@fhevm/sdk 1.0.0-alpha.3 → 1.0.0-alpha.5

package/core/host-contracts/canDecryptValuesFromPairs.ts

@@ -1,6 +1,6 @@
 import type { FhevmChain } from '../types/fhevmChain.js';
 import type { SignedDelegatedDecryptionPermit, SignedSelfDecryptionPermit } from '../types/signedDecryptionPermit.js';
-import type { TransportKeypair } from '../kms/TransportKeypair-p.js';
+import type { TransportKeyPair } from '../kms/TransportKeyPair-p.js';
 import type { ChecksummedAddress, Uint64BigInt } from '../types/primitives.js';
 import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
 import type { Handle } from '../types/encryptedTypes-p.js';
@@ -10,7 +10,7 @@ import {
   assertIsSignedDecryptionPermit,
   assertPermitIncludesContractAddresses,
 } from '../kms/SignedDecryptionPermit-p.js';
-import { assertPermitMatchesKeypair } from '../utils-p/decrypt/assertPermitMatchesKeypair.js';
+import { assertPermitMatchesKeyPair } from '../utils-p/decrypt/assertPermitMatchesKeyPair.js';
 import { isUserDecryptable } from '../host-contracts/isUserDecryptable.js';
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -30,7 +30,7 @@ type Parameters =
   | {
       readonly pairs: ReadonlyArray<{ readonly handle: Handle; readonly contractAddress: ChecksummedAddress }>;
       readonly signedPermit: SignedSelfDecryptionPermit | SignedDelegatedDecryptionPermit;
-      readonly transportKeypair?: TransportKeypair | undefined;
+      readonly transportKeyPair?: TransportKeyPair | undefined;
     };
 
 type ReturnType = {
@@ -66,8 +66,8 @@ export async function canDecryptValuesFromPairs(context: Context, parameters: Pa
     signedPermit.assertNotExpired();
     assertPermitIncludesContractAddresses(signedPermit, contractAddresses);
 
-    if (parameters.transportKeypair !== undefined) {
-      assertPermitMatchesKeypair(signedPermit, parameters.transportKeypair);
+    if (parameters.transportKeyPair !== undefined) {
+      assertPermitMatchesKeyPair(signedPermit, parameters.transportKeyPair);
     }
 
     userAddress = signedPermit.encryptedDataOwnerAddress;

package/core/host-contracts/checkDelegation.ts

@@ -4,6 +4,7 @@ import type { ChecksummedAddress } from '../types/primitives.js';
 import type { HandleContractPair } from '../types/other-p.js';
 import { AclUserDecryptionError } from '../errors/AclError.js';
 import { isHandleDelegatedForUserDecryption } from './isHandleDelegatedForUserDecryption-p.js';
+import { WILDCARD_DELEGATION_ADDRESS } from './constants.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -45,7 +46,21 @@ export async function checkDelegation(context: Context, parameters: Parameters):
     });
   }
 
-  // 2. Verify rules: delegator !== contractAddress & delegate !== contractAddress
+  // 2. Verify rule: delegate !== WILDCARD_CONTRACT
+  if (delegate.toLowerCase() === WILDCARD_DELEGATION_ADDRESS.toLowerCase()) {
+    throw new AclUserDecryptionError({
+      contractAddress: address,
+      message: `delegate cannot be equal to wildcard contract address`,
+    });
+  }
+  if (delegator.toLowerCase() === WILDCARD_DELEGATION_ADDRESS.toLowerCase()) {
+    throw new AclUserDecryptionError({
+      contractAddress: address,
+      message: `delegator cannot be equal to wildcard contract address`,
+    });
+  }
+
+  // 3. Verify rules: delegator !== contractAddress & delegate !== contractAddress
   for (const pair of handleContractPairs) {
     if (delegator.toLowerCase() === pair.contractAddress.toLowerCase()) {
       throw new AclUserDecryptionError({
@@ -61,7 +76,7 @@ export async function checkDelegation(context: Context, parameters: Parameters):
     }
   }
 
-  // 3. Collect all unique (contractAddress, handle) pairs to avoid duplicate RPC calls
+  // 4. Collect all unique (contractAddress, handle) pairs to avoid duplicate RPC calls
   const allChecks: HandleContractPair[] = [];
   const seenKeys = new Set<string>();
 
@@ -81,7 +96,7 @@ export async function checkDelegation(context: Context, parameters: Parameters):
     throw new Error('checkDelegation: no delegation checks to perform (unexpected empty dedup result)');
   }
 
-  // 4. Single batched RPC call for all unique checks
+  // 5. Single batched RPC call for all unique checks
   const allResults = await isHandleDelegatedForUserDecryption(context, {
     address,
     delegator,
@@ -89,7 +104,7 @@ export async function checkDelegation(context: Context, parameters: Parameters):
     pairs: allChecks,
   });
 
-  // 5. Build result map for lookup
+  // 6. Build result map for lookup
   const resultMap = new Map<string, boolean>();
   for (const [i, check] of allChecks.entries()) {
     const result = allResults[i];
@@ -101,7 +116,7 @@ export async function checkDelegation(context: Context, parameters: Parameters):
     resultMap.set(key, result);
   }
 
-  // 6. Verify delegation for each requested pair
+  // 7. Verify delegation for each requested pair
   for (const pair of handleContractPairs) {
     const key = getKey(pair.contractAddress, pair.handle.bytes32Hex);
     if (resultMap.get(key) !== true) {

package/core/host-contracts/constants.ts

@@ -0,0 +1,3 @@
+import type { ChecksummedAddress } from '../types/primitives.js';
+
+export const WILDCARD_DELEGATION_ADDRESS = '0xFFfFfFffFFfffFFfFFfFFFFFffFFFffffFfFFFfF' as ChecksummedAddress;

package/core/kms/SignedDecryptionPermit-p.ts

@@ -29,7 +29,7 @@ import {
   createKmsDelegatedUserDecryptEip712,
 } from './createKmsDelegatedUserDecryptEip712.js';
 import { assertRecordStringProperty } from '../base/string.js';
-import { assertIsTransportKeypair, type TransportKeypair } from './TransportKeypair-p.js';
+import { assertIsTransportKeyPair, type TransportKeyPair } from './TransportKeyPair-p.js';
 import { assertKmsEIP712DeadlineValidity } from './utils.js';
 import { readKmsSignersContext } from '../host-contracts/readKmsSignersContext-p.js';
 import { kmsSignersContextToExtraData } from '../host-contracts/KmsSignersContext-p.js';
@@ -301,7 +301,7 @@ type SignDecryptionPermitCommonParameters = {
   readonly durationDays: number;
   readonly signerAddress: string;
   readonly signer: NativeSigner;
-  readonly transportKeypair: TransportKeypair;
+  readonly transportKeyPair: TransportKeyPair;
 };
 
 export type SignSelfDecryptionPermitParameters = SignDecryptionPermitCommonParameters & {
@@ -324,10 +324,10 @@ export type SignDecryptionPermitParameters =
  * to decrypt encrypted values belonging to the `delegatorAddress` account.
  * Otherwise, creates a standard permit where the signer decrypts their own values.
  *
- * The EIP-712 message includes the keypair's public key, allowing the gateway
- * to encrypt the decrypted result for this specific keypair.
+ * The EIP-712 message includes the key pair's public key, allowing the gateway
+ * to encrypt the decrypted result for this specific key pair.
  *
- * @throws If the signer, address, or keypair is invalid.
+ * @throws If the signer, address, or key pair is invalid.
  * @throws If the signature verification fails.
  */
 export async function signDecryptionPermit(
@@ -353,12 +353,12 @@ export async function signDecryptionPermit(
     startTimestamp,
     durationDays,
     signerAddress: signerAddressArg,
-    transportKeypair,
+    transportKeyPair: transportKeyPair,
     signer,
     delegatorAddress,
   } = parameters;
 
-  assertIsTransportKeypair(transportKeypair, {});
+  assertIsTransportKeyPair(transportKeyPair, {});
   assertIsAddress(signerAddressArg, {});
 
   if (delegatorAddress !== undefined) {
@@ -380,7 +380,7 @@ export async function signDecryptionPermit(
     durationDays,
     startTimestamp,
     extraData,
-    publicKey: transportKeypair.publicKey,
+    publicKey: transportKeyPair.publicKey,
   };
 
   const eip712 =
@@ -414,10 +414,10 @@ export async function parseSignedDecryptionPermit(
     readonly client: NonNullable<object>;
     readonly options: { readonly batchRpcCalls: boolean };
   },
-  transportKeypair: TransportKeypair,
+  transportKeyPair: TransportKeyPair,
   permit: unknown,
 ): Promise<SignedDecryptionPermit> {
-  assertIsTransportKeypair(transportKeypair, {});
+  assertIsTransportKeyPair(transportKeyPair, {});
 
   const permitName = 'permit';
   const options = {};
@@ -438,10 +438,10 @@ export async function parseSignedDecryptionPermit(
     throw new Error(`Unknown permit primaryType: ${primaryType}`);
   }
 
-  if (eip712.message.publicKey.toLowerCase() !== transportKeypair.publicKey.toLowerCase()) {
+  if (eip712.message.publicKey.toLowerCase() !== transportKeyPair.publicKey.toLowerCase()) {
     throw new Error(
-      "The permit's publicKey does not match the E2eTransportKeypair's publicKey. " +
-        'Ensure the permit was signed with the same keypair.',
+      "The permit's publicKey does not match the E2eTransportKeyPair's publicKey. " +
+        'Ensure the permit was signed with the same key pair.',
     );
   }
 

package/core/kms/{TransportKeypair-p.ts → TransportKeyPair-p.ts}

@@ -10,22 +10,22 @@ import { verifyTkmsPublicKey } from '../utils-p/decrypt/verifyTkmsPublicKey.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
-const PRIVATE_TOKEN = Symbol('TransportKeypair.token');
+const PRIVATE_TOKEN = Symbol('TransportKeyPair.token');
 
 ////////////////////////////////////////////////////////////////////////////////
 
-declare const TransportKeypairBrand: unique symbol;
+declare const TransportKeyPairBrand: unique symbol;
 
-export type TransportKeypair = {
+export type TransportKeyPair = {
   readonly publicKey: BytesHex;
-  readonly [TransportKeypairBrand]: true;
+  readonly [TransportKeyPairBrand]: true;
 };
 
 ////////////////////////////////////////////////////////////////////////////////
-// TransportKeypairImpl
+// TransportKeyPairImpl
 //
 // Unexported class wrapping closures that bind a tkmsPrivateKey.
-// - Class: enables instanceof checks (isTransportKeypair)
+// - Class: enables instanceof checks (isTransportKeyPair)
 // - Closures: methods capture privateKey without exposing it
 // - Frozen: instance, class, and prototype are all immutable
 // - Tree-shakable: unused exports are eliminated by bundlers
@@ -35,8 +35,8 @@ export type TransportKeypair = {
 const GetTkmsPrivateKeyFn = Symbol();
 const SerializeFn = Symbol();
 
-class TransportKeypairImpl implements TransportKeypair {
-  declare readonly [TransportKeypairBrand]: true;
+class TransportKeyPairImpl implements TransportKeyPair {
+  declare readonly [TransportKeyPairBrand]: true;
 
   readonly #publicKeyBytesHex: BytesHex;
   readonly #privateKeyBytes: Bytes;
@@ -82,7 +82,7 @@ class TransportKeypairImpl implements TransportKeypair {
       throw new Error('Unauthorized');
     }
     // If the runtime was GC'd, deref() returns undefined, which !== expectedRuntime → throws.
-    // This is intentional: a GC'd runtime means the keypair is stale.
+    // This is intentional: a GC'd runtime means the key pair is stale.
     if (expectedRuntime !== this.#runtime.deref()) {
       throw new Error('Invalid runtime');
     }
@@ -109,7 +109,7 @@ class TransportKeypairImpl implements TransportKeypair {
   }
 
   /**
-   * Hidden method (Symbol key) that serializes the keypair including the private key.
+   * Hidden method (Symbol key) that serializes the key pair including the private key.
    *
    * Access is protected by the Symbol key (not exported) and the private token.
    */
@@ -135,29 +135,29 @@ class TransportKeypairImpl implements TransportKeypair {
   }
 }
 
-Object.freeze(TransportKeypairImpl);
-Object.freeze(TransportKeypairImpl.prototype);
+Object.freeze(TransportKeyPairImpl);
+Object.freeze(TransportKeyPairImpl.prototype);
 
 ////////////////////////////////////////////////////////////////////////////////
 
 /** Type guard. */
-export function isTransportKeypair(value: unknown): value is TransportKeypair {
-  return value instanceof TransportKeypairImpl;
+export function isTransportKeyPair(value: unknown): value is TransportKeyPair {
+  return value instanceof TransportKeyPairImpl;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 
-/** Throws {@link InvalidTypeError} if value is not a valid {@link TransportKeypair}. */
-export function assertIsTransportKeypair(
+/** Throws {@link InvalidTypeError} if value is not a valid {@link TransportKeyPair}. */
+export function assertIsTransportKeyPair(
   value: unknown,
   options: { subject?: string } & ErrorMetadataParams,
-): asserts value is TransportKeypair {
-  if (!isTransportKeypair(value)) {
+): asserts value is TransportKeyPair {
+  if (!isTransportKeyPair(value)) {
     throw new InvalidTypeError(
       {
         subject: options.subject,
         type: typeof value,
-        expectedType: 'TransportKeypair',
+        expectedType: 'TransportKeyPair',
       },
       options,
     );
@@ -166,14 +166,14 @@ export function assertIsTransportKeypair(
 
 ////////////////////////////////////////////////////////////////////////////////
 
-/** Generates a fresh {@link TransportKeypair}. */
-export async function generateTransportKeypair(context: { readonly runtime: WithDecrypt }): Promise<TransportKeypair> {
+/** Generates a fresh {@link TransportKeyPair}. */
+export async function generateTransportKeyPair(context: { readonly runtime: WithDecrypt }): Promise<TransportKeyPair> {
   const tkmsPrivateKey = await context.runtime.decrypt.generateTkmsPrivateKey();
   const tkmsPrivateKeyBytes = await context.runtime.decrypt.serializeTkmsPrivateKey({ tkmsPrivateKey });
   const tkmsPublicKeyBytesHex = await context.runtime.decrypt.getTkmsPublicKeyHex({
     tkmsPrivateKey,
   });
-  return new TransportKeypairImpl(PRIVATE_TOKEN, context.runtime, {
+  return new TransportKeyPairImpl(PRIVATE_TOKEN, context.runtime, {
     privateKeyBytes: tkmsPrivateKeyBytes,
     publicKeyBytesHex: tkmsPublicKeyBytesHex,
     tkmsPrivateKey,
@@ -181,25 +181,25 @@ export async function generateTransportKeypair(context: { readonly runtime: With
 }
 
 /**
- * Converts an unknown value into a {@link TransportKeypair}.
+ * Converts an unknown value into a {@link TransportKeyPair}.
  *
  * Accepted inputs:
- * - An existing {@link TransportKeypair} (returned as-is)
+ * - An existing {@link TransportKeyPair} (returned as-is)
  * - A plain object `{ publicKey, privateKey }` where each is `Bytes` or `BytesHex`
  *
- * @throws {InvalidTypeError} If `value` is not a recognized keypair shape.
+ * @throws {InvalidTypeError} If `value` is not a recognized key pair shape.
  */
-export async function toTransportKeypair(
+export async function toTransportKeyPair(
   context: { readonly runtime: FhevmRuntime },
   value: unknown,
-): Promise<TransportKeypair> {
-  if (isTransportKeypair(value)) {
+): Promise<TransportKeyPair> {
+  if (isTransportKeyPair(value)) {
     // Force realize
-    await (value as TransportKeypairImpl)[GetTkmsPrivateKeyFn](PRIVATE_TOKEN, context.runtime);
+    await (value as TransportKeyPairImpl)[GetTkmsPrivateKeyFn](PRIVATE_TOKEN, context.runtime);
     return value;
   }
 
-  const name = 'TransportKeypair';
+  const name = 'TransportKeyPair';
   const options = {};
 
   assertRecordNonNullableProperty(value, 'publicKey', name, {
@@ -240,7 +240,7 @@ export async function toTransportKeypair(
     await verifyTkmsPublicKey({ runtime: runtimeWithDecrypt }, { tkmsPrivateKey, tkmsPublicKeyBytesHex });
   }
 
-  return new TransportKeypairImpl(PRIVATE_TOKEN, context.runtime, {
+  return new TransportKeyPairImpl(PRIVATE_TOKEN, context.runtime, {
     privateKeyBytes: tkmsPrivateKeyBytes,
     publicKeyBytesHex: tkmsPublicKeyBytesHex,
     tkmsPrivateKey,
@@ -248,31 +248,31 @@ export async function toTransportKeypair(
 }
 
 /**
- * Serializes an {@link TransportKeypair} including the private key.
+ * Serializes an {@link TransportKeyPair} including the private key.
  *
  * **The output contains sensitive key material — handle and store securely.**
  *
- * @throws {InvalidTypeError} If `value` is not a valid {@link TransportKeypair}.
+ * @throws {InvalidTypeError} If `value` is not a valid {@link TransportKeyPair}.
  */
-export function serializeTransportKeypair(value: TransportKeypair): {
+export function serializeTransportKeyPair(value: TransportKeyPair): {
   publicKey: BytesHex;
   privateKey: BytesHex;
 } {
-  assertIsTransportKeypair(value, {});
-  return (value as TransportKeypairImpl)[SerializeFn](PRIVATE_TOKEN);
+  assertIsTransportKeyPair(value, {});
+  return (value as TransportKeyPairImpl)[SerializeFn](PRIVATE_TOKEN);
 }
 
 /**
- * Extracts the deserialized TKMS private key from an {@link TransportKeypair}.
+ * Extracts the deserialized TKMS private key from an {@link TransportKeyPair}.
  * Lazily deserializes and verifies the key on first access.
  *
- * @throws {InvalidTypeError} If `value` is not a valid {@link TransportKeypair}.
+ * @throws {InvalidTypeError} If `value` is not a valid {@link TransportKeyPair}.
  * @throws If the runtime does not match or the key verification fails.
  */
-export async function transportKeypairToTkmsPrivateKey(
+export async function transportKeyPairToTkmsPrivateKey(
   context: { readonly runtime: FhevmRuntime },
-  value: TransportKeypair,
+  value: TransportKeyPair,
 ): Promise<TkmsPrivateKey> {
-  assertIsTransportKeypair(value, {});
-  return await (value as TransportKeypairImpl)[GetTkmsPrivateKeyFn](PRIVATE_TOKEN, context.runtime);
+  assertIsTransportKeyPair(value, {});
+  return await (value as TransportKeyPairImpl)[GetTkmsPrivateKeyFn](PRIVATE_TOKEN, context.runtime);
 }

package/core/kms/decryptKmsSignedcryptedShares-p.ts

@@ -1,8 +1,8 @@
 import type { WithDecrypt } from '../types/coreFhevmRuntime.js';
 import type { KmsSigncryptedShares } from '../types/kms.js';
 import type { ClearValue } from '../types/encryptedTypes-p.js';
-import type { TransportKeypair } from './TransportKeypair-p.js';
-import { transportKeypairToTkmsPrivateKey } from './TransportKeypair-p.js';
+import type { TransportKeyPair } from './TransportKeyPair-p.js';
+import { transportKeyPairToTkmsPrivateKey } from './TransportKeyPair-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 // decryptKmsSignedcryptedShares (with privateKey)
@@ -14,7 +14,7 @@ type Context = {
 
 type Parameters = {
   readonly kmsSigncryptedShares: KmsSigncryptedShares;
-  readonly transportKeypair: TransportKeypair;
+  readonly transportKeyPair: TransportKeyPair;
 };
 
 type ReturnType = readonly ClearValue[];
@@ -22,10 +22,10 @@ type ReturnType = readonly ClearValue[];
 ////////////////////////////////////////////////////////////////////////////////
 
 export async function decryptKmsSignedcryptedShares(context: Context, parameters: Parameters): Promise<ReturnType> {
-  const { transportKeypair, kmsSigncryptedShares } = parameters;
+  const { transportKeyPair: transportKeyPair, kmsSigncryptedShares } = parameters;
 
-  // also validates `transportKeypair`
-  const tkmsPrivateKey = await transportKeypairToTkmsPrivateKey(context, transportKeypair);
+  // also validates `transportKeyPair`
+  const tkmsPrivateKey = await transportKeyPairToTkmsPrivateKey(context, transportKeyPair);
 
   // Using the `KmsSigncryptedShares` decrypt and reconstruct clear values
   const orderedDecryptedHandles: readonly ClearValue[] = await context.runtime.decrypt.decryptAndReconstruct({

package/core/kms/decryptValuesFromPairs.ts

@@ -7,7 +7,7 @@ import type { KmsSigncryptedShares } from '../types/kms.js';
 import type { ChecksummedAddress, TypedValue } from '../types/primitives.js';
 import type { RelayerDelegatedUserDecryptOptions, RelayerUserDecryptOptions } from '../types/relayer.js';
 import type { SignedDelegatedDecryptionPermit, SignedSelfDecryptionPermit } from '../types/signedDecryptionPermit.js';
-import type { TransportKeypair } from './TransportKeypair-p.js';
+import type { TransportKeyPair } from './TransportKeyPair-p.js';
 import { decryptKmsSignedcryptedShares } from './decryptKmsSignedcryptedShares-p.js';
 import { fetchKmsSignedcryptedShares } from './fetchKmsSignedcryptedShares-p.js';
 
@@ -27,7 +27,7 @@ type Parameters =
         readonly contractAddress: ChecksummedAddress;
       }>;
       readonly signedPermit: SignedSelfDecryptionPermit;
-      readonly transportKeypair: TransportKeypair;
+      readonly transportKeyPair: TransportKeyPair;
       readonly options?: RelayerUserDecryptOptions | undefined;
     }
   | {
@@ -36,7 +36,7 @@ type Parameters =
         readonly contractAddress: ChecksummedAddress;
       }>;
       readonly signedPermit: SignedDelegatedDecryptionPermit;
-      readonly transportKeypair: TransportKeypair;
+      readonly transportKeyPair: TransportKeyPair;
       readonly options?: RelayerDelegatedUserDecryptOptions | undefined;
     };
 
@@ -45,13 +45,13 @@ export type ReturnType = readonly TypedValue[];
 ////////////////////////////////////////////////////////////////////////////////
 
 export async function decryptValuesFromPairs(fhevm: Context, parameters: Parameters): Promise<ReturnType> {
-  const { transportKeypair } = parameters;
+  const { transportKeyPair: transportKeyPair } = parameters;
 
   const kmsSigncryptedShares: KmsSigncryptedShares = await fetchKmsSignedcryptedShares(fhevm, parameters);
 
   // Using the `KmsSigncryptedShares` decrypt and reconstruct clear values
   return decryptKmsSignedcryptedShares(fhevm, {
     kmsSigncryptedShares,
-    transportKeypair,
+    transportKeyPair: transportKeyPair,
   });
 }

package/core/kms/index.ts

@@ -1 +0,0 @@
-export type { TransportKeypair } from './TransportKeypair-p.ts';

package/core/modules/decrypt/mock.ts

@@ -53,7 +53,7 @@ export async function decryptAndReconstruct(
   const cleartextEthereumModule = runtime.ethereum as CleartextEthereumModule;
   const { tkmsPrivateKey, shares } = parameters;
 
-  const privateKeySecp256k1 = asBytesHex(tkmsPrivateKey as unknown);
+  const privateKeySecp256k1 = asBytesHex(tkmsPrivateKey);
   const publicKeySecp256k1 = cleartextEthereumModule.getPublicKey({ privateKey: privateKeySecp256k1 });
 
   const metadata: KmsSigncryptedSharesMetadata = getMetadata(shares);
@@ -149,7 +149,7 @@ export async function getTkmsPublicKeyHex(
   parameters: GetTkmsPublicKeyHexParameters,
 ): Promise<GetTkmsPublicKeyHexReturnType> {
   const { tkmsPrivateKey } = parameters;
-  const privateKeySecp256k1 = asBytesHex(tkmsPrivateKey as unknown);
+  const privateKeySecp256k1 = asBytesHex(tkmsPrivateKey);
   const cleartextEthereumModule = runtime.ethereum as CleartextEthereumModule;
   const publicKeySecp256k1 = cleartextEthereumModule.getPublicKey({ privateKey: privateKeySecp256k1 });
   return Promise.resolve(publicKeySecp256k1);
@@ -164,7 +164,7 @@ export async function serializeTkmsPrivateKey(
   parameters: SerializeTkmsPrivateKeyParameters,
 ): Promise<SerializeTkmsPrivateKeyReturnType> {
   const { tkmsPrivateKey } = parameters;
-  const privateKeySecp256k1 = asBytesHex(tkmsPrivateKey as unknown);
+  const privateKeySecp256k1 = asBytesHex(tkmsPrivateKey);
   const privateKeySecp256k1Bytes = hexToBytes(privateKeySecp256k1);
   return Promise.resolve(privateKeySecp256k1Bytes);
 }

package/core/modules/decrypt/module/init-p.ts

@@ -109,22 +109,21 @@ export async function initTkmsModule(runtime: FhevmRuntime): Promise<void> {
 
   ownerUid = runtime.uid;
 
-  if (cachedTkmsModulePromise !== undefined) {
-    return cachedTkmsModulePromise;
+  // Cache the TKMS initialization promise once and keep it cached even if it
+  // rejects.
+  //
+  // Retry is not supported:
+  // -----------------------
+  // The underlying KMS/WASM bindings
+  // keep module-level state that cannot be reset reliably after a partial
+  // initialization failure; later callers should observe the original error
+  // instead of retrying against half-initialized state.
+  if (cachedTkmsModulePromise === undefined) {
+    // resolve is sync
+    const cfg = _getOrResolveTkmsModuleConfig(runtime);
+    cachedTkmsModulePromise = _initTkmsModule(cfg);
   }
 
-  // Use existing config if already set, otherwise resolve from runtime
-  const cfg = _getOrResolveTkmsModuleConfig(runtime);
-
-  cachedTkmsModulePromise = _initTkmsModule(cfg);
-
-  // This is purely theoretical. Retry is not yet possible since the `_initTkmsModule`
-  // does not support retry (see kms lib internal global variables).
-  cachedTkmsModulePromise.catch(() => {
-    // Clear cache on failure so retry is possible
-    cachedTkmsModulePromise = undefined;
-  });
-
   return cachedTkmsModulePromise;
 }
 

package/core/modules/encrypt/mock.ts

@@ -6,15 +6,13 @@ import type { FhevmRuntime } from '../../types/coreFhevmRuntime.js';
 import type {
   FheEncryptionCrs,
   FheEncryptionCrsBrand,
-  FheEncryptionCrsBytes,
   FheEncryptionKeyBytes,
   FheEncryptionPublicKey,
   FheEncryptionPublicKeyBrand,
-  FheEncryptionPublicKeyBytes,
 } from '../../types/fheEncryptionKey.js';
 import type { Bytes, BytesHex, UintNumber } from '../../types/primitives.js';
 import type {
-  BuildWithProofPackedReturnTypeParameters,
+  BuildWithProofPackedParameters,
   BuildWithProofPackedReturnType,
   ParseTFHEProvenCompactCiphertextListParameters,
   ParseTFHEProvenCompactCiphertextListReturnType,
@@ -123,7 +121,7 @@ export async function parseTFHEProvenCompactCiphertextList(
 ////////////////////////////////////////////////////////////////////////////////
 
 export async function buildWithProofPacked(
-  parameters: BuildWithProofPackedReturnTypeParameters,
+  parameters: BuildWithProofPackedParameters,
 ): Promise<BuildWithProofPackedReturnType> {
   const { fheEncryptionKey: publicEncryptionParams, metaData, typedValues, extraData } = parameters;
 
@@ -219,7 +217,7 @@ export async function serializeFheEncryptionPublicKey(
   return Object.freeze({
     id: tfhePublicKey.id,
     bytes: tfhePublicKeyBytes,
-  }) as FheEncryptionPublicKeyBytes;
+  });
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -246,7 +244,7 @@ export async function serializeFheEncryptionCrs(
     id: tfheCrs.id,
     capacity: tfheCrs.capacity,
     bytes: tfheCrsBytes,
-  }) as FheEncryptionCrsBytes;
+  });
 }
 
 ////////////////////////////////////////////////////////////////////////////////

package/core/modules/encrypt/module/api-p.ts

@@ -1,5 +1,5 @@
 import type {
-  BuildWithProofPackedReturnTypeParameters,
+  BuildWithProofPackedParameters,
   BuildWithProofPackedReturnType,
   ParseTFHEProvenCompactCiphertextListParameters,
   ParseTFHEProvenCompactCiphertextListReturnType,
@@ -17,11 +17,9 @@ import type {
 import type {
   FheEncryptionCrs,
   FheEncryptionCrsBrand,
-  FheEncryptionCrsBytes,
   FheEncryptionKeyBytes,
   FheEncryptionPublicKey,
   FheEncryptionPublicKeyBrand,
-  FheEncryptionPublicKeyBytes,
 } from '../../../types/fheEncryptionKey.js';
 import type { CompactCiphertextListBuilder } from '../../../../wasm/tfhe/tfhe.v1.5.3.js';
 import type { Bytes, UintNumber } from '../../../types/primitives.js';
@@ -195,7 +193,7 @@ export async function parseTFHEProvenCompactCiphertextList(
 
 export async function buildWithProofPacked(
   runtime: FhevmRuntime,
-  parameters: BuildWithProofPackedReturnTypeParameters,
+  parameters: BuildWithProofPackedParameters,
 ): Promise<BuildWithProofPackedReturnType> {
   await initTfheModule(runtime);
 
@@ -359,7 +357,7 @@ export async function serializeFheEncryptionPublicKey(
   return Object.freeze({
     id: tfhePublicKey.id,
     bytes: tfhePublicKeyBytes,
-  }) as FheEncryptionPublicKeyBytes;
+  });
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -389,7 +387,7 @@ export async function serializeFheEncryptionCrs(
     id: tfheCrs.id,
     capacity: tfheCrs.capacity,
     bytes: tfheCrsBytes,
-  }) as FheEncryptionCrsBytes;
+  });
 }
 
 ////////////////////////////////////////////////////////////////////////////////

package/core/modules/encrypt/module/index.ts

@@ -1,6 +1,6 @@
 import type { FhevmRuntime } from '../../../types/coreFhevmRuntime.js';
 import type {
-  BuildWithProofPackedReturnTypeParameters,
+  BuildWithProofPackedParameters,
   DeserializeFheEncryptionCrsParameters,
   DeserializeFheEncryptionPublicKeyParameters,
   EncryptModuleFactory,
@@ -31,7 +31,7 @@ export const encryptModule: EncryptModuleFactory = (runtime: FhevmRuntime) => {
       getTfheModuleInfo: () => getTfheModuleInfo(),
       parseTFHEProvenCompactCiphertextList: (args: ParseTFHEProvenCompactCiphertextListParameters) =>
         parseTFHEProvenCompactCiphertextList(runtime, args),
-      buildWithProofPacked: (args: BuildWithProofPackedReturnTypeParameters) => buildWithProofPacked(runtime, args),
+      buildWithProofPacked: (args: BuildWithProofPackedParameters) => buildWithProofPacked(runtime, args),
       serializeFheEncryptionKey: (args: SerializeFheEncryptionKeyParameters) =>
         serializeFheEncryptionKey(runtime, args),
       serializeFheEncryptionPublicKey: (args: SerializeFheEncryptionPublicKeyParameters) =>