Ship the encryptor in a bundle or a server

/// <reference types="vite/client" />
import encryptWorkerUrl from "@zama-fhe/sdk/encrypt.worker.js?url";
import { createSepoliaEncryptorWeb } from "@tokenops/sdk/fhe/web";

// vite dev pre-bundles @zama-fhe/sdk into node_modules/.vite/deps, where
// ./encrypt.worker.js does not exist. A ?url import works in dev and build.
const encryptor = await createSepoliaEncryptorWeb({
  publicClient,
  walletClient,
  offloadWorker: encryptWorkerUrl,
});

import type { NextConfig } from "next";

const csp = [
  "default-src 'self'",
  "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'", // use nonces in production
  "worker-src 'self' blob:",
  "connect-src 'self' data: https://ethereum-rpc.publicnode.com https://*.s3.eu-west-1.amazonaws.com",
].join("; ");

const nextConfig: NextConfig = {
  async headers() {
    return [{ source: "/:path*", headers: [{ key: "Content-Security-Policy", value: csp }] }];
  },
};

export default nextConfig;

import express from "express";
import { createPublicClient, createWalletClient, http, isAddress, nonceManager, type Address } from "viem";
import { privateKeyToAccount } from "viem/accounts";
import { mainnet } from "viem/chains";
import { createSepoliaEncryptor, isTokenOpsSdkError, MAINNET_CHAIN_ID } from "@tokenops/sdk/fhe";
import { createConfidentialDisperseClient } from "@tokenops/sdk/fhe-disperse";

const rpcUrl = process.env.MAINNET_RPC_URL!;
const account = privateKeyToAccount(process.env.OPERATOR_PRIVATE_KEY as `0x${string}`, { nonceManager });
const publicClient = createPublicClient({ chain: mainnet, transport: http(rpcUrl) });
const walletClient = createWalletClient({ account, chain: mainnet, transport: http(rpcUrl) });

// One encryptor per process, built at startup and reused for every request.
const encryptor = await createSepoliaEncryptor({
  chainId: MAINNET_CHAIN_ID,
  rpcUrl,
  auth: { __type: "ApiKeyHeader", value: process.env.RELAYER_API_KEY! },
});
const disperse = createConfidentialDisperseClient({ publicClient, walletClient, encryptor });

const app = express();
app.use(express.json());

app.post("/disperse", async (req, res) => {
  const { token, recipients, amounts } = req.body as { token: string; recipients: string[]; amounts: string[] };
  if (!isAddress(token) || !recipients.every((r) => isAddress(r))) {
    res.status(400).json({ error: "invalid address" });
    return;
  }
  try {
    const { hash } = await disperse.disperse({
      token,
      mode: "direct",
      recipients: recipients as Address[],
      amounts: amounts.map((a) => BigInt(a)),
    });
    res.json({ hash });
  } catch (err) {
    if (isTokenOpsSdkError(err)) {
      res.status(422).json({ code: err.code, error: err.message });
      return;
    }
    throw err;
  }
});

const server = app.listen(3001);
process.on("SIGTERM", () => server.close(() => encryptor.terminate()));

"use client";
import { ZamaProvider } from "@zama-fhe/react-sdk";
import { sepolia as zamaSepolia } from "@zama-fhe/sdk/chains";
import { createConfig as createZamaConfig } from "@zama-fhe/sdk/viem";
import { web } from "@zama-fhe/sdk/web";
import { useMemo, type ReactNode } from "react";
import { usePublicClient, useWalletClient } from "wagmi";

// Render inside <WagmiProvider> and <QueryClientProvider>.
export function ZamaFromWagmi({ children }: { children: ReactNode }) {
  const publicClient = usePublicClient();
  const { data: walletClient } = useWalletClient();
  const config = useMemo(
    () =>
      publicClient && walletClient
        ? createZamaConfig({
            chains: [zamaSepolia],
            publicClient,
            walletClient,
            relayers: { [zamaSepolia.id]: web() },
          })
        : undefined,
    [publicClient, walletClient],
  );
  if (!config) return <p>Connect a wallet</p>;
  return <ZamaProvider config={config}>{children}</ZamaProvider>;
}

import pkg from "@tokenops/sdk/package.json" with { type: "json" };

console.log(pkg.version);