@zama-fhe/sdk 4.0.0-alpha.1 → 4.0.0-alpha.2

package/dist/cjs/base-signer.cjs

@@ -1,2 +1,2 @@
-const e=require("./relayer.cjs"),t=require("./wrappers-registry.cjs"),n=require("./applied-runtime.cjs"),r=require("./validation.cjs"),i=require("./chains.cjs");let a=require("viem"),o=require("@fhevm/sdk/viem"),s=require("zod/mini");var c=class{#e=null;#t=null;#n;#r;#i;constructor(e=`CredentialStore`,t=1,n=`credentials`){this.#n=e,this.#r=t,this.#i=n}#a(){return this.#e?Promise.resolve(this.#e):(this.#t||=new Promise((e,t)=>{let n=indexedDB.open(this.#n,this.#r);n.onupgradeneeded=()=>{let e=n.result;e.objectStoreNames.contains(this.#i)||e.createObjectStore(this.#i,{keyPath:`key`})},n.onsuccess=()=>{this.#e=n.result,this.#t=null,this.#e.onversionchange=()=>{this.#e?.close(),this.#e=null,this.#t=null},this.#e.onclose=()=>{this.#e=null,this.#t=null},e(this.#e)},n.onerror=()=>{this.#e=null,this.#t=null,t(n.error)}}),this.#t)}async#o(e,t){let n=await this.#a();return new Promise((r,i)=>{let a=n.transaction(this.#i,e);a.onabort=()=>i(a.error??Error(`Transaction aborted`));let o=t(a.objectStore(this.#i));e===`readonly`?o.onsuccess=()=>r(o.result):a.oncomplete=()=>r(o.result),o.onerror=()=>i(o.error)})}async get(e){return(await this.#o(`readonly`,t=>t.get(e)))?.value??null}async set(e,t){await this.#o(`readwrite`,n=>n.put({key:e,value:t}))}async delete(e){await this.#o(`readwrite`,t=>t.delete(e))}async clear(){await this.#o(`readwrite`,e=>e.clear())}};const l=new c;var u=class{#e=new Map;async get(e){return this.#e.get(e)??null}async set(e,t){this.#e.set(e,t)}async delete(e){this.#e.delete(e)}};const d=new u;function f(){return typeof window<`u`?new c(`CredentialStore`):new u}function p(e=f(),t=e){return{storage:e,permitStorage:t}}function m(t,n,r){let i=t.map(e=>e.id),a=[...new Set(i.filter((e,t)=>i.indexOf(e)!==t))];if(a.length>0)throw new e.t(`Duplicate chain id(s) [${a.join(`, `)}] in the chains array. Each chain id must appear only once. Note: hardhat and anvil are aliases (both use 31337).`);let o=Object.keys(n).map(Number).filter(e=>!i.includes(e));o.length>0&&r.warn(`Relayer entries for chain(s) [${o.join(`, `)}] are ignored: those chains are not in the chains array. Add the chain config to use them, or drop the relayer entries.`);let s=new Map;for(let r of t){let t=n[r.id];if(!t)throw new e.t(`Chain ${r.id} has no relayer configured. Add a relayer entry: relayers: { [${r.id}]: web() }`);s.set(r.id,{chain:r,relayerConfig:t})}return s}var h=class{#e;#t;#n;constructor(t,n,r){if(t.length===0)throw new e.t(`At least one chain is required.`);this.#e=new Map(t.map(e=>[e.id,e])),this.#n=t[0].id;let i=new Map;for(let[e,{relayerConfig:a,chain:o}]of m(t,n,r))i.set(e,a.createRelayer(o,r));this.#t=i}get chains(){return[...this.#e.values()]}get chain(){let t=this.#e.get(this.#n);if(t===void 0)throw new e.t(`Chain ${this.#n} is not configured. Add it to the chains array.`);return t}switchChain(e){this.#n=e}dispose(){for(let e of new Set(this.#t.values()))e.dispose?.()}get relayer(){let t=this.#t.get(this.chain.id);if(t===void 0)throw new e.t(`No relayer configured for chain ${this.#n}. Add it to the relayers object.`);return t}};const g={version:1,info:`zama-sdk-keypair-wrapping-v1`,ivLengthBytes:12,tagLengthBytes:16};function _(e){return new Uint8Array(e)}function v(e){return _(new TextEncoder().encode(JSON.stringify([e.publicKey,e.createdAt,e.expiresAt,e.tkmsVersion??null])))}function ee(e){return typeof e==`string`?new TextEncoder().encode(e):_(e)}var te=class{#e;#t;constructor(e){this.#e=e}async baseKey(){return this.#t??=this.#n(this.#e),this.#t}async#n(e){let t=ee(e),n=await crypto.subtle.importKey(`raw`,t,`HKDF`,!1,[`deriveKey`]);return t.fill(0),e instanceof Uint8Array&&e.fill(0),this.#e=void 0,n}};async function y(e,t){let n=await e.baseKey();return crypto.subtle.deriveKey({name:`HKDF`,hash:`SHA-256`,salt:new TextEncoder().encode(t),info:new TextEncoder().encode(g.info)},n,{name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}async function ne(e,t,n,r){let i=await y(t,n),o=crypto.getRandomValues(new Uint8Array(g.ivLengthBytes)),s=await crypto.subtle.encrypt({name:`AES-GCM`,iv:o,additionalData:v(r)},i,_((0,a.toBytes)(e)));return{wrappedPrivateKey:(0,a.toHex)(new Uint8Array(s)),iv:(0,a.toHex)(o)}}async function b(e,t,n,r){let i=await y(t,n),o=await crypto.subtle.decrypt({name:`AES-GCM`,iv:_((0,a.toBytes)(e.iv)),additionalData:v(r)},i,_((0,a.toBytes)(e.wrappedPrivateKey)));return(0,a.toHex)(new Uint8Array(o))}function x(e){return typeof e==`object`&&!!e&&`name`in e&&e.name===`OperationError`}const S=`transportKeyPairTTL must be a positive integer number of seconds`,C=`permitTTL must be a positive integer number of days`,w=`transportKeyPairScope must be a non-empty string`,T=`transportKeyPairDerivationSecret must be a Uint8Array of at least 32 bytes or a string of at least 64 characters (256 bits of entropy): source it from a CSPRNG or secrets manager, not a human-memorable passphrase`,E=365*t.R,re=s.z.int({error:S}).check(s.z.positive({error:S}),s.z.maximum(E,`transportKeyPairTTL must not exceed the fhevm ACL maximum of ${E}s (365 days)`)),D=s.z.int({error:C}).check(s.z.positive({error:C}),s.z.maximum(365,`permitTTL must not exceed the V1 permit maximum of 365 days`)),ie=s.z.string({error:w}).check(s.z.minLength(1,w)),ae=s.z.union([s.z.string({error:T}).check(s.z.minLength(64,T)),s.z.instanceof(Uint8Array,{error:T}).check(s.z.refine(e=>e.byteLength>=32,{error:T}))],{error:T}),O=s.z.object({publicKey:t.K,privateKey:t.K,createdAt:t.X,expiresAt:t.Y,tkmsVersion:s.z.optional(s.z.string())}),k=s.z.object({domain:s.z.record(s.z.string(),s.z.unknown()),primaryType:s.z.optional(s.z.string()),types:s.z.record(s.z.string(),s.z.array(s.z.object({name:s.z.string(),type:s.z.string()}))),message:s.z.record(s.z.string(),s.z.unknown())}),A=s.z.object({version:s.z.int().check(s.z.positive()),eip712:k,signature:t.K,signerAddress:t.G,delegatorAddress:s.z.optional(t.G)}),j={keypairPublicKey:t.K,contractAddresses:s.z.array(t.G).check(s.z.maxLength(10)),serializedPermit:A,startTimestamp:t.X},oe=s.z.object({...j,version:s.z.literal(1),durationDays:t.J}),se=s.z.object({...j,version:s.z.literal(2),durationSeconds:t.Y}),M=s.z.union([oe,se]),ce=s.z.array(M),le=s.z.array(s.z.string()),ue=s.z.object({version:s.z.literal(1),eip712:k,signerAddress:t.G}),de=s.z.object({version:s.z.literal(2),eip712:k,signerAddress:t.G,delegatorAddress:s.z.optional(t.G)}),fe=s.z.union([ue,de]),pe=`iv must be a ${g.ivLengthBytes}-byte hex string`,me=`wrappedPrivateKey must be a whole number of bytes and at least ${g.tagLengthBytes} bytes (the AES-GCM authentication tag)`;function N(e){return(e.length-2)/2}const he=s.z.object({wrappingVersion:s.z.literal(g.version,{error:`wrappingVersion must be a wrapping scheme this SDK can read`}),publicKey:t.K,wrappedPrivateKey:t.K.check(s.z.refine(e=>e.length%2==0&&N(e)>=g.tagLengthBytes,{error:me})),iv:t.K.check(s.z.refine(e=>N(e)===g.ivLengthBytes,{error:pe})),createdAt:t.X,expiresAt:t.Y,tkmsVersion:s.z.optional(s.z.string())});function P(e){let t={publicKey:e.publicKey,createdAt:e.createdAt,expiresAt:e.expiresAt};return e.tkmsVersion&&(t.tkmsVersion=e.tkmsVersion),t}const F={version:g.version,schema:he,async encode(e,t,n){let{wrappedPrivateKey:r,iv:i}=await ne(e.privateKey,t,n,P(e)),a={wrappingVersion:g.version,publicKey:e.publicKey,wrappedPrivateKey:r,iv:i,createdAt:e.createdAt,expiresAt:e.expiresAt};return e.tkmsVersion&&(a.tkmsVersion=e.tkmsVersion),a},async decode(e,t,n){let r=await b({wrappedPrivateKey:e.wrappedPrivateKey,iv:e.iv},t,n,P(e)),i={publicKey:e.publicKey,privateKey:r,createdAt:e.createdAt,expiresAt:e.expiresAt};return e.tkmsVersion&&(i.tkmsVersion=e.tkmsVersion),i}},I=new Map([[F.version,F]]),L=F;function R(e){let t=e;return t.wrappingVersion!==void 0||t.wrappedPrivateKey!==void 0&&t.iv!==void 0}function ge(e){if(typeof e!=`object`||!e||!R(e)){let t=O.safeParse(e);return t.success?{kind:`plaintext`,keyPair:t.data}:{kind:`unrecognized`}}let t=e.wrappingVersion,n=typeof t==`number`?I.get(t):void 0;if(n===void 0)return{kind:`unsupported-version`,version:t};let r=n.schema.safeParse(e);if(!r.success)return{kind:`corrupt-wrapped`};let i=r.data;return{kind:`wrapped`,expiresAt:i.expiresAt,decode:(e,t)=>n.decode(i,e,t)}}function _e(e,t,n){return L.encode(e,t,n)}function z(e){return`keypair:${e}`}function B(e){return`keypair:scope:${e}`}function V(e,t){return`permits:${e}:${t}:`}function H(e){return`${V(e.signerAddress,e.chainId)}${e.delegatorAddress}`}function U(e){return`permits-index:${e}`}function W(e){return`scope:${e}`}function ve(e,t){return{"wrapped-without-secret":`Transport key pair for scope "${t}" is wrapped, but this instance has no transportKeyPairDerivationSecret configured. Every instance sharing this scope must use the same transportKeyPairDerivationSecret; once they do, call permits.revokeTransportKeyPair() to rotate the entry.`,"unwrapped-under-secret":`Transport key pair for scope "${t}" is stored unwrapped, but this instance is configured with a transportKeyPairDerivationSecret. A peer instance sharing this scope is running without the secret: configure the same transportKeyPairDerivationSecret everywhere, then call permits.revokeTransportKeyPair() to migrate the scope to a wrapped entry.`,"unwrap-failed":`Transport key pair for scope "${t}" failed to unwrap. This usually means another instance created it with a different transportKeyPairDerivationSecret: every instance sharing this scope must use the same secret. It can also mean the stored entry is corrupted.`,"corrupt-wrapped":`Transport key pair for scope "${t}" is wrapped but structurally invalid: the stored iv or ciphertext is not a shape this wrapping scheme can produce. This usually means the stored entry is corrupted, or instances sharing this scope are running mismatched wrapping-scheme versions.`}[e]}const ye={"unwrapped-under-secret":`unwrapped transport key pair entry found while a transportKeyPairDerivationSecret is configured`,"unwrap-failed":`transport key pair entry failed to unwrap (wrong transportKeyPairDerivationSecret?)`,"corrupt-wrapped":`structurally invalid wrapped transport key pair entry`};function be(e,t){let n=typeof e==`number`?`wrappingVersion ${e}`:`no wrappingVersion this build recognizes`;return`Transport key pair ${t===void 0?`for this signer`:`for scope "${t}"`} was written under a wrapping scheme this SDK build cannot read (${n}). The entry is preserved instead of regenerated, since an instance that understands the scheme may still be using it: ${t===void 0?`run a build that supports it, or call permits.clear() to discard the entry deliberately`:`run a build that supports it everywhere, or call permits.revokeTransportKeyPair() to rotate the scope`}.`}var xe=class{#e;#t;#n;#r;#i;#a;#o=new Map;#s=new Map;constructor(e){this.#e=e.generator,this.#t=e.storage,this.#n=e.ttl,this.#r=e.logger,this.#i=e.scope,this.#a=e.derivationSecret}#c(e){return this.#i===void 0?`signer:${e}`:W(this.#i)}#l(e){return this.#i===void 0?z(e):B(this.#i)}async readStored(e){return this.#u(this.#l(e),this.#c(e))}async#u(e,n){let r=await this.#t.get(e);if(r==null)return null;let i=ge(r);if(i.kind===`unsupported-version`)throw this.#f(e,be(i.version,this.#i));if(i.kind===`unrecognized`)return await this.#m(e,`malformed transport key pair entry`),null;let a=this.#a;if(a===void 0)return i.kind===`plaintext`?await this.#p(e,i.keyPair.expiresAt)?null:i.keyPair:this.#d(e,`wrapped-without-secret`);if(i.kind===`plaintext`)return this.#d(e,`unwrapped-under-secret`);if(i.kind===`corrupt-wrapped`)return this.#d(e,`corrupt-wrapped`);if(await this.#p(e,i.expiresAt))return null;try{return await i.decode(a,n)}catch(n){if(!x(n))throw this.#r.error(`transport key pair unwrap failed unexpectedly`,{key:e,error:n}),new t.dt(`Transport key pair unwrap failed unexpectedly.`,{cause:n});return this.#d(e,`unwrap-failed`,n)}}async#d(e,t,n){if(this.#i!==void 0)throw this.#f(e,ve(t,this.#i),n);if(t===`wrapped-without-secret`)throw this.#f(e,`Transport key pair for this signer is wrapped, but this instance has no transportKeyPairDerivationSecret configured. Configure the same transportKeyPairDerivationSecret the entry was written with. To downgrade to plaintext at rest on purpose, discard the stored entry first by calling permits.clear(), then run without the secret.`,n);let r=ye[t];return this.#r.warn(r,{key:e}),await this.#m(e,r),null}#f(e,n,r){return this.#r.error(n,{key:e}),new t.dt(n,{cause:r})}async#p(e,n){return t.V()<n?!1:(await this.#m(e,`expired transport key pair entry`),!0)}async#m(e,n){this.#r.debug(`discarding transport key pair entry`,{key:e,reason:n}),await t.U(`delete transport key pair entry`,()=>this.#t.delete(e),this.#r)}async getOrCreate(e,t){return this.#h(this.#l(e),this.#c(e),{strict:t?.strict})}async#h(e,n,r){let i=r?.strict??!1,a=`${e}::${i}`,o=this.#o.get(a);if(o)return o;let s=this.#s.get(e)??0,c=(async()=>{let r=await this.#u(e,n);if(r!==null)return r;let a=await this.#e(),o=t.V(),c=o+this.#n,l={publicKey:a.publicKey,privateKey:a.privateKey,createdAt:o,expiresAt:c};a.tkmsVersion&&(l.tkmsVersion=a.tkmsVersion);let u=l;if(this.#a!==void 0)try{u=await _e(l,this.#a,n)}catch(n){let r=`Failed to wrap the transport private key for at-rest storage.`;throw this.#r.error(r,{key:e,error:n}),new t.dt(r,{cause:n})}if((this.#s.get(e)??0)===s)i?await this.#t.set(e,u):await t.U(`persist transport key pair`,()=>this.#t.set(e,u),this.#r);else if(i)throw new t.gt(`The transport key pair was rotated while it was being generated, so the freshly generated key pair could not be persisted. Retry.`);return l})().finally(()=>{this.#o.delete(a)});return this.#o.set(a,c),c}async clear(e){let n=z(e);await t.U(`delete transport key pair entry`,()=>this.#t.delete(n),this.#r)}async evict(e){let n=this.#l(e);await t.U(`evict transport key pair entry`,()=>this.#t.delete(n),this.#r)}async clearScope(){if(this.#i===void 0)return;let e=B(this.#i);this.#s.set(e,(this.#s.get(e)??0)+1),await this.#t.delete(e)}async warmScope(){this.#i!==void 0&&await this.#h(B(this.#i),W(this.#i),{strict:!0})}};function G(e,t){return{...e,...t}}function K(e){return e.version===2&&e.contractAddresses.length===0}function Se(e,t){return K(e)||e.contractAddresses.includes(t)}function q(e,t){return K(e)||e.contractAddresses.some(e=>t.has(e))}function J(e,t){if(e.some(K))return[];let n=new Set(e.flatMap(e=>e.contractAddresses));return t.filter(e=>!n.has(e))}function Ce(e){let t=[];for(let n=0;n<e.length;n+=10)t.push(e.slice(n,n+10));return t}function we(e){return e.version===1?e.durationDays*t.R:e.durationSeconds}function Te(e,t,n){return e.filter(e=>e.keypairPublicKey===t&&n<e.startTimestamp+we(e))}function Ee(e,t){let n=new Set(t);return e.filter(e=>!q(e,n))}function Y(e,t){return[...new Set([...e,...t])].sort()}function De(e,t,n){let r=new Set(n),i=e.filter(e=>!K(e)&&new Set([...e.contractAddresses,...t]).size<=10);if(i.length===0)return null;function a(e){return e.contractAddresses.reduce((e,t)=>e+ +!!r.has(t),0)}let o=Math.max(...i.map(a));return i.filter(e=>a(e)===o).reduce((e,t)=>t.startTimestamp>e.startTimestamp?t:e)}function Oe(e){return typeof e!=`object`||!e||Array.isArray(e)||`version`in e?e:{...e,version:1}}var ke=class{#e;#t;constructor(e){this.#e=e.storage,this.#t=e.logger}async list(e){let t=H(e),n=await this.#e.get(t);if(n==null)return[];let r=Array.isArray(n)?n.map(Oe):n,i=ce.safeParse(r);return i.success?i.data:(await this.clearScope(e),[])}async listUsableAndPrune(e,n){let r=await this.list(e),i=Te(r,n,Math.floor(Date.now()/1e3));return i.length!==r.length&&(i.length===0?await this.clearScope(e):await t.U(`update permit entry`,()=>this.#e.set(H(e),i),this.#t)),i}async append(e,t){if(t.length===0)return;let n=t.map(e=>M.parse(e)),r=await this.list(e);await this.#e.set(H(e),[...r,...n]),await this.#a(e)}async replace(e,t,n){let r=M.parse(n),i=(await this.list(e)).filter(e=>e.serializedPermit.signature!==t);await this.#e.set(H(e),[...i,r]),await this.#a(e)}async deletePermitsTouching(e,t){let n=await this.list(e);if(n.length===0)return;let r=Ee(n,t);r.length===0?await this.clearScope(e):await this.#e.set(H(e),r)}async clearScope(e){await this.#s(H(e)),await this.#o(e)}async clearAllForSigner(e){await this.#n(e,()=>!0)}async clearAllForSignerOnChain(e,t){let n=V(e,t);await this.#n(e,e=>e.startsWith(n))}async#n(e,t){let n=U(e),r=await this.#i(n),i=r.filter(t);r.length>0&&i.length===0||(await Promise.all(i.map(e=>this.#s(e))),await this.#r(n,r.filter(e=>!t(e))))}async#r(e,n){n.length===0?await t.U(`delete permit index`,()=>this.#e.delete(e),this.#t):await t.U(`update permit index`,()=>this.#e.set(e,n),this.#t)}async#i(e){let n=await this.#e.get(e);if(n==null)return[];let r=le.safeParse(n);return r.success?r.data:(await t.U(`delete permit index`,()=>this.#e.delete(e),this.#t),[])}async#a(e){let t=U(e.signerAddress),n=H(e),r=await this.#i(t);r.includes(n)||await this.#e.set(t,[...r,n])}async#o(e){let t=U(e.signerAddress),n=H(e),r=await this.#i(t),i=r.filter(e=>e!==n);i.length!==r.length&&await this.#r(t,i)}async#s(e){await t.U(`delete permit entry`,()=>this.#e.delete(e),this.#t)}};const Ae=30*t.R;var je=class{#e;#t;#n;#r;#i;#a;#o;#s;#c=new Map;constructor(e){this.#e=new xe({generator:async()=>{let t=e.router.relayer,n=await t.generateTransportKeyPair();return t.serializeTransportKeyPair({transportKeyPair:n})},storage:e.storage,ttl:e.transportKeyPairTTL,logger:e.logger,scope:e.scope,derivationSecret:e.derivationSecret}),this.#t=new ke({storage:e.permitStorage??e.storage,logger:e.logger}),this.#n=e.router,this.#r=e.signer,this.#i=e.permitTTL,this.#a=e.logger,this.#o=e.emitEvent,this.#s=e.scope}#l(e){if(!this.#r)throw new t.$(e);return this.#r}#u(e,n){let r=t.st(n,{operation:e});return this.#o({type:t.Z.PermitError,operation:e,error:r}),r}async#d(){if(this.#n.chain.protocolConfigContractAddress===void 0)return 1;try{return await this.#n.relayer.canUseUnifiedDecryptionPermit()?2:1}catch{return 1}}async grantPermit(e,n){let r=n===void 0?`grantPermit`:`grantDelegationPermit`,i=e===t.z,a,o,s;try{a=t.W(this.#l(`grantPermit`).requireWalletAccount(`grantPermit`).address),o=i?[]:t.B(e),s=this.#f(a,n)}catch(e){throw this.#u(r,e)}let c=await this.#e.getOrCreate(a);if(i){let e;try{e=await this.#t.listUsableAndPrune(s,c.publicKey)}catch(e){throw this.#u(r,e)}let n=e.find(K);if(n)return{keypair:c,permissions:[n]};if(await this.#d()===1)throw this.#u(r,t.xt(`grantPermit`));let i=await this.#p({version:2,chunk:[],keypair:c,scope:s});return await t.U(`persist permit`,()=>this.#t.append(s,[i]),this.#a),{keypair:c,permissions:[i]}}if(o.length===0)return{keypair:c,permissions:[]};let l;try{l=await this.#t.listUsableAndPrune(s,c.publicKey)}catch(e){throw this.#u(r,e)}let u=J(l,o);if(u.length>0){let e=await this.#d(),n=De(l,u,o);if(n!==null){let r=Y(n.contractAddresses,u),i=await this.#p({version:e,chunk:r,keypair:c,scope:s});await t.U(`replace permit`,()=>this.#t.replace(s,n.serializedPermit.signature,i),this.#a),l[l.indexOf(n)]=i}else for(let n of Ce(u)){let r=await this.#p({version:e,chunk:n,keypair:c,scope:s});l.push(r),await t.U(`persist permit`,()=>this.#t.append(s,[r]),this.#a)}}let d=new Set(o);return{keypair:c,permissions:l.filter(e=>q(e,d))}}async preparePermit(n){let i=t.W(n.signer),a=n.contracts===t.z,o=n.contracts===`wildcard`?[]:t.B(n.contracts);if(!a&&o.length===0)throw new e.t(`preparePermit: request.contracts must not be empty.`);if(!a&&o.length>10)throw new e.t(`preparePermit: request.contracts must not exceed 10 addresses per call (got ${o.length}) — grantPermit chunks automatically, preparePermit does not.`);let s=n.delegator?t.W(n.delegator):void 0;if(s!==void 0&&s===i)throw new e.t(`preparePermit: request.delegator must differ from request.signer — self-delegation is not allowed.`);let c=(n.durationDays===void 0?this.#i:r.t(D,n.durationDays))*t.R,l=this.#n.relayer,u=await this.#e.getOrCreate(i,{strict:!0}),d=await l.parseTransportKeyPair(u),f=t.V(),p=await this.#d();if(a&&p===1)throw t.xt(`preparePermit`);let m=a?2:p,h;try{let e=m===2?await l.createUnsignedUnifiedDecryptionPermitEip712({transportKeyPair:d,contractAddresses:o,startTimestamp:f,durationSeconds:c,signerAddress:i}):await l.createUnsignedLegacyDecryptionPermitEip712({transportKeyPair:d,contractAddresses:o,startTimestamp:f,durationSeconds:c,...s&&{delegatorAddress:s}});h=t.H(k.parse(e))}catch(e){throw t.bt(`preparePermit`,e)??e}return m===2?{version:2,eip712:h,signerAddress:i,...s&&{delegatorAddress:s}}:{version:1,eip712:h,signerAddress:i}}async registerPermit(e,n){let i;try{i=r.t(fe,e)}catch(e){throw this.#u(`registerPermit`,e)}let a=this.#n.relayer,o=this.#n.chain.id,{domain:s,message:c}=i.eip712,l=Number(s.chainId);if(l!==o)throw this.#u(`registerPermit`,new t.pt({preparedChainId:l,activeChainId:o}));let u=Number(c.startTimestamp),d=i.version===2?Number(c.durationSeconds):Number(c.durationDays)*t.R;if(t.V()>=u+d)throw this.#u(`registerPermit`,new t.mt(`registerPermit: the prepared permit's validity window (starting ${u}, ${d}s) has already elapsed — call preparePermit again.`));let f=i.signerAddress,p=await this.#e.readStored(f);if(p===null||p.publicKey!==c.publicKey)throw new t.gt(`registerPermit: the transport key pair changed since preparePermit ran — call preparePermit again to rebind the signature request to the current key pair.`);try{let e=await a.parseTransportKeyPair(p),s=await a.parseSignedDecryptionPermit({serializedPermit:{version:i.version,eip712:i.eip712,signature:n,signerAddress:f,...i.version===2&&i.delegatorAddress&&{delegatorAddress:i.delegatorAddress}},transportKeyPair:e}),c=r.t(A,await a.serializeSignedDecryptionPermit({signedPermit:s})),l=G({keypairPublicKey:p.publicKey,contractAddresses:t.B(s.version===2?s.eip712.message.allowedContracts:s.eip712.message.contractAddresses),serializedPermit:c,startTimestamp:Number(s.eip712.message.startTimestamp)},s.version===2?{version:2,durationSeconds:Number(s.eip712.message.durationSeconds)}:{version:1,durationDays:Number(s.eip712.message.durationDays)}),u={signerAddress:f,chainId:o,delegatorAddress:t.W(s.encryptedDataOwnerAddress)};await t.U(`replace permit`,()=>this.#t.replace(u,c.signature,l),this.#a)}catch(e){throw this.#u(`registerPermit`,e)}}async hasPermit(e,n){if(e.length===0)return!0;let r=this.#r?.walletAccount.getSnapshot();if(!r)return!1;let i=t.W(r.address),a;try{a=await this.#e.readStored(i)}catch(e){if(!(e instanceof t.dt))throw e;return!1}if(a===null)return!1;let o=this.#f(i,n);return J(await this.#t.listUsableAndPrune(o,a.publicKey),t.B(e)).length===0}async revokePermits(e){let n=t.W(this.#l(`revokePermits`).requireWalletAccount(`revokePermits`).address);if(e===void 0){await this.#t.clearAllForSigner(n);return}let r=t.B(e);r.length!==0&&await this.#t.deletePermitsTouching(this.#f(n),r)}async clearPermitsAfterInvalidation(e){await t.U(`clear permits after invalidation`,()=>this.#t.clearAllForSignerOnChain(e,this.#n.chain.id),this.#a)}#f(e,n){return{signerAddress:e,chainId:this.#n.chain.id,delegatorAddress:n?t.W(n):e}}async clearCredentials(){let e=t.W(this.#l(`clearCredentials`).requireWalletAccount(`clearCredentials`).address);await this.#e.clear(e),await this.#t.clearAllForSigner(e)}async revokeTransportKeyPair(t){if(this.#s===void 0)throw new e.t(`revokeTransportKeyPair() requires a transportKeyPairScope to be configured on this SDK instance — there is no shared key pair to revoke.`);if(t!==this.#s)throw new e.t(`revokeTransportKeyPair("${t}") does not match the configured scope ("${this.#s}").`);await this.#e.clearScope()}async warmTransportKeyPair(e){await this.#e.getOrCreate(t.W(e))}async warmTransportKeyPairScope(t){if(this.#s===void 0)throw new e.t(`warmTransportKeyPairScope() requires a transportKeyPairScope to be configured on this SDK instance — there is no shared key pair to warm.`);if(t!==this.#s)throw new e.t(`warmTransportKeyPairScope("${t}") does not match the configured scope ("${this.#s}").`);await this.#e.warmScope()}async handleWalletAccountChange(e,n){let r=e?t.W(e.address):void 0;r!==(n?t.W(n.address):void 0)&&r&&(await this.#e.clear(r),await this.#t.clearAllForSigner(r))}async#p(n){let{version:i,chunk:a,keypair:o,scope:s}=n,c=t.V(),l=s.delegatorAddress!==s.signerAddress,u=this.#n.relayer;try{let e=await u.parseTransportKeyPair(o),n=this.#i*t.R,d={transportKeyPair:e,contractAddresses:a,startTimestamp:c,durationSeconds:n,signerAddress:s.signerAddress,signer:this.#l(`signPermit`)},f=await(i===2?u.signUnifiedDecryptionPermit:u.signDecryptionPermit)(l?{...d,delegatorAddress:s.delegatorAddress}:d),p=r.t(A,await u.serializeSignedDecryptionPermit({signedPermit:f}));return G({keypairPublicKey:o.publicKey,contractAddresses:a,serializedPermit:p,startTimestamp:c},i===2?{version:2,durationSeconds:n}:{version:1,durationDays:this.#i})}catch(n){let r=l?`grantDelegationPermit`:`grantPermit`,i=n instanceof e.r?void 0:t.bt(`grantPermit`,n);throw i?this.#u(r,i):(!(n instanceof e.r)&&n instanceof Error&&e.p(n.message)&&await this.#e.evict(s.signerAddress),this.#u(r,n))}}async evictTransportKeyPair(){let e=this.#r?.walletAccount.getSnapshot();e&&await this.#e.evict(t.W(e.address))}async recoverPermits(e,n,r){let i=this.#l(`recoverPermits`).requireWalletAccount(`recoverPermits`),a=this.#f(t.W(i.address),n),o=H(a),s=this.#c.get(o);if(s)return await s,this.grantPermit(e,n);let c=await this.#m(a),l=this.#c.get(o);if(l)return await l,this.grantPermit(e,n);if(c===null)return this.grantPermit(e,n);let u=new Set(r??[]);if(u.size>0&&!c.some(e=>u.has(e.serializedPermit.signature)))return this.grantPermit(e,n);let d=c.filter(e=>!u.has(e.serializedPermit.signature)),f=c.some(K)?t.z:Y(c.flatMap(e=>e.contractAddresses),t.B(e)),p=this.#h(a,f,d,n).finally(()=>{this.#c.delete(o)});return this.#c.set(o,p),await p,this.grantPermit(e,n)}async#m(e){try{return await this.#t.list(e)}catch(e){return this.#a.warn(`read permits for recovery failed`,{error:e}),null}}async#h(e,n,r,i){await t.U(`evict revoked permits`,()=>this.#t.clearScope(e),this.#a);try{await this.grantPermit(n,i)}catch(n){throw r.length>0&&await t.U(`restore surviving permits`,async()=>{let t=await this.#t.list(e),n=new Set(t.map(e=>e.serializedPermit.signature)),i=r.filter(e=>!n.has(e.serializedPermit.signature));i.length>0&&await this.#t.append(e,i)},this.#a),n}}},Me=class{#e;#t=`[zama-sdk]`;constructor(e){this.#e=e}error(e,t){this.#e?.error(`${this.#t} ${e}`,t)}warn(e,t){this.#e?.warn(`${this.#t} ${e}`,t)}info(e,t){this.#e?.info(`${this.#t} ${e}`,t)}debug(e,t){this.#e?.debug(`${this.#t} ${e}`,t)}warnAlways(e){console.warn(`${this.#t} ${e}`),this.warn(e)}};const X={[i.s.id]:i.s.registryAddress,[i.c.id]:i.c.registryAddress,[i.u.id]:i.u.registryAddress,[i.l.id]:i.l.registryAddress,[i.a.id]:i.a.registryAddress,[i.o.id]:i.o.registryAddress,[i.n.id]:i.n.registryAddress},Ne=s.z.record(s.z.string().check(s.z.regex(/^\d+$/,`expected numeric chain id key`)),t.G),Z=t.q,Q=300*1e3;var Pe=class{provider;#e;#t;#n=new Map;constructor(e){this.provider=e.provider,this.#e=Object.assign({},X,r.t(s.z.optional(Ne),e.registryAddresses)),this.#t=r.t(Z,e.registryTTL??86400)*1e3}getAddress(e){return this.#e[e]}#r(e){let t=this.#n.get(e);if(t){if(Date.now()>=t.expiresAt){this.#n.delete(e);return}return t.data}}#i(e,t,n=this.#t){return this.#n.set(e,{data:t,expiresAt:Date.now()+n}),t}refresh(){this.#n.clear()}get ttlMs(){return this.#t}async getRegistryAddress(){let t=await this.provider.getChainId(),n=this.#e[t];if(!n)throw new e.t(`No wrappers registry address configured for chain ${t}.\nPass a registryAddresses entry for this chain.`);return(0,a.getAddress)(n)}async listPairs(n={}){let r=n.page??1,i=n.pageSize??100,a=n.metadata??!1;if(r<1)throw new e.t(`page must be >= 1, got ${r}`);if(i<1)throw new e.t(`pageSize must be >= 1, got ${i}`);let o=await this.getRegistryAddress(),s=`total:${o}`,c=this.#r(s);if(c===void 0){let e=await this.provider.readContract(t.a(o));c=this.#i(s,Number(e))}let l=BigInt((r-1)*i),u=l+BigInt(i)>BigInt(c)?BigInt(c):l+BigInt(i);if(l>=BigInt(c))return{items:[],total:c,page:r,pageSize:i};let d=`slice:${o}:${l}:${u}`,f=this.#r(d);if(f===void 0){let e=await this.provider.readContract(t.o(o,l,u));f=this.#i(d,[...e])}if(!a)return{items:f,total:c,page:r,pageSize:i};let p=`metadata:${o}:${l}:${u}`,m=this.#r(p);if(m===void 0){let e=await Promise.allSettled(f.map(e=>this.#a(e))),t=e.some(e=>e.status===`rejected`),n=e.map((e,t)=>e.status===`fulfilled`?e.value:Object.assign({},f[t],{metadataFailed:!0,underlying:{name:`Unknown`,symbol:`???`,decimals:0,totalSupply:0n},confidential:{name:`Unknown`,symbol:`???`,decimals:0}}));m=this.#i(p,n,t?Q:void 0)}return{items:m,total:c,page:r,pageSize:i}}async#a(e){let[n,r,i,a,o,s,c]=await Promise.all([this.provider.readContract(t.b(e.tokenAddress)),this.provider.readContract(t.x(e.tokenAddress)),this.provider.readContract(t.v(e.tokenAddress)),this.provider.readContract(t.y(e.tokenAddress)),this.provider.readContract(t.b(e.confidentialTokenAddress)),this.provider.readContract(t.x(e.confidentialTokenAddress)),this.provider.readContract(t.v(e.confidentialTokenAddress))]);return{...e,underlying:{name:n,symbol:r,decimals:i,totalSupply:a},confidential:{name:o,symbol:s,decimals:c}}}async getConfidentialToken(e){let n=await this.getRegistryAddress(),r=(0,a.getAddress)(e),i=`ct:${n}:${r}`,o=this.#r(i);if(o!==void 0)return o;let[s,c]=await this.provider.readContract(t.t(n,r));return c===a.zeroAddress?this.#i(i,null,Q):this.#i(i,{confidentialTokenAddress:c,isValid:s})}async getUnderlyingToken(e){let n=await this.getRegistryAddress(),r=(0,a.getAddress)(e),i=`ut:${n}:${r}`,o=this.#r(i);if(o!==void 0)return o;let[s,c]=await this.provider.readContract(t.n(n,r));return c===a.zeroAddress?this.#i(i,null,Q):this.#i(i,{tokenAddress:c,isValid:s})}async getTokenPairs(){let e=await this.getRegistryAddress();return this.provider.readContract(t.i(e))}async getTokenPairsLength(){let e=await this.getRegistryAddress();return this.provider.readContract(t.a(e))}async getTokenPairsSlice(e,n){let r=await this.getRegistryAddress();return this.provider.readContract(t.o(r,e,n))}async getTokenPair(e){let n=await this.getRegistryAddress();return this.provider.readContract(t.r(n,e))}async getConfidentialTokenAddress(e){let n=await this.getRegistryAddress();return this.provider.readContract(t.t(n,(0,a.getAddress)(e)))}async getTokenAddress(e){let n=await this.getRegistryAddress();return this.provider.readContract(t.n(n,(0,a.getAddress)(e)))}async isConfidentialTokenValid(e){let n=await this.getRegistryAddress();return this.provider.readContract(t.s(n,(0,a.getAddress)(e)))}};function Fe(e,t,i){let a=new Me(i.logger),s=i.logger,c={wasmAssetLoadMode:`auto`,moduleVersions:`auto`,logger:{error:(e,t)=>s?.error(e,{cause:t}),warn:e=>s?.warn(e),debug:e=>s?.debug(e)},...i.runtime};if((0,o.hasFhevmRuntimeConfig)()){let e=`runtime configuration is already set and cannot be changed.`;i.runtime===void 0?a.debug(e):a.warn(e)}else(0,o.setFhevmRuntimeConfig)(c),n.r(c);let{storage:l,permitStorage:u}=p(i.storage,i.permitStorage),d=new h(i.chains,i.relayers,a);return{chains:i.chains,router:d,provider:t,signer:e,storage:l,permitStorage:u,transportKeyPairTTL:r.t(re,i.transportKeyPairTTL??Ae),permitTTL:r.t(D,i.permitTTL??30),transportKeyPairScope:i.transportKeyPairScope===void 0?void 0:r.t(ie,i.transportKeyPairScope),registryTTL:r.t(Z,i.registryTTL??86400),logger:a,onEvent:i.onEvent}}function Ie(e,t){return e?.address===t?.address&&e?.chainId===t?.chainId}var $=class{#e=new Set;#t;#n;constructor(e){this.#t=e,this.#n=e!==void 0}getSnapshot(){return this.#t}isReady(){return this.#n}setSnapshot(e){this.#n=!0;let t=this.#t;Ie(t,e)||(this.#t=e,this.#r({previous:t,next:e}))}subscribe(e){this.#e.add(e);let t=this.#t;return t&&e({previous:void 0,next:t}),()=>{this.#e.delete(e)}}#r(e){for(let t of this.#e)t(e)}};function Le(e){return new $(e)}var Re=class{walletAccount;#e=!1;constructor(e){this.walletAccount=new $(e)}requireWalletAccount(e){let n=this.walletAccount.getSnapshot();if(!n)throw new t.nt(e);return n}dispose(){this.#e||(this.#e=!0,this.onDispose())}[Symbol.dispose](){this.dispose()}onDispose(){}};Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return X}}),Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return Se}}),Object.defineProperty(exports,"d",{enumerable:!0,get:function(){return u}}),Object.defineProperty(exports,"f",{enumerable:!0,get:function(){return d}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return Fe}}),Object.defineProperty(exports,"l",{enumerable:!0,get:function(){return ae}}),Object.defineProperty(exports,"m",{enumerable:!0,get:function(){return l}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return $}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return Pe}}),Object.defineProperty(exports,"p",{enumerable:!0,get:function(){return c}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Le}}),Object.defineProperty(exports,"s",{enumerable:!0,get:function(){return je}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return Re}}),Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return te}});
+const e=require("./relayer.cjs"),t=require("./signing.cjs"),n=require("./erc165.cjs"),r=require("./applied-runtime.cjs"),i=require("./validation.cjs"),a=require("./wrappers-registry.cjs"),o=require("./chains.cjs");let s=require("viem"),c=require("@fhevm/sdk/viem"),l=require("zod/mini");var u=class{#e=null;#t=null;#n;#r;#i;constructor(e=`CredentialStore`,t=1,n=`credentials`){this.#n=e,this.#r=t,this.#i=n}#a(){return this.#e?Promise.resolve(this.#e):(this.#t||=new Promise((e,t)=>{let n=indexedDB.open(this.#n,this.#r);n.onupgradeneeded=()=>{let e=n.result;e.objectStoreNames.contains(this.#i)||e.createObjectStore(this.#i,{keyPath:`key`})},n.onsuccess=()=>{this.#e=n.result,this.#t=null,this.#e.onversionchange=()=>{this.#e?.close(),this.#e=null,this.#t=null},this.#e.onclose=()=>{this.#e=null,this.#t=null},e(this.#e)},n.onerror=()=>{this.#e=null,this.#t=null,t(n.error)}}),this.#t)}async#o(e,t){let n=await this.#a();return new Promise((r,i)=>{let a=n.transaction(this.#i,e);a.onabort=()=>i(a.error??Error(`Transaction aborted`));let o=t(a.objectStore(this.#i));e===`readonly`?o.onsuccess=()=>r(o.result):a.oncomplete=()=>r(o.result),o.onerror=()=>i(o.error)})}async get(e){return(await this.#o(`readonly`,t=>t.get(e)))?.value??null}async set(e,t){await this.#o(`readwrite`,n=>n.put({key:e,value:t}))}async delete(e){await this.#o(`readwrite`,t=>t.delete(e))}async clear(){await this.#o(`readwrite`,e=>e.clear())}};const d=new u;var f=class{#e=new Map;async get(e){return this.#e.get(e)??null}async set(e,t){this.#e.set(e,t)}async delete(e){this.#e.delete(e)}};const p=new f;function m(){return typeof window<`u`?new u(`CredentialStore`):new f}function h(e=m(),t=e){return{storage:e,permitStorage:t}}function g(t,n,r){let i=t.map(e=>e.id),a=[...new Set(i.filter((e,t)=>i.indexOf(e)!==t))];if(a.length>0)throw new e.t(`Duplicate chain id(s) [${a.join(`, `)}] in the chains array. Each chain id must appear only once. Note: hardhat and anvil are aliases (both use 31337).`);let o=Object.keys(n).map(Number).filter(e=>!i.includes(e));o.length>0&&r.warn(`Relayer entries for chain(s) [${o.join(`, `)}] are ignored: those chains are not in the chains array. Add the chain config to use them, or drop the relayer entries.`);let s=new Map;for(let r of t){let t=n[r.id];if(!t)throw new e.t(`Chain ${r.id} has no relayer configured. Add a relayer entry: relayers: { [${r.id}]: web() }`);s.set(r.id,{chain:r,relayerConfig:t})}return s}var _=class{#e;#t;#n;constructor(t,n,r,i){if(t.length===0)throw new e.t(`At least one chain is required.`);this.#e=new Map(t.map(e=>[e.id,e])),this.#n=t[0].id;let a=new Map;for(let[e,{relayerConfig:o,chain:s}]of g(t,n,r))a.set(e,o.createRelayer(s,r,i));this.#t=a}get chains(){return[...this.#e.values()]}get chain(){let t=this.#e.get(this.#n);if(t===void 0)throw new e.t(`Chain ${this.#n} is not configured. Add it to the chains array.`);return t}switchChain(e){this.#n=e}dispose(){for(let e of new Set(this.#t.values()))e.dispose?.()}get relayer(){let t=this.#t.get(this.chain.id);if(t===void 0)throw new e.t(`No relayer configured for chain ${this.#n}. Add it to the relayers object.`);return t}};const v={version:1,info:`zama-sdk-keypair-wrapping-v1`,ivLengthBytes:12,tagLengthBytes:16};function y(e){return new Uint8Array(e)}function b(e){return y(new TextEncoder().encode(JSON.stringify([e.publicKey,e.createdAt,e.expiresAt,e.tkmsVersion??null])))}function ee(e){return typeof e==`string`?new TextEncoder().encode(e):y(e)}var te=class{#e;#t;constructor(e){this.#e=e}async baseKey(){return this.#t??=this.#n(this.#e),this.#t}async#n(e){let t=ee(e),n=await crypto.subtle.importKey(`raw`,t,`HKDF`,!1,[`deriveKey`]);return t.fill(0),e instanceof Uint8Array&&e.fill(0),this.#e=void 0,n}};async function x(e,t){let n=await e.baseKey();return crypto.subtle.deriveKey({name:`HKDF`,hash:`SHA-256`,salt:new TextEncoder().encode(t),info:new TextEncoder().encode(v.info)},n,{name:`AES-GCM`,length:256},!1,[`encrypt`,`decrypt`])}async function ne(e,t,n,r){let i=await x(t,n),a=crypto.getRandomValues(new Uint8Array(v.ivLengthBytes)),o=await crypto.subtle.encrypt({name:`AES-GCM`,iv:a,additionalData:b(r)},i,y((0,s.toBytes)(e)));return{wrappedPrivateKey:(0,s.toHex)(new Uint8Array(o)),iv:(0,s.toHex)(a)}}async function re(e,t,n,r){let i=await x(t,n),a=await crypto.subtle.decrypt({name:`AES-GCM`,iv:y((0,s.toBytes)(e.iv)),additionalData:b(r)},i,y((0,s.toBytes)(e.wrappedPrivateKey)));return(0,s.toHex)(new Uint8Array(a))}function ie(e){return typeof e==`object`&&!!e&&`name`in e&&e.name===`OperationError`}const S=`transportKeyPairTTL must be a positive integer number of seconds`,C=`permitTTL must be a positive integer number of days`,w=`transportKeyPairScope must be a non-empty string`,T=`transportKeyPairDerivationSecret must be a Uint8Array of at least 32 bytes or a string of at least 64 characters (256 bits of entropy): source it from a CSPRNG or secrets manager, not a human-memorable passphrase`,E=365*a.c,ae=l.z.int({error:S}).check(l.z.positive({error:S}),l.z.maximum(E,`transportKeyPairTTL must not exceed the fhevm ACL maximum of ${E}s (365 days)`)),D=l.z.int({error:C}).check(l.z.positive({error:C}),l.z.maximum(365,`permitTTL must not exceed the V1 permit maximum of 365 days`)),oe=l.z.string({error:w}).check(l.z.minLength(1,w)),se=l.z.union([l.z.string({error:T}).check(l.z.minLength(64,T)),l.z.instanceof(Uint8Array,{error:T}).check(l.z.refine(e=>e.byteLength>=32,{error:T}))],{error:T}),ce=l.z.object({publicKey:n.L,privateKey:n.L,createdAt:n.V,expiresAt:n.B,tkmsVersion:l.z.optional(l.z.string())}),O=l.z.object({domain:l.z.record(l.z.string(),l.z.unknown()),primaryType:l.z.optional(l.z.string()),types:l.z.record(l.z.string(),l.z.array(l.z.object({name:l.z.string(),type:l.z.string()}))),message:l.z.record(l.z.string(),l.z.unknown())}),k=l.z.object({version:l.z.int().check(l.z.positive()),eip712:O,signature:n.L,signerAddress:n.I,delegatorAddress:l.z.optional(n.I)}),A={keypairPublicKey:n.L,contractAddresses:l.z.array(n.I).check(l.z.maxLength(10)),serializedPermit:k,startTimestamp:n.V},le=l.z.object({...A,version:l.z.literal(1),durationDays:n.z}),ue=l.z.object({...A,version:l.z.literal(2),durationSeconds:n.B}),j=l.z.union([le,ue]),de=l.z.array(j),fe=l.z.array(l.z.string()),pe=l.z.object({version:l.z.literal(1),eip712:O,signerAddress:n.I}),me=l.z.object({version:l.z.literal(2),eip712:O,signerAddress:n.I,delegatorAddress:l.z.optional(n.I)}),he=l.z.union([pe,me]),ge=`iv must be a ${v.ivLengthBytes}-byte hex string`,_e=`wrappedPrivateKey must be a whole number of bytes and at least ${v.tagLengthBytes} bytes (the AES-GCM authentication tag)`;function M(e){return(e.length-2)/2}const ve=l.z.object({wrappingVersion:l.z.literal(v.version,{error:`wrappingVersion must be a wrapping scheme this SDK can read`}),publicKey:n.L,wrappedPrivateKey:n.L.check(l.z.refine(e=>e.length%2==0&&M(e)>=v.tagLengthBytes,{error:_e})),iv:n.L.check(l.z.refine(e=>M(e)===v.ivLengthBytes,{error:ge})),createdAt:n.V,expiresAt:n.B,tkmsVersion:l.z.optional(l.z.string())});function N(e){let t={publicKey:e.publicKey,createdAt:e.createdAt,expiresAt:e.expiresAt};return e.tkmsVersion&&(t.tkmsVersion=e.tkmsVersion),t}const P={version:v.version,schema:ve,async encode(e,t,n){let{wrappedPrivateKey:r,iv:i}=await ne(e.privateKey,t,n,N(e)),a={wrappingVersion:v.version,publicKey:e.publicKey,wrappedPrivateKey:r,iv:i,createdAt:e.createdAt,expiresAt:e.expiresAt};return e.tkmsVersion&&(a.tkmsVersion=e.tkmsVersion),a},async decode(e,t,n){let r=await re({wrappedPrivateKey:e.wrappedPrivateKey,iv:e.iv},t,n,N(e)),i={publicKey:e.publicKey,privateKey:r,createdAt:e.createdAt,expiresAt:e.expiresAt};return e.tkmsVersion&&(i.tkmsVersion=e.tkmsVersion),i}},ye=new Map([[P.version,P]]),be=P;function xe(e){let t=e;return t.wrappingVersion!==void 0||t.wrappedPrivateKey!==void 0&&t.iv!==void 0}function Se(e){if(typeof e!=`object`||!e||!xe(e)){let t=ce.safeParse(e);return t.success?{kind:`plaintext`,keyPair:t.data}:{kind:`unrecognized`}}let t=e.wrappingVersion,n=typeof t==`number`?ye.get(t):void 0;if(n===void 0)return{kind:`unsupported-version`,version:t};let r=n.schema.safeParse(e);if(!r.success)return{kind:`corrupt-wrapped`};let i=r.data;return{kind:`wrapped`,expiresAt:i.expiresAt,decode:(e,t)=>n.decode(i,e,t)}}function Ce(e,t,n){return be.encode(e,t,n)}function F(e){return`keypair:${e}`}function I(e){return`keypair:scope:${e}`}function L(e,t){return`permits:${e}:${t}:`}function R(e){return`${L(e.signerAddress,e.chainId)}${e.delegatorAddress}`}function z(e){return`permits-index:${e}`}function B(e){return`scope:${e}`}function we(e,t){return{"wrapped-without-secret":`Transport key pair for scope "${t}" is wrapped, but this instance has no transportKeyPairDerivationSecret configured. Every instance sharing this scope must use the same transportKeyPairDerivationSecret; once they do, call permits.revokeTransportKeyPair() to rotate the entry.`,"unwrapped-under-secret":`Transport key pair for scope "${t}" is stored unwrapped, but this instance is configured with a transportKeyPairDerivationSecret. A peer instance sharing this scope is running without the secret: configure the same transportKeyPairDerivationSecret everywhere, then call permits.revokeTransportKeyPair() to migrate the scope to a wrapped entry.`,"unwrap-failed":`Transport key pair for scope "${t}" failed to unwrap. This usually means another instance created it with a different transportKeyPairDerivationSecret: every instance sharing this scope must use the same secret. It can also mean the stored entry is corrupted.`,"corrupt-wrapped":`Transport key pair for scope "${t}" is wrapped but structurally invalid: the stored iv or ciphertext is not a shape this wrapping scheme can produce. This usually means the stored entry is corrupted, or instances sharing this scope are running mismatched wrapping-scheme versions.`}[e]}const Te={"unwrapped-under-secret":`unwrapped transport key pair entry found while a transportKeyPairDerivationSecret is configured`,"unwrap-failed":`transport key pair entry failed to unwrap (wrong transportKeyPairDerivationSecret?)`,"corrupt-wrapped":`structurally invalid wrapped transport key pair entry`};function Ee(e,t){let n=typeof e==`number`?`wrappingVersion ${e}`:`no wrappingVersion this build recognizes`;return`Transport key pair ${t===void 0?`for this signer`:`for scope "${t}"`} was written under a wrapping scheme this SDK build cannot read (${n}). The entry is preserved instead of regenerated, since an instance that understands the scheme may still be using it: ${t===void 0?`run a build that supports it, or call permits.clear() to discard the entry deliberately`:`run a build that supports it everywhere, or call permits.revokeTransportKeyPair() to rotate the scope`}.`}var De=class{#e;#t;#n;#r;#i;#a;#o=new Map;#s=new Map;constructor(e){this.#e=e.generator,this.#t=e.storage,this.#n=e.ttl,this.#r=e.logger,this.#i=e.scope,this.#a=e.derivationSecret}#c(e){return this.#i===void 0?`signer:${e}`:B(this.#i)}#l(e){return this.#i===void 0?F(e):I(this.#i)}async readStored(e){return this.#u(this.#l(e),this.#c(e))}async#u(e,n){let r=await this.#t.get(e);if(r==null)return null;let i=Se(r);if(i.kind===`unsupported-version`)throw this.#f(e,Ee(i.version,this.#i));if(i.kind===`unrecognized`)return await this.#m(e,`malformed transport key pair entry`),null;let a=this.#a;if(a===void 0)return i.kind===`plaintext`?await this.#p(e,i.keyPair.expiresAt)?null:i.keyPair:this.#d(e,`wrapped-without-secret`);if(i.kind===`plaintext`)return this.#d(e,`unwrapped-under-secret`);if(i.kind===`corrupt-wrapped`)return this.#d(e,`corrupt-wrapped`);if(await this.#p(e,i.expiresAt))return null;try{return await i.decode(a,n)}catch(n){if(!ie(n))throw this.#r.error(`transport key pair unwrap failed unexpectedly`,{key:e,error:n}),new t.s(`Transport key pair unwrap failed unexpectedly.`,{cause:n});return this.#d(e,`unwrap-failed`,n)}}async#d(e,t,n){if(this.#i!==void 0)throw this.#f(e,we(t,this.#i),n);if(t===`wrapped-without-secret`)throw this.#f(e,`Transport key pair for this signer is wrapped, but this instance has no transportKeyPairDerivationSecret configured. Configure the same transportKeyPairDerivationSecret the entry was written with. To downgrade to plaintext at rest on purpose, discard the stored entry first by calling permits.clear(), then run without the secret.`,n);let r=Te[t];return this.#r.warn(r,{key:e}),await this.#m(e,r),null}#f(e,n,r){return this.#r.error(n,{key:e}),new t.s(n,{cause:r})}async#p(e,t){return a.d()<t?!1:(await this.#m(e,`expired transport key pair entry`),!0)}async#m(e,t){this.#r.debug(`discarding transport key pair entry`,{key:e,reason:t}),await n.j(`delete transport key pair entry`,()=>this.#t.delete(e),this.#r)}async getOrCreate(e,t){return this.#h(this.#l(e),this.#c(e),{strict:t?.strict})}async#h(e,r,i){let o=i?.strict??!1,s=`${e}::${o}`,c=this.#o.get(s);if(c)return c;let l=this.#s.get(e)??0,u=(async()=>{let i=await this.#u(e,r);if(i!==null)return i;let s=await this.#e(),c=a.d(),u=c+this.#n,d={publicKey:s.publicKey,privateKey:s.privateKey,createdAt:c,expiresAt:u};s.tkmsVersion&&(d.tkmsVersion=s.tkmsVersion);let f=d;if(this.#a!==void 0)try{f=await Ce(d,this.#a,r)}catch(n){let r=`Failed to wrap the transport private key for at-rest storage.`;throw this.#r.error(r,{key:e,error:n}),new t.s(r,{cause:n})}if((this.#s.get(e)??0)===l)o?await this.#t.set(e,f):await n.j(`persist transport key pair`,()=>this.#t.set(e,f),this.#r);else if(o)throw new t.f(`The transport key pair was rotated while it was being generated, so the freshly generated key pair could not be persisted. Retry.`);return d})().finally(()=>{this.#o.delete(s)});return this.#o.set(s,u),u}async clear(e){let t=F(e);await n.j(`delete transport key pair entry`,()=>this.#t.delete(t),this.#r)}async evict(e){let t=this.#l(e);await n.j(`evict transport key pair entry`,()=>this.#t.delete(t),this.#r)}async clearScope(){if(this.#i===void 0)return;let e=I(this.#i);this.#s.set(e,(this.#s.get(e)??0)+1),await this.#t.delete(e)}async warmScope(){this.#i!==void 0&&await this.#h(I(this.#i),B(this.#i),{strict:!0})}};function V(e){return i.t(he,e)}function H(e,t){return{...e,...t}}function U(e){return e.version===2&&e.contractAddresses.length===0}function Oe(e,t){return U(e)||e.contractAddresses.includes(t)}function W(e,t){return U(e)||e.contractAddresses.some(e=>t.has(e))}function G(e,t){if(e.some(U))return[];let n=new Set(e.flatMap(e=>e.contractAddresses));return t.filter(e=>!n.has(e))}function K(e){let t=[];for(let n=0;n<e.length;n+=10)t.push(e.slice(n,n+10));return t}function ke(e){return e.version===1?e.durationDays*a.c:e.durationSeconds}function Ae(e,t,n){return e.filter(e=>e.keypairPublicKey===t&&n<e.startTimestamp+ke(e))}function je(e,t){let n=new Set(t);return e.filter(e=>!W(e,n))}function q(e,t){return[...new Set([...e,...t])].sort()}function Me(e,t,n){let r=new Set(n),i=e.filter(e=>!U(e)&&new Set([...e.contractAddresses,...t]).size<=10);if(i.length===0)return null;function a(e){return e.contractAddresses.reduce((e,t)=>e+ +!!r.has(t),0)}let o=Math.max(...i.map(a));return i.filter(e=>a(e)===o).reduce((e,t)=>t.startTimestamp>e.startTimestamp?t:e)}function Ne(e){return typeof e!=`object`||!e||Array.isArray(e)||`version`in e?e:{...e,version:1}}var Pe=class{#e;#t;constructor(e){this.#e=e.storage,this.#t=e.logger}async list(e){let t=R(e),n=await this.#e.get(t);if(n==null)return[];let r=Array.isArray(n)?n.map(Ne):n,i=de.safeParse(r);return i.success?i.data:(await this.clearScope(e),[])}async listUsableAndPrune(e,t){let r=await this.list(e),i=Ae(r,t,Math.floor(Date.now()/1e3));return i.length!==r.length&&(i.length===0?await this.clearScope(e):await n.j(`update permit entry`,()=>this.#e.set(R(e),i),this.#t)),i}async append(e,t){if(t.length===0)return;let n=t.map(e=>j.parse(e)),r=await this.list(e);await this.#e.set(R(e),[...r,...n]),await this.#a(e)}async replace(e,t,n){let r=j.parse(n),i=(await this.list(e)).filter(e=>e.serializedPermit.signature!==t);await this.#e.set(R(e),[...i,r]),await this.#a(e)}async deletePermitsTouching(e,t){let n=await this.list(e);if(n.length===0)return;let r=je(n,t);r.length===0?await this.clearScope(e):await this.#e.set(R(e),r)}async clearScope(e){await this.#s(R(e)),await this.#o(e)}async clearAllForSigner(e){await this.#n(e,()=>!0)}async clearAllForSignerOnChain(e,t){let n=L(e,t);await this.#n(e,e=>e.startsWith(n))}async#n(e,t){let n=z(e),r=await this.#i(n),i=r.filter(t);r.length>0&&i.length===0||(await Promise.all(i.map(e=>this.#s(e))),await this.#r(n,r.filter(e=>!t(e))))}async#r(e,t){t.length===0?await n.j(`delete permit index`,()=>this.#e.delete(e),this.#t):await n.j(`update permit index`,()=>this.#e.set(e,t),this.#t)}async#i(e){let t=await this.#e.get(e);if(t==null)return[];let r=fe.safeParse(t);return r.success?r.data:(await n.j(`delete permit index`,()=>this.#e.delete(e),this.#t),[])}async#a(e){let t=z(e.signerAddress),n=R(e),r=await this.#i(t);r.includes(n)||await this.#e.set(t,[...r,n])}async#o(e){let t=z(e.signerAddress),n=R(e),r=await this.#i(t),i=r.filter(e=>e!==n);i.length!==r.length&&await this.#r(t,i)}async#s(e){await n.j(`delete permit entry`,()=>this.#e.delete(e),this.#t)}};async function J(e,t,n){let r=e.get(t);if(r!==void 0)return r;let i=await n();return e.set(t,i),i}const Fe=30*a.c;var Ie=class{#e;#t;#n;#r;#i;#a;#o;#s;#c=new Map;constructor(e){this.#e=new De({generator:async()=>{let t=e.router.relayer,n=await t.generateTransportKeyPair();return t.serializeTransportKeyPair({transportKeyPair:n})},storage:e.storage,ttl:e.transportKeyPairTTL,logger:e.logger,scope:e.scope,derivationSecret:e.derivationSecret}),this.#t=new Pe({storage:e.permitStorage??e.storage,logger:e.logger}),this.#n=e.router,this.#r=e.signer,this.#i=e.permitTTL,this.#a=e.logger,this.#o=e.emitEvent,this.#s=e.scope}#l(e){if(!this.#r)throw new n.W(e);return this.#r}#u(e,r,i=``){let a=t.r(r,{operation:e});return i&&(a.message=i+a.message),this.#o({type:n.H.PermitError,operation:e,error:a}),a}async#d(){if(this.#n.chain.protocolConfigContractAddress===void 0)return 1;try{return await this.#n.relayer.canUseUnifiedDecryptionPermit()?2:1}catch{return 1}}async grantPermit(e,r){let i=r===void 0?`grantPermit`:`grantDelegationPermit`,o=e===a.l,s,c,l;try{s=n.F(this.#l(`grantPermit`).requireWalletAccount(`grantPermit`).address),c=o?[]:a.u(e),l=this.#p(s,r)}catch(e){throw this.#u(i,e)}let u=await this.#e.getOrCreate(s);if(o){let e;try{e=await this.#t.listUsableAndPrune(l,u.publicKey)}catch(e){throw this.#u(i,e)}let r=e.find(U);if(r)return{keypair:u,permissions:[r]};if(await this.#d()===1)throw this.#u(i,t._(`grantPermit`));let a=await this.#m({version:2,chunk:[],keypair:u,scope:l});return await n.j(`persist permit`,()=>this.#t.append(l,[a]),this.#a),{keypair:u,permissions:[a]}}if(c.length===0)return{keypair:u,permissions:[]};let d;try{d=await this.#t.listUsableAndPrune(l,u.publicKey)}catch(e){throw this.#u(i,e)}let f=G(d,c);if(f.length>0){let e=await this.#d(),t=Me(d,f,c);if(t!==null){let r=q(t.contractAddresses,f),i=await this.#m({version:e,chunk:r,keypair:u,scope:l});await n.j(`replace permit`,()=>this.#t.replace(l,t.serializedPermit.signature,i),this.#a),d[d.indexOf(t)]=i}else for(let t of K(f)){let r=await this.#m({version:e,chunk:t,keypair:u,scope:l});d.push(r),await n.j(`persist permit`,()=>this.#t.append(l,[r]),this.#a)}}let p=new Set(c);return{keypair:u,permissions:d.filter(e=>W(e,p))}}async preparePermit(t){let r=t.contracts===`wildcard`?0:a.u(t.contracts).length;if(r>10)throw new e.t(`preparePermit: request.contracts must not exceed 10 addresses (got ${r}). Use batchPreparePermits to split them across permits.`);let[i]=await this.batchPreparePermits(t);return n.P(i,`batchPreparePermits result`),i}async batchPreparePermits(r){let o=n.F(r.signer),s=r.contracts===a.l,c=r.contracts===`wildcard`?[]:a.u(r.contracts);if(!s&&c.length===0)throw new e.t(`request.contracts must not be empty.`);let l=r.delegator?n.F(r.delegator):void 0;if(l!==void 0&&l===o)throw new e.t(`request.delegator must differ from request.signer: self-delegation is not allowed.`);let u=(r.durationDays===void 0?this.#i:i.t(D,r.durationDays))*a.c,d=this.#n.relayer,f=await this.#e.getOrCreate(o,{strict:!0}),p=await d.parseTransportKeyPair(f),m=a.d(),h=await this.#d();if(s&&h===1)throw t._(`preparePermit`);let g=s?2:h,_=s?[[]]:K(c);try{return await Promise.all(_.map(async e=>{let t=g===2?await d.createUnsignedUnifiedDecryptionPermitEip712({transportKeyPair:p,contractAddresses:e,startTimestamp:m,durationSeconds:u,signerAddress:o}):await d.createUnsignedLegacyDecryptionPermitEip712({transportKeyPair:p,contractAddresses:e,startTimestamp:m,durationSeconds:u,...l&&{delegatorAddress:l}}),n=a.f(O.parse(t));return g===2?{version:2,eip712:n,signerAddress:o,...l&&{delegatorAddress:l}}:{version:1,eip712:n,signerAddress:o}}))}catch(e){throw t.g(`preparePermit`,e)??e}}async batchRegisterPermits(t){if(t.length===0)throw new e.t(`permits must not be empty.`);let r={relayer:this.#n.relayer,activeChainId:this.#n.chain.id,storedKeyPairs:new Map,transportKeyPairs:new Map},i=[];for(let[e,{prepared:n,signature:a}]of t.entries()){let o=t.length>1?`permits[${e}]: `:``;i.push(await this.#f(n,a,r,o))}for(let{scope:e,permission:t}of i)await n.j(`replace permit`,()=>this.#t.replace(e,t.serializedPermit.signature,t),this.#a)}async#f(e,r,{relayer:o,activeChainId:s,storedKeyPairs:c,transportKeyPairs:l},u){let d;try{d=V(e)}catch(e){throw this.#u(`registerPermit`,e,u)}let{domain:f,message:p}=d.eip712,m=Number(f.chainId);if(m!==s)throw this.#u(`registerPermit`,new t.l({preparedChainId:m,activeChainId:s}),u);let h=Number(p.startTimestamp),g=d.version===2?Number(p.durationSeconds):Number(p.durationDays)*a.c;if(a.d()>=h+g)throw this.#u(`registerPermit`,new t.u(`registerPermit: the prepared permit's validity window (starting ${h}, ${g}s) has already elapsed. Prepare the permit again.`),u);let _=d.signerAddress,v=await J(c,_,()=>this.#e.readStored(_));if(v===null||v.publicKey!==p.publicKey)throw new t.f(`${u}registerPermit: the transport key pair changed since the permit was prepared. Prepare it again to rebind the signature request to the current key pair.`);try{let e=await J(l,_,()=>o.parseTransportKeyPair(v)),t=await o.parseSignedDecryptionPermit({serializedPermit:{version:d.version,eip712:d.eip712,signature:r,signerAddress:_,...d.version===2&&d.delegatorAddress&&{delegatorAddress:d.delegatorAddress}},transportKeyPair:e}),c=i.t(k,await o.serializeSignedDecryptionPermit({signedPermit:t})),u=H({keypairPublicKey:v.publicKey,contractAddresses:a.u(t.version===2?t.eip712.message.allowedContracts:t.eip712.message.contractAddresses),serializedPermit:c,startTimestamp:Number(t.eip712.message.startTimestamp)},t.version===2?{version:2,durationSeconds:Number(t.eip712.message.durationSeconds)}:{version:1,durationDays:Number(t.eip712.message.durationDays)});return{scope:{signerAddress:_,chainId:s,delegatorAddress:n.F(t.encryptedDataOwnerAddress)},permission:u}}catch(e){throw this.#u(`registerPermit`,e,u)}}async hasPermit(e,r){if(e.length===0)return!0;let i=this.#r?.walletAccount.getSnapshot();if(!i)return!1;let o=n.F(i.address),s;try{s=await this.#e.readStored(o)}catch(e){if(!(e instanceof t.s))throw e;return!1}if(s===null)return!1;let c=this.#p(o,r);return G(await this.#t.listUsableAndPrune(c,s.publicKey),a.u(e)).length===0}async revokePermits(e){let t=n.F(this.#l(`revokePermits`).requireWalletAccount(`revokePermits`).address);if(e===void 0){await this.#t.clearAllForSigner(t);return}let r=a.u(e);r.length!==0&&await this.#t.deletePermitsTouching(this.#p(t),r)}async clearPermitsAfterInvalidation(e){await n.j(`clear permits after invalidation`,()=>this.#t.clearAllForSignerOnChain(e,this.#n.chain.id),this.#a)}#p(e,t){return{signerAddress:e,chainId:this.#n.chain.id,delegatorAddress:t?n.F(t):e}}async clearCredentials(){let e=n.F(this.#l(`clearCredentials`).requireWalletAccount(`clearCredentials`).address);await this.#e.clear(e),await this.#t.clearAllForSigner(e)}async revokeTransportKeyPair(t){if(this.#s===void 0)throw new e.t(`revokeTransportKeyPair() requires a transportKeyPairScope to be configured on this SDK instance — there is no shared key pair to revoke.`);if(t!==this.#s)throw new e.t(`revokeTransportKeyPair("${t}") does not match the configured scope ("${this.#s}").`);await this.#e.clearScope()}async warmTransportKeyPair(e){await this.#e.getOrCreate(n.F(e))}async warmTransportKeyPairScope(t){if(this.#s===void 0)throw new e.t(`warmTransportKeyPairScope() requires a transportKeyPairScope to be configured on this SDK instance — there is no shared key pair to warm.`);if(t!==this.#s)throw new e.t(`warmTransportKeyPairScope("${t}") does not match the configured scope ("${this.#s}").`);await this.#e.warmScope()}async handleWalletAccountChange(e,t){let r=e?n.F(e.address):void 0;r!==(t?n.F(t.address):void 0)&&r&&(await this.#e.clear(r),await this.#t.clearAllForSigner(r))}async#m(n){let{version:r,chunk:o,keypair:s,scope:c}=n,l=a.d(),u=c.delegatorAddress!==c.signerAddress,d=this.#n.relayer;try{let e=await d.parseTransportKeyPair(s),t=this.#i*a.c,n={transportKeyPair:e,contractAddresses:o,startTimestamp:l,durationSeconds:t,signerAddress:c.signerAddress,signer:this.#l(`signPermit`)},f=await(r===2?d.signUnifiedDecryptionPermit:d.signDecryptionPermit)(u?{...n,delegatorAddress:c.delegatorAddress}:n),p=i.t(k,await d.serializeSignedDecryptionPermit({signedPermit:f}));return H({keypairPublicKey:s.publicKey,contractAddresses:o,serializedPermit:p,startTimestamp:l},r===2?{version:2,durationSeconds:t}:{version:1,durationDays:this.#i})}catch(n){let r=u?`grantDelegationPermit`:`grantPermit`,i=n instanceof e.r?void 0:t.g(`grantPermit`,n);throw i?this.#u(r,i):(!(n instanceof e.r)&&n instanceof Error&&e.p(n.message)&&await this.#e.evict(c.signerAddress),this.#u(r,n))}}async evictTransportKeyPair(){let e=this.#r?.walletAccount.getSnapshot();e&&await this.#e.evict(n.F(e.address))}async recoverPermits(e,t,r){let i=this.#l(`recoverPermits`).requireWalletAccount(`recoverPermits`),o=this.#p(n.F(i.address),t),s=R(o),c=this.#c.get(s);if(c)return await c,this.grantPermit(e,t);let l=await this.#h(o),u=this.#c.get(s);if(u)return await u,this.grantPermit(e,t);if(l===null)return this.grantPermit(e,t);let d=new Set(r??[]);if(d.size>0&&!l.some(e=>d.has(e.serializedPermit.signature)))return this.grantPermit(e,t);let f=l.filter(e=>!d.has(e.serializedPermit.signature)),p=l.some(U)?a.l:q(l.flatMap(e=>e.contractAddresses),a.u(e)),m=this.#g(o,p,f,t).finally(()=>{this.#c.delete(s)});return this.#c.set(s,m),await m,this.grantPermit(e,t)}async#h(e){try{return await this.#t.list(e)}catch(e){return this.#a.warn(`read permits for recovery failed`,{error:e}),null}}async#g(e,t,r,i){await n.j(`evict revoked permits`,()=>this.#t.clearScope(e),this.#a);try{await this.grantPermit(t,i)}catch(t){throw r.length>0&&await n.j(`restore surviving permits`,async()=>{let t=await this.#t.list(e),n=new Set(t.map(e=>e.serializedPermit.signature)),i=r.filter(e=>!n.has(e.serializedPermit.signature));i.length>0&&await this.#t.append(e,i)},this.#a),t}}},Le=class{#e;#t=`[zama-sdk]`;constructor(e){this.#e=e}error(e,t){this.#e?.error(`${this.#t} ${e}`,t)}warn(e,t){this.#e?.warn(`${this.#t} ${e}`,t)}info(e,t){this.#e?.info(`${this.#t} ${e}`,t)}debug(e,t){this.#e?.debug(`${this.#t} ${e}`,t)}warnAlways(e){console.warn(`${this.#t} ${e}`),this.warn(e)}};const Y={[o.o.id]:o.o.registryAddress,[o.s.id]:o.s.registryAddress,[o.l.id]:o.l.registryAddress,[o.c.id]:o.c.registryAddress,[o.a.id]:o.a.registryAddress,[o.u.id]:o.u.registryAddress,[o.n.id]:o.n.registryAddress},X=l.z.record(l.z.string().check(l.z.regex(/^\d+$/,`expected numeric chain id key`)),n.I),Z=n.R,Q=300*1e3;var Re=class{provider;#e;#t;#n=new Map;constructor(e){this.provider=e.provider,this.#e=Object.assign({},Y,i.t(l.z.optional(X),e.registryAddresses)),this.#t=i.t(Z,e.registryTTL??86400)*1e3}getAddress(e){return this.#e[e]}#r(e){let t=this.#n.get(e);if(t){if(Date.now()>=t.expiresAt){this.#n.delete(e);return}return t.data}}#i(e,t,n=this.#t){return this.#n.set(e,{data:t,expiresAt:Date.now()+n}),t}refresh(){this.#n.clear()}get ttlMs(){return this.#t}async getRegistryAddress(){let t=await this.provider.getChainId(),n=this.#e[t];if(!n)throw new e.t(`No wrappers registry address configured for chain ${t}.\nPass a registryAddresses entry for this chain.`);return(0,s.getAddress)(n)}async listPairs(t={}){let n=t.page??1,r=t.pageSize??100,i=t.metadata??!1;if(n<1)throw new e.t(`page must be >= 1, got ${n}`);if(r<1)throw new e.t(`pageSize must be >= 1, got ${r}`);let o=await this.getRegistryAddress(),s=`total:${o}`,c=this.#r(s);if(c===void 0){let e=await this.provider.readContract(a.a(o));c=this.#i(s,Number(e))}let l=BigInt((n-1)*r),u=l+BigInt(r)>BigInt(c)?BigInt(c):l+BigInt(r);if(l>=BigInt(c))return{items:[],total:c,page:n,pageSize:r};let d=`slice:${o}:${l}:${u}`,f=this.#r(d);if(f===void 0){let e=await this.provider.readContract(a.o(o,l,u));f=this.#i(d,[...e])}if(!i)return{items:f,total:c,page:n,pageSize:r};let p=`metadata:${o}:${l}:${u}`,m=this.#r(p);if(m===void 0){let e=await Promise.allSettled(f.map(e=>this.#a(e))),t=e.some(e=>e.status===`rejected`),n=e.map((e,t)=>e.status===`fulfilled`?e.value:Object.assign({},f[t],{metadataFailed:!0,underlying:{name:`Unknown`,symbol:`???`,decimals:0,totalSupply:0n},confidential:{name:`Unknown`,symbol:`???`,decimals:0}}));m=this.#i(p,n,t?Q:void 0)}return{items:m,total:c,page:n,pageSize:r}}async#a(e){let[t,r,i,a,o,s,c]=await Promise.all([this.provider.readContract(n.p(e.tokenAddress)),this.provider.readContract(n.m(e.tokenAddress)),this.provider.readContract(n.d(e.tokenAddress)),this.provider.readContract(n.f(e.tokenAddress)),this.provider.readContract(n.p(e.confidentialTokenAddress)),this.provider.readContract(n.m(e.confidentialTokenAddress)),this.provider.readContract(n.d(e.confidentialTokenAddress))]);return{...e,underlying:{name:t,symbol:r,decimals:i,totalSupply:a},confidential:{name:o,symbol:s,decimals:c}}}async getConfidentialToken(e){let t=await this.getRegistryAddress(),n=(0,s.getAddress)(e),r=`ct:${t}:${n}`,i=this.#r(r);if(i!==void 0)return i;let[o,c]=await this.provider.readContract(a.t(t,n));return c===s.zeroAddress?this.#i(r,null,Q):this.#i(r,{confidentialTokenAddress:c,isValid:o})}async getUnderlyingToken(e){let t=await this.getRegistryAddress(),n=(0,s.getAddress)(e),r=`ut:${t}:${n}`,i=this.#r(r);if(i!==void 0)return i;let[o,c]=await this.provider.readContract(a.n(t,n));return c===s.zeroAddress?this.#i(r,null,Q):this.#i(r,{tokenAddress:c,isValid:o})}async getTokenPairs(){let e=await this.getRegistryAddress();return this.provider.readContract(a.i(e))}async getTokenPairsLength(){let e=await this.getRegistryAddress();return this.provider.readContract(a.a(e))}async getTokenPairsSlice(e,t){let n=await this.getRegistryAddress();return this.provider.readContract(a.o(n,e,t))}async getTokenPair(e){let t=await this.getRegistryAddress();return this.provider.readContract(a.r(t,e))}async getConfidentialTokenAddress(e){let t=await this.getRegistryAddress();return this.provider.readContract(a.t(t,(0,s.getAddress)(e)))}async getTokenAddress(e){let t=await this.getRegistryAddress();return this.provider.readContract(a.n(t,(0,s.getAddress)(e)))}async isConfidentialTokenValid(e){let t=await this.getRegistryAddress();return this.provider.readContract(a.s(t,(0,s.getAddress)(e)))}};function ze(e,t,n){let a=new Le(n.logger),o=n.logger,s={wasmAssetLoadMode:`auto`,moduleVersions:`auto`,logger:{error:(e,t)=>o?.error(e,{cause:t}),warn:e=>o?.warn(e),debug:e=>o?.debug(e)},...n.runtime};if((0,c.hasFhevmRuntimeConfig)()){let e=`runtime configuration is already set and cannot be changed.`;n.runtime===void 0?a.debug(e):a.warn(e)}else(0,c.setFhevmRuntimeConfig)(s),r.r(s);let{storage:l,permitStorage:u}=h(n.storage,n.permitStorage),d=n.telemetry===!1?void 0:{layer:`core`},f=new _(n.chains,n.relayers,a,d);return{chains:n.chains,router:f,provider:t,signer:e,storage:l,permitStorage:u,transportKeyPairTTL:i.t(ae,n.transportKeyPairTTL??Fe),permitTTL:i.t(D,n.permitTTL??30),clearCredentialsOnWalletChange:n.clearCredentialsOnWalletChange??!0,transportKeyPairScope:n.transportKeyPairScope===void 0?void 0:i.t(oe,n.transportKeyPairScope),registryTTL:i.t(Z,n.registryTTL??86400),logger:a,onEvent:n.onEvent,telemetry:d}}function Be(e,t){return e?.address===t?.address&&e?.chainId===t?.chainId}var $=class{#e=new Set;#t;#n;constructor(e){this.#t=e,this.#n=e!==void 0}getSnapshot(){return this.#t}isReady(){return this.#n}setSnapshot(e){this.#n=!0;let t=this.#t;Be(t,e)||(this.#t=e,this.#r({previous:t,next:e}))}subscribe(e){this.#e.add(e);let t=this.#t;return t&&e({previous:void 0,next:t}),()=>{this.#e.delete(e)}}#r(e){for(let t of this.#e)t(e)}};function Ve(e){return new $(e)}var He=class{walletAccount;#e=!1;constructor(e){this.walletAccount=new $(e)}requireWalletAccount(e){let t=this.walletAccount.getSnapshot();if(!t)throw new n.q(e);return t}dispose(){this.#e||(this.#e=!0,this.onDispose())}[Symbol.dispose](){this.dispose()}onDispose(){}};Object.defineProperty(exports,"a",{enumerable:!0,get:function(){return Y}}),Object.defineProperty(exports,"c",{enumerable:!0,get:function(){return Oe}}),Object.defineProperty(exports,"d",{enumerable:!0,get:function(){return te}}),Object.defineProperty(exports,"f",{enumerable:!0,get:function(){return f}}),Object.defineProperty(exports,"h",{enumerable:!0,get:function(){return d}}),Object.defineProperty(exports,"i",{enumerable:!0,get:function(){return ze}}),Object.defineProperty(exports,"l",{enumerable:!0,get:function(){return V}}),Object.defineProperty(exports,"m",{enumerable:!0,get:function(){return u}}),Object.defineProperty(exports,"n",{enumerable:!0,get:function(){return $}}),Object.defineProperty(exports,"o",{enumerable:!0,get:function(){return Re}}),Object.defineProperty(exports,"p",{enumerable:!0,get:function(){return p}}),Object.defineProperty(exports,"r",{enumerable:!0,get:function(){return Ve}}),Object.defineProperty(exports,"s",{enumerable:!0,get:function(){return Ie}}),Object.defineProperty(exports,"t",{enumerable:!0,get:function(){return He}}),Object.defineProperty(exports,"u",{enumerable:!0,get:function(){return se}});
 //# sourceMappingURL=base-signer.cjs.map