@fhevm/sdk 1.0.0-alpha.4 → 1.0.0-alpha.6

package/core/handle/FheType.ts

@@ -316,8 +316,6 @@ export function assertIsEncryptionBitsArray(
 
 /**
  * Converts an encryption bit width to its corresponding FheTypeId.
- * Accepts loose `number` input; validates internally via `isEncryptionBits`.
- * @throws A {@link FheTypeError} If bitwidth is not a valid encryption bit width.
  * @example fheTypeIdFromEncryptionBits(8) // 2 (euint8)
  */
 export function fheTypeIdFromEncryptionBits(bitwidth: EncryptionBits): FheTypeId {
@@ -326,8 +324,6 @@ export function fheTypeIdFromEncryptionBits(bitwidth: EncryptionBits): FheTypeId
 
 /**
  * Converts an FheType to its corresponding FheTypeId.
- * Accepts loose `string` input; validates internally via `isFheType`.
- * @throws A {@link FheTypeError} If name is not a valid FheType.
  * @example fheTypeIdFromName('euint8') // 2
  */
 export function fheTypeIdFromName(name: FheType): FheTypeId {
@@ -336,7 +332,6 @@ export function fheTypeIdFromName(name: FheType): FheTypeId {
 
 /**
  * Converts an FheTypeId to its corresponding FheType.
- * @throws A {@link FheTypeError} If id is not a valid FheTypeId.
  * @example fheTypeNameFromId(2) // 'euint8'
  */
 export function fheTypeNameFromId(typeId: FheTypeId): FheType {
@@ -353,7 +348,7 @@ export function fheTypeNameFromTypeName(typeName: ValueTypeName): FheType {
 
 /**
  * Converts a FheType to its corresponding TypeName.
- * @example fheTypeNameFromTypeName('euint8') // 'uint8'
+ * @example typeNameFromFheTypeName('euint8') // 'uint8'
  */
 export function typeNameFromFheTypeName(fheType: FheType): ValueTypeName {
   return fheType.substring(1) as ValueTypeName;
@@ -365,7 +360,6 @@ export function typeNameFromFheTypeName(fheType: FheType): ValueTypeName {
 
 /**
  * Returns the Solidity primitive type name for an FheTypeId.
- * Accepts loose `number` input; validates internally via `isFheTypeId`.
  * @example solidityPrimitiveTypeNameFromFheTypeId(0) // 'bool'
  * @example solidityPrimitiveTypeNameFromFheTypeId(7) // 'address'
  * @example solidityPrimitiveTypeNameFromFheTypeId(2) // 'uint256'
@@ -398,9 +392,9 @@ export function encryptionBitsFromFheTypeId(typeId: FheTypeId): EncryptionBits {
  * Returns the encryption bit width for an FheType name.
  * @param name - The FHE type name (e.g., 'ebool', 'euint32', 'eaddress')
  * @returns The encryption bit width (always \>= 2)
- * @example encryptionBitsFromFheTypeName('ebool') // 2
- * @example encryptionBitsFromFheTypeName('euint32') // 32
- * @example encryptionBitsFromFheTypeName('eaddress') // 160
+ * @example encryptionBitsFromFheType('ebool') // 2
+ * @example encryptionBitsFromFheType('euint32') // 32
+ * @example encryptionBitsFromFheType('eaddress') // 160
  */
 export function encryptionBitsFromFheType(name: FheType): EncryptionBits {
   const bw = FheTypeIdToEncryptionBits[FheTypeNameToId[name]];
@@ -463,11 +457,11 @@ export function bytesToClearValueType<etype extends FheType>(fheType: etype, byt
  * and returns it narrowed. No conversion is performed.
  *
  * - `ebool` → `boolean`
- * - `eaddress` → `string` (checksummed address)
+ * - `eaddress` → `string` (validated address)
  * - `euint8/16/32` → `number`
  * - `euint64/128/256` → `bigint`
  *
- * @throws If `value` is not the expected JS type or exceeds the type's range.
+ * @throws If `value` is not the expected JS type.
  */
 export function asClearValueType<etype extends FheType>(
   fheTypeName: etype,
@@ -504,14 +498,13 @@ export function asClearValueType<etype extends FheType>(
 
 /**
  * Converts `value` to the correct JS type for the given `fheTypeName`.
- * Accepts any uint-like input (number, bigint, string) and coerces it.
  *
- * - `ebool` → `boolean`
+ * - `ebool` → `boolean` (value must already be a `boolean`; no coercion)
  * - `eaddress` → `string` (validated address)
- * - `euint8/16/32` → coerced to `number` via `Number()`
- * - `euint64/128/256` → coerced to `bigint` via `BigInt()`
+ * - `euint8/16/32` → coerced to `number` via `Number()` (accepts `number` or `bigint`)
+ * - `euint64/128/256` → coerced to `bigint` via `BigInt()` (accepts `number` or `bigint`)
  *
- * @throws If `value` cannot be converted or exceeds the type's range.
+ * @throws If `value` is not the expected JS type or cannot be coerced.
  */
 export function toClearValueType<etype extends FheType>(
   fheTypeName: etype,

package/core/host-contracts/canDecryptValuesFromPairs.ts

@@ -1,6 +1,6 @@
 import type { FhevmChain } from '../types/fhevmChain.js';
 import type { SignedDelegatedDecryptionPermit, SignedSelfDecryptionPermit } from '../types/signedDecryptionPermit.js';
-import type { TransportKeypair } from '../kms/TransportKeypair-p.js';
+import type { TransportKeyPair } from '../kms/TransportKeyPair-p.js';
 import type { ChecksummedAddress, Uint64BigInt } from '../types/primitives.js';
 import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
 import type { Handle } from '../types/encryptedTypes-p.js';
@@ -10,7 +10,7 @@ import {
   assertIsSignedDecryptionPermit,
   assertPermitIncludesContractAddresses,
 } from '../kms/SignedDecryptionPermit-p.js';
-import { assertPermitMatchesKeypair } from '../utils-p/decrypt/assertPermitMatchesKeypair.js';
+import { assertPermitMatchesKeyPair } from '../utils-p/decrypt/assertPermitMatchesKeyPair.js';
 import { isUserDecryptable } from '../host-contracts/isUserDecryptable.js';
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -30,7 +30,7 @@ type Parameters =
   | {
       readonly pairs: ReadonlyArray<{ readonly handle: Handle; readonly contractAddress: ChecksummedAddress }>;
       readonly signedPermit: SignedSelfDecryptionPermit | SignedDelegatedDecryptionPermit;
-      readonly transportKeypair?: TransportKeypair | undefined;
+      readonly transportKeyPair?: TransportKeyPair | undefined;
     };
 
 type ReturnType = {
@@ -66,8 +66,8 @@ export async function canDecryptValuesFromPairs(context: Context, parameters: Pa
     signedPermit.assertNotExpired();
     assertPermitIncludesContractAddresses(signedPermit, contractAddresses);
 
-    if (parameters.transportKeypair !== undefined) {
-      assertPermitMatchesKeypair(signedPermit, parameters.transportKeypair);
+    if (parameters.transportKeyPair !== undefined) {
+      assertPermitMatchesKeyPair(signedPermit, parameters.transportKeyPair);
     }
 
     userAddress = signedPermit.encryptedDataOwnerAddress;

package/core/kms/SignedDecryptionPermit-p.ts

@@ -29,7 +29,7 @@ import {
   createKmsDelegatedUserDecryptEip712,
 } from './createKmsDelegatedUserDecryptEip712.js';
 import { assertRecordStringProperty } from '../base/string.js';
-import { assertIsTransportKeypair, type TransportKeypair } from './TransportKeypair-p.js';
+import { assertIsTransportKeyPair, type TransportKeyPair } from './TransportKeyPair-p.js';
 import { assertKmsEIP712DeadlineValidity } from './utils.js';
 import { readKmsSignersContext } from '../host-contracts/readKmsSignersContext-p.js';
 import { kmsSignersContextToExtraData } from '../host-contracts/KmsSignersContext-p.js';
@@ -125,7 +125,7 @@ abstract class SignedDecryptionPermitBaseImpl {
     }
   }
 
-  public get e2eTransportPublicKey(): BytesHex {
+  public get transportPublicKey(): BytesHex {
     return this.#eip712.message.publicKey;
   }
 
@@ -301,7 +301,7 @@ type SignDecryptionPermitCommonParameters = {
   readonly durationDays: number;
   readonly signerAddress: string;
   readonly signer: NativeSigner;
-  readonly transportKeypair: TransportKeypair;
+  readonly transportKeyPair: TransportKeyPair;
 };
 
 export type SignSelfDecryptionPermitParameters = SignDecryptionPermitCommonParameters & {
@@ -324,10 +324,10 @@ export type SignDecryptionPermitParameters =
  * to decrypt encrypted values belonging to the `delegatorAddress` account.
  * Otherwise, creates a standard permit where the signer decrypts their own values.
  *
- * The EIP-712 message includes the keypair's public key, allowing the gateway
- * to encrypt the decrypted result for this specific keypair.
+ * The EIP-712 message includes the key pair's public key, allowing the gateway
+ * to encrypt the decrypted result for this specific key pair.
  *
- * @throws If the signer, address, or keypair is invalid.
+ * @throws If the signer, address, or key pair is invalid.
  * @throws If the signature verification fails.
  */
 export async function signDecryptionPermit(
@@ -353,12 +353,12 @@ export async function signDecryptionPermit(
     startTimestamp,
     durationDays,
     signerAddress: signerAddressArg,
-    transportKeypair,
+    transportKeyPair: transportKeyPair,
     signer,
     delegatorAddress,
   } = parameters;
 
-  assertIsTransportKeypair(transportKeypair, {});
+  assertIsTransportKeyPair(transportKeyPair, {});
   assertIsAddress(signerAddressArg, {});
 
   if (delegatorAddress !== undefined) {
@@ -380,7 +380,7 @@ export async function signDecryptionPermit(
     durationDays,
     startTimestamp,
     extraData,
-    publicKey: transportKeypair.publicKey,
+    publicKey: transportKeyPair.publicKey,
   };
 
   const eip712 =
@@ -414,10 +414,10 @@ export async function parseSignedDecryptionPermit(
     readonly client: NonNullable<object>;
     readonly options: { readonly batchRpcCalls: boolean };
   },
-  transportKeypair: TransportKeypair,
+  transportKeyPair: TransportKeyPair,
   permit: unknown,
 ): Promise<SignedDecryptionPermit> {
-  assertIsTransportKeypair(transportKeypair, {});
+  assertIsTransportKeyPair(transportKeyPair, {});
 
   const permitName = 'permit';
   const options = {};
@@ -438,10 +438,10 @@ export async function parseSignedDecryptionPermit(
     throw new Error(`Unknown permit primaryType: ${primaryType}`);
   }
 
-  if (eip712.message.publicKey.toLowerCase() !== transportKeypair.publicKey.toLowerCase()) {
+  if (eip712.message.publicKey.toLowerCase() !== transportKeyPair.publicKey.toLowerCase()) {
     throw new Error(
-      "The permit's publicKey does not match the E2eTransportKeypair's publicKey. " +
-        'Ensure the permit was signed with the same keypair.',
+      "The permit's publicKey does not match the TransportKeyPairKeyPair's publicKey. " +
+        'Ensure the permit was signed with the same key pair.',
     );
   }
 

package/core/kms/{TransportKeypair-p.ts → TransportKeyPair-p.ts}

@@ -10,22 +10,22 @@ import { verifyTkmsPublicKey } from '../utils-p/decrypt/verifyTkmsPublicKey.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
-const PRIVATE_TOKEN = Symbol('TransportKeypair.token');
+const PRIVATE_TOKEN = Symbol('TransportKeyPair.token');
 
 ////////////////////////////////////////////////////////////////////////////////
 
-declare const TransportKeypairBrand: unique symbol;
+declare const TransportKeyPairBrand: unique symbol;
 
-export type TransportKeypair = {
+export type TransportKeyPair = {
   readonly publicKey: BytesHex;
-  readonly [TransportKeypairBrand]: true;
+  readonly [TransportKeyPairBrand]: true;
 };
 
 ////////////////////////////////////////////////////////////////////////////////
-// TransportKeypairImpl
+// TransportKeyPairImpl
 //
 // Unexported class wrapping closures that bind a tkmsPrivateKey.
-// - Class: enables instanceof checks (isTransportKeypair)
+// - Class: enables instanceof checks (isTransportKeyPair)
 // - Closures: methods capture privateKey without exposing it
 // - Frozen: instance, class, and prototype are all immutable
 // - Tree-shakable: unused exports are eliminated by bundlers
@@ -35,8 +35,8 @@ export type TransportKeypair = {
 const GetTkmsPrivateKeyFn = Symbol();
 const SerializeFn = Symbol();
 
-class TransportKeypairImpl implements TransportKeypair {
-  declare readonly [TransportKeypairBrand]: true;
+class TransportKeyPairImpl implements TransportKeyPair {
+  declare readonly [TransportKeyPairBrand]: true;
 
   readonly #publicKeyBytesHex: BytesHex;
   readonly #privateKeyBytes: Bytes;
@@ -82,7 +82,7 @@ class TransportKeypairImpl implements TransportKeypair {
       throw new Error('Unauthorized');
     }
     // If the runtime was GC'd, deref() returns undefined, which !== expectedRuntime → throws.
-    // This is intentional: a GC'd runtime means the keypair is stale.
+    // This is intentional: a GC'd runtime means the key pair is stale.
     if (expectedRuntime !== this.#runtime.deref()) {
       throw new Error('Invalid runtime');
     }
@@ -109,7 +109,7 @@ class TransportKeypairImpl implements TransportKeypair {
   }
 
   /**
-   * Hidden method (Symbol key) that serializes the keypair including the private key.
+   * Hidden method (Symbol key) that serializes the key pair including the private key.
    *
    * Access is protected by the Symbol key (not exported) and the private token.
    */
@@ -135,29 +135,29 @@ class TransportKeypairImpl implements TransportKeypair {
   }
 }
 
-Object.freeze(TransportKeypairImpl);
-Object.freeze(TransportKeypairImpl.prototype);
+Object.freeze(TransportKeyPairImpl);
+Object.freeze(TransportKeyPairImpl.prototype);
 
 ////////////////////////////////////////////////////////////////////////////////
 
 /** Type guard. */
-export function isTransportKeypair(value: unknown): value is TransportKeypair {
-  return value instanceof TransportKeypairImpl;
+export function isTransportKeyPair(value: unknown): value is TransportKeyPair {
+  return value instanceof TransportKeyPairImpl;
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 
-/** Throws {@link InvalidTypeError} if value is not a valid {@link TransportKeypair}. */
-export function assertIsTransportKeypair(
+/** Throws {@link InvalidTypeError} if value is not a valid {@link TransportKeyPair}. */
+export function assertIsTransportKeyPair(
   value: unknown,
   options: { subject?: string } & ErrorMetadataParams,
-): asserts value is TransportKeypair {
-  if (!isTransportKeypair(value)) {
+): asserts value is TransportKeyPair {
+  if (!isTransportKeyPair(value)) {
     throw new InvalidTypeError(
       {
         subject: options.subject,
         type: typeof value,
-        expectedType: 'TransportKeypair',
+        expectedType: 'TransportKeyPair',
       },
       options,
     );
@@ -166,14 +166,14 @@ export function assertIsTransportKeypair(
 
 ////////////////////////////////////////////////////////////////////////////////
 
-/** Generates a fresh {@link TransportKeypair}. */
-export async function generateTransportKeypair(context: { readonly runtime: WithDecrypt }): Promise<TransportKeypair> {
+/** Generates a fresh {@link TransportKeyPair}. */
+export async function generateTransportKeyPair(context: { readonly runtime: WithDecrypt }): Promise<TransportKeyPair> {
   const tkmsPrivateKey = await context.runtime.decrypt.generateTkmsPrivateKey();
   const tkmsPrivateKeyBytes = await context.runtime.decrypt.serializeTkmsPrivateKey({ tkmsPrivateKey });
   const tkmsPublicKeyBytesHex = await context.runtime.decrypt.getTkmsPublicKeyHex({
     tkmsPrivateKey,
   });
-  return new TransportKeypairImpl(PRIVATE_TOKEN, context.runtime, {
+  return new TransportKeyPairImpl(PRIVATE_TOKEN, context.runtime, {
     privateKeyBytes: tkmsPrivateKeyBytes,
     publicKeyBytesHex: tkmsPublicKeyBytesHex,
     tkmsPrivateKey,
@@ -181,25 +181,25 @@ export async function generateTransportKeypair(context: { readonly runtime: With
 }
 
 /**
- * Converts an unknown value into a {@link TransportKeypair}.
+ * Converts an unknown value into a {@link TransportKeyPair}.
  *
  * Accepted inputs:
- * - An existing {@link TransportKeypair} (returned as-is)
+ * - An existing {@link TransportKeyPair} (returned as-is)
  * - A plain object `{ publicKey, privateKey }` where each is `Bytes` or `BytesHex`
  *
- * @throws {InvalidTypeError} If `value` is not a recognized keypair shape.
+ * @throws {InvalidTypeError} If `value` is not a recognized key pair shape.
  */
-export async function toTransportKeypair(
+export async function toTransportKeyPair(
   context: { readonly runtime: FhevmRuntime },
   value: unknown,
-): Promise<TransportKeypair> {
-  if (isTransportKeypair(value)) {
+): Promise<TransportKeyPair> {
+  if (isTransportKeyPair(value)) {
     // Force realize
-    await (value as TransportKeypairImpl)[GetTkmsPrivateKeyFn](PRIVATE_TOKEN, context.runtime);
+    await (value as TransportKeyPairImpl)[GetTkmsPrivateKeyFn](PRIVATE_TOKEN, context.runtime);
     return value;
   }
 
-  const name = 'TransportKeypair';
+  const name = 'TransportKeyPair';
   const options = {};
 
   assertRecordNonNullableProperty(value, 'publicKey', name, {
@@ -240,7 +240,7 @@ export async function toTransportKeypair(
     await verifyTkmsPublicKey({ runtime: runtimeWithDecrypt }, { tkmsPrivateKey, tkmsPublicKeyBytesHex });
   }
 
-  return new TransportKeypairImpl(PRIVATE_TOKEN, context.runtime, {
+  return new TransportKeyPairImpl(PRIVATE_TOKEN, context.runtime, {
     privateKeyBytes: tkmsPrivateKeyBytes,
     publicKeyBytesHex: tkmsPublicKeyBytesHex,
     tkmsPrivateKey,
@@ -248,31 +248,31 @@ export async function toTransportKeypair(
 }
 
 /**
- * Serializes an {@link TransportKeypair} including the private key.
+ * Serializes an {@link TransportKeyPair} including the private key.
  *
  * **The output contains sensitive key material — handle and store securely.**
  *
- * @throws {InvalidTypeError} If `value` is not a valid {@link TransportKeypair}.
+ * @throws {InvalidTypeError} If `value` is not a valid {@link TransportKeyPair}.
  */
-export function serializeTransportKeypair(value: TransportKeypair): {
+export function serializeTransportKeyPair(value: TransportKeyPair): {
   publicKey: BytesHex;
   privateKey: BytesHex;
 } {
-  assertIsTransportKeypair(value, {});
-  return (value as TransportKeypairImpl)[SerializeFn](PRIVATE_TOKEN);
+  assertIsTransportKeyPair(value, {});
+  return (value as TransportKeyPairImpl)[SerializeFn](PRIVATE_TOKEN);
 }
 
 /**
- * Extracts the deserialized TKMS private key from an {@link TransportKeypair}.
+ * Extracts the deserialized TKMS private key from an {@link TransportKeyPair}.
  * Lazily deserializes and verifies the key on first access.
  *
- * @throws {InvalidTypeError} If `value` is not a valid {@link TransportKeypair}.
+ * @throws {InvalidTypeError} If `value` is not a valid {@link TransportKeyPair}.
  * @throws If the runtime does not match or the key verification fails.
  */
-export async function transportKeypairToTkmsPrivateKey(
+export async function transportKeyPairToTkmsPrivateKey(
   context: { readonly runtime: FhevmRuntime },
-  value: TransportKeypair,
+  value: TransportKeyPair,
 ): Promise<TkmsPrivateKey> {
-  assertIsTransportKeypair(value, {});
-  return await (value as TransportKeypairImpl)[GetTkmsPrivateKeyFn](PRIVATE_TOKEN, context.runtime);
+  assertIsTransportKeyPair(value, {});
+  return await (value as TransportKeyPairImpl)[GetTkmsPrivateKeyFn](PRIVATE_TOKEN, context.runtime);
 }

package/core/kms/decryptKmsSignedcryptedShares-p.ts

@@ -1,8 +1,8 @@
 import type { WithDecrypt } from '../types/coreFhevmRuntime.js';
 import type { KmsSigncryptedShares } from '../types/kms.js';
 import type { ClearValue } from '../types/encryptedTypes-p.js';
-import type { TransportKeypair } from './TransportKeypair-p.js';
-import { transportKeypairToTkmsPrivateKey } from './TransportKeypair-p.js';
+import type { TransportKeyPair } from './TransportKeyPair-p.js';
+import { transportKeyPairToTkmsPrivateKey } from './TransportKeyPair-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 // decryptKmsSignedcryptedShares (with privateKey)
@@ -14,7 +14,7 @@ type Context = {
 
 type Parameters = {
   readonly kmsSigncryptedShares: KmsSigncryptedShares;
-  readonly transportKeypair: TransportKeypair;
+  readonly transportKeyPair: TransportKeyPair;
 };
 
 type ReturnType = readonly ClearValue[];
@@ -22,10 +22,10 @@ type ReturnType = readonly ClearValue[];
 ////////////////////////////////////////////////////////////////////////////////
 
 export async function decryptKmsSignedcryptedShares(context: Context, parameters: Parameters): Promise<ReturnType> {
-  const { transportKeypair, kmsSigncryptedShares } = parameters;
+  const { transportKeyPair: transportKeyPair, kmsSigncryptedShares } = parameters;
 
-  // also validates `transportKeypair`
-  const tkmsPrivateKey = await transportKeypairToTkmsPrivateKey(context, transportKeypair);
+  // also validates `transportKeyPair`
+  const tkmsPrivateKey = await transportKeyPairToTkmsPrivateKey(context, transportKeyPair);
 
   // Using the `KmsSigncryptedShares` decrypt and reconstruct clear values
   const orderedDecryptedHandles: readonly ClearValue[] = await context.runtime.decrypt.decryptAndReconstruct({

package/core/kms/decryptValuesFromPairs.ts

@@ -7,7 +7,7 @@ import type { KmsSigncryptedShares } from '../types/kms.js';
 import type { ChecksummedAddress, TypedValue } from '../types/primitives.js';
 import type { RelayerDelegatedUserDecryptOptions, RelayerUserDecryptOptions } from '../types/relayer.js';
 import type { SignedDelegatedDecryptionPermit, SignedSelfDecryptionPermit } from '../types/signedDecryptionPermit.js';
-import type { TransportKeypair } from './TransportKeypair-p.js';
+import type { TransportKeyPair } from './TransportKeyPair-p.js';
 import { decryptKmsSignedcryptedShares } from './decryptKmsSignedcryptedShares-p.js';
 import { fetchKmsSignedcryptedShares } from './fetchKmsSignedcryptedShares-p.js';
 
@@ -27,7 +27,7 @@ type Parameters =
         readonly contractAddress: ChecksummedAddress;
       }>;
       readonly signedPermit: SignedSelfDecryptionPermit;
-      readonly transportKeypair: TransportKeypair;
+      readonly transportKeyPair: TransportKeyPair;
       readonly options?: RelayerUserDecryptOptions | undefined;
     }
   | {
@@ -36,7 +36,7 @@ type Parameters =
         readonly contractAddress: ChecksummedAddress;
       }>;
       readonly signedPermit: SignedDelegatedDecryptionPermit;
-      readonly transportKeypair: TransportKeypair;
+      readonly transportKeyPair: TransportKeyPair;
       readonly options?: RelayerDelegatedUserDecryptOptions | undefined;
     };
 
@@ -45,13 +45,13 @@ export type ReturnType = readonly TypedValue[];
 ////////////////////////////////////////////////////////////////////////////////
 
 export async function decryptValuesFromPairs(fhevm: Context, parameters: Parameters): Promise<ReturnType> {
-  const { transportKeypair } = parameters;
+  const { transportKeyPair: transportKeyPair } = parameters;
 
   const kmsSigncryptedShares: KmsSigncryptedShares = await fetchKmsSignedcryptedShares(fhevm, parameters);
 
   // Using the `KmsSigncryptedShares` decrypt and reconstruct clear values
   return decryptKmsSignedcryptedShares(fhevm, {
     kmsSigncryptedShares,
-    transportKeypair,
+    transportKeyPair: transportKeyPair,
   });
 }

package/core/kms/index.ts

@@ -1 +0,0 @@
-export type { TransportKeypair } from './TransportKeypair-p.ts';

package/core/kms/kmsExtraData.ts

@@ -9,6 +9,13 @@ export function fromKmsExtraData(extraData: BytesHex): {
   version: Uint8Number;
   kmsContextId: Uint256BigInt;
 } {
+  if ((extraData as string) === '0x00' || (extraData as string) === '0x') {
+    return {
+      version: 0 as Uint8Number,
+      kmsContextId: 0n as Uint256BigInt,
+    };
+  }
+
   // First byte = version (characters 2-3 after '0x')
   const version = asUint8Number(parseInt(extraData.slice(2, 4), 16));
 
@@ -43,7 +50,7 @@ export function assertIsKmsExtraData(
   value: unknown,
   options: { subject?: string } & ErrorMetadataParams,
 ): asserts value is BytesHex {
-  if (value === '0x00') {
+  if (value === '0x00' || value === '0x') {
     return;
   }
   assertIsBytesHex(value, { ...options, byteLength: 33 as ByteLength });

package/core/modules/decrypt/mock.ts

@@ -53,7 +53,7 @@ export async function decryptAndReconstruct(
   const cleartextEthereumModule = runtime.ethereum as CleartextEthereumModule;
   const { tkmsPrivateKey, shares } = parameters;
 
-  const privateKeySecp256k1 = asBytesHex(tkmsPrivateKey as unknown);
+  const privateKeySecp256k1 = asBytesHex(tkmsPrivateKey);
   const publicKeySecp256k1 = cleartextEthereumModule.getPublicKey({ privateKey: privateKeySecp256k1 });
 
   const metadata: KmsSigncryptedSharesMetadata = getMetadata(shares);
@@ -149,7 +149,7 @@ export async function getTkmsPublicKeyHex(
   parameters: GetTkmsPublicKeyHexParameters,
 ): Promise<GetTkmsPublicKeyHexReturnType> {
   const { tkmsPrivateKey } = parameters;
-  const privateKeySecp256k1 = asBytesHex(tkmsPrivateKey as unknown);
+  const privateKeySecp256k1 = asBytesHex(tkmsPrivateKey);
   const cleartextEthereumModule = runtime.ethereum as CleartextEthereumModule;
   const publicKeySecp256k1 = cleartextEthereumModule.getPublicKey({ privateKey: privateKeySecp256k1 });
   return Promise.resolve(publicKeySecp256k1);
@@ -164,7 +164,7 @@ export async function serializeTkmsPrivateKey(
   parameters: SerializeTkmsPrivateKeyParameters,
 ): Promise<SerializeTkmsPrivateKeyReturnType> {
   const { tkmsPrivateKey } = parameters;
-  const privateKeySecp256k1 = asBytesHex(tkmsPrivateKey as unknown);
+  const privateKeySecp256k1 = asBytesHex(tkmsPrivateKey);
   const privateKeySecp256k1Bytes = hexToBytes(privateKeySecp256k1);
   return Promise.resolve(privateKeySecp256k1Bytes);
 }

package/core/modules/decrypt/module/init-p.ts

@@ -109,22 +109,21 @@ export async function initTkmsModule(runtime: FhevmRuntime): Promise<void> {
 
   ownerUid = runtime.uid;
 
-  if (cachedTkmsModulePromise !== undefined) {
-    return cachedTkmsModulePromise;
+  // Cache the TKMS initialization promise once and keep it cached even if it
+  // rejects.
+  //
+  // Retry is not supported:
+  // -----------------------
+  // The underlying KMS/WASM bindings
+  // keep module-level state that cannot be reset reliably after a partial
+  // initialization failure; later callers should observe the original error
+  // instead of retrying against half-initialized state.
+  if (cachedTkmsModulePromise === undefined) {
+    // resolve is sync
+    const cfg = _getOrResolveTkmsModuleConfig(runtime);
+    cachedTkmsModulePromise = _initTkmsModule(cfg);
   }
 
-  // Use existing config if already set, otherwise resolve from runtime
-  const cfg = _getOrResolveTkmsModuleConfig(runtime);
-
-  cachedTkmsModulePromise = _initTkmsModule(cfg);
-
-  // This is purely theoretical. Retry is not yet possible since the `_initTkmsModule`
-  // does not support retry (see kms lib internal global variables).
-  cachedTkmsModulePromise.catch(() => {
-    // Clear cache on failure so retry is possible
-    cachedTkmsModulePromise = undefined;
-  });
-
   return cachedTkmsModulePromise;
 }
 

package/core/modules/encrypt/mock.ts

@@ -6,15 +6,13 @@ import type { FhevmRuntime } from '../../types/coreFhevmRuntime.js';
 import type {
   FheEncryptionCrs,
   FheEncryptionCrsBrand,
-  FheEncryptionCrsBytes,
   FheEncryptionKeyBytes,
   FheEncryptionPublicKey,
   FheEncryptionPublicKeyBrand,
-  FheEncryptionPublicKeyBytes,
 } from '../../types/fheEncryptionKey.js';
 import type { Bytes, BytesHex, UintNumber } from '../../types/primitives.js';
 import type {
-  BuildWithProofPackedReturnTypeParameters,
+  BuildWithProofPackedParameters,
   BuildWithProofPackedReturnType,
   ParseTFHEProvenCompactCiphertextListParameters,
   ParseTFHEProvenCompactCiphertextListReturnType,
@@ -123,7 +121,7 @@ export async function parseTFHEProvenCompactCiphertextList(
 ////////////////////////////////////////////////////////////////////////////////
 
 export async function buildWithProofPacked(
-  parameters: BuildWithProofPackedReturnTypeParameters,
+  parameters: BuildWithProofPackedParameters,
 ): Promise<BuildWithProofPackedReturnType> {
   const { fheEncryptionKey: publicEncryptionParams, metaData, typedValues, extraData } = parameters;
 
@@ -219,7 +217,7 @@ export async function serializeFheEncryptionPublicKey(
   return Object.freeze({
     id: tfhePublicKey.id,
     bytes: tfhePublicKeyBytes,
-  }) as FheEncryptionPublicKeyBytes;
+  });
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -246,7 +244,7 @@ export async function serializeFheEncryptionCrs(
     id: tfheCrs.id,
     capacity: tfheCrs.capacity,
     bytes: tfheCrsBytes,
-  }) as FheEncryptionCrsBytes;
+  });
 }
 
 ////////////////////////////////////////////////////////////////////////////////