@fhevm/sdk 0.13.2 → 0.14.0-13

package/core/types/relayer-p.ts

@@ -114,8 +114,10 @@ export type FetchUserDecryptPayloadV2 = {
     // Hex encoded bytes with 0x prefix. Default: 0x00
     readonly extraData: BytesHex;
   };
-  // Hex encoded signature with 0x prefix.
-  readonly signature: Bytes65Hex;
+  // Hex encoded signature with 0x prefix. Variable length: a 65-byte EOA ECDSA
+  // signature, an ERC-1271 smart-contract-wallet blob, or the empty `0x`
+  // pre-approved-hash flow. The relayer /v3 route forwards it verbatim.
+  readonly signature: BytesHex;
 };
 
 export type FetchDelegatedUserDecryptPayload = {

package/core/types/signedDecryptionPermit.ts

@@ -3,10 +3,14 @@ import type { Bytes65Hex, BytesHex, ChecksummedAddress } from './primitives.js';
 
 /**
  * Common fields shared by all signed decryption permit versions.
+ *
+ * @typeParam Signature - The permit signature hex type. Defaults to the strict
+ *   65-byte {@link Bytes65Hex} used by the EOA path; the unified V2 permit widens
+ *   it to a variable-length {@link BytesHex} to carry ERC-1271 blobs.
  */
-export type SignedDecryptionPermitBase = {
+export type SignedDecryptionPermitBase<Signature extends BytesHex = Bytes65Hex> = {
   /** The EIP-712 signature. */
-  readonly signature: Bytes65Hex;
+  readonly signature: Signature;
   /** The account that signed the permit. */
   readonly signerAddress: ChecksummedAddress;
   /**
@@ -53,9 +57,12 @@ export type SignedDecryptionPermitV1 = SignedDecryptionPermitBase & {
  * a separate delegated variant. The `encryptedDataOwnerAddress` is read from
  * `eip712.message.userAddress` and may differ from `signerAddress`.
  *
+ * The `signature` is widened to {@link BytesHex} to carry ERC-1271 blobs (see
+ * the `Signature` type parameter on {@link SignedDecryptionPermitBase}).
+ *
  * Discriminate from {@link SignedDecryptionPermitV1} with `permit.version === 2`.
  */
-export type SignedDecryptionPermitV2 = SignedDecryptionPermitBase & {
+export type SignedDecryptionPermitV2 = SignedDecryptionPermitBase<BytesHex> & {
   readonly version: 2;
   readonly eip712: KmsUserDecryptEip712V2;
 };

package/core/utils-p/decrypt/verifyErc1271UserDecrypt-p.ts

@@ -0,0 +1,164 @@
+import type { EthCallResult } from '../../modules/ethereum/types.js';
+import type { FhevmRuntime } from '../../types/coreFhevmRuntime.js';
+import type { KmsUserDecryptEip712V2 } from '../../types/kms.js';
+import type { Bytes32Hex, Bytes65Hex, BytesHex, ChecksummedAddress } from '../../types/primitives.js';
+import {
+  Erc1271EmptySigOnEoaError,
+  Erc1271EoaMismatchNoCodeError,
+  Erc1271RejectedError,
+  Erc1271WrongMagicError,
+} from '../../errors/Erc1271Error.js';
+import { getTrustedClient } from '../../runtime/CoreFhevm-p.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * ERC-1271 magic return value of `isValidSignature(bytes32,bytes)`:
+ * `bytes4(keccak256("isValidSignature(bytes32,bytes)"))`. It doubles as the
+ * function selector, so it also prefixes the STATICCALL calldata.
+ */
+export const ERC1271_MAGIC_VALUE = '0x1626ba7e' as const;
+
+/**
+ * Gas cap for the `isValidSignature` STATICCALL. Matches the relayer / KMS
+ * default (`erc1271_gas_limit = 100000`) so all three layers bound the wallet's
+ * verification the same way.
+ */
+export const ERC1271_GAS_LIMIT = 100_000n;
+
+////////////////////////////////////////////////////////////////////////////////
+
+/** Byte length of a `0x`-prefixed hex string. */
+function byteLengthOfHex(hex: string): number {
+  return (hex.length - 2) / 2;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+export type VerifyErc1271UserDecryptContext = {
+  readonly runtime: FhevmRuntime;
+  readonly client: NonNullable<object>;
+};
+
+export type VerifyErc1271UserDecryptParameters = {
+  /** The claimed identity the signature must authenticate — the contract wallet. */
+  readonly userAddress: ChecksummedAddress;
+  /** The unified EIP-712 typed data the user signed (domain + struct + message). */
+  readonly eip712: KmsUserDecryptEip712V2;
+  /** The opaque signature blob (65-byte EOA, multisig concat, or empty `0x`). */
+  readonly signature: BytesHex;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// verifyErc1271UserDecrypt
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * Precautionary client-side port of the shared crate's `verify_signature`
+ * (`shared/user-decryption-signature/src/lib.rs`), validating a user-decryption
+ * signature against `userAddress` per RFC-012:
+ *
+ * 1. If the signature is 65 bytes and `ecrecover(digest) === userAddress`,
+ *    accept locally (EOA fast path, no RPC).
+ * 2. Otherwise STATICCALL `IERC1271(userAddress).isValidSignature(digest, sig)`
+ *    and accept iff it returns the magic value `0x1626ba7e`.
+ *
+ * This check is **precautionary, not authoritative** (the KMS runs the same
+ * algorithm and gates key release):
+ * - A **definitive** local failure (wrong magic / revert / malformed returndata /
+ *   empty signature or ecrecover mismatch on an EOA) throws — fail-fast, matching
+ *   the relayer's sync 400.
+ * - An **inconclusive** outcome (no read provider, or an RPC transport error)
+ *   logs a warning and returns, forwarding the request to the KMS.
+ *
+ * @throws {@link Erc1271VerificationError} on a definitive local rejection.
+ */
+export async function verifyErc1271UserDecrypt(
+  context: VerifyErc1271UserDecryptContext,
+  parameters: VerifyErc1271UserDecryptParameters,
+): Promise<void> {
+  const { userAddress, eip712, signature } = parameters;
+  const ethereum = context.runtime.ethereum;
+
+  const { domain, primaryType, message } = eip712;
+  const fields = eip712.types[primaryType];
+  const types = { [primaryType]: [...fields] };
+
+  const digest: Bytes32Hex = ethereum.hashTypedData({ domain, types, primaryType, message });
+
+  const sigByteLength = byteLengthOfHex(signature);
+
+  // 1. EOA fast path — local, no RPC. Only meaningful for a 65-byte signature.
+  //    An unparsable blob (or a recovered address that isn't userAddress) simply
+  //    falls through to the ERC-1271 STATICCALL, never rejecting outright.
+  if (sigByteLength === 65) {
+    try {
+      const recovered = await ethereum.recoverTypedDataAddress({
+        domain,
+        types,
+        primaryType,
+        message,
+        signature: signature as Bytes65Hex,
+      });
+      if (recovered.toLowerCase() === userAddress.toLowerCase()) {
+        return;
+      }
+    } catch {
+      // Unparsable 65-byte blob (e.g. a Safe eth_sign / approveHash shape) —
+      // fall through to ERC-1271.
+    }
+  }
+
+  // 2. ERC-1271 STATICCALL. The magic value doubles as the function selector.
+  const encodedArgs = ethereum.encode({ types: ['bytes32', 'bytes'], values: [digest, signature] });
+  const calldata = `${ERC1271_MAGIC_VALUE}${encodedArgs.slice(2)}` as BytesHex;
+
+  let result: EthCallResult;
+  try {
+    const trustedClient = getTrustedClient(context);
+    result = await ethereum.call(trustedClient, {
+      to: userAddress,
+      data: calldata,
+      gas: ERC1271_GAS_LIMIT,
+    });
+  } catch (err) {
+    // Inconclusive: no read provider or a transport-level error. The KMS is the
+    // authority — degrade gracefully and forward rather than hard-failing.
+    const reason = err instanceof Error ? err.message : String(err);
+    context.runtime.config.logger?.warn?.(
+      `ERC-1271 user-decryption signature check could not complete for userAddress ${userAddress}; ` +
+        `forwarding to the KMS (authoritative). Reason: ${reason}`,
+    );
+    return;
+  }
+
+  if (!result.success) {
+    // A clean EVM revert is a definitive rejection.
+    throw new Erc1271RejectedError({ userAddress, detail: `isValidSignature call reverted: ${result.reason}` });
+  }
+
+  const returndata = result.data;
+  const returnByteLength = byteLengthOfHex(returndata);
+
+  if (returnByteLength === 0) {
+    // STATICCALL to a no-code address succeeds with empty returndata — the
+    // dominant signal that userAddress is an EOA.
+    if (sigByteLength === 0) {
+      throw new Erc1271EmptySigOnEoaError({ userAddress });
+    }
+    throw new Erc1271EoaMismatchNoCodeError({ userAddress });
+  }
+
+  // Solidity ABI-encodes `bytes4` as a full 32-byte word; a non-compliant
+  // fallback returning fewer bytes is rejected before matching the magic value.
+  if (returnByteLength < 32) {
+    throw new Erc1271RejectedError({ userAddress, detail: `returndata length ${returnByteLength} < 32` });
+  }
+
+  const magicValue = returndata.slice(0, 10).toLowerCase();
+  if (magicValue === ERC1271_MAGIC_VALUE) {
+    return;
+  }
+
+  throw new Erc1271WrongMagicError({ userAddress, magicValue });
+}

package/ethers/internal/ethereum-ct.ts

@@ -3,8 +3,6 @@ import type {
   GeneratePrivateKeyReturnType,
   GetPublicKeyParameters,
   GetPublicKeyReturnType,
-  HashTypedDataParameters,
-  HashTypedDataReturnType,
   MnemonicToAccountParameters,
   MnemonicToAccountReturnType,
   RecoverAddressParameters,
@@ -13,19 +11,19 @@ import type {
   SignReturnType,
 } from '../../core/modules/ethereum/types-ct.js';
 import type { BytesHex, ChecksummedAddress } from '../../core/types/primitives.js';
-import type { TypedDataField } from 'ethers';
 import {
+  call,
   decode,
   encode,
   encodePacked,
   getChainId,
+  hashTypedData,
   readContract,
   recoverTypedDataAddress,
   signTypedData,
 } from './ethereum.js';
-import { SigningKey, HDNodeWallet, Wallet, TypedDataEncoder } from 'ethers';
+import { SigningKey, HDNodeWallet, Wallet } from 'ethers';
 import { sign, recoverAddress } from '../../core/base/sign.js';
-import { asBytes32Hex } from '../../core/base/bytes.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -36,9 +34,11 @@ export const cleartextEthereumModule: CleartextEthereumModuleFactory = () => {
       encode,
       encodePacked,
       recoverTypedDataAddress,
+      hashTypedData,
       signTypedData,
       getChainId,
       readContract,
+      call,
       mnemonicToAccount: (parameters: MnemonicToAccountParameters): MnemonicToAccountReturnType => {
         const signer = HDNodeWallet.fromPhrase(parameters.mnemonic, undefined, parameters.path);
         return {
@@ -60,16 +60,6 @@ export const cleartextEthereumModule: CleartextEthereumModuleFactory = () => {
         const recoveredAddress = recoverAddress(parameters);
         return Promise.resolve(recoveredAddress);
       },
-      hashTypedData: (parameters: HashTypedDataParameters): HashTypedDataReturnType => {
-        const primaryTypeFields = parameters.types[parameters.primaryType];
-        if (primaryTypeFields === undefined) {
-          throw new Error(`Primary type "${parameters.primaryType}" not found in types`);
-        }
-        const typesToHash: Record<string, TypedDataField[]> = {
-          [parameters.primaryType]: [...primaryTypeFields],
-        };
-        return asBytes32Hex(TypedDataEncoder.hash(parameters.domain, typesToHash, parameters.message));
-      },
     }),
   });
 };

package/ethers/internal/ethereum.ts

@@ -5,8 +5,12 @@ import type {
   EncodePackedReturnType,
   EncodeParameters,
   EncodeReturnType,
+  EthCallParameters,
+  EthCallResult,
   EthereumModuleFactory,
   GetChainIdReturnType,
+  HashTypedDataParameters,
+  HashTypedDataReturnType,
   TrustedClient,
   ReadContractParameters,
   RecoverTypedDataAddressParameters,
@@ -17,10 +21,10 @@ import type {
 } from '../../core/modules/ethereum/types.js';
 import type { ethers as EthersT } from 'ethers';
 import type { TypedDataField } from 'ethers';
-import type { BytesHex } from '../../core/types/primitives.js';
+import type { Bytes32Hex, BytesHex } from '../../core/types/primitives.js';
 import { asChecksummedAddress } from '../../core/base/address.js';
-import { AbiCoder, solidityPacked, verifyTypedData } from 'ethers';
-import { getEthersContract, getNetwork } from './utils.js';
+import { AbiCoder, TypedDataEncoder, solidityPacked, verifyTypedData } from 'ethers';
+import { getEthersContract, getEthersProvider, getNetwork } from './utils.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 // encodePacked
@@ -78,6 +82,26 @@ export function decode(parameters: DecodeParameters): DecodeReturnType {
   return abiCoder.decode(parameters.types, parameters.encodedData);
 }
 
+////////////////////////////////////////////////////////////////////////////////
+// hashTypedData
+////////////////////////////////////////////////////////////////////////////////
+
+export function hashTypedData(parameters: HashTypedDataParameters): HashTypedDataReturnType {
+  const { primaryType, types, domain, message } = parameters;
+
+  // ethers rejects EIP712Domain in the types map and expects a single primary
+  // struct; mirror recoverTypedDataAddress/signTypedData by filtering to it.
+  const primaryTypeFields = types[primaryType];
+  if (primaryTypeFields === undefined) {
+    throw new Error(`Primary type "${primaryType}" not found in types`);
+  }
+  const typesToHash: Record<string, TypedDataField[]> = {
+    [primaryType]: primaryTypeFields,
+  };
+
+  return TypedDataEncoder.hash(domain, typesToHash, message) as Bytes32Hex;
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // readContract
 ////////////////////////////////////////////////////////////////////////////////
@@ -91,6 +115,35 @@ export async function readContract(
   return result;
 }
 
+////////////////////////////////////////////////////////////////////////////////
+// call (raw eth_call / STATICCALL)
+////////////////////////////////////////////////////////////////////////////////
+
+export async function call(
+  hostPublicClient: TrustedClient<EthersT.ContractRunner>,
+  parameters: EthCallParameters,
+): Promise<EthCallResult> {
+  const provider = getEthersProvider(hostPublicClient);
+  try {
+    const data = await provider.call({
+      to: parameters.to,
+      data: parameters.data,
+      ...(parameters.gas !== undefined ? { gasLimit: parameters.gas } : {}),
+    });
+    // ethers' `Provider.call` always resolves to a hex string ('0x' for empty).
+    return { success: true, data: data as BytesHex };
+  } catch (err) {
+    // ethers tags a clean EVM revert as CALL_EXCEPTION — a definitive rejection.
+    // Anything else is transport-level and rethrown so the precautionary caller
+    // can degrade gracefully.
+    if (typeof err === 'object' && err !== null && (err as { code?: unknown }).code === 'CALL_EXCEPTION') {
+      const reason = err instanceof Error ? err.message : 'isValidSignature call reverted';
+      return { success: false, reason };
+    }
+    throw err;
+  }
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // getChainId
 ////////////////////////////////////////////////////////////////////////////////
@@ -157,9 +210,11 @@ export const ethereumModule: EthereumModuleFactory = () => {
       encode,
       encodePacked,
       recoverTypedDataAddress,
+      hashTypedData,
       signTypedData,
       getChainId,
       readContract,
+      call,
     }),
   });
 };

package/ethers/internal/utils.ts

@@ -30,6 +30,33 @@ export async function getNetwork(hostPublicClient: TrustedClient<EthersT.Contrac
   throw new Error('Cannot get network: client is neither a Provider nor a ContractRunner with a provider.');
 }
 
+/**
+ * Get an ethers `Provider` from an unknown client.
+ * Supports a `Provider` directly, or a `ContractRunner` that carries one.
+ */
+export function getEthersProvider(hostPublicClient: TrustedClient<EthersT.ContractRunner>): EthersT.Provider {
+  const runner = trustedClientToEthersContractRunner(hostPublicClient);
+
+  if ((runner as unknown) === undefined || (runner as unknown) === null) {
+    throw new Error('Cannot get provider: client is null or undefined.');
+  }
+
+  const runnerRecord = runner as unknown as Record<string, unknown>;
+  if (
+    typeof runner === 'object' &&
+    typeof runnerRecord.call === 'function' &&
+    typeof runnerRecord.getNetwork === 'function'
+  ) {
+    return runner as unknown as EthersT.Provider;
+  }
+
+  if (runner.provider != null) {
+    return runner.provider;
+  }
+
+  throw new Error('Cannot get provider: client is neither a Provider nor a ContractRunner with a provider.');
+}
+
 // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-parameters
 export function getEthersContract<C>(
   hostPublicClient: TrustedClient<EthersT.ContractRunner>,

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@fhevm/sdk",
   "description": "TypeScript Interface for FHEVM",
-  "version": "0.13.2",
+  "version": "0.14.0-13",
   "type": "module",
   "main": "./_cjs/index.js",
   "module": "./_esm/index.js",
@@ -103,7 +103,7 @@
   "dependencies": {
     "@noble/curves": "2.0.1",
     "@noble/hashes": "2.0.1",
-    "wasm-feature-detect": "^1.8.0"
+    "wasm-feature-detect": "1.8.0"
   },
   "repository": {
     "type": "git",

package/viem/internal/ethereum-ct.ts

@@ -3,8 +3,6 @@ import type {
   GeneratePrivateKeyReturnType,
   GetPublicKeyParameters,
   GetPublicKeyReturnType,
-  HashTypedDataParameters,
-  HashTypedDataReturnType,
   MnemonicToAccountParameters,
   MnemonicToAccountReturnType,
   RecoverAddressParameters,
@@ -15,16 +13,18 @@ import type {
 import type { Bytes65Hex, BytesHex, ChecksummedAddress } from '../../core/types/primitives.js';
 import { generatePrivateKey, mnemonicToAccount, privateKeyToAccount, sign } from 'viem/accounts';
 import {
+  call,
   decode,
   encode,
   encodePacked,
   getChainId,
+  hashTypedData,
   readContract,
   recoverTypedDataAddress,
   signTypedData,
 } from './ethereum.js';
-import { asBytes32Hex, bytesToHex } from '../../core/base/bytes.js';
-import { hashTypedData, recoverAddress } from 'viem';
+import { bytesToHex } from '../../core/base/bytes.js';
+import { recoverAddress } from 'viem';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -35,9 +35,11 @@ export const cleartextEthereumModule: CleartextEthereumModuleFactory = () => {
       encode,
       encodePacked,
       recoverTypedDataAddress,
+      hashTypedData,
       signTypedData,
       getChainId,
       readContract,
+      call,
       mnemonicToAccount: (parameters: MnemonicToAccountParameters): MnemonicToAccountReturnType => {
         const signer = mnemonicToAccount(parameters.mnemonic, { path: parameters.path });
         const pk = signer.getHdKey().privateKey;
@@ -58,16 +60,6 @@ export const cleartextEthereumModule: CleartextEthereumModuleFactory = () => {
       recoverAddress: (parameters: RecoverAddressParameters): Promise<RecoverAddressReturnType> => {
         return recoverAddress(parameters) as Promise<ChecksummedAddress>;
       },
-      hashTypedData: (parameters: HashTypedDataParameters): HashTypedDataReturnType => {
-        return asBytes32Hex(
-          hashTypedData({
-            domain: parameters.domain,
-            types: parameters.types as Record<string, Array<{ name: string; type: string }>>,
-            primaryType: parameters.primaryType,
-            message: parameters.message,
-          }),
-        );
-      },
     }),
   });
 };

package/viem/internal/ethereum.ts

@@ -6,8 +6,12 @@ import type {
   EncodePackedReturnType,
   EncodeParameters,
   EncodeReturnType,
+  EthCallParameters,
+  EthCallResult,
   EthereumModuleFactory,
   GetChainIdReturnType,
+  HashTypedDataParameters,
+  HashTypedDataReturnType,
   TrustedClient,
   ReadContractParameters,
   RecoverTypedDataAddressParameters,
@@ -16,7 +20,8 @@ import type {
   SignTypedDataReturnType,
   NativeSigner,
 } from '../../core/modules/ethereum/types.js';
-import type { BytesHex } from '../../core/types/primitives.js';
+import type { Bytes32Hex, BytesHex } from '../../core/types/primitives.js';
+import { BaseError, ExecutionRevertedError, hashTypedData as viemHashTypedData } from 'viem';
 import { recoverTypedDataAddress as viemRecoverTypedDataAddress } from 'viem';
 import { encodePacked as viemEncodePacked, encodeAbiParameters, decodeAbiParameters } from 'viem';
 import { asChecksummedAddress } from '../../core/base/address.js';
@@ -59,6 +64,19 @@ export function decode(parameters: DecodeParameters): DecodeReturnType {
   return [...decodeAbiParameters(abiParameters, parameters.encodedData as `0x${string}`)];
 }
 
+////////////////////////////////////////////////////////////////////////////////
+// hashTypedData
+////////////////////////////////////////////////////////////////////////////////
+
+export function hashTypedData(parameters: HashTypedDataParameters): HashTypedDataReturnType {
+  return viemHashTypedData({
+    domain: parameters.domain,
+    types: parameters.types,
+    primaryType: parameters.primaryType,
+    message: parameters.message,
+  }) as Bytes32Hex;
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // readContract
 ////////////////////////////////////////////////////////////////////////////////
@@ -71,6 +89,33 @@ export async function readContract(
   return publicClient.readContract(parameters);
 }
 
+////////////////////////////////////////////////////////////////////////////////
+// call (raw eth_call / STATICCALL)
+////////////////////////////////////////////////////////////////////////////////
+
+export async function call(
+  hostPublicClient: TrustedClient<PublicClient>,
+  parameters: EthCallParameters,
+): Promise<EthCallResult> {
+  const publicClient = trustedClientToViemPublicClient(hostPublicClient);
+  try {
+    const { data } = await publicClient.call({
+      to: parameters.to,
+      data: parameters.data,
+      ...(parameters.gas !== undefined ? { gas: parameters.gas } : {}),
+    });
+    return { success: true, data: (data ?? '0x') as BytesHex };
+  } catch (err) {
+    // A clean EVM revert is a definitive on-chain rejection; anything else
+    // (network, timeout, rate limit, …) is transport-level and rethrown so the
+    // precautionary caller can degrade gracefully.
+    if (err instanceof BaseError && err.walk((e) => e instanceof ExecutionRevertedError) !== null) {
+      return { success: false, reason: err.shortMessage };
+    }
+    throw err;
+  }
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // getChainId
 ////////////////////////////////////////////////////////////////////////////////
@@ -137,9 +182,11 @@ export const ethereumModule: EthereumModuleFactory = () => {
       encode,
       encodePacked,
       recoverTypedDataAddress,
+      hashTypedData,
       signTypedData,
       getChainId,
       readContract,
+      call,
     }),
   });
 };

package/wasm/tkms/KmsLibApi.d.ts

@@ -31,7 +31,7 @@ export interface KmsLibApi {
 }
 
 // Default version
-export type TkmsVersion = '0.13.10' | '0.13.20-0';
+export type TkmsVersion = '0.13.10' | '0.13.20-0' | '0.14.0-1';
 
 export type TkmsWasmBase64 = {
   readonly tkmsWasmBase64: string;

package/wasm/tkms/loadKmsLib.js

@@ -8,12 +8,13 @@
 
 ////////////////////////////////////////////////////////////////////////////////
 
-export const KMS_VERSIONS = Object.freeze(['0.13.10', '0.13.20-0']);
-export const DEFAULT_TKMS_VERSION = '0.13.20-0';
+export const KMS_VERSIONS = Object.freeze(['0.13.10', '0.13.20-0', '0.14.0-1']);
+export const DEFAULT_TKMS_VERSION = '0.14.0-1';
 
 const _loaders = {
   '0.13.10': () => import('./v0.13.10/kms_lib.js'),
   '0.13.20-0': () => import('./v0.13.20-0/kms_lib.js'),
+  '0.14.0-1': () => import('./v0.14.0-1/kms_lib.js'),
 };
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -21,6 +22,7 @@ const _loaders = {
 const _wasmBase64Loaders = {
   '0.13.10': () => import('./v0.13.10/kms_lib_bg.wasm.base64.js'),
   '0.13.20-0': () => import('./v0.13.20-0/kms_lib_bg.wasm.base64.js'),
+  '0.14.0-1': () => import('./v0.14.0-1/kms_lib_bg.wasm.base64.js'),
 };
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -40,6 +42,13 @@ const _assets = Object.freeze({
       sha256: 'be54c8f11daf048b897b41cf6e6735895490cdca77f2a01c01be0d6fbf369c81',
     }),
   }),
+  '0.14.0-1': Object.freeze({
+    wasm: Object.freeze({
+      filename: 'kms_lib_bg.v0.14.0-1.wasm',
+      localRelativePath: './v0.14.0-1/kms_lib_bg.wasm',
+      sha256: 'd4c2a1ed2567e7a3b2dfefb4c24e8a521110dd7c7648b533316647c06f6a9252',
+    }),
+  }),
 });
 
 ////////////////////////////////////////////////////////////////////////////////