    await this.#base.init();\n    const { serializedPermit } = parameters;\n    return this.#base.parseSignedDecryptionPermit({\n      ...parameters,\n      serializedPermit: {\n        ...serializedPermit,\n        signature: normalizeSignatureV(serializedPermit.signature),\n      },\n    });\n  };\n\n  /**\n   * Generates a fresh ephemeral transport key pair for a user-decrypt session.\n   * The relayer re-encrypts decrypted values to this pair's public key, so only\n   * the holder of the private key can read them; bind it to a permit via\n   * {@link signDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const transportKeyPair = await relayer.generateTransportKeyPair();\n   * ```\n   */\n  generateTransportKeyPair: FhevmClient[\"generateTransportKeyPair\"] = async () => {\n    await this.#decrypt.init();\n    return this.#decrypt.generateTransportKeyPair();\n  };\n}\n\n/**\n * Rewrites a 65-byte signature's recovery byte from 0/1 to 27/28. The gateway\n * verifies V1 permits on-chain with OpenZeppelin `ECDSA.recover`, which rejects\n * 0/1. Longer signatures (ERC-1271, concatenated) pass through untouched.\n */\nfunction normalizeSignatureV(signature: string): string {\n  if (signature.length !== 132) {\n    return signature;\n  }\n  const v = parseInt(signature.slice(130), 16);\n  if (v !== 0 && v !== 1) {\n    return signature;\n  }\n  return `${signature.slice(0, 130)}${v === 0 ? \"1b\" : \"1c\"}`;\n}\n\n/**\n * The one reason, if any, this thread's configuration cannot be reproduced in\n * the worker realm, so offload is worse than inline there.\n */\nfunction encryptOffloadBlocker(runtime: WireRuntimeConfig | undefined): string | undefined {\n  // A runtime `locateFile` is a function: it cannot be cloned into the worker\n  // realm, which would silently resolve WASM assets from the default URLs.\n  if (hasAppliedLocateFile()) {\n    return \"a runtime locateFile cannot cross the encrypt worker boundary\";\n  }\n  // Unreadable here, so the worker would run on fhevm defaults: an auth it\n  // carries would 401 inside the worker as an application error, which never degrades.\n  if (runtime === undefined && hasFhevmRuntimeConfig()) {\n    return \"a runtime config set outside createConfig cannot be replicated in the encrypt worker realm\";\n  }\n  return undefined;\n}\n\n/**\n * Translates the SDK's public {@link FheChain.auth} shape (discriminated by\n * `__type`) into the `type`-discriminated `auth` that `@fhevm/sdk` expects.\n *\n * @throws if the auth discriminator is not one of the supported kinds.\n */\nfunction toFhevmAuth(\n  auth: NonNullable<FheChain[\"auth\"]>,\n): NonNullable<FhevmRelayerOptions[\"auth\"]> {\n  const type = auth[\"__type\"];\n  switch (type) {\n    case \"ApiKeyHeader\":\n      return { type, value: auth.value, header: auth.header };\n    case \"ApiKeyCookie\":\n      return { type, value: auth.value, cookie: auth.cookie };\n    case \"BearerToken\":\n      return { type, token: auth.token };\n    default:\n      throw new ConfigurationError(`Unknown auth type: ${String(type)}`);\n  }\n}\n"],"x_google_ignoreList":[1],"mappings":"6lBAYA,SAAgB,GAAa,EAA6B,CACxD,MAAO,CACL,GAAI,EAAM,GACV,MAAO,CACL,UAAW,CACT,IAAK,CAAE,QAAS,EAAM,kBAAmB,EACzC,cAAe,CAAE,QAAS,EAAM,4BAA6B,EAC7D,YAAa,CAAE,QAAS,EAAM,kBAAmB,EACjD,eAAgB,IAAA,EAClB,EACA,WAAY,EAAM,WAClB,QAAS,CACP,GAAI,EAAM,eACV,UAAW,CACT,WAAY,CAAE,QAAS,EAAM,kCAAmC,EAChE,kBAAmB,CAAE,QAAS,EAAM,yCAA0C,CAChF,CACF,CACF,CACF,CACF;;;;;;AC3BA,MAAM,EAAc,OAAO,eAAe,EACpC,EAAiB,OAAO,kBAAkB,EAC1C,EAAe,OAAO,sBAAsB,EAC5C,EAAY,OAAO,mBAAmB,EACtC,EAAc,OAAO,gBAAgB,EACrC,EAAY,GAAS,OAAO,GAAQ,YAAY,GAAiB,OAAO,GAAQ,WAgDhF,EAAmB,IAAI,IAAI,CAC7B,CAAC,QAAS,CA5CV,UAAY,GAAQ,EAAS,CAAG,GAAK,EAAI,GACzC,UAAU,EAAK,CACX,GAAM,CAAE,QAAO,SAAU,IAAI,eAE7B,OADA,EAAO,EAAK,CAAK,EACV,CAAC,EAAO,CAAC,CAAK,CAAC,CAC1B,EACA,YAAY,EAAM,CAEd,OADA,EAAK,MAAM,EACJ,EAAK,CAAI,CACpB,CAmC6B,CAAC,EAC9B,CAAC,QAAS,CA9BV,UAAY,GAAU,EAAS,CAAK,GAAK,KAAe,EACxD,UAAU,CAAE,SAAS,CACjB,IAAI,EAcJ,MAbA,CAWI,EAXA,aAAiB,MACJ,CACT,QAAS,GACT,MAAO,CACH,QAAS,EAAM,QACf,KAAM,EAAM,KACZ,MAAO,EAAM,KACjB,CACJ,EAGa,CAAE,QAAS,GAAO,OAAM,EAElC,CAAC,EAAY,CAAC,CAAC,CAC1B,EACA,YAAY,EAAY,CAIpB,MAHI,EAAW,QACL,OAAO,OAAW,MAAM,EAAW,MAAM,OAAO,EAAG,EAAW,KAAK,EAEvE,EAAW,KACrB,CAO6B,CAAC,CAClC,CAAC,EACD,SAAS,GAAgB,EAAgB,EAAQ,CAC7C,IAAK,IAAM,KAAiB,EAIxB,GAHI,IAAW,GAAiB,IAAkB,KAG9C,aAAyB,QAAU,EAAc,KAAK,CAAM,EAC5D,MAAO,GAGf,MAAO,EACX,CACA,SAAS,EAAO,EAAK,EAAK,WAAY,EAAiB,CAAC,GAAG,EAAG,CAC1D,EAAG,iBAAiB,UAAW,SAAS,EAAS,EAAI,CACjD,GAAI,CAAC,GAAM,CAAC,EAAG,KACX,OAEJ,GAAI,CAAC,GAAgB,EAAgB,EAAG,MAAM,EAAG,CAC7C,QAAQ,KAAK,mBAAmB,EAAG,OAAO,oBAAoB,EAC9D,MACJ,CACA,GAAM,CAAE,KAAI,OAAM,QAAS,OAAO,OAAO,CAAE,KAAM,CAAC,CAAE,EAAG,EAAG,IAAI,EACxD,GAAgB,EAAG,KAAK,cAAgB,CAAC,EAAA,CAAG,IAAI,CAAa,EAC/D,EACJ,GAAI,CACA,IAAM,EAAS,EAAK,MAAM,EAAG,EAAE,CAAC,CAAC,QAAQ,EAAK,IAAS,EAAI,GAAO,CAAG,EAC/D,EAAW,EAAK,QAAQ,EAAK,IAAS,EAAI,GAAO,CAAG,EAC1D,OAAQ,EAAR,CACI,IAAK,MAEG,EAAc,EAElB,MACJ,IAAK,MAEG,EAAO,EAAK,MAAM,EAAE,CAAC,CAAC,IAAM,EAAc,EAAG,KAAK,KAAK,EACvD,EAAc,GAElB,MACJ,IAAK,QAEG,EAAc,EAAS,MAAM,EAAQ,CAAY,EAErD,MACJ,IAAK,YAGG,EAAc,EAAM,IADF,EAAS,GAAG,CACN,CAAC,EAE7B,MACJ,IAAK,WACD,CACI,GAAM,CAAE,QAAO,SAAU,IAAI,eAC7B,EAAO,EAAK,CAAK,EACjB,EAAc,EAAS,EAAO,CAAC,CAAK,CAAC,CACzC,CACA,MACJ,IAAK,UAEG,EAAc,IAAA,GAElB,MACJ,QACI,MACR,CACJ,OACO,EAAO,CACV,EAAc,CAAE,SAAQ,GAAc,CAAE,CAC5C,CACA,QAAQ,QAAQ,CAAW,CAAC,CACvB,MAAO,IACD,CAAE,SAAQ,GAAc,CAAE,EACpC,CAAC,CACG,KAAM,GAAgB,CACvB,GAAM,CAAC,EAAW,GAAiB,EAAY,CAAW,EAC1D,EAAG,YAAY,OAAO,OAAO,OAAO,OAAO,CAAC,EAAG,CAAS,EAAG,CAAE,IAAG,CAAC,EAAG,CAAa,EAC7E,IAAS,YAET,EAAG,oBAAoB,UAAW,CAAQ,EAC1C,EAAc,CAAE,EACZ,KAAa,GAAO,OAAO,EAAI,IAAe,YAC9C,EAAI,EAAU,CAAC,EAG3B,CAAC,CAAC,CACG,MAAO,GAAU,CAElB,GAAM,CAAC,EAAW,GAAiB,EAAY,CAC3C,MAAW,UAAU,6BAA6B,GACjD,GAAc,CACnB,CAAC,EACD,EAAG,YAAY,OAAO,OAAO,OAAO,OAAO,CAAC,EAAG,CAAS,EAAG,CAAE,IAAG,CAAC,EAAG,CAAa,CACrF,CAAC,CACL,CAAC,EACG,EAAG,OACH,EAAG,MAAM,CAEjB,CACA,SAAS,GAAc,EAAU,CAC7B,OAAO,EAAS,YAAY,OAAS,aACzC,CACA,SAAS,EAAc,EAAU,CACzB,GAAc,CAAQ,GACtB,EAAS,MAAM,CACvB,CACA,SAAS,EAAK,EAAI,EAAQ,CACtB,IAAM,EAAmB,IAAI,IAiB7B,OAhBA,EAAG,iBAAiB,UAAW,SAAuB,EAAI,CACtD,GAAM,CAAE,QAAS,EACjB,GAAI,CAAC,GAAQ,CAAC,EAAK,GACf,OAEJ,IAAM,EAAW,EAAiB,IAAI,EAAK,EAAE,EACxC,KAGL,GAAI,CACA,EAAS,CAAI,CACjB,QACQ,CACJ,EAAiB,OAAO,EAAK,EAAE,CACnC,CACJ,CAAC,EACM,EAAY,EAAI,EAAkB,CAAC,EAAG,CAAM,CACvD,CACA,SAAS,EAAqB,EAAY,CACtC,GAAI,EACA,MAAU,MAAM,4CAA4C,CAEpE,CACA,SAAS,EAAgB,EAAI,CACzB,OAAO,EAAuB,EAAI,IAAI,IAAO,CACzC,KAAM,SACV,CAAC,CAAC,CAAC,SAAW,CACV,EAAc,CAAE,CACpB,CAAC,CACL,CACA,MAAM,EAAe,IAAI,QACnB,EAAkB,yBAA0B,YAC9C,IAAI,qBAAsB,GAAO,CAC7B,IAAM,GAAY,EAAa,IAAI,CAAE,GAAK,GAAK,EAC/C,EAAa,IAAI,EAAI,CAAQ,EACzB,IAAa,GACb,EAAgB,CAAE,CAE1B,CAAC,EACL,SAAS,EAAc,EAAO,EAAI,CAC9B,IAAM,GAAY,EAAa,IAAI,CAAE,GAAK,GAAK,EAC/C,EAAa,IAAI,EAAI,CAAQ,EACzB,GACA,EAAgB,SAAS,EAAO,EAAI,CAAK,CAEjD,CACA,SAAS,EAAgB,EAAO,CACxB,GACA,EAAgB,WAAW,CAAK,CAExC,CACA,SAAS,EAAY,EAAI,EAAkB,EAAO,CAAC,EAAG,EAAS,UAAY,CAAE,EAAG,CAC5E,IAAI,EAAkB,GAChB,EAAQ,IAAI,MAAM,EAAQ,CAC5B,IAAI,EAAS,EAAM,CAEf,GADA,EAAqB,CAAe,EAChC,IAAS,EACT,UAAa,CACT,EAAgB,CAAK,EACrB,EAAgB,CAAE,EAClB,EAAiB,MAAM,EACvB,EAAkB,EACtB,EAEJ,GAAI,IAAS,OAAQ,CACjB,GAAI,EAAK,SAAW,EAChB,MAAO,CAAE,SAAY,CAAM,EAE/B,IAAM,EAAI,EAAuB,EAAI,EAAkB,CACnD,KAAM,MACN,KAAM,EAAK,IAAK,GAAM,EAAE,SAAS,CAAC,CACtC,CAAC,CAAC,CAAC,KAAK,CAAa,EACrB,OAAO,EAAE,KAAK,KAAK,CAAC,CACxB,CACA,OAAO,EAAY,EAAI,EAAkB,CAAC,GAAG,EAAM,CAAI,CAAC,CAC5D,EACA,IAAI,EAAS,EAAM,EAAU,CACzB,EAAqB,CAAe,EAGpC,GAAM,CAAC,EAAO,GAAiB,EAAY,CAAQ,EACnD,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,MACN,KAAM,CAAC,GAAG,EAAM,CAAI,CAAC,CAAC,IAAK,GAAM,EAAE,SAAS,CAAC,EAC7C,OACJ,EAAG,CAAa,CAAC,CAAC,KAAK,CAAa,CACxC,EACA,MAAM,EAAS,EAAU,EAAiB,CACtC,EAAqB,CAAe,EACpC,IAAM,EAAO,EAAK,EAAK,OAAS,GAChC,GAAI,IAAS,EACT,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,UACV,CAAC,CAAC,CAAC,KAAK,CAAa,EAGzB,GAAI,IAAS,OACT,OAAO,EAAY,EAAI,EAAkB,EAAK,MAAM,EAAG,EAAE,CAAC,EAE9D,GAAM,CAAC,EAAc,GAAiB,EAAiB,CAAe,EACtE,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,QACN,KAAM,EAAK,IAAK,GAAM,EAAE,SAAS,CAAC,EAClC,cACJ,EAAG,CAAa,CAAC,CAAC,KAAK,CAAa,CACxC,EACA,UAAU,EAAS,EAAiB,CAChC,EAAqB,CAAe,EACpC,GAAM,CAAC,EAAc,GAAiB,EAAiB,CAAe,EACtE,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,YACN,KAAM,EAAK,IAAK,GAAM,EAAE,SAAS,CAAC,EAClC,cACJ,EAAG,CAAa,CAAC,CAAC,KAAK,CAAa,CACxC,CACJ,CAAC,EAED,OADA,EAAc,EAAO,CAAE,EAChB,CACX,CACA,SAAS,EAAO,EAAK,CACjB,OAAO,MAAM,UAAU,OAAO,MAAM,CAAC,EAAG,CAAG,CAC/C,CACA,SAAS,EAAiB,EAAc,CACpC,IAAM,EAAY,EAAa,IAAI,CAAW,EAC9C,MAAO,CAAC,EAAU,IAAK,GAAM,EAAE,EAAE,EAAG,EAAO,EAAU,IAAK,GAAM,EAAE,EAAE,CAAC,CAAC,CAC1E,CACA,MAAM,EAAgB,IAAI,QAC1B,SAAS,EAAS,EAAK,EAAW,CAE9B,OADA,EAAc,IAAI,EAAK,CAAS,EACzB,CACX,CACA,SAAS,EAAM,EAAK,CAChB,OAAO,OAAO,OAAO,EAAK,EAAG,GAAc,EAAK,CAAC,CACrD,CAQA,SAAS,EAAY,EAAO,CACxB,IAAK,GAAM,CAAC,EAAM,KAAY,EAC1B,GAAI,EAAQ,UAAU,CAAK,EAAG,CAC1B,GAAM,CAAC,EAAiB,GAAiB,EAAQ,UAAU,CAAK,EAChE,MAAO,CACH,CACI,KAAM,UACN,OACA,MAAO,CACX,EACA,CACJ,CACJ,CAEJ,MAAO,CACH,CACI,KAAM,MACN,OACJ,EACA,EAAc,IAAI,CAAK,GAAK,CAAC,CACjC,CACJ,CACA,SAAS,EAAc,EAAO,CAC1B,OAAQ,EAAM,KAAd,CACI,IAAK,UACD,OAAO,EAAiB,IAAI,EAAM,IAAI,CAAC,CAAC,YAAY,EAAM,KAAK,EACnE,IAAK,MACD,OAAO,EAAM,KACrB,CACJ,CACA,SAAS,EAAuB,EAAI,EAAkB,EAAK,EAAW,CAClE,OAAO,IAAI,QAAS,GAAY,CAC5B,IAAM,EAAK,EAAa,EACxB,EAAiB,IAAI,EAAI,CAAO,EAC5B,EAAG,OACH,EAAG,MAAM,EAEb,EAAG,YAAY,OAAO,OAAO,CAAE,IAAG,EAAG,CAAG,EAAG,CAAS,CACxD,CAAC,CACL,CACA,SAAS,GAAe,CACpB,MAAO,KAAW,CAAC,CACd,KAAK,CAAC,CAAC,CACP,QAAU,KAAK,MAAM,KAAK,OAAO,WAA2B,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAC3E,KAAK,GAAG,CACjB,CCnPA,SAAgB,EAAY,EAAoC,CAG9D,OACE,OAAO,GAAU,YACjB,GACC,EAAkC,YAAc,EAErD,CAOA,MAAM,EAAmB,CACvB,aACA,SACA,aACA,YACA,kBACA,OACA,OACA,eACA,UACA,QACA,MACF,EAKA,SAAS,EAAY,EAAyB,CAC5C,GAAI,CAEF,OADA,gBAAgB,CAAK,EACd,EACT,MAAQ,CACN,MAAO,EACT,CACF,CAMA,SAAS,EAAuB,EAAmC,CACjE,IAAM,EAAY,EAA+C,SACjE,OAAO,EAAqB,GAAU,OAAO,CAC/C,CAMA,SAAS,EAAkB,EAAwB,CACjD,GAAI,CACF,OAAO,KAAK,UAAU,CAAK,GAAK,OAAO,CAAK,CAC9C,MAAQ,CACN,OAAO,OAAO,CAAK,CACrB,CACF,CAGA,SAAS,EAAiB,EAAyC,CACjE,IAAM,EAAiC,CAAC,EACxC,IAAK,IAAM,KAAO,EAAkB,CAClC,IAAM,EAAS,EAAmC,GAC9C,IAAU,IAAA,IAAa,EAAY,CAAK,IAC1C,EAAM,GAAO,EAEjB,CAGA,GAAI,CAAC,EAAyB,EAAM,UAAa,EAAG,CAClD,IAAM,EAAa,EAAuB,CAAM,EAC5C,IAAe,IAAA,KACjB,EAAM,WAAgB,EAE1B,CACA,OAAO,CACT,CAEA,SAAgB,EAAY,EAAgB,EAAgB,EAA4B,CACtF,GAAI,EAAY,CAAK,EACnB,OAAO,EAET,IAAM,EAAQ,GACZ,EAAQ,GAAK,IAAU,IAAA,GAAY,EAAY,EAAO,EAAQ,CAAC,EAAI,IAAA,GACrE,GAAI,aAAiB,MACnB,MAAO,CACL,UAAW,GACX,KAAM,EAAM,KACZ,QAAS,EAAM,QACf,MAAO,EAAM,MACb,MAAO,EAAiB,CAAK,EAC7B,MAAO,EAAK,EAAM,KAAK,CACzB,EAEF,GAAI,OAAO,GAAU,UAAY,EAAgB,CAG/C,GAAM,CAAE,UAAS,SAAU,EAC3B,MAAO,CACL,UAAW,GACX,KAAM,QACN,QAAS,OAAO,GAAY,SAAW,EAAU,EAAkB,CAAK,EACxE,MAAO,IAAA,GACP,MAAO,EAAiB,CAAK,EAC7B,MAAO,EAAK,CAAK,CACnB,CACF,CACA,MAAO,CACL,UAAW,GACX,KAAM,QACN,QAAS,OAAO,GAAU,SAAW,EAAQ,EAAkB,CAAK,EACpE,MAAO,IAAA,GACP,MAAO,CAAC,EACR,MAAO,IAAA,EACT,CACF,CAOA,SAAgB,EAAc,EAAwB,CACpD,IAAM,EAAY,MAAM,EAAK,QAAS,EAAK,MAAQ,CAAE,MAAO,EAAc,EAAK,KAAK,CAAE,EAAI,CAAC,CAAC,EAM5F,MALA,GAAM,KAAO,EAAK,KACd,EAAK,QAAU,IAAA,KACjB,EAAM,MAAQ,EAAK,OAErB,OAAO,OAAO,EAAO,EAAK,KAAK,EACxB,CACT,CChPA,SAAgB,IAA8B,CAI5C,OAAO,IAAI,OAAO,IAAI,IAAI,sBAAuB,OAAO,KAAK,GAAG,EAAG,CACjE,KAAM,SACN,KAAM,kBACR,CAAC,CACH,CCeA,MAAa,EAAyD,CACpE,MAAO,IACP,KAAM,GACR,EASM,EAAmB,IAAI,QAG7B,IAAM,EAAN,cAAqC,KAAM,CAEzC,QAEA,YAAY,EAAiB,EAAyD,CACpF,MAAM,EAAS,CAAO,EACtB,KAAK,KAAO,yBACZ,KAAK,QAAU,GAAS,SAAW,EACrC,CACF,EAOA,SAAS,GAAe,EAAyB,CAC/C,GAAI,OAAO,GAAU,WAAY,EAC/B,MAAO,GAET,GAAM,CAAE,OAAM,WAAY,EAC1B,OACE,IAAS,kBACR,IAAS,aACR,OAAO,GAAY,UACnB,EAAQ,SAAS,6BAA6B,CAEpD,CAEA,SAAS,EAAe,EAAuC,CAC7D,GAAI,GAAQ,QACV,MAAM,EAAO,QAAU,IAAI,aAAa,6BAA8B,YAAY,CAEtF,CAWA,MAAM,EAA2B,CAAE,MAAO,EAAG,KAAM,IAAA,GAAW,UAAW,EAAG,EAO5E,SAAS,GAAe,EAGtB,CACA,GAAI,IAAQ,IAAA,GACV,MAAO,CAAE,MAAK,UAAW,CAAC,CAAE,EAE9B,IAAM,EAAiB,EAAI,eAAe,MACpC,EAAW,EAAI,SAAS,MAC9B,GAAI,EAAE,aAA0B,aAAe,EAAE,aAAoB,YACnE,MAAO,CAAE,MAAK,UAAW,CAAC,CAAE,EAI9B,IAAM,EAAgB,EAAe,MAAM,EACrC,EAAU,EAAS,MAAM,EAC/B,MAAO,CACL,IAAK,CACH,GAAG,EACH,eAAgB,CAAE,GAAG,EAAI,eAAgB,MAAO,CAAc,EAC9D,SAAU,CAAE,GAAG,EAAI,SAAU,MAAO,CAAQ,CAC9C,EACA,UAAW,CAAC,EAAc,OAAuB,EAAQ,MAAqB,CAChF,CACF,CA4BA,SAAS,IAA2C,CAClD,IAAI,EACE,EAAS,IAAI,SAAgB,EAAU,IAAW,CACtD,EAAO,CACT,CAAC,EAID,OADA,EAAO,UAAY,CAAC,CAAC,EACd,CAAE,YAAa,IAAA,GAAW,OAAQ,IAAA,GAAW,IAAK,IAAA,GAAW,SAAQ,MAAK,CACnF,CAgCA,IAAa,GAAb,KAAkE,CAChE,GAEA,GAEA,GAAgB,GAChB,GAAyB,EAEzB,GAAY,EAEZ,GAA8B,IAAI,IAElC,GAEA,GAAU,EACV,GAAoB,GAEpB,YAAY,EAAmC,CAC7C,KAAKA,GAAU,CACjB,CAEA,SAA4B,CAI1B,IAAM,EAAc,KAAKE,KAAgB,GAAuB,EAChE,GAAI,EAAW,cAAgB,IAAA,GAAW,CAGxC,IAAM,EAAyB,KAAKC,OAAkB,KAAKC,GAAU,CAAU,CAAC,CAAC,CAAC,MAC/E,GAAmB,CAIlB,MAHI,EAAW,cAAgB,IAC7B,EAAW,YAAc,IAAA,IAErB,CACR,CACF,EACA,EAAW,YAAc,CAC3B,CACA,OAAO,EAAW,WACpB,EAEA,aAAuD,GACrD,KAAKD,OACH,KAAKE,GACF,GAAY,EAAQ,aAAa,CAAU,GAG3C,EAAK,EAAI,IAAY,EAAI,aAAa,EAAI,CAAE,GAAG,EAAY,SAAQ,CAAC,EACrE,EAAW,OACb,CACF,EAEF,cAAyD,GACvD,KAAKF,OACH,KAAKE,GACF,GAAY,EAAQ,cAAc,CAAU,GAC5C,EAAK,EAAI,IAAY,EAAI,cAAc,EAAI,CAAE,GAAG,EAAY,SAAQ,CAAC,EACtE,EAAW,OACb,CACF,EAYF,SAAgB,CACd,KAAKC,GAAoB,GACzB,KAAKC,GAAe,CACtB,CAQA,KAAMF,GACJ,EACA,EAKA,EACY,CACZ,GAAM,CAAE,SAAQ,aAAY,GAAG,GAAY,GAAe,CAAC,EAE3D,EAAe,CAAM,EACrB,MAAM,KAAK,KAAK,EAEhB,EAAe,CAAM,EACrB,IAAM,EAAa,KAAKH,GAClB,EAAM,GAAY,IAGxB,GAAI,KAAKM,KAAoB,IAAA,KAAc,KAAKC,IAAiB,IAAQ,IAAA,IACvE,OAAO,EAAO,MAAM,KAAKD,EAAe,EAE1C,GAAI,IAAe,IAAA,IAAa,IAAQ,IAAA,GACtC,OAAO,EACL,MAAM,KAAKE,GACT,EACA,KAAKC,GAAS,MAAQ,IAAI,EAAuB,6BAA6B,CAChF,CACF,EAEF,IAAM,EAAK,KAAKC,KACV,MAAgB,KAAK,EAAI,MAAM,CAAE,CAAC,CAAC,UAAY,CAAC,CAAC,EACvD,GAAQ,iBAAiB,QAAS,EAAS,CAAE,KAAM,EAAK,CAAC,EACrD,GACF,KAAKX,GAAmB,IAAI,EAAI,CAAgD,EAElF,GAAI,CACF,IAAM,EAAS,MAAM,KAAKY,GAAc,EAAY,EAAW,EAAK,EAAI,CAAO,CAAC,EAIhF,MADA,MAAKF,GAAW,EACT,CACT,OAAS,EAAO,CACd,GAAI,aAAiB,EACnB,OAAO,EAAO,MAAM,KAAKD,GAAS,EAAY,CAAK,CAAC,EAEtD,MAAM,CACR,QAAU,CACR,KAAKT,GAAmB,OAAO,CAAE,EACjC,GAAQ,oBAAoB,QAAS,CAAO,CAC9C,CACF,CAEA,KAAMG,GAAU,EAA6C,CAC3D,GAAI,KAAKK,GAEP,OAEF,IAAM,EAAgB,KAAKT,GAAQ,cACnC,GAAI,IAAkB,IAAA,GAAW,CAG/B,MAAM,KAAKU,GAAS,EAAY,IAAI,EAAuB,CAAa,CAAC,EACzE,MACF,CAIA,IAAM,EAAmB,MAAM,KAAKV,GAAQ,YAAY,EACxD,GAAI,CACF,IAAM,EAAM,MAAM,KAAKc,GAAO,CAAU,EAClC,EAAU,KAAKd,GAAQ,QACvB,EACJ,OAAO,GAAY,SACf,KACA,EAAM,KAAO,IAA+C,CAC1D,GAAI,CACF,OAAO,MAAM,EAAQ,QAAQ,CAAiD,CAChF,OAAS,EAAO,CAId,MAAM,EAAY,CAAK,CACzB,CACF,CAAC,EAGD,EAAM,GAAO,EAAmC,IAAoB,CACxE,GAAI,CACF,KAAKA,GAAQ,OAAO,EAAM,CAAC,CAAO,CACpC,OAAS,EAAO,CACd,KAAKe,GAAmB,SAAU,CAAK,CACzC,CACF,CAAC,EACK,EAAa,GAAO,EAAY,IAA6B,CACjE,GAAI,CACF,KAAKd,GAAmB,IAAI,CAAE,CAAC,GAAG,CAAK,CACzC,OAAS,EAAO,CACd,KAAKc,GAAmB,aAAc,CAAK,CAC7C,CACF,CAAC,EAIK,EAAU,GAAe,CAAgB,EAC/C,MAAM,KAAKF,GACT,EACA,EAAI,KACF,EACE,CACE,GAAG,KAAKb,GAAQ,YAChB,cAAe,CACb,GAAG,KAAKA,GAAQ,YAAY,cAC5B,iBAAkB,EAAQ,GAC5B,EACA,OAAQ,OAAO,GAAY,SAAW,EAAU,IAAA,EAClD,EACA,EAAQ,SACV,EACA,EACA,EACA,CACF,EACA,CAAE,GAAI,KAAKA,GAAQ,SAAS,KAAM,UAAW,MAAO,CACtD,EACA,EAAW,IAAM,EACjB,KAAKW,GAAW,CAAE,GAAG,KAAKA,GAAU,KAAM,IAAA,EAAU,CACtD,OAAS,EAAO,CAId,GAAI,EAAE,aAAiB,GAErB,MADA,KAAKK,GAAU,EAAY,IAAI,EAAuB,6BAA6B,CAAC,EAC9E,EAER,MAAM,KAAKN,GAAS,EAAY,CAAK,CACvC,CACF,CAGA,GAAmB,EAAkB,EAAsB,CACzD,IAAM,EAAS,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EACpE,GAAI,CACF,KAAKV,GAAQ,OAAO,KAAK,mBAAmB,EAAS,mBAAmB,GAAQ,CAClF,MAAQ,CAER,CACF,CAOA,KAAMG,GAAe,EAAoC,CACvD,KAAKc,KACL,GAAI,CACF,OAAO,MAAM,EAAK,CACpB,QAAU,CACR,KAAKA,KACL,KAAKV,GAAe,CACtB,CACF,CAEA,IAAuB,CACjB,CAAC,KAAKD,IAAqB,KAAKW,GAAU,IAG9C,KAAKX,GAAoB,GACzB,KAAKJ,IAAa,QAAQ,UAAU,EAGpC,KAAKA,GAAc,IAAA,GACnB,KAAKM,GAAkB,IAAA,GACvB,KAAKC,GAAgB,GACrB,KAAKE,GAAW,EAClB,CAEA,IAAwB,CACtB,IAAM,EAAS,KAAKX,GAAQ,aAC5B,GAAI,IAAW,IAAA,GACb,OAAO,GAAoB,EAE7B,GAAI,OAAO,GAAW,WAAY,CAChC,IAAM,EAAS,EAAO,EAStB,OANI,EAAiB,IAAI,CAAM,GAC7B,KAAKA,GAAQ,OAAO,WAClB,6GACF,EAEF,EAAiB,IAAI,CAAM,EACpB,CACT,CACA,OAAO,IAAI,OAAO,EAAQ,CAAE,KAAM,SAAU,KAAM,kBAAmB,CAAC,CACxE,CAGA,KAAMc,GAAO,EAAiE,CAC5E,IAAI,EACJ,GAAI,CACF,EAAS,KAAKI,GAAc,CAC9B,OAAS,EAAO,CAGd,MAAM,IAAI,EAAuB,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EAAG,CACvF,MAAO,CACT,CAAC,CACH,CACA,EAAW,OAAS,EACpB,IAAM,EAAM,MAAM,KAAKC,GAAW,EAAY,CAAM,EAEpD,OADA,KAAKC,GAAiB,EAAY,CAAM,EACjC,CACT,CAGA,GAAW,EAA8B,EAAmD,CAC1F,OAAO,IAAI,SAAmC,EAAS,IAAW,CAChE,IAAM,MAAe,CACnB,aAAa,CAAK,EAClB,EAAO,oBAAoB,UAAW,CAAO,EAC7C,EAAO,oBAAoB,QAAS,CAAO,CAC7C,EACM,EAAQ,eAAiB,CAC7B,EAAO,EACP,EACE,IAAI,EACF,uCAAuC,KAAKpB,GAAQ,SAAS,MAAM,IACrE,CACF,CACF,EAAG,KAAKA,GAAQ,SAAS,KAAK,EACxB,EAAW,GAAwB,CACnC,EAAM,OAAA,8BACR,EAAO,EACP,EAAQ,EAAuB,CAAM,CAAC,EAE1C,EACM,EAAW,GAAsB,CACrC,EAAO,EACP,IAAM,EAAU,EAAM,SAAW,wBAGjC,EAAO,IAAI,EAAuB,CAAO,CAAC,EAC1C,KAAKgB,GAAU,EAAY,IAAI,EAAuB,CAAO,CAAC,CAChE,EACA,EAAO,iBAAiB,UAAW,CAAO,EAC1C,EAAO,iBAAiB,QAAS,CAAO,CAC1C,CAAC,CACH,CAGA,GAAiB,EAA8B,EAAsB,CACnE,EAAO,iBAAiB,QAAU,GAAsB,CAGtD,GAAI,KAAKd,KAAgB,EACvB,OAKF,IAAM,EAAQ,IAAI,EAAuB,EAAM,SAAW,wBAAyB,CACjF,QAAS,EACX,CAAC,EACD,KAAKS,GAAW,CAAE,GAAG,KAAKA,GAAU,MAAO,KAAKA,GAAS,MAAQ,EAAG,KAAM,CAAM,EAChF,KAAKK,GAAU,EAAY,CAAK,CAClC,CAAC,CACH,CAUA,KAAMH,GACJ,EACA,EACA,EACY,CACZ,IAAM,EACJ,IAAa,IAAA,GACT,IAAA,GACA,eAAiB,CACf,KAAKG,GACH,EACA,IAAI,EACF,kBAAkB,EAAS,UAAU,mBAAmB,EAAS,GAAG,IACtE,CACF,CACF,EAAG,EAAS,EAAE,EACpB,GAAI,CACF,OAAO,MAAM,QAAQ,KAAK,CACxB,EAAK,MAAO,GAAmB,CAC7B,IAAM,EAAU,EAAY,CAAK,EAAI,EAAc,CAAK,EAAK,EAG7D,MAAM,GAAe,CAAO,EACxB,IAAI,EAAuB,EAAQ,QAAS,CAAE,MAAO,CAAQ,CAAC,EAC9D,CACN,CAAC,EACD,EAAW,MACb,CAAC,CACH,QAAU,CACJ,IAAU,IAAA,IACZ,aAAa,CAAK,CAEtB,CACF,CAQA,GAAU,EAA0C,EAAqC,CACnF,IAAe,IAAA,KAGf,KAAKd,KAAgB,IACvB,KAAKA,GAAc,IAAA,IAErB,EAAW,QAAQ,UAAU,EAC7B,EAAW,OAAS,IAAA,GACpB,EAAW,IAAM,IAAA,GACjB,EAAW,YAAc,IAAA,GACzB,EAAW,KAAK,CAAK,EACvB,CAEA,KAAMQ,GACJ,EACA,EACgC,CAChC,IAAM,EAAS,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EACpE,GAAI,KAAKV,GAAQ,OAEf,MADA,KAAKgB,GAAU,EAAY,IAAI,EAAuB,6BAA6B,CAAC,EAC9E,IAAI,EACR,oEAAoE,IACpE,CAAE,OAAM,CACV,EAEF,GAAM,CAAE,YAAW,WAAY,KAAKK,GAAiB,CAAK,EAI1D,GAHA,KAAKZ,KAAkB,CAAC,EACxB,KAAKO,GAAU,EAAY,IAAI,EAAuB,oCAAoC,CAAC,EAC3F,KAAKM,GAAc,EAAQ,EAAW,CAAO,EACzC,KAAKd,KAAoB,IAAA,GAAW,CAGtC,IAAM,GAA2C,SAAY,CAC3D,IAAM,EAAS,KAAKR,GAAQ,mBAAmB,EAE/C,OADA,MAAM,EAAO,KAAK,EACX,CACT,EAAA,CAAG,CAAC,CAAC,MAAO,GAAmB,CAO7B,MANI,KAAKQ,KAAoB,IAC3B,KAAKA,GAAkB,IAAA,IAEzB,KAAKR,GAAQ,OAAO,WAClB,iDAAiD,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,GACxG,EACM,CACR,CAAC,EACD,KAAKQ,GAAkB,CACzB,CACA,OAAO,KAAKA,EACd,CAQA,GAAiB,EAA4E,CAC3F,IAAM,EACJ,aAAiB,GACjB,EAAM,SACN,KAAKG,GAAS,MAAQ,EACxB,MAAO,CAAE,YAAW,QAAS,CAAC,GAAa,CAAC,KAAKF,EAAc,CACjE,CAGA,GAAc,EAAgB,EAAoB,EAAwB,CACxE,GAAI,CAAC,GAAW,KAAKE,GAAS,YAAc,KAAKA,GAAS,MACxD,OAEF,KAAKA,GAAW,CAAE,GAAG,KAAKA,GAAU,UAAW,KAAKA,GAAS,KAAM,EACnE,IAAM,EAAQ,EAAY,kCAAoC,wBAG9D,KAAKX,GAAQ,OAAO,WAClB,gCAAmC,EAAM,0BAA0B,GACrE,CACF,CACF,ECrkBa,GAAb,KAAgD,CAC9C,GACA,GACA,GACA,GACA,GACA,GAOA,YAAY,EAA4B,CACtC,KAAKuB,GAAS,EAAO,MACrB,GAAM,CAAE,UAAS,QAAO,gBAAe,iBAAgB,oBACrD,EAAO,SAAW,CAAC,EACf,EAAO,KAAKA,GAAO,KAAO,GAAY,KAAKA,GAAO,IAAI,EAAI,IAAA,GAK1D,EAAS,CACb,aAAc,EAAmB,CAAE,UAJnC,OAAO,KAAKA,GAAO,SAAY,SAC3B,EAAK,KAAKA,GAAO,OAAO,EACxB,EAAO,KAAKA,GAAO,OAAO,CAEe,CAAC,EAC9C,MAAO,GAAa,KAAKA,EAAM,EAC/B,QAAS,CAAE,gBAAe,iBAAgB,kBAAiB,CAC7D,EACA,KAAKI,GAAkB,CACrB,GAAI,IAAS,IAAA,IAAa,CAAE,MAAK,EACjC,GAAI,IAAY,IAAA,IAAa,CAAE,SAAQ,EACvC,GAAI,IAAU,IAAA,IAAa,CAAE,OAAM,CACrC,EAIA,IAAM,MACJ,KAAKH,GAAM,2BAA2B,CAAE,QAAS,KAAKG,EAAgB,CAAC,EAGnE,EAAkB,IAAsD,CAC5E,KAAM,SAAY,CAChB,MAAM,EAAY,EAClB,MAAM,EAAO,KAAK,CACpB,EACA,aAAe,GAAe,EAAO,aAAa,CAAU,EAC5D,cAAgB,GAAe,EAAO,cAAc,CAAU,EAC9D,2BAA6B,GAAe,EAAO,2BAA2B,CAAU,CAC1F,GACI,EAAO,WACT,KAAKH,GAAQ,EAA+B,CAAM,EAClD,KAAKC,GAAW,EAAkC,CAAM,EACxD,KAAKC,GAAW,EAAe,EAAkC,CAAM,CAAC,IAExE,KAAKF,GAAQ,GAAsB,CAAM,EACzC,KAAKC,GAAW,EAAyB,CAAM,EAC/C,KAAKC,GAAW,KAAKE,GAAqB,EAAQ,EAAQ,CACxD,cACA,uBAA0B,EAAe,GAAyB,CAAM,CAAC,CAC3E,CAAC,EAEL,CAMA,GACE,EACA,EACA,EAIqB,CACrB,IAAM,EAAU,EAAO,gBAAkB,GACnC,EAAS,IAAY,GACrB,EACJ,OAAO,QAAW,aACjB,EAAO,gBAAkB,IAAA,IAAA,IAK5B,GAAI,IAAY,IAAS,EAAE,GAAU,GACnC,OAAO,EAAO,mBAAmB,EAEnC,IAAM,EAAU,EAAsB,EAChC,EAAU,GAAsB,CAAO,EAC7C,GAAI,IAAY,IAAA,IAAa,CAAC,EAI5B,OADA,EAAO,OAAO,WAAW,0CAA0C,EAAQ,EAAE,EACtE,EAAO,mBAAmB,EAEnC,IAAM,EAAe,IAAI,GAAoB,CAC3C,YAAa,CAAE,MAAO,EAAO,MAAO,cAAe,EAAO,QAAS,QAAS,GAAW,CAAC,CAAE,EAC1F,QAAS,KAAKL,GAAO,QACrB,YAAa,EAAO,YACpB,mBAAoB,EAAO,mBAC3B,OAAQ,EAAO,OACf,SAAU,EAAO,iBAAmB,EACpC,aAAc,EAAO,cAGrB,cAAe,EACf,QACF,CAAC,EACD,MAAO,CACL,SAAY,EAAa,KAAK,EAC9B,aAAe,GAAe,EAAa,aAAa,CAAU,EAClE,cAAgB,GAAe,EAAa,cAAc,CAAU,EAIpE,2BAA6B,GAAe,KAAKC,GAAM,2BAA2B,CAAU,EAC5F,YAAe,EAAa,QAAQ,CACtC,CACF,CAGA,IAAI,OAAQ,CACV,OAAO,KAAKD,EACd,CAIA,QACE,KAAKM,KAAwB,KAAKH,GAAS,KAAK,CAAC,CAAC,MAAO,GAAmB,CAE1E,KADA,MAAKG,GAAsB,IAAA,GACrB,CACR,CAAC,EACM,KAAKA,IAOd,YAAsB,CACpB,KAAKA,GAAsB,IAAA,GAC3B,KAAKH,GAAS,UAAU,CAC1B,EAcA,mBAAwD,KAAO,KAC7D,MAAM,KAAKF,GAAM,KAAK,EACf,KAAKA,GAAM,mBAAmB,CACnC,GAAG,EACH,QAAS,CAAE,GAAG,KAAKG,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAeH,oBAA0D,KAAO,KAC/D,MAAM,KAAKH,GAAM,KAAK,EACf,KAAKA,GAAM,oBAAoB,CACpC,GAAG,EACH,QAAS,CAAE,GAAG,KAAKG,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAeH,kCAAsF,KACpF,KAEA,MAAM,KAAKH,GAAM,KAAK,EACf,KAAKA,GAAM,kCAAkC,CAClD,GAAG,EACH,QAAS,CAAE,GAAG,KAAKG,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAkBH,aAA4C,KAAO,KACjD,MAAM,KAAKG,GAAa,EACjB,KAAKJ,GAAS,aAAa,CAChC,GAAG,EACH,QAAS,CAAE,GAAG,KAAKC,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAoBH,cAA8C,KAAO,KACnD,MAAM,KAAKG,GAAa,EACjB,KAAKJ,GAAS,cAAc,CACjC,GAAG,EACH,QAAS,CAAE,GAAG,KAAKC,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAoBH,aAA4C,KAAO,KACjD,MAAM,KAAKF,GAAS,KAAK,EAClB,KAAKA,GAAS,aAAa,CAChC,GAAG,EACH,QAAS,CAAE,GAAG,KAAKE,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAkBH,cAA8C,KAAO,KACnD,MAAM,KAAKF,GAAS,KAAK,EAClB,KAAKA,GAAS,cAAc,CACjC,GAAG,EACH,QAAS,CAAE,GAAG,KAAKE,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAoBH,uBAAgE,KAAO,KACrE,MAAM,KAAKF,GAAS,KAAK,EAClB,KAAKA,GAAS,uBAAuB,CAC1C,GAAG,EACH,QAAS,CAAE,GAAG,KAAKE,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAcH,2BAAwE,KAAO,KAI7E,MAAM,KAAKH,GAAM,KAAK,EACf,KAAKA,GAAM,2BAA2B,CAC3C,GAAG,EACH,QAAS,CAAE,GAAG,KAAKG,GAAiB,GAAG,GAAY,OAAQ,CAC7D,CAAC,GAwBH,qBAA4D,KAAO,KACjE,MAAM,KAAKH,GAAM,KAAK,EACf,KAAKA,GAAM,qBAAqB,CAAU,GAuBnD,2CACG,GAAeO,EAAiD,KAAKP,GAAO,CAAU,EAkBzF,0BAAuE,GACrE,KAAKC,GAAS,0BAA0B,CAAU,EAapD,gCAAmF,GACjF,KAAKD,GAAM,gCAAgC,CAAU,EAcvD,sBAA8D,KAAO,KACnE,MAAM,KAAKC,GAAS,KAAK,EAClB,KAAKA,GAAS,sBAAsB,CAAU,GAmBvD,4BAA0E,KAAO,IAAe,CAC9F,MAAM,KAAKD,GAAM,KAAK,EACtB,GAAM,CAAE,oBAAqB,EAC7B,OAAO,KAAKA,GAAM,4BAA4B,CAC5C,GAAG,EACH,iBAAkB,CAChB,GAAG,EACH,UAAW,GAAoB,EAAiB,SAAS,CAC3D,CACF,CAAC,CACH,EAaA,yBAAoE,UAClE,MAAM,KAAKC,GAAS,KAAK,EAClB,KAAKA,GAAS,yBAAyB,EAElD,EAOA,SAAS,GAAoB,EAA2B,CACtD,GAAI,EAAU,SAAW,IACvB,OAAO,EAET,IAAM,EAAI,SAAS,EAAU,MAAM,GAAG,EAAG,EAAE,EAI3C,OAHI,IAAM,GAAK,IAAM,EACZ,EAEF,GAAG,EAAU,MAAM,EAAG,GAAG,IAAI,IAAM,EAAI,KAAO,MACvD,CAMA,SAAS,GAAsB,EAA4D,CAGzF,GAAI,EAAqB,EACvB,MAAO,gEAIT,GAAI,IAAY,IAAA,IAAa,EAAsB,EACjD,MAAO,4FAGX,CAQA,SAAS,GACP,EAC0C,CAC1C,IAAM,EAAO,EAAK,OAClB,OAAQ,EAAR,CACE,IAAK,eACH,MAAO,CAAE,OAAM,MAAO,EAAK,MAAO,OAAQ,EAAK,MAAO,EACxD,IAAK,eACH,MAAO,CAAE,OAAM,MAAO,EAAK,MAAO,OAAQ,EAAK,MAAO,EACxD,IAAK,cACH,MAAO,CAAE,OAAM,MAAO,EAAK,KAAM,EACnC,QACE,MAAM,IAAI,EAAmB,sBAAsB,OAAO,CAAI,GAAG,CACrE,CACF"}
+{"version":3,"file":"fhevm-relayer-Y5XYNOcs.js","names":["#config","#progressListeners","#generation","#withActive","#initOnce","#dispatch","#releaseRequested","#releaseIfIdle","#degradePromise","#pinnedInline","#degrade","#crashes","#sequence","#overBoundary","#spawn","#warnCallbackThrew","#teardown","#active","#createWorker","#raceReady","#armCrashHandler","#classifyDegrade","#warnDegraded","#chain","#base","#decrypt","#encrypt","#defaultOptions","#buildEncryptBackend","#encryptInitPromise","#initEncrypt","createUnsignedLegacyDecryptionPermitEip712Action"],"sources":["../../src/chains/to-fhevm-chain.ts","../../../../node_modules/.pnpm/comlink@4.4.2/node_modules/comlink/dist/esm/comlink.mjs","../../src/worker/protocol.ts","../../src/worker/spawn.ts","../../src/worker/encrypt-worker-client.ts","../../src/relayer/fhevm-relayer.ts"],"sourcesContent":["import type { FhevmChain } from \"@fhevm/sdk/chains\";\nimport type { FheChain } from \"./types\";\n\n/**\n * Derive an `@fhevm/sdk` {@link FhevmChain} from zama-sdk's richer\n * {@link FheChain}.\n *\n * `FheChain` carries fields `@fhevm/sdk` does not model (RPC `network`,\n * `registryAddress`, `executorAddress`, cleartext signer keys); those stay on\n * `FheChain` for the token layer. This adapter projects only the subset the\n * FHE runtime needs: contract addresses, relayer URL, and gateway.\n */\nexport function toFhevmChain(chain: FheChain): FhevmChain {\n  return {\n    id: chain.id,\n    fhevm: {\n      contracts: {\n        acl: { address: chain.aclContractAddress },\n        inputVerifier: { address: chain.inputVerifierContractAddress },\n        kmsVerifier: { address: chain.kmsContractAddress },\n        protocolConfig: undefined,\n      },\n      relayerUrl: chain.relayerUrl,\n      gateway: {\n        id: chain.gatewayChainId,\n        contracts: {\n          decryption: { address: chain.verifyingContractAddressDecryption },\n          inputVerification: { address: chain.verifyingContractAddressInputVerification },\n        },\n      },\n    },\n  } satisfies FhevmChain;\n}\n","/**\n * @license\n * Copyright 2019 Google LLC\n * SPDX-License-Identifier: Apache-2.0\n */\nconst proxyMarker = Symbol(\"Comlink.proxy\");\nconst createEndpoint = Symbol(\"Comlink.endpoint\");\nconst releaseProxy = Symbol(\"Comlink.releaseProxy\");\nconst finalizer = Symbol(\"Comlink.finalizer\");\nconst throwMarker = Symbol(\"Comlink.thrown\");\nconst isObject = (val) => (typeof val === \"object\" && val !== null) || typeof val === \"function\";\n/**\n * Internal transfer handle to handle objects marked to proxy.\n */\nconst proxyTransferHandler = {\n    canHandle: (val) => isObject(val) && val[proxyMarker],\n    serialize(obj) {\n        const { port1, port2 } = new MessageChannel();\n        expose(obj, port1);\n        return [port2, [port2]];\n    },\n    deserialize(port) {\n        port.start();\n        return wrap(port);\n    },\n};\n/**\n * Internal transfer handler to handle thrown exceptions.\n */\nconst throwTransferHandler = {\n    canHandle: (value) => isObject(value) && throwMarker in value,\n    serialize({ value }) {\n        let serialized;\n        if (value instanceof Error) {\n            serialized = {\n                isError: true,\n                value: {\n                    message: value.message,\n                    name: value.name,\n                    stack: value.stack,\n                },\n            };\n        }\n        else {\n            serialized = { isError: false, value };\n        }\n        return [serialized, []];\n    },\n    deserialize(serialized) {\n        if (serialized.isError) {\n            throw Object.assign(new Error(serialized.value.message), serialized.value);\n        }\n        throw serialized.value;\n    },\n};\n/**\n * Allows customizing the serialization of certain values.\n */\nconst transferHandlers = new Map([\n    [\"proxy\", proxyTransferHandler],\n    [\"throw\", throwTransferHandler],\n]);\nfunction isAllowedOrigin(allowedOrigins, origin) {\n    for (const allowedOrigin of allowedOrigins) {\n        if (origin === allowedOrigin || allowedOrigin === \"*\") {\n            return true;\n        }\n        if (allowedOrigin instanceof RegExp && allowedOrigin.test(origin)) {\n            return true;\n        }\n    }\n    return false;\n}\nfunction expose(obj, ep = globalThis, allowedOrigins = [\"*\"]) {\n    ep.addEventListener(\"message\", function callback(ev) {\n        if (!ev || !ev.data) {\n            return;\n        }\n        if (!isAllowedOrigin(allowedOrigins, ev.origin)) {\n            console.warn(`Invalid origin '${ev.origin}' for comlink proxy`);\n            return;\n        }\n        const { id, type, path } = Object.assign({ path: [] }, ev.data);\n        const argumentList = (ev.data.argumentList || []).map(fromWireValue);\n        let returnValue;\n        try {\n            const parent = path.slice(0, -1).reduce((obj, prop) => obj[prop], obj);\n            const rawValue = path.reduce((obj, prop) => obj[prop], obj);\n            switch (type) {\n                case \"GET\" /* MessageType.GET */:\n                    {\n                        returnValue = rawValue;\n                    }\n                    break;\n                case \"SET\" /* MessageType.SET */:\n                    {\n                        parent[path.slice(-1)[0]] = fromWireValue(ev.data.value);\n                        returnValue = true;\n                    }\n                    break;\n                case \"APPLY\" /* MessageType.APPLY */:\n                    {\n                        returnValue = rawValue.apply(parent, argumentList);\n                    }\n                    break;\n                case \"CONSTRUCT\" /* MessageType.CONSTRUCT */:\n                    {\n                        const value = new rawValue(...argumentList);\n                        returnValue = proxy(value);\n                    }\n                    break;\n                case \"ENDPOINT\" /* MessageType.ENDPOINT */:\n                    {\n                        const { port1, port2 } = new MessageChannel();\n                        expose(obj, port2);\n                        returnValue = transfer(port1, [port1]);\n                    }\n                    break;\n                case \"RELEASE\" /* MessageType.RELEASE */:\n                    {\n                        returnValue = undefined;\n                    }\n                    break;\n                default:\n                    return;\n            }\n        }\n        catch (value) {\n            returnValue = { value, [throwMarker]: 0 };\n        }\n        Promise.resolve(returnValue)\n            .catch((value) => {\n            return { value, [throwMarker]: 0 };\n        })\n            .then((returnValue) => {\n            const [wireValue, transferables] = toWireValue(returnValue);\n            ep.postMessage(Object.assign(Object.assign({}, wireValue), { id }), transferables);\n            if (type === \"RELEASE\" /* MessageType.RELEASE */) {\n                // detach and deactive after sending release response above.\n                ep.removeEventListener(\"message\", callback);\n                closeEndPoint(ep);\n                if (finalizer in obj && typeof obj[finalizer] === \"function\") {\n                    obj[finalizer]();\n                }\n            }\n        })\n            .catch((error) => {\n            // Send Serialization Error To Caller\n            const [wireValue, transferables] = toWireValue({\n                value: new TypeError(\"Unserializable return value\"),\n                [throwMarker]: 0,\n            });\n            ep.postMessage(Object.assign(Object.assign({}, wireValue), { id }), transferables);\n        });\n    });\n    if (ep.start) {\n        ep.start();\n    }\n}\nfunction isMessagePort(endpoint) {\n    return endpoint.constructor.name === \"MessagePort\";\n}\nfunction closeEndPoint(endpoint) {\n    if (isMessagePort(endpoint))\n        endpoint.close();\n}\nfunction wrap(ep, target) {\n    const pendingListeners = new Map();\n    ep.addEventListener(\"message\", function handleMessage(ev) {\n        const { data } = ev;\n        if (!data || !data.id) {\n            return;\n        }\n        const resolver = pendingListeners.get(data.id);\n        if (!resolver) {\n            return;\n        }\n        try {\n            resolver(data);\n        }\n        finally {\n            pendingListeners.delete(data.id);\n        }\n    });\n    return createProxy(ep, pendingListeners, [], target);\n}\nfunction throwIfProxyReleased(isReleased) {\n    if (isReleased) {\n        throw new Error(\"Proxy has been released and is not useable\");\n    }\n}\nfunction releaseEndpoint(ep) {\n    return requestResponseMessage(ep, new Map(), {\n        type: \"RELEASE\" /* MessageType.RELEASE */,\n    }).then(() => {\n        closeEndPoint(ep);\n    });\n}\nconst proxyCounter = new WeakMap();\nconst proxyFinalizers = \"FinalizationRegistry\" in globalThis &&\n    new FinalizationRegistry((ep) => {\n        const newCount = (proxyCounter.get(ep) || 0) - 1;\n        proxyCounter.set(ep, newCount);\n        if (newCount === 0) {\n            releaseEndpoint(ep);\n        }\n    });\nfunction registerProxy(proxy, ep) {\n    const newCount = (proxyCounter.get(ep) || 0) + 1;\n    proxyCounter.set(ep, newCount);\n    if (proxyFinalizers) {\n        proxyFinalizers.register(proxy, ep, proxy);\n    }\n}\nfunction unregisterProxy(proxy) {\n    if (proxyFinalizers) {\n        proxyFinalizers.unregister(proxy);\n    }\n}\nfunction createProxy(ep, pendingListeners, path = [], target = function () { }) {\n    let isProxyReleased = false;\n    const proxy = new Proxy(target, {\n        get(_target, prop) {\n            throwIfProxyReleased(isProxyReleased);\n            if (prop === releaseProxy) {\n                return () => {\n                    unregisterProxy(proxy);\n                    releaseEndpoint(ep);\n                    pendingListeners.clear();\n                    isProxyReleased = true;\n                };\n            }\n            if (prop === \"then\") {\n                if (path.length === 0) {\n                    return { then: () => proxy };\n                }\n                const r = requestResponseMessage(ep, pendingListeners, {\n                    type: \"GET\" /* MessageType.GET */,\n                    path: path.map((p) => p.toString()),\n                }).then(fromWireValue);\n                return r.then.bind(r);\n            }\n            return createProxy(ep, pendingListeners, [...path, prop]);\n        },\n        set(_target, prop, rawValue) {\n            throwIfProxyReleased(isProxyReleased);\n            // FIXME: ES6 Proxy Handler `set` methods are supposed to return a\n            // boolean. To show good will, we return true asynchronously ¯\\_(ツ)_/¯\n            const [value, transferables] = toWireValue(rawValue);\n            return requestResponseMessage(ep, pendingListeners, {\n                type: \"SET\" /* MessageType.SET */,\n                path: [...path, prop].map((p) => p.toString()),\n                value,\n            }, transferables).then(fromWireValue);\n        },\n        apply(_target, _thisArg, rawArgumentList) {\n            throwIfProxyReleased(isProxyReleased);\n            const last = path[path.length - 1];\n            if (last === createEndpoint) {\n                return requestResponseMessage(ep, pendingListeners, {\n                    type: \"ENDPOINT\" /* MessageType.ENDPOINT */,\n                }).then(fromWireValue);\n            }\n            // We just pretend that `bind()` didn’t happen.\n            if (last === \"bind\") {\n                return createProxy(ep, pendingListeners, path.slice(0, -1));\n            }\n            const [argumentList, transferables] = processArguments(rawArgumentList);\n            return requestResponseMessage(ep, pendingListeners, {\n                type: \"APPLY\" /* MessageType.APPLY */,\n                path: path.map((p) => p.toString()),\n                argumentList,\n            }, transferables).then(fromWireValue);\n        },\n        construct(_target, rawArgumentList) {\n            throwIfProxyReleased(isProxyReleased);\n            const [argumentList, transferables] = processArguments(rawArgumentList);\n            return requestResponseMessage(ep, pendingListeners, {\n                type: \"CONSTRUCT\" /* MessageType.CONSTRUCT */,\n                path: path.map((p) => p.toString()),\n                argumentList,\n            }, transferables).then(fromWireValue);\n        },\n    });\n    registerProxy(proxy, ep);\n    return proxy;\n}\nfunction myFlat(arr) {\n    return Array.prototype.concat.apply([], arr);\n}\nfunction processArguments(argumentList) {\n    const processed = argumentList.map(toWireValue);\n    return [processed.map((v) => v[0]), myFlat(processed.map((v) => v[1]))];\n}\nconst transferCache = new WeakMap();\nfunction transfer(obj, transfers) {\n    transferCache.set(obj, transfers);\n    return obj;\n}\nfunction proxy(obj) {\n    return Object.assign(obj, { [proxyMarker]: true });\n}\nfunction windowEndpoint(w, context = globalThis, targetOrigin = \"*\") {\n    return {\n        postMessage: (msg, transferables) => w.postMessage(msg, targetOrigin, transferables),\n        addEventListener: context.addEventListener.bind(context),\n        removeEventListener: context.removeEventListener.bind(context),\n    };\n}\nfunction toWireValue(value) {\n    for (const [name, handler] of transferHandlers) {\n        if (handler.canHandle(value)) {\n            const [serializedValue, transferables] = handler.serialize(value);\n            return [\n                {\n                    type: \"HANDLER\" /* WireValueType.HANDLER */,\n                    name,\n                    value: serializedValue,\n                },\n                transferables,\n            ];\n        }\n    }\n    return [\n        {\n            type: \"RAW\" /* WireValueType.RAW */,\n            value,\n        },\n        transferCache.get(value) || [],\n    ];\n}\nfunction fromWireValue(value) {\n    switch (value.type) {\n        case \"HANDLER\" /* WireValueType.HANDLER */:\n            return transferHandlers.get(value.name).deserialize(value.value);\n        case \"RAW\" /* WireValueType.RAW */:\n            return value.value;\n    }\n}\nfunction requestResponseMessage(ep, pendingListeners, msg, transfers) {\n    return new Promise((resolve) => {\n        const id = generateUUID();\n        pendingListeners.set(id, resolve);\n        if (ep.start) {\n            ep.start();\n        }\n        ep.postMessage(Object.assign({ id }, msg), transfers);\n    });\n}\nfunction generateUUID() {\n    return new Array(4)\n        .fill(0)\n        .map(() => Math.floor(Math.random() * Number.MAX_SAFE_INTEGER).toString(16))\n        .join(\"-\");\n}\n\nexport { createEndpoint, expose, finalizer, proxy, proxyMarker, releaseProxy, transfer, transferHandlers, windowEndpoint, wrap };\n//# sourceMappingURL=comlink.mjs.map\n","/**\n * Shared contract between the main-thread encrypt client and the encrypt\n * worker, spoken over Comlink. Every payload must survive `structuredClone`:\n * no `AbortSignal`, no class instances; callbacks cross as Comlink proxies.\n */\n\nimport type { FhevmChain } from \"@fhevm/sdk/chains\";\nimport type {\n  FhevmClientOptions,\n  FhevmEncryptBackend,\n  FhevmRelayerOptions,\n  WireRuntimeConfig,\n} from \"../relayer/types\";\nimport { isValidRetryAfterSeconds, readRetryAfterHeader } from \"../utils/error\";\n\ntype EncryptParameters = Parameters<FhevmEncryptBackend[\"encryptValue\"]>[0];\ntype EncryptsParameters = Parameters<FhevmEncryptBackend[\"encryptValues\"]>[0];\n\n/**\n * What the worker offloads, and all the encrypt client's surface the worker\n * client implements. Key fetches stay on the calling thread, where the chain's\n * auth applies and the key never crosses back out.\n */\nexport type EncryptOffloadBackend = Pick<\n  FhevmEncryptBackend,\n  \"init\" | \"encryptValue\" | \"encryptValues\"\n>;\n\n/** Per-request options minus `signal`, the one non-cloneable member of the set. */\nexport type WireRequestOptions = Omit<FhevmRelayerOptions, \"signal\">;\n\nexport type WireProgressEvent = Parameters<\n  NonNullable<NonNullable<EncryptParameters[\"options\"]>[\"onProgress\"]>\n>[0];\n\nexport type WireInitPayload = {\n  readonly chain: FhevmChain;\n  /** RPC URL for host-chain reads; absent when reads proxy through `rpcRequest`. */\n  readonly rpcUrl: string | undefined;\n  /** Carries `fheEncryptionKey`, prefetched on the main thread so the worker skips the download. */\n  readonly clientOptions: FhevmClientOptions;\n  readonly runtime: WireRuntimeConfig;\n};\n\n/** Main-thread callback the worker uses for host-chain reads when the chain's network is an injected provider. */\nexport type WireRpcRequest = (args: { method: string; params?: unknown }) => Promise<unknown>;\n\n/**\n * Main-thread callback receiving every operation's progress events, routed on\n * `id`. One channel per worker avoids minting a `MessageChannel` per call, whose\n * local port and listener would linger until garbage collection after terminate.\n * Returns `unknown`: a Comlink proxy call answers with a promise.\n */\nexport type WireProgressCallback = (id: number, event: WireProgressEvent) => unknown;\n\nexport type WireLogCallback = (level: \"debug\" | \"warn\" | \"error\", message: string) => unknown;\n\n/**\n * The API the worker exposes over Comlink. `id` correlates an in-flight\n * operation with `abort` and with its progress events, since neither an\n * `AbortSignal` nor a per-call callback can cross the boundary cheaply. The\n * `init` callback parameters must be passed as Comlink proxies (or `null`).\n */\nexport type EncryptWorkerApi = {\n  init(\n    payload: WireInitPayload,\n    rpcRequest: WireRpcRequest | null,\n    log: WireLogCallback,\n    onProgress: WireProgressCallback,\n  ): Promise<void>;\n  encryptValue(\n    id: number,\n    parameters: {\n      readonly value: EncryptParameters[\"value\"];\n      readonly contractAddress: string;\n      readonly userAddress: string;\n      readonly options: WireRequestOptions | undefined;\n    },\n  ): ReturnType<FhevmEncryptBackend[\"encryptValue\"]>;\n  encryptValues(\n    id: number,\n    parameters: {\n      readonly values: EncryptsParameters[\"values\"];\n      readonly contractAddress: string;\n      readonly userAddress: string;\n      readonly options: WireRequestOptions | undefined;\n    },\n  ): ReturnType<FhevmEncryptBackend[\"encryptValues\"]>;\n  abort(id: number): void;\n};\n\n/** Raw message the worker posts once its module graph has loaded, before Comlink traffic. */\nexport const WORKER_READY_MESSAGE = \"zama-encrypt-worker-ready\";\n\n/**\n * An `Error` flattened for the boundary crossing, thrown by the worker as a\n * plain object so it survives structured clone intact. `props` carries the\n * fields the SDK's duck-typed classifiers read (`statusCode`, `retryAfter`,\n * `code`, …); a cloned `Error` instance would drop them with the prototype.\n * Reading them through the prototype chain is deliberate: upstream's `status`\n * and `relayerApiError` are prototype getters, not own fields.\n */\nexport type WireError = {\n  readonly wireError: true;\n  readonly name: string;\n  readonly message: string;\n  readonly stack: string | undefined;\n  readonly props: Record<string, unknown>;\n  readonly cause: WireError | undefined;\n};\n\nexport function isWireError(value: unknown): value is WireError {\n  // Exact `true`, not presence: an `Error` subclass carrying the key must not be\n  // rehydrated as a flattened one.\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    (value as { wireError?: unknown }).wireError === true\n  );\n}\n\n/**\n * Fields preserved across the boundary: what the error classifiers read off\n * `@fhevm/sdk`, relayer, and JSON-RPC errors, plus the `error`/`info` nesting\n * keys those classifiers walk alongside `cause`.\n */\nconst WIRE_ERROR_PROPS = [\n  \"statusCode\",\n  \"status\",\n  \"retryAfter\",\n  \"timeoutMs\",\n  \"relayerApiError\",\n  \"code\",\n  \"data\",\n  \"shortMessage\",\n  \"details\",\n  \"error\",\n  \"info\",\n] as const;\n\nconst MAX_CAUSE_DEPTH = 6;\n\n/** A probe is exact where a structural walk only approximates. */\nfunction isCloneSafe(value: unknown): boolean {\n  try {\n    structuredClone(value);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The `Retry-After` header survives as a plain number of seconds; the\n * `Response` object it lives on cannot cross the boundary.\n */\nfunction retryAfterFromResponse(error: object): number | undefined {\n  const response = (error as { response?: { headers?: unknown } }).response;\n  return readRetryAfterHeader(response?.headers);\n}\n\n/**\n * `JSON.stringify` throws instead of returning `undefined` on a bigint or a\n * circular value; a non-Error thrown value must never fail error handling itself.\n */\nfunction stringifyNonError(error: unknown): string {\n  try {\n    return JSON.stringify(error) ?? String(error);\n  } catch {\n    return String(error);\n  }\n}\n\n/** The classifier fields readable off one thrown value, `Error` or plain object alike. */\nfunction extractWireProps(source: object): Record<string, unknown> {\n  const props: Record<string, unknown> = {};\n  for (const key of WIRE_ERROR_PROPS) {\n    const value = (source as Record<string, unknown>)[key];\n    if (value !== undefined && isCloneSafe(value)) {\n      props[key] = value;\n    }\n  }\n  // The header wins over a malformed own delay (`0`, negative, `NaN`), as the\n  // inline extractor in `utils/error.ts` decides it.\n  if (!isValidRetryAfterSeconds(props[\"retryAfter\"])) {\n    const fromHeader = retryAfterFromResponse(source);\n    if (fromHeader !== undefined) {\n      props[\"retryAfter\"] = fromHeader;\n    }\n  }\n  return props;\n}\n\nexport function toWireError(error: unknown, depth: number = MAX_CAUSE_DEPTH): WireError {\n  if (isWireError(error)) {\n    return error;\n  }\n  const nest = (cause: unknown): WireError | undefined =>\n    depth > 0 && cause !== undefined ? toWireError(cause, depth - 1) : undefined;\n  if (error instanceof Error) {\n    return {\n      wireError: true,\n      name: error.name,\n      message: error.message,\n      stack: error.stack,\n      props: extractWireProps(error),\n      cause: nest(error.cause),\n    };\n  }\n  if (typeof error === \"object\" && error !== null) {\n    // Wallets reject with a plain `{ code, message, data }`; dropping `code`\n    // would break viem's classification inside the worker.\n    const { message, cause } = error as { message?: unknown; cause?: unknown };\n    return {\n      wireError: true,\n      name: \"Error\",\n      message: typeof message === \"string\" ? message : stringifyNonError(error),\n      stack: undefined,\n      props: extractWireProps(error),\n      cause: nest(cause),\n    };\n  }\n  return {\n    wireError: true,\n    name: \"Error\",\n    message: typeof error === \"string\" ? error : stringifyNonError(error),\n    stack: undefined,\n    props: {},\n    cause: undefined,\n  };\n}\n\n/**\n * Rebuilds a plain `Error` carrying the original `name`, own fields, and cause\n * chain, so name-based classification and status/retry-after extraction behave\n * as if the error had been thrown on this thread.\n */\nexport function fromWireError(wire: WireError): Error {\n  const error = new Error(wire.message, wire.cause ? { cause: fromWireError(wire.cause) } : {});\n  error.name = wire.name;\n  if (wire.stack !== undefined) {\n    error.stack = wire.stack;\n  }\n  Object.assign(error, wire.props);\n  return error;\n}\n","/** Isolated so the CJS build can replace worker construction with an inert stub. */\n\n/** False in the CJS stub, which ships no worker chunk; a caller-supplied `offloadWorker` source works in either build. */\nexport const BUNDLED_ENCRYPT_WORKER = true;\n\nexport function createEncryptWorker(): Worker {\n  // Keep the `new Worker(new URL(...))` expression exactly in this inline\n  // form: bundlers detect it statically to emit and rewrite the worker chunk,\n  // and lose it if the URL is hoisted into a variable.\n  return new Worker(new URL(\"./encrypt.worker.js\", import.meta.url), {\n    type: \"module\",\n    name: \"zama-fhe-encrypt\",\n  });\n}\n","import { proxy, transfer, wrap, type Remote } from \"comlink\";\nimport type { EIP1193Provider } from \"viem\";\nimport { EncryptOffloadUnavailableError } from \"../errors/encryption\";\nimport type { FhevmClientOptions } from \"../relayer/types\";\nimport type { LoggerService } from \"../services/logger-service\";\nimport type {\n  EncryptOffloadBackend,\n  EncryptWorkerApi,\n  WireInitPayload,\n  WireProgressEvent,\n  WireRequestOptions,\n} from \"./protocol\";\nimport { WORKER_READY_MESSAGE, fromWireError, isWireError, toWireError } from \"./protocol\";\nimport { createEncryptWorker } from \"./spawn\";\n\n/**\n * Watchdog deadlines, in milliseconds, for worker lifecycle steps: each is a\n * ceiling on \"the worker never answered\", not on legitimate slow work. Encrypt\n * operations themselves are not watched: nothing bounds local WASM compute, so\n * a proof may run for as long as it needs.\n */\nexport type EncryptWorkerTimeouts = {\n  /** Worker startup + module-graph load; a bundler that mishandled the worker URL fails here. */\n  readonly spawn: number;\n  /** Client init inside the worker realm: chain reads and WASM compilation. */\n  readonly init: number;\n};\n\nexport const DEFAULT_ENCRYPT_WORKER_TIMEOUTS: EncryptWorkerTimeouts = {\n  spawn: 10_000,\n  init: 300_000,\n};\n\n/** Second crash pins the client to the calling thread. */\nconst CRASH_PIN_THRESHOLD = 2;\n\n/** Stable prefix of every degrade warning. */\nexport const ENCRYPT_OFFLOAD_WARN_PREFIX = \"Encrypt offload unavailable\";\n\n/** Workers already returned by an `offloadWorker` factory, to catch a factory that hands out one worker forever. */\nconst handedOutWorkers = new WeakSet<Worker>();\n\n/** Internal signal: the worker infrastructure failed; the operation itself was not rejected. */\nclass WorkerUnavailableError extends Error {\n  /** True when a worker that had already signalled ready died under us, so a respawn is worth trying. */\n  readonly crashed: boolean;\n\n  constructor(message: string, options?: ErrorOptions & { readonly crashed?: boolean }) {\n    super(message, options);\n    this.name = \"WorkerUnavailableError\";\n    this.crashed = options?.crashed ?? false;\n  }\n}\n\n/**\n * A payload Comlink could not clone into the worker (`DataCloneError`) or could\n * not return out of it (its own `TypeError`): a boundary failure, so it degrades\n * rather than reaching the caller as an application error.\n */\nfunction isCloneFailure(error: unknown): boolean {\n  if (typeof error !== \"object\" || error === null) {\n    return false;\n  }\n  const { name, message } = error as { name?: unknown; message?: unknown };\n  return (\n    name === \"DataCloneError\" ||\n    (name === \"TypeError\" &&\n      typeof message === \"string\" &&\n      message.includes(\"Unserializable return value\"))\n  );\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted) {\n    throw signal.reason ?? new DOMException(\"The operation was aborted.\", \"AbortError\");\n  }\n}\n\n/** What the client remembers about worker crashes, dropped whole by a worker answer and by a release. */\ntype CrashHistory = {\n  readonly count: number;\n  /** The crash that killed the current worker, so a call landing after it degrades as a crash too. */\n  readonly last: WorkerUnavailableError | undefined;\n  /** Crash count the degrade warning was last emitted for, so one failure warns once. */\n  readonly warnedFor: number;\n};\n\nconst NO_CRASHES: CrashHistory = { count: 0, last: undefined, warnedFor: -1 };\n\n/**\n * The key copied for the crossing plus the buffers to transfer, so the wire copy\n * is moved instead of cloned. Anything but the known binary shape crosses\n * unchanged.\n */\nfunction keyForTransfer(key: FhevmClientOptions[\"fheEncryptionKey\"]): {\n  readonly key: FhevmClientOptions[\"fheEncryptionKey\"];\n  readonly transfers: Transferable[];\n} {\n  if (key === undefined) {\n    return { key, transfers: [] };\n  }\n  const publicKeyBytes = key.publicKeyBytes.bytes;\n  const crsBytes = key.crsBytes.bytes;\n  if (!(publicKeyBytes instanceof Uint8Array) || !(crsBytes instanceof Uint8Array)) {\n    return { key, transfers: [] };\n  }\n  // `slice` yields a fresh exactly-sized buffer, so transferring it leaves this\n  // thread's cached key intact.\n  const publicKeyCopy = publicKeyBytes.slice();\n  const crsCopy = crsBytes.slice();\n  return {\n    key: {\n      ...key,\n      publicKeyBytes: { ...key.publicKeyBytes, bytes: publicKeyCopy },\n      crsBytes: { ...key.crsBytes, bytes: crsCopy },\n    },\n    transfers: [publicKeyCopy.buffer as ArrayBuffer, crsCopy.buffer as ArrayBuffer],\n  };\n}\n\n/**\n * Per-call options: `signal` is forwarded as an `abort` call, `onProgress` is\n * served from the worker's shared progress channel, and `never` keeps the\n * callback contravariantly compatible with each operation's own event type.\n */\ntype CallOptions = WireRequestOptions & {\n  readonly signal?: AbortSignal;\n  readonly onProgress?: (args: never) => void;\n};\n\n/**\n * Everything scoped to one spawned worker, created by the init that spawns it\n * and dropped whole by a teardown. A late event carrying its own generation can\n * therefore only settle that generation, never the worker running in its place.\n */\ntype WorkerGeneration = {\n  /** Memoized bring-up for this worker; it dies with the generation, so the next call re-runs it. */\n  initPromise: Promise<void> | undefined;\n  worker: Worker | undefined;\n  api: Remote<EncryptWorkerApi> | undefined;\n  /** Never resolves; teardown rejects it, and every boundary crossing races it so all of them settle together. */\n  readonly doomed: Promise<never>;\n  /** Rejects `doomed` with the teardown's `WorkerUnavailableError`. */\n  readonly doom: (error: WorkerUnavailableError) => void;\n};\n\nfunction createWorkerGeneration(): WorkerGeneration {\n  let doom!: (error: WorkerUnavailableError) => void;\n  const doomed = new Promise<never>((_resolve, reject) => {\n    doom = reject;\n  });\n  // An idle teardown dooms a generation with no crossing racing it; this\n  // handler keeps that from surfacing as an unhandled rejection.\n  doomed.catch(() => {});\n  return { initPromise: undefined, worker: undefined, api: undefined, doomed, doom };\n}\n\nexport type EncryptWorkerClientConfig = {\n  readonly initPayload: Omit<WireInitPayload, \"rpcUrl\">;\n  /** The chain's RPC endpoint: a URL crosses into the worker; a provider is proxied per request. */\n  readonly network: EIP1193Provider | string;\n  /** Fetches the FHE key on the calling thread, where the chain's auth applies; the worker realm never downloads it itself. */\n  readonly prefetchKey: () => Promise<FhevmClientOptions[\"fheEncryptionKey\"]>;\n  readonly createInlineClient: () => EncryptOffloadBackend;\n  readonly logger: LoggerService;\n  readonly timeouts: EncryptWorkerTimeouts;\n  /** A string or `URL` is spawned with the SDK's worker options; a factory is called for the worker itself. */\n  readonly workerSource?: string | URL | (() => Worker);\n  /**\n   * A pre-known reason offload cannot work in this session: init degrades with\n   * it immediately, so strict rejects at call time rather than at config time.\n   */\n  readonly blockedReason?: string;\n  /**\n   * Strict offload (`offloadEncrypt: true`): never run encryption on the\n   * calling thread. Every path that would degrade rejects with\n   * {@link EncryptOffloadUnavailableError} instead.\n   */\n  readonly strict: boolean;\n};\n\n/**\n * Encrypt backend that runs `@fhevm/sdk` in a dedicated module worker so proof\n * generation never blocks the main thread. Only infrastructure failure degrades\n * to inline (or rejects under `strict`); worker-reported errors are rethrown,\n * since inline would fail the same way.\n */\nexport class EncryptWorkerClient implements EncryptOffloadBackend {\n  readonly #config: EncryptWorkerClientConfig;\n  /** Resources of the worker currently being brought up or served; undefined while none runs. */\n  #generation: WorkerGeneration | undefined;\n  /** True once the client runs inline for the rest of its life, with no further spawn attempts. */\n  #pinnedInline = false;\n  #crashes: CrashHistory = NO_CRASHES;\n  /** Wire ids, allocated across generations so a late reply can never be read as a live operation. */\n  #sequence = 0;\n  /** Per-operation `onProgress`, keyed by wire id and routed over one channel registered at init: one channel per worker avoids minting a `MessageChannel` per call, whose local port and listener would linger until garbage collection after terminate. */\n  readonly #progressListeners = new Map<number, (event: WireProgressEvent) => void>();\n  /** Memoized inline backend. Kept, with its key copy, across a worker recovery so a later degrade skips the refetch. */\n  #degradePromise: Promise<EncryptOffloadBackend> | undefined;\n  /** Operations that must drain before a requested release terminates the worker. */\n  #active = 0;\n  #releaseRequested = false;\n\n  constructor(config: EncryptWorkerClientConfig) {\n    this.#config = config;\n  }\n\n  init = (): Promise<void> => {\n    // A call landing mid-drain rides the worker being released rather than\n    // canceling the release: the drain still completes, and the call after it\n    // spawns a fresh worker.\n    const generation = (this.#generation ??= createWorkerGeneration());\n    if (generation.initPromise === undefined) {\n      // Only a successful cycle is memoized: a failure a retry could clear must\n      // not be replayed to every later call.\n      const attempt: Promise<void> = this.#withActive(() => this.#initOnce(generation)).catch(\n        (error: unknown) => {\n          if (generation.initPromise === attempt) {\n            generation.initPromise = undefined;\n          }\n          throw error;\n        },\n      );\n      generation.initPromise = attempt;\n    }\n    return generation.initPromise;\n  };\n\n  encryptValue: EncryptOffloadBackend[\"encryptValue\"] = (parameters) =>\n    this.#withActive(() =>\n      this.#dispatch(\n        (backend) => backend.encryptValue(parameters),\n        // Spread, so a field upstream adds to the parameters still crosses; the\n        // stripped `options` replaces the caller's, which carries `signal`.\n        (api, id, options) => api.encryptValue(id, { ...parameters, options }),\n        parameters.options,\n      ),\n    );\n\n  encryptValues: EncryptOffloadBackend[\"encryptValues\"] = (parameters) =>\n    this.#withActive(() =>\n      this.#dispatch(\n        (backend) => backend.encryptValues(parameters),\n        (api, id, options) => api.encryptValues(id, { ...parameters, options }),\n        parameters.options,\n      ),\n    );\n\n  /**\n   * Releases the worker without changing what callers observe: in-flight\n   * operations (an init included) run to completion over the worker, and the\n   * worker is terminated as soon as the last one settles, immediately if the\n   * client is idle. The client is not spent: the release resets it whole, so a\n   * later call re-fetches the key and spawns a fresh worker exactly like the\n   * first one, even if the client had degraded to the calling thread. The drain\n   * is not bounded: a worker wedged inside an operation is only terminated once\n   * that operation settles.\n   */\n  dispose(): void {\n    this.#releaseRequested = true;\n    this.#releaseIfIdle();\n  }\n\n  /**\n   * The one place that decides between the worker and the calling thread:\n   * inline once pinned or while no worker is running; otherwise the worker,\n   * falling back to inline on infrastructure failure while application errors\n   * pass through.\n   */\n  async #dispatch<T>(\n    invoke: (backend: EncryptOffloadBackend) => Promise<T>,\n    overWorker: (\n      api: Remote<EncryptWorkerApi>,\n      id: number,\n      options: WireRequestOptions,\n    ) => Promise<T>,\n    callOptions: CallOptions | undefined,\n  ): Promise<T> {\n    const { signal, onProgress, ...options } = callOptions ?? {};\n    // The worker dequeues an abort only after the proof, so a dispatched call always runs whole.\n    throwIfAborted(signal);\n    await this.init();\n    // A listener added after the abort never fires, so an abort during init needs this recheck.\n    throwIfAborted(signal);\n    const generation = this.#generation;\n    const api = generation?.api;\n    // An existing degrade attempt already carries the decision that created it,\n    // and its inline backend caches the key, so reuse it rather than degrading again.\n    if (this.#degradePromise !== undefined && (this.#pinnedInline || api === undefined)) {\n      return invoke(await this.#degradePromise);\n    }\n    if (generation === undefined || api === undefined) {\n      return invoke(\n        await this.#degrade(\n          generation,\n          this.#crashes.last ?? new WorkerUnavailableError(\"Encrypt worker not running.\"),\n        ),\n      );\n    }\n    const id = this.#sequence++;\n    const onAbort = () => void api.abort(id).catch(() => {});\n    signal?.addEventListener(\"abort\", onAbort, { once: true });\n    if (onProgress) {\n      this.#progressListeners.set(id, onProgress as (event: WireProgressEvent) => void);\n    }\n    try {\n      const result = await this.#overBoundary(generation, overWorker(api, id, options));\n      // A worker operation that answered clears the crash history: two unrelated\n      // crashes far apart must not add up to a permanent degrade.\n      this.#crashes = NO_CRASHES;\n      return result;\n    } catch (error) {\n      if (error instanceof WorkerUnavailableError) {\n        return invoke(await this.#degrade(generation, error));\n      }\n      throw error;\n    } finally {\n      this.#progressListeners.delete(id);\n      signal?.removeEventListener(\"abort\", onAbort);\n    }\n  }\n\n  async #initOnce(generation: WorkerGeneration): Promise<void> {\n    if (this.#pinnedInline) {\n      // The degrade that pinned the client already initialized the backend every call now runs on.\n      return;\n    }\n    const blockedReason = this.#config.blockedReason;\n    if (blockedReason !== undefined) {\n      // Handled before any resource is spent: non-strict callers never get here\n      // (the relayer inlines directly), and strict throws out of the degrade.\n      await this.#degrade(generation, new WorkerUnavailableError(blockedReason));\n      return;\n    }\n    // Outside the degrade guard: a failed key fetch is an application/network\n    // error, and the inline backend would refetch the same key from the same\n    // relayer. It rejects out of init exactly as the inline arm's would.\n    const fheEncryptionKey = await this.#config.prefetchKey();\n    try {\n      const api = await this.#spawn(generation);\n      const network = this.#config.network;\n      const rpcRequest =\n        typeof network === \"string\"\n          ? null\n          : proxy(async (args: { method: string; params?: unknown }) => {\n              try {\n                return await network.request(args as Parameters<EIP1193Provider[\"request\"]>[0]);\n              } catch (error) {\n                // Comlink keeps only name/message/stack on a thrown error, which\n                // would strip the provider's `code` (4001, -32005) the worker's\n                // classifiers read; flatten it so those fields cross.\n                throw toWireError(error);\n              }\n            });\n      // A callback that throws would reject the Comlink proxy call back in the\n      // worker realm, where nothing can report it, so it is contained here.\n      const log = proxy((level: \"debug\" | \"warn\" | \"error\", message: string) => {\n        try {\n          this.#config.logger[level](message);\n        } catch (error) {\n          this.#warnCallbackThrew(\"logger\", error);\n        }\n      });\n      const onProgress = proxy((id: number, event: WireProgressEvent) => {\n        try {\n          this.#progressListeners.get(id)?.(event);\n        } catch (error) {\n          this.#warnCallbackThrew(\"onProgress\", error);\n        }\n      });\n      // The copy stays on this thread so a later degrade to inline reuses the\n      // key instead of refetching; transferring the wire copy avoids a third\n      // in-transit copy of it.\n      const wireKey = keyForTransfer(fheEncryptionKey);\n      await this.#overBoundary(\n        generation,\n        api.init(\n          transfer(\n            {\n              ...this.#config.initPayload,\n              clientOptions: {\n                ...this.#config.initPayload.clientOptions,\n                fheEncryptionKey: wireKey.key,\n              },\n              rpcUrl: typeof network === \"string\" ? network : undefined,\n            },\n            wireKey.transfers,\n          ),\n          rpcRequest,\n          log,\n          onProgress,\n        ),\n        { ms: this.#config.timeouts.init, operation: \"init\" },\n      );\n      generation.api = api;\n      this.#crashes = { ...this.#crashes, last: undefined };\n    } catch (error) {\n      // Only \"the worker never answered or crashed\" is infrastructure. An error\n      // the worker itself reported (a chain read, bad key material) would fail\n      // the same way inline, so it reaches the caller unchanged.\n      if (!(error instanceof WorkerUnavailableError)) {\n        this.#teardown(generation, new WorkerUnavailableError(\"Encrypt worker init failed.\"));\n        throw error;\n      }\n      await this.#degrade(generation, error);\n    }\n  }\n\n  /** Reports a caller callback that threw; the reporting itself must not throw back into the worker. */\n  #warnCallbackThrew(callback: string, error: unknown): void {\n    const reason = error instanceof Error ? error.message : String(error);\n    try {\n      this.#config.logger.warn(`Encrypt offload ${callback} callback threw: ${reason}`);\n    } catch {\n      // A logger that throws on its own warning leaves nowhere left to report.\n    }\n  }\n\n  /**\n   * The count spans a whole public entry, its init included, so a release\n   * requested mid-call cannot terminate the worker between the init and the\n   * operation.\n   */\n  async #withActive<T>(work: () => Promise<T>): Promise<T> {\n    this.#active++;\n    try {\n      return await work();\n    } finally {\n      this.#active--;\n      this.#releaseIfIdle();\n    }\n  }\n\n  #releaseIfIdle(): void {\n    if (!this.#releaseRequested || this.#active > 0) {\n      return;\n    }\n    this.#releaseRequested = false;\n    this.#generation?.worker?.terminate();\n    // A full reset, so a release is the recovery lever for a degraded client:\n    // the next call re-fetches the key and spawns a fresh worker either way.\n    this.#generation = undefined;\n    this.#degradePromise = undefined;\n    this.#pinnedInline = false;\n    this.#crashes = NO_CRASHES;\n  }\n\n  #createWorker(): Worker {\n    const source = this.#config.workerSource;\n    if (source === undefined) {\n      return createEncryptWorker();\n    }\n    if (typeof source === \"function\") {\n      const worker = source();\n      // A memoized factory would hand the client a worker it already terminated,\n      // so the contract is one fresh Worker per call.\n      if (handedOutWorkers.has(worker)) {\n        this.#config.logger.warnAlways(\n          \"The offloadWorker factory returned a worker it already handed out; each call must construct a fresh Worker.\",\n        );\n      }\n      handedOutWorkers.add(worker);\n      return worker;\n    }\n    return new Worker(source, { type: \"module\", name: \"zama-fhe-encrypt\" });\n  }\n\n  /** Resolves once the worker's module graph has loaded. */\n  async #spawn(generation: WorkerGeneration): Promise<Remote<EncryptWorkerApi>> {\n    let worker: Worker;\n    try {\n      worker = this.#createWorker();\n    } catch (error) {\n      // A blocked construction is infrastructure, so it must reach the\n      // degrade path as such rather than as the raw thrown error.\n      throw new WorkerUnavailableError(error instanceof Error ? error.message : String(error), {\n        cause: error,\n      });\n    }\n    generation.worker = worker;\n    const api = await this.#raceReady(generation, worker);\n    this.#armCrashHandler(generation, worker);\n    return api;\n  }\n\n  /** Resolves with the Comlink API on the worker's ready message; rejects on the spawn deadline or a pre-ready error. */\n  #raceReady(generation: WorkerGeneration, worker: Worker): Promise<Remote<EncryptWorkerApi>> {\n    return new Promise<Remote<EncryptWorkerApi>>((resolve, reject) => {\n      const settle = () => {\n        clearTimeout(timer);\n        worker.removeEventListener(\"message\", onReady);\n        worker.removeEventListener(\"error\", onError);\n      };\n      const timer = setTimeout(() => {\n        settle();\n        reject(\n          new WorkerUnavailableError(\n            `Encrypt worker did not start within ${this.#config.timeouts.spawn}ms.`,\n          ),\n        );\n      }, this.#config.timeouts.spawn);\n      const onReady = (event: MessageEvent) => {\n        if (event.data === WORKER_READY_MESSAGE) {\n          settle();\n          resolve(wrap<EncryptWorkerApi>(worker));\n        }\n      };\n      const onError = (event: ErrorEvent) => {\n        settle();\n        const message = event.message || \"Encrypt worker error.\";\n        // A worker that never came up is not worth respawning per call, so\n        // this failure is not flagged as a crash.\n        reject(new WorkerUnavailableError(message));\n        this.#teardown(generation, new WorkerUnavailableError(message));\n      };\n      worker.addEventListener(\"message\", onReady);\n      worker.addEventListener(\"error\", onError);\n    });\n  }\n\n  /** Permanent crash detector, armed only after ready so a pre-ready failure never counts as a crash. */\n  #armCrashHandler(generation: WorkerGeneration, worker: Worker): void {\n    worker.addEventListener(\"error\", (event: ErrorEvent) => {\n      // A generation already torn down cannot crash the client again: nothing\n      // is waiting on it, and the worker running in its place is unaffected.\n      if (this.#generation !== generation) {\n        return;\n      }\n      // A ready worker died under us: the teardown drops the memoized init so\n      // the next call spawns a fresh one, and the operations it took down\n      // finish inline.\n      const crash = new WorkerUnavailableError(event.message || \"Encrypt worker error.\", {\n        crashed: true,\n      });\n      this.#crashes = { ...this.#crashes, count: this.#crashes.count + 1, last: crash };\n      this.#teardown(generation, crash);\n    });\n  }\n\n  /**\n   * Awaits one promise crossing the worker boundary, racing the generation's\n   * `doomed` promise so a teardown settles it with the teardown's\n   * `WorkerUnavailableError`, which degrades it inline. Without a `deadline` it\n   * settles whenever the worker answers; a `deadline` bounds a lifecycle step,\n   * and missing it means the worker is presumed stuck, so the generation is\n   * torn down whole.\n   */\n  async #overBoundary<T>(\n    generation: WorkerGeneration,\n    work: Promise<T>,\n    deadline?: { readonly ms: number; readonly operation: string },\n  ): Promise<T> {\n    const timer =\n      deadline === undefined\n        ? undefined\n        : setTimeout(() => {\n            this.#teardown(\n              generation,\n              new WorkerUnavailableError(\n                `Encrypt worker ${deadline.operation} timed out after ${deadline.ms}ms.`,\n              ),\n            );\n          }, deadline.ms);\n    try {\n      return await Promise.race([\n        work.catch((error: unknown) => {\n          const failure = isWireError(error) ? fromWireError(error) : (error as Error);\n          // A payload Comlink could not carry is infrastructure, so it degrades\n          // instead of reaching the caller as the operation's own failure.\n          throw isCloneFailure(failure)\n            ? new WorkerUnavailableError(failure.message, { cause: failure })\n            : failure;\n        }),\n        generation.doomed,\n      ]);\n    } finally {\n      if (timer !== undefined) {\n        clearTimeout(timer);\n      }\n    }\n  }\n\n  /**\n   * Rejects and drops one generation whole: its worker, its memoized init, and\n   * every crossing racing its `doomed` promise. The next call therefore re-runs\n   * the cycle on a fresh generation, so a spurious teardown costs a respawn\n   * rather than a permanent degrade.\n   */\n  #teardown(generation: WorkerGeneration | undefined, error: WorkerUnavailableError): void {\n    if (generation === undefined) {\n      return;\n    }\n    if (this.#generation === generation) {\n      this.#generation = undefined;\n    }\n    generation.worker?.terminate();\n    generation.worker = undefined;\n    generation.api = undefined;\n    generation.initPromise = undefined;\n    generation.doom(error);\n  }\n\n  async #degrade(\n    generation: WorkerGeneration | undefined,\n    cause: unknown,\n  ): Promise<EncryptOffloadBackend> {\n    const reason = cause instanceof Error ? cause.message : String(cause);\n    if (this.#config.strict) {\n      this.#teardown(generation, new WorkerUnavailableError(\"Encrypt worker unavailable.\"));\n      throw new EncryptOffloadUnavailableError(\n        `Encrypt offload required (offloadEncrypt: true) but unavailable: ${reason}`,\n        { cause },\n      );\n    }\n    const { transient, pinning } = this.#classifyDegrade(cause);\n    this.#pinnedInline ||= !transient;\n    this.#teardown(generation, new WorkerUnavailableError(\"Encrypt worker degraded to inline.\"));\n    this.#warnDegraded(reason, transient, pinning);\n    if (this.#degradePromise === undefined) {\n      // Only a live backend is memoized: an inline init is a key refetch, and a\n      // transient failure there must not close the degrade path for the session.\n      const attempt: Promise<EncryptOffloadBackend> = (async () => {\n        const inline = this.#config.createInlineClient();\n        await inline.init();\n        return inline;\n      })().catch((error: unknown) => {\n        if (this.#degradePromise === attempt) {\n          this.#degradePromise = undefined;\n        }\n        this.#config.logger.warnAlways(\n          `Encrypt inline fallback failed to initialize: ${error instanceof Error ? error.message : String(error)}`,\n        );\n        throw error;\n      });\n      this.#degradePromise = attempt;\n    }\n    return this.#degradePromise;\n  }\n\n  /**\n   * How one failure degrades, read off the state before the degrade mutates it:\n   * `transient` diverts only this call, `pinning` settles the client inline now.\n   * One crash is treated as transient; a repeat crash, or a worker that never\n   * came up, settles the client inline rather than spawning a replacement per call.\n   */\n  #classifyDegrade(cause: unknown): { readonly transient: boolean; readonly pinning: boolean } {\n    const transient =\n      cause instanceof WorkerUnavailableError &&\n      cause.crashed &&\n      this.#crashes.count < CRASH_PIN_THRESHOLD;\n    return { transient, pinning: !transient && !this.#pinnedInline };\n  }\n\n  /** One warning per failure, whether it pins the client inline or only diverts this call. */\n  #warnDegraded(reason: string, transient: boolean, pinning: boolean): void {\n    if (!pinning && this.#crashes.warnedFor === this.#crashes.count) {\n      return;\n    }\n    this.#crashes = { ...this.#crashes, warnedFor: this.#crashes.count };\n    const scope = transient ? \"in-flight encryption falls back\" : \"encryption falls back\";\n    // Always on the console: a silent return to main-thread encryption is the\n    // freeze this offload prevents.\n    this.#config.logger.warnAlways(\n      `${ENCRYPT_OFFLOAD_WARN_PREFIX}, ${scope} to the calling thread: ${reason}`,\n    );\n  }\n}\n","import { createUnsignedLegacyDecryptionPermitEip712 as createUnsignedLegacyDecryptionPermitEip712Action } from \"@fhevm/sdk/actions/base\";\nimport {\n  createFhevmBaseClient,\n  createFhevmDecryptClient,\n  createFhevmEncryptClient,\n  hasFhevmRuntimeConfig,\n} from \"@fhevm/sdk/viem\";\nimport {\n  createFhevmCleartextBaseClient,\n  createFhevmCleartextDecryptClient,\n  createFhevmCleartextEncryptClient,\n} from \"@fhevm/sdk/viem/cleartext\";\nimport { createPublicClient, custom, http } from \"viem\";\nimport { toFhevmChain } from \"../chains/to-fhevm-chain\";\nimport type { FheChain } from \"../chains/types\";\nimport { ConfigurationError } from \"../errors\";\nimport { getAppliedWireRuntime, hasAppliedLocateFile } from \"./applied-runtime\";\nimport type { LoggerService } from \"../services/logger-service\";\nimport {\n  DEFAULT_ENCRYPT_WORKER_TIMEOUTS,\n  EncryptWorkerClient,\n  type EncryptWorkerClientConfig,\n  type EncryptWorkerTimeouts,\n} from \"../worker/encrypt-worker-client\";\nimport { BUNDLED_ENCRYPT_WORKER } from \"../worker/spawn\";\nimport type {\n  FhevmBaseClient,\n  FhevmClient,\n  FhevmDecryptClient,\n  FhevmEncryptBackend,\n  FhevmRelayerOptions,\n  RelayerSDK,\n  RelayerOptions,\n  WireRuntimeConfig,\n} from \"./types\";\n\n/** The `@fhevm/sdk` client inputs the worker realm rebuilds its own client from. */\ntype EncryptInitPayload = EncryptWorkerClientConfig[\"initPayload\"];\n\n/** Construction config for {@link FhevmRelayer}. */\nexport interface FhevmRelayerConfig {\n  /** FHE chain configuration. */\n  chain: FheChain;\n  /**\n   * Cleartext mode for local dev/test chains without FHE infrastructure — reads\n   * mock cleartexts from the on-chain executor (discovered automatically)\n   * instead of calling the relayer.\n   */\n  cleartext?: boolean;\n  /**\n   * Per-transport {@link RelayerOptions}: `@fhevm/sdk` client options plus a\n   * default request `timeout` applied to every relayer round-trip on the chain.\n   */\n  options?: RelayerOptions;\n  /** Encrypt-worker offload mode; see `web()`'s `offloadEncrypt` option. */\n  offloadEncrypt?: \"auto\" | boolean;\n  /** Watchdog deadlines for the encrypt worker; `web()` defaults every field before it gets here. */\n  offloadTimeouts?: EncryptWorkerTimeouts;\n  /** Custom source for the encrypt worker; see `web()`'s `offloadWorker` option. */\n  offloadWorker?: string | URL | (() => Worker);\n  /** Receives worker log lines and offload-fallback warnings. */\n  logger: LoggerService;\n}\n\n/**\n * Single-chain FHE backend that drives `@fhevm/sdk` on the calling thread with\n * capability-scoped lazy initialization.\n * EIP-712 signing is done by the signer layer; this backend builds the typed\n * data and, on decrypt, reassembles the new SDK's signed permit from the\n * interface's params + the previously returned signature.\n *\n * @remarks\n * Each method delegates to the narrowest base, decrypt, or encrypt client,\n * adding two cross-cutting behaviors that the delegated signatures don't\n * express:\n *\n * - **Lazy init.** Each operation initializes only the capability it requires.\n *   Public decrypt avoids WASM, private decrypt loads TKMS only, and encryption\n *   alone loads TFHE and the FHE encryption key.\n * - **Option merging.** The chain's default options (`auth`, `timeout`, `debug`)\n *   are spread in first, then the per-call `options`, so a per-call value always\n *   wins over the chain default. Serialization helpers make no relayer\n *   round-trip, so they inject no options.\n *\n * @internal\n */\nexport class FhevmRelayer implements RelayerSDK {\n  readonly #chain: FheChain;\n  readonly #base: FhevmBaseClient;\n  readonly #decrypt: FhevmDecryptClient;\n  readonly #encrypt: FhevmEncryptBackend;\n  readonly #defaultOptions: Partial<FhevmRelayerOptions>;\n  #encryptInitPromise: Promise<void> | undefined;\n\n  /**\n   * Builds capability-scoped `@fhevm/sdk` clients for the chain and captures\n   * the chain's `auth`/`timeout`/`debug` as request defaults. Construction is\n   * cheap; each client's one-time init is deferred to its first operation.\n   */\n  constructor(config: FhevmRelayerConfig) {\n    this.#chain = config.chain;\n    const { timeout, debug, batchRpcCalls, moduleVersions, fheEncryptionKey } =\n      config.options ?? {};\n    const auth = this.#chain.auth ? toFhevmAuth(this.#chain.auth) : undefined;\n    const transport =\n      typeof this.#chain.network === \"string\"\n        ? http(this.#chain.network)\n        : custom(this.#chain.network);\n    const params = {\n      publicClient: createPublicClient({ transport }),\n      chain: toFhevmChain(this.#chain),\n      options: { batchRpcCalls, moduleVersions, fheEncryptionKey },\n    };\n    this.#defaultOptions = {\n      ...(auth !== undefined && { auth }),\n      ...(timeout !== undefined && { timeout }),\n      ...(debug !== undefined && { debug }),\n    };\n    // The FHE key is always fetched here, on the calling thread, so the chain's\n    // default request options (auth in particular) apply; a worker realm has no\n    // access to them.\n    const prefetchKey = () =>\n      this.#base.fetchFheEncryptionKeyBytes({ options: this.#defaultOptions });\n    // Re-listed rather than spread: the upstream client exposes an enumerable\n    // `ready` getter, and a spread would call it, starting init at construction.\n    const withInlineInit = (client: FhevmEncryptBackend): FhevmEncryptBackend => ({\n      init: async () => {\n        await prefetchKey();\n        await client.init();\n      },\n      encryptValue: (parameters) => client.encryptValue(parameters),\n      encryptValues: (parameters) => client.encryptValues(parameters),\n      fetchFheEncryptionKeyBytes: (parameters) => client.fetchFheEncryptionKeyBytes(parameters),\n    });\n    if (config.cleartext) {\n      this.#base = createFhevmCleartextBaseClient(params);\n      this.#decrypt = createFhevmCleartextDecryptClient(params);\n      this.#encrypt = withInlineInit(createFhevmCleartextEncryptClient(params));\n    } else {\n      this.#base = createFhevmBaseClient(params);\n      this.#decrypt = createFhevmDecryptClient(params);\n      this.#encrypt = this.#buildEncryptBackend(config, params, {\n        prefetchKey,\n        createInlineClient: () => withInlineInit(createFhevmEncryptClient(params)),\n      });\n    }\n  }\n\n  /**\n   * Picks the encrypt backend for a non-cleartext chain: the worker client when\n   * offload is on and reachable, the inline calling-thread client otherwise.\n   */\n  #buildEncryptBackend(\n    config: FhevmRelayerConfig,\n    params: { chain: EncryptInitPayload[\"chain\"]; options: EncryptInitPayload[\"clientOptions\"] },\n    inline: {\n      prefetchKey: EncryptWorkerClientConfig[\"prefetchKey\"];\n      createInlineClient: () => FhevmEncryptBackend;\n    },\n  ): FhevmEncryptBackend {\n    const offload = config.offloadEncrypt ?? false;\n    const strict = offload === true;\n    const workerAvailable =\n      typeof Worker === \"function\" &&\n      (config.offloadWorker !== undefined || BUNDLED_ENCRYPT_WORKER);\n    // Silent both ways: offload off is what the caller asked for, and a realm\n    // with no Worker is an environment fact that would warn on every SSR\n    // render. Strict skips the capability check, since construction runs during\n    // that render and the failure must surface at call time instead.\n    if (offload === false || !(strict || workerAvailable)) {\n      return inline.createInlineClient();\n    }\n    const runtime = getAppliedWireRuntime();\n    const blocker = encryptOffloadBlocker(runtime);\n    if (blocker !== undefined && !strict) {\n      // Always on the console: the alternative is an opaque rejection at\n      // encrypt time, or WASM assets silently resolved from the default URLs.\n      config.logger.warnAlways(`Encryption runs on the calling thread: ${blocker}.`);\n      return inline.createInlineClient();\n    }\n    const workerClient = new EncryptWorkerClient({\n      initPayload: { chain: params.chain, clientOptions: params.options, runtime: runtime ?? {} },\n      network: this.#chain.network,\n      prefetchKey: inline.prefetchKey,\n      createInlineClient: inline.createInlineClient,\n      logger: config.logger,\n      timeouts: config.offloadTimeouts ?? DEFAULT_ENCRYPT_WORKER_TIMEOUTS,\n      workerSource: config.offloadWorker,\n      // Strict with a blocker: the client degrades at init, which rejects at\n      // call time rather than at config time.\n      blockedReason: blocker,\n      strict,\n    });\n    return {\n      init: () => workerClient.init(),\n      encryptValue: (parameters) => workerClient.encryptValue(parameters),\n      encryptValues: (parameters) => workerClient.encryptValues(parameters),\n      // Served from the calling thread: routing it through the worker would\n      // structured-clone the ~50 MB key back out on every call. `ignoreCache`\n      // therefore refreshes this thread's cache, not the worker's seeded key.\n      fetchFheEncryptionKeyBytes: (parameters) => this.#base.fetchFheEncryptionKeyBytes(parameters),\n      dispose: () => workerClient.dispose(),\n    };\n  }\n\n  /** The FHE chain this backend is bound to. */\n  get chain() {\n    return this.#chain;\n  }\n\n  // Only a fulfilled init is memoized: a rejection clears the memo so the next\n  // encryption retries instead of inheriting a transient key-fetch failure.\n  #initEncrypt = (): Promise<void> => {\n    this.#encryptInitPromise ??= this.#encrypt.init().catch((error: unknown) => {\n      this.#encryptInitPromise = undefined;\n      throw error;\n    });\n    return this.#encryptInitPromise;\n  };\n\n  /**\n   * Releases the encrypt worker once in-flight encryptions settle and drops the\n   * memoized init; the next encryption spawns a fresh worker and re-initializes.\n   */\n  dispose = (): void => {\n    this.#encryptInitPromise = undefined;\n    this.#encrypt.dispose?.();\n  };\n\n  /**\n   * Decrypts a single publicly-decryptable value — one whose contract granted\n   * public access, so no permit or key pair is needed — into its typed clear\n   * value.\n   *\n   * @example\n   * ```ts\n   * const { type, value } = await relayer.decryptPublicValue({\n   *   encryptedValue: handle, // a bytes32 ciphertext reference\n   * });\n   * ```\n   */\n  decryptPublicValue: FhevmClient[\"decryptPublicValue\"] = async (parameters) => {\n    await this.#base.init();\n    return this.#base.decryptPublicValue({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * Batch form of {@link decryptPublicValue}: decrypts many publicly-decryptable\n   * values in one relayer round-trip, returning their typed clear values in\n   * order.\n   *\n   * @example\n   * ```ts\n   * const values = await relayer.decryptPublicValues({\n   *   encryptedValues: [handleA, handleB],\n   * });\n   * ```\n   */\n  decryptPublicValues: FhevmClient[\"decryptPublicValues\"] = async (parameters) => {\n    await this.#base.init();\n    return this.#base.decryptPublicValues({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * Like {@link decryptPublicValues}, but also returns the KMS signature bundle —\n   * the handles list, ABI-encoded cleartexts, and decryption proof — needed to\n   * verify or replay the result on-chain.\n   *\n   * @example\n   * ```ts\n   * const { clearValues, checkSignaturesArgs } =\n   *   await relayer.decryptPublicValuesWithSignatures({ encryptedValues: [handle] });\n   * // checkSignaturesArgs: { handlesList, abiEncodedCleartexts, decryptionProof }\n   * ```\n   */\n  decryptPublicValuesWithSignatures: FhevmClient[\"decryptPublicValuesWithSignatures\"] = async (\n    parameters,\n  ) => {\n    await this.#base.init();\n    return this.#base.decryptPublicValuesWithSignatures({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * Encrypts one typed input under the chain's FHE key, bound to the contract it\n   * targets and the user submitting it, and returns the ciphertext handle plus\n   * the input proof the contract verifies on-chain. `type` is the FHE type\n   * with the `e` prefix (`\"euint64\"`, `\"ebool\"`, `\"eaddress\"`).\n   *\n   * @example\n   * ```ts\n   * const { encryptedValue, inputProof } = await relayer.encryptValue({\n   *   value: { type: \"euint64\", value: 1000n },\n   *   contractAddress: \"0xToken…\",\n   *   userAddress: \"0xUser…\",\n   * });\n   * ```\n   */\n  encryptValue: FhevmClient[\"encryptValue\"] = async (parameters) => {\n    await this.#initEncrypt();\n    return this.#encrypt.encryptValue({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * Batch form of {@link encryptValue}: encrypts several inputs for the same\n   * contract and user in one call, returning all ciphertext handles under a\n   * single shared input proof.\n   *\n   * @example\n   * ```ts\n   * const { encryptedValues, inputProof } = await relayer.encryptValues({\n   *   values: [\n   *     { type: \"euint64\", value: 1000n },\n   *     { type: \"ebool\", value: true },\n   *   ],\n   *   contractAddress: \"0xToken…\",\n   *   userAddress: \"0xUser…\",\n   * });\n   * ```\n   */\n  encryptValues: FhevmClient[\"encryptValues\"] = async (parameters) => {\n    await this.#initEncrypt();\n    return this.#encrypt.encryptValues({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * User-decrypts a single access-controlled value: the relayer re-encrypts it\n   * to the ephemeral transport key pair, gated by the signed permit, and this\n   * returns the typed clear value. Build the key pair with\n   * {@link generateTransportKeyPair} and the permit with\n   * {@link signDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const { type, value } = await relayer.decryptValue({\n   *   encryptedValue: handle,\n   *   contractAddress: \"0xToken…\",\n   *   transportKeyPair,\n   *   signedPermit,\n   * });\n   * ```\n   */\n  decryptValue: FhevmClient[\"decryptValue\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.decryptValue({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * Batch form of {@link decryptValue} for values that all belong to the same\n   * contract; returns the typed clear values positionally. For values spanning\n   * multiple contracts, use {@link decryptValuesFromPairs}.\n   *\n   * @example\n   * ```ts\n   * const values = await relayer.decryptValues({\n   *   encryptedValues: [handleA, handleB],\n   *   contractAddress: \"0xToken…\",\n   *   transportKeyPair,\n   *   signedPermit,\n   * });\n   * ```\n   */\n  decryptValues: FhevmClient[\"decryptValues\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.decryptValues({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * User-decrypts values that span multiple contracts: each pair carries its own\n   * `contractAddress`, so one permit covering those contracts decrypts them all\n   * in a single round-trip. Returns the typed clear values positionally.\n   *\n   * @example\n   * ```ts\n   * const values = await relayer.decryptValuesFromPairs({\n   *   pairs: [\n   *     { encryptedValue: handleA, contractAddress: \"0xTokenA…\" },\n   *     { encryptedValue: handleB, contractAddress: \"0xTokenB…\" },\n   *   ],\n   *   transportKeyPair,\n   *   signedPermit,\n   * });\n   * ```\n   */\n  decryptValuesFromPairs: FhevmClient[\"decryptValuesFromPairs\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.decryptValuesFromPairs({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters.options },\n    });\n  };\n\n  /**\n   * Fetches the chain's raw FHE public-key bytes — the key encryption uses —\n   * served from cache unless `ignoreCache` forces a refetch. Rarely called\n   * directly: {@link encryptValue}/{@link encryptValues} fetch the key for you.\n   *\n   * @example\n   * ```ts\n   * const keyBytes = await relayer.fetchFheEncryptionKeyBytes();\n   * const fresh = await relayer.fetchFheEncryptionKeyBytes({ ignoreCache: true });\n   * ```\n   */\n  fetchFheEncryptionKeyBytes: FhevmClient[\"fetchFheEncryptionKeyBytes\"] = async (parameters) => {\n    // Served from the base client, which shares the key cache with the encrypt\n    // client: initializing encryption here would spawn the encrypt worker and\n    // wait out its bring-up for a key this thread fetches itself.\n    await this.#base.init();\n    return this.#base.fetchFheEncryptionKeyBytes({\n      ...parameters,\n      options: { ...this.#defaultOptions, ...parameters?.options },\n    });\n  };\n\n  /**\n   * Builds the EIP-712 user-decrypt permit and signs it with the given signer,\n   * authorizing the transport key pair to decrypt the listed contracts' values\n   * for `durationSeconds` starting at `startTimestamp`. Pass `delegatorAddress`\n   * to sign a delegated permit — decrypting values owned by that account instead\n   * of the signer's own. Persist the result via\n   * {@link serializeSignedDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const signedPermit = await relayer.signDecryptionPermit({\n   *   transportKeyPair,\n   *   contractAddresses: [\"0xToken…\"],\n   *   startTimestamp: Math.floor(Date.now() / 1000),\n   *   durationSeconds: 60 * 60 * 24,\n   *   signerAddress: \"0xUser…\",\n   *   signer,\n   *   // delegatorAddress: \"0xOwner…\", // omit for a self permit\n   * });\n   * ```\n   */\n  signDecryptionPermit: FhevmClient[\"signDecryptionPermit\"] = async (parameters) => {\n    await this.#base.init();\n    return this.#base.signDecryptionPermit(parameters);\n  };\n\n  /**\n   * Builds the unsigned EIP-712 typed data for a V1 decryption permit, without\n   * signing it — the signer-less counterpart to {@link signDecryptionPermit}.\n   * Hand the result to an out-of-process signer for `eth_signTypedData_v4`,\n   * then verify the returned signature via {@link parseSignedDecryptionPermit}.\n   *\n   * Not on `@fhevm/sdk`'s client decorator, so it's called directly against\n   * the base client rather than through a decorated method.\n   *\n   * @example\n   * ```ts\n   * const eip712 = await relayer.createUnsignedLegacyDecryptionPermitEip712({\n   *   transportKeyPair,\n   *   contractAddresses: [\"0xToken…\"],\n   *   startTimestamp: Math.floor(Date.now() / 1000),\n   *   durationSeconds: 60 * 60 * 24,\n   *   // delegatorAddress: \"0xOwner…\", // omit for a self permit\n   * });\n   * ```\n   */\n  createUnsignedLegacyDecryptionPermitEip712: RelayerSDK[\"createUnsignedLegacyDecryptionPermitEip712\"] =\n    (parameters) => createUnsignedLegacyDecryptionPermitEip712Action(this.#base, parameters);\n\n  // Permit/key-pair helpers carry no request options. Parsing explicitly\n  // initializes the capability that validates the restored value; serialization\n  // resolves the frozen context internally (via initPublicAction), which reads\n  // on-chain state.\n\n  /**\n   * Serializes a transport key pair to a hex `{ publicKey, privateKey }` pair for\n   * storage or transport, so a decryption session can resume without regenerating\n   * keys. Reverse of {@link parseTransportKeyPair}.\n   *\n   * @example\n   * ```ts\n   * const stored = await relayer.serializeTransportKeyPair({ transportKeyPair });\n   * // { publicKey: \"0x…\", privateKey: \"0x…\" }\n   * ```\n   */\n  serializeTransportKeyPair: FhevmClient[\"serializeTransportKeyPair\"] = (parameters) =>\n    this.#decrypt.serializeTransportKeyPair(parameters);\n\n  /**\n   * Serializes a signed permit to a plain, JSON-stringifiable object (version,\n   * EIP-712 payload, signature, signer) for caching or transport. Reverse of\n   * {@link parseSignedDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const serialized = await relayer.serializeSignedDecryptionPermit({ signedPermit });\n   * localStorage.setItem(\"permit\", JSON.stringify(serialized));\n   * ```\n   */\n  serializeSignedDecryptionPermit: FhevmClient[\"serializeSignedDecryptionPermit\"] = (parameters) =>\n    this.#base.serializeSignedDecryptionPermit(parameters);\n\n  /**\n   * Rebuilds a transport key pair from its serialized hex\n   * `{ publicKey, privateKey }` form. Reverse of {@link serializeTransportKeyPair}.\n   *\n   * @example\n   * ```ts\n   * const transportKeyPair = await relayer.parseTransportKeyPair({\n   *   publicKey: stored.publicKey,\n   *   privateKey: stored.privateKey,\n   * });\n   * ```\n   */\n  parseTransportKeyPair: FhevmClient[\"parseTransportKeyPair\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.parseTransportKeyPair(parameters);\n  };\n\n  /**\n   * Rebuilds a signed permit from its serialized form and validates it: checks\n   * the EIP-712 structure, verifies the signature against the on-chain verifier,\n   * and confirms the permit's public key matches `transportKeyPair`. Reverse of\n   * {@link serializeSignedDecryptionPermit}.\n   *\n   * @throws if the permit is malformed, expired, or its signature is invalid.\n   *\n   * @example\n   * ```ts\n   * const signedPermit = await relayer.parseSignedDecryptionPermit({\n   *   serializedPermit,\n   *   transportKeyPair,\n   * });\n   * ```\n   */\n  parseSignedDecryptionPermit: FhevmClient[\"parseSignedDecryptionPermit\"] = async (parameters) => {\n    await this.#base.init();\n    const { serializedPermit } = parameters;\n    return this.#base.parseSignedDecryptionPermit({\n      ...parameters,\n      serializedPermit: {\n        ...serializedPermit,\n        signature: normalizeSignatureV(serializedPermit.signature),\n      },\n    });\n  };\n\n  /**\n   * Generates a fresh ephemeral transport key pair for a user-decrypt session.\n   * The relayer re-encrypts decrypted values to this pair's public key, so only\n   * the holder of the private key can read them; bind it to a permit via\n   * {@link signDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const transportKeyPair = await relayer.generateTransportKeyPair();\n   * ```\n   */\n  generateTransportKeyPair: FhevmClient[\"generateTransportKeyPair\"] = async () => {\n    await this.#decrypt.init();\n    return this.#decrypt.generateTransportKeyPair();\n  };\n}\n\n/**\n * Rewrites a 65-byte signature's recovery byte from 0/1 to 27/28. The gateway\n * verifies V1 permits on-chain with OpenZeppelin `ECDSA.recover`, which rejects\n * 0/1. Longer signatures (ERC-1271, concatenated) pass through untouched.\n */\nfunction normalizeSignatureV(signature: string): string {\n  if (signature.length !== 132) {\n    return signature;\n  }\n  const v = parseInt(signature.slice(130), 16);\n  if (v !== 0 && v !== 1) {\n    return signature;\n  }\n  return `${signature.slice(0, 130)}${v === 0 ? \"1b\" : \"1c\"}`;\n}\n\n/**\n * The one reason, if any, this thread's configuration cannot be reproduced in\n * the worker realm, so offload is worse than inline there.\n */\nfunction encryptOffloadBlocker(runtime: WireRuntimeConfig | undefined): string | undefined {\n  // A runtime `locateFile` is a function: it cannot be cloned into the worker\n  // realm, which would silently resolve WASM assets from the default URLs.\n  if (hasAppliedLocateFile()) {\n    return \"a runtime locateFile cannot cross the encrypt worker boundary\";\n  }\n  // Unreadable here, so the worker would run on fhevm defaults: an auth it\n  // carries would 401 inside the worker as an application error, which never degrades.\n  if (runtime === undefined && hasFhevmRuntimeConfig()) {\n    return \"a runtime config set outside createConfig cannot be replicated in the encrypt worker realm\";\n  }\n  return undefined;\n}\n\n/**\n * Translates the SDK's public {@link FheChain.auth} shape (discriminated by\n * `__type`) into the `type`-discriminated `auth` that `@fhevm/sdk` expects.\n *\n * @throws if the auth discriminator is not one of the supported kinds.\n */\nfunction toFhevmAuth(\n  auth: NonNullable<FheChain[\"auth\"]>,\n): NonNullable<FhevmRelayerOptions[\"auth\"]> {\n  const type = auth[\"__type\"];\n  switch (type) {\n    case \"ApiKeyHeader\":\n      return { type, value: auth.value, header: auth.header };\n    case \"ApiKeyCookie\":\n      return { type, value: auth.value, cookie: auth.cookie };\n    case \"BearerToken\":\n      return { type, token: auth.token };\n    default:\n      throw new ConfigurationError(`Unknown auth type: ${String(type)}`);\n  }\n}\n"],"x_google_ignoreList":[1],"mappings":"6lBAYA,SAAgB,GAAa,EAA6B,CACxD,MAAO,CACL,GAAI,EAAM,GACV,MAAO,CACL,UAAW,CACT,IAAK,CAAE,QAAS,EAAM,kBAAmB,EACzC,cAAe,CAAE,QAAS,EAAM,4BAA6B,EAC7D,YAAa,CAAE,QAAS,EAAM,kBAAmB,EACjD,eAAgB,IAAA,EAClB,EACA,WAAY,EAAM,WAClB,QAAS,CACP,GAAI,EAAM,eACV,UAAW,CACT,WAAY,CAAE,QAAS,EAAM,kCAAmC,EAChE,kBAAmB,CAAE,QAAS,EAAM,yCAA0C,CAChF,CACF,CACF,CACF,CACF;;;;;;AC3BA,MAAM,EAAc,OAAO,eAAe,EACpC,EAAiB,OAAO,kBAAkB,EAC1C,EAAe,OAAO,sBAAsB,EAC5C,EAAY,OAAO,mBAAmB,EACtC,EAAc,OAAO,gBAAgB,EACrC,EAAY,GAAS,OAAO,GAAQ,YAAY,GAAiB,OAAO,GAAQ,WAgDhF,EAAmB,IAAI,IAAI,CAC7B,CAAC,QAAS,CA5CV,UAAY,GAAQ,EAAS,CAAG,GAAK,EAAI,GACzC,UAAU,EAAK,CACX,GAAM,CAAE,QAAO,SAAU,IAAI,eAE7B,OADA,EAAO,EAAK,CAAK,EACV,CAAC,EAAO,CAAC,CAAK,CAAC,CAC1B,EACA,YAAY,EAAM,CAEd,OADA,EAAK,MAAM,EACJ,EAAK,CAAI,CACpB,CAmC6B,CAAC,EAC9B,CAAC,QAAS,CA9BV,UAAY,GAAU,EAAS,CAAK,GAAK,KAAe,EACxD,UAAU,CAAE,SAAS,CACjB,IAAI,EAcJ,MAbA,CAWI,EAXA,aAAiB,MACJ,CACT,QAAS,GACT,MAAO,CACH,QAAS,EAAM,QACf,KAAM,EAAM,KACZ,MAAO,EAAM,KACjB,CACJ,EAGa,CAAE,QAAS,GAAO,OAAM,EAElC,CAAC,EAAY,CAAC,CAAC,CAC1B,EACA,YAAY,EAAY,CAIpB,MAHI,EAAW,QACL,OAAO,OAAW,MAAM,EAAW,MAAM,OAAO,EAAG,EAAW,KAAK,EAEvE,EAAW,KACrB,CAO6B,CAAC,CAClC,CAAC,EACD,SAAS,GAAgB,EAAgB,EAAQ,CAC7C,IAAK,IAAM,KAAiB,EAIxB,GAHI,IAAW,GAAiB,IAAkB,KAG9C,aAAyB,QAAU,EAAc,KAAK,CAAM,EAC5D,MAAO,GAGf,MAAO,EACX,CACA,SAAS,EAAO,EAAK,EAAK,WAAY,EAAiB,CAAC,GAAG,EAAG,CAC1D,EAAG,iBAAiB,UAAW,SAAS,EAAS,EAAI,CACjD,GAAI,CAAC,GAAM,CAAC,EAAG,KACX,OAEJ,GAAI,CAAC,GAAgB,EAAgB,EAAG,MAAM,EAAG,CAC7C,QAAQ,KAAK,mBAAmB,EAAG,OAAO,oBAAoB,EAC9D,MACJ,CACA,GAAM,CAAE,KAAI,OAAM,QAAS,OAAO,OAAO,CAAE,KAAM,CAAC,CAAE,EAAG,EAAG,IAAI,EACxD,GAAgB,EAAG,KAAK,cAAgB,CAAC,EAAA,CAAG,IAAI,CAAa,EAC/D,EACJ,GAAI,CACA,IAAM,EAAS,EAAK,MAAM,EAAG,EAAE,CAAC,CAAC,QAAQ,EAAK,IAAS,EAAI,GAAO,CAAG,EAC/D,EAAW,EAAK,QAAQ,EAAK,IAAS,EAAI,GAAO,CAAG,EAC1D,OAAQ,EAAR,CACI,IAAK,MAEG,EAAc,EAElB,MACJ,IAAK,MAEG,EAAO,EAAK,MAAM,EAAE,CAAC,CAAC,IAAM,EAAc,EAAG,KAAK,KAAK,EACvD,EAAc,GAElB,MACJ,IAAK,QAEG,EAAc,EAAS,MAAM,EAAQ,CAAY,EAErD,MACJ,IAAK,YAGG,EAAc,EAAM,IADF,EAAS,GAAG,CACN,CAAC,EAE7B,MACJ,IAAK,WACD,CACI,GAAM,CAAE,QAAO,SAAU,IAAI,eAC7B,EAAO,EAAK,CAAK,EACjB,EAAc,EAAS,EAAO,CAAC,CAAK,CAAC,CACzC,CACA,MACJ,IAAK,UAEG,EAAc,IAAA,GAElB,MACJ,QACI,MACR,CACJ,OACO,EAAO,CACV,EAAc,CAAE,SAAQ,GAAc,CAAE,CAC5C,CACA,QAAQ,QAAQ,CAAW,CAAC,CACvB,MAAO,IACD,CAAE,SAAQ,GAAc,CAAE,EACpC,CAAC,CACG,KAAM,GAAgB,CACvB,GAAM,CAAC,EAAW,GAAiB,EAAY,CAAW,EAC1D,EAAG,YAAY,OAAO,OAAO,OAAO,OAAO,CAAC,EAAG,CAAS,EAAG,CAAE,IAAG,CAAC,EAAG,CAAa,EAC7E,IAAS,YAET,EAAG,oBAAoB,UAAW,CAAQ,EAC1C,EAAc,CAAE,EACZ,KAAa,GAAO,OAAO,EAAI,IAAe,YAC9C,EAAI,EAAU,CAAC,EAG3B,CAAC,CAAC,CACG,MAAO,GAAU,CAElB,GAAM,CAAC,EAAW,GAAiB,EAAY,CAC3C,MAAW,UAAU,6BAA6B,GACjD,GAAc,CACnB,CAAC,EACD,EAAG,YAAY,OAAO,OAAO,OAAO,OAAO,CAAC,EAAG,CAAS,EAAG,CAAE,IAAG,CAAC,EAAG,CAAa,CACrF,CAAC,CACL,CAAC,EACG,EAAG,OACH,EAAG,MAAM,CAEjB,CACA,SAAS,GAAc,EAAU,CAC7B,OAAO,EAAS,YAAY,OAAS,aACzC,CACA,SAAS,EAAc,EAAU,CACzB,GAAc,CAAQ,GACtB,EAAS,MAAM,CACvB,CACA,SAAS,EAAK,EAAI,EAAQ,CACtB,IAAM,EAAmB,IAAI,IAiB7B,OAhBA,EAAG,iBAAiB,UAAW,SAAuB,EAAI,CACtD,GAAM,CAAE,QAAS,EACjB,GAAI,CAAC,GAAQ,CAAC,EAAK,GACf,OAEJ,IAAM,EAAW,EAAiB,IAAI,EAAK,EAAE,EACxC,KAGL,GAAI,CACA,EAAS,CAAI,CACjB,QACQ,CACJ,EAAiB,OAAO,EAAK,EAAE,CACnC,CACJ,CAAC,EACM,EAAY,EAAI,EAAkB,CAAC,EAAG,CAAM,CACvD,CACA,SAAS,EAAqB,EAAY,CACtC,GAAI,EACA,MAAU,MAAM,4CAA4C,CAEpE,CACA,SAAS,EAAgB,EAAI,CACzB,OAAO,EAAuB,EAAI,IAAI,IAAO,CACzC,KAAM,SACV,CAAC,CAAC,CAAC,SAAW,CACV,EAAc,CAAE,CACpB,CAAC,CACL,CACA,MAAM,EAAe,IAAI,QACnB,EAAkB,yBAA0B,YAC9C,IAAI,qBAAsB,GAAO,CAC7B,IAAM,GAAY,EAAa,IAAI,CAAE,GAAK,GAAK,EAC/C,EAAa,IAAI,EAAI,CAAQ,EACzB,IAAa,GACb,EAAgB,CAAE,CAE1B,CAAC,EACL,SAAS,EAAc,EAAO,EAAI,CAC9B,IAAM,GAAY,EAAa,IAAI,CAAE,GAAK,GAAK,EAC/C,EAAa,IAAI,EAAI,CAAQ,EACzB,GACA,EAAgB,SAAS,EAAO,EAAI,CAAK,CAEjD,CACA,SAAS,EAAgB,EAAO,CACxB,GACA,EAAgB,WAAW,CAAK,CAExC,CACA,SAAS,EAAY,EAAI,EAAkB,EAAO,CAAC,EAAG,EAAS,UAAY,CAAE,EAAG,CAC5E,IAAI,EAAkB,GAChB,EAAQ,IAAI,MAAM,EAAQ,CAC5B,IAAI,EAAS,EAAM,CAEf,GADA,EAAqB,CAAe,EAChC,IAAS,EACT,UAAa,CACT,EAAgB,CAAK,EACrB,EAAgB,CAAE,EAClB,EAAiB,MAAM,EACvB,EAAkB,EACtB,EAEJ,GAAI,IAAS,OAAQ,CACjB,GAAI,EAAK,SAAW,EAChB,MAAO,CAAE,SAAY,CAAM,EAE/B,IAAM,EAAI,EAAuB,EAAI,EAAkB,CACnD,KAAM,MACN,KAAM,EAAK,IAAK,GAAM,EAAE,SAAS,CAAC,CACtC,CAAC,CAAC,CAAC,KAAK,CAAa,EACrB,OAAO,EAAE,KAAK,KAAK,CAAC,CACxB,CACA,OAAO,EAAY,EAAI,EAAkB,CAAC,GAAG,EAAM,CAAI,CAAC,CAC5D,EACA,IAAI,EAAS,EAAM,EAAU,CACzB,EAAqB,CAAe,EAGpC,GAAM,CAAC,EAAO,GAAiB,EAAY,CAAQ,EACnD,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,MACN,KAAM,CAAC,GAAG,EAAM,CAAI,CAAC,CAAC,IAAK,GAAM,EAAE,SAAS,CAAC,EAC7C,OACJ,EAAG,CAAa,CAAC,CAAC,KAAK,CAAa,CACxC,EACA,MAAM,EAAS,EAAU,EAAiB,CACtC,EAAqB,CAAe,EACpC,IAAM,EAAO,EAAK,EAAK,OAAS,GAChC,GAAI,IAAS,EACT,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,UACV,CAAC,CAAC,CAAC,KAAK,CAAa,EAGzB,GAAI,IAAS,OACT,OAAO,EAAY,EAAI,EAAkB,EAAK,MAAM,EAAG,EAAE,CAAC,EAE9D,GAAM,CAAC,EAAc,GAAiB,EAAiB,CAAe,EACtE,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,QACN,KAAM,EAAK,IAAK,GAAM,EAAE,SAAS,CAAC,EAClC,cACJ,EAAG,CAAa,CAAC,CAAC,KAAK,CAAa,CACxC,EACA,UAAU,EAAS,EAAiB,CAChC,EAAqB,CAAe,EACpC,GAAM,CAAC,EAAc,GAAiB,EAAiB,CAAe,EACtE,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,YACN,KAAM,EAAK,IAAK,GAAM,EAAE,SAAS,CAAC,EAClC,cACJ,EAAG,CAAa,CAAC,CAAC,KAAK,CAAa,CACxC,CACJ,CAAC,EAED,OADA,EAAc,EAAO,CAAE,EAChB,CACX,CACA,SAAS,EAAO,EAAK,CACjB,OAAO,MAAM,UAAU,OAAO,MAAM,CAAC,EAAG,CAAG,CAC/C,CACA,SAAS,EAAiB,EAAc,CACpC,IAAM,EAAY,EAAa,IAAI,CAAW,EAC9C,MAAO,CAAC,EAAU,IAAK,GAAM,EAAE,EAAE,EAAG,EAAO,EAAU,IAAK,GAAM,EAAE,EAAE,CAAC,CAAC,CAC1E,CACA,MAAM,EAAgB,IAAI,QAC1B,SAAS,EAAS,EAAK,EAAW,CAE9B,OADA,EAAc,IAAI,EAAK,CAAS,EACzB,CACX,CACA,SAAS,EAAM,EAAK,CAChB,OAAO,OAAO,OAAO,EAAK,EAAG,GAAc,EAAK,CAAC,CACrD,CAQA,SAAS,EAAY,EAAO,CACxB,IAAK,GAAM,CAAC,EAAM,KAAY,EAC1B,GAAI,EAAQ,UAAU,CAAK,EAAG,CAC1B,GAAM,CAAC,EAAiB,GAAiB,EAAQ,UAAU,CAAK,EAChE,MAAO,CACH,CACI,KAAM,UACN,OACA,MAAO,CACX,EACA,CACJ,CACJ,CAEJ,MAAO,CACH,CACI,KAAM,MACN,OACJ,EACA,EAAc,IAAI,CAAK,GAAK,CAAC,CACjC,CACJ,CACA,SAAS,EAAc,EAAO,CAC1B,OAAQ,EAAM,KAAd,CACI,IAAK,UACD,OAAO,EAAiB,IAAI,EAAM,IAAI,CAAC,CAAC,YAAY,EAAM,KAAK,EACnE,IAAK,MACD,OAAO,EAAM,KACrB,CACJ,CACA,SAAS,EAAuB,EAAI,EAAkB,EAAK,EAAW,CAClE,OAAO,IAAI,QAAS,GAAY,CAC5B,IAAM,EAAK,EAAa,EACxB,EAAiB,IAAI,EAAI,CAAO,EAC5B,EAAG,OACH,EAAG,MAAM,EAEb,EAAG,YAAY,OAAO,OAAO,CAAE,IAAG,EAAG,CAAG,EAAG,CAAS,CACxD,CAAC,CACL,CACA,SAAS,GAAe,CACpB,MAAO,KAAW,CAAC,CACd,KAAK,CAAC,CAAC,CACP,QAAU,KAAK,MAAM,KAAK,OAAO,WAA2B,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAC3E,KAAK,GAAG,CACjB,CCnPA,SAAgB,EAAY,EAAoC,CAG9D,OACE,OAAO,GAAU,YACjB,GACC,EAAkC,YAAc,EAErD,CAOA,MAAM,EAAmB,CACvB,aACA,SACA,aACA,YACA,kBACA,OACA,OACA,eACA,UACA,QACA,MACF,EAKA,SAAS,EAAY,EAAyB,CAC5C,GAAI,CAEF,OADA,gBAAgB,CAAK,EACd,EACT,MAAQ,CACN,MAAO,EACT,CACF,CAMA,SAAS,EAAuB,EAAmC,CACjE,IAAM,EAAY,EAA+C,SACjE,OAAO,EAAqB,GAAU,OAAO,CAC/C,CAMA,SAAS,EAAkB,EAAwB,CACjD,GAAI,CACF,OAAO,KAAK,UAAU,CAAK,GAAK,OAAO,CAAK,CAC9C,MAAQ,CACN,OAAO,OAAO,CAAK,CACrB,CACF,CAGA,SAAS,EAAiB,EAAyC,CACjE,IAAM,EAAiC,CAAC,EACxC,IAAK,IAAM,KAAO,EAAkB,CAClC,IAAM,EAAS,EAAmC,GAC9C,IAAU,IAAA,IAAa,EAAY,CAAK,IAC1C,EAAM,GAAO,EAEjB,CAGA,GAAI,CAAC,EAAyB,EAAM,UAAa,EAAG,CAClD,IAAM,EAAa,EAAuB,CAAM,EAC5C,IAAe,IAAA,KACjB,EAAM,WAAgB,EAE1B,CACA,OAAO,CACT,CAEA,SAAgB,EAAY,EAAgB,EAAgB,EAA4B,CACtF,GAAI,EAAY,CAAK,EACnB,OAAO,EAET,IAAM,EAAQ,GACZ,EAAQ,GAAK,IAAU,IAAA,GAAY,EAAY,EAAO,EAAQ,CAAC,EAAI,IAAA,GACrE,GAAI,aAAiB,MACnB,MAAO,CACL,UAAW,GACX,KAAM,EAAM,KACZ,QAAS,EAAM,QACf,MAAO,EAAM,MACb,MAAO,EAAiB,CAAK,EAC7B,MAAO,EAAK,EAAM,KAAK,CACzB,EAEF,GAAI,OAAO,GAAU,UAAY,EAAgB,CAG/C,GAAM,CAAE,UAAS,SAAU,EAC3B,MAAO,CACL,UAAW,GACX,KAAM,QACN,QAAS,OAAO,GAAY,SAAW,EAAU,EAAkB,CAAK,EACxE,MAAO,IAAA,GACP,MAAO,EAAiB,CAAK,EAC7B,MAAO,EAAK,CAAK,CACnB,CACF,CACA,MAAO,CACL,UAAW,GACX,KAAM,QACN,QAAS,OAAO,GAAU,SAAW,EAAQ,EAAkB,CAAK,EACpE,MAAO,IAAA,GACP,MAAO,CAAC,EACR,MAAO,IAAA,EACT,CACF,CAOA,SAAgB,EAAc,EAAwB,CACpD,IAAM,EAAY,MAAM,EAAK,QAAS,EAAK,MAAQ,CAAE,MAAO,EAAc,EAAK,KAAK,CAAE,EAAI,CAAC,CAAC,EAM5F,MALA,GAAM,KAAO,EAAK,KACd,EAAK,QAAU,IAAA,KACjB,EAAM,MAAQ,EAAK,OAErB,OAAO,OAAO,EAAO,EAAK,KAAK,EACxB,CACT,CChPA,SAAgB,IAA8B,CAI5C,OAAO,IAAI,OAAO,IAAI,IAAI,sBAAuB,OAAO,KAAK,GAAG,EAAG,CACjE,KAAM,SACN,KAAM,kBACR,CAAC,CACH,CCeA,MAAa,EAAyD,CACpE,MAAO,IACP,KAAM,GACR,EASM,EAAmB,IAAI,QAG7B,IAAM,EAAN,cAAqC,KAAM,CAEzC,QAEA,YAAY,EAAiB,EAAyD,CACpF,MAAM,EAAS,CAAO,EACtB,KAAK,KAAO,yBACZ,KAAK,QAAU,GAAS,SAAW,EACrC,CACF,EAOA,SAAS,GAAe,EAAyB,CAC/C,GAAI,OAAO,GAAU,WAAY,EAC/B,MAAO,GAET,GAAM,CAAE,OAAM,WAAY,EAC1B,OACE,IAAS,kBACR,IAAS,aACR,OAAO,GAAY,UACnB,EAAQ,SAAS,6BAA6B,CAEpD,CAEA,SAAS,EAAe,EAAuC,CAC7D,GAAI,GAAQ,QACV,MAAM,EAAO,QAAU,IAAI,aAAa,6BAA8B,YAAY,CAEtF,CAWA,MAAM,EAA2B,CAAE,MAAO,EAAG,KAAM,IAAA,GAAW,UAAW,EAAG,EAO5E,SAAS,GAAe,EAGtB,CACA,GAAI,IAAQ,IAAA,GACV,MAAO,CAAE,MAAK,UAAW,CAAC,CAAE,EAE9B,IAAM,EAAiB,EAAI,eAAe,MACpC,EAAW,EAAI,SAAS,MAC9B,GAAI,EAAE,aAA0B,aAAe,EAAE,aAAoB,YACnE,MAAO,CAAE,MAAK,UAAW,CAAC,CAAE,EAI9B,IAAM,EAAgB,EAAe,MAAM,EACrC,EAAU,EAAS,MAAM,EAC/B,MAAO,CACL,IAAK,CACH,GAAG,EACH,eAAgB,CAAE,GAAG,EAAI,eAAgB,MAAO,CAAc,EAC9D,SAAU,CAAE,GAAG,EAAI,SAAU,MAAO,CAAQ,CAC9C,EACA,UAAW,CAAC,EAAc,OAAuB,EAAQ,MAAqB,CAChF,CACF,CA4BA,SAAS,IAA2C,CAClD,IAAI,EACE,EAAS,IAAI,SAAgB,EAAU,IAAW,CACtD,EAAO,CACT,CAAC,EAID,OADA,EAAO,UAAY,CAAC,CAAC,EACd,CAAE,YAAa,IAAA,GAAW,OAAQ,IAAA,GAAW,IAAK,IAAA,GAAW,SAAQ,MAAK,CACnF,CAgCA,IAAa,GAAb,KAAkE,CAChE,GAEA,GAEA,GAAgB,GAChB,GAAyB,EAEzB,GAAY,EAEZ,GAA8B,IAAI,IAElC,GAEA,GAAU,EACV,GAAoB,GAEpB,YAAY,EAAmC,CAC7C,KAAKA,GAAU,CACjB,CAEA,SAA4B,CAI1B,IAAM,EAAc,KAAKE,KAAgB,GAAuB,EAChE,GAAI,EAAW,cAAgB,IAAA,GAAW,CAGxC,IAAM,EAAyB,KAAKC,OAAkB,KAAKC,GAAU,CAAU,CAAC,CAAC,CAAC,MAC/E,GAAmB,CAIlB,MAHI,EAAW,cAAgB,IAC7B,EAAW,YAAc,IAAA,IAErB,CACR,CACF,EACA,EAAW,YAAc,CAC3B,CACA,OAAO,EAAW,WACpB,EAEA,aAAuD,GACrD,KAAKD,OACH,KAAKE,GACF,GAAY,EAAQ,aAAa,CAAU,GAG3C,EAAK,EAAI,IAAY,EAAI,aAAa,EAAI,CAAE,GAAG,EAAY,SAAQ,CAAC,EACrE,EAAW,OACb,CACF,EAEF,cAAyD,GACvD,KAAKF,OACH,KAAKE,GACF,GAAY,EAAQ,cAAc,CAAU,GAC5C,EAAK,EAAI,IAAY,EAAI,cAAc,EAAI,CAAE,GAAG,EAAY,SAAQ,CAAC,EACtE,EAAW,OACb,CACF,EAYF,SAAgB,CACd,KAAKC,GAAoB,GACzB,KAAKC,GAAe,CACtB,CAQA,KAAMF,GACJ,EACA,EAKA,EACY,CACZ,GAAM,CAAE,SAAQ,aAAY,GAAG,GAAY,GAAe,CAAC,EAE3D,EAAe,CAAM,EACrB,MAAM,KAAK,KAAK,EAEhB,EAAe,CAAM,EACrB,IAAM,EAAa,KAAKH,GAClB,EAAM,GAAY,IAGxB,GAAI,KAAKM,KAAoB,IAAA,KAAc,KAAKC,IAAiB,IAAQ,IAAA,IACvE,OAAO,EAAO,MAAM,KAAKD,EAAe,EAE1C,GAAI,IAAe,IAAA,IAAa,IAAQ,IAAA,GACtC,OAAO,EACL,MAAM,KAAKE,GACT,EACA,KAAKC,GAAS,MAAQ,IAAI,EAAuB,6BAA6B,CAChF,CACF,EAEF,IAAM,EAAK,KAAKC,KACV,MAAgB,KAAK,EAAI,MAAM,CAAE,CAAC,CAAC,UAAY,CAAC,CAAC,EACvD,GAAQ,iBAAiB,QAAS,EAAS,CAAE,KAAM,EAAK,CAAC,EACrD,GACF,KAAKX,GAAmB,IAAI,EAAI,CAAgD,EAElF,GAAI,CACF,IAAM,EAAS,MAAM,KAAKY,GAAc,EAAY,EAAW,EAAK,EAAI,CAAO,CAAC,EAIhF,MADA,MAAKF,GAAW,EACT,CACT,OAAS,EAAO,CACd,GAAI,aAAiB,EACnB,OAAO,EAAO,MAAM,KAAKD,GAAS,EAAY,CAAK,CAAC,EAEtD,MAAM,CACR,QAAU,CACR,KAAKT,GAAmB,OAAO,CAAE,EACjC,GAAQ,oBAAoB,QAAS,CAAO,CAC9C,CACF,CAEA,KAAMG,GAAU,EAA6C,CAC3D,GAAI,KAAKK,GAEP,OAEF,IAAM,EAAgB,KAAKT,GAAQ,cACnC,GAAI,IAAkB,IAAA,GAAW,CAG/B,MAAM,KAAKU,GAAS,EAAY,IAAI,EAAuB,CAAa,CAAC,EACzE,MACF,CAIA,IAAM,EAAmB,MAAM,KAAKV,GAAQ,YAAY,EACxD,GAAI,CACF,IAAM,EAAM,MAAM,KAAKc,GAAO,CAAU,EAClC,EAAU,KAAKd,GAAQ,QACvB,EACJ,OAAO,GAAY,SACf,KACA,EAAM,KAAO,IAA+C,CAC1D,GAAI,CACF,OAAO,MAAM,EAAQ,QAAQ,CAAiD,CAChF,OAAS,EAAO,CAId,MAAM,EAAY,CAAK,CACzB,CACF,CAAC,EAGD,EAAM,GAAO,EAAmC,IAAoB,CACxE,GAAI,CACF,KAAKA,GAAQ,OAAO,EAAM,CAAC,CAAO,CACpC,OAAS,EAAO,CACd,KAAKe,GAAmB,SAAU,CAAK,CACzC,CACF,CAAC,EACK,EAAa,GAAO,EAAY,IAA6B,CACjE,GAAI,CACF,KAAKd,GAAmB,IAAI,CAAE,CAAC,GAAG,CAAK,CACzC,OAAS,EAAO,CACd,KAAKc,GAAmB,aAAc,CAAK,CAC7C,CACF,CAAC,EAIK,EAAU,GAAe,CAAgB,EAC/C,MAAM,KAAKF,GACT,EACA,EAAI,KACF,EACE,CACE,GAAG,KAAKb,GAAQ,YAChB,cAAe,CACb,GAAG,KAAKA,GAAQ,YAAY,cAC5B,iBAAkB,EAAQ,GAC5B,EACA,OAAQ,OAAO,GAAY,SAAW,EAAU,IAAA,EAClD,EACA,EAAQ,SACV,EACA,EACA,EACA,CACF,EACA,CAAE,GAAI,KAAKA,GAAQ,SAAS,KAAM,UAAW,MAAO,CACtD,EACA,EAAW,IAAM,EACjB,KAAKW,GAAW,CAAE,GAAG,KAAKA,GAAU,KAAM,IAAA,EAAU,CACtD,OAAS,EAAO,CAId,GAAI,EAAE,aAAiB,GAErB,MADA,KAAKK,GAAU,EAAY,IAAI,EAAuB,6BAA6B,CAAC,EAC9E,EAER,MAAM,KAAKN,GAAS,EAAY,CAAK,CACvC,CACF,CAGA,GAAmB,EAAkB,EAAsB,CACzD,IAAM,EAAS,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EACpE,GAAI,CACF,KAAKV,GAAQ,OAAO,KAAK,mBAAmB,EAAS,mBAAmB,GAAQ,CAClF,MAAQ,CAER,CACF,CAOA,KAAMG,GAAe,EAAoC,CACvD,KAAKc,KACL,GAAI,CACF,OAAO,MAAM,EAAK,CACpB,QAAU,CACR,KAAKA,KACL,KAAKV,GAAe,CACtB,CACF,CAEA,IAAuB,CACjB,CAAC,KAAKD,IAAqB,KAAKW,GAAU,IAG9C,KAAKX,GAAoB,GACzB,KAAKJ,IAAa,QAAQ,UAAU,EAGpC,KAAKA,GAAc,IAAA,GACnB,KAAKM,GAAkB,IAAA,GACvB,KAAKC,GAAgB,GACrB,KAAKE,GAAW,EAClB,CAEA,IAAwB,CACtB,IAAM,EAAS,KAAKX,GAAQ,aAC5B,GAAI,IAAW,IAAA,GACb,OAAO,GAAoB,EAE7B,GAAI,OAAO,GAAW,WAAY,CAChC,IAAM,EAAS,EAAO,EAStB,OANI,EAAiB,IAAI,CAAM,GAC7B,KAAKA,GAAQ,OAAO,WAClB,6GACF,EAEF,EAAiB,IAAI,CAAM,EACpB,CACT,CACA,OAAO,IAAI,OAAO,EAAQ,CAAE,KAAM,SAAU,KAAM,kBAAmB,CAAC,CACxE,CAGA,KAAMc,GAAO,EAAiE,CAC5E,IAAI,EACJ,GAAI,CACF,EAAS,KAAKI,GAAc,CAC9B,OAAS,EAAO,CAGd,MAAM,IAAI,EAAuB,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EAAG,CACvF,MAAO,CACT,CAAC,CACH,CACA,EAAW,OAAS,EACpB,IAAM,EAAM,MAAM,KAAKC,GAAW,EAAY,CAAM,EAEpD,OADA,KAAKC,GAAiB,EAAY,CAAM,EACjC,CACT,CAGA,GAAW,EAA8B,EAAmD,CAC1F,OAAO,IAAI,SAAmC,EAAS,IAAW,CAChE,IAAM,MAAe,CACnB,aAAa,CAAK,EAClB,EAAO,oBAAoB,UAAW,CAAO,EAC7C,EAAO,oBAAoB,QAAS,CAAO,CAC7C,EACM,EAAQ,eAAiB,CAC7B,EAAO,EACP,EACE,IAAI,EACF,uCAAuC,KAAKpB,GAAQ,SAAS,MAAM,IACrE,CACF,CACF,EAAG,KAAKA,GAAQ,SAAS,KAAK,EACxB,EAAW,GAAwB,CACnC,EAAM,OAAA,8BACR,EAAO,EACP,EAAQ,EAAuB,CAAM,CAAC,EAE1C,EACM,EAAW,GAAsB,CACrC,EAAO,EACP,IAAM,EAAU,EAAM,SAAW,wBAGjC,EAAO,IAAI,EAAuB,CAAO,CAAC,EAC1C,KAAKgB,GAAU,EAAY,IAAI,EAAuB,CAAO,CAAC,CAChE,EACA,EAAO,iBAAiB,UAAW,CAAO,EAC1C,EAAO,iBAAiB,QAAS,CAAO,CAC1C,CAAC,CACH,CAGA,GAAiB,EAA8B,EAAsB,CACnE,EAAO,iBAAiB,QAAU,GAAsB,CAGtD,GAAI,KAAKd,KAAgB,EACvB,OAKF,IAAM,EAAQ,IAAI,EAAuB,EAAM,SAAW,wBAAyB,CACjF,QAAS,EACX,CAAC,EACD,KAAKS,GAAW,CAAE,GAAG,KAAKA,GAAU,MAAO,KAAKA,GAAS,MAAQ,EAAG,KAAM,CAAM,EAChF,KAAKK,GAAU,EAAY,CAAK,CAClC,CAAC,CACH,CAUA,KAAMH,GACJ,EACA,EACA,EACY,CACZ,IAAM,EACJ,IAAa,IAAA,GACT,IAAA,GACA,eAAiB,CACf,KAAKG,GACH,EACA,IAAI,EACF,kBAAkB,EAAS,UAAU,mBAAmB,EAAS,GAAG,IACtE,CACF,CACF,EAAG,EAAS,EAAE,EACpB,GAAI,CACF,OAAO,MAAM,QAAQ,KAAK,CACxB,EAAK,MAAO,GAAmB,CAC7B,IAAM,EAAU,EAAY,CAAK,EAAI,EAAc,CAAK,EAAK,EAG7D,MAAM,GAAe,CAAO,EACxB,IAAI,EAAuB,EAAQ,QAAS,CAAE,MAAO,CAAQ,CAAC,EAC9D,CACN,CAAC,EACD,EAAW,MACb,CAAC,CACH,QAAU,CACJ,IAAU,IAAA,IACZ,aAAa,CAAK,CAEtB,CACF,CAQA,GAAU,EAA0C,EAAqC,CACnF,IAAe,IAAA,KAGf,KAAKd,KAAgB,IACvB,KAAKA,GAAc,IAAA,IAErB,EAAW,QAAQ,UAAU,EAC7B,EAAW,OAAS,IAAA,GACpB,EAAW,IAAM,IAAA,GACjB,EAAW,YAAc,IAAA,GACzB,EAAW,KAAK,CAAK,EACvB,CAEA,KAAMQ,GACJ,EACA,EACgC,CAChC,IAAM,EAAS,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EACpE,GAAI,KAAKV,GAAQ,OAEf,MADA,KAAKgB,GAAU,EAAY,IAAI,EAAuB,6BAA6B,CAAC,EAC9E,IAAI,EACR,oEAAoE,IACpE,CAAE,OAAM,CACV,EAEF,GAAM,CAAE,YAAW,WAAY,KAAKK,GAAiB,CAAK,EAI1D,GAHA,KAAKZ,KAAkB,CAAC,EACxB,KAAKO,GAAU,EAAY,IAAI,EAAuB,oCAAoC,CAAC,EAC3F,KAAKM,GAAc,EAAQ,EAAW,CAAO,EACzC,KAAKd,KAAoB,IAAA,GAAW,CAGtC,IAAM,GAA2C,SAAY,CAC3D,IAAM,EAAS,KAAKR,GAAQ,mBAAmB,EAE/C,OADA,MAAM,EAAO,KAAK,EACX,CACT,EAAA,CAAG,CAAC,CAAC,MAAO,GAAmB,CAO7B,MANI,KAAKQ,KAAoB,IAC3B,KAAKA,GAAkB,IAAA,IAEzB,KAAKR,GAAQ,OAAO,WAClB,iDAAiD,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,GACxG,EACM,CACR,CAAC,EACD,KAAKQ,GAAkB,CACzB,CACA,OAAO,KAAKA,EACd,CAQA,GAAiB,EAA4E,CAC3F,IAAM,EACJ,aAAiB,GACjB,EAAM,SACN,KAAKG,GAAS,MAAQ,EACxB,MAAO,CAAE,YAAW,QAAS,CAAC,GAAa,CAAC,KAAKF,EAAc,CACjE,CAGA,GAAc,EAAgB,EAAoB,EAAwB,CACxE,GAAI,CAAC,GAAW,KAAKE,GAAS,YAAc,KAAKA,GAAS,MACxD,OAEF,KAAKA,GAAW,CAAE,GAAG,KAAKA,GAAU,UAAW,KAAKA,GAAS,KAAM,EACnE,IAAM,EAAQ,EAAY,kCAAoC,wBAG9D,KAAKX,GAAQ,OAAO,WAClB,gCAAmC,EAAM,0BAA0B,GACrE,CACF,CACF,ECrkBa,GAAb,KAAgD,CAC9C,GACA,GACA,GACA,GACA,GACA,GAOA,YAAY,EAA4B,CACtC,KAAKuB,GAAS,EAAO,MACrB,GAAM,CAAE,UAAS,QAAO,gBAAe,iBAAgB,oBACrD,EAAO,SAAW,CAAC,EACf,EAAO,KAAKA,GAAO,KAAO,GAAY,KAAKA,GAAO,IAAI,EAAI,IAAA,GAK1D,EAAS,CACb,aAAc,EAAmB,CAAE,UAJnC,OAAO,KAAKA,GAAO,SAAY,SAC3B,EAAK,KAAKA,GAAO,OAAO,EACxB,EAAO,KAAKA,GAAO,OAAO,CAEe,CAAC,EAC9C,MAAO,GAAa,KAAKA,EAAM,EAC/B,QAAS,CAAE,gBAAe,iBAAgB,kBAAiB,CAC7D,EACA,KAAKI,GAAkB,CACrB,GAAI,IAAS,IAAA,IAAa,CAAE,MAAK,EACjC,GAAI,IAAY,IAAA,IAAa,CAAE,SAAQ,EACvC,GAAI,IAAU,IAAA,IAAa,CAAE,OAAM,CACrC,EAIA,IAAM,MACJ,KAAKH,GAAM,2BAA2B,CAAE,QAAS,KAAKG,EAAgB,CAAC,EAGnE,EAAkB,IAAsD,CAC5E,KAAM,SAAY,CAChB,MAAM,EAAY,EAClB,MAAM,EAAO,KAAK,CACpB,EACA,aAAe,GAAe,EAAO,aAAa,CAAU,EAC5D,cAAgB,GAAe,EAAO,cAAc,CAAU,EAC9D,2BAA6B,GAAe,EAAO,2BAA2B,CAAU,CAC1F,GACI,EAAO,WACT,KAAKH,GAAQ,EAA+B,CAAM,EAClD,KAAKC,GAAW,EAAkC,CAAM,EACxD,KAAKC,GAAW,EAAe,EAAkC,CAAM,CAAC,IAExE,KAAKF,GAAQ,GAAsB,CAAM,EACzC,KAAKC,GAAW,EAAyB,CAAM,EAC/C,KAAKC,GAAW,KAAKE,GAAqB,EAAQ,EAAQ,CACxD,cACA,uBAA0B,EAAe,GAAyB,CAAM,CAAC,CAC3E,CAAC,EAEL,CAMA,GACE,EACA,EACA,EAIqB,CACrB,IAAM,EAAU,EAAO,gBAAkB,GACnC,EAAS,IAAY,GACrB,EACJ,OAAO,QAAW,aACjB,EAAO,gBAAkB,IAAA,IAAA,IAK5B,GAAI,IAAY,IAAS,EAAE,GAAU,GACnC,OAAO,EAAO,mBAAmB,EAEnC,IAAM,EAAU,EAAsB,EAChC,EAAU,GAAsB,CAAO,EAC7C,GAAI,IAAY,IAAA,IAAa,CAAC,EAI5B,OADA,EAAO,OAAO,WAAW,0CAA0C,EAAQ,EAAE,EACtE,EAAO,mBAAmB,EAEnC,IAAM,EAAe,IAAI,GAAoB,CAC3C,YAAa,CAAE,MAAO,EAAO,MAAO,cAAe,EAAO,QAAS,QAAS,GAAW,CAAC,CAAE,EAC1F,QAAS,KAAKL,GAAO,QACrB,YAAa,EAAO,YACpB,mBAAoB,EAAO,mBAC3B,OAAQ,EAAO,OACf,SAAU,EAAO,iBAAmB,EACpC,aAAc,EAAO,cAGrB,cAAe,EACf,QACF,CAAC,EACD,MAAO,CACL,SAAY,EAAa,KAAK,EAC9B,aAAe,GAAe,EAAa,aAAa,CAAU,EAClE,cAAgB,GAAe,EAAa,cAAc,CAAU,EAIpE,2BAA6B,GAAe,KAAKC,GAAM,2BAA2B,CAAU,EAC5F,YAAe,EAAa,QAAQ,CACtC,CACF,CAGA,IAAI,OAAQ,CACV,OAAO,KAAKD,EACd,CAIA,QACE,KAAKM,KAAwB,KAAKH,GAAS,KAAK,CAAC,CAAC,MAAO,GAAmB,CAE1E,KADA,MAAKG,GAAsB,IAAA,GACrB,CACR,CAAC,EACM,KAAKA,IAOd,YAAsB,CACpB,KAAKA,GAAsB,IAAA,GAC3B,KAAKH,GAAS,UAAU,CAC1B,EAcA,mBAAwD,KAAO,KAC7D,MAAM,KAAKF,GAAM,KAAK,EACf,KAAKA,GAAM,mBAAmB,CACnC,GAAG,EACH,QAAS,CAAE,GAAG,KAAKG,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAeH,oBAA0D,KAAO,KAC/D,MAAM,KAAKH,GAAM,KAAK,EACf,KAAKA,GAAM,oBAAoB,CACpC,GAAG,EACH,QAAS,CAAE,GAAG,KAAKG,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAeH,kCAAsF,KACpF,KAEA,MAAM,KAAKH,GAAM,KAAK,EACf,KAAKA,GAAM,kCAAkC,CAClD,GAAG,EACH,QAAS,CAAE,GAAG,KAAKG,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAkBH,aAA4C,KAAO,KACjD,MAAM,KAAKG,GAAa,EACjB,KAAKJ,GAAS,aAAa,CAChC,GAAG,EACH,QAAS,CAAE,GAAG,KAAKC,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAoBH,cAA8C,KAAO,KACnD,MAAM,KAAKG,GAAa,EACjB,KAAKJ,GAAS,cAAc,CACjC,GAAG,EACH,QAAS,CAAE,GAAG,KAAKC,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAoBH,aAA4C,KAAO,KACjD,MAAM,KAAKF,GAAS,KAAK,EAClB,KAAKA,GAAS,aAAa,CAChC,GAAG,EACH,QAAS,CAAE,GAAG,KAAKE,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAkBH,cAA8C,KAAO,KACnD,MAAM,KAAKF,GAAS,KAAK,EAClB,KAAKA,GAAS,cAAc,CACjC,GAAG,EACH,QAAS,CAAE,GAAG,KAAKE,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAoBH,uBAAgE,KAAO,KACrE,MAAM,KAAKF,GAAS,KAAK,EAClB,KAAKA,GAAS,uBAAuB,CAC1C,GAAG,EACH,QAAS,CAAE,GAAG,KAAKE,GAAiB,GAAG,EAAW,OAAQ,CAC5D,CAAC,GAcH,2BAAwE,KAAO,KAI7E,MAAM,KAAKH,GAAM,KAAK,EACf,KAAKA,GAAM,2BAA2B,CAC3C,GAAG,EACH,QAAS,CAAE,GAAG,KAAKG,GAAiB,GAAG,GAAY,OAAQ,CAC7D,CAAC,GAwBH,qBAA4D,KAAO,KACjE,MAAM,KAAKH,GAAM,KAAK,EACf,KAAKA,GAAM,qBAAqB,CAAU,GAuBnD,2CACG,GAAeO,EAAiD,KAAKP,GAAO,CAAU,EAkBzF,0BAAuE,GACrE,KAAKC,GAAS,0BAA0B,CAAU,EAapD,gCAAmF,GACjF,KAAKD,GAAM,gCAAgC,CAAU,EAcvD,sBAA8D,KAAO,KACnE,MAAM,KAAKC,GAAS,KAAK,EAClB,KAAKA,GAAS,sBAAsB,CAAU,GAmBvD,4BAA0E,KAAO,IAAe,CAC9F,MAAM,KAAKD,GAAM,KAAK,EACtB,GAAM,CAAE,oBAAqB,EAC7B,OAAO,KAAKA,GAAM,4BAA4B,CAC5C,GAAG,EACH,iBAAkB,CAChB,GAAG,EACH,UAAW,GAAoB,EAAiB,SAAS,CAC3D,CACF,CAAC,CACH,EAaA,yBAAoE,UAClE,MAAM,KAAKC,GAAS,KAAK,EAClB,KAAKA,GAAS,yBAAyB,EAElD,EAOA,SAAS,GAAoB,EAA2B,CACtD,GAAI,EAAU,SAAW,IACvB,OAAO,EAET,IAAM,EAAI,SAAS,EAAU,MAAM,GAAG,EAAG,EAAE,EAI3C,OAHI,IAAM,GAAK,IAAM,EACZ,EAEF,GAAG,EAAU,MAAM,EAAG,GAAG,IAAI,IAAM,EAAI,KAAO,MACvD,CAMA,SAAS,GAAsB,EAA4D,CAGzF,GAAI,EAAqB,EACvB,MAAO,gEAIT,GAAI,IAAY,IAAA,IAAa,EAAsB,EACjD,MAAO,4FAGX,CAQA,SAAS,GACP,EAC0C,CAC1C,IAAM,EAAO,EAAK,OAClB,OAAQ,EAAR,CACE,IAAK,eACH,MAAO,CAAE,OAAM,MAAO,EAAK,MAAO,OAAQ,EAAK,MAAO,EACxD,IAAK,eACH,MAAO,CAAE,OAAM,MAAO,EAAK,MAAO,OAAQ,EAAK,MAAO,EACxD,IAAK,cACH,MAAO,CAAE,OAAM,MAAO,EAAK,KAAM,EACnC,QACE,MAAM,IAAI,EAAmB,sBAAsB,OAAO,CAAI,GAAG,CACrE,CACF"}

package/dist/esm/{index-CnIEp8zv.d.ts → index-DlpdjcMQ.d.ts}

@@ -19789,6 +19789,8 @@ declare const ZamaErrorCode: {
   readonly DelegationExpiryUnchanged: "DELEGATION_EXPIRY_UNCHANGED";
   /** Delegate address cannot be the contract address. */
   readonly DelegationDelegateEqualsContract: "DELEGATION_DELEGATE_EQUALS_CONTRACT";
+  /** Delegate address cannot be the wildcard address — it's only valid as `contractAddress`. */
+  readonly DelegationDelegateCannotBeWildcard: "DELEGATION_DELEGATE_CANNOT_BE_WILDCARD";
   /** Contract address cannot be the sender address. */
   readonly DelegationContractIsSelf: "DELEGATION_CONTRACT_IS_SELF";
   /** The ACL contract is paused. */
@@ -20000,6 +20002,10 @@ declare class DelegationExpiryUnchangedError extends ZamaError {
 declare class DelegationDelegateEqualsContractError extends ZamaError {
   constructor(message: string, options?: ErrorOptions);
 }
+/** Delegate address cannot be the wildcard address — it's only valid as `contractAddress`. */
+declare class DelegationDelegateCannotBeWildcardError extends ZamaError {
+  constructor(message: string, options?: ErrorOptions);
+}
 /** Contract address cannot be the sender address. */
 declare class DelegationContractIsSelfError extends ZamaError {
   constructor(message: string, options?: ErrorOptions);
@@ -20358,6 +20364,8 @@ interface ErrorForCode {
   [ZamaErrorCode.DelegationExpiryUnchanged]: DelegationExpiryUnchangedError;
   /** Thrown for {@link ZamaErrorCode.DelegationDelegateEqualsContract}. */
   [ZamaErrorCode.DelegationDelegateEqualsContract]: DelegationDelegateEqualsContractError;
+  /** Thrown for {@link ZamaErrorCode.DelegationDelegateCannotBeWildcard}. */
+  [ZamaErrorCode.DelegationDelegateCannotBeWildcard]: DelegationDelegateCannotBeWildcardError;
   /** Thrown for {@link ZamaErrorCode.DelegationContractIsSelf}. */
   [ZamaErrorCode.DelegationContractIsSelf]: DelegationContractIsSelfError;
   /** Thrown for {@link ZamaErrorCode.AclPaused}. */
@@ -20569,7 +20577,7 @@ declare class Permits {
 }
 //#endregion
 //#region src/services/delegation-service.d.ts
-/** Delegation activity and expiry, resolved from a single expiry read. */
+/** Delegation activity and expiry, resolved from the active contract or wildcard grant. */
 interface DelegationStatus {
   /** Whether the delegation is currently active (exists and not expired). */
   isActive: boolean;
@@ -20602,7 +20610,8 @@ declare class Delegations {
    * window with a bounded internal retry, so you can decrypt right after this
    * resolves.
    *
-   * @param contractAddress - The confidential contract address to delegate on.
+   * @param contractAddress - The confidential contract address to delegate on, or
+   *   {@link WILDCARD_CONTRACT} to cover every contract with a single delegation.
    * @param delegateAddress - Address to delegate decryption rights to.
    * @param expirationDate - Optional expiration date (defaults to permanent delegation via `uint64.max`).
    * @returns The transaction hash and mined receipt.
@@ -20610,6 +20619,7 @@ declare class Delegations {
    * @throws if signer and provider are on different chains. {@link ChainMismatchError}
    * @throws if `expirationDate` is less than 1 hour in the future. {@link DelegationExpirationTooSoonError}
    * @throws if the delegate equals the connected wallet. {@link DelegationSelfNotAllowedError}
+   * @throws if the delegate is the wildcard address. {@link DelegationDelegateCannotBeWildcardError}
    * @throws if the delegate equals the contract address. {@link DelegationDelegateEqualsContractError}
    * @throws if the new expiry equals the current one. {@link DelegationExpiryUnchangedError}
    * @throws if the delegation transaction reverts. {@link TransactionRevertedError}
@@ -22568,5 +22578,5 @@ declare class Decryption {
   } & DelegatedDecryptOptions): Promise<BatchDecryptResult>;
 }
 //#endregion
-export { confidentialTransferFromMutationOptions as $, DelegationSelfNotAllowedError as $n, isOperatorContract as $r, invalidateAfterSetOperator as $t, DelegatedDecryptValuesMutationParams as A, WalletNotConnectedError as An, delegateForUserDecryptionContract as Ar, confidentialIsOperatorQueryOptions as At, ResumeUnshieldParams as B, InsufficientERC20BalanceError as Bn, supportsInterfaceContract as Br, WrappersRegistryConfig as Bt, HasPermitQueryConfig as C, TransactionRevertedError as Cn, getConfidentialTokenAddressContract as Cr, ConfidentialBalanceQueryConfig as Ct, preparePermitMutationOptions as D, SignerNotConfiguredError as Dn, getTokenPairsLengthContract as Dr, BatchDecryptAsOptions as Dt, registerPermitMutationOptions as E, SigningRejectedError as En, getTokenPairsContract as Er, BatchBalancesResult as Et, unwrapAllMutationOptions as F, BalanceCheckUnavailableError as Fn, ERC1363_INTERFACE_ID as Fr, WrapperDiscoveryQueryConfig as Ft, unshieldMutationOptions as G, DelegationContractIsSelfError as Gn, nameContract as Gr, isWrapperQueryOptions as Gt, UnshieldAllParams as H, EncryptOffloadUnavailableError as Hn, approveContract as Hr, totalSupplyQueryOptions as Ht, WrapParams as I, BalanceErrorDetails as In, ERC7984_INTERFACE_ID as Ir, wrapperDiscoveryQueryOptions as It, ConfidentialSetOperatorParams as J, DelegationExpirationTooSoonError as Jn, confidentialTotalSupplyContract as Jr, tokenMetadataQueryOptions as Jt, ApproveUnderlyingParams as K, DelegationCooldownError as Kn, symbolContract as Kr, TokenMetadata as Kt, wrapMutationOptions as L, ERC20ReadFailedError as Ln, ERC7984_WRAPPER_INTERFACE_ID as Lr, DefaultRegistryAddresses as Lt, encryptMutationOptions as M, NotEntitledError as Mn, isHandleDelegatedContract as Mr, pendingUnshieldQueryOptions as Mt, FinalizeUnwrapParams as N, ConfigurationError as Nn, revokeDelegationContract as Nr, UnderlyingAllowanceQueryConfig as Nt, grantPermitMutationOptions as O, SignerRequiredError as On, getTokenPairsSliceContract as Or, Token as Ot, finalizeUnwrapMutationOptions as P, RelayerRequestFailedError as Pn, transferAndCallContract as Pr, underlyingAllowanceQueryOptions as Pt, ConfidentialTransferFromParams as Q, DelegationNotPropagatedError as Qn, inferredTotalSupplyContract as Qr, invalidateAfterApproveUnderlying as Qt, UnwrapParams as R, InsufficientAllowanceError as Rn, isConfidentialTokenContract as Rr, ListPairsOptions as Rt, revokePermitsMutationOptions as S, UnshieldAlreadyFinalizedError as Sn, TokenWrapperPairWithMetadata as Sr, confidentialBalancesQueryOptions as St, RegisterPermitParams as T, SigningFailedError as Tn, getTokenPairContract as Tr, WrappedToken as Tt, unshieldAllMutationOptions as U, EncryptionFailedError as Un, balanceOfContract as Ur, IsConfidentialQueryConfig as Ut, resumeUnshieldMutationOptions as V, DecryptionFailedError as Vn, allowanceContract as Vr, TotalSupplyQueryConfig as Vt, UnshieldParams as W, AclPausedError as Wn, decimalsContract as Wr, isConfidentialQueryOptions as Wt, ConfidentialTransferFromAndCallParams as X, DelegationExpiryUnchangedError as Xn, confidentialTransferFromContract as Xr, QueryFilterLike as Xt, confidentialSetOperatorMutationOptions as Y, DelegationExpiredError as Yn, confidentialTransferContract as Yr, QueryClientLike as Yt, confidentialTransferFromAndCallMutationOptions as Z, DelegationNotFoundError as Zn, finalizeUnwrapContract as Zr, QueryLike as Zt, DecryptBalanceAsParams as _, DelegationStatus as _n, SerializedPermitEip712 as _r, tokenPairQueryOptions as _t, ZamaSDK as a, unwrapRequesterContract as ai, invalidateAfterWrap as an, RevokedKmsContextError as ar, shieldMutationOptions as at, delegateDecryptionMutationOptions as b, matchZamaError as bn, PaginatedResult as br, tokenPairsSliceQueryOptions as bt, BatchDecryptItem as c, invalidateWalletLifecycleQueries as cn, ChainMismatchError as cr, ListPairsQueryConfig as ct, DelegationStatusQueryConfig as d, MutationFactoryOptions as dn, isRetryable as dr, TokenPairsSliceQueryConfig as dt, rateContract as ei, invalidateAfterShield as en, InvalidTransportKeyPairError as er, ConfidentialTransferAndCallParams as et, delegationStatusQueryOptions as f, QueryFactoryOptions as fn, retryAfterSeconds as fr, WrappersRegistryQueryConfig as ft, batchDecryptBalancesAsMutationOptions as g, Delegations as gn, SerializedPermit as gr, tokenAddressQueryOptions as gt, BatchDecryptBalancesAsParams as h, hashFn as hn, PreparedPermit as hr, listPairsQueryOptions as ht, decryptValuesQueryOptions as i, unwrapFromBalanceContract as ii, invalidateAfterUnwrap as in, PreparedPermitExpiredError as ir, ShieldParams as it, delegatedDecryptValuesMutationOptions as j, RpcRateLimitError as jn, getDelegationExpiryContract as jr, PendingUnshieldQueryConfig as jt, decryptPublicValuesMutationOptions as k, WalletAccountNotReadyError as kn, isConfidentialTokenValidContract as kr, ConfidentialIsOperatorQueryConfig as kt, BatchDecryptResult as l, zamaQueryKeys as ln, ZamaError as lr, TokenAddressQueryConfig as lt, revokeDelegationMutationOptions as m, filterQueryOptions as mn, PreparePermitRequest as mr, isConfidentialTokenValidQueryOptions as mt, DecryptResult as n, underlyingContract as ni, invalidateAfterUnshield as nn, NoCiphertextError as nr, ConfidentialTransferParams as nt, ZamaSDKOptions as o, wrapContract as oi, invalidateBalanceQueries as on, TransportKeyPairChangedError as or, ConfidentialTokenAddressQueryConfig as ot, RevokeDelegationParams as p, StrippedQueryOptionKeys as pn, Permission as pr, confidentialTokenAddressQueryOptions as pt, approveUnderlyingMutationOptions as q, DelegationDelegateEqualsContractError as qn, confidentialBalanceOfContract as qr, TokenMetadataQueryConfig as qt, EncryptedInput as r, unwrapContract as ri, invalidateAfterUnshieldSettled as rn, PreparedPermitChainMismatchError as rr, confidentialTransferMutationOptions as rt, Offline as s, createConfig as si, invalidateWagmiBalanceQueries as sn, TransportKeyPairExpiredError as sr, IsConfidentialTokenValidQueryConfig as st, Decryption as t, setOperatorContract as ti, invalidateAfterTransfer as tn, KeyWrappingError as tr, confidentialTransferAndCallMutationOptions as tt, DelegatedDecryptOptions as u, SignerQueryContext as un, ZamaErrorCode as ur, TokenPairQueryConfig as ut, decryptBalanceAsMutationOptions as v, Permits as vn, SerializedTransportKeyPair as vr, tokenPairsLengthQueryOptions as vt, hasPermitQueryOptions as w, SigningErrorMetadata as wn, getTokenAddressContract as wr, confidentialBalanceQueryOptions as wt, clearCredentialsMutationOptions as x, UnshieldAlreadyFinalizedDetails as xn, TokenWrapperPair as xr, ConfidentialBalancesQueryConfig as xt, DelegateDecryptionParams as y, ErrorForCode as yn, ChecksummedAddress as yr, tokenPairsQueryOptions as yt, unwrapMutationOptions as z, InsufficientConfidentialBalanceError as zn, isConfidentialWrapperContract as zr, WrappersRegistry as zt };
-//# sourceMappingURL=index-CnIEp8zv.d.ts.map
+export { confidentialTransferFromMutationOptions as $, DelegationNotPropagatedError as $n, inferredTotalSupplyContract as $r, invalidateAfterSetOperator as $t, DelegatedDecryptValuesMutationParams as A, WalletNotConnectedError as An, isConfidentialTokenValidContract as Ar, confidentialIsOperatorQueryOptions as At, ResumeUnshieldParams as B, InsufficientERC20BalanceError as Bn, isConfidentialWrapperContract as Br, WrappersRegistryConfig as Bt, HasPermitQueryConfig as C, TransactionRevertedError as Cn, TokenWrapperPairWithMetadata as Cr, ConfidentialBalanceQueryConfig as Ct, preparePermitMutationOptions as D, SignerNotConfiguredError as Dn, getTokenPairsContract as Dr, BatchDecryptAsOptions as Dt, registerPermitMutationOptions as E, SigningRejectedError as En, getTokenPairContract as Er, BatchBalancesResult as Et, unwrapAllMutationOptions as F, BalanceCheckUnavailableError as Fn, transferAndCallContract as Fr, WrapperDiscoveryQueryConfig as Ft, unshieldMutationOptions as G, DelegationContractIsSelfError as Gn, decimalsContract as Gr, isWrapperQueryOptions as Gt, UnshieldAllParams as H, EncryptOffloadUnavailableError as Hn, allowanceContract as Hr, totalSupplyQueryOptions as Ht, WrapParams as I, BalanceErrorDetails as In, ERC1363_INTERFACE_ID as Ir, wrapperDiscoveryQueryOptions as It, ConfidentialSetOperatorParams as J, DelegationDelegateEqualsContractError as Jn, confidentialBalanceOfContract as Jr, tokenMetadataQueryOptions as Jt, ApproveUnderlyingParams as K, DelegationCooldownError as Kn, nameContract as Kr, TokenMetadata as Kt, wrapMutationOptions as L, ERC20ReadFailedError as Ln, ERC7984_INTERFACE_ID as Lr, DefaultRegistryAddresses as Lt, encryptMutationOptions as M, NotEntitledError as Mn, getDelegationExpiryContract as Mr, pendingUnshieldQueryOptions as Mt, FinalizeUnwrapParams as N, ConfigurationError as Nn, isHandleDelegatedContract as Nr, UnderlyingAllowanceQueryConfig as Nt, grantPermitMutationOptions as O, SignerRequiredError as On, getTokenPairsLengthContract as Or, Token as Ot, finalizeUnwrapMutationOptions as P, RelayerRequestFailedError as Pn, revokeDelegationContract as Pr, underlyingAllowanceQueryOptions as Pt, ConfidentialTransferFromParams as Q, DelegationNotFoundError as Qn, finalizeUnwrapContract as Qr, invalidateAfterApproveUnderlying as Qt, UnwrapParams as R, InsufficientAllowanceError as Rn, ERC7984_WRAPPER_INTERFACE_ID as Rr, ListPairsOptions as Rt, revokePermitsMutationOptions as S, UnshieldAlreadyFinalizedError as Sn, TokenWrapperPair as Sr, confidentialBalancesQueryOptions as St, RegisterPermitParams as T, SigningFailedError as Tn, getTokenAddressContract as Tr, WrappedToken as Tt, unshieldAllMutationOptions as U, EncryptionFailedError as Un, approveContract as Ur, IsConfidentialQueryConfig as Ut, resumeUnshieldMutationOptions as V, DecryptionFailedError as Vn, supportsInterfaceContract as Vr, TotalSupplyQueryConfig as Vt, UnshieldParams as W, AclPausedError as Wn, balanceOfContract as Wr, isConfidentialQueryOptions as Wt, ConfidentialTransferFromAndCallParams as X, DelegationExpiredError as Xn, confidentialTransferContract as Xr, QueryFilterLike as Xt, confidentialSetOperatorMutationOptions as Y, DelegationExpirationTooSoonError as Yn, confidentialTotalSupplyContract as Yr, QueryClientLike as Yt, confidentialTransferFromAndCallMutationOptions as Z, DelegationExpiryUnchangedError as Zn, confidentialTransferFromContract as Zr, QueryLike as Zt, DecryptBalanceAsParams as _, DelegationStatus as _n, SerializedPermit as _r, tokenPairQueryOptions as _t, ZamaSDK as a, unwrapFromBalanceContract as ai, invalidateAfterWrap as an, PreparedPermitExpiredError as ar, shieldMutationOptions as at, delegateDecryptionMutationOptions as b, matchZamaError as bn, ChecksummedAddress as br, tokenPairsSliceQueryOptions as bt, BatchDecryptItem as c, createConfig as ci, invalidateWalletLifecycleQueries as cn, TransportKeyPairExpiredError as cr, ListPairsQueryConfig as ct, DelegationStatusQueryConfig as d, MutationFactoryOptions as dn, ZamaErrorCode as dr, TokenPairsSliceQueryConfig as dt, isOperatorContract as ei, invalidateAfterShield as en, DelegationSelfNotAllowedError as er, ConfidentialTransferAndCallParams as et, delegationStatusQueryOptions as f, QueryFactoryOptions as fn, isRetryable as fr, WrappersRegistryQueryConfig as ft, batchDecryptBalancesAsMutationOptions as g, Delegations as gn, PreparedPermit as gr, tokenAddressQueryOptions as gt, BatchDecryptBalancesAsParams as h, hashFn as hn, PreparePermitRequest as hr, listPairsQueryOptions as ht, decryptValuesQueryOptions as i, unwrapContract as ii, invalidateAfterUnwrap as in, PreparedPermitChainMismatchError as ir, ShieldParams as it, delegatedDecryptValuesMutationOptions as j, RpcRateLimitError as jn, delegateForUserDecryptionContract as jr, PendingUnshieldQueryConfig as jt, decryptPublicValuesMutationOptions as k, WalletAccountNotReadyError as kn, getTokenPairsSliceContract as kr, ConfidentialIsOperatorQueryConfig as kt, BatchDecryptResult as l, zamaQueryKeys as ln, ChainMismatchError as lr, TokenAddressQueryConfig as lt, revokeDelegationMutationOptions as m, filterQueryOptions as mn, Permission as mr, isConfidentialTokenValidQueryOptions as mt, DecryptResult as n, setOperatorContract as ni, invalidateAfterUnshield as nn, KeyWrappingError as nr, ConfidentialTransferParams as nt, ZamaSDKOptions as o, unwrapRequesterContract as oi, invalidateBalanceQueries as on, RevokedKmsContextError as or, ConfidentialTokenAddressQueryConfig as ot, RevokeDelegationParams as p, StrippedQueryOptionKeys as pn, retryAfterSeconds as pr, confidentialTokenAddressQueryOptions as pt, approveUnderlyingMutationOptions as q, DelegationDelegateCannotBeWildcardError as qn, symbolContract as qr, TokenMetadataQueryConfig as qt, EncryptedInput as r, underlyingContract as ri, invalidateAfterUnshieldSettled as rn, NoCiphertextError as rr, confidentialTransferMutationOptions as rt, Offline as s, wrapContract as si, invalidateWagmiBalanceQueries as sn, TransportKeyPairChangedError as sr, IsConfidentialTokenValidQueryConfig as st, Decryption as t, rateContract as ti, invalidateAfterTransfer as tn, InvalidTransportKeyPairError as tr, confidentialTransferAndCallMutationOptions as tt, DelegatedDecryptOptions as u, SignerQueryContext as un, ZamaError as ur, TokenPairQueryConfig as ut, decryptBalanceAsMutationOptions as v, Permits as vn, SerializedPermitEip712 as vr, tokenPairsLengthQueryOptions as vt, hasPermitQueryOptions as w, SigningErrorMetadata as wn, getConfidentialTokenAddressContract as wr, confidentialBalanceQueryOptions as wt, clearCredentialsMutationOptions as x, UnshieldAlreadyFinalizedDetails as xn, PaginatedResult as xr, ConfidentialBalancesQueryConfig as xt, DelegateDecryptionParams as y, ErrorForCode as yn, SerializedTransportKeyPair as yr, tokenPairsQueryOptions as yt, unwrapMutationOptions as z, InsufficientConfidentialBalanceError as zn, isConfidentialTokenContract as zr, WrappersRegistry as zt };
+//# sourceMappingURL=index-DlpdjcMQ.d.ts.map