@zama-fhe/sdk 3.7.0 → 3.7.2

package/dist/esm/{fhevm-relayer-DXLb4mIw.js.map → fhevm-relayer-DnAUqf3b.js.map}

@@ -1 +1 @@
-{"version":3,"file":"fhevm-relayer-DXLb4mIw.js","names":["#config","#progressListeners","#generation","#withActive","#initOnce","#dispatch","#releaseRequested","#releaseIfIdle","#degradePromise","#pinnedInline","#degrade","#crashes","#sequence","#overBoundary","#spawn","#warnCallbackThrew","#teardown","#active","#createWorker","#raceReady","#armCrashHandler","#classifyDegrade","#warnDegraded","#chain","#base","#decrypt","#encrypt","#defaultOptions","#telemetry","#requestOptions","#buildEncryptBackend","#encryptInitPromise","#initEncrypt","createUnsignedLegacyDecryptionPermitEip712Action"],"sources":["../../src/chains/to-fhevm-chain.ts","../../../../node_modules/.pnpm/comlink@4.4.2/node_modules/comlink/dist/esm/comlink.mjs","../../src/worker/protocol.ts","../../src/worker/spawn.ts","../../src/worker/encrypt-worker-client.ts","../../src/relayer/fhevm-relayer.ts"],"sourcesContent":["import type { FhevmChain } from \"@fhevm/sdk/chains\";\nimport type { FheChain } from \"./types\";\n\n/**\n * Derive an `@fhevm/sdk` {@link FhevmChain} from zama-sdk's richer\n * {@link FheChain}.\n *\n * `FheChain` carries fields `@fhevm/sdk` does not model (RPC `network`,\n * `registryAddress`, `executorAddress`, cleartext signer keys); those stay on\n * `FheChain` for the token layer. This adapter projects only the subset the\n * FHE runtime needs: contract addresses, relayer URL, and gateway.\n */\nexport function toFhevmChain(chain: FheChain): FhevmChain {\n  return {\n    id: chain.id,\n    fhevm: {\n      contracts: {\n        acl: { address: chain.aclContractAddress },\n        inputVerifier: { address: chain.inputVerifierContractAddress },\n        kmsVerifier: { address: chain.kmsContractAddress },\n        protocolConfig: undefined,\n      },\n      relayerUrl: chain.relayerUrl,\n      gateway: {\n        id: chain.gatewayChainId,\n        contracts: {\n          decryption: { address: chain.verifyingContractAddressDecryption },\n          inputVerification: { address: chain.verifyingContractAddressInputVerification },\n        },\n      },\n    },\n  } satisfies FhevmChain;\n}\n","/**\n * @license\n * Copyright 2019 Google LLC\n * SPDX-License-Identifier: Apache-2.0\n */\nconst proxyMarker = Symbol(\"Comlink.proxy\");\nconst createEndpoint = Symbol(\"Comlink.endpoint\");\nconst releaseProxy = Symbol(\"Comlink.releaseProxy\");\nconst finalizer = Symbol(\"Comlink.finalizer\");\nconst throwMarker = Symbol(\"Comlink.thrown\");\nconst isObject = (val) => (typeof val === \"object\" && val !== null) || typeof val === \"function\";\n/**\n * Internal transfer handle to handle objects marked to proxy.\n */\nconst proxyTransferHandler = {\n    canHandle: (val) => isObject(val) && val[proxyMarker],\n    serialize(obj) {\n        const { port1, port2 } = new MessageChannel();\n        expose(obj, port1);\n        return [port2, [port2]];\n    },\n    deserialize(port) {\n        port.start();\n        return wrap(port);\n    },\n};\n/**\n * Internal transfer handler to handle thrown exceptions.\n */\nconst throwTransferHandler = {\n    canHandle: (value) => isObject(value) && throwMarker in value,\n    serialize({ value }) {\n        let serialized;\n        if (value instanceof Error) {\n            serialized = {\n                isError: true,\n                value: {\n                    message: value.message,\n                    name: value.name,\n                    stack: value.stack,\n                },\n            };\n        }\n        else {\n            serialized = { isError: false, value };\n        }\n        return [serialized, []];\n    },\n    deserialize(serialized) {\n        if (serialized.isError) {\n            throw Object.assign(new Error(serialized.value.message), serialized.value);\n        }\n        throw serialized.value;\n    },\n};\n/**\n * Allows customizing the serialization of certain values.\n */\nconst transferHandlers = new Map([\n    [\"proxy\", proxyTransferHandler],\n    [\"throw\", throwTransferHandler],\n]);\nfunction isAllowedOrigin(allowedOrigins, origin) {\n    for (const allowedOrigin of allowedOrigins) {\n        if (origin === allowedOrigin || allowedOrigin === \"*\") {\n            return true;\n        }\n        if (allowedOrigin instanceof RegExp && allowedOrigin.test(origin)) {\n            return true;\n        }\n    }\n    return false;\n}\nfunction expose(obj, ep = globalThis, allowedOrigins = [\"*\"]) {\n    ep.addEventListener(\"message\", function callback(ev) {\n        if (!ev || !ev.data) {\n            return;\n        }\n        if (!isAllowedOrigin(allowedOrigins, ev.origin)) {\n            console.warn(`Invalid origin '${ev.origin}' for comlink proxy`);\n            return;\n        }\n        const { id, type, path } = Object.assign({ path: [] }, ev.data);\n        const argumentList = (ev.data.argumentList || []).map(fromWireValue);\n        let returnValue;\n        try {\n            const parent = path.slice(0, -1).reduce((obj, prop) => obj[prop], obj);\n            const rawValue = path.reduce((obj, prop) => obj[prop], obj);\n            switch (type) {\n                case \"GET\" /* MessageType.GET */:\n                    {\n                        returnValue = rawValue;\n                    }\n                    break;\n                case \"SET\" /* MessageType.SET */:\n                    {\n                        parent[path.slice(-1)[0]] = fromWireValue(ev.data.value);\n                        returnValue = true;\n                    }\n                    break;\n                case \"APPLY\" /* MessageType.APPLY */:\n                    {\n                        returnValue = rawValue.apply(parent, argumentList);\n                    }\n                    break;\n                case \"CONSTRUCT\" /* MessageType.CONSTRUCT */:\n                    {\n                        const value = new rawValue(...argumentList);\n                        returnValue = proxy(value);\n                    }\n                    break;\n                case \"ENDPOINT\" /* MessageType.ENDPOINT */:\n                    {\n                        const { port1, port2 } = new MessageChannel();\n                        expose(obj, port2);\n                        returnValue = transfer(port1, [port1]);\n                    }\n                    break;\n                case \"RELEASE\" /* MessageType.RELEASE */:\n                    {\n                        returnValue = undefined;\n                    }\n                    break;\n                default:\n                    return;\n            }\n        }\n        catch (value) {\n            returnValue = { value, [throwMarker]: 0 };\n        }\n        Promise.resolve(returnValue)\n            .catch((value) => {\n            return { value, [throwMarker]: 0 };\n        })\n            .then((returnValue) => {\n            const [wireValue, transferables] = toWireValue(returnValue);\n            ep.postMessage(Object.assign(Object.assign({}, wireValue), { id }), transferables);\n            if (type === \"RELEASE\" /* MessageType.RELEASE */) {\n                // detach and deactive after sending release response above.\n                ep.removeEventListener(\"message\", callback);\n                closeEndPoint(ep);\n                if (finalizer in obj && typeof obj[finalizer] === \"function\") {\n                    obj[finalizer]();\n                }\n            }\n        })\n            .catch((error) => {\n            // Send Serialization Error To Caller\n            const [wireValue, transferables] = toWireValue({\n                value: new TypeError(\"Unserializable return value\"),\n                [throwMarker]: 0,\n            });\n            ep.postMessage(Object.assign(Object.assign({}, wireValue), { id }), transferables);\n        });\n    });\n    if (ep.start) {\n        ep.start();\n    }\n}\nfunction isMessagePort(endpoint) {\n    return endpoint.constructor.name === \"MessagePort\";\n}\nfunction closeEndPoint(endpoint) {\n    if (isMessagePort(endpoint))\n        endpoint.close();\n}\nfunction wrap(ep, target) {\n    const pendingListeners = new Map();\n    ep.addEventListener(\"message\", function handleMessage(ev) {\n        const { data } = ev;\n        if (!data || !data.id) {\n            return;\n        }\n        const resolver = pendingListeners.get(data.id);\n        if (!resolver) {\n            return;\n        }\n        try {\n            resolver(data);\n        }\n        finally {\n            pendingListeners.delete(data.id);\n        }\n    });\n    return createProxy(ep, pendingListeners, [], target);\n}\nfunction throwIfProxyReleased(isReleased) {\n    if (isReleased) {\n        throw new Error(\"Proxy has been released and is not useable\");\n    }\n}\nfunction releaseEndpoint(ep) {\n    return requestResponseMessage(ep, new Map(), {\n        type: \"RELEASE\" /* MessageType.RELEASE */,\n    }).then(() => {\n        closeEndPoint(ep);\n    });\n}\nconst proxyCounter = new WeakMap();\nconst proxyFinalizers = \"FinalizationRegistry\" in globalThis &&\n    new FinalizationRegistry((ep) => {\n        const newCount = (proxyCounter.get(ep) || 0) - 1;\n        proxyCounter.set(ep, newCount);\n        if (newCount === 0) {\n            releaseEndpoint(ep);\n        }\n    });\nfunction registerProxy(proxy, ep) {\n    const newCount = (proxyCounter.get(ep) || 0) + 1;\n    proxyCounter.set(ep, newCount);\n    if (proxyFinalizers) {\n        proxyFinalizers.register(proxy, ep, proxy);\n    }\n}\nfunction unregisterProxy(proxy) {\n    if (proxyFinalizers) {\n        proxyFinalizers.unregister(proxy);\n    }\n}\nfunction createProxy(ep, pendingListeners, path = [], target = function () { }) {\n    let isProxyReleased = false;\n    const proxy = new Proxy(target, {\n        get(_target, prop) {\n            throwIfProxyReleased(isProxyReleased);\n            if (prop === releaseProxy) {\n                return () => {\n                    unregisterProxy(proxy);\n                    releaseEndpoint(ep);\n                    pendingListeners.clear();\n                    isProxyReleased = true;\n                };\n            }\n            if (prop === \"then\") {\n                if (path.length === 0) {\n                    return { then: () => proxy };\n                }\n                const r = requestResponseMessage(ep, pendingListeners, {\n                    type: \"GET\" /* MessageType.GET */,\n                    path: path.map((p) => p.toString()),\n                }).then(fromWireValue);\n                return r.then.bind(r);\n            }\n            return createProxy(ep, pendingListeners, [...path, prop]);\n        },\n        set(_target, prop, rawValue) {\n            throwIfProxyReleased(isProxyReleased);\n            // FIXME: ES6 Proxy Handler `set` methods are supposed to return a\n            // boolean. To show good will, we return true asynchronously ¯\\_(ツ)_/¯\n            const [value, transferables] = toWireValue(rawValue);\n            return requestResponseMessage(ep, pendingListeners, {\n                type: \"SET\" /* MessageType.SET */,\n                path: [...path, prop].map((p) => p.toString()),\n                value,\n            }, transferables).then(fromWireValue);\n        },\n        apply(_target, _thisArg, rawArgumentList) {\n            throwIfProxyReleased(isProxyReleased);\n            const last = path[path.length - 1];\n            if (last === createEndpoint) {\n                return requestResponseMessage(ep, pendingListeners, {\n                    type: \"ENDPOINT\" /* MessageType.ENDPOINT */,\n                }).then(fromWireValue);\n            }\n            // We just pretend that `bind()` didn’t happen.\n            if (last === \"bind\") {\n                return createProxy(ep, pendingListeners, path.slice(0, -1));\n            }\n            const [argumentList, transferables] = processArguments(rawArgumentList);\n            return requestResponseMessage(ep, pendingListeners, {\n                type: \"APPLY\" /* MessageType.APPLY */,\n                path: path.map((p) => p.toString()),\n                argumentList,\n            }, transferables).then(fromWireValue);\n        },\n        construct(_target, rawArgumentList) {\n            throwIfProxyReleased(isProxyReleased);\n            const [argumentList, transferables] = processArguments(rawArgumentList);\n            return requestResponseMessage(ep, pendingListeners, {\n                type: \"CONSTRUCT\" /* MessageType.CONSTRUCT */,\n                path: path.map((p) => p.toString()),\n                argumentList,\n            }, transferables).then(fromWireValue);\n        },\n    });\n    registerProxy(proxy, ep);\n    return proxy;\n}\nfunction myFlat(arr) {\n    return Array.prototype.concat.apply([], arr);\n}\nfunction processArguments(argumentList) {\n    const processed = argumentList.map(toWireValue);\n    return [processed.map((v) => v[0]), myFlat(processed.map((v) => v[1]))];\n}\nconst transferCache = new WeakMap();\nfunction transfer(obj, transfers) {\n    transferCache.set(obj, transfers);\n    return obj;\n}\nfunction proxy(obj) {\n    return Object.assign(obj, { [proxyMarker]: true });\n}\nfunction windowEndpoint(w, context = globalThis, targetOrigin = \"*\") {\n    return {\n        postMessage: (msg, transferables) => w.postMessage(msg, targetOrigin, transferables),\n        addEventListener: context.addEventListener.bind(context),\n        removeEventListener: context.removeEventListener.bind(context),\n    };\n}\nfunction toWireValue(value) {\n    for (const [name, handler] of transferHandlers) {\n        if (handler.canHandle(value)) {\n            const [serializedValue, transferables] = handler.serialize(value);\n            return [\n                {\n                    type: \"HANDLER\" /* WireValueType.HANDLER */,\n                    name,\n                    value: serializedValue,\n                },\n                transferables,\n            ];\n        }\n    }\n    return [\n        {\n            type: \"RAW\" /* WireValueType.RAW */,\n            value,\n        },\n        transferCache.get(value) || [],\n    ];\n}\nfunction fromWireValue(value) {\n    switch (value.type) {\n        case \"HANDLER\" /* WireValueType.HANDLER */:\n            return transferHandlers.get(value.name).deserialize(value.value);\n        case \"RAW\" /* WireValueType.RAW */:\n            return value.value;\n    }\n}\nfunction requestResponseMessage(ep, pendingListeners, msg, transfers) {\n    return new Promise((resolve) => {\n        const id = generateUUID();\n        pendingListeners.set(id, resolve);\n        if (ep.start) {\n            ep.start();\n        }\n        ep.postMessage(Object.assign({ id }, msg), transfers);\n    });\n}\nfunction generateUUID() {\n    return new Array(4)\n        .fill(0)\n        .map(() => Math.floor(Math.random() * Number.MAX_SAFE_INTEGER).toString(16))\n        .join(\"-\");\n}\n\nexport { createEndpoint, expose, finalizer, proxy, proxyMarker, releaseProxy, transfer, transferHandlers, windowEndpoint, wrap };\n//# sourceMappingURL=comlink.mjs.map\n","/**\n * Shared contract between the main-thread encrypt client and the encrypt\n * worker, spoken over Comlink. Every payload must survive `structuredClone`:\n * no `AbortSignal`, no class instances; callbacks cross as Comlink proxies.\n */\n\nimport type { FhevmChain } from \"@fhevm/sdk/chains\";\nimport type {\n  FhevmClientOptions,\n  FhevmEncryptBackend,\n  FhevmRelayerOptions,\n  WireRuntimeConfig,\n} from \"../relayer/types\";\nimport { isValidRetryAfterSeconds, readRetryAfterHeader } from \"../utils/error\";\n\ntype EncryptParameters = Parameters<FhevmEncryptBackend[\"encryptValue\"]>[0];\ntype EncryptsParameters = Parameters<FhevmEncryptBackend[\"encryptValues\"]>[0];\n\n/**\n * What the worker offloads, and all the encrypt client's surface the worker\n * client implements. Key fetches stay on the calling thread, where the chain's\n * auth applies and the key never crosses back out.\n */\nexport type EncryptOffloadBackend = Pick<\n  FhevmEncryptBackend,\n  \"init\" | \"encryptValue\" | \"encryptValues\"\n>;\n\n/** Per-request options minus `signal`, the one non-cloneable member of the set. */\nexport type WireRequestOptions = Omit<FhevmRelayerOptions, \"signal\">;\n\nexport type WireProgressEvent = Parameters<\n  NonNullable<NonNullable<EncryptParameters[\"options\"]>[\"onProgress\"]>\n>[0];\n\nexport type WireInitPayload = {\n  readonly chain: FhevmChain;\n  /** RPC URL for host-chain reads; absent when reads proxy through `rpcRequest`. */\n  readonly rpcUrl: string | undefined;\n  /** Carries `fheEncryptionKey`, prefetched on the main thread so the worker skips the download. */\n  readonly clientOptions: FhevmClientOptions;\n  readonly runtime: WireRuntimeConfig;\n};\n\n/** Main-thread callback the worker uses for host-chain reads when the chain's network is an injected provider. */\nexport type WireRpcRequest = (args: { method: string; params?: unknown }) => Promise<unknown>;\n\n/**\n * Main-thread callback receiving every operation's progress events, routed on\n * `id`. One channel per worker avoids minting a `MessageChannel` per call, whose\n * local port and listener would linger until garbage collection after terminate.\n * Returns `unknown`: a Comlink proxy call answers with a promise.\n */\nexport type WireProgressCallback = (id: number, event: WireProgressEvent) => unknown;\n\nexport type WireLogCallback = (level: \"debug\" | \"warn\" | \"error\", message: string) => unknown;\n\n/**\n * The API the worker exposes over Comlink. `id` correlates an in-flight\n * operation with `abort` and with its progress events, since neither an\n * `AbortSignal` nor a per-call callback can cross the boundary cheaply. The\n * `init` callback parameters must be passed as Comlink proxies (or `null`).\n */\nexport type EncryptWorkerApi = {\n  init(\n    payload: WireInitPayload,\n    rpcRequest: WireRpcRequest | null,\n    log: WireLogCallback,\n    onProgress: WireProgressCallback,\n  ): Promise<void>;\n  encryptValue(\n    id: number,\n    parameters: {\n      readonly value: EncryptParameters[\"value\"];\n      readonly contractAddress: string;\n      readonly userAddress: string;\n      readonly options: WireRequestOptions | undefined;\n    },\n  ): ReturnType<FhevmEncryptBackend[\"encryptValue\"]>;\n  encryptValues(\n    id: number,\n    parameters: {\n      readonly values: EncryptsParameters[\"values\"];\n      readonly contractAddress: string;\n      readonly userAddress: string;\n      readonly options: WireRequestOptions | undefined;\n    },\n  ): ReturnType<FhevmEncryptBackend[\"encryptValues\"]>;\n  abort(id: number): void;\n};\n\n/** Raw message the worker posts once its module graph has loaded, before Comlink traffic. */\nexport const WORKER_READY_MESSAGE = \"zama-encrypt-worker-ready\";\n\n/**\n * An `Error` flattened for the boundary crossing, thrown by the worker as a\n * plain object so it survives structured clone intact. `props` carries the\n * fields the SDK's duck-typed classifiers read (`statusCode`, `retryAfter`,\n * `code`, …); a cloned `Error` instance would drop them with the prototype.\n * Reading them through the prototype chain is deliberate: upstream's `status`\n * and `relayerApiError` are prototype getters, not own fields.\n */\nexport type WireError = {\n  readonly wireError: true;\n  readonly name: string;\n  readonly message: string;\n  readonly stack: string | undefined;\n  readonly props: Record<string, unknown>;\n  readonly cause: WireError | undefined;\n};\n\nexport function isWireError(value: unknown): value is WireError {\n  // Exact `true`, not presence: an `Error` subclass carrying the key must not be\n  // rehydrated as a flattened one.\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    (value as { wireError?: unknown }).wireError === true\n  );\n}\n\n/**\n * Fields preserved across the boundary: what the error classifiers read off\n * `@fhevm/sdk`, relayer, and JSON-RPC errors, plus the `error`/`info` nesting\n * keys those classifiers walk alongside `cause`.\n */\nconst WIRE_ERROR_PROPS = [\n  \"statusCode\",\n  \"status\",\n  \"retryAfter\",\n  \"timeoutMs\",\n  \"relayerApiError\",\n  \"code\",\n  \"data\",\n  \"shortMessage\",\n  \"details\",\n  \"error\",\n  \"info\",\n] as const;\n\nconst MAX_CAUSE_DEPTH = 6;\n\n/** A probe is exact where a structural walk only approximates. */\nfunction isCloneSafe(value: unknown): boolean {\n  try {\n    structuredClone(value);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The `Retry-After` header survives as a plain number of seconds; the\n * `Response` object it lives on cannot cross the boundary.\n */\nfunction retryAfterFromResponse(error: object): number | undefined {\n  const response = (error as { response?: { headers?: unknown } }).response;\n  return readRetryAfterHeader(response?.headers);\n}\n\n/**\n * `JSON.stringify` throws instead of returning `undefined` on a bigint or a\n * circular value; a non-Error thrown value must never fail error handling itself.\n */\nfunction stringifyNonError(error: unknown): string {\n  try {\n    return JSON.stringify(error) ?? String(error);\n  } catch {\n    return String(error);\n  }\n}\n\n/** The classifier fields readable off one thrown value, `Error` or plain object alike. */\nfunction extractWireProps(source: object): Record<string, unknown> {\n  const props: Record<string, unknown> = {};\n  for (const key of WIRE_ERROR_PROPS) {\n    const value = (source as Record<string, unknown>)[key];\n    if (value !== undefined && isCloneSafe(value)) {\n      props[key] = value;\n    }\n  }\n  // The header wins over a malformed own delay (`0`, negative, `NaN`), as the\n  // inline extractor in `utils/error.ts` decides it.\n  if (!isValidRetryAfterSeconds(props[\"retryAfter\"])) {\n    const fromHeader = retryAfterFromResponse(source);\n    if (fromHeader !== undefined) {\n      props[\"retryAfter\"] = fromHeader;\n    }\n  }\n  return props;\n}\n\nexport function toWireError(error: unknown, depth: number = MAX_CAUSE_DEPTH): WireError {\n  if (isWireError(error)) {\n    return error;\n  }\n  const nest = (cause: unknown): WireError | undefined =>\n    depth > 0 && cause !== undefined ? toWireError(cause, depth - 1) : undefined;\n  if (error instanceof Error) {\n    return {\n      wireError: true,\n      name: error.name,\n      message: error.message,\n      stack: error.stack,\n      props: extractWireProps(error),\n      cause: nest(error.cause),\n    };\n  }\n  if (typeof error === \"object\" && error !== null) {\n    // Wallets reject with a plain `{ code, message, data }`; dropping `code`\n    // would break viem's classification inside the worker.\n    const { message, cause } = error as { message?: unknown; cause?: unknown };\n    return {\n      wireError: true,\n      name: \"Error\",\n      message: typeof message === \"string\" ? message : stringifyNonError(error),\n      stack: undefined,\n      props: extractWireProps(error),\n      cause: nest(cause),\n    };\n  }\n  return {\n    wireError: true,\n    name: \"Error\",\n    message: typeof error === \"string\" ? error : stringifyNonError(error),\n    stack: undefined,\n    props: {},\n    cause: undefined,\n  };\n}\n\n/**\n * Rebuilds a plain `Error` carrying the original `name`, own fields, and cause\n * chain, so name-based classification and status/retry-after extraction behave\n * as if the error had been thrown on this thread.\n */\nexport function fromWireError(wire: WireError): Error {\n  const error = new Error(wire.message, wire.cause ? { cause: fromWireError(wire.cause) } : {});\n  error.name = wire.name;\n  if (wire.stack !== undefined) {\n    error.stack = wire.stack;\n  }\n  Object.assign(error, wire.props);\n  return error;\n}\n","/** Isolated so the CJS build can replace worker construction with an inert stub. */\n\n/** False in the CJS stub, which ships no worker chunk; a caller-supplied `offloadWorker` source works in either build. */\nexport const BUNDLED_ENCRYPT_WORKER = true;\n\nexport function createEncryptWorker(): Worker {\n  // Keep the `new Worker(new URL(...))` expression exactly in this inline\n  // form: bundlers detect it statically to emit and rewrite the worker chunk,\n  // and lose it if the URL is hoisted into a variable.\n  return new Worker(new URL(\"./encrypt.worker.js\", import.meta.url), {\n    type: \"module\",\n    name: \"zama-fhe-encrypt\",\n  });\n}\n","import { proxy, transfer, wrap, type Remote } from \"comlink\";\nimport type { EIP1193Provider } from \"viem\";\nimport { EncryptOffloadUnavailableError } from \"../errors/encryption\";\nimport type { FhevmClientOptions } from \"../relayer/types\";\nimport type { LoggerService } from \"../services/logger-service\";\nimport type {\n  EncryptOffloadBackend,\n  EncryptWorkerApi,\n  WireInitPayload,\n  WireProgressEvent,\n  WireRequestOptions,\n} from \"./protocol\";\nimport { WORKER_READY_MESSAGE, fromWireError, isWireError, toWireError } from \"./protocol\";\nimport { createEncryptWorker } from \"./spawn\";\n\n/**\n * Watchdog deadlines, in milliseconds, for worker lifecycle steps: each is a\n * ceiling on \"the worker never answered\", not on legitimate slow work. Encrypt\n * operations themselves are not watched: nothing bounds local WASM compute, so\n * a proof may run for as long as it needs.\n */\nexport type EncryptWorkerTimeouts = {\n  /** Worker startup + module-graph load; a bundler that mishandled the worker URL fails here. */\n  readonly spawn: number;\n  /** Client init inside the worker realm: chain reads and WASM compilation. */\n  readonly init: number;\n};\n\nexport const DEFAULT_ENCRYPT_WORKER_TIMEOUTS: EncryptWorkerTimeouts = {\n  spawn: 10_000,\n  init: 300_000,\n};\n\n/** Second crash pins the client to the calling thread. */\nconst CRASH_PIN_THRESHOLD = 2;\n\n/** Stable prefix of every degrade warning. */\nexport const ENCRYPT_OFFLOAD_WARN_PREFIX = \"Encrypt offload unavailable\";\n\n/** Workers already returned by an `offloadWorker` factory, to catch a factory that hands out one worker forever. */\nconst handedOutWorkers = new WeakSet<Worker>();\n\n/** Internal signal: the worker infrastructure failed; the operation itself was not rejected. */\nclass WorkerUnavailableError extends Error {\n  /** True when a worker that had already signalled ready died under us, so a respawn is worth trying. */\n  readonly crashed: boolean;\n\n  constructor(message: string, options?: ErrorOptions & { readonly crashed?: boolean }) {\n    super(message, options);\n    this.name = \"WorkerUnavailableError\";\n    this.crashed = options?.crashed ?? false;\n  }\n}\n\n/**\n * A payload Comlink could not clone into the worker (`DataCloneError`) or could\n * not return out of it (its own `TypeError`): a boundary failure, so it degrades\n * rather than reaching the caller as an application error.\n */\nfunction isCloneFailure(error: unknown): boolean {\n  if (typeof error !== \"object\" || error === null) {\n    return false;\n  }\n  const { name, message } = error as { name?: unknown; message?: unknown };\n  return (\n    name === \"DataCloneError\" ||\n    (name === \"TypeError\" &&\n      typeof message === \"string\" &&\n      message.includes(\"Unserializable return value\"))\n  );\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted) {\n    throw signal.reason ?? new DOMException(\"The operation was aborted.\", \"AbortError\");\n  }\n}\n\n/** What the client remembers about worker crashes, dropped whole by a worker answer and by a release. */\ntype CrashHistory = {\n  readonly count: number;\n  /** The crash that killed the current worker, so a call landing after it degrades as a crash too. */\n  readonly last: WorkerUnavailableError | undefined;\n  /** Crash count the degrade warning was last emitted for, so one failure warns once. */\n  readonly warnedFor: number;\n};\n\nconst NO_CRASHES: CrashHistory = { count: 0, last: undefined, warnedFor: -1 };\n\n/**\n * The key copied for the crossing plus the buffers to transfer, so the wire copy\n * is moved instead of cloned. Anything but the known binary shape crosses\n * unchanged.\n */\nfunction keyForTransfer(key: FhevmClientOptions[\"fheEncryptionKey\"]): {\n  readonly key: FhevmClientOptions[\"fheEncryptionKey\"];\n  readonly transfers: Transferable[];\n} {\n  if (key === undefined) {\n    return { key, transfers: [] };\n  }\n  const publicKeyBytes = key.publicKeyBytes.bytes;\n  const crsBytes = key.crsBytes.bytes;\n  if (!(publicKeyBytes instanceof Uint8Array) || !(crsBytes instanceof Uint8Array)) {\n    return { key, transfers: [] };\n  }\n  // `slice` yields a fresh exactly-sized buffer, so transferring it leaves this\n  // thread's cached key intact.\n  const publicKeyCopy = publicKeyBytes.slice();\n  const crsCopy = crsBytes.slice();\n  return {\n    key: {\n      ...key,\n      publicKeyBytes: { ...key.publicKeyBytes, bytes: publicKeyCopy },\n      crsBytes: { ...key.crsBytes, bytes: crsCopy },\n    },\n    transfers: [publicKeyCopy.buffer as ArrayBuffer, crsCopy.buffer as ArrayBuffer],\n  };\n}\n\n/**\n * Per-call options: `signal` is forwarded as an `abort` call, `onProgress` is\n * served from the worker's shared progress channel, and `never` keeps the\n * callback contravariantly compatible with each operation's own event type.\n */\ntype CallOptions = WireRequestOptions & {\n  readonly signal?: AbortSignal;\n  readonly onProgress?: (args: never) => void;\n};\n\n/**\n * Everything scoped to one spawned worker, created by the init that spawns it\n * and dropped whole by a teardown. A late event carrying its own generation can\n * therefore only settle that generation, never the worker running in its place.\n */\ntype WorkerGeneration = {\n  /** Memoized bring-up for this worker; it dies with the generation, so the next call re-runs it. */\n  initPromise: Promise<void> | undefined;\n  worker: Worker | undefined;\n  api: Remote<EncryptWorkerApi> | undefined;\n  /** Never resolves; teardown rejects it, and every boundary crossing races it so all of them settle together. */\n  readonly doomed: Promise<never>;\n  /** Rejects `doomed` with the teardown's `WorkerUnavailableError`. */\n  readonly doom: (error: WorkerUnavailableError) => void;\n};\n\nfunction createWorkerGeneration(): WorkerGeneration {\n  let doom!: (error: WorkerUnavailableError) => void;\n  const doomed = new Promise<never>((_resolve, reject) => {\n    doom = reject;\n  });\n  // An idle teardown dooms a generation with no crossing racing it; this\n  // handler keeps that from surfacing as an unhandled rejection.\n  doomed.catch(() => {});\n  return { initPromise: undefined, worker: undefined, api: undefined, doomed, doom };\n}\n\nexport type EncryptWorkerClientConfig = {\n  readonly initPayload: Omit<WireInitPayload, \"rpcUrl\">;\n  /** The chain's RPC endpoint: a URL crosses into the worker; a provider is proxied per request. */\n  readonly network: EIP1193Provider | string;\n  /** Fetches the FHE key on the calling thread, where the chain's auth applies; the worker realm never downloads it itself. */\n  readonly prefetchKey: () => Promise<FhevmClientOptions[\"fheEncryptionKey\"]>;\n  readonly createInlineClient: () => EncryptOffloadBackend;\n  readonly logger: LoggerService;\n  readonly timeouts: EncryptWorkerTimeouts;\n  /** A string or `URL` is spawned with the SDK's worker options; a factory is called for the worker itself. */\n  readonly workerSource?: string | URL | (() => Worker);\n  /**\n   * A pre-known reason offload cannot work in this session: init degrades with\n   * it immediately, so strict rejects at call time rather than at config time.\n   */\n  readonly blockedReason?: string;\n  /**\n   * Strict offload (`offloadEncrypt: true`): never run encryption on the\n   * calling thread. Every path that would degrade rejects with\n   * {@link EncryptOffloadUnavailableError} instead.\n   */\n  readonly strict: boolean;\n};\n\n/**\n * Encrypt backend that runs `@fhevm/sdk` in a dedicated module worker so proof\n * generation never blocks the main thread. Only infrastructure failure degrades\n * to inline (or rejects under `strict`); worker-reported errors are rethrown,\n * since inline would fail the same way.\n */\nexport class EncryptWorkerClient implements EncryptOffloadBackend {\n  readonly #config: EncryptWorkerClientConfig;\n  /** Resources of the worker currently being brought up or served; undefined while none runs. */\n  #generation: WorkerGeneration | undefined;\n  /** True once the client runs inline for the rest of its life, with no further spawn attempts. */\n  #pinnedInline = false;\n  #crashes: CrashHistory = NO_CRASHES;\n  /** Wire ids, allocated across generations so a late reply can never be read as a live operation. */\n  #sequence = 0;\n  /** Per-operation `onProgress`, keyed by wire id and routed over one channel registered at init: one channel per worker avoids minting a `MessageChannel` per call, whose local port and listener would linger until garbage collection after terminate. */\n  readonly #progressListeners = new Map<number, (event: WireProgressEvent) => void>();\n  /** Memoized inline backend. Kept, with its key copy, across a worker recovery so a later degrade skips the refetch. */\n  #degradePromise: Promise<EncryptOffloadBackend> | undefined;\n  /** Operations that must drain before a requested release terminates the worker. */\n  #active = 0;\n  #releaseRequested = false;\n\n  constructor(config: EncryptWorkerClientConfig) {\n    this.#config = config;\n  }\n\n  init = (): Promise<void> => {\n    // A call landing mid-drain rides the worker being released rather than\n    // canceling the release: the drain still completes, and the call after it\n    // spawns a fresh worker.\n    const generation = (this.#generation ??= createWorkerGeneration());\n    if (generation.initPromise === undefined) {\n      // Only a successful cycle is memoized: a failure a retry could clear must\n      // not be replayed to every later call.\n      const attempt: Promise<void> = this.#withActive(() => this.#initOnce(generation)).catch(\n        (error: unknown) => {\n          if (generation.initPromise === attempt) {\n            generation.initPromise = undefined;\n          }\n          throw error;\n        },\n      );\n      generation.initPromise = attempt;\n    }\n    return generation.initPromise;\n  };\n\n  encryptValue: EncryptOffloadBackend[\"encryptValue\"] = (parameters) =>\n    this.#withActive(() =>\n      this.#dispatch(\n        (backend) => backend.encryptValue(parameters),\n        // Spread, so a field upstream adds to the parameters still crosses; the\n        // stripped `options` replaces the caller's, which carries `signal`.\n        (api, id, options) => api.encryptValue(id, { ...parameters, options }),\n        parameters.options,\n      ),\n    );\n\n  encryptValues: EncryptOffloadBackend[\"encryptValues\"] = (parameters) =>\n    this.#withActive(() =>\n      this.#dispatch(\n        (backend) => backend.encryptValues(parameters),\n        (api, id, options) => api.encryptValues(id, { ...parameters, options }),\n        parameters.options,\n      ),\n    );\n\n  /**\n   * Releases the worker without changing what callers observe: in-flight\n   * operations (an init included) run to completion over the worker, and the\n   * worker is terminated as soon as the last one settles, immediately if the\n   * client is idle. The client is not spent: the release resets it whole, so a\n   * later call re-fetches the key and spawns a fresh worker exactly like the\n   * first one, even if the client had degraded to the calling thread. The drain\n   * is not bounded: a worker wedged inside an operation is only terminated once\n   * that operation settles.\n   */\n  dispose(): void {\n    this.#releaseRequested = true;\n    this.#releaseIfIdle();\n  }\n\n  /**\n   * The one place that decides between the worker and the calling thread:\n   * inline once pinned or while no worker is running; otherwise the worker,\n   * falling back to inline on infrastructure failure while application errors\n   * pass through.\n   */\n  async #dispatch<T>(\n    invoke: (backend: EncryptOffloadBackend) => Promise<T>,\n    overWorker: (\n      api: Remote<EncryptWorkerApi>,\n      id: number,\n      options: WireRequestOptions,\n    ) => Promise<T>,\n    callOptions: CallOptions | undefined,\n  ): Promise<T> {\n    const { signal, onProgress, ...options } = callOptions ?? {};\n    // The worker dequeues an abort only after the proof, so a dispatched call always runs whole.\n    throwIfAborted(signal);\n    await this.init();\n    // A listener added after the abort never fires, so an abort during init needs this recheck.\n    throwIfAborted(signal);\n    const generation = this.#generation;\n    const api = generation?.api;\n    // An existing degrade attempt already carries the decision that created it,\n    // and its inline backend caches the key, so reuse it rather than degrading again.\n    if (this.#degradePromise !== undefined && (this.#pinnedInline || api === undefined)) {\n      return invoke(await this.#degradePromise);\n    }\n    if (generation === undefined || api === undefined) {\n      return invoke(\n        await this.#degrade(\n          generation,\n          this.#crashes.last ?? new WorkerUnavailableError(\"Encrypt worker not running.\"),\n        ),\n      );\n    }\n    const id = this.#sequence++;\n    const onAbort = () => void api.abort(id).catch(() => {});\n    signal?.addEventListener(\"abort\", onAbort, { once: true });\n    if (onProgress) {\n      this.#progressListeners.set(id, onProgress as (event: WireProgressEvent) => void);\n    }\n    try {\n      const result = await this.#overBoundary(generation, overWorker(api, id, options));\n      // A worker operation that answered clears the crash history: two unrelated\n      // crashes far apart must not add up to a permanent degrade.\n      this.#crashes = NO_CRASHES;\n      return result;\n    } catch (error) {\n      if (error instanceof WorkerUnavailableError) {\n        return invoke(await this.#degrade(generation, error));\n      }\n      throw error;\n    } finally {\n      this.#progressListeners.delete(id);\n      signal?.removeEventListener(\"abort\", onAbort);\n    }\n  }\n\n  async #initOnce(generation: WorkerGeneration): Promise<void> {\n    if (this.#pinnedInline) {\n      // The degrade that pinned the client already initialized the backend every call now runs on.\n      return;\n    }\n    const blockedReason = this.#config.blockedReason;\n    if (blockedReason !== undefined) {\n      // Handled before any resource is spent: non-strict callers never get here\n      // (the relayer inlines directly), and strict throws out of the degrade.\n      await this.#degrade(generation, new WorkerUnavailableError(blockedReason));\n      return;\n    }\n    // Outside the degrade guard: a failed key fetch is an application/network\n    // error, and the inline backend would refetch the same key from the same\n    // relayer. It rejects out of init exactly as the inline arm's would.\n    const fheEncryptionKey = await this.#config.prefetchKey();\n    try {\n      const api = await this.#spawn(generation);\n      const network = this.#config.network;\n      const rpcRequest =\n        typeof network === \"string\"\n          ? null\n          : proxy(async (args: { method: string; params?: unknown }) => {\n              try {\n                return await network.request(args as Parameters<EIP1193Provider[\"request\"]>[0]);\n              } catch (error) {\n                // Comlink keeps only name/message/stack on a thrown error, which\n                // would strip the provider's `code` (4001, -32005) the worker's\n                // classifiers read; flatten it so those fields cross.\n                throw toWireError(error);\n              }\n            });\n      // A callback that throws would reject the Comlink proxy call back in the\n      // worker realm, where nothing can report it, so it is contained here.\n      const log = proxy((level: \"debug\" | \"warn\" | \"error\", message: string) => {\n        try {\n          this.#config.logger[level](message);\n        } catch (error) {\n          this.#warnCallbackThrew(\"logger\", error);\n        }\n      });\n      const onProgress = proxy((id: number, event: WireProgressEvent) => {\n        try {\n          this.#progressListeners.get(id)?.(event);\n        } catch (error) {\n          this.#warnCallbackThrew(\"onProgress\", error);\n        }\n      });\n      // The copy stays on this thread so a later degrade to inline reuses the\n      // key instead of refetching; transferring the wire copy avoids a third\n      // in-transit copy of it.\n      const wireKey = keyForTransfer(fheEncryptionKey);\n      await this.#overBoundary(\n        generation,\n        api.init(\n          transfer(\n            {\n              ...this.#config.initPayload,\n              clientOptions: {\n                ...this.#config.initPayload.clientOptions,\n                fheEncryptionKey: wireKey.key,\n              },\n              rpcUrl: typeof network === \"string\" ? network : undefined,\n            },\n            wireKey.transfers,\n          ),\n          rpcRequest,\n          log,\n          onProgress,\n        ),\n        { ms: this.#config.timeouts.init, operation: \"init\" },\n      );\n      generation.api = api;\n      this.#crashes = { ...this.#crashes, last: undefined };\n    } catch (error) {\n      // Only \"the worker never answered or crashed\" is infrastructure. An error\n      // the worker itself reported (a chain read, bad key material) would fail\n      // the same way inline, so it reaches the caller unchanged.\n      if (!(error instanceof WorkerUnavailableError)) {\n        this.#teardown(generation, new WorkerUnavailableError(\"Encrypt worker init failed.\"));\n        throw error;\n      }\n      await this.#degrade(generation, error);\n    }\n  }\n\n  /** Reports a caller callback that threw; the reporting itself must not throw back into the worker. */\n  #warnCallbackThrew(callback: string, error: unknown): void {\n    const reason = error instanceof Error ? error.message : String(error);\n    try {\n      this.#config.logger.warn(`Encrypt offload ${callback} callback threw: ${reason}`);\n    } catch {\n      // A logger that throws on its own warning leaves nowhere left to report.\n    }\n  }\n\n  /**\n   * The count spans a whole public entry, its init included, so a release\n   * requested mid-call cannot terminate the worker between the init and the\n   * operation.\n   */\n  async #withActive<T>(work: () => Promise<T>): Promise<T> {\n    this.#active++;\n    try {\n      return await work();\n    } finally {\n      this.#active--;\n      this.#releaseIfIdle();\n    }\n  }\n\n  #releaseIfIdle(): void {\n    if (!this.#releaseRequested || this.#active > 0) {\n      return;\n    }\n    this.#releaseRequested = false;\n    this.#generation?.worker?.terminate();\n    // A full reset, so a release is the recovery lever for a degraded client:\n    // the next call re-fetches the key and spawns a fresh worker either way.\n    this.#generation = undefined;\n    this.#degradePromise = undefined;\n    this.#pinnedInline = false;\n    this.#crashes = NO_CRASHES;\n  }\n\n  #createWorker(): Worker {\n    const source = this.#config.workerSource;\n    if (source === undefined) {\n      return createEncryptWorker();\n    }\n    if (typeof source === \"function\") {\n      const worker = source();\n      // A memoized factory would hand the client a worker it already terminated,\n      // so the contract is one fresh Worker per call.\n      if (handedOutWorkers.has(worker)) {\n        this.#config.logger.warnAlways(\n          \"The offloadWorker factory returned a worker it already handed out; each call must construct a fresh Worker.\",\n        );\n      }\n      handedOutWorkers.add(worker);\n      return worker;\n    }\n    return new Worker(source, { type: \"module\", name: \"zama-fhe-encrypt\" });\n  }\n\n  /** Resolves once the worker's module graph has loaded. */\n  async #spawn(generation: WorkerGeneration): Promise<Remote<EncryptWorkerApi>> {\n    let worker: Worker;\n    try {\n      worker = this.#createWorker();\n    } catch (error) {\n      // A blocked construction is infrastructure, so it must reach the\n      // degrade path as such rather than as the raw thrown error.\n      throw new WorkerUnavailableError(error instanceof Error ? error.message : String(error), {\n        cause: error,\n      });\n    }\n    generation.worker = worker;\n    const api = await this.#raceReady(generation, worker);\n    this.#armCrashHandler(generation, worker);\n    return api;\n  }\n\n  /** Resolves with the Comlink API on the worker's ready message; rejects on the spawn deadline or a pre-ready error. */\n  #raceReady(generation: WorkerGeneration, worker: Worker): Promise<Remote<EncryptWorkerApi>> {\n    return new Promise<Remote<EncryptWorkerApi>>((resolve, reject) => {\n      const settle = () => {\n        clearTimeout(timer);\n        worker.removeEventListener(\"message\", onReady);\n        worker.removeEventListener(\"error\", onError);\n      };\n      const timer = setTimeout(() => {\n        settle();\n        reject(\n          new WorkerUnavailableError(\n            `Encrypt worker did not start within ${this.#config.timeouts.spawn}ms.`,\n          ),\n        );\n      }, this.#config.timeouts.spawn);\n      const onReady = (event: MessageEvent) => {\n        if (event.data === WORKER_READY_MESSAGE) {\n          settle();\n          resolve(wrap<EncryptWorkerApi>(worker));\n        }\n      };\n      const onError = (event: ErrorEvent) => {\n        settle();\n        const message = event.message || \"Encrypt worker error.\";\n        // A worker that never came up is not worth respawning per call, so\n        // this failure is not flagged as a crash.\n        reject(new WorkerUnavailableError(message));\n        this.#teardown(generation, new WorkerUnavailableError(message));\n      };\n      worker.addEventListener(\"message\", onReady);\n      worker.addEventListener(\"error\", onError);\n    });\n  }\n\n  /** Permanent crash detector, armed only after ready so a pre-ready failure never counts as a crash. */\n  #armCrashHandler(generation: WorkerGeneration, worker: Worker): void {\n    worker.addEventListener(\"error\", (event: ErrorEvent) => {\n      // A generation already torn down cannot crash the client again: nothing\n      // is waiting on it, and the worker running in its place is unaffected.\n      if (this.#generation !== generation) {\n        return;\n      }\n      // A ready worker died under us: the teardown drops the memoized init so\n      // the next call spawns a fresh one, and the operations it took down\n      // finish inline.\n      const crash = new WorkerUnavailableError(event.message || \"Encrypt worker error.\", {\n        crashed: true,\n      });\n      this.#crashes = { ...this.#crashes, count: this.#crashes.count + 1, last: crash };\n      this.#teardown(generation, crash);\n    });\n  }\n\n  /**\n   * Awaits one promise crossing the worker boundary, racing the generation's\n   * `doomed` promise so a teardown settles it with the teardown's\n   * `WorkerUnavailableError`, which degrades it inline. Without a `deadline` it\n   * settles whenever the worker answers; a `deadline` bounds a lifecycle step,\n   * and missing it means the worker is presumed stuck, so the generation is\n   * torn down whole.\n   */\n  async #overBoundary<T>(\n    generation: WorkerGeneration,\n    work: Promise<T>,\n    deadline?: { readonly ms: number; readonly operation: string },\n  ): Promise<T> {\n    const timer =\n      deadline === undefined\n        ? undefined\n        : setTimeout(() => {\n            this.#teardown(\n              generation,\n              new WorkerUnavailableError(\n                `Encrypt worker ${deadline.operation} timed out after ${deadline.ms}ms.`,\n              ),\n            );\n          }, deadline.ms);\n    try {\n      return await Promise.race([\n        work.catch((error: unknown) => {\n          const failure = isWireError(error) ? fromWireError(error) : (error as Error);\n          // A payload Comlink could not carry is infrastructure, so it degrades\n          // instead of reaching the caller as the operation's own failure.\n          throw isCloneFailure(failure)\n            ? new WorkerUnavailableError(failure.message, { cause: failure })\n            : failure;\n        }),\n        generation.doomed,\n      ]);\n    } finally {\n      if (timer !== undefined) {\n        clearTimeout(timer);\n      }\n    }\n  }\n\n  /**\n   * Rejects and drops one generation whole: its worker, its memoized init, and\n   * every crossing racing its `doomed` promise. The next call therefore re-runs\n   * the cycle on a fresh generation, so a spurious teardown costs a respawn\n   * rather than a permanent degrade.\n   */\n  #teardown(generation: WorkerGeneration | undefined, error: WorkerUnavailableError): void {\n    if (generation === undefined) {\n      return;\n    }\n    if (this.#generation === generation) {\n      this.#generation = undefined;\n    }\n    generation.worker?.terminate();\n    generation.worker = undefined;\n    generation.api = undefined;\n    generation.initPromise = undefined;\n    generation.doom(error);\n  }\n\n  async #degrade(\n    generation: WorkerGeneration | undefined,\n    cause: unknown,\n  ): Promise<EncryptOffloadBackend> {\n    const reason = cause instanceof Error ? cause.message : String(cause);\n    if (this.#config.strict) {\n      this.#teardown(generation, new WorkerUnavailableError(\"Encrypt worker unavailable.\"));\n      throw new EncryptOffloadUnavailableError(\n        `Encrypt offload required (offloadEncrypt: true) but unavailable: ${reason}`,\n        { cause },\n      );\n    }\n    const { transient, pinning } = this.#classifyDegrade(cause);\n    this.#pinnedInline ||= !transient;\n    this.#teardown(generation, new WorkerUnavailableError(\"Encrypt worker degraded to inline.\"));\n    this.#warnDegraded(reason, transient, pinning);\n    if (this.#degradePromise === undefined) {\n      // Only a live backend is memoized: an inline init is a key refetch, and a\n      // transient failure there must not close the degrade path for the session.\n      const attempt: Promise<EncryptOffloadBackend> = (async () => {\n        const inline = this.#config.createInlineClient();\n        await inline.init();\n        return inline;\n      })().catch((error: unknown) => {\n        if (this.#degradePromise === attempt) {\n          this.#degradePromise = undefined;\n        }\n        this.#config.logger.warnAlways(\n          `Encrypt inline fallback failed to initialize: ${error instanceof Error ? error.message : String(error)}`,\n        );\n        throw error;\n      });\n      this.#degradePromise = attempt;\n    }\n    return this.#degradePromise;\n  }\n\n  /**\n   * How one failure degrades, read off the state before the degrade mutates it:\n   * `transient` diverts only this call, `pinning` settles the client inline now.\n   * One crash is treated as transient; a repeat crash, or a worker that never\n   * came up, settles the client inline rather than spawning a replacement per call.\n   */\n  #classifyDegrade(cause: unknown): { readonly transient: boolean; readonly pinning: boolean } {\n    const transient =\n      cause instanceof WorkerUnavailableError &&\n      cause.crashed &&\n      this.#crashes.count < CRASH_PIN_THRESHOLD;\n    return { transient, pinning: !transient && !this.#pinnedInline };\n  }\n\n  /** One warning per failure, whether it pins the client inline or only diverts this call. */\n  #warnDegraded(reason: string, transient: boolean, pinning: boolean): void {\n    if (!pinning && this.#crashes.warnedFor === this.#crashes.count) {\n      return;\n    }\n    this.#crashes = { ...this.#crashes, warnedFor: this.#crashes.count };\n    const scope = transient ? \"in-flight encryption falls back\" : \"encryption falls back\";\n    // Always on the console: a silent return to main-thread encryption is the\n    // freeze this offload prevents.\n    this.#config.logger.warnAlways(\n      `${ENCRYPT_OFFLOAD_WARN_PREFIX}, ${scope} to the calling thread: ${reason}`,\n    );\n  }\n}\n","import { createUnsignedLegacyDecryptionPermitEip712 as createUnsignedLegacyDecryptionPermitEip712Action } from \"@fhevm/sdk/actions/base\";\nimport {\n  createFhevmBaseClient,\n  createFhevmDecryptClient,\n  createFhevmEncryptClient,\n  hasFhevmRuntimeConfig,\n} from \"@fhevm/sdk/viem\";\nimport {\n  createFhevmCleartextBaseClient,\n  createFhevmCleartextDecryptClient,\n  createFhevmCleartextEncryptClient,\n} from \"@fhevm/sdk/viem/cleartext\";\nimport { createPublicClient, custom, http } from \"viem\";\nimport { toFhevmChain } from \"../chains/to-fhevm-chain\";\nimport type { FheChain } from \"../chains/types\";\nimport { ConfigurationError } from \"../errors\";\nimport { getAppliedWireRuntime, hasAppliedLocateFile } from \"./applied-runtime\";\nimport type { LoggerService } from \"../services/logger-service\";\nimport { type RelayerTelemetry, telemetryHeaders } from \"../telemetry\";\nimport {\n  DEFAULT_ENCRYPT_WORKER_TIMEOUTS,\n  EncryptWorkerClient,\n  type EncryptWorkerClientConfig,\n  type EncryptWorkerTimeouts,\n} from \"../worker/encrypt-worker-client\";\nimport { BUNDLED_ENCRYPT_WORKER } from \"../worker/spawn\";\nimport type {\n  FhevmBaseClient,\n  FhevmClient,\n  FhevmDecryptClient,\n  FhevmEncryptBackend,\n  FhevmRelayerOptions,\n  RelayerRequestOptions,\n  RelayerSDK,\n  RelayerOptions,\n  WireRuntimeConfig,\n} from \"./types\";\n\n/** The `@fhevm/sdk` client inputs the worker realm rebuilds its own client from. */\ntype EncryptInitPayload = EncryptWorkerClientConfig[\"initPayload\"];\n\n/** Construction config for {@link FhevmRelayer}. */\nexport interface FhevmRelayerConfig {\n  /** FHE chain configuration. */\n  chain: FheChain;\n  /**\n   * Cleartext mode for local dev/test chains without FHE infrastructure — reads\n   * mock cleartexts from the on-chain executor (discovered automatically)\n   * instead of calling the relayer.\n   */\n  cleartext?: boolean;\n  /**\n   * Per-transport {@link RelayerOptions}: `@fhevm/sdk` client options plus a\n   * default request `timeout` applied to every relayer round-trip on the chain.\n   */\n  options?: RelayerOptions;\n  /** Encrypt-worker offload mode; see `web()`'s `offloadEncrypt` option. */\n  offloadEncrypt?: \"auto\" | boolean;\n  /** Watchdog deadlines for the encrypt worker; `web()` defaults every field before it gets here. */\n  offloadTimeouts?: EncryptWorkerTimeouts;\n  /** Custom source for the encrypt worker; see `web()`'s `offloadWorker` option. */\n  offloadWorker?: string | URL | (() => Worker);\n  /** Receives worker log lines and offload-fallback warnings. */\n  logger: LoggerService;\n  telemetry?: RelayerTelemetry;\n}\n\n/**\n * Single-chain FHE backend that drives `@fhevm/sdk` on the calling thread with\n * capability-scoped lazy initialization.\n * EIP-712 signing is done by the signer layer; this backend builds the typed\n * data and, on decrypt, reassembles the new SDK's signed permit from the\n * interface's params + the previously returned signature.\n *\n * @remarks\n * Each method delegates to the narrowest base, decrypt, or encrypt client,\n * adding two cross-cutting behaviors that the delegated signatures don't\n * express:\n *\n * - **Lazy init.** Each operation initializes only the capability it requires.\n *   Public decrypt avoids WASM, private decrypt loads TKMS only, and encryption\n *   alone loads TFHE and the FHE encryption key.\n * - **Option merging.** The chain's default options (`auth`, `timeout`, `debug`)\n *   are spread in first, then the per-call `options`, so a per-call value always\n *   wins over the chain default. Serialization helpers make no relayer\n *   round-trip, so they inject no options.\n *\n * @internal\n */\nexport class FhevmRelayer implements RelayerSDK {\n  readonly #chain: FheChain;\n  readonly #base: FhevmBaseClient;\n  readonly #decrypt: FhevmDecryptClient;\n  readonly #encrypt: FhevmEncryptBackend;\n  readonly #defaultOptions: Partial<FhevmRelayerOptions>;\n  readonly #telemetry: RelayerTelemetry | undefined;\n  #encryptInitPromise: Promise<void> | undefined;\n\n  /**\n   * Builds capability-scoped `@fhevm/sdk` clients for the chain and captures\n   * the chain's `auth`/`timeout`/`debug` as request defaults. Construction is\n   * cheap; each client's one-time init is deferred to its first operation.\n   */\n  constructor(config: FhevmRelayerConfig) {\n    this.#chain = config.chain;\n    const { timeout, debug, batchRpcCalls, moduleVersions, fheEncryptionKey } =\n      config.options ?? {};\n    const auth = this.#chain.auth ? toFhevmAuth(this.#chain.auth) : undefined;\n    const transport =\n      typeof this.#chain.network === \"string\"\n        ? http(this.#chain.network)\n        : custom(this.#chain.network);\n    const params = {\n      publicClient: createPublicClient({ transport }),\n      chain: toFhevmChain(this.#chain),\n      options: { batchRpcCalls, moduleVersions, fheEncryptionKey },\n    };\n    this.#defaultOptions = {\n      ...(auth !== undefined && { auth }),\n      ...(timeout !== undefined && { timeout }),\n      ...(debug !== undefined && { debug }),\n    };\n    this.#telemetry = config.telemetry;\n    // The FHE key is always fetched here, on the calling thread, so the chain's\n    // default request options (auth in particular) apply; a worker realm has no\n    // access to them.\n    const prefetchKey = () =>\n      this.#base.fetchFheEncryptionKeyBytes({ options: this.#requestOptions(undefined) });\n    // Re-listed rather than spread: the upstream client exposes an enumerable\n    // `ready` getter, and a spread would call it, starting init at construction.\n    const withInlineInit = (client: FhevmEncryptBackend): FhevmEncryptBackend => ({\n      init: async () => {\n        await prefetchKey();\n        await client.init();\n      },\n      encryptValue: (parameters) => client.encryptValue(parameters),\n      encryptValues: (parameters) => client.encryptValues(parameters),\n      fetchFheEncryptionKeyBytes: (parameters) => client.fetchFheEncryptionKeyBytes(parameters),\n    });\n    if (config.cleartext) {\n      this.#base = createFhevmCleartextBaseClient(params);\n      this.#decrypt = createFhevmCleartextDecryptClient(params);\n      this.#encrypt = withInlineInit(createFhevmCleartextEncryptClient(params));\n    } else {\n      this.#base = createFhevmBaseClient(params);\n      this.#decrypt = createFhevmDecryptClient(params);\n      this.#encrypt = this.#buildEncryptBackend(config, params, {\n        prefetchKey,\n        createInlineClient: () => withInlineInit(createFhevmEncryptClient(params)),\n      });\n    }\n  }\n\n  /**\n   * Picks the encrypt backend for a non-cleartext chain: the worker client when\n   * offload is on and reachable, the inline calling-thread client otherwise.\n   */\n  #buildEncryptBackend(\n    config: FhevmRelayerConfig,\n    params: { chain: EncryptInitPayload[\"chain\"]; options: EncryptInitPayload[\"clientOptions\"] },\n    inline: {\n      prefetchKey: EncryptWorkerClientConfig[\"prefetchKey\"];\n      createInlineClient: () => FhevmEncryptBackend;\n    },\n  ): FhevmEncryptBackend {\n    const offload = config.offloadEncrypt ?? false;\n    const strict = offload === true;\n    const workerAvailable =\n      typeof Worker === \"function\" &&\n      (config.offloadWorker !== undefined || BUNDLED_ENCRYPT_WORKER);\n    // Silent both ways: offload off is what the caller asked for, and a realm\n    // with no Worker is an environment fact that would warn on every SSR\n    // render. Strict skips the capability check, since construction runs during\n    // that render and the failure must surface at call time instead.\n    if (offload === false || !(strict || workerAvailable)) {\n      return inline.createInlineClient();\n    }\n    const runtime = getAppliedWireRuntime();\n    const blocker = encryptOffloadBlocker(runtime);\n    if (blocker !== undefined && !strict) {\n      // Always on the console: the alternative is an opaque rejection at\n      // encrypt time, or WASM assets silently resolved from the default URLs.\n      config.logger.warnAlways(`Encryption runs on the calling thread: ${blocker}.`);\n      return inline.createInlineClient();\n    }\n    const workerClient = new EncryptWorkerClient({\n      initPayload: { chain: params.chain, clientOptions: params.options, runtime: runtime ?? {} },\n      network: this.#chain.network,\n      prefetchKey: inline.prefetchKey,\n      createInlineClient: inline.createInlineClient,\n      logger: config.logger,\n      timeouts: config.offloadTimeouts ?? DEFAULT_ENCRYPT_WORKER_TIMEOUTS,\n      workerSource: config.offloadWorker,\n      // Strict with a blocker: the client degrades at init, which rejects at\n      // call time rather than at config time.\n      blockedReason: blocker,\n      strict,\n    });\n    return {\n      init: () => workerClient.init(),\n      encryptValue: (parameters) => workerClient.encryptValue(parameters),\n      encryptValues: (parameters) => workerClient.encryptValues(parameters),\n      // Served from the calling thread: routing it through the worker would\n      // structured-clone the ~50 MB key back out on every call. `ignoreCache`\n      // therefore refreshes this thread's cache, not the worker's seeded key.\n      fetchFheEncryptionKeyBytes: (parameters) => this.#base.fetchFheEncryptionKeyBytes(parameters),\n      dispose: () => workerClient.dispose(),\n    };\n  }\n\n  /** The FHE chain this backend is bound to. */\n  get chain() {\n    return this.#chain;\n  }\n\n  // `operation` becomes a header here and must never reach `@fhevm/sdk`.\n  #requestOptions<T extends Partial<FhevmRelayerOptions> | undefined>(\n    options: T,\n  ): Omit<Partial<FhevmRelayerOptions> & NonNullable<T>, \"operation\"> {\n    const { operation, ...merged } = {\n      ...this.#defaultOptions,\n      ...options,\n    } as Partial<FhevmRelayerOptions> & NonNullable<T> & RelayerRequestOptions;\n    if (this.#telemetry === undefined) {\n      return merged;\n    }\n    return {\n      ...merged,\n      headers: { ...merged.headers, ...telemetryHeaders(this.#telemetry, operation) },\n    };\n  }\n\n  // Only a fulfilled init is memoized: a rejection clears the memo so the next\n  // encryption retries instead of inheriting a transient key-fetch failure.\n  #initEncrypt = (): Promise<void> => {\n    this.#encryptInitPromise ??= this.#encrypt.init().catch((error: unknown) => {\n      this.#encryptInitPromise = undefined;\n      throw error;\n    });\n    return this.#encryptInitPromise;\n  };\n\n  /**\n   * Releases the encrypt worker once in-flight encryptions settle and drops the\n   * memoized init; the next encryption spawns a fresh worker and re-initializes.\n   */\n  dispose = (): void => {\n    this.#encryptInitPromise = undefined;\n    this.#encrypt.dispose?.();\n  };\n\n  /**\n   * Decrypts a single publicly-decryptable value — one whose contract granted\n   * public access, so no permit or key pair is needed — into its typed clear\n   * value.\n   *\n   * @example\n   * ```ts\n   * const { type, value } = await relayer.decryptPublicValue({\n   *   encryptedValue: handle, // a bytes32 ciphertext reference\n   * });\n   * ```\n   */\n  decryptPublicValue: FhevmClient[\"decryptPublicValue\"] = async (parameters) => {\n    await this.#base.init();\n    return this.#base.decryptPublicValue({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * Batch form of {@link decryptPublicValue}: decrypts many publicly-decryptable\n   * values in one relayer round-trip, returning their typed clear values in\n   * order.\n   *\n   * @example\n   * ```ts\n   * const values = await relayer.decryptPublicValues({\n   *   encryptedValues: [handleA, handleB],\n   * });\n   * ```\n   */\n  decryptPublicValues: FhevmClient[\"decryptPublicValues\"] = async (parameters) => {\n    await this.#base.init();\n    return this.#base.decryptPublicValues({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * Like {@link decryptPublicValues}, but also returns the KMS signature bundle —\n   * the handles list, ABI-encoded cleartexts, and decryption proof — needed to\n   * verify or replay the result on-chain.\n   *\n   * @example\n   * ```ts\n   * const { clearValues, checkSignaturesArgs } =\n   *   await relayer.decryptPublicValuesWithSignatures({ encryptedValues: [handle] });\n   * // checkSignaturesArgs: { handlesList, abiEncodedCleartexts, decryptionProof }\n   * ```\n   */\n  decryptPublicValuesWithSignatures: FhevmClient[\"decryptPublicValuesWithSignatures\"] = async (\n    parameters,\n  ) => {\n    await this.#base.init();\n    return this.#base.decryptPublicValuesWithSignatures({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * Encrypts one typed input under the chain's FHE key, bound to the contract it\n   * targets and the user submitting it, and returns the ciphertext handle plus\n   * the input proof the contract verifies on-chain. `type` is the FHE type\n   * with the `e` prefix (`\"euint64\"`, `\"ebool\"`, `\"eaddress\"`).\n   *\n   * @example\n   * ```ts\n   * const { encryptedValue, inputProof } = await relayer.encryptValue({\n   *   value: { type: \"euint64\", value: 1000n },\n   *   contractAddress: \"0xToken…\",\n   *   userAddress: \"0xUser…\",\n   * });\n   * ```\n   */\n  encryptValue: FhevmClient[\"encryptValue\"] = async (parameters) => {\n    await this.#initEncrypt();\n    return this.#encrypt.encryptValue({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * Batch form of {@link encryptValue}: encrypts several inputs for the same\n   * contract and user in one call, returning all ciphertext handles under a\n   * single shared input proof.\n   *\n   * @example\n   * ```ts\n   * const { encryptedValues, inputProof } = await relayer.encryptValues({\n   *   values: [\n   *     { type: \"euint64\", value: 1000n },\n   *     { type: \"ebool\", value: true },\n   *   ],\n   *   contractAddress: \"0xToken…\",\n   *   userAddress: \"0xUser…\",\n   * });\n   * ```\n   */\n  encryptValues: FhevmClient[\"encryptValues\"] = async (parameters) => {\n    await this.#initEncrypt();\n    return this.#encrypt.encryptValues({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * User-decrypts a single access-controlled value: the relayer re-encrypts it\n   * to the ephemeral transport key pair, gated by the signed permit, and this\n   * returns the typed clear value. Build the key pair with\n   * {@link generateTransportKeyPair} and the permit with\n   * {@link signDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const { type, value } = await relayer.decryptValue({\n   *   encryptedValue: handle,\n   *   contractAddress: \"0xToken…\",\n   *   transportKeyPair,\n   *   signedPermit,\n   * });\n   * ```\n   */\n  decryptValue: FhevmClient[\"decryptValue\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.decryptValue({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * Batch form of {@link decryptValue} for values that all belong to the same\n   * contract; returns the typed clear values positionally. For values spanning\n   * multiple contracts, use {@link decryptValuesFromPairs}.\n   *\n   * @example\n   * ```ts\n   * const values = await relayer.decryptValues({\n   *   encryptedValues: [handleA, handleB],\n   *   contractAddress: \"0xToken…\",\n   *   transportKeyPair,\n   *   signedPermit,\n   * });\n   * ```\n   */\n  decryptValues: FhevmClient[\"decryptValues\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.decryptValues({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * User-decrypts values that span multiple contracts: each pair carries its own\n   * `contractAddress`, so one permit covering those contracts decrypts them all\n   * in a single round-trip. Returns the typed clear values positionally.\n   *\n   * @example\n   * ```ts\n   * const values = await relayer.decryptValuesFromPairs({\n   *   pairs: [\n   *     { encryptedValue: handleA, contractAddress: \"0xTokenA…\" },\n   *     { encryptedValue: handleB, contractAddress: \"0xTokenB…\" },\n   *   ],\n   *   transportKeyPair,\n   *   signedPermit,\n   * });\n   * ```\n   */\n  decryptValuesFromPairs: FhevmClient[\"decryptValuesFromPairs\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.decryptValuesFromPairs({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * Fetches the chain's raw FHE public-key bytes — the key encryption uses —\n   * served from cache unless `ignoreCache` forces a refetch. Rarely called\n   * directly: {@link encryptValue}/{@link encryptValues} fetch the key for you.\n   *\n   * @example\n   * ```ts\n   * const keyBytes = await relayer.fetchFheEncryptionKeyBytes();\n   * const fresh = await relayer.fetchFheEncryptionKeyBytes({ ignoreCache: true });\n   * ```\n   */\n  fetchFheEncryptionKeyBytes: FhevmClient[\"fetchFheEncryptionKeyBytes\"] = async (parameters) => {\n    // Served from the base client, which shares the key cache with the encrypt\n    // client: initializing encryption here would spawn the encrypt worker and\n    // wait out its bring-up for a key this thread fetches itself.\n    await this.#base.init();\n    return this.#base.fetchFheEncryptionKeyBytes({\n      ...parameters,\n      options: this.#requestOptions(parameters?.options),\n    });\n  };\n\n  /**\n   * Builds the EIP-712 user-decrypt permit and signs it with the given signer,\n   * authorizing the transport key pair to decrypt the listed contracts' values\n   * for `durationSeconds` starting at `startTimestamp`. Pass `delegatorAddress`\n   * to sign a delegated permit — decrypting values owned by that account instead\n   * of the signer's own. Persist the result via\n   * {@link serializeSignedDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const signedPermit = await relayer.signDecryptionPermit({\n   *   transportKeyPair,\n   *   contractAddresses: [\"0xToken…\"],\n   *   startTimestamp: Math.floor(Date.now() / 1000),\n   *   durationSeconds: 60 * 60 * 24,\n   *   signerAddress: \"0xUser…\",\n   *   signer,\n   *   // delegatorAddress: \"0xOwner…\", // omit for a self permit\n   * });\n   * ```\n   */\n  signDecryptionPermit: FhevmClient[\"signDecryptionPermit\"] = async (parameters) => {\n    await this.#base.init();\n    return this.#base.signDecryptionPermit(parameters);\n  };\n\n  /**\n   * Builds the unsigned EIP-712 typed data for a V1 decryption permit, without\n   * signing it — the signer-less counterpart to {@link signDecryptionPermit}.\n   * Hand the result to an out-of-process signer for `eth_signTypedData_v4`,\n   * then verify the returned signature via {@link parseSignedDecryptionPermit}.\n   *\n   * Not on `@fhevm/sdk`'s client decorator, so it's called directly against\n   * the base client rather than through a decorated method.\n   *\n   * @example\n   * ```ts\n   * const eip712 = await relayer.createUnsignedLegacyDecryptionPermitEip712({\n   *   transportKeyPair,\n   *   contractAddresses: [\"0xToken…\"],\n   *   startTimestamp: Math.floor(Date.now() / 1000),\n   *   durationSeconds: 60 * 60 * 24,\n   *   // delegatorAddress: \"0xOwner…\", // omit for a self permit\n   * });\n   * ```\n   */\n  createUnsignedLegacyDecryptionPermitEip712: RelayerSDK[\"createUnsignedLegacyDecryptionPermitEip712\"] =\n    (parameters) => createUnsignedLegacyDecryptionPermitEip712Action(this.#base, parameters);\n\n  // Permit/key-pair helpers carry no request options. Parsing explicitly\n  // initializes the capability that validates the restored value; serialization\n  // resolves the frozen context internally (via initPublicAction), which reads\n  // on-chain state.\n\n  /**\n   * Serializes a transport key pair to a hex `{ publicKey, privateKey }` pair for\n   * storage or transport, so a decryption session can resume without regenerating\n   * keys. Reverse of {@link parseTransportKeyPair}.\n   *\n   * @example\n   * ```ts\n   * const stored = await relayer.serializeTransportKeyPair({ transportKeyPair });\n   * // { publicKey: \"0x…\", privateKey: \"0x…\" }\n   * ```\n   */\n  serializeTransportKeyPair: FhevmClient[\"serializeTransportKeyPair\"] = (parameters) =>\n    this.#decrypt.serializeTransportKeyPair(parameters);\n\n  /**\n   * Serializes a signed permit to a plain, JSON-stringifiable object (version,\n   * EIP-712 payload, signature, signer) for caching or transport. Reverse of\n   * {@link parseSignedDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const serialized = await relayer.serializeSignedDecryptionPermit({ signedPermit });\n   * localStorage.setItem(\"permit\", JSON.stringify(serialized));\n   * ```\n   */\n  serializeSignedDecryptionPermit: FhevmClient[\"serializeSignedDecryptionPermit\"] = (parameters) =>\n    this.#base.serializeSignedDecryptionPermit(parameters);\n\n  /**\n   * Rebuilds a transport key pair from its serialized hex\n   * `{ publicKey, privateKey }` form. Reverse of {@link serializeTransportKeyPair}.\n   *\n   * @example\n   * ```ts\n   * const transportKeyPair = await relayer.parseTransportKeyPair({\n   *   publicKey: stored.publicKey,\n   *   privateKey: stored.privateKey,\n   * });\n   * ```\n   */\n  parseTransportKeyPair: FhevmClient[\"parseTransportKeyPair\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.parseTransportKeyPair(parameters);\n  };\n\n  /**\n   * Rebuilds a signed permit from its serialized form and validates it: checks\n   * the EIP-712 structure, verifies the signature against the on-chain verifier,\n   * and confirms the permit's public key matches `transportKeyPair`. Reverse of\n   * {@link serializeSignedDecryptionPermit}.\n   *\n   * @throws if the permit is malformed, expired, or its signature is invalid.\n   *\n   * @example\n   * ```ts\n   * const signedPermit = await relayer.parseSignedDecryptionPermit({\n   *   serializedPermit,\n   *   transportKeyPair,\n   * });\n   * ```\n   */\n  parseSignedDecryptionPermit: FhevmClient[\"parseSignedDecryptionPermit\"] = async (parameters) => {\n    await this.#base.init();\n    const { serializedPermit } = parameters;\n    return this.#base.parseSignedDecryptionPermit({\n      ...parameters,\n      serializedPermit: {\n        ...serializedPermit,\n        signature: normalizeSignatureV(serializedPermit.signature),\n      },\n    });\n  };\n\n  /**\n   * Generates a fresh ephemeral transport key pair for a user-decrypt session.\n   * The relayer re-encrypts decrypted values to this pair's public key, so only\n   * the holder of the private key can read them; bind it to a permit via\n   * {@link signDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const transportKeyPair = await relayer.generateTransportKeyPair();\n   * ```\n   */\n  generateTransportKeyPair: FhevmClient[\"generateTransportKeyPair\"] = async () => {\n    await this.#decrypt.init();\n    return this.#decrypt.generateTransportKeyPair();\n  };\n}\n\n/**\n * Rewrites a 65-byte signature's recovery byte from 0/1 to 27/28. The gateway\n * verifies V1 permits on-chain with OpenZeppelin `ECDSA.recover`, which rejects\n * 0/1. Longer signatures (ERC-1271, concatenated) pass through untouched.\n */\nfunction normalizeSignatureV(signature: string): string {\n  if (signature.length !== 132) {\n    return signature;\n  }\n  const v = parseInt(signature.slice(130), 16);\n  if (v !== 0 && v !== 1) {\n    return signature;\n  }\n  return `${signature.slice(0, 130)}${v === 0 ? \"1b\" : \"1c\"}`;\n}\n\n/**\n * The one reason, if any, this thread's configuration cannot be reproduced in\n * the worker realm, so offload is worse than inline there.\n */\nfunction encryptOffloadBlocker(runtime: WireRuntimeConfig | undefined): string | undefined {\n  // A runtime `locateFile` is a function: it cannot be cloned into the worker\n  // realm, which would silently resolve WASM assets from the default URLs.\n  if (hasAppliedLocateFile()) {\n    return \"a runtime locateFile cannot cross the encrypt worker boundary\";\n  }\n  // Unreadable here, so the worker would run on fhevm defaults: an auth it\n  // carries would 401 inside the worker as an application error, which never degrades.\n  if (runtime === undefined && hasFhevmRuntimeConfig()) {\n    return \"a runtime config set outside createConfig cannot be replicated in the encrypt worker realm\";\n  }\n  return undefined;\n}\n\n/**\n * Translates the SDK's public {@link FheChain.auth} shape (discriminated by\n * `__type`) into the `type`-discriminated `auth` that `@fhevm/sdk` expects.\n *\n * @throws if the auth discriminator is not one of the supported kinds.\n */\nfunction toFhevmAuth(\n  auth: NonNullable<FheChain[\"auth\"]>,\n): NonNullable<FhevmRelayerOptions[\"auth\"]> {\n  const type = auth[\"__type\"];\n  switch (type) {\n    case \"ApiKeyHeader\":\n      return { type, value: auth.value, header: auth.header };\n    case \"ApiKeyCookie\":\n      return { type, value: auth.value, cookie: auth.cookie };\n    case \"BearerToken\":\n      return { type, token: auth.token };\n    default:\n      throw new ConfigurationError(`Unknown auth type: ${String(type)}`);\n  }\n}\n"],"x_google_ignoreList":[1],"mappings":"2oBAYA,SAAgB,EAAa,EAA6B,CACxD,MAAO,CACL,GAAI,EAAM,GACV,MAAO,CACL,UAAW,CACT,IAAK,CAAE,QAAS,EAAM,kBAAmB,EACzC,cAAe,CAAE,QAAS,EAAM,4BAA6B,EAC7D,YAAa,CAAE,QAAS,EAAM,kBAAmB,EACjD,eAAgB,IAAA,EAClB,EACA,WAAY,EAAM,WAClB,QAAS,CACP,GAAI,EAAM,eACV,UAAW,CACT,WAAY,CAAE,QAAS,EAAM,kCAAmC,EAChE,kBAAmB,CAAE,QAAS,EAAM,yCAA0C,CAChF,CACF,CACF,CACF,CACF;;;;;;AC3BA,MAAM,EAAc,OAAO,eAAe,EACpC,EAAiB,OAAO,kBAAkB,EAC1C,EAAe,OAAO,sBAAsB,EAC5C,EAAY,OAAO,mBAAmB,EACtC,EAAc,OAAO,gBAAgB,EACrC,EAAY,GAAS,OAAO,GAAQ,YAAY,GAAiB,OAAO,GAAQ,WAgDhF,EAAmB,IAAI,IAAI,CAC7B,CAAC,QAAS,CA5CV,UAAY,GAAQ,EAAS,CAAG,GAAK,EAAI,GACzC,UAAU,EAAK,CACX,GAAM,CAAE,QAAO,SAAU,IAAI,eAE7B,OADA,EAAO,EAAK,CAAK,EACV,CAAC,EAAO,CAAC,CAAK,CAAC,CAC1B,EACA,YAAY,EAAM,CAEd,OADA,EAAK,MAAM,EACJ,EAAK,CAAI,CACpB,CAmC6B,CAAC,EAC9B,CAAC,QAAS,CA9BV,UAAY,GAAU,EAAS,CAAK,GAAK,KAAe,EACxD,UAAU,CAAE,SAAS,CACjB,IAAI,EAcJ,MAbA,CAWI,EAXA,aAAiB,MACJ,CACT,QAAS,GACT,MAAO,CACH,QAAS,EAAM,QACf,KAAM,EAAM,KACZ,MAAO,EAAM,KACjB,CACJ,EAGa,CAAE,QAAS,GAAO,OAAM,EAElC,CAAC,EAAY,CAAC,CAAC,CAC1B,EACA,YAAY,EAAY,CAIpB,MAHI,EAAW,QACL,OAAO,OAAW,MAAM,EAAW,MAAM,OAAO,EAAG,EAAW,KAAK,EAEvE,EAAW,KACrB,CAO6B,CAAC,CAClC,CAAC,EACD,SAAS,EAAgB,EAAgB,EAAQ,CAC7C,IAAK,IAAM,KAAiB,EAIxB,GAHI,IAAW,GAAiB,IAAkB,KAG9C,aAAyB,QAAU,EAAc,KAAK,CAAM,EAC5D,MAAO,GAGf,MAAO,EACX,CACA,SAAS,EAAO,EAAK,EAAK,WAAY,EAAiB,CAAC,GAAG,EAAG,CAC1D,EAAG,iBAAiB,UAAW,SAAS,EAAS,EAAI,CACjD,GAAI,CAAC,GAAM,CAAC,EAAG,KACX,OAEJ,GAAI,CAAC,EAAgB,EAAgB,EAAG,MAAM,EAAG,CAC7C,QAAQ,KAAK,mBAAmB,EAAG,OAAO,oBAAoB,EAC9D,MACJ,CACA,GAAM,CAAE,KAAI,OAAM,QAAS,OAAO,OAAO,CAAE,KAAM,CAAC,CAAE,EAAG,EAAG,IAAI,EACxD,GAAgB,EAAG,KAAK,cAAgB,CAAC,EAAA,CAAG,IAAI,CAAa,EAC/D,EACJ,GAAI,CACA,IAAM,EAAS,EAAK,MAAM,EAAG,EAAE,CAAC,CAAC,QAAQ,EAAK,IAAS,EAAI,GAAO,CAAG,EAC/D,EAAW,EAAK,QAAQ,EAAK,IAAS,EAAI,GAAO,CAAG,EAC1D,OAAQ,EAAR,CACI,IAAK,MAEG,EAAc,EAElB,MACJ,IAAK,MAEG,EAAO,EAAK,MAAM,EAAE,CAAC,CAAC,IAAM,EAAc,EAAG,KAAK,KAAK,EACvD,EAAc,GAElB,MACJ,IAAK,QAEG,EAAc,EAAS,MAAM,EAAQ,CAAY,EAErD,MACJ,IAAK,YAGG,EAAc,EAAM,IADF,EAAS,GAAG,CACN,CAAC,EAE7B,MACJ,IAAK,WACD,CACI,GAAM,CAAE,QAAO,SAAU,IAAI,eAC7B,EAAO,EAAK,CAAK,EACjB,EAAc,EAAS,EAAO,CAAC,CAAK,CAAC,CACzC,CACA,MACJ,IAAK,UAEG,EAAc,IAAA,GAElB,MACJ,QACI,MACR,CACJ,OACO,EAAO,CACV,EAAc,CAAE,SAAQ,GAAc,CAAE,CAC5C,CACA,QAAQ,QAAQ,CAAW,CAAC,CACvB,MAAO,IACD,CAAE,SAAQ,GAAc,CAAE,EACpC,CAAC,CACG,KAAM,GAAgB,CACvB,GAAM,CAAC,EAAW,GAAiB,EAAY,CAAW,EAC1D,EAAG,YAAY,OAAO,OAAO,OAAO,OAAO,CAAC,EAAG,CAAS,EAAG,CAAE,IAAG,CAAC,EAAG,CAAa,EAC7E,IAAS,YAET,EAAG,oBAAoB,UAAW,CAAQ,EAC1C,EAAc,CAAE,EACZ,KAAa,GAAO,OAAO,EAAI,IAAe,YAC9C,EAAI,EAAU,CAAC,EAG3B,CAAC,CAAC,CACG,MAAO,GAAU,CAElB,GAAM,CAAC,EAAW,GAAiB,EAAY,CAC3C,MAAW,UAAU,6BAA6B,GACjD,GAAc,CACnB,CAAC,EACD,EAAG,YAAY,OAAO,OAAO,OAAO,OAAO,CAAC,EAAG,CAAS,EAAG,CAAE,IAAG,CAAC,EAAG,CAAa,CACrF,CAAC,CACL,CAAC,EACG,EAAG,OACH,EAAG,MAAM,CAEjB,CACA,SAAS,GAAc,EAAU,CAC7B,OAAO,EAAS,YAAY,OAAS,aACzC,CACA,SAAS,EAAc,EAAU,CACzB,GAAc,CAAQ,GACtB,EAAS,MAAM,CACvB,CACA,SAAS,EAAK,EAAI,EAAQ,CACtB,IAAM,EAAmB,IAAI,IAiB7B,OAhBA,EAAG,iBAAiB,UAAW,SAAuB,EAAI,CACtD,GAAM,CAAE,QAAS,EACjB,GAAI,CAAC,GAAQ,CAAC,EAAK,GACf,OAEJ,IAAM,EAAW,EAAiB,IAAI,EAAK,EAAE,EACxC,KAGL,GAAI,CACA,EAAS,CAAI,CACjB,QACQ,CACJ,EAAiB,OAAO,EAAK,EAAE,CACnC,CACJ,CAAC,EACM,EAAY,EAAI,EAAkB,CAAC,EAAG,CAAM,CACvD,CACA,SAAS,EAAqB,EAAY,CACtC,GAAI,EACA,MAAU,MAAM,4CAA4C,CAEpE,CACA,SAAS,EAAgB,EAAI,CACzB,OAAO,EAAuB,EAAI,IAAI,IAAO,CACzC,KAAM,SACV,CAAC,CAAC,CAAC,SAAW,CACV,EAAc,CAAE,CACpB,CAAC,CACL,CACA,MAAM,EAAe,IAAI,QACnB,EAAkB,yBAA0B,YAC9C,IAAI,qBAAsB,GAAO,CAC7B,IAAM,GAAY,EAAa,IAAI,CAAE,GAAK,GAAK,EAC/C,EAAa,IAAI,EAAI,CAAQ,EACzB,IAAa,GACb,EAAgB,CAAE,CAE1B,CAAC,EACL,SAAS,EAAc,EAAO,EAAI,CAC9B,IAAM,GAAY,EAAa,IAAI,CAAE,GAAK,GAAK,EAC/C,EAAa,IAAI,EAAI,CAAQ,EACzB,GACA,EAAgB,SAAS,EAAO,EAAI,CAAK,CAEjD,CACA,SAAS,EAAgB,EAAO,CACxB,GACA,EAAgB,WAAW,CAAK,CAExC,CACA,SAAS,EAAY,EAAI,EAAkB,EAAO,CAAC,EAAG,EAAS,UAAY,CAAE,EAAG,CAC5E,IAAI,EAAkB,GAChB,EAAQ,IAAI,MAAM,EAAQ,CAC5B,IAAI,EAAS,EAAM,CAEf,GADA,EAAqB,CAAe,EAChC,IAAS,EACT,UAAa,CACT,EAAgB,CAAK,EACrB,EAAgB,CAAE,EAClB,EAAiB,MAAM,EACvB,EAAkB,EACtB,EAEJ,GAAI,IAAS,OAAQ,CACjB,GAAI,EAAK,SAAW,EAChB,MAAO,CAAE,SAAY,CAAM,EAE/B,IAAM,EAAI,EAAuB,EAAI,EAAkB,CACnD,KAAM,MACN,KAAM,EAAK,IAAK,GAAM,EAAE,SAAS,CAAC,CACtC,CAAC,CAAC,CAAC,KAAK,CAAa,EACrB,OAAO,EAAE,KAAK,KAAK,CAAC,CACxB,CACA,OAAO,EAAY,EAAI,EAAkB,CAAC,GAAG,EAAM,CAAI,CAAC,CAC5D,EACA,IAAI,EAAS,EAAM,EAAU,CACzB,EAAqB,CAAe,EAGpC,GAAM,CAAC,EAAO,GAAiB,EAAY,CAAQ,EACnD,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,MACN,KAAM,CAAC,GAAG,EAAM,CAAI,CAAC,CAAC,IAAK,GAAM,EAAE,SAAS,CAAC,EAC7C,OACJ,EAAG,CAAa,CAAC,CAAC,KAAK,CAAa,CACxC,EACA,MAAM,EAAS,EAAU,EAAiB,CACtC,EAAqB,CAAe,EACpC,IAAM,EAAO,EAAK,EAAK,OAAS,GAChC,GAAI,IAAS,EACT,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,UACV,CAAC,CAAC,CAAC,KAAK,CAAa,EAGzB,GAAI,IAAS,OACT,OAAO,EAAY,EAAI,EAAkB,EAAK,MAAM,EAAG,EAAE,CAAC,EAE9D,GAAM,CAAC,EAAc,GAAiB,EAAiB,CAAe,EACtE,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,QACN,KAAM,EAAK,IAAK,GAAM,EAAE,SAAS,CAAC,EAClC,cACJ,EAAG,CAAa,CAAC,CAAC,KAAK,CAAa,CACxC,EACA,UAAU,EAAS,EAAiB,CAChC,EAAqB,CAAe,EACpC,GAAM,CAAC,EAAc,GAAiB,EAAiB,CAAe,EACtE,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,YACN,KAAM,EAAK,IAAK,GAAM,EAAE,SAAS,CAAC,EAClC,cACJ,EAAG,CAAa,CAAC,CAAC,KAAK,CAAa,CACxC,CACJ,CAAC,EAED,OADA,EAAc,EAAO,CAAE,EAChB,CACX,CACA,SAAS,GAAO,EAAK,CACjB,OAAO,MAAM,UAAU,OAAO,MAAM,CAAC,EAAG,CAAG,CAC/C,CACA,SAAS,EAAiB,EAAc,CACpC,IAAM,EAAY,EAAa,IAAI,CAAW,EAC9C,MAAO,CAAC,EAAU,IAAK,GAAM,EAAE,EAAE,EAAG,GAAO,EAAU,IAAK,GAAM,EAAE,EAAE,CAAC,CAAC,CAC1E,CACA,MAAM,EAAgB,IAAI,QAC1B,SAAS,EAAS,EAAK,EAAW,CAE9B,OADA,EAAc,IAAI,EAAK,CAAS,EACzB,CACX,CACA,SAAS,EAAM,EAAK,CAChB,OAAO,OAAO,OAAO,EAAK,EAAG,GAAc,EAAK,CAAC,CACrD,CAQA,SAAS,EAAY,EAAO,CACxB,IAAK,GAAM,CAAC,EAAM,KAAY,EAC1B,GAAI,EAAQ,UAAU,CAAK,EAAG,CAC1B,GAAM,CAAC,EAAiB,GAAiB,EAAQ,UAAU,CAAK,EAChE,MAAO,CACH,CACI,KAAM,UACN,OACA,MAAO,CACX,EACA,CACJ,CACJ,CAEJ,MAAO,CACH,CACI,KAAM,MACN,OACJ,EACA,EAAc,IAAI,CAAK,GAAK,CAAC,CACjC,CACJ,CACA,SAAS,EAAc,EAAO,CAC1B,OAAQ,EAAM,KAAd,CACI,IAAK,UACD,OAAO,EAAiB,IAAI,EAAM,IAAI,CAAC,CAAC,YAAY,EAAM,KAAK,EACnE,IAAK,MACD,OAAO,EAAM,KACrB,CACJ,CACA,SAAS,EAAuB,EAAI,EAAkB,EAAK,EAAW,CAClE,OAAO,IAAI,QAAS,GAAY,CAC5B,IAAM,EAAK,EAAa,EACxB,EAAiB,IAAI,EAAI,CAAO,EAC5B,EAAG,OACH,EAAG,MAAM,EAEb,EAAG,YAAY,OAAO,OAAO,CAAE,IAAG,EAAG,CAAG,EAAG,CAAS,CACxD,CAAC,CACL,CACA,SAAS,GAAe,CACpB,MAAO,KAAW,CAAC,CACd,KAAK,CAAC,CAAC,CACP,QAAU,KAAK,MAAM,KAAK,OAAO,WAA2B,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAC3E,KAAK,GAAG,CACjB,CCnPA,SAAgB,EAAY,EAAoC,CAG9D,OACE,OAAO,GAAU,YACjB,GACC,EAAkC,YAAc,EAErD,CAOA,MAAM,EAAmB,CACvB,aACA,SACA,aACA,YACA,kBACA,OACA,OACA,eACA,UACA,QACA,MACF,EAKA,SAAS,EAAY,EAAyB,CAC5C,GAAI,CAEF,OADA,gBAAgB,CAAK,EACd,EACT,MAAQ,CACN,MAAO,EACT,CACF,CAMA,SAAS,EAAuB,EAAmC,CACjE,IAAM,EAAY,EAA+C,SACjE,OAAO,EAAqB,GAAU,OAAO,CAC/C,CAMA,SAAS,EAAkB,EAAwB,CACjD,GAAI,CACF,OAAO,KAAK,UAAU,CAAK,GAAK,OAAO,CAAK,CAC9C,MAAQ,CACN,OAAO,OAAO,CAAK,CACrB,CACF,CAGA,SAAS,EAAiB,EAAyC,CACjE,IAAM,EAAiC,CAAC,EACxC,IAAK,IAAM,KAAO,EAAkB,CAClC,IAAM,EAAS,EAAmC,GAC9C,IAAU,IAAA,IAAa,EAAY,CAAK,IAC1C,EAAM,GAAO,EAEjB,CAGA,GAAI,CAAC,EAAyB,EAAM,UAAa,EAAG,CAClD,IAAM,EAAa,EAAuB,CAAM,EAC5C,IAAe,IAAA,KACjB,EAAM,WAAgB,EAE1B,CACA,OAAO,CACT,CAEA,SAAgB,EAAY,EAAgB,EAAgB,EAA4B,CACtF,GAAI,EAAY,CAAK,EACnB,OAAO,EAET,IAAM,EAAQ,GACZ,EAAQ,GAAK,IAAU,IAAA,GAAY,EAAY,EAAO,EAAQ,CAAC,EAAI,IAAA,GACrE,GAAI,aAAiB,MACnB,MAAO,CACL,UAAW,GACX,KAAM,EAAM,KACZ,QAAS,EAAM,QACf,MAAO,EAAM,MACb,MAAO,EAAiB,CAAK,EAC7B,MAAO,EAAK,EAAM,KAAK,CACzB,EAEF,GAAI,OAAO,GAAU,UAAY,EAAgB,CAG/C,GAAM,CAAE,UAAS,SAAU,EAC3B,MAAO,CACL,UAAW,GACX,KAAM,QACN,QAAS,OAAO,GAAY,SAAW,EAAU,EAAkB,CAAK,EACxE,MAAO,IAAA,GACP,MAAO,EAAiB,CAAK,EAC7B,MAAO,EAAK,CAAK,CACnB,CACF,CACA,MAAO,CACL,UAAW,GACX,KAAM,QACN,QAAS,OAAO,GAAU,SAAW,EAAQ,EAAkB,CAAK,EACpE,MAAO,IAAA,GACP,MAAO,CAAC,EACR,MAAO,IAAA,EACT,CACF,CAOA,SAAgB,EAAc,EAAwB,CACpD,IAAM,EAAY,MAAM,EAAK,QAAS,EAAK,MAAQ,CAAE,MAAO,EAAc,EAAK,KAAK,CAAE,EAAI,CAAC,CAAC,EAM5F,MALA,GAAM,KAAO,EAAK,KACd,EAAK,QAAU,IAAA,KACjB,EAAM,MAAQ,EAAK,OAErB,OAAO,OAAO,EAAO,EAAK,KAAK,EACxB,CACT,CChPA,SAAgB,IAA8B,CAI5C,OAAO,IAAI,OAAO,IAAI,IAAI,sBAAuB,OAAO,KAAK,GAAG,EAAG,CACjE,KAAM,SACN,KAAM,kBACR,CAAC,CACH,CCeA,MAAa,EAAyD,CACpE,MAAO,IACP,KAAM,GACR,EASM,EAAmB,IAAI,QAG7B,IAAM,EAAN,cAAqC,KAAM,CAEzC,QAEA,YAAY,EAAiB,EAAyD,CACpF,MAAM,EAAS,CAAO,EACtB,KAAK,KAAO,yBACZ,KAAK,QAAU,GAAS,SAAW,EACrC,CACF,EAOA,SAAS,GAAe,EAAyB,CAC/C,GAAI,OAAO,GAAU,WAAY,EAC/B,MAAO,GAET,GAAM,CAAE,OAAM,WAAY,EAC1B,OACE,IAAS,kBACR,IAAS,aACR,OAAO,GAAY,UACnB,EAAQ,SAAS,6BAA6B,CAEpD,CAEA,SAAS,EAAe,EAAuC,CAC7D,GAAI,GAAQ,QACV,MAAM,EAAO,QAAU,IAAI,aAAa,6BAA8B,YAAY,CAEtF,CAWA,MAAM,EAA2B,CAAE,MAAO,EAAG,KAAM,IAAA,GAAW,UAAW,EAAG,EAO5E,SAAS,GAAe,EAGtB,CACA,GAAI,IAAQ,IAAA,GACV,MAAO,CAAE,MAAK,UAAW,CAAC,CAAE,EAE9B,IAAM,EAAiB,EAAI,eAAe,MACpC,EAAW,EAAI,SAAS,MAC9B,GAAI,EAAE,aAA0B,aAAe,EAAE,aAAoB,YACnE,MAAO,CAAE,MAAK,UAAW,CAAC,CAAE,EAI9B,IAAM,EAAgB,EAAe,MAAM,EACrC,EAAU,EAAS,MAAM,EAC/B,MAAO,CACL,IAAK,CACH,GAAG,EACH,eAAgB,CAAE,GAAG,EAAI,eAAgB,MAAO,CAAc,EAC9D,SAAU,CAAE,GAAG,EAAI,SAAU,MAAO,CAAQ,CAC9C,EACA,UAAW,CAAC,EAAc,OAAuB,EAAQ,MAAqB,CAChF,CACF,CA4BA,SAAS,IAA2C,CAClD,IAAI,EACE,EAAS,IAAI,SAAgB,EAAU,IAAW,CACtD,EAAO,CACT,CAAC,EAID,OADA,EAAO,UAAY,CAAC,CAAC,EACd,CAAE,YAAa,IAAA,GAAW,OAAQ,IAAA,GAAW,IAAK,IAAA,GAAW,SAAQ,MAAK,CACnF,CAgCA,IAAa,GAAb,KAAkE,CAChE,GAEA,GAEA,GAAgB,GAChB,GAAyB,EAEzB,GAAY,EAEZ,GAA8B,IAAI,IAElC,GAEA,GAAU,EACV,GAAoB,GAEpB,YAAY,EAAmC,CAC7C,KAAKA,GAAU,CACjB,CAEA,SAA4B,CAI1B,IAAM,EAAc,KAAKE,KAAgB,GAAuB,EAChE,GAAI,EAAW,cAAgB,IAAA,GAAW,CAGxC,IAAM,EAAyB,KAAKC,OAAkB,KAAKC,GAAU,CAAU,CAAC,CAAC,CAAC,MAC/E,GAAmB,CAIlB,MAHI,EAAW,cAAgB,IAC7B,EAAW,YAAc,IAAA,IAErB,CACR,CACF,EACA,EAAW,YAAc,CAC3B,CACA,OAAO,EAAW,WACpB,EAEA,aAAuD,GACrD,KAAKD,OACH,KAAKE,GACF,GAAY,EAAQ,aAAa,CAAU,GAG3C,EAAK,EAAI,IAAY,EAAI,aAAa,EAAI,CAAE,GAAG,EAAY,SAAQ,CAAC,EACrE,EAAW,OACb,CACF,EAEF,cAAyD,GACvD,KAAKF,OACH,KAAKE,GACF,GAAY,EAAQ,cAAc,CAAU,GAC5C,EAAK,EAAI,IAAY,EAAI,cAAc,EAAI,CAAE,GAAG,EAAY,SAAQ,CAAC,EACtE,EAAW,OACb,CACF,EAYF,SAAgB,CACd,KAAKC,GAAoB,GACzB,KAAKC,GAAe,CACtB,CAQA,KAAMF,GACJ,EACA,EAKA,EACY,CACZ,GAAM,CAAE,SAAQ,aAAY,GAAG,GAAY,GAAe,CAAC,EAE3D,EAAe,CAAM,EACrB,MAAM,KAAK,KAAK,EAEhB,EAAe,CAAM,EACrB,IAAM,EAAa,KAAKH,GAClB,EAAM,GAAY,IAGxB,GAAI,KAAKM,KAAoB,IAAA,KAAc,KAAKC,IAAiB,IAAQ,IAAA,IACvE,OAAO,EAAO,MAAM,KAAKD,EAAe,EAE1C,GAAI,IAAe,IAAA,IAAa,IAAQ,IAAA,GACtC,OAAO,EACL,MAAM,KAAKE,GACT,EACA,KAAKC,GAAS,MAAQ,IAAI,EAAuB,6BAA6B,CAChF,CACF,EAEF,IAAM,EAAK,KAAKC,KACV,MAAgB,KAAK,EAAI,MAAM,CAAE,CAAC,CAAC,UAAY,CAAC,CAAC,EACvD,GAAQ,iBAAiB,QAAS,EAAS,CAAE,KAAM,EAAK,CAAC,EACrD,GACF,KAAKX,GAAmB,IAAI,EAAI,CAAgD,EAElF,GAAI,CACF,IAAM,EAAS,MAAM,KAAKY,GAAc,EAAY,EAAW,EAAK,EAAI,CAAO,CAAC,EAIhF,MADA,MAAKF,GAAW,EACT,CACT,OAAS,EAAO,CACd,GAAI,aAAiB,EACnB,OAAO,EAAO,MAAM,KAAKD,GAAS,EAAY,CAAK,CAAC,EAEtD,MAAM,CACR,QAAU,CACR,KAAKT,GAAmB,OAAO,CAAE,EACjC,GAAQ,oBAAoB,QAAS,CAAO,CAC9C,CACF,CAEA,KAAMG,GAAU,EAA6C,CAC3D,GAAI,KAAKK,GAEP,OAEF,IAAM,EAAgB,KAAKT,GAAQ,cACnC,GAAI,IAAkB,IAAA,GAAW,CAG/B,MAAM,KAAKU,GAAS,EAAY,IAAI,EAAuB,CAAa,CAAC,EACzE,MACF,CAIA,IAAM,EAAmB,MAAM,KAAKV,GAAQ,YAAY,EACxD,GAAI,CACF,IAAM,EAAM,MAAM,KAAKc,GAAO,CAAU,EAClC,EAAU,KAAKd,GAAQ,QACvB,EACJ,OAAO,GAAY,SACf,KACA,EAAM,KAAO,IAA+C,CAC1D,GAAI,CACF,OAAO,MAAM,EAAQ,QAAQ,CAAiD,CAChF,OAAS,EAAO,CAId,MAAM,EAAY,CAAK,CACzB,CACF,CAAC,EAGD,EAAM,GAAO,EAAmC,IAAoB,CACxE,GAAI,CACF,KAAKA,GAAQ,OAAO,EAAM,CAAC,CAAO,CACpC,OAAS,EAAO,CACd,KAAKe,GAAmB,SAAU,CAAK,CACzC,CACF,CAAC,EACK,EAAa,GAAO,EAAY,IAA6B,CACjE,GAAI,CACF,KAAKd,GAAmB,IAAI,CAAE,CAAC,GAAG,CAAK,CACzC,OAAS,EAAO,CACd,KAAKc,GAAmB,aAAc,CAAK,CAC7C,CACF,CAAC,EAIK,EAAU,GAAe,CAAgB,EAC/C,MAAM,KAAKF,GACT,EACA,EAAI,KACF,EACE,CACE,GAAG,KAAKb,GAAQ,YAChB,cAAe,CACb,GAAG,KAAKA,GAAQ,YAAY,cAC5B,iBAAkB,EAAQ,GAC5B,EACA,OAAQ,OAAO,GAAY,SAAW,EAAU,IAAA,EAClD,EACA,EAAQ,SACV,EACA,EACA,EACA,CACF,EACA,CAAE,GAAI,KAAKA,GAAQ,SAAS,KAAM,UAAW,MAAO,CACtD,EACA,EAAW,IAAM,EACjB,KAAKW,GAAW,CAAE,GAAG,KAAKA,GAAU,KAAM,IAAA,EAAU,CACtD,OAAS,EAAO,CAId,GAAI,EAAE,aAAiB,GAErB,MADA,KAAKK,GAAU,EAAY,IAAI,EAAuB,6BAA6B,CAAC,EAC9E,EAER,MAAM,KAAKN,GAAS,EAAY,CAAK,CACvC,CACF,CAGA,GAAmB,EAAkB,EAAsB,CACzD,IAAM,EAAS,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EACpE,GAAI,CACF,KAAKV,GAAQ,OAAO,KAAK,mBAAmB,EAAS,mBAAmB,GAAQ,CAClF,MAAQ,CAER,CACF,CAOA,KAAMG,GAAe,EAAoC,CACvD,KAAKc,KACL,GAAI,CACF,OAAO,MAAM,EAAK,CACpB,QAAU,CACR,KAAKA,KACL,KAAKV,GAAe,CACtB,CACF,CAEA,IAAuB,CACjB,CAAC,KAAKD,IAAqB,KAAKW,GAAU,IAG9C,KAAKX,GAAoB,GACzB,KAAKJ,IAAa,QAAQ,UAAU,EAGpC,KAAKA,GAAc,IAAA,GACnB,KAAKM,GAAkB,IAAA,GACvB,KAAKC,GAAgB,GACrB,KAAKE,GAAW,EAClB,CAEA,IAAwB,CACtB,IAAM,EAAS,KAAKX,GAAQ,aAC5B,GAAI,IAAW,IAAA,GACb,OAAO,GAAoB,EAE7B,GAAI,OAAO,GAAW,WAAY,CAChC,IAAM,EAAS,EAAO,EAStB,OANI,EAAiB,IAAI,CAAM,GAC7B,KAAKA,GAAQ,OAAO,WAClB,6GACF,EAEF,EAAiB,IAAI,CAAM,EACpB,CACT,CACA,OAAO,IAAI,OAAO,EAAQ,CAAE,KAAM,SAAU,KAAM,kBAAmB,CAAC,CACxE,CAGA,KAAMc,GAAO,EAAiE,CAC5E,IAAI,EACJ,GAAI,CACF,EAAS,KAAKI,GAAc,CAC9B,OAAS,EAAO,CAGd,MAAM,IAAI,EAAuB,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EAAG,CACvF,MAAO,CACT,CAAC,CACH,CACA,EAAW,OAAS,EACpB,IAAM,EAAM,MAAM,KAAKC,GAAW,EAAY,CAAM,EAEpD,OADA,KAAKC,GAAiB,EAAY,CAAM,EACjC,CACT,CAGA,GAAW,EAA8B,EAAmD,CAC1F,OAAO,IAAI,SAAmC,EAAS,IAAW,CAChE,IAAM,MAAe,CACnB,aAAa,CAAK,EAClB,EAAO,oBAAoB,UAAW,CAAO,EAC7C,EAAO,oBAAoB,QAAS,CAAO,CAC7C,EACM,EAAQ,eAAiB,CAC7B,EAAO,EACP,EACE,IAAI,EACF,uCAAuC,KAAKpB,GAAQ,SAAS,MAAM,IACrE,CACF,CACF,EAAG,KAAKA,GAAQ,SAAS,KAAK,EACxB,EAAW,GAAwB,CACnC,EAAM,OAAA,8BACR,EAAO,EACP,EAAQ,EAAuB,CAAM,CAAC,EAE1C,EACM,EAAW,GAAsB,CACrC,EAAO,EACP,IAAM,EAAU,EAAM,SAAW,wBAGjC,EAAO,IAAI,EAAuB,CAAO,CAAC,EAC1C,KAAKgB,GAAU,EAAY,IAAI,EAAuB,CAAO,CAAC,CAChE,EACA,EAAO,iBAAiB,UAAW,CAAO,EAC1C,EAAO,iBAAiB,QAAS,CAAO,CAC1C,CAAC,CACH,CAGA,GAAiB,EAA8B,EAAsB,CACnE,EAAO,iBAAiB,QAAU,GAAsB,CAGtD,GAAI,KAAKd,KAAgB,EACvB,OAKF,IAAM,EAAQ,IAAI,EAAuB,EAAM,SAAW,wBAAyB,CACjF,QAAS,EACX,CAAC,EACD,KAAKS,GAAW,CAAE,GAAG,KAAKA,GAAU,MAAO,KAAKA,GAAS,MAAQ,EAAG,KAAM,CAAM,EAChF,KAAKK,GAAU,EAAY,CAAK,CAClC,CAAC,CACH,CAUA,KAAMH,GACJ,EACA,EACA,EACY,CACZ,IAAM,EACJ,IAAa,IAAA,GACT,IAAA,GACA,eAAiB,CACf,KAAKG,GACH,EACA,IAAI,EACF,kBAAkB,EAAS,UAAU,mBAAmB,EAAS,GAAG,IACtE,CACF,CACF,EAAG,EAAS,EAAE,EACpB,GAAI,CACF,OAAO,MAAM,QAAQ,KAAK,CACxB,EAAK,MAAO,GAAmB,CAC7B,IAAM,EAAU,EAAY,CAAK,EAAI,EAAc,CAAK,EAAK,EAG7D,MAAM,GAAe,CAAO,EACxB,IAAI,EAAuB,EAAQ,QAAS,CAAE,MAAO,CAAQ,CAAC,EAC9D,CACN,CAAC,EACD,EAAW,MACb,CAAC,CACH,QAAU,CACJ,IAAU,IAAA,IACZ,aAAa,CAAK,CAEtB,CACF,CAQA,GAAU,EAA0C,EAAqC,CACnF,IAAe,IAAA,KAGf,KAAKd,KAAgB,IACvB,KAAKA,GAAc,IAAA,IAErB,EAAW,QAAQ,UAAU,EAC7B,EAAW,OAAS,IAAA,GACpB,EAAW,IAAM,IAAA,GACjB,EAAW,YAAc,IAAA,GACzB,EAAW,KAAK,CAAK,EACvB,CAEA,KAAMQ,GACJ,EACA,EACgC,CAChC,IAAM,EAAS,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EACpE,GAAI,KAAKV,GAAQ,OAEf,MADA,KAAKgB,GAAU,EAAY,IAAI,EAAuB,6BAA6B,CAAC,EAC9E,IAAI,EACR,oEAAoE,IACpE,CAAE,OAAM,CACV,EAEF,GAAM,CAAE,YAAW,WAAY,KAAKK,GAAiB,CAAK,EAI1D,GAHA,KAAKZ,KAAkB,CAAC,EACxB,KAAKO,GAAU,EAAY,IAAI,EAAuB,oCAAoC,CAAC,EAC3F,KAAKM,GAAc,EAAQ,EAAW,CAAO,EACzC,KAAKd,KAAoB,IAAA,GAAW,CAGtC,IAAM,GAA2C,SAAY,CAC3D,IAAM,EAAS,KAAKR,GAAQ,mBAAmB,EAE/C,OADA,MAAM,EAAO,KAAK,EACX,CACT,EAAA,CAAG,CAAC,CAAC,MAAO,GAAmB,CAO7B,MANI,KAAKQ,KAAoB,IAC3B,KAAKA,GAAkB,IAAA,IAEzB,KAAKR,GAAQ,OAAO,WAClB,iDAAiD,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,GACxG,EACM,CACR,CAAC,EACD,KAAKQ,GAAkB,CACzB,CACA,OAAO,KAAKA,EACd,CAQA,GAAiB,EAA4E,CAC3F,IAAM,EACJ,aAAiB,GACjB,EAAM,SACN,KAAKG,GAAS,MAAQ,EACxB,MAAO,CAAE,YAAW,QAAS,CAAC,GAAa,CAAC,KAAKF,EAAc,CACjE,CAGA,GAAc,EAAgB,EAAoB,EAAwB,CACxE,GAAI,CAAC,GAAW,KAAKE,GAAS,YAAc,KAAKA,GAAS,MACxD,OAEF,KAAKA,GAAW,CAAE,GAAG,KAAKA,GAAU,UAAW,KAAKA,GAAS,KAAM,EACnE,IAAM,EAAQ,EAAY,kCAAoC,wBAG9D,KAAKX,GAAQ,OAAO,WAClB,gCAAmC,EAAM,0BAA0B,GACrE,CACF,CACF,EClkBa,GAAb,KAAgD,CAC9C,GACA,GACA,GACA,GACA,GACA,GACA,GAOA,YAAY,EAA4B,CACtC,KAAKuB,GAAS,EAAO,MACrB,GAAM,CAAE,UAAS,QAAO,gBAAe,iBAAgB,oBACrD,EAAO,SAAW,CAAC,EACf,EAAO,KAAKA,GAAO,KAAO,GAAY,KAAKA,GAAO,IAAI,EAAI,IAAA,GAK1D,EAAS,CACb,aAAc,EAAmB,CAAE,UAJnC,OAAO,KAAKA,GAAO,SAAY,SAC3B,EAAK,KAAKA,GAAO,OAAO,EACxB,EAAO,KAAKA,GAAO,OAAO,CAEe,CAAC,EAC9C,MAAO,EAAa,KAAKA,EAAM,EAC/B,QAAS,CAAE,gBAAe,iBAAgB,kBAAiB,CAC7D,EACA,KAAKI,GAAkB,CACrB,GAAI,IAAS,IAAA,IAAa,CAAE,MAAK,EACjC,GAAI,IAAY,IAAA,IAAa,CAAE,SAAQ,EACvC,GAAI,IAAU,IAAA,IAAa,CAAE,OAAM,CACrC,EACA,KAAKC,GAAa,EAAO,UAIzB,IAAM,MACJ,KAAKJ,GAAM,2BAA2B,CAAE,QAAS,KAAKK,GAAgB,IAAA,EAAS,CAAE,CAAC,EAG9E,EAAkB,IAAsD,CAC5E,KAAM,SAAY,CAChB,MAAM,EAAY,EAClB,MAAM,EAAO,KAAK,CACpB,EACA,aAAe,GAAe,EAAO,aAAa,CAAU,EAC5D,cAAgB,GAAe,EAAO,cAAc,CAAU,EAC9D,2BAA6B,GAAe,EAAO,2BAA2B,CAAU,CAC1F,GACI,EAAO,WACT,KAAKL,GAAQ,GAA+B,CAAM,EAClD,KAAKC,GAAW,GAAkC,CAAM,EACxD,KAAKC,GAAW,EAAe,EAAkC,CAAM,CAAC,IAExE,KAAKF,GAAQ,GAAsB,CAAM,EACzC,KAAKC,GAAW,GAAyB,CAAM,EAC/C,KAAKC,GAAW,KAAKI,GAAqB,EAAQ,EAAQ,CACxD,cACA,uBAA0B,EAAe,EAAyB,CAAM,CAAC,CAC3E,CAAC,EAEL,CAMA,GACE,EACA,EACA,EAIqB,CACrB,IAAM,EAAU,EAAO,gBAAkB,GACnC,EAAS,IAAY,GACrB,EACJ,OAAO,QAAW,aACjB,EAAO,gBAAkB,IAAA,IAAA,IAK5B,GAAI,IAAY,IAAS,EAAE,GAAU,GACnC,OAAO,EAAO,mBAAmB,EAEnC,IAAM,EAAU,EAAsB,EAChC,EAAU,GAAsB,CAAO,EAC7C,GAAI,IAAY,IAAA,IAAa,CAAC,EAI5B,OADA,EAAO,OAAO,WAAW,0CAA0C,EAAQ,EAAE,EACtE,EAAO,mBAAmB,EAEnC,IAAM,EAAe,IAAI,GAAoB,CAC3C,YAAa,CAAE,MAAO,EAAO,MAAO,cAAe,EAAO,QAAS,QAAS,GAAW,CAAC,CAAE,EAC1F,QAAS,KAAKP,GAAO,QACrB,YAAa,EAAO,YACpB,mBAAoB,EAAO,mBAC3B,OAAQ,EAAO,OACf,SAAU,EAAO,iBAAmB,EACpC,aAAc,EAAO,cAGrB,cAAe,EACf,QACF,CAAC,EACD,MAAO,CACL,SAAY,EAAa,KAAK,EAC9B,aAAe,GAAe,EAAa,aAAa,CAAU,EAClE,cAAgB,GAAe,EAAa,cAAc,CAAU,EAIpE,2BAA6B,GAAe,KAAKC,GAAM,2BAA2B,CAAU,EAC5F,YAAe,EAAa,QAAQ,CACtC,CACF,CAGA,IAAI,OAAQ,CACV,OAAO,KAAKD,EACd,CAGA,GACE,EACkE,CAClE,GAAM,CAAE,YAAW,GAAG,GAAW,CAC/B,GAAG,KAAKI,GACR,GAAG,CACL,EAIA,OAHI,KAAKC,KAAe,IAAA,GACf,EAEF,CACL,GAAG,EACH,QAAS,CAAE,GAAG,EAAO,QAAS,GAAG,EAAiB,KAAKA,GAAY,CAAS,CAAE,CAChF,CACF,CAIA,QACE,KAAKG,KAAwB,KAAKL,GAAS,KAAK,CAAC,CAAC,MAAO,GAAmB,CAE1E,KADA,MAAKK,GAAsB,IAAA,GACrB,CACR,CAAC,EACM,KAAKA,IAOd,YAAsB,CACpB,KAAKA,GAAsB,IAAA,GAC3B,KAAKL,GAAS,UAAU,CAC1B,EAcA,mBAAwD,KAAO,KAC7D,MAAM,KAAKF,GAAM,KAAK,EACf,KAAKA,GAAM,mBAAmB,CACnC,GAAG,EACH,QAAS,KAAKK,GAAgB,EAAW,OAAO,CAClD,CAAC,GAeH,oBAA0D,KAAO,KAC/D,MAAM,KAAKL,GAAM,KAAK,EACf,KAAKA,GAAM,oBAAoB,CACpC,GAAG,EACH,QAAS,KAAKK,GAAgB,EAAW,OAAO,CAClD,CAAC,GAeH,kCAAsF,KACpF,KAEA,MAAM,KAAKL,GAAM,KAAK,EACf,KAAKA,GAAM,kCAAkC,CAClD,GAAG,EACH,QAAS,KAAKK,GAAgB,EAAW,OAAO,CAClD,CAAC,GAkBH,aAA4C,KAAO,KACjD,MAAM,KAAKG,GAAa,EACjB,KAAKN,GAAS,aAAa,CAChC,GAAG,EACH,QAAS,KAAKG,GAAgB,EAAW,OAAO,CAClD,CAAC,GAoBH,cAA8C,KAAO,KACnD,MAAM,KAAKG,GAAa,EACjB,KAAKN,GAAS,cAAc,CACjC,GAAG,EACH,QAAS,KAAKG,GAAgB,EAAW,OAAO,CAClD,CAAC,GAoBH,aAA4C,KAAO,KACjD,MAAM,KAAKJ,GAAS,KAAK,EAClB,KAAKA,GAAS,aAAa,CAChC,GAAG,EACH,QAAS,KAAKI,GAAgB,EAAW,OAAO,CAClD,CAAC,GAkBH,cAA8C,KAAO,KACnD,MAAM,KAAKJ,GAAS,KAAK,EAClB,KAAKA,GAAS,cAAc,CACjC,GAAG,EACH,QAAS,KAAKI,GAAgB,EAAW,OAAO,CAClD,CAAC,GAoBH,uBAAgE,KAAO,KACrE,MAAM,KAAKJ,GAAS,KAAK,EAClB,KAAKA,GAAS,uBAAuB,CAC1C,GAAG,EACH,QAAS,KAAKI,GAAgB,EAAW,OAAO,CAClD,CAAC,GAcH,2BAAwE,KAAO,KAI7E,MAAM,KAAKL,GAAM,KAAK,EACf,KAAKA,GAAM,2BAA2B,CAC3C,GAAG,EACH,QAAS,KAAKK,GAAgB,GAAY,OAAO,CACnD,CAAC,GAwBH,qBAA4D,KAAO,KACjE,MAAM,KAAKL,GAAM,KAAK,EACf,KAAKA,GAAM,qBAAqB,CAAU,GAuBnD,2CACG,GAAeS,EAAiD,KAAKT,GAAO,CAAU,EAkBzF,0BAAuE,GACrE,KAAKC,GAAS,0BAA0B,CAAU,EAapD,gCAAmF,GACjF,KAAKD,GAAM,gCAAgC,CAAU,EAcvD,sBAA8D,KAAO,KACnE,MAAM,KAAKC,GAAS,KAAK,EAClB,KAAKA,GAAS,sBAAsB,CAAU,GAmBvD,4BAA0E,KAAO,IAAe,CAC9F,MAAM,KAAKD,GAAM,KAAK,EACtB,GAAM,CAAE,oBAAqB,EAC7B,OAAO,KAAKA,GAAM,4BAA4B,CAC5C,GAAG,EACH,iBAAkB,CAChB,GAAG,EACH,UAAW,GAAoB,EAAiB,SAAS,CAC3D,CACF,CAAC,CACH,EAaA,yBAAoE,UAClE,MAAM,KAAKC,GAAS,KAAK,EAClB,KAAKA,GAAS,yBAAyB,EAElD,EAOA,SAAS,GAAoB,EAA2B,CACtD,GAAI,EAAU,SAAW,IACvB,OAAO,EAET,IAAM,EAAI,SAAS,EAAU,MAAM,GAAG,EAAG,EAAE,EAI3C,OAHI,IAAM,GAAK,IAAM,EACZ,EAEF,GAAG,EAAU,MAAM,EAAG,GAAG,IAAI,IAAM,EAAI,KAAO,MACvD,CAMA,SAAS,GAAsB,EAA4D,CAGzF,GAAI,EAAqB,EACvB,MAAO,gEAIT,GAAI,IAAY,IAAA,IAAa,EAAsB,EACjD,MAAO,4FAGX,CAQA,SAAS,GACP,EAC0C,CAC1C,IAAM,EAAO,EAAK,OAClB,OAAQ,EAAR,CACE,IAAK,eACH,MAAO,CAAE,OAAM,MAAO,EAAK,MAAO,OAAQ,EAAK,MAAO,EACxD,IAAK,eACH,MAAO,CAAE,OAAM,MAAO,EAAK,MAAO,OAAQ,EAAK,MAAO,EACxD,IAAK,cACH,MAAO,CAAE,OAAM,MAAO,EAAK,KAAM,EACnC,QACE,MAAM,IAAI,EAAmB,sBAAsB,OAAO,CAAI,GAAG,CACrE,CACF"}
+{"version":3,"file":"fhevm-relayer-DnAUqf3b.js","names":["#config","#progressListeners","#generation","#withActive","#initOnce","#dispatch","#releaseRequested","#releaseIfIdle","#degradePromise","#pinnedInline","#degrade","#crashes","#sequence","#overBoundary","#spawn","#warnCallbackThrew","#teardown","#active","#createWorker","#raceReady","#armCrashHandler","#classifyDegrade","#warnDegraded","#chain","#base","#decrypt","#encrypt","#defaultOptions","#telemetry","#requestOptions","#buildEncryptBackend","#encryptInitPromise","#initEncrypt","createUnsignedLegacyDecryptionPermitEip712Action"],"sources":["../../src/chains/to-fhevm-chain.ts","../../../../node_modules/.pnpm/comlink@4.4.2/node_modules/comlink/dist/esm/comlink.mjs","../../src/worker/protocol.ts","../../src/worker/spawn.ts","../../src/worker/encrypt-worker-client.ts","../../src/relayer/fhevm-relayer.ts"],"sourcesContent":["import type { FhevmChain } from \"@fhevm/sdk/chains\";\nimport type { FheChain } from \"./types\";\n\n/**\n * Derive an `@fhevm/sdk` {@link FhevmChain} from zama-sdk's richer\n * {@link FheChain}.\n *\n * `FheChain` carries fields `@fhevm/sdk` does not model (RPC `network`,\n * `registryAddress`, `executorAddress`, cleartext signer keys); those stay on\n * `FheChain` for the token layer. This adapter projects only the subset the\n * FHE runtime needs: contract addresses, relayer URL, and gateway.\n */\nexport function toFhevmChain(chain: FheChain): FhevmChain {\n  return {\n    id: chain.id,\n    fhevm: {\n      contracts: {\n        acl: { address: chain.aclContractAddress },\n        inputVerifier: { address: chain.inputVerifierContractAddress },\n        kmsVerifier: { address: chain.kmsContractAddress },\n        protocolConfig: undefined,\n      },\n      relayerUrl: chain.relayerUrl,\n      gateway: {\n        id: chain.gatewayChainId,\n        contracts: {\n          decryption: { address: chain.verifyingContractAddressDecryption },\n          inputVerification: { address: chain.verifyingContractAddressInputVerification },\n        },\n      },\n    },\n  } satisfies FhevmChain;\n}\n","/**\n * @license\n * Copyright 2019 Google LLC\n * SPDX-License-Identifier: Apache-2.0\n */\nconst proxyMarker = Symbol(\"Comlink.proxy\");\nconst createEndpoint = Symbol(\"Comlink.endpoint\");\nconst releaseProxy = Symbol(\"Comlink.releaseProxy\");\nconst finalizer = Symbol(\"Comlink.finalizer\");\nconst throwMarker = Symbol(\"Comlink.thrown\");\nconst isObject = (val) => (typeof val === \"object\" && val !== null) || typeof val === \"function\";\n/**\n * Internal transfer handle to handle objects marked to proxy.\n */\nconst proxyTransferHandler = {\n    canHandle: (val) => isObject(val) && val[proxyMarker],\n    serialize(obj) {\n        const { port1, port2 } = new MessageChannel();\n        expose(obj, port1);\n        return [port2, [port2]];\n    },\n    deserialize(port) {\n        port.start();\n        return wrap(port);\n    },\n};\n/**\n * Internal transfer handler to handle thrown exceptions.\n */\nconst throwTransferHandler = {\n    canHandle: (value) => isObject(value) && throwMarker in value,\n    serialize({ value }) {\n        let serialized;\n        if (value instanceof Error) {\n            serialized = {\n                isError: true,\n                value: {\n                    message: value.message,\n                    name: value.name,\n                    stack: value.stack,\n                },\n            };\n        }\n        else {\n            serialized = { isError: false, value };\n        }\n        return [serialized, []];\n    },\n    deserialize(serialized) {\n        if (serialized.isError) {\n            throw Object.assign(new Error(serialized.value.message), serialized.value);\n        }\n        throw serialized.value;\n    },\n};\n/**\n * Allows customizing the serialization of certain values.\n */\nconst transferHandlers = new Map([\n    [\"proxy\", proxyTransferHandler],\n    [\"throw\", throwTransferHandler],\n]);\nfunction isAllowedOrigin(allowedOrigins, origin) {\n    for (const allowedOrigin of allowedOrigins) {\n        if (origin === allowedOrigin || allowedOrigin === \"*\") {\n            return true;\n        }\n        if (allowedOrigin instanceof RegExp && allowedOrigin.test(origin)) {\n            return true;\n        }\n    }\n    return false;\n}\nfunction expose(obj, ep = globalThis, allowedOrigins = [\"*\"]) {\n    ep.addEventListener(\"message\", function callback(ev) {\n        if (!ev || !ev.data) {\n            return;\n        }\n        if (!isAllowedOrigin(allowedOrigins, ev.origin)) {\n            console.warn(`Invalid origin '${ev.origin}' for comlink proxy`);\n            return;\n        }\n        const { id, type, path } = Object.assign({ path: [] }, ev.data);\n        const argumentList = (ev.data.argumentList || []).map(fromWireValue);\n        let returnValue;\n        try {\n            const parent = path.slice(0, -1).reduce((obj, prop) => obj[prop], obj);\n            const rawValue = path.reduce((obj, prop) => obj[prop], obj);\n            switch (type) {\n                case \"GET\" /* MessageType.GET */:\n                    {\n                        returnValue = rawValue;\n                    }\n                    break;\n                case \"SET\" /* MessageType.SET */:\n                    {\n                        parent[path.slice(-1)[0]] = fromWireValue(ev.data.value);\n                        returnValue = true;\n                    }\n                    break;\n                case \"APPLY\" /* MessageType.APPLY */:\n                    {\n                        returnValue = rawValue.apply(parent, argumentList);\n                    }\n                    break;\n                case \"CONSTRUCT\" /* MessageType.CONSTRUCT */:\n                    {\n                        const value = new rawValue(...argumentList);\n                        returnValue = proxy(value);\n                    }\n                    break;\n                case \"ENDPOINT\" /* MessageType.ENDPOINT */:\n                    {\n                        const { port1, port2 } = new MessageChannel();\n                        expose(obj, port2);\n                        returnValue = transfer(port1, [port1]);\n                    }\n                    break;\n                case \"RELEASE\" /* MessageType.RELEASE */:\n                    {\n                        returnValue = undefined;\n                    }\n                    break;\n                default:\n                    return;\n            }\n        }\n        catch (value) {\n            returnValue = { value, [throwMarker]: 0 };\n        }\n        Promise.resolve(returnValue)\n            .catch((value) => {\n            return { value, [throwMarker]: 0 };\n        })\n            .then((returnValue) => {\n            const [wireValue, transferables] = toWireValue(returnValue);\n            ep.postMessage(Object.assign(Object.assign({}, wireValue), { id }), transferables);\n            if (type === \"RELEASE\" /* MessageType.RELEASE */) {\n                // detach and deactive after sending release response above.\n                ep.removeEventListener(\"message\", callback);\n                closeEndPoint(ep);\n                if (finalizer in obj && typeof obj[finalizer] === \"function\") {\n                    obj[finalizer]();\n                }\n            }\n        })\n            .catch((error) => {\n            // Send Serialization Error To Caller\n            const [wireValue, transferables] = toWireValue({\n                value: new TypeError(\"Unserializable return value\"),\n                [throwMarker]: 0,\n            });\n            ep.postMessage(Object.assign(Object.assign({}, wireValue), { id }), transferables);\n        });\n    });\n    if (ep.start) {\n        ep.start();\n    }\n}\nfunction isMessagePort(endpoint) {\n    return endpoint.constructor.name === \"MessagePort\";\n}\nfunction closeEndPoint(endpoint) {\n    if (isMessagePort(endpoint))\n        endpoint.close();\n}\nfunction wrap(ep, target) {\n    const pendingListeners = new Map();\n    ep.addEventListener(\"message\", function handleMessage(ev) {\n        const { data } = ev;\n        if (!data || !data.id) {\n            return;\n        }\n        const resolver = pendingListeners.get(data.id);\n        if (!resolver) {\n            return;\n        }\n        try {\n            resolver(data);\n        }\n        finally {\n            pendingListeners.delete(data.id);\n        }\n    });\n    return createProxy(ep, pendingListeners, [], target);\n}\nfunction throwIfProxyReleased(isReleased) {\n    if (isReleased) {\n        throw new Error(\"Proxy has been released and is not useable\");\n    }\n}\nfunction releaseEndpoint(ep) {\n    return requestResponseMessage(ep, new Map(), {\n        type: \"RELEASE\" /* MessageType.RELEASE */,\n    }).then(() => {\n        closeEndPoint(ep);\n    });\n}\nconst proxyCounter = new WeakMap();\nconst proxyFinalizers = \"FinalizationRegistry\" in globalThis &&\n    new FinalizationRegistry((ep) => {\n        const newCount = (proxyCounter.get(ep) || 0) - 1;\n        proxyCounter.set(ep, newCount);\n        if (newCount === 0) {\n            releaseEndpoint(ep);\n        }\n    });\nfunction registerProxy(proxy, ep) {\n    const newCount = (proxyCounter.get(ep) || 0) + 1;\n    proxyCounter.set(ep, newCount);\n    if (proxyFinalizers) {\n        proxyFinalizers.register(proxy, ep, proxy);\n    }\n}\nfunction unregisterProxy(proxy) {\n    if (proxyFinalizers) {\n        proxyFinalizers.unregister(proxy);\n    }\n}\nfunction createProxy(ep, pendingListeners, path = [], target = function () { }) {\n    let isProxyReleased = false;\n    const proxy = new Proxy(target, {\n        get(_target, prop) {\n            throwIfProxyReleased(isProxyReleased);\n            if (prop === releaseProxy) {\n                return () => {\n                    unregisterProxy(proxy);\n                    releaseEndpoint(ep);\n                    pendingListeners.clear();\n                    isProxyReleased = true;\n                };\n            }\n            if (prop === \"then\") {\n                if (path.length === 0) {\n                    return { then: () => proxy };\n                }\n                const r = requestResponseMessage(ep, pendingListeners, {\n                    type: \"GET\" /* MessageType.GET */,\n                    path: path.map((p) => p.toString()),\n                }).then(fromWireValue);\n                return r.then.bind(r);\n            }\n            return createProxy(ep, pendingListeners, [...path, prop]);\n        },\n        set(_target, prop, rawValue) {\n            throwIfProxyReleased(isProxyReleased);\n            // FIXME: ES6 Proxy Handler `set` methods are supposed to return a\n            // boolean. To show good will, we return true asynchronously ¯\\_(ツ)_/¯\n            const [value, transferables] = toWireValue(rawValue);\n            return requestResponseMessage(ep, pendingListeners, {\n                type: \"SET\" /* MessageType.SET */,\n                path: [...path, prop].map((p) => p.toString()),\n                value,\n            }, transferables).then(fromWireValue);\n        },\n        apply(_target, _thisArg, rawArgumentList) {\n            throwIfProxyReleased(isProxyReleased);\n            const last = path[path.length - 1];\n            if (last === createEndpoint) {\n                return requestResponseMessage(ep, pendingListeners, {\n                    type: \"ENDPOINT\" /* MessageType.ENDPOINT */,\n                }).then(fromWireValue);\n            }\n            // We just pretend that `bind()` didn’t happen.\n            if (last === \"bind\") {\n                return createProxy(ep, pendingListeners, path.slice(0, -1));\n            }\n            const [argumentList, transferables] = processArguments(rawArgumentList);\n            return requestResponseMessage(ep, pendingListeners, {\n                type: \"APPLY\" /* MessageType.APPLY */,\n                path: path.map((p) => p.toString()),\n                argumentList,\n            }, transferables).then(fromWireValue);\n        },\n        construct(_target, rawArgumentList) {\n            throwIfProxyReleased(isProxyReleased);\n            const [argumentList, transferables] = processArguments(rawArgumentList);\n            return requestResponseMessage(ep, pendingListeners, {\n                type: \"CONSTRUCT\" /* MessageType.CONSTRUCT */,\n                path: path.map((p) => p.toString()),\n                argumentList,\n            }, transferables).then(fromWireValue);\n        },\n    });\n    registerProxy(proxy, ep);\n    return proxy;\n}\nfunction myFlat(arr) {\n    return Array.prototype.concat.apply([], arr);\n}\nfunction processArguments(argumentList) {\n    const processed = argumentList.map(toWireValue);\n    return [processed.map((v) => v[0]), myFlat(processed.map((v) => v[1]))];\n}\nconst transferCache = new WeakMap();\nfunction transfer(obj, transfers) {\n    transferCache.set(obj, transfers);\n    return obj;\n}\nfunction proxy(obj) {\n    return Object.assign(obj, { [proxyMarker]: true });\n}\nfunction windowEndpoint(w, context = globalThis, targetOrigin = \"*\") {\n    return {\n        postMessage: (msg, transferables) => w.postMessage(msg, targetOrigin, transferables),\n        addEventListener: context.addEventListener.bind(context),\n        removeEventListener: context.removeEventListener.bind(context),\n    };\n}\nfunction toWireValue(value) {\n    for (const [name, handler] of transferHandlers) {\n        if (handler.canHandle(value)) {\n            const [serializedValue, transferables] = handler.serialize(value);\n            return [\n                {\n                    type: \"HANDLER\" /* WireValueType.HANDLER */,\n                    name,\n                    value: serializedValue,\n                },\n                transferables,\n            ];\n        }\n    }\n    return [\n        {\n            type: \"RAW\" /* WireValueType.RAW */,\n            value,\n        },\n        transferCache.get(value) || [],\n    ];\n}\nfunction fromWireValue(value) {\n    switch (value.type) {\n        case \"HANDLER\" /* WireValueType.HANDLER */:\n            return transferHandlers.get(value.name).deserialize(value.value);\n        case \"RAW\" /* WireValueType.RAW */:\n            return value.value;\n    }\n}\nfunction requestResponseMessage(ep, pendingListeners, msg, transfers) {\n    return new Promise((resolve) => {\n        const id = generateUUID();\n        pendingListeners.set(id, resolve);\n        if (ep.start) {\n            ep.start();\n        }\n        ep.postMessage(Object.assign({ id }, msg), transfers);\n    });\n}\nfunction generateUUID() {\n    return new Array(4)\n        .fill(0)\n        .map(() => Math.floor(Math.random() * Number.MAX_SAFE_INTEGER).toString(16))\n        .join(\"-\");\n}\n\nexport { createEndpoint, expose, finalizer, proxy, proxyMarker, releaseProxy, transfer, transferHandlers, windowEndpoint, wrap };\n//# sourceMappingURL=comlink.mjs.map\n","/**\n * Shared contract between the main-thread encrypt client and the encrypt\n * worker, spoken over Comlink. Every payload must survive `structuredClone`:\n * no `AbortSignal`, no class instances; callbacks cross as Comlink proxies.\n */\n\nimport type { FhevmChain } from \"@fhevm/sdk/chains\";\nimport type {\n  FhevmClientOptions,\n  FhevmEncryptBackend,\n  FhevmRelayerOptions,\n  WireRuntimeConfig,\n} from \"../relayer/types\";\nimport { isValidRetryAfterSeconds, readRetryAfterHeader } from \"../utils/error\";\n\ntype EncryptParameters = Parameters<FhevmEncryptBackend[\"encryptValue\"]>[0];\ntype EncryptsParameters = Parameters<FhevmEncryptBackend[\"encryptValues\"]>[0];\n\n/**\n * What the worker offloads, and all the encrypt client's surface the worker\n * client implements. Key fetches stay on the calling thread, where the chain's\n * auth applies and the key never crosses back out.\n */\nexport type EncryptOffloadBackend = Pick<\n  FhevmEncryptBackend,\n  \"init\" | \"encryptValue\" | \"encryptValues\"\n>;\n\n/** Per-request options minus `signal`, the one non-cloneable member of the set. */\nexport type WireRequestOptions = Omit<FhevmRelayerOptions, \"signal\">;\n\nexport type WireProgressEvent = Parameters<\n  NonNullable<NonNullable<EncryptParameters[\"options\"]>[\"onProgress\"]>\n>[0];\n\nexport type WireInitPayload = {\n  readonly chain: FhevmChain;\n  /** RPC URL for host-chain reads; absent when reads proxy through `rpcRequest`. */\n  readonly rpcUrl: string | undefined;\n  /** Carries `fheEncryptionKey`, prefetched on the main thread so the worker skips the download. */\n  readonly clientOptions: FhevmClientOptions;\n  readonly runtime: WireRuntimeConfig;\n};\n\n/** Main-thread callback the worker uses for host-chain reads when the chain's network is an injected provider. */\nexport type WireRpcRequest = (args: { method: string; params?: unknown }) => Promise<unknown>;\n\n/**\n * Main-thread callback receiving every operation's progress events, routed on\n * `id`. One channel per worker avoids minting a `MessageChannel` per call, whose\n * local port and listener would linger until garbage collection after terminate.\n * Returns `unknown`: a Comlink proxy call answers with a promise.\n */\nexport type WireProgressCallback = (id: number, event: WireProgressEvent) => unknown;\n\nexport type WireLogCallback = (level: \"debug\" | \"warn\" | \"error\", message: string) => unknown;\n\n/**\n * The API the worker exposes over Comlink. `id` correlates an in-flight\n * operation with `abort` and with its progress events, since neither an\n * `AbortSignal` nor a per-call callback can cross the boundary cheaply. The\n * `init` callback parameters must be passed as Comlink proxies (or `null`).\n */\nexport type EncryptWorkerApi = {\n  init(\n    payload: WireInitPayload,\n    rpcRequest: WireRpcRequest | null,\n    log: WireLogCallback,\n    onProgress: WireProgressCallback,\n  ): Promise<void>;\n  encryptValue(\n    id: number,\n    parameters: {\n      readonly value: EncryptParameters[\"value\"];\n      readonly contractAddress: string;\n      readonly userAddress: string;\n      readonly options: WireRequestOptions | undefined;\n    },\n  ): ReturnType<FhevmEncryptBackend[\"encryptValue\"]>;\n  encryptValues(\n    id: number,\n    parameters: {\n      readonly values: EncryptsParameters[\"values\"];\n      readonly contractAddress: string;\n      readonly userAddress: string;\n      readonly options: WireRequestOptions | undefined;\n    },\n  ): ReturnType<FhevmEncryptBackend[\"encryptValues\"]>;\n  abort(id: number): void;\n};\n\n/** Raw message the worker posts once its module graph has loaded, before Comlink traffic. */\nexport const WORKER_READY_MESSAGE = \"zama-encrypt-worker-ready\";\n\n/**\n * An `Error` flattened for the boundary crossing, thrown by the worker as a\n * plain object so it survives structured clone intact. `props` carries the\n * fields the SDK's duck-typed classifiers read (`statusCode`, `retryAfter`,\n * `code`, …); a cloned `Error` instance would drop them with the prototype.\n * Reading them through the prototype chain is deliberate: upstream's `status`\n * and `relayerApiError` are prototype getters, not own fields.\n */\nexport type WireError = {\n  readonly wireError: true;\n  readonly name: string;\n  readonly message: string;\n  readonly stack: string | undefined;\n  readonly props: Record<string, unknown>;\n  readonly cause: WireError | undefined;\n};\n\nexport function isWireError(value: unknown): value is WireError {\n  // Exact `true`, not presence: an `Error` subclass carrying the key must not be\n  // rehydrated as a flattened one.\n  return (\n    typeof value === \"object\" &&\n    value !== null &&\n    (value as { wireError?: unknown }).wireError === true\n  );\n}\n\n/**\n * Fields preserved across the boundary: what the error classifiers read off\n * `@fhevm/sdk`, relayer, and JSON-RPC errors, plus the `error`/`info` nesting\n * keys those classifiers walk alongside `cause`.\n */\nconst WIRE_ERROR_PROPS = [\n  \"statusCode\",\n  \"status\",\n  \"retryAfter\",\n  \"timeoutMs\",\n  \"relayerApiError\",\n  \"code\",\n  \"data\",\n  \"shortMessage\",\n  \"details\",\n  \"error\",\n  \"info\",\n] as const;\n\nconst MAX_CAUSE_DEPTH = 6;\n\n/** A probe is exact where a structural walk only approximates. */\nfunction isCloneSafe(value: unknown): boolean {\n  try {\n    structuredClone(value);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * The `Retry-After` header survives as a plain number of seconds; the\n * `Response` object it lives on cannot cross the boundary.\n */\nfunction retryAfterFromResponse(error: object): number | undefined {\n  const response = (error as { response?: { headers?: unknown } }).response;\n  return readRetryAfterHeader(response?.headers);\n}\n\n/**\n * `JSON.stringify` throws instead of returning `undefined` on a bigint or a\n * circular value; a non-Error thrown value must never fail error handling itself.\n */\nfunction stringifyNonError(error: unknown): string {\n  try {\n    return JSON.stringify(error) ?? String(error);\n  } catch {\n    return String(error);\n  }\n}\n\n/** The classifier fields readable off one thrown value, `Error` or plain object alike. */\nfunction extractWireProps(source: object): Record<string, unknown> {\n  const props: Record<string, unknown> = {};\n  for (const key of WIRE_ERROR_PROPS) {\n    const value = (source as Record<string, unknown>)[key];\n    if (value !== undefined && isCloneSafe(value)) {\n      props[key] = value;\n    }\n  }\n  // The header wins over a malformed own delay (`0`, negative, `NaN`), as the\n  // inline extractor in `utils/error.ts` decides it.\n  if (!isValidRetryAfterSeconds(props[\"retryAfter\"])) {\n    const fromHeader = retryAfterFromResponse(source);\n    if (fromHeader !== undefined) {\n      props[\"retryAfter\"] = fromHeader;\n    }\n  }\n  return props;\n}\n\nexport function toWireError(error: unknown, depth: number = MAX_CAUSE_DEPTH): WireError {\n  if (isWireError(error)) {\n    return error;\n  }\n  const nest = (cause: unknown): WireError | undefined =>\n    depth > 0 && cause !== undefined ? toWireError(cause, depth - 1) : undefined;\n  if (error instanceof Error) {\n    return {\n      wireError: true,\n      name: error.name,\n      message: error.message,\n      stack: error.stack,\n      props: extractWireProps(error),\n      cause: nest(error.cause),\n    };\n  }\n  if (typeof error === \"object\" && error !== null) {\n    // Wallets reject with a plain `{ code, message, data }`; dropping `code`\n    // would break viem's classification inside the worker.\n    const { message, cause } = error as { message?: unknown; cause?: unknown };\n    return {\n      wireError: true,\n      name: \"Error\",\n      message: typeof message === \"string\" ? message : stringifyNonError(error),\n      stack: undefined,\n      props: extractWireProps(error),\n      cause: nest(cause),\n    };\n  }\n  return {\n    wireError: true,\n    name: \"Error\",\n    message: typeof error === \"string\" ? error : stringifyNonError(error),\n    stack: undefined,\n    props: {},\n    cause: undefined,\n  };\n}\n\n/**\n * Rebuilds a plain `Error` carrying the original `name`, own fields, and cause\n * chain, so name-based classification and status/retry-after extraction behave\n * as if the error had been thrown on this thread.\n */\nexport function fromWireError(wire: WireError): Error {\n  const error = new Error(wire.message, wire.cause ? { cause: fromWireError(wire.cause) } : {});\n  error.name = wire.name;\n  if (wire.stack !== undefined) {\n    error.stack = wire.stack;\n  }\n  Object.assign(error, wire.props);\n  return error;\n}\n","/** Isolated so the CJS build can replace worker construction with an inert stub. */\n\n/** False in the CJS stub, which ships no worker chunk; a caller-supplied `offloadWorker` source works in either build. */\nexport const BUNDLED_ENCRYPT_WORKER = true;\n\nexport function createEncryptWorker(): Worker {\n  // Keep the `new Worker(new URL(...))` expression exactly in this inline\n  // form: bundlers detect it statically to emit and rewrite the worker chunk,\n  // and lose it if the URL is hoisted into a variable.\n  return new Worker(new URL(\"./encrypt.worker.js\", import.meta.url), {\n    type: \"module\",\n    name: \"zama-fhe-encrypt\",\n  });\n}\n","import { proxy, transfer, wrap, type Remote } from \"comlink\";\nimport type { EIP1193Provider } from \"viem\";\nimport { EncryptOffloadUnavailableError } from \"../errors/encryption\";\nimport type { FhevmClientOptions } from \"../relayer/types\";\nimport type { LoggerService } from \"../services/logger-service\";\nimport type {\n  EncryptOffloadBackend,\n  EncryptWorkerApi,\n  WireInitPayload,\n  WireProgressEvent,\n  WireRequestOptions,\n} from \"./protocol\";\nimport { WORKER_READY_MESSAGE, fromWireError, isWireError, toWireError } from \"./protocol\";\nimport { createEncryptWorker } from \"./spawn\";\n\n/**\n * Watchdog deadlines, in milliseconds, for worker lifecycle steps: each is a\n * ceiling on \"the worker never answered\", not on legitimate slow work. Encrypt\n * operations themselves are not watched: nothing bounds local WASM compute, so\n * a proof may run for as long as it needs.\n */\nexport type EncryptWorkerTimeouts = {\n  /** Worker startup + module-graph load; a bundler that mishandled the worker URL fails here. */\n  readonly spawn: number;\n  /** Client init inside the worker realm: chain reads and WASM compilation. */\n  readonly init: number;\n};\n\nexport const DEFAULT_ENCRYPT_WORKER_TIMEOUTS: EncryptWorkerTimeouts = {\n  spawn: 10_000,\n  init: 300_000,\n};\n\n/** Second crash pins the client to the calling thread. */\nconst CRASH_PIN_THRESHOLD = 2;\n\n/** Stable prefix of every degrade warning. */\nexport const ENCRYPT_OFFLOAD_WARN_PREFIX = \"Encrypt offload unavailable\";\n\n/** Workers already returned by an `offloadWorker` factory, to catch a factory that hands out one worker forever. */\nconst handedOutWorkers = new WeakSet<Worker>();\n\n/** Internal signal: the worker infrastructure failed; the operation itself was not rejected. */\nclass WorkerUnavailableError extends Error {\n  /** True when a worker that had already signalled ready died under us, so a respawn is worth trying. */\n  readonly crashed: boolean;\n\n  constructor(message: string, options?: ErrorOptions & { readonly crashed?: boolean }) {\n    super(message, options);\n    this.name = \"WorkerUnavailableError\";\n    this.crashed = options?.crashed ?? false;\n  }\n}\n\n/**\n * A payload Comlink could not clone into the worker (`DataCloneError`) or could\n * not return out of it (its own `TypeError`): a boundary failure, so it degrades\n * rather than reaching the caller as an application error.\n */\nfunction isCloneFailure(error: unknown): boolean {\n  if (typeof error !== \"object\" || error === null) {\n    return false;\n  }\n  const { name, message } = error as { name?: unknown; message?: unknown };\n  return (\n    name === \"DataCloneError\" ||\n    (name === \"TypeError\" &&\n      typeof message === \"string\" &&\n      message.includes(\"Unserializable return value\"))\n  );\n}\n\nfunction throwIfAborted(signal: AbortSignal | undefined): void {\n  if (signal?.aborted) {\n    throw signal.reason ?? new DOMException(\"The operation was aborted.\", \"AbortError\");\n  }\n}\n\n/** What the client remembers about worker crashes, dropped whole by a worker answer and by a release. */\ntype CrashHistory = {\n  readonly count: number;\n  /** The crash that killed the current worker, so a call landing after it degrades as a crash too. */\n  readonly last: WorkerUnavailableError | undefined;\n  /** Crash count the degrade warning was last emitted for, so one failure warns once. */\n  readonly warnedFor: number;\n};\n\nconst NO_CRASHES: CrashHistory = { count: 0, last: undefined, warnedFor: -1 };\n\n/**\n * The key copied for the crossing plus the buffers to transfer, so the wire copy\n * is moved instead of cloned. Anything but the known binary shape crosses\n * unchanged.\n */\nfunction keyForTransfer(key: FhevmClientOptions[\"fheEncryptionKey\"]): {\n  readonly key: FhevmClientOptions[\"fheEncryptionKey\"];\n  readonly transfers: Transferable[];\n} {\n  if (key === undefined) {\n    return { key, transfers: [] };\n  }\n  const publicKeyBytes = key.publicKeyBytes.bytes;\n  const crsBytes = key.crsBytes.bytes;\n  if (!(publicKeyBytes instanceof Uint8Array) || !(crsBytes instanceof Uint8Array)) {\n    return { key, transfers: [] };\n  }\n  // `slice` yields a fresh exactly-sized buffer, so transferring it leaves this\n  // thread's cached key intact.\n  const publicKeyCopy = publicKeyBytes.slice();\n  const crsCopy = crsBytes.slice();\n  return {\n    key: {\n      ...key,\n      publicKeyBytes: { ...key.publicKeyBytes, bytes: publicKeyCopy },\n      crsBytes: { ...key.crsBytes, bytes: crsCopy },\n    },\n    transfers: [publicKeyCopy.buffer as ArrayBuffer, crsCopy.buffer as ArrayBuffer],\n  };\n}\n\n/**\n * Per-call options: `signal` is forwarded as an `abort` call, `onProgress` is\n * served from the worker's shared progress channel, and `never` keeps the\n * callback contravariantly compatible with each operation's own event type.\n */\ntype CallOptions = WireRequestOptions & {\n  readonly signal?: AbortSignal;\n  readonly onProgress?: (args: never) => void;\n};\n\n/**\n * Everything scoped to one spawned worker, created by the init that spawns it\n * and dropped whole by a teardown. A late event carrying its own generation can\n * therefore only settle that generation, never the worker running in its place.\n */\ntype WorkerGeneration = {\n  /** Memoized bring-up for this worker; it dies with the generation, so the next call re-runs it. */\n  initPromise: Promise<void> | undefined;\n  worker: Worker | undefined;\n  api: Remote<EncryptWorkerApi> | undefined;\n  /** Never resolves; teardown rejects it, and every boundary crossing races it so all of them settle together. */\n  readonly doomed: Promise<never>;\n  /** Rejects `doomed` with the teardown's `WorkerUnavailableError`. */\n  readonly doom: (error: WorkerUnavailableError) => void;\n};\n\nfunction createWorkerGeneration(): WorkerGeneration {\n  let doom!: (error: WorkerUnavailableError) => void;\n  const doomed = new Promise<never>((_resolve, reject) => {\n    doom = reject;\n  });\n  // An idle teardown dooms a generation with no crossing racing it; this\n  // handler keeps that from surfacing as an unhandled rejection.\n  doomed.catch(() => {});\n  return { initPromise: undefined, worker: undefined, api: undefined, doomed, doom };\n}\n\nexport type EncryptWorkerClientConfig = {\n  readonly initPayload: Omit<WireInitPayload, \"rpcUrl\">;\n  /** The chain's RPC endpoint: a URL crosses into the worker; a provider is proxied per request. */\n  readonly network: EIP1193Provider | string;\n  /** Fetches the FHE key on the calling thread, where the chain's auth applies; the worker realm never downloads it itself. */\n  readonly prefetchKey: () => Promise<FhevmClientOptions[\"fheEncryptionKey\"]>;\n  readonly createInlineClient: () => EncryptOffloadBackend;\n  readonly logger: LoggerService;\n  readonly timeouts: EncryptWorkerTimeouts;\n  /** A string or `URL` is spawned with the SDK's worker options; a factory is called for the worker itself. */\n  readonly workerSource?: string | URL | (() => Worker);\n  /**\n   * A pre-known reason offload cannot work in this session: init degrades with\n   * it immediately, so strict rejects at call time rather than at config time.\n   */\n  readonly blockedReason?: string;\n  /**\n   * Strict offload (`offloadEncrypt: true`): never run encryption on the\n   * calling thread. Every path that would degrade rejects with\n   * {@link EncryptOffloadUnavailableError} instead.\n   */\n  readonly strict: boolean;\n};\n\n/**\n * Encrypt backend that runs `@fhevm/sdk` in a dedicated module worker so proof\n * generation never blocks the main thread. Only infrastructure failure degrades\n * to inline (or rejects under `strict`); worker-reported errors are rethrown,\n * since inline would fail the same way.\n */\nexport class EncryptWorkerClient implements EncryptOffloadBackend {\n  readonly #config: EncryptWorkerClientConfig;\n  /** Resources of the worker currently being brought up or served; undefined while none runs. */\n  #generation: WorkerGeneration | undefined;\n  /** True once the client runs inline for the rest of its life, with no further spawn attempts. */\n  #pinnedInline = false;\n  #crashes: CrashHistory = NO_CRASHES;\n  /** Wire ids, allocated across generations so a late reply can never be read as a live operation. */\n  #sequence = 0;\n  /** Per-operation `onProgress`, keyed by wire id and routed over one channel registered at init: one channel per worker avoids minting a `MessageChannel` per call, whose local port and listener would linger until garbage collection after terminate. */\n  readonly #progressListeners = new Map<number, (event: WireProgressEvent) => void>();\n  /** Memoized inline backend. Kept, with its key copy, across a worker recovery so a later degrade skips the refetch. */\n  #degradePromise: Promise<EncryptOffloadBackend> | undefined;\n  /** Operations that must drain before a requested release terminates the worker. */\n  #active = 0;\n  #releaseRequested = false;\n\n  constructor(config: EncryptWorkerClientConfig) {\n    this.#config = config;\n  }\n\n  init = (): Promise<void> => {\n    // A call landing mid-drain rides the worker being released rather than\n    // canceling the release: the drain still completes, and the call after it\n    // spawns a fresh worker.\n    const generation = (this.#generation ??= createWorkerGeneration());\n    if (generation.initPromise === undefined) {\n      // Only a successful cycle is memoized: a failure a retry could clear must\n      // not be replayed to every later call.\n      const attempt: Promise<void> = this.#withActive(() => this.#initOnce(generation)).catch(\n        (error: unknown) => {\n          if (generation.initPromise === attempt) {\n            generation.initPromise = undefined;\n          }\n          throw error;\n        },\n      );\n      generation.initPromise = attempt;\n    }\n    return generation.initPromise;\n  };\n\n  encryptValue: EncryptOffloadBackend[\"encryptValue\"] = (parameters) =>\n    this.#withActive(() =>\n      this.#dispatch(\n        (backend) => backend.encryptValue(parameters),\n        // Spread, so a field upstream adds to the parameters still crosses; the\n        // stripped `options` replaces the caller's, which carries `signal`.\n        (api, id, options) => api.encryptValue(id, { ...parameters, options }),\n        parameters.options,\n      ),\n    );\n\n  encryptValues: EncryptOffloadBackend[\"encryptValues\"] = (parameters) =>\n    this.#withActive(() =>\n      this.#dispatch(\n        (backend) => backend.encryptValues(parameters),\n        (api, id, options) => api.encryptValues(id, { ...parameters, options }),\n        parameters.options,\n      ),\n    );\n\n  /**\n   * Releases the worker without changing what callers observe: in-flight\n   * operations (an init included) run to completion over the worker, and the\n   * worker is terminated as soon as the last one settles, immediately if the\n   * client is idle. The client is not spent: the release resets it whole, so a\n   * later call re-fetches the key and spawns a fresh worker exactly like the\n   * first one, even if the client had degraded to the calling thread. The drain\n   * is not bounded: a worker wedged inside an operation is only terminated once\n   * that operation settles.\n   */\n  dispose(): void {\n    this.#releaseRequested = true;\n    this.#releaseIfIdle();\n  }\n\n  /**\n   * The one place that decides between the worker and the calling thread:\n   * inline once pinned or while no worker is running; otherwise the worker,\n   * falling back to inline on infrastructure failure while application errors\n   * pass through.\n   */\n  async #dispatch<T>(\n    invoke: (backend: EncryptOffloadBackend) => Promise<T>,\n    overWorker: (\n      api: Remote<EncryptWorkerApi>,\n      id: number,\n      options: WireRequestOptions,\n    ) => Promise<T>,\n    callOptions: CallOptions | undefined,\n  ): Promise<T> {\n    const { signal, onProgress, ...options } = callOptions ?? {};\n    // The worker dequeues an abort only after the proof, so a dispatched call always runs whole.\n    throwIfAborted(signal);\n    await this.init();\n    // A listener added after the abort never fires, so an abort during init needs this recheck.\n    throwIfAborted(signal);\n    const generation = this.#generation;\n    const api = generation?.api;\n    // An existing degrade attempt already carries the decision that created it,\n    // and its inline backend caches the key, so reuse it rather than degrading again.\n    if (this.#degradePromise !== undefined && (this.#pinnedInline || api === undefined)) {\n      return invoke(await this.#degradePromise);\n    }\n    if (generation === undefined || api === undefined) {\n      return invoke(\n        await this.#degrade(\n          generation,\n          this.#crashes.last ?? new WorkerUnavailableError(\"Encrypt worker not running.\"),\n        ),\n      );\n    }\n    const id = this.#sequence++;\n    const onAbort = () => void api.abort(id).catch(() => {});\n    signal?.addEventListener(\"abort\", onAbort, { once: true });\n    if (onProgress) {\n      this.#progressListeners.set(id, onProgress as (event: WireProgressEvent) => void);\n    }\n    try {\n      const result = await this.#overBoundary(generation, overWorker(api, id, options));\n      // A worker operation that answered clears the crash history: two unrelated\n      // crashes far apart must not add up to a permanent degrade.\n      this.#crashes = NO_CRASHES;\n      return result;\n    } catch (error) {\n      if (error instanceof WorkerUnavailableError) {\n        return invoke(await this.#degrade(generation, error));\n      }\n      throw error;\n    } finally {\n      this.#progressListeners.delete(id);\n      signal?.removeEventListener(\"abort\", onAbort);\n    }\n  }\n\n  async #initOnce(generation: WorkerGeneration): Promise<void> {\n    if (this.#pinnedInline) {\n      // The degrade that pinned the client already initialized the backend every call now runs on.\n      return;\n    }\n    const blockedReason = this.#config.blockedReason;\n    if (blockedReason !== undefined) {\n      // Handled before any resource is spent: non-strict callers never get here\n      // (the relayer inlines directly), and strict throws out of the degrade.\n      await this.#degrade(generation, new WorkerUnavailableError(blockedReason));\n      return;\n    }\n    // Outside the degrade guard: a failed key fetch is an application/network\n    // error, and the inline backend would refetch the same key from the same\n    // relayer. It rejects out of init exactly as the inline arm's would.\n    const fheEncryptionKey = await this.#config.prefetchKey();\n    try {\n      const api = await this.#spawn(generation);\n      const network = this.#config.network;\n      const rpcRequest =\n        typeof network === \"string\"\n          ? null\n          : proxy(async (args: { method: string; params?: unknown }) => {\n              try {\n                return await network.request(args as Parameters<EIP1193Provider[\"request\"]>[0]);\n              } catch (error) {\n                // Comlink keeps only name/message/stack on a thrown error, which\n                // would strip the provider's `code` (4001, -32005) the worker's\n                // classifiers read; flatten it so those fields cross.\n                throw toWireError(error);\n              }\n            });\n      // A callback that throws would reject the Comlink proxy call back in the\n      // worker realm, where nothing can report it, so it is contained here.\n      const log = proxy((level: \"debug\" | \"warn\" | \"error\", message: string) => {\n        try {\n          this.#config.logger[level](message);\n        } catch (error) {\n          this.#warnCallbackThrew(\"logger\", error);\n        }\n      });\n      const onProgress = proxy((id: number, event: WireProgressEvent) => {\n        try {\n          this.#progressListeners.get(id)?.(event);\n        } catch (error) {\n          this.#warnCallbackThrew(\"onProgress\", error);\n        }\n      });\n      // The copy stays on this thread so a later degrade to inline reuses the\n      // key instead of refetching; transferring the wire copy avoids a third\n      // in-transit copy of it.\n      const wireKey = keyForTransfer(fheEncryptionKey);\n      await this.#overBoundary(\n        generation,\n        api.init(\n          transfer(\n            {\n              ...this.#config.initPayload,\n              clientOptions: {\n                ...this.#config.initPayload.clientOptions,\n                fheEncryptionKey: wireKey.key,\n              },\n              rpcUrl: typeof network === \"string\" ? network : undefined,\n            },\n            wireKey.transfers,\n          ),\n          rpcRequest,\n          log,\n          onProgress,\n        ),\n        { ms: this.#config.timeouts.init, operation: \"init\" },\n      );\n      generation.api = api;\n      this.#crashes = { ...this.#crashes, last: undefined };\n    } catch (error) {\n      // Only \"the worker never answered or crashed\" is infrastructure. An error\n      // the worker itself reported (a chain read, bad key material) would fail\n      // the same way inline, so it reaches the caller unchanged.\n      if (!(error instanceof WorkerUnavailableError)) {\n        this.#teardown(generation, new WorkerUnavailableError(\"Encrypt worker init failed.\"));\n        throw error;\n      }\n      await this.#degrade(generation, error);\n    }\n  }\n\n  /** Reports a caller callback that threw; the reporting itself must not throw back into the worker. */\n  #warnCallbackThrew(callback: string, error: unknown): void {\n    const reason = error instanceof Error ? error.message : String(error);\n    try {\n      this.#config.logger.warn(`Encrypt offload ${callback} callback threw: ${reason}`);\n    } catch {\n      // A logger that throws on its own warning leaves nowhere left to report.\n    }\n  }\n\n  /**\n   * The count spans a whole public entry, its init included, so a release\n   * requested mid-call cannot terminate the worker between the init and the\n   * operation.\n   */\n  async #withActive<T>(work: () => Promise<T>): Promise<T> {\n    this.#active++;\n    try {\n      return await work();\n    } finally {\n      this.#active--;\n      this.#releaseIfIdle();\n    }\n  }\n\n  #releaseIfIdle(): void {\n    if (!this.#releaseRequested || this.#active > 0) {\n      return;\n    }\n    this.#releaseRequested = false;\n    this.#generation?.worker?.terminate();\n    // A full reset, so a release is the recovery lever for a degraded client:\n    // the next call re-fetches the key and spawns a fresh worker either way.\n    this.#generation = undefined;\n    this.#degradePromise = undefined;\n    this.#pinnedInline = false;\n    this.#crashes = NO_CRASHES;\n  }\n\n  #createWorker(): Worker {\n    const source = this.#config.workerSource;\n    if (source === undefined) {\n      return createEncryptWorker();\n    }\n    if (typeof source === \"function\") {\n      const worker = source();\n      // A memoized factory would hand the client a worker it already terminated,\n      // so the contract is one fresh Worker per call.\n      if (handedOutWorkers.has(worker)) {\n        this.#config.logger.warnAlways(\n          \"The offloadWorker factory returned a worker it already handed out; each call must construct a fresh Worker.\",\n        );\n      }\n      handedOutWorkers.add(worker);\n      return worker;\n    }\n    return new Worker(source, { type: \"module\", name: \"zama-fhe-encrypt\" });\n  }\n\n  /** Resolves once the worker's module graph has loaded. */\n  async #spawn(generation: WorkerGeneration): Promise<Remote<EncryptWorkerApi>> {\n    let worker: Worker;\n    try {\n      worker = this.#createWorker();\n    } catch (error) {\n      // A blocked construction is infrastructure, so it must reach the\n      // degrade path as such rather than as the raw thrown error.\n      throw new WorkerUnavailableError(error instanceof Error ? error.message : String(error), {\n        cause: error,\n      });\n    }\n    generation.worker = worker;\n    const api = await this.#raceReady(generation, worker);\n    this.#armCrashHandler(generation, worker);\n    return api;\n  }\n\n  /** Resolves with the Comlink API on the worker's ready message; rejects on the spawn deadline or a pre-ready error. */\n  #raceReady(generation: WorkerGeneration, worker: Worker): Promise<Remote<EncryptWorkerApi>> {\n    return new Promise<Remote<EncryptWorkerApi>>((resolve, reject) => {\n      const settle = () => {\n        clearTimeout(timer);\n        worker.removeEventListener(\"message\", onReady);\n        worker.removeEventListener(\"error\", onError);\n      };\n      const timer = setTimeout(() => {\n        settle();\n        reject(\n          new WorkerUnavailableError(\n            `Encrypt worker did not start within ${this.#config.timeouts.spawn}ms.`,\n          ),\n        );\n      }, this.#config.timeouts.spawn);\n      const onReady = (event: MessageEvent) => {\n        if (event.data === WORKER_READY_MESSAGE) {\n          settle();\n          resolve(wrap<EncryptWorkerApi>(worker));\n        }\n      };\n      const onError = (event: ErrorEvent) => {\n        settle();\n        const message = event.message || \"Encrypt worker error.\";\n        // A worker that never came up is not worth respawning per call, so\n        // this failure is not flagged as a crash.\n        reject(new WorkerUnavailableError(message));\n        this.#teardown(generation, new WorkerUnavailableError(message));\n      };\n      worker.addEventListener(\"message\", onReady);\n      worker.addEventListener(\"error\", onError);\n    });\n  }\n\n  /** Permanent crash detector, armed only after ready so a pre-ready failure never counts as a crash. */\n  #armCrashHandler(generation: WorkerGeneration, worker: Worker): void {\n    worker.addEventListener(\"error\", (event: ErrorEvent) => {\n      // A generation already torn down cannot crash the client again: nothing\n      // is waiting on it, and the worker running in its place is unaffected.\n      if (this.#generation !== generation) {\n        return;\n      }\n      // A ready worker died under us: the teardown drops the memoized init so\n      // the next call spawns a fresh one, and the operations it took down\n      // finish inline.\n      const crash = new WorkerUnavailableError(event.message || \"Encrypt worker error.\", {\n        crashed: true,\n      });\n      this.#crashes = { ...this.#crashes, count: this.#crashes.count + 1, last: crash };\n      this.#teardown(generation, crash);\n    });\n  }\n\n  /**\n   * Awaits one promise crossing the worker boundary, racing the generation's\n   * `doomed` promise so a teardown settles it with the teardown's\n   * `WorkerUnavailableError`, which degrades it inline. Without a `deadline` it\n   * settles whenever the worker answers; a `deadline` bounds a lifecycle step,\n   * and missing it means the worker is presumed stuck, so the generation is\n   * torn down whole.\n   */\n  async #overBoundary<T>(\n    generation: WorkerGeneration,\n    work: Promise<T>,\n    deadline?: { readonly ms: number; readonly operation: string },\n  ): Promise<T> {\n    const timer =\n      deadline === undefined\n        ? undefined\n        : setTimeout(() => {\n            this.#teardown(\n              generation,\n              new WorkerUnavailableError(\n                `Encrypt worker ${deadline.operation} timed out after ${deadline.ms}ms.`,\n              ),\n            );\n          }, deadline.ms);\n    try {\n      return await Promise.race([\n        work.catch((error: unknown) => {\n          const failure = isWireError(error) ? fromWireError(error) : (error as Error);\n          // A payload Comlink could not carry is infrastructure, so it degrades\n          // instead of reaching the caller as the operation's own failure.\n          throw isCloneFailure(failure)\n            ? new WorkerUnavailableError(failure.message, { cause: failure })\n            : failure;\n        }),\n        generation.doomed,\n      ]);\n    } finally {\n      if (timer !== undefined) {\n        clearTimeout(timer);\n      }\n    }\n  }\n\n  /**\n   * Rejects and drops one generation whole: its worker, its memoized init, and\n   * every crossing racing its `doomed` promise. The next call therefore re-runs\n   * the cycle on a fresh generation, so a spurious teardown costs a respawn\n   * rather than a permanent degrade.\n   */\n  #teardown(generation: WorkerGeneration | undefined, error: WorkerUnavailableError): void {\n    if (generation === undefined) {\n      return;\n    }\n    if (this.#generation === generation) {\n      this.#generation = undefined;\n    }\n    generation.worker?.terminate();\n    generation.worker = undefined;\n    generation.api = undefined;\n    generation.initPromise = undefined;\n    generation.doom(error);\n  }\n\n  async #degrade(\n    generation: WorkerGeneration | undefined,\n    cause: unknown,\n  ): Promise<EncryptOffloadBackend> {\n    const reason = cause instanceof Error ? cause.message : String(cause);\n    if (this.#config.strict) {\n      this.#teardown(generation, new WorkerUnavailableError(\"Encrypt worker unavailable.\"));\n      throw new EncryptOffloadUnavailableError(\n        `Encrypt offload required (offloadEncrypt: true) but unavailable: ${reason}`,\n        { cause },\n      );\n    }\n    const { transient, pinning } = this.#classifyDegrade(cause);\n    this.#pinnedInline ||= !transient;\n    this.#teardown(generation, new WorkerUnavailableError(\"Encrypt worker degraded to inline.\"));\n    this.#warnDegraded(reason, transient, pinning);\n    if (this.#degradePromise === undefined) {\n      // Only a live backend is memoized: an inline init is a key refetch, and a\n      // transient failure there must not close the degrade path for the session.\n      const attempt: Promise<EncryptOffloadBackend> = (async () => {\n        const inline = this.#config.createInlineClient();\n        await inline.init();\n        return inline;\n      })().catch((error: unknown) => {\n        if (this.#degradePromise === attempt) {\n          this.#degradePromise = undefined;\n        }\n        this.#config.logger.warnAlways(\n          `Encrypt inline fallback failed to initialize: ${error instanceof Error ? error.message : String(error)}`,\n        );\n        throw error;\n      });\n      this.#degradePromise = attempt;\n    }\n    return this.#degradePromise;\n  }\n\n  /**\n   * How one failure degrades, read off the state before the degrade mutates it:\n   * `transient` diverts only this call, `pinning` settles the client inline now.\n   * One crash is treated as transient; a repeat crash, or a worker that never\n   * came up, settles the client inline rather than spawning a replacement per call.\n   */\n  #classifyDegrade(cause: unknown): { readonly transient: boolean; readonly pinning: boolean } {\n    const transient =\n      cause instanceof WorkerUnavailableError &&\n      cause.crashed &&\n      this.#crashes.count < CRASH_PIN_THRESHOLD;\n    return { transient, pinning: !transient && !this.#pinnedInline };\n  }\n\n  /** One warning per failure, whether it pins the client inline or only diverts this call. */\n  #warnDegraded(reason: string, transient: boolean, pinning: boolean): void {\n    if (!pinning && this.#crashes.warnedFor === this.#crashes.count) {\n      return;\n    }\n    this.#crashes = { ...this.#crashes, warnedFor: this.#crashes.count };\n    const scope = transient ? \"in-flight encryption falls back\" : \"encryption falls back\";\n    // Always on the console: a silent return to main-thread encryption is the\n    // freeze this offload prevents.\n    this.#config.logger.warnAlways(\n      `${ENCRYPT_OFFLOAD_WARN_PREFIX}, ${scope} to the calling thread: ${reason}`,\n    );\n  }\n}\n","import { createUnsignedLegacyDecryptionPermitEip712 as createUnsignedLegacyDecryptionPermitEip712Action } from \"@fhevm/sdk/actions/base\";\nimport {\n  createFhevmBaseClient,\n  createFhevmDecryptClient,\n  createFhevmEncryptClient,\n  hasFhevmRuntimeConfig,\n} from \"@fhevm/sdk/viem\";\nimport {\n  createFhevmCleartextBaseClient,\n  createFhevmCleartextDecryptClient,\n  createFhevmCleartextEncryptClient,\n} from \"@fhevm/sdk/viem/cleartext\";\nimport { createPublicClient, custom, http } from \"viem\";\nimport { toFhevmChain } from \"../chains/to-fhevm-chain\";\nimport type { FheChain } from \"../chains/types\";\nimport { ConfigurationError } from \"../errors\";\nimport { getAppliedWireRuntime, hasAppliedLocateFile } from \"./applied-runtime\";\nimport type { LoggerService } from \"../services/logger-service\";\nimport { type RelayerTelemetry, telemetryHeaders } from \"../telemetry\";\nimport {\n  DEFAULT_ENCRYPT_WORKER_TIMEOUTS,\n  EncryptWorkerClient,\n  type EncryptWorkerClientConfig,\n  type EncryptWorkerTimeouts,\n} from \"../worker/encrypt-worker-client\";\nimport { BUNDLED_ENCRYPT_WORKER } from \"../worker/spawn\";\nimport type {\n  FhevmBaseClient,\n  FhevmClient,\n  FhevmDecryptClient,\n  FhevmEncryptBackend,\n  FhevmRelayerOptions,\n  RelayerRequestOptions,\n  RelayerSDK,\n  RelayerOptions,\n  WireRuntimeConfig,\n} from \"./types\";\n\n/** The `@fhevm/sdk` client inputs the worker realm rebuilds its own client from. */\ntype EncryptInitPayload = EncryptWorkerClientConfig[\"initPayload\"];\n\n/** Construction config for {@link FhevmRelayer}. */\nexport interface FhevmRelayerConfig {\n  /** FHE chain configuration. */\n  chain: FheChain;\n  /**\n   * Cleartext mode for local dev/test chains without FHE infrastructure — reads\n   * mock cleartexts from the on-chain executor (discovered automatically)\n   * instead of calling the relayer.\n   */\n  cleartext?: boolean;\n  /**\n   * Per-transport {@link RelayerOptions}: `@fhevm/sdk` client options plus a\n   * default request `timeout` applied to every relayer round-trip on the chain.\n   */\n  options?: RelayerOptions;\n  /** Encrypt-worker offload mode; see `web()`'s `offloadEncrypt` option. */\n  offloadEncrypt?: \"auto\" | boolean;\n  /** Watchdog deadlines for the encrypt worker; `web()` defaults every field before it gets here. */\n  offloadTimeouts?: EncryptWorkerTimeouts;\n  /** Custom source for the encrypt worker; see `web()`'s `offloadWorker` option. */\n  offloadWorker?: string | URL | (() => Worker);\n  /** Receives worker log lines and offload-fallback warnings. */\n  logger: LoggerService;\n  telemetry?: RelayerTelemetry;\n}\n\n/**\n * Single-chain FHE backend that drives `@fhevm/sdk` on the calling thread with\n * capability-scoped lazy initialization.\n * EIP-712 signing is done by the signer layer; this backend builds the typed\n * data and, on decrypt, reassembles the new SDK's signed permit from the\n * interface's params + the previously returned signature.\n *\n * @remarks\n * Each method delegates to the narrowest base, decrypt, or encrypt client,\n * adding two cross-cutting behaviors that the delegated signatures don't\n * express:\n *\n * - **Lazy init.** Each operation initializes only the capability it requires.\n *   Public decrypt avoids WASM, private decrypt loads TKMS only, and encryption\n *   alone loads TFHE and the FHE encryption key.\n * - **Option merging.** The chain's default options (`auth`, `timeout`, `debug`)\n *   are spread in first, then the per-call `options`, so a per-call value always\n *   wins over the chain default. Serialization helpers make no relayer\n *   round-trip, so they inject no options.\n *\n * @internal\n */\nexport class FhevmRelayer implements RelayerSDK {\n  readonly #chain: FheChain;\n  readonly #base: FhevmBaseClient;\n  readonly #decrypt: FhevmDecryptClient;\n  readonly #encrypt: FhevmEncryptBackend;\n  readonly #defaultOptions: Partial<FhevmRelayerOptions>;\n  readonly #telemetry: RelayerTelemetry | undefined;\n  #encryptInitPromise: Promise<void> | undefined;\n\n  /**\n   * Builds capability-scoped `@fhevm/sdk` clients for the chain and captures\n   * the chain's `auth`/`timeout`/`debug` as request defaults. Construction is\n   * cheap; each client's one-time init is deferred to its first operation.\n   */\n  constructor(config: FhevmRelayerConfig) {\n    this.#chain = config.chain;\n    const { timeout, debug, batchRpcCalls, moduleVersions, fheEncryptionKey } =\n      config.options ?? {};\n    const auth = this.#chain.auth ? toFhevmAuth(this.#chain.auth) : undefined;\n    const transport =\n      typeof this.#chain.network === \"string\"\n        ? http(this.#chain.network)\n        : custom(this.#chain.network);\n    const params = {\n      publicClient: createPublicClient({ transport }),\n      chain: toFhevmChain(this.#chain),\n      options: { batchRpcCalls, moduleVersions, fheEncryptionKey },\n    };\n    this.#defaultOptions = {\n      ...(auth !== undefined && { auth }),\n      ...(timeout !== undefined && { timeout }),\n      ...(debug !== undefined && { debug }),\n    };\n    this.#telemetry = config.telemetry;\n    // The FHE key is always fetched here, on the calling thread, so the chain's\n    // default request options (auth in particular) apply; a worker realm has no\n    // access to them.\n    const prefetchKey = () =>\n      this.#base.fetchFheEncryptionKeyBytes({ options: this.#requestOptions(undefined) });\n    // Re-listed rather than spread: the upstream client exposes an enumerable\n    // `ready` getter, and a spread would call it, starting init at construction.\n    const withInlineInit = (client: FhevmEncryptBackend): FhevmEncryptBackend => ({\n      init: async () => {\n        await prefetchKey();\n        await client.init();\n      },\n      encryptValue: (parameters) => client.encryptValue(parameters),\n      encryptValues: (parameters) => client.encryptValues(parameters),\n      fetchFheEncryptionKeyBytes: (parameters) => client.fetchFheEncryptionKeyBytes(parameters),\n    });\n    if (config.cleartext) {\n      this.#base = createFhevmCleartextBaseClient(params);\n      this.#decrypt = createFhevmCleartextDecryptClient(params);\n      this.#encrypt = withInlineInit(createFhevmCleartextEncryptClient(params));\n    } else {\n      this.#base = createFhevmBaseClient(params);\n      this.#decrypt = createFhevmDecryptClient(params);\n      this.#encrypt = this.#buildEncryptBackend(config, params, {\n        prefetchKey,\n        createInlineClient: () => withInlineInit(createFhevmEncryptClient(params)),\n      });\n    }\n  }\n\n  /**\n   * Picks the encrypt backend for a non-cleartext chain: the worker client when\n   * offload is on and reachable, the inline calling-thread client otherwise.\n   */\n  #buildEncryptBackend(\n    config: FhevmRelayerConfig,\n    params: { chain: EncryptInitPayload[\"chain\"]; options: EncryptInitPayload[\"clientOptions\"] },\n    inline: {\n      prefetchKey: EncryptWorkerClientConfig[\"prefetchKey\"];\n      createInlineClient: () => FhevmEncryptBackend;\n    },\n  ): FhevmEncryptBackend {\n    const offload = config.offloadEncrypt ?? false;\n    const strict = offload === true;\n    const workerAvailable =\n      typeof Worker === \"function\" &&\n      (config.offloadWorker !== undefined || BUNDLED_ENCRYPT_WORKER);\n    // Silent both ways: offload off is what the caller asked for, and a realm\n    // with no Worker is an environment fact that would warn on every SSR\n    // render. Strict skips the capability check, since construction runs during\n    // that render and the failure must surface at call time instead.\n    if (offload === false || !(strict || workerAvailable)) {\n      return inline.createInlineClient();\n    }\n    const runtime = getAppliedWireRuntime();\n    const blocker = encryptOffloadBlocker(runtime);\n    if (blocker !== undefined && !strict) {\n      // Always on the console: the alternative is an opaque rejection at\n      // encrypt time, or WASM assets silently resolved from the default URLs.\n      config.logger.warnAlways(`Encryption runs on the calling thread: ${blocker}.`);\n      return inline.createInlineClient();\n    }\n    const workerClient = new EncryptWorkerClient({\n      initPayload: { chain: params.chain, clientOptions: params.options, runtime: runtime ?? {} },\n      network: this.#chain.network,\n      prefetchKey: inline.prefetchKey,\n      createInlineClient: inline.createInlineClient,\n      logger: config.logger,\n      timeouts: config.offloadTimeouts ?? DEFAULT_ENCRYPT_WORKER_TIMEOUTS,\n      workerSource: config.offloadWorker,\n      // Strict with a blocker: the client degrades at init, which rejects at\n      // call time rather than at config time.\n      blockedReason: blocker,\n      strict,\n    });\n    return {\n      init: () => workerClient.init(),\n      encryptValue: (parameters) => workerClient.encryptValue(parameters),\n      encryptValues: (parameters) => workerClient.encryptValues(parameters),\n      // Served from the calling thread: routing it through the worker would\n      // structured-clone the ~50 MB key back out on every call. `ignoreCache`\n      // therefore refreshes this thread's cache, not the worker's seeded key.\n      fetchFheEncryptionKeyBytes: (parameters) => this.#base.fetchFheEncryptionKeyBytes(parameters),\n      dispose: () => workerClient.dispose(),\n    };\n  }\n\n  /** The FHE chain this backend is bound to. */\n  get chain() {\n    return this.#chain;\n  }\n\n  // `operation` becomes a header here and must never reach `@fhevm/sdk`.\n  #requestOptions<T extends Partial<FhevmRelayerOptions> | undefined>(\n    options: T,\n  ): Omit<Partial<FhevmRelayerOptions> & NonNullable<T>, \"operation\"> {\n    const { operation, ...merged } = {\n      ...this.#defaultOptions,\n      ...options,\n    } as Partial<FhevmRelayerOptions> & NonNullable<T> & RelayerRequestOptions;\n    if (this.#telemetry === undefined) {\n      return merged;\n    }\n    return {\n      ...merged,\n      headers: { ...merged.headers, ...telemetryHeaders(this.#telemetry, operation) },\n    };\n  }\n\n  // Only a fulfilled init is memoized: a rejection clears the memo so the next\n  // encryption retries instead of inheriting a transient key-fetch failure.\n  #initEncrypt = (): Promise<void> => {\n    this.#encryptInitPromise ??= this.#encrypt.init().catch((error: unknown) => {\n      this.#encryptInitPromise = undefined;\n      throw error;\n    });\n    return this.#encryptInitPromise;\n  };\n\n  /**\n   * Releases the encrypt worker once in-flight encryptions settle and drops the\n   * memoized init; the next encryption spawns a fresh worker and re-initializes.\n   */\n  dispose = (): void => {\n    this.#encryptInitPromise = undefined;\n    this.#encrypt.dispose?.();\n  };\n\n  /**\n   * Decrypts a single publicly-decryptable value — one whose contract granted\n   * public access, so no permit or key pair is needed — into its typed clear\n   * value.\n   *\n   * @example\n   * ```ts\n   * const { type, value } = await relayer.decryptPublicValue({\n   *   encryptedValue: handle, // a bytes32 ciphertext reference\n   * });\n   * ```\n   */\n  decryptPublicValue: FhevmClient[\"decryptPublicValue\"] = async (parameters) => {\n    await this.#base.init();\n    return this.#base.decryptPublicValue({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * Batch form of {@link decryptPublicValue}: decrypts many publicly-decryptable\n   * values in one relayer round-trip, returning their typed clear values in\n   * order.\n   *\n   * @example\n   * ```ts\n   * const values = await relayer.decryptPublicValues({\n   *   encryptedValues: [handleA, handleB],\n   * });\n   * ```\n   */\n  decryptPublicValues: FhevmClient[\"decryptPublicValues\"] = async (parameters) => {\n    await this.#base.init();\n    return this.#base.decryptPublicValues({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * Like {@link decryptPublicValues}, but also returns the KMS signature bundle —\n   * the handles list, ABI-encoded cleartexts, and decryption proof — needed to\n   * verify or replay the result on-chain.\n   *\n   * @example\n   * ```ts\n   * const { clearValues, checkSignaturesArgs } =\n   *   await relayer.decryptPublicValuesWithSignatures({ encryptedValues: [handle] });\n   * // checkSignaturesArgs: { handlesList, abiEncodedCleartexts, decryptionProof }\n   * ```\n   */\n  decryptPublicValuesWithSignatures: FhevmClient[\"decryptPublicValuesWithSignatures\"] = async (\n    parameters,\n  ) => {\n    await this.#base.init();\n    return this.#base.decryptPublicValuesWithSignatures({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * Encrypts one typed input under the chain's FHE key, bound to the contract it\n   * targets and the user submitting it, and returns the ciphertext handle plus\n   * the input proof the contract verifies on-chain. `type` is the FHE type\n   * with the `e` prefix (`\"euint64\"`, `\"ebool\"`, `\"eaddress\"`).\n   *\n   * @example\n   * ```ts\n   * const { encryptedValue, inputProof } = await relayer.encryptValue({\n   *   value: { type: \"euint64\", value: 1000n },\n   *   contractAddress: \"0xToken…\",\n   *   userAddress: \"0xUser…\",\n   * });\n   * ```\n   */\n  encryptValue: FhevmClient[\"encryptValue\"] = async (parameters) => {\n    await this.#initEncrypt();\n    return this.#encrypt.encryptValue({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * Batch form of {@link encryptValue}: encrypts several inputs for the same\n   * contract and user in one call, returning all ciphertext handles under a\n   * single shared input proof.\n   *\n   * @example\n   * ```ts\n   * const { encryptedValues, inputProof } = await relayer.encryptValues({\n   *   values: [\n   *     { type: \"euint64\", value: 1000n },\n   *     { type: \"ebool\", value: true },\n   *   ],\n   *   contractAddress: \"0xToken…\",\n   *   userAddress: \"0xUser…\",\n   * });\n   * ```\n   */\n  encryptValues: FhevmClient[\"encryptValues\"] = async (parameters) => {\n    await this.#initEncrypt();\n    return this.#encrypt.encryptValues({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * User-decrypts a single access-controlled value: the relayer re-encrypts it\n   * to the ephemeral transport key pair, gated by the signed permit, and this\n   * returns the typed clear value. Build the key pair with\n   * {@link generateTransportKeyPair} and the permit with\n   * {@link signDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const { type, value } = await relayer.decryptValue({\n   *   encryptedValue: handle,\n   *   contractAddress: \"0xToken…\",\n   *   transportKeyPair,\n   *   signedPermit,\n   * });\n   * ```\n   */\n  decryptValue: FhevmClient[\"decryptValue\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.decryptValue({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * Batch form of {@link decryptValue} for values that all belong to the same\n   * contract; returns the typed clear values positionally. For values spanning\n   * multiple contracts, use {@link decryptValuesFromPairs}.\n   *\n   * @example\n   * ```ts\n   * const values = await relayer.decryptValues({\n   *   encryptedValues: [handleA, handleB],\n   *   contractAddress: \"0xToken…\",\n   *   transportKeyPair,\n   *   signedPermit,\n   * });\n   * ```\n   */\n  decryptValues: FhevmClient[\"decryptValues\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.decryptValues({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * User-decrypts values that span multiple contracts: each pair carries its own\n   * `contractAddress`, so one permit covering those contracts decrypts them all\n   * in a single round-trip. Returns the typed clear values positionally.\n   *\n   * @example\n   * ```ts\n   * const values = await relayer.decryptValuesFromPairs({\n   *   pairs: [\n   *     { encryptedValue: handleA, contractAddress: \"0xTokenA…\" },\n   *     { encryptedValue: handleB, contractAddress: \"0xTokenB…\" },\n   *   ],\n   *   transportKeyPair,\n   *   signedPermit,\n   * });\n   * ```\n   */\n  decryptValuesFromPairs: FhevmClient[\"decryptValuesFromPairs\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.decryptValuesFromPairs({\n      ...parameters,\n      options: this.#requestOptions(parameters.options),\n    });\n  };\n\n  /**\n   * Fetches the chain's raw FHE public-key bytes — the key encryption uses —\n   * served from cache unless `ignoreCache` forces a refetch. Rarely called\n   * directly: {@link encryptValue}/{@link encryptValues} fetch the key for you.\n   *\n   * @example\n   * ```ts\n   * const keyBytes = await relayer.fetchFheEncryptionKeyBytes();\n   * const fresh = await relayer.fetchFheEncryptionKeyBytes({ ignoreCache: true });\n   * ```\n   */\n  fetchFheEncryptionKeyBytes: FhevmClient[\"fetchFheEncryptionKeyBytes\"] = async (parameters) => {\n    // Served from the base client, which shares the key cache with the encrypt\n    // client: initializing encryption here would spawn the encrypt worker and\n    // wait out its bring-up for a key this thread fetches itself.\n    await this.#base.init();\n    return this.#base.fetchFheEncryptionKeyBytes({\n      ...parameters,\n      options: this.#requestOptions(parameters?.options),\n    });\n  };\n\n  /**\n   * Builds the EIP-712 user-decrypt permit and signs it with the given signer,\n   * authorizing the transport key pair to decrypt the listed contracts' values\n   * for `durationSeconds` starting at `startTimestamp`. Pass `delegatorAddress`\n   * to sign a delegated permit — decrypting values owned by that account instead\n   * of the signer's own. Persist the result via\n   * {@link serializeSignedDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const signedPermit = await relayer.signDecryptionPermit({\n   *   transportKeyPair,\n   *   contractAddresses: [\"0xToken…\"],\n   *   startTimestamp: Math.floor(Date.now() / 1000),\n   *   durationSeconds: 60 * 60 * 24,\n   *   signerAddress: \"0xUser…\",\n   *   signer,\n   *   // delegatorAddress: \"0xOwner…\", // omit for a self permit\n   * });\n   * ```\n   */\n  signDecryptionPermit: FhevmClient[\"signDecryptionPermit\"] = async (parameters) => {\n    await this.#base.init();\n    return this.#base.signDecryptionPermit(parameters);\n  };\n\n  /**\n   * Builds the unsigned EIP-712 typed data for a V1 decryption permit, without\n   * signing it — the signer-less counterpart to {@link signDecryptionPermit}.\n   * Hand the result to an out-of-process signer for `eth_signTypedData_v4`,\n   * then verify the returned signature via {@link parseSignedDecryptionPermit}.\n   *\n   * Not on `@fhevm/sdk`'s client decorator, so it's called directly against\n   * the base client rather than through a decorated method.\n   *\n   * @example\n   * ```ts\n   * const eip712 = await relayer.createUnsignedLegacyDecryptionPermitEip712({\n   *   transportKeyPair,\n   *   contractAddresses: [\"0xToken…\"],\n   *   startTimestamp: Math.floor(Date.now() / 1000),\n   *   durationSeconds: 60 * 60 * 24,\n   *   // delegatorAddress: \"0xOwner…\", // omit for a self permit\n   * });\n   * ```\n   */\n  createUnsignedLegacyDecryptionPermitEip712: RelayerSDK[\"createUnsignedLegacyDecryptionPermitEip712\"] =\n    (parameters) => createUnsignedLegacyDecryptionPermitEip712Action(this.#base, parameters);\n\n  // Permit/key-pair helpers carry no request options. Parsing explicitly\n  // initializes the capability that validates the restored value; serialization\n  // resolves the frozen context internally (via initPublicAction), which reads\n  // on-chain state.\n\n  /**\n   * Serializes a transport key pair to a hex `{ publicKey, privateKey }` pair for\n   * storage or transport, so a decryption session can resume without regenerating\n   * keys. Reverse of {@link parseTransportKeyPair}.\n   *\n   * @example\n   * ```ts\n   * const stored = await relayer.serializeTransportKeyPair({ transportKeyPair });\n   * // { publicKey: \"0x…\", privateKey: \"0x…\" }\n   * ```\n   */\n  serializeTransportKeyPair: FhevmClient[\"serializeTransportKeyPair\"] = (parameters) =>\n    this.#decrypt.serializeTransportKeyPair(parameters);\n\n  /**\n   * Serializes a signed permit to a plain, JSON-stringifiable object (version,\n   * EIP-712 payload, signature, signer) for caching or transport. Reverse of\n   * {@link parseSignedDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const serialized = await relayer.serializeSignedDecryptionPermit({ signedPermit });\n   * localStorage.setItem(\"permit\", JSON.stringify(serialized));\n   * ```\n   */\n  serializeSignedDecryptionPermit: FhevmClient[\"serializeSignedDecryptionPermit\"] = (parameters) =>\n    this.#base.serializeSignedDecryptionPermit(parameters);\n\n  /**\n   * Rebuilds a transport key pair from its serialized hex\n   * `{ publicKey, privateKey }` form. Reverse of {@link serializeTransportKeyPair}.\n   *\n   * @example\n   * ```ts\n   * const transportKeyPair = await relayer.parseTransportKeyPair({\n   *   publicKey: stored.publicKey,\n   *   privateKey: stored.privateKey,\n   * });\n   * ```\n   */\n  parseTransportKeyPair: FhevmClient[\"parseTransportKeyPair\"] = async (parameters) => {\n    await this.#decrypt.init();\n    return this.#decrypt.parseTransportKeyPair(parameters);\n  };\n\n  /**\n   * Rebuilds a signed permit from its serialized form and validates it: checks\n   * the EIP-712 structure, verifies the signature against the on-chain verifier,\n   * and confirms the permit's public key matches `transportKeyPair`. Reverse of\n   * {@link serializeSignedDecryptionPermit}.\n   *\n   * @throws if the permit is malformed, expired, or its signature is invalid.\n   *\n   * @example\n   * ```ts\n   * const signedPermit = await relayer.parseSignedDecryptionPermit({\n   *   serializedPermit,\n   *   transportKeyPair,\n   * });\n   * ```\n   */\n  parseSignedDecryptionPermit: FhevmClient[\"parseSignedDecryptionPermit\"] = async (parameters) => {\n    await this.#base.init();\n    const { serializedPermit } = parameters;\n    return this.#base.parseSignedDecryptionPermit({\n      ...parameters,\n      serializedPermit: {\n        ...serializedPermit,\n        signature: normalizeSignatureV(serializedPermit.signature),\n      },\n    });\n  };\n\n  /**\n   * Generates a fresh ephemeral transport key pair for a user-decrypt session.\n   * The relayer re-encrypts decrypted values to this pair's public key, so only\n   * the holder of the private key can read them; bind it to a permit via\n   * {@link signDecryptionPermit}.\n   *\n   * @example\n   * ```ts\n   * const transportKeyPair = await relayer.generateTransportKeyPair();\n   * ```\n   */\n  generateTransportKeyPair: FhevmClient[\"generateTransportKeyPair\"] = async () => {\n    await this.#decrypt.init();\n    return this.#decrypt.generateTransportKeyPair();\n  };\n}\n\n/**\n * Rewrites a 65-byte signature's recovery byte from 0/1 to 27/28. The gateway\n * verifies V1 permits on-chain with OpenZeppelin `ECDSA.recover`, which rejects\n * 0/1. Longer signatures (ERC-1271, concatenated) pass through untouched.\n */\nfunction normalizeSignatureV(signature: string): string {\n  if (signature.length !== 132) {\n    return signature;\n  }\n  const v = parseInt(signature.slice(130), 16);\n  if (v !== 0 && v !== 1) {\n    return signature;\n  }\n  return `${signature.slice(0, 130)}${v === 0 ? \"1b\" : \"1c\"}`;\n}\n\n/**\n * The one reason, if any, this thread's configuration cannot be reproduced in\n * the worker realm, so offload is worse than inline there.\n */\nfunction encryptOffloadBlocker(runtime: WireRuntimeConfig | undefined): string | undefined {\n  // A runtime `locateFile` is a function: it cannot be cloned into the worker\n  // realm, which would silently resolve WASM assets from the default URLs.\n  if (hasAppliedLocateFile()) {\n    return \"a runtime locateFile cannot cross the encrypt worker boundary\";\n  }\n  // Unreadable here, so the worker would run on fhevm defaults: an auth it\n  // carries would 401 inside the worker as an application error, which never degrades.\n  if (runtime === undefined && hasFhevmRuntimeConfig()) {\n    return \"a runtime config set outside createConfig cannot be replicated in the encrypt worker realm\";\n  }\n  return undefined;\n}\n\n/**\n * Translates the SDK's public {@link FheChain.auth} shape (discriminated by\n * `__type`) into the `type`-discriminated `auth` that `@fhevm/sdk` expects.\n *\n * @throws if the auth discriminator is not one of the supported kinds.\n */\nfunction toFhevmAuth(\n  auth: NonNullable<FheChain[\"auth\"]>,\n): NonNullable<FhevmRelayerOptions[\"auth\"]> {\n  const type = auth[\"__type\"];\n  switch (type) {\n    case \"ApiKeyHeader\":\n      return { type, value: auth.value, header: auth.header };\n    case \"ApiKeyCookie\":\n      return { type, value: auth.value, cookie: auth.cookie };\n    case \"BearerToken\":\n      return { type, token: auth.token };\n    default:\n      throw new ConfigurationError(`Unknown auth type: ${String(type)}`);\n  }\n}\n"],"x_google_ignoreList":[1],"mappings":"2oBAYA,SAAgB,EAAa,EAA6B,CACxD,MAAO,CACL,GAAI,EAAM,GACV,MAAO,CACL,UAAW,CACT,IAAK,CAAE,QAAS,EAAM,kBAAmB,EACzC,cAAe,CAAE,QAAS,EAAM,4BAA6B,EAC7D,YAAa,CAAE,QAAS,EAAM,kBAAmB,EACjD,eAAgB,IAAA,EAClB,EACA,WAAY,EAAM,WAClB,QAAS,CACP,GAAI,EAAM,eACV,UAAW,CACT,WAAY,CAAE,QAAS,EAAM,kCAAmC,EAChE,kBAAmB,CAAE,QAAS,EAAM,yCAA0C,CAChF,CACF,CACF,CACF,CACF;;;;;;AC3BA,MAAM,EAAc,OAAO,eAAe,EACpC,EAAiB,OAAO,kBAAkB,EAC1C,EAAe,OAAO,sBAAsB,EAC5C,EAAY,OAAO,mBAAmB,EACtC,EAAc,OAAO,gBAAgB,EACrC,EAAY,GAAS,OAAO,GAAQ,YAAY,GAAiB,OAAO,GAAQ,WAgDhF,EAAmB,IAAI,IAAI,CAC7B,CAAC,QAAS,CA5CV,UAAY,GAAQ,EAAS,CAAG,GAAK,EAAI,GACzC,UAAU,EAAK,CACX,GAAM,CAAE,QAAO,SAAU,IAAI,eAE7B,OADA,EAAO,EAAK,CAAK,EACV,CAAC,EAAO,CAAC,CAAK,CAAC,CAC1B,EACA,YAAY,EAAM,CAEd,OADA,EAAK,MAAM,EACJ,EAAK,CAAI,CACpB,CAmC6B,CAAC,EAC9B,CAAC,QAAS,CA9BV,UAAY,GAAU,EAAS,CAAK,GAAK,KAAe,EACxD,UAAU,CAAE,SAAS,CACjB,IAAI,EAcJ,MAbA,CAWI,EAXA,aAAiB,MACJ,CACT,QAAS,GACT,MAAO,CACH,QAAS,EAAM,QACf,KAAM,EAAM,KACZ,MAAO,EAAM,KACjB,CACJ,EAGa,CAAE,QAAS,GAAO,OAAM,EAElC,CAAC,EAAY,CAAC,CAAC,CAC1B,EACA,YAAY,EAAY,CAIpB,MAHI,EAAW,QACL,OAAO,OAAW,MAAM,EAAW,MAAM,OAAO,EAAG,EAAW,KAAK,EAEvE,EAAW,KACrB,CAO6B,CAAC,CAClC,CAAC,EACD,SAAS,EAAgB,EAAgB,EAAQ,CAC7C,IAAK,IAAM,KAAiB,EAIxB,GAHI,IAAW,GAAiB,IAAkB,KAG9C,aAAyB,QAAU,EAAc,KAAK,CAAM,EAC5D,MAAO,GAGf,MAAO,EACX,CACA,SAAS,EAAO,EAAK,EAAK,WAAY,EAAiB,CAAC,GAAG,EAAG,CAC1D,EAAG,iBAAiB,UAAW,SAAS,EAAS,EAAI,CACjD,GAAI,CAAC,GAAM,CAAC,EAAG,KACX,OAEJ,GAAI,CAAC,EAAgB,EAAgB,EAAG,MAAM,EAAG,CAC7C,QAAQ,KAAK,mBAAmB,EAAG,OAAO,oBAAoB,EAC9D,MACJ,CACA,GAAM,CAAE,KAAI,OAAM,QAAS,OAAO,OAAO,CAAE,KAAM,CAAC,CAAE,EAAG,EAAG,IAAI,EACxD,GAAgB,EAAG,KAAK,cAAgB,CAAC,EAAA,CAAG,IAAI,CAAa,EAC/D,EACJ,GAAI,CACA,IAAM,EAAS,EAAK,MAAM,EAAG,EAAE,CAAC,CAAC,QAAQ,EAAK,IAAS,EAAI,GAAO,CAAG,EAC/D,EAAW,EAAK,QAAQ,EAAK,IAAS,EAAI,GAAO,CAAG,EAC1D,OAAQ,EAAR,CACI,IAAK,MAEG,EAAc,EAElB,MACJ,IAAK,MAEG,EAAO,EAAK,MAAM,EAAE,CAAC,CAAC,IAAM,EAAc,EAAG,KAAK,KAAK,EACvD,EAAc,GAElB,MACJ,IAAK,QAEG,EAAc,EAAS,MAAM,EAAQ,CAAY,EAErD,MACJ,IAAK,YAGG,EAAc,EAAM,IADF,EAAS,GAAG,CACN,CAAC,EAE7B,MACJ,IAAK,WACD,CACI,GAAM,CAAE,QAAO,SAAU,IAAI,eAC7B,EAAO,EAAK,CAAK,EACjB,EAAc,EAAS,EAAO,CAAC,CAAK,CAAC,CACzC,CACA,MACJ,IAAK,UAEG,EAAc,IAAA,GAElB,MACJ,QACI,MACR,CACJ,OACO,EAAO,CACV,EAAc,CAAE,SAAQ,GAAc,CAAE,CAC5C,CACA,QAAQ,QAAQ,CAAW,CAAC,CACvB,MAAO,IACD,CAAE,SAAQ,GAAc,CAAE,EACpC,CAAC,CACG,KAAM,GAAgB,CACvB,GAAM,CAAC,EAAW,GAAiB,EAAY,CAAW,EAC1D,EAAG,YAAY,OAAO,OAAO,OAAO,OAAO,CAAC,EAAG,CAAS,EAAG,CAAE,IAAG,CAAC,EAAG,CAAa,EAC7E,IAAS,YAET,EAAG,oBAAoB,UAAW,CAAQ,EAC1C,EAAc,CAAE,EACZ,KAAa,GAAO,OAAO,EAAI,IAAe,YAC9C,EAAI,EAAU,CAAC,EAG3B,CAAC,CAAC,CACG,MAAO,GAAU,CAElB,GAAM,CAAC,EAAW,GAAiB,EAAY,CAC3C,MAAW,UAAU,6BAA6B,GACjD,GAAc,CACnB,CAAC,EACD,EAAG,YAAY,OAAO,OAAO,OAAO,OAAO,CAAC,EAAG,CAAS,EAAG,CAAE,IAAG,CAAC,EAAG,CAAa,CACrF,CAAC,CACL,CAAC,EACG,EAAG,OACH,EAAG,MAAM,CAEjB,CACA,SAAS,GAAc,EAAU,CAC7B,OAAO,EAAS,YAAY,OAAS,aACzC,CACA,SAAS,EAAc,EAAU,CACzB,GAAc,CAAQ,GACtB,EAAS,MAAM,CACvB,CACA,SAAS,EAAK,EAAI,EAAQ,CACtB,IAAM,EAAmB,IAAI,IAiB7B,OAhBA,EAAG,iBAAiB,UAAW,SAAuB,EAAI,CACtD,GAAM,CAAE,QAAS,EACjB,GAAI,CAAC,GAAQ,CAAC,EAAK,GACf,OAEJ,IAAM,EAAW,EAAiB,IAAI,EAAK,EAAE,EACxC,KAGL,GAAI,CACA,EAAS,CAAI,CACjB,QACQ,CACJ,EAAiB,OAAO,EAAK,EAAE,CACnC,CACJ,CAAC,EACM,EAAY,EAAI,EAAkB,CAAC,EAAG,CAAM,CACvD,CACA,SAAS,EAAqB,EAAY,CACtC,GAAI,EACA,MAAU,MAAM,4CAA4C,CAEpE,CACA,SAAS,EAAgB,EAAI,CACzB,OAAO,EAAuB,EAAI,IAAI,IAAO,CACzC,KAAM,SACV,CAAC,CAAC,CAAC,SAAW,CACV,EAAc,CAAE,CACpB,CAAC,CACL,CACA,MAAM,EAAe,IAAI,QACnB,EAAkB,yBAA0B,YAC9C,IAAI,qBAAsB,GAAO,CAC7B,IAAM,GAAY,EAAa,IAAI,CAAE,GAAK,GAAK,EAC/C,EAAa,IAAI,EAAI,CAAQ,EACzB,IAAa,GACb,EAAgB,CAAE,CAE1B,CAAC,EACL,SAAS,EAAc,EAAO,EAAI,CAC9B,IAAM,GAAY,EAAa,IAAI,CAAE,GAAK,GAAK,EAC/C,EAAa,IAAI,EAAI,CAAQ,EACzB,GACA,EAAgB,SAAS,EAAO,EAAI,CAAK,CAEjD,CACA,SAAS,EAAgB,EAAO,CACxB,GACA,EAAgB,WAAW,CAAK,CAExC,CACA,SAAS,EAAY,EAAI,EAAkB,EAAO,CAAC,EAAG,EAAS,UAAY,CAAE,EAAG,CAC5E,IAAI,EAAkB,GAChB,EAAQ,IAAI,MAAM,EAAQ,CAC5B,IAAI,EAAS,EAAM,CAEf,GADA,EAAqB,CAAe,EAChC,IAAS,EACT,UAAa,CACT,EAAgB,CAAK,EACrB,EAAgB,CAAE,EAClB,EAAiB,MAAM,EACvB,EAAkB,EACtB,EAEJ,GAAI,IAAS,OAAQ,CACjB,GAAI,EAAK,SAAW,EAChB,MAAO,CAAE,SAAY,CAAM,EAE/B,IAAM,EAAI,EAAuB,EAAI,EAAkB,CACnD,KAAM,MACN,KAAM,EAAK,IAAK,GAAM,EAAE,SAAS,CAAC,CACtC,CAAC,CAAC,CAAC,KAAK,CAAa,EACrB,OAAO,EAAE,KAAK,KAAK,CAAC,CACxB,CACA,OAAO,EAAY,EAAI,EAAkB,CAAC,GAAG,EAAM,CAAI,CAAC,CAC5D,EACA,IAAI,EAAS,EAAM,EAAU,CACzB,EAAqB,CAAe,EAGpC,GAAM,CAAC,EAAO,GAAiB,EAAY,CAAQ,EACnD,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,MACN,KAAM,CAAC,GAAG,EAAM,CAAI,CAAC,CAAC,IAAK,GAAM,EAAE,SAAS,CAAC,EAC7C,OACJ,EAAG,CAAa,CAAC,CAAC,KAAK,CAAa,CACxC,EACA,MAAM,EAAS,EAAU,EAAiB,CACtC,EAAqB,CAAe,EACpC,IAAM,EAAO,EAAK,EAAK,OAAS,GAChC,GAAI,IAAS,EACT,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,UACV,CAAC,CAAC,CAAC,KAAK,CAAa,EAGzB,GAAI,IAAS,OACT,OAAO,EAAY,EAAI,EAAkB,EAAK,MAAM,EAAG,EAAE,CAAC,EAE9D,GAAM,CAAC,EAAc,GAAiB,EAAiB,CAAe,EACtE,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,QACN,KAAM,EAAK,IAAK,GAAM,EAAE,SAAS,CAAC,EAClC,cACJ,EAAG,CAAa,CAAC,CAAC,KAAK,CAAa,CACxC,EACA,UAAU,EAAS,EAAiB,CAChC,EAAqB,CAAe,EACpC,GAAM,CAAC,EAAc,GAAiB,EAAiB,CAAe,EACtE,OAAO,EAAuB,EAAI,EAAkB,CAChD,KAAM,YACN,KAAM,EAAK,IAAK,GAAM,EAAE,SAAS,CAAC,EAClC,cACJ,EAAG,CAAa,CAAC,CAAC,KAAK,CAAa,CACxC,CACJ,CAAC,EAED,OADA,EAAc,EAAO,CAAE,EAChB,CACX,CACA,SAAS,GAAO,EAAK,CACjB,OAAO,MAAM,UAAU,OAAO,MAAM,CAAC,EAAG,CAAG,CAC/C,CACA,SAAS,EAAiB,EAAc,CACpC,IAAM,EAAY,EAAa,IAAI,CAAW,EAC9C,MAAO,CAAC,EAAU,IAAK,GAAM,EAAE,EAAE,EAAG,GAAO,EAAU,IAAK,GAAM,EAAE,EAAE,CAAC,CAAC,CAC1E,CACA,MAAM,EAAgB,IAAI,QAC1B,SAAS,EAAS,EAAK,EAAW,CAE9B,OADA,EAAc,IAAI,EAAK,CAAS,EACzB,CACX,CACA,SAAS,EAAM,EAAK,CAChB,OAAO,OAAO,OAAO,EAAK,EAAG,GAAc,EAAK,CAAC,CACrD,CAQA,SAAS,EAAY,EAAO,CACxB,IAAK,GAAM,CAAC,EAAM,KAAY,EAC1B,GAAI,EAAQ,UAAU,CAAK,EAAG,CAC1B,GAAM,CAAC,EAAiB,GAAiB,EAAQ,UAAU,CAAK,EAChE,MAAO,CACH,CACI,KAAM,UACN,OACA,MAAO,CACX,EACA,CACJ,CACJ,CAEJ,MAAO,CACH,CACI,KAAM,MACN,OACJ,EACA,EAAc,IAAI,CAAK,GAAK,CAAC,CACjC,CACJ,CACA,SAAS,EAAc,EAAO,CAC1B,OAAQ,EAAM,KAAd,CACI,IAAK,UACD,OAAO,EAAiB,IAAI,EAAM,IAAI,CAAC,CAAC,YAAY,EAAM,KAAK,EACnE,IAAK,MACD,OAAO,EAAM,KACrB,CACJ,CACA,SAAS,EAAuB,EAAI,EAAkB,EAAK,EAAW,CAClE,OAAO,IAAI,QAAS,GAAY,CAC5B,IAAM,EAAK,EAAa,EACxB,EAAiB,IAAI,EAAI,CAAO,EAC5B,EAAG,OACH,EAAG,MAAM,EAEb,EAAG,YAAY,OAAO,OAAO,CAAE,IAAG,EAAG,CAAG,EAAG,CAAS,CACxD,CAAC,CACL,CACA,SAAS,GAAe,CACpB,MAAO,KAAW,CAAC,CACd,KAAK,CAAC,CAAC,CACP,QAAU,KAAK,MAAM,KAAK,OAAO,WAA2B,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAC3E,KAAK,GAAG,CACjB,CCnPA,SAAgB,EAAY,EAAoC,CAG9D,OACE,OAAO,GAAU,YACjB,GACC,EAAkC,YAAc,EAErD,CAOA,MAAM,EAAmB,CACvB,aACA,SACA,aACA,YACA,kBACA,OACA,OACA,eACA,UACA,QACA,MACF,EAKA,SAAS,EAAY,EAAyB,CAC5C,GAAI,CAEF,OADA,gBAAgB,CAAK,EACd,EACT,MAAQ,CACN,MAAO,EACT,CACF,CAMA,SAAS,EAAuB,EAAmC,CACjE,IAAM,EAAY,EAA+C,SACjE,OAAO,EAAqB,GAAU,OAAO,CAC/C,CAMA,SAAS,EAAkB,EAAwB,CACjD,GAAI,CACF,OAAO,KAAK,UAAU,CAAK,GAAK,OAAO,CAAK,CAC9C,MAAQ,CACN,OAAO,OAAO,CAAK,CACrB,CACF,CAGA,SAAS,EAAiB,EAAyC,CACjE,IAAM,EAAiC,CAAC,EACxC,IAAK,IAAM,KAAO,EAAkB,CAClC,IAAM,EAAS,EAAmC,GAC9C,IAAU,IAAA,IAAa,EAAY,CAAK,IAC1C,EAAM,GAAO,EAEjB,CAGA,GAAI,CAAC,EAAyB,EAAM,UAAa,EAAG,CAClD,IAAM,EAAa,EAAuB,CAAM,EAC5C,IAAe,IAAA,KACjB,EAAM,WAAgB,EAE1B,CACA,OAAO,CACT,CAEA,SAAgB,EAAY,EAAgB,EAAgB,EAA4B,CACtF,GAAI,EAAY,CAAK,EACnB,OAAO,EAET,IAAM,EAAQ,GACZ,EAAQ,GAAK,IAAU,IAAA,GAAY,EAAY,EAAO,EAAQ,CAAC,EAAI,IAAA,GACrE,GAAI,aAAiB,MACnB,MAAO,CACL,UAAW,GACX,KAAM,EAAM,KACZ,QAAS,EAAM,QACf,MAAO,EAAM,MACb,MAAO,EAAiB,CAAK,EAC7B,MAAO,EAAK,EAAM,KAAK,CACzB,EAEF,GAAI,OAAO,GAAU,UAAY,EAAgB,CAG/C,GAAM,CAAE,UAAS,SAAU,EAC3B,MAAO,CACL,UAAW,GACX,KAAM,QACN,QAAS,OAAO,GAAY,SAAW,EAAU,EAAkB,CAAK,EACxE,MAAO,IAAA,GACP,MAAO,EAAiB,CAAK,EAC7B,MAAO,EAAK,CAAK,CACnB,CACF,CACA,MAAO,CACL,UAAW,GACX,KAAM,QACN,QAAS,OAAO,GAAU,SAAW,EAAQ,EAAkB,CAAK,EACpE,MAAO,IAAA,GACP,MAAO,CAAC,EACR,MAAO,IAAA,EACT,CACF,CAOA,SAAgB,EAAc,EAAwB,CACpD,IAAM,EAAY,MAAM,EAAK,QAAS,EAAK,MAAQ,CAAE,MAAO,EAAc,EAAK,KAAK,CAAE,EAAI,CAAC,CAAC,EAM5F,MALA,GAAM,KAAO,EAAK,KACd,EAAK,QAAU,IAAA,KACjB,EAAM,MAAQ,EAAK,OAErB,OAAO,OAAO,EAAO,EAAK,KAAK,EACxB,CACT,CChPA,SAAgB,IAA8B,CAI5C,OAAO,IAAI,OAAO,IAAI,IAAI,sBAAuB,OAAO,KAAK,GAAG,EAAG,CACjE,KAAM,SACN,KAAM,kBACR,CAAC,CACH,CCeA,MAAa,EAAyD,CACpE,MAAO,IACP,KAAM,GACR,EASM,EAAmB,IAAI,QAG7B,IAAM,EAAN,cAAqC,KAAM,CAEzC,QAEA,YAAY,EAAiB,EAAyD,CACpF,MAAM,EAAS,CAAO,EACtB,KAAK,KAAO,yBACZ,KAAK,QAAU,GAAS,SAAW,EACrC,CACF,EAOA,SAAS,GAAe,EAAyB,CAC/C,GAAI,OAAO,GAAU,WAAY,EAC/B,MAAO,GAET,GAAM,CAAE,OAAM,WAAY,EAC1B,OACE,IAAS,kBACR,IAAS,aACR,OAAO,GAAY,UACnB,EAAQ,SAAS,6BAA6B,CAEpD,CAEA,SAAS,EAAe,EAAuC,CAC7D,GAAI,GAAQ,QACV,MAAM,EAAO,QAAU,IAAI,aAAa,6BAA8B,YAAY,CAEtF,CAWA,MAAM,EAA2B,CAAE,MAAO,EAAG,KAAM,IAAA,GAAW,UAAW,EAAG,EAO5E,SAAS,GAAe,EAGtB,CACA,GAAI,IAAQ,IAAA,GACV,MAAO,CAAE,MAAK,UAAW,CAAC,CAAE,EAE9B,IAAM,EAAiB,EAAI,eAAe,MACpC,EAAW,EAAI,SAAS,MAC9B,GAAI,EAAE,aAA0B,aAAe,EAAE,aAAoB,YACnE,MAAO,CAAE,MAAK,UAAW,CAAC,CAAE,EAI9B,IAAM,EAAgB,EAAe,MAAM,EACrC,EAAU,EAAS,MAAM,EAC/B,MAAO,CACL,IAAK,CACH,GAAG,EACH,eAAgB,CAAE,GAAG,EAAI,eAAgB,MAAO,CAAc,EAC9D,SAAU,CAAE,GAAG,EAAI,SAAU,MAAO,CAAQ,CAC9C,EACA,UAAW,CAAC,EAAc,OAAuB,EAAQ,MAAqB,CAChF,CACF,CA4BA,SAAS,IAA2C,CAClD,IAAI,EACE,EAAS,IAAI,SAAgB,EAAU,IAAW,CACtD,EAAO,CACT,CAAC,EAID,OADA,EAAO,UAAY,CAAC,CAAC,EACd,CAAE,YAAa,IAAA,GAAW,OAAQ,IAAA,GAAW,IAAK,IAAA,GAAW,SAAQ,MAAK,CACnF,CAgCA,IAAa,GAAb,KAAkE,CAChE,GAEA,GAEA,GAAgB,GAChB,GAAyB,EAEzB,GAAY,EAEZ,GAA8B,IAAI,IAElC,GAEA,GAAU,EACV,GAAoB,GAEpB,YAAY,EAAmC,CAC7C,KAAKA,GAAU,CACjB,CAEA,SAA4B,CAI1B,IAAM,EAAc,KAAKE,KAAgB,GAAuB,EAChE,GAAI,EAAW,cAAgB,IAAA,GAAW,CAGxC,IAAM,EAAyB,KAAKC,OAAkB,KAAKC,GAAU,CAAU,CAAC,CAAC,CAAC,MAC/E,GAAmB,CAIlB,MAHI,EAAW,cAAgB,IAC7B,EAAW,YAAc,IAAA,IAErB,CACR,CACF,EACA,EAAW,YAAc,CAC3B,CACA,OAAO,EAAW,WACpB,EAEA,aAAuD,GACrD,KAAKD,OACH,KAAKE,GACF,GAAY,EAAQ,aAAa,CAAU,GAG3C,EAAK,EAAI,IAAY,EAAI,aAAa,EAAI,CAAE,GAAG,EAAY,SAAQ,CAAC,EACrE,EAAW,OACb,CACF,EAEF,cAAyD,GACvD,KAAKF,OACH,KAAKE,GACF,GAAY,EAAQ,cAAc,CAAU,GAC5C,EAAK,EAAI,IAAY,EAAI,cAAc,EAAI,CAAE,GAAG,EAAY,SAAQ,CAAC,EACtE,EAAW,OACb,CACF,EAYF,SAAgB,CACd,KAAKC,GAAoB,GACzB,KAAKC,GAAe,CACtB,CAQA,KAAMF,GACJ,EACA,EAKA,EACY,CACZ,GAAM,CAAE,SAAQ,aAAY,GAAG,GAAY,GAAe,CAAC,EAE3D,EAAe,CAAM,EACrB,MAAM,KAAK,KAAK,EAEhB,EAAe,CAAM,EACrB,IAAM,EAAa,KAAKH,GAClB,EAAM,GAAY,IAGxB,GAAI,KAAKM,KAAoB,IAAA,KAAc,KAAKC,IAAiB,IAAQ,IAAA,IACvE,OAAO,EAAO,MAAM,KAAKD,EAAe,EAE1C,GAAI,IAAe,IAAA,IAAa,IAAQ,IAAA,GACtC,OAAO,EACL,MAAM,KAAKE,GACT,EACA,KAAKC,GAAS,MAAQ,IAAI,EAAuB,6BAA6B,CAChF,CACF,EAEF,IAAM,EAAK,KAAKC,KACV,MAAgB,KAAK,EAAI,MAAM,CAAE,CAAC,CAAC,UAAY,CAAC,CAAC,EACvD,GAAQ,iBAAiB,QAAS,EAAS,CAAE,KAAM,EAAK,CAAC,EACrD,GACF,KAAKX,GAAmB,IAAI,EAAI,CAAgD,EAElF,GAAI,CACF,IAAM,EAAS,MAAM,KAAKY,GAAc,EAAY,EAAW,EAAK,EAAI,CAAO,CAAC,EAIhF,MADA,MAAKF,GAAW,EACT,CACT,OAAS,EAAO,CACd,GAAI,aAAiB,EACnB,OAAO,EAAO,MAAM,KAAKD,GAAS,EAAY,CAAK,CAAC,EAEtD,MAAM,CACR,QAAU,CACR,KAAKT,GAAmB,OAAO,CAAE,EACjC,GAAQ,oBAAoB,QAAS,CAAO,CAC9C,CACF,CAEA,KAAMG,GAAU,EAA6C,CAC3D,GAAI,KAAKK,GAEP,OAEF,IAAM,EAAgB,KAAKT,GAAQ,cACnC,GAAI,IAAkB,IAAA,GAAW,CAG/B,MAAM,KAAKU,GAAS,EAAY,IAAI,EAAuB,CAAa,CAAC,EACzE,MACF,CAIA,IAAM,EAAmB,MAAM,KAAKV,GAAQ,YAAY,EACxD,GAAI,CACF,IAAM,EAAM,MAAM,KAAKc,GAAO,CAAU,EAClC,EAAU,KAAKd,GAAQ,QACvB,EACJ,OAAO,GAAY,SACf,KACA,EAAM,KAAO,IAA+C,CAC1D,GAAI,CACF,OAAO,MAAM,EAAQ,QAAQ,CAAiD,CAChF,OAAS,EAAO,CAId,MAAM,EAAY,CAAK,CACzB,CACF,CAAC,EAGD,EAAM,GAAO,EAAmC,IAAoB,CACxE,GAAI,CACF,KAAKA,GAAQ,OAAO,EAAM,CAAC,CAAO,CACpC,OAAS,EAAO,CACd,KAAKe,GAAmB,SAAU,CAAK,CACzC,CACF,CAAC,EACK,EAAa,GAAO,EAAY,IAA6B,CACjE,GAAI,CACF,KAAKd,GAAmB,IAAI,CAAE,CAAC,GAAG,CAAK,CACzC,OAAS,EAAO,CACd,KAAKc,GAAmB,aAAc,CAAK,CAC7C,CACF,CAAC,EAIK,EAAU,GAAe,CAAgB,EAC/C,MAAM,KAAKF,GACT,EACA,EAAI,KACF,EACE,CACE,GAAG,KAAKb,GAAQ,YAChB,cAAe,CACb,GAAG,KAAKA,GAAQ,YAAY,cAC5B,iBAAkB,EAAQ,GAC5B,EACA,OAAQ,OAAO,GAAY,SAAW,EAAU,IAAA,EAClD,EACA,EAAQ,SACV,EACA,EACA,EACA,CACF,EACA,CAAE,GAAI,KAAKA,GAAQ,SAAS,KAAM,UAAW,MAAO,CACtD,EACA,EAAW,IAAM,EACjB,KAAKW,GAAW,CAAE,GAAG,KAAKA,GAAU,KAAM,IAAA,EAAU,CACtD,OAAS,EAAO,CAId,GAAI,EAAE,aAAiB,GAErB,MADA,KAAKK,GAAU,EAAY,IAAI,EAAuB,6BAA6B,CAAC,EAC9E,EAER,MAAM,KAAKN,GAAS,EAAY,CAAK,CACvC,CACF,CAGA,GAAmB,EAAkB,EAAsB,CACzD,IAAM,EAAS,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EACpE,GAAI,CACF,KAAKV,GAAQ,OAAO,KAAK,mBAAmB,EAAS,mBAAmB,GAAQ,CAClF,MAAQ,CAER,CACF,CAOA,KAAMG,GAAe,EAAoC,CACvD,KAAKc,KACL,GAAI,CACF,OAAO,MAAM,EAAK,CACpB,QAAU,CACR,KAAKA,KACL,KAAKV,GAAe,CACtB,CACF,CAEA,IAAuB,CACjB,CAAC,KAAKD,IAAqB,KAAKW,GAAU,IAG9C,KAAKX,GAAoB,GACzB,KAAKJ,IAAa,QAAQ,UAAU,EAGpC,KAAKA,GAAc,IAAA,GACnB,KAAKM,GAAkB,IAAA,GACvB,KAAKC,GAAgB,GACrB,KAAKE,GAAW,EAClB,CAEA,IAAwB,CACtB,IAAM,EAAS,KAAKX,GAAQ,aAC5B,GAAI,IAAW,IAAA,GACb,OAAO,GAAoB,EAE7B,GAAI,OAAO,GAAW,WAAY,CAChC,IAAM,EAAS,EAAO,EAStB,OANI,EAAiB,IAAI,CAAM,GAC7B,KAAKA,GAAQ,OAAO,WAClB,6GACF,EAEF,EAAiB,IAAI,CAAM,EACpB,CACT,CACA,OAAO,IAAI,OAAO,EAAQ,CAAE,KAAM,SAAU,KAAM,kBAAmB,CAAC,CACxE,CAGA,KAAMc,GAAO,EAAiE,CAC5E,IAAI,EACJ,GAAI,CACF,EAAS,KAAKI,GAAc,CAC9B,OAAS,EAAO,CAGd,MAAM,IAAI,EAAuB,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EAAG,CACvF,MAAO,CACT,CAAC,CACH,CACA,EAAW,OAAS,EACpB,IAAM,EAAM,MAAM,KAAKC,GAAW,EAAY,CAAM,EAEpD,OADA,KAAKC,GAAiB,EAAY,CAAM,EACjC,CACT,CAGA,GAAW,EAA8B,EAAmD,CAC1F,OAAO,IAAI,SAAmC,EAAS,IAAW,CAChE,IAAM,MAAe,CACnB,aAAa,CAAK,EAClB,EAAO,oBAAoB,UAAW,CAAO,EAC7C,EAAO,oBAAoB,QAAS,CAAO,CAC7C,EACM,EAAQ,eAAiB,CAC7B,EAAO,EACP,EACE,IAAI,EACF,uCAAuC,KAAKpB,GAAQ,SAAS,MAAM,IACrE,CACF,CACF,EAAG,KAAKA,GAAQ,SAAS,KAAK,EACxB,EAAW,GAAwB,CACnC,EAAM,OAAA,8BACR,EAAO,EACP,EAAQ,EAAuB,CAAM,CAAC,EAE1C,EACM,EAAW,GAAsB,CACrC,EAAO,EACP,IAAM,EAAU,EAAM,SAAW,wBAGjC,EAAO,IAAI,EAAuB,CAAO,CAAC,EAC1C,KAAKgB,GAAU,EAAY,IAAI,EAAuB,CAAO,CAAC,CAChE,EACA,EAAO,iBAAiB,UAAW,CAAO,EAC1C,EAAO,iBAAiB,QAAS,CAAO,CAC1C,CAAC,CACH,CAGA,GAAiB,EAA8B,EAAsB,CACnE,EAAO,iBAAiB,QAAU,GAAsB,CAGtD,GAAI,KAAKd,KAAgB,EACvB,OAKF,IAAM,EAAQ,IAAI,EAAuB,EAAM,SAAW,wBAAyB,CACjF,QAAS,EACX,CAAC,EACD,KAAKS,GAAW,CAAE,GAAG,KAAKA,GAAU,MAAO,KAAKA,GAAS,MAAQ,EAAG,KAAM,CAAM,EAChF,KAAKK,GAAU,EAAY,CAAK,CAClC,CAAC,CACH,CAUA,KAAMH,GACJ,EACA,EACA,EACY,CACZ,IAAM,EACJ,IAAa,IAAA,GACT,IAAA,GACA,eAAiB,CACf,KAAKG,GACH,EACA,IAAI,EACF,kBAAkB,EAAS,UAAU,mBAAmB,EAAS,GAAG,IACtE,CACF,CACF,EAAG,EAAS,EAAE,EACpB,GAAI,CACF,OAAO,MAAM,QAAQ,KAAK,CACxB,EAAK,MAAO,GAAmB,CAC7B,IAAM,EAAU,EAAY,CAAK,EAAI,EAAc,CAAK,EAAK,EAG7D,MAAM,GAAe,CAAO,EACxB,IAAI,EAAuB,EAAQ,QAAS,CAAE,MAAO,CAAQ,CAAC,EAC9D,CACN,CAAC,EACD,EAAW,MACb,CAAC,CACH,QAAU,CACJ,IAAU,IAAA,IACZ,aAAa,CAAK,CAEtB,CACF,CAQA,GAAU,EAA0C,EAAqC,CACnF,IAAe,IAAA,KAGf,KAAKd,KAAgB,IACvB,KAAKA,GAAc,IAAA,IAErB,EAAW,QAAQ,UAAU,EAC7B,EAAW,OAAS,IAAA,GACpB,EAAW,IAAM,IAAA,GACjB,EAAW,YAAc,IAAA,GACzB,EAAW,KAAK,CAAK,EACvB,CAEA,KAAMQ,GACJ,EACA,EACgC,CAChC,IAAM,EAAS,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,EACpE,GAAI,KAAKV,GAAQ,OAEf,MADA,KAAKgB,GAAU,EAAY,IAAI,EAAuB,6BAA6B,CAAC,EAC9E,IAAI,EACR,oEAAoE,IACpE,CAAE,OAAM,CACV,EAEF,GAAM,CAAE,YAAW,WAAY,KAAKK,GAAiB,CAAK,EAI1D,GAHA,KAAKZ,KAAkB,CAAC,EACxB,KAAKO,GAAU,EAAY,IAAI,EAAuB,oCAAoC,CAAC,EAC3F,KAAKM,GAAc,EAAQ,EAAW,CAAO,EACzC,KAAKd,KAAoB,IAAA,GAAW,CAGtC,IAAM,GAA2C,SAAY,CAC3D,IAAM,EAAS,KAAKR,GAAQ,mBAAmB,EAE/C,OADA,MAAM,EAAO,KAAK,EACX,CACT,EAAA,CAAG,CAAC,CAAC,MAAO,GAAmB,CAO7B,MANI,KAAKQ,KAAoB,IAC3B,KAAKA,GAAkB,IAAA,IAEzB,KAAKR,GAAQ,OAAO,WAClB,iDAAiD,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,GACxG,EACM,CACR,CAAC,EACD,KAAKQ,GAAkB,CACzB,CACA,OAAO,KAAKA,EACd,CAQA,GAAiB,EAA4E,CAC3F,IAAM,EACJ,aAAiB,GACjB,EAAM,SACN,KAAKG,GAAS,MAAQ,EACxB,MAAO,CAAE,YAAW,QAAS,CAAC,GAAa,CAAC,KAAKF,EAAc,CACjE,CAGA,GAAc,EAAgB,EAAoB,EAAwB,CACxE,GAAI,CAAC,GAAW,KAAKE,GAAS,YAAc,KAAKA,GAAS,MACxD,OAEF,KAAKA,GAAW,CAAE,GAAG,KAAKA,GAAU,UAAW,KAAKA,GAAS,KAAM,EACnE,IAAM,EAAQ,EAAY,kCAAoC,wBAG9D,KAAKX,GAAQ,OAAO,WAClB,gCAAmC,EAAM,0BAA0B,GACrE,CACF,CACF,EClkBa,GAAb,KAAgD,CAC9C,GACA,GACA,GACA,GACA,GACA,GACA,GAOA,YAAY,EAA4B,CACtC,KAAKuB,GAAS,EAAO,MACrB,GAAM,CAAE,UAAS,QAAO,gBAAe,iBAAgB,oBACrD,EAAO,SAAW,CAAC,EACf,EAAO,KAAKA,GAAO,KAAO,GAAY,KAAKA,GAAO,IAAI,EAAI,IAAA,GAK1D,EAAS,CACb,aAAc,EAAmB,CAAE,UAJnC,OAAO,KAAKA,GAAO,SAAY,SAC3B,EAAK,KAAKA,GAAO,OAAO,EACxB,EAAO,KAAKA,GAAO,OAAO,CAEe,CAAC,EAC9C,MAAO,EAAa,KAAKA,EAAM,EAC/B,QAAS,CAAE,gBAAe,iBAAgB,kBAAiB,CAC7D,EACA,KAAKI,GAAkB,CACrB,GAAI,IAAS,IAAA,IAAa,CAAE,MAAK,EACjC,GAAI,IAAY,IAAA,IAAa,CAAE,SAAQ,EACvC,GAAI,IAAU,IAAA,IAAa,CAAE,OAAM,CACrC,EACA,KAAKC,GAAa,EAAO,UAIzB,IAAM,MACJ,KAAKJ,GAAM,2BAA2B,CAAE,QAAS,KAAKK,GAAgB,IAAA,EAAS,CAAE,CAAC,EAG9E,EAAkB,IAAsD,CAC5E,KAAM,SAAY,CAChB,MAAM,EAAY,EAClB,MAAM,EAAO,KAAK,CACpB,EACA,aAAe,GAAe,EAAO,aAAa,CAAU,EAC5D,cAAgB,GAAe,EAAO,cAAc,CAAU,EAC9D,2BAA6B,GAAe,EAAO,2BAA2B,CAAU,CAC1F,GACI,EAAO,WACT,KAAKL,GAAQ,GAA+B,CAAM,EAClD,KAAKC,GAAW,GAAkC,CAAM,EACxD,KAAKC,GAAW,EAAe,EAAkC,CAAM,CAAC,IAExE,KAAKF,GAAQ,GAAsB,CAAM,EACzC,KAAKC,GAAW,GAAyB,CAAM,EAC/C,KAAKC,GAAW,KAAKI,GAAqB,EAAQ,EAAQ,CACxD,cACA,uBAA0B,EAAe,EAAyB,CAAM,CAAC,CAC3E,CAAC,EAEL,CAMA,GACE,EACA,EACA,EAIqB,CACrB,IAAM,EAAU,EAAO,gBAAkB,GACnC,EAAS,IAAY,GACrB,EACJ,OAAO,QAAW,aACjB,EAAO,gBAAkB,IAAA,IAAA,IAK5B,GAAI,IAAY,IAAS,EAAE,GAAU,GACnC,OAAO,EAAO,mBAAmB,EAEnC,IAAM,EAAU,EAAsB,EAChC,EAAU,GAAsB,CAAO,EAC7C,GAAI,IAAY,IAAA,IAAa,CAAC,EAI5B,OADA,EAAO,OAAO,WAAW,0CAA0C,EAAQ,EAAE,EACtE,EAAO,mBAAmB,EAEnC,IAAM,EAAe,IAAI,GAAoB,CAC3C,YAAa,CAAE,MAAO,EAAO,MAAO,cAAe,EAAO,QAAS,QAAS,GAAW,CAAC,CAAE,EAC1F,QAAS,KAAKP,GAAO,QACrB,YAAa,EAAO,YACpB,mBAAoB,EAAO,mBAC3B,OAAQ,EAAO,OACf,SAAU,EAAO,iBAAmB,EACpC,aAAc,EAAO,cAGrB,cAAe,EACf,QACF,CAAC,EACD,MAAO,CACL,SAAY,EAAa,KAAK,EAC9B,aAAe,GAAe,EAAa,aAAa,CAAU,EAClE,cAAgB,GAAe,EAAa,cAAc,CAAU,EAIpE,2BAA6B,GAAe,KAAKC,GAAM,2BAA2B,CAAU,EAC5F,YAAe,EAAa,QAAQ,CACtC,CACF,CAGA,IAAI,OAAQ,CACV,OAAO,KAAKD,EACd,CAGA,GACE,EACkE,CAClE,GAAM,CAAE,YAAW,GAAG,GAAW,CAC/B,GAAG,KAAKI,GACR,GAAG,CACL,EAIA,OAHI,KAAKC,KAAe,IAAA,GACf,EAEF,CACL,GAAG,EACH,QAAS,CAAE,GAAG,EAAO,QAAS,GAAG,EAAiB,KAAKA,GAAY,CAAS,CAAE,CAChF,CACF,CAIA,QACE,KAAKG,KAAwB,KAAKL,GAAS,KAAK,CAAC,CAAC,MAAO,GAAmB,CAE1E,KADA,MAAKK,GAAsB,IAAA,GACrB,CACR,CAAC,EACM,KAAKA,IAOd,YAAsB,CACpB,KAAKA,GAAsB,IAAA,GAC3B,KAAKL,GAAS,UAAU,CAC1B,EAcA,mBAAwD,KAAO,KAC7D,MAAM,KAAKF,GAAM,KAAK,EACf,KAAKA,GAAM,mBAAmB,CACnC,GAAG,EACH,QAAS,KAAKK,GAAgB,EAAW,OAAO,CAClD,CAAC,GAeH,oBAA0D,KAAO,KAC/D,MAAM,KAAKL,GAAM,KAAK,EACf,KAAKA,GAAM,oBAAoB,CACpC,GAAG,EACH,QAAS,KAAKK,GAAgB,EAAW,OAAO,CAClD,CAAC,GAeH,kCAAsF,KACpF,KAEA,MAAM,KAAKL,GAAM,KAAK,EACf,KAAKA,GAAM,kCAAkC,CAClD,GAAG,EACH,QAAS,KAAKK,GAAgB,EAAW,OAAO,CAClD,CAAC,GAkBH,aAA4C,KAAO,KACjD,MAAM,KAAKG,GAAa,EACjB,KAAKN,GAAS,aAAa,CAChC,GAAG,EACH,QAAS,KAAKG,GAAgB,EAAW,OAAO,CAClD,CAAC,GAoBH,cAA8C,KAAO,KACnD,MAAM,KAAKG,GAAa,EACjB,KAAKN,GAAS,cAAc,CACjC,GAAG,EACH,QAAS,KAAKG,GAAgB,EAAW,OAAO,CAClD,CAAC,GAoBH,aAA4C,KAAO,KACjD,MAAM,KAAKJ,GAAS,KAAK,EAClB,KAAKA,GAAS,aAAa,CAChC,GAAG,EACH,QAAS,KAAKI,GAAgB,EAAW,OAAO,CAClD,CAAC,GAkBH,cAA8C,KAAO,KACnD,MAAM,KAAKJ,GAAS,KAAK,EAClB,KAAKA,GAAS,cAAc,CACjC,GAAG,EACH,QAAS,KAAKI,GAAgB,EAAW,OAAO,CAClD,CAAC,GAoBH,uBAAgE,KAAO,KACrE,MAAM,KAAKJ,GAAS,KAAK,EAClB,KAAKA,GAAS,uBAAuB,CAC1C,GAAG,EACH,QAAS,KAAKI,GAAgB,EAAW,OAAO,CAClD,CAAC,GAcH,2BAAwE,KAAO,KAI7E,MAAM,KAAKL,GAAM,KAAK,EACf,KAAKA,GAAM,2BAA2B,CAC3C,GAAG,EACH,QAAS,KAAKK,GAAgB,GAAY,OAAO,CACnD,CAAC,GAwBH,qBAA4D,KAAO,KACjE,MAAM,KAAKL,GAAM,KAAK,EACf,KAAKA,GAAM,qBAAqB,CAAU,GAuBnD,2CACG,GAAeS,EAAiD,KAAKT,GAAO,CAAU,EAkBzF,0BAAuE,GACrE,KAAKC,GAAS,0BAA0B,CAAU,EAapD,gCAAmF,GACjF,KAAKD,GAAM,gCAAgC,CAAU,EAcvD,sBAA8D,KAAO,KACnE,MAAM,KAAKC,GAAS,KAAK,EAClB,KAAKA,GAAS,sBAAsB,CAAU,GAmBvD,4BAA0E,KAAO,IAAe,CAC9F,MAAM,KAAKD,GAAM,KAAK,EACtB,GAAM,CAAE,oBAAqB,EAC7B,OAAO,KAAKA,GAAM,4BAA4B,CAC5C,GAAG,EACH,iBAAkB,CAChB,GAAG,EACH,UAAW,GAAoB,EAAiB,SAAS,CAC3D,CACF,CAAC,CACH,EAaA,yBAAoE,UAClE,MAAM,KAAKC,GAAS,KAAK,EAClB,KAAKA,GAAS,yBAAyB,EAElD,EAOA,SAAS,GAAoB,EAA2B,CACtD,GAAI,EAAU,SAAW,IACvB,OAAO,EAET,IAAM,EAAI,SAAS,EAAU,MAAM,GAAG,EAAG,EAAE,EAI3C,OAHI,IAAM,GAAK,IAAM,EACZ,EAEF,GAAG,EAAU,MAAM,EAAG,GAAG,IAAI,IAAM,EAAI,KAAO,MACvD,CAMA,SAAS,GAAsB,EAA4D,CAGzF,GAAI,EAAqB,EACvB,MAAO,gEAIT,GAAI,IAAY,IAAA,IAAa,EAAsB,EACjD,MAAO,4FAGX,CAQA,SAAS,GACP,EAC0C,CAC1C,IAAM,EAAO,EAAK,OAClB,OAAQ,EAAR,CACE,IAAK,eACH,MAAO,CAAE,OAAM,MAAO,EAAK,MAAO,OAAQ,EAAK,MAAO,EACxD,IAAK,eACH,MAAO,CAAE,OAAM,MAAO,EAAK,MAAO,OAAQ,EAAK,MAAO,EACxD,IAAK,cACH,MAAO,CAAE,OAAM,MAAO,EAAK,KAAM,EACnC,QACE,MAAM,IAAI,EAAmB,sBAAsB,OAAO,CAAI,GAAG,CACrE,CACF"}

package/dist/esm/{index-BKMce5ya.d.ts → index-BlY7CCPB.d.ts}

@@ -1,9 +1,9 @@
-import { p as FheChain } from "./index-Cdbp_93f.js";
-import { i as ZamaConfig, o as ZamaConfigGeneric } from "./types-BIgPY1yI.js";
-import "./cleartext-DInZ0vz-.js";
-import "./types-Bz42Emet.js";
-import "./types-I9lJwH20.js";
-import "./index-CpQK8U4F.js";
+import { f as FheChain } from "./index-D1Wtji3m.js";
+import { i as ZamaConfig, o as ZamaConfigGeneric } from "./types-CHepK8MK.js";
+import "./cleartext-BnTAN4-g.js";
+import "./types-C2ccCjoA.js";
+import "./types-Dc1fpXWt.js";
+import "./index-CD2sMpst.js";
 //#region src/config/create.d.ts
 /**
  * Create a {@link ZamaConfig} from a custom {@link GenericSigner} and
@@ -31,4 +31,4 @@ import "./index-CpQK8U4F.js";
 declare function createConfig<const TChains extends readonly [FheChain, ...FheChain[]]>(params: ZamaConfigGeneric<TChains>): ZamaConfig;
 //#endregion
 export { createConfig as t };
-//# sourceMappingURL=index-BKMce5ya.d.ts.map
+//# sourceMappingURL=index-BlY7CCPB.d.ts.map

package/dist/esm/{index-CpQK8U4F.d.ts → index-CD2sMpst.d.ts}

@@ -1,4 +1,4 @@
-import { D as GenericSigner, O as WalletAccount, S as TransactionKind, St as WrapOptions, Tt as UnshieldCallbacks, _ as PrepareTransactionRequest, _t as ShieldOptions, bt as UnshieldOptions, c as GenericStorage, cn as EncryptedValue, en as TransactionResult, g as PrepareOptions, hn as RelayerSDK, i as ZamaConfig, l as GenericProvider, mn as RelayerRequestOptions, nn as DecryptPublicValuesResult, on as EncryptParams, sn as EncryptResult, tn as ClearValue, v as PreparedFor, wt as TransferCallbacks, xt as UnwrapResult, yt as TransferOptions } from "./types-BIgPY1yI.js";
+import { D as GenericSigner, O as WalletAccount, S as TransactionKind, St as WrapOptions, Tt as UnshieldCallbacks, _ as PrepareTransactionRequest, _t as ShieldOptions, bt as UnshieldOptions, c as GenericStorage, cn as EncryptedValue, en as TransactionResult, g as PrepareOptions, hn as RelayerSDK, i as ZamaConfig, l as GenericProvider, mn as RelayerRequestOptions, nn as DecryptPublicValuesResult, on as EncryptParams, sn as EncryptResult, tn as ClearValue, v as PreparedFor, wt as TransferCallbacks, xt as UnwrapResult, yt as TransferOptions } from "./types-CHepK8MK.js";
 import { Address, Hex } from "viem";
 import { z } from "zod/mini";
 import { MutationFunctionContext, QueryKey, QueryObserverOptions, skipToken } from "@tanstack/query-core";
@@ -22055,4 +22055,4 @@ declare class Decryption {
 }
 //#endregion
 export { DelegationCooldownError as $, decimalsContract as $t, TransactionRevertedError as A, TokenWrapperPair as At, ConfigurationError as B, getDelegationExpiryContract as Bt, Delegations as C, PreparedPermit as Ct, matchZamaError as D, SignedPreparedPermit as Dt, ErrorForCode as E, SerializedTransportKeyPair as Et, SignerRequiredError as F, getTokenPairsContract as Ft, InsufficientAllowanceError as G, ERC7984_INTERFACE_ID as Gt, BalanceCheckUnavailableError as H, revokeDelegationContract as Ht, WalletAccountNotReadyError as I, getTokenPairsLengthContract as It, DecryptionFailedError as J, isConfidentialWrapperContract as Jt, InsufficientConfidentialBalanceError as K, ERC7984_WRAPPER_INTERFACE_ID as Kt, WalletNotConnectedError as L, getTokenPairsSliceContract as Lt, SigningFailedError as M, getConfidentialTokenAddressContract as Mt, SigningRejectedError as N, getTokenAddressContract as Nt, UnshieldAlreadyFinalizedDetails as O, ChecksummedAddress as Ot, SignerNotConfiguredError as P, getTokenPairContract as Pt, DelegationContractIsSelfError as Q, balanceOfContract as Qt, RpcRateLimitError as R, isConfidentialTokenValidContract as Rt, Offline as S, PreparePermitRequest as St, Permits as T, SerializedPermitEip712 as Tt, BalanceErrorDetails as U, transferAndCallContract as Ut, RelayerRequestFailedError as V, isHandleDelegatedContract as Vt, ERC20ReadFailedError as W, ERC1363_INTERFACE_ID as Wt, EncryptionFailedError as X, allowanceContract as Xt, EncryptOffloadUnavailableError as Y, supportsInterfaceContract as Yt, AclPausedError as Z, approveContract as Zt, WrappersRegistryConfig as _, ZamaError as _t, DecryptResult as a, confidentialTransferFromContract as an, DelegationNotFoundError as at, BatchDecryptAsOptions as b, retryAfterSeconds as bt, SignerQueryContext as c, isOperatorContract as cn, InvalidTransportKeyPairError as ct, QueryFactoryOptions as d, underlyingContract as dn, PreparedPermitChainMismatchError as dt, nameContract as en, DelegationDelegateCannotBeWildcardError as et, ZamaSDK as f, unwrapContract as fn, PreparedPermitExpiredError as ft, WrappersRegistry as g, ChainMismatchError as gt, ListPairsOptions as h, wrapContract as hn, TransportKeyPairExpiredError as ht, DelegatedDecryptOptions as i, confidentialTransferContract as in, DelegationExpiryUnchangedError as it, SigningErrorMetadata as j, TokenWrapperPairWithMetadata as jt, UnshieldAlreadyFinalizedError as k, PaginatedResult as kt, zamaQueryKeys as l, rateContract as ln, KeyWrappingError as lt, DefaultRegistryAddresses as m, unwrapRequesterContract as mn, TransportKeyPairChangedError as mt, BatchDecryptItem as n, confidentialBalanceOfContract as nn, DelegationExpirationTooSoonError as nt, EncryptedInput as o, finalizeUnwrapContract as on, DelegationNotPropagatedError as ot, ZamaSDKOptions as p, unwrapFromBalanceContract as pn, RevokedKmsContextError as pt, InsufficientERC20BalanceError as q, isConfidentialTokenContract as qt, BatchDecryptResult as r, confidentialTotalSupplyContract as rn, DelegationExpiredError as rt, decryptValuesQueryOptions as s, inferredTotalSupplyContract as sn, DelegationSelfNotAllowedError as st, Decryption as t, symbolContract as tn, DelegationDelegateEqualsContractError as tt, MutationFactoryOptions as u, setOperatorContract as un, NoCiphertextError as ut, WrappedToken as v, ZamaErrorCode as vt, DelegationStatus as w, SerializedPermit as wt, Token as x, Permission as xt, BatchBalancesResult as y, isRetryable as yt, NotEntitledError as z, delegateForUserDecryptionContract as zt };
-//# sourceMappingURL=index-CpQK8U4F.d.ts.map
+//# sourceMappingURL=index-CD2sMpst.d.ts.map

package/dist/esm/{index-Cdbp_93f.d.ts → index-D1Wtji3m.d.ts}

@@ -15,11 +15,8 @@ type FheChainAuth = {
 };
 /**
  * Complete chain configuration — the single source of truth for
- * per-chain FHE contract addresses and network settings.
- *
- * All built-in presets (`mainnet`, `polygon`, `sepolia`, `polygonAmoy`, `hoodi`,
- * `ingenTestnet`, `zenithTrexTestnet`, `bscTestnet`, `hardhat`) are `FheChain`
- * objects exported from `@zama-fhe/sdk/chains`.
+ * per-chain FHE contract addresses and network settings. The built-in presets
+ * exported from `@zama-fhe/sdk/chains` are `FheChain` objects.
  */
 interface FheChain<TId extends number = number> {
   /** EVM chain ID of the host chain. */
@@ -141,25 +138,6 @@ declare const hoodi: {
   readonly registryAddress: "0x1807aE2f693F8530DFB126D0eF98F2F2518F292f";
   readonly executorAddress: "0xC316692627de536368d82e9121F1D44a550894E6";
 };
-/**
- * T-Rex InGen testnet configuration (chainId 364301).
- *
- * InGen does not have full FHE infrastructure — use with `cleartext()` transport.
- * Contract addresses match the cleartext deployment.
- */
-declare const ingenTestnet: {
-  readonly id: 364301;
-  readonly gatewayChainId: 10901;
-  readonly relayerUrl: "";
-  readonly network: "https://rpc.ingen.t-rex.network";
-  readonly aclContractAddress: "0x09a4710BfBe7B557cD5CFE88BB31e9b5b85C419b";
-  readonly kmsContractAddress: "0xd885DEa6a924785fCcdf9CE993FEe27EA11832e6";
-  readonly inputVerifierContractAddress: "0x90f05B10db153365D8cB143EA17f5E5714D0bCD5";
-  readonly verifyingContractAddressDecryption: "0x5ffdaAB0373E62E2ea2944776209aEf29E631A64";
-  readonly verifyingContractAddressInputVerification: "0x812b06e1CDCE800494b79fFE4f925A504a9A9810";
-  readonly registryAddress: "0x7FC3D79EF9d01fA318CF2Aa5D91dDC492383Be0F";
-  readonly executorAddress: "0x1B05DE5b67b8f8363DC04E3a5996a616f11f8C7B";
-};
 /**
  * T-Rex Zenith testnet configuration (chainId 936486).
  *
@@ -236,5 +214,5 @@ declare const anvil: {
  */
 declare const chains: Record<number, FheChain>;
 //#endregion
-export { hoodi as a, polygon as c, zenithTrexTestnet as d, AtLeastOneChain as f, hardhat as i, polygonAmoy as l, FheChainAuth as m, bscTestnet as n, ingenTestnet as o, FheChain as p, chains as r, mainnet as s, anvil as t, sepolia as u };
-//# sourceMappingURL=index-Cdbp_93f.d.ts.map
+export { hoodi as a, polygonAmoy as c, AtLeastOneChain as d, FheChain as f, hardhat as i, sepolia as l, bscTestnet as n, mainnet as o, FheChainAuth as p, chains as r, polygon as s, anvil as t, zenithTrexTestnet as u };
+//# sourceMappingURL=index-D1Wtji3m.d.ts.map

package/dist/esm/{index-C1clixw5.d.ts → index-fsWBYM8S.d.ts}

@@ -1,6 +1,6 @@
-import "./index-Cdbp_93f.js";
-import { c as GenericStorage, n as RelayerConfig, pn as RelayerOptions } from "./types-BIgPY1yI.js";
-import "./cleartext-DInZ0vz-.js";
+import "./index-D1Wtji3m.js";
+import { c as GenericStorage, n as RelayerConfig, pn as RelayerOptions } from "./types-CHepK8MK.js";
+import "./cleartext-BnTAN4-g.js";
 //#region src/node/config.d.ts
 /** Node transport — drives the FHE backend directly on the calling thread. */
 interface NodeRelayerConfig extends RelayerConfig {
@@ -61,4 +61,4 @@ declare class AsyncLocalMapStorage implements GenericStorage {
 declare const asyncLocalStorage: AsyncLocalMapStorage;
 //#endregion
 export { node as i, asyncLocalStorage as n, NodeRelayerConfig as r, AsyncLocalMapStorage as t };
-//# sourceMappingURL=index-C1clixw5.d.ts.map
+//# sourceMappingURL=index-fsWBYM8S.d.ts.map