@fhevm/sdk 1.1.0-alpha.6 → 1.1.0-alpha.8

package/core/actions/encrypt/generateZkProof.ts

@@ -5,6 +5,7 @@ import type { ZkProof } from '../../types/zkProof-p.js';
 import type { BytesHex } from '../../types/primitives.js';
 import { createTypedValue } from '../../base/typedValue.js';
 import { createZkProofBuilder } from '../../coprocessor/ZkProofBuilder-p.js';
+import { resolveRawValueTypeName } from '../../handle/FheType.js';
 import { asFhevmWithTfheVersion } from '../../runtime/CoreFhevm-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -28,7 +29,7 @@ export async function generateZkProof(
 
   const builder = createZkProofBuilder();
   for (const value of values) {
-    builder.addTypedValue(createTypedValue(value));
+    builder.addTypedValue(createTypedValue({ type: resolveRawValueTypeName(value.type), value: value.value }));
   }
 
   const f = asFhevmWithTfheVersion(fhevm);

package/core/actions/host/index.ts

@@ -10,24 +10,4 @@ export {
   isAllowedForDecryption,
 } from './isAllowedForDecryption.js';
 
-export { type ResolveChainIdParameters, type ResolveChainIdReturnType, resolveChainId } from './resolveChainId.js';
-
-export {
-  type ReadFhevmExecutorContractDataParameters,
-  type ReadFhevmExecutorContractDataReturnType,
-  readFhevmExecutorContractData,
-} from './readFhevmExecutorContractData.js';
-
-export {
-  type ReadKmsVerifierContractDataParameters,
-  type ReadKmsVerifierContractDataReturnType,
-  readKmsVerifierContractData,
-} from './readKmsVerifierContractData.js';
-
 export { type PersistAllowedParameters, type PersistAllowedReturnType, persistAllowed } from './persistAllowed.js';
-
-export {
-  type ReadInputVerifierContractDataParameters,
-  type ReadInputVerifierContractDataReturnType,
-  readInputVerifierContractData,
-} from './readInputVerifierContractData.js';

package/core/actions/host/readKmsVerifierContractData.ts

@@ -10,7 +10,7 @@ import { assertIsKmsEip712Domain } from '../../kms/createKmsEip712Domain.js';
 import { eip712Domain } from '../../host-contracts/eip712Domain-p.js';
 import { assertIsHostContractVersionOf } from '../../host-contracts/HostContractVersion-p.js';
 import { getHostContractVersion } from '../../host-contracts/HostContractVersion-p.js';
-import { readKmsSignersContext } from '../../host-contracts/readKmsSignersContext-p.js';
+import { readCurrentKmsSignersContext } from '../../host-contracts/readKmsSignersContext-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -44,7 +44,7 @@ export async function readKmsVerifierContractData(
   const rpcCalls = [
     () => getHostContractVersion(fhevm, parameters),
     () => eip712Domain(fhevm, parameters),
-    () => readKmsSignersContext(fhevm, { kmsVerifierAddress, protocolConfigAddress }),
+    () => readCurrentKmsSignersContext(fhevm, { kmsVerifierAddress, protocolConfigAddress }),
   ];
 
   const res = await executeWithBatching<unknown>(rpcCalls, fhevm.options.batchRpcCalls);

package/core/base/cachedFetch.ts

@@ -23,6 +23,7 @@ type CachedFetchOptions<TContext, TParams, TResult> = {
 };
 
 export const CACHE_TTL_24H = 24 * 60 * 60 * 1000; // 24 hours
+export const CACHE_TTL_15MIN = 15 * 60 * 1000; // 15 min
 
 /**
  * Creates a cached, deduplicating wrapper around an async fetch function.

package/core/base/uint.ts

@@ -23,7 +23,12 @@ import type {
   UintTypeName,
   ValueTypeName,
 } from '../types/primitives.js';
-import type { RecordWithPropertyType, RecordUintPropertyType, RecordUint256PropertyType } from '../types/record-p.js';
+import type {
+  RecordWithPropertyType,
+  RecordUintPropertyType,
+  RecordUint256PropertyType,
+  RecordUintNumberPropertyType,
+} from '../types/record-p.js';
 import type { ErrorMetadataParams } from './errors/ErrorBase.js';
 import { isRecordNonNullableProperty, typeofProperty } from './record.js';
 import { InvalidPropertyError } from './errors/InvalidPropertyError.js';
@@ -615,6 +620,18 @@ export function assertRecordUintProperty<K extends string>(
 
 ////////////////////////////////////////////////////////////////////////////////
 
+export function isRecordUintNumberProperty<K extends string>(
+  record: unknown,
+  property: K,
+): record is RecordUintNumberPropertyType<K> {
+  if (!isRecordNonNullableProperty(record, property)) {
+    return false;
+  }
+  return isUintNumber(record[property]);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
 export function isRecordUint256Property<K extends string>(
   record: unknown,
   property: K,

package/core/clients/decorators/base.ts

@@ -1,19 +1,12 @@
 import type { Fhevm, FhevmBase, FhevmExtension } from '../../types/coreFhevmClient.js';
 import type { FhevmChain } from '../../types/fhevmChain.js';
-import type {
-  SignedSelfDecryptionPermit,
-  SignedDelegatedDecryptionPermit,
-} from '../../types/signedDecryptionPermit.js';
+import type { SignedDecryptionPermit } from '../../types/signedDecryptionPermit.js';
 import type {
   SerializeTransportKeyPairParameters,
   SerializeTransportKeyPairReturnType,
 } from '../../actions/chain/serializeTransportKeyPair.js';
 import { assertIsFhevmBaseClient } from '../../runtime/CoreFhevm-p.js';
-import {
-  signDecryptionPermit,
-  type SignSelfDecryptionPermitParameters,
-  type SignDelegatedDecryptionPermitParameters,
-} from '../../actions/base/signDecryptionPermit.js';
+import { signDecryptionPermit, type SignDecryptionPermitParameters } from '../../actions/base/signDecryptionPermit.js';
 import {
   parseTransportKeyPair,
   type ParseTransportKeyPairParameters,
@@ -127,27 +120,16 @@ export type BaseActions = {
   readonly decryptPublicValuesWithSignatures: (
     parameters: DecryptPublicValuesWithSignaturesParameters,
   ) => Promise<DecryptPublicValuesWithSignaturesReturnType>;
-  readonly signDecryptionPermit: {
-    /**
-     * Signs a self decryption permit — Alice decrypts her own encrypted values.
-     *
-     * 1. Alice signs a permit saying "I, Alice, want to decrypt my own handles."
-     * 2. Alice calls `decrypt` with this permit.
-     * 3. The KMS verifies Alice's signature and releases decrypted shares to her.
-     *
-     * No `delegatorAddress` needed — the signer is the owner.
-     */
-    (parameters: SignSelfDecryptionPermitParameters): Promise<SignedSelfDecryptionPermit>;
-    /**
-     * Signs a delegated decryption permit — Bob decrypts Alice's (`delegatorAddress`) encrypted values.
-     *
-     * 1. Alice calls `FHE.delegateUserDecryption()` on-chain, giving Bob permission to decrypt her handles.
-     * 2. Bob signs a permit with `delegatorAddress: Alice`, saying "I, Bob, want to decrypt Alice's handles."
-     * 3. Bob calls `decrypt` with this permit.
-     * 4. The KMS authenticates Bob via his signature, then checks the on-chain ACL to verify Alice delegated to Bob.
-     */
-    (parameters: SignDelegatedDecryptionPermitParameters): Promise<SignedDelegatedDecryptionPermit>;
-  };
+  /**
+   * Signs a decryption permit.
+   *
+   * - Without `delegatorAddress`: Alice signs to decrypt her own encrypted values.
+   * - With `delegatorAddress`: Bob signs to decrypt values belonging to `delegatorAddress` (Alice),
+   *   after Alice has granted permission via `FHE.delegateUserDecryption()` on-chain.
+   *
+   * Inspect `isDelegated` on the returned permit to distinguish the two cases.
+   */
+  readonly signDecryptionPermit: (parameters: SignDecryptionPermitParameters) => Promise<SignedDecryptionPermit>;
   /** Deserializes a previously serialized e2e transport key pair back into a usable key pair. */
   readonly parseTransportKeyPair: (
     parameters: ParseTransportKeyPairParameters,
@@ -177,13 +159,7 @@ function _baseActions(fhevm: Fhevm<FhevmChain>): BaseActions {
     decryptPublicValue: (parameters) => decryptPublicValue(fhevm, parameters),
     decryptPublicValues: (parameters) => decryptPublicValues(fhevm, parameters),
     decryptPublicValuesWithSignatures: (parameters) => decryptPublicValuesWithSignatures(fhevm, parameters),
-    // Preserve the original action overloads on the decorated client API.
-    // Runtime behavior is unchanged: this is a direct pass-through wrapper.
-    signDecryptionPermit: ((parameters: SignSelfDecryptionPermitParameters | SignDelegatedDecryptionPermitParameters) =>
-      signDecryptionPermit(
-        fhevm,
-        parameters as SignSelfDecryptionPermitParameters,
-      )) as BaseActions['signDecryptionPermit'],
+    signDecryptionPermit: (parameters) => signDecryptionPermit(fhevm, parameters),
     parseTransportKeyPair: (parameters) => parseTransportKeyPair(fhevm, parameters),
     serializeTransportKeyPair: (parameters) => serializeTransportKeyPair(fhevm, parameters),
     serializeSignedDecryptionPermit: (parameters) => serializeSignedDecryptionPermit(fhevm, parameters),

package/core/coprocessor/coprocessorEip712Types.ts

@@ -5,7 +5,7 @@ import type { CoprocessorEip712Types } from '../types/coprocessor.js';
 ////////////////////////////////////////////////////////////////////////////////
 
 /*
-    const EIP712DomainType = [
+    const Eip712DomainType = [
       { name: 'name', type: 'string' },
       { name: 'version', type: 'string' },
       { name: 'chainId', type: 'uint256' },
@@ -16,7 +16,7 @@ import type { CoprocessorEip712Types } from '../types/coprocessor.js';
 export const coprocessorEip712PrimaryType = 'CiphertextVerification' satisfies keyof CoprocessorEip712Types;
 
 export const coprocessorEip712Types: CoprocessorEip712Types = {
-  // EIP712Domain: [
+  // Eip712Domain: [
   //   { name: 'name', type: 'string' },
   //   { name: 'version', type: 'string' },
   //   { name: 'chainId', type: 'uint256' },

package/core/handle/FheType.ts

@@ -354,6 +354,17 @@ export function typeNameFromFheTypeName(fheType: FheType): ValueTypeName {
   return fheType.substring(1) as ValueTypeName;
 }
 
+/**
+ * Resolves a raw type name to its clear `ValueTypeName`, accepting FHE type
+ * aliases ("ebool", "euint8", ...) in addition to clear-value names
+ * ("bool", "uint8", ...). Non-FHE type names are returned unchanged.
+ * @example resolveRawValueTypeName('euint8') // 'uint8'
+ * @example resolveRawValueTypeName('uint8') // 'uint8' (unchanged)
+ */
+export function resolveRawValueTypeName(type: string): string {
+  return isFheType(type) ? typeNameFromFheTypeName(type) : type;
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 // Solidity primitive type names
 ////////////////////////////////////////////////////////////////////////////////

package/core/host-contracts/HostContractVersion-p.ts

@@ -196,6 +196,18 @@ export function isVersionStrictlyBefore(
   return false;
 }
 
+/**
+ * Returns `true` if the version equals `major.minor.patch` exactly.
+ */
+export function isVersionEqual(
+  version: HostContractVersion,
+  otherVersion: { readonly major: number; readonly minor: number; readonly patch: number },
+): boolean {
+  return (
+    version.major === otherVersion.major && version.minor === otherVersion.minor && version.patch === otherVersion.patch
+  );
+}
+
 /**
  * Asserts that a {@link HostContractVersion} belongs to a specific contract.
  * Narrows the type to `HostContractVersion<name>` on success.

package/core/host-contracts/KmsSignersContext-p.ts

@@ -1,20 +1,22 @@
-import type { BytesHex, ChecksummedAddress, Uint256BigInt, Uint8Number } from '../types/primitives.js';
+import type { ChecksummedAddress, Uint256BigInt, Uint8Number } from '../types/primitives.js';
 import type { kmsBrand } from '../types/kms.js';
 import type { KmsSignersContext } from '../types/kmsSignersContext.js';
 import type { ErrorMetadataParams } from '../base/errors/ErrorBase.js';
 import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
+import type { KmsExtraData } from '../types/kms-p.js';
 import { InvalidTypeError } from '../base/errors/InvalidTypeError.js';
 import { addressToChecksummedAddress } from '../base/address.js';
 import { DuplicateSignerError, ThresholdSignerError, UnknownSignerError } from '../errors/SignersError.js';
 import { assertOwnedBy } from '../runtime/CoreFhevmRuntime-p.js';
-import {
-  assertIsKmsExtraData,
-  EXTRA_DATA_V0,
-  EXTRA_DATA_V1,
-  EXTRA_DATA_V2,
-  toKmsExtraData,
-} from '../kms/kmsExtraData.js';
 import { assertIsNonEmptyString, ensure0x } from '../base/string.js';
+import {
+  assertIsKmsExtraDataBytesHex,
+  createKmsExtraData,
+  equalsKmsExtraData,
+  fromKmsExtraDataBytesHex,
+  isKmsExtraData,
+  validateKmsExtraDataParams,
+} from '../kms/kmsExtraData-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -124,6 +126,8 @@ export function createKmsSignersContext(
 ): KmsSignersContext {
   const { kmsVerifierAddress: address, kmsContextId, kmsEpochId, kmsSigners, kmsSignerThreshold } = parameters;
 
+  validateKmsExtraDataParams({ kmsContextId: parameters.kmsContextId, kmsEpochId: parameters.kmsEpochId });
+
   return new KmsSignersContextImpl(PRIVATE_TOKEN, owner, {
     address: addressToChecksummedAddress(address),
     kmsContextId,
@@ -135,32 +139,13 @@ export function createKmsSignersContext(
 
 ////////////////////////////////////////////////////////////////////////////////
 
-export function kmsSignersContextToExtraData(kmsSignersContext: KmsSignersContext): BytesHex {
+export function kmsSignersContextToExtraData(kmsSignersContext: KmsSignersContext): KmsExtraData {
   assertIsKmsSignersContext(kmsSignersContext, {});
-
-  if (kmsSignersContext.id === 0n) {
-    return toKmsExtraData({
-      version: EXTRA_DATA_V0,
-      kmsContextId: 0n as Uint256BigInt,
-      kmsEpochId: 0n as Uint256BigInt,
-    });
-  }
-
-  if (kmsSignersContext.epochId === 0n) {
-    return toKmsExtraData({
-      version: EXTRA_DATA_V1,
-      kmsContextId: kmsSignersContext.id,
-      kmsEpochId: 0n as Uint256BigInt,
-    });
-  }
-
-  return toKmsExtraData({
-    version: EXTRA_DATA_V2,
-    kmsContextId: kmsSignersContext.id,
-    kmsEpochId: kmsSignersContext.epochId,
-  });
+  return createKmsExtraData({ kmsContextId: kmsSignersContext.id, kmsEpochId: kmsSignersContext.epochId });
 }
 
+////////////////////////////////////////////////////////////////////////////////
+
 /**
  * Asserts that the given `extraData` is a valid KMS extra data string and
  * matches the `extraData` derived from the provided {@link KmsSignersContext}.
@@ -176,15 +161,23 @@ export function assertExtraDataMatchesKmsSingersContext(
   options: { subject?: string } & ErrorMetadataParams,
 ): void {
   const { extraData, kmsSignersContext } = parameters;
-  assertIsNonEmptyString(extraData);
 
-  const sanitizedExtraData = ensure0x(extraData);
-  assertIsKmsExtraData(sanitizedExtraData, options);
+  let sanitizedExtraData: KmsExtraData;
+  if (isKmsExtraData(extraData)) {
+    sanitizedExtraData = extraData;
+  } else {
+    assertIsNonEmptyString(extraData);
+    const sanitizedExtraDataBytesHex = ensure0x(extraData);
+    assertIsKmsExtraDataBytesHex(sanitizedExtraDataBytesHex, options);
+    sanitizedExtraData = fromKmsExtraDataBytesHex(sanitizedExtraDataBytesHex);
+  }
 
   const expectedExtraData = kmsSignersContextToExtraData(kmsSignersContext);
 
-  if (sanitizedExtraData !== expectedExtraData) {
-    throw new Error(`extraData "${extraData}" does not match KmsSignersContext extraData "${expectedExtraData}".`);
+  if (!equalsKmsExtraData(sanitizedExtraData, expectedExtraData)) {
+    throw new Error(
+      `extraData "${sanitizedExtraData.toBytesHex()}" does not match KmsSignersContext extraData "${expectedExtraData.toBytesHex()}".`,
+    );
   }
 }
 

package/core/host-contracts/canDecryptValuesFromPairs.ts

@@ -1,15 +1,13 @@
 import type { FhevmChain } from '../types/fhevmChain.js';
-import type { SignedDelegatedDecryptionPermit, SignedSelfDecryptionPermit } from '../types/signedDecryptionPermit.js';
+import type { SignedDecryptionPermit } from '../types/signedDecryptionPermit.js';
 import type { TransportKeyPair } from '../kms/TransportKeyPair-p.js';
 import type { ChecksummedAddress, Uint64BigInt } from '../types/primitives.js';
 import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
 import type { Handle } from '../types/encryptedTypes-p.js';
 import { addressToChecksummedAddress, assertIsAddress } from '../base/address.js';
 import { assertHandlesBelongToSameChainId } from '../handle/FhevmHandle.js';
-import {
-  assertIsSignedDecryptionPermit,
-  assertPermitIncludesContractAddresses,
-} from '../kms/SignedDecryptionPermit-p.js';
+import { assertIsSignedDecryptionPermit } from '../kms/SignedDecryptionPermit-p.js';
+import { assertPermitV1IncludesContractAddresses } from '../kms/fetchKmsSigncryptedSharesV1-p.js';
 import { assertPermitMatchesKeyPair } from '../utils-p/decrypt/assertPermitMatchesKeyPair.js';
 import { isUserDecryptable } from '../host-contracts/isUserDecryptable.js';
 
@@ -29,7 +27,7 @@ type Parameters =
     }
   | {
       readonly pairs: ReadonlyArray<{ readonly handle: Handle; readonly contractAddress: ChecksummedAddress }>;
-      readonly signedPermit: SignedSelfDecryptionPermit | SignedDelegatedDecryptionPermit;
+      readonly signedPermit: SignedDecryptionPermit;
       readonly transportKeyPair?: TransportKeyPair | undefined;
     };
 
@@ -64,7 +62,9 @@ export async function canDecryptValuesFromPairs(context: Context, parameters: Pa
 
     assertIsSignedDecryptionPermit(signedPermit, { subject: 'signedPermit' });
     signedPermit.assertNotExpired();
-    assertPermitIncludesContractAddresses(signedPermit, contractAddresses);
+    if (signedPermit.version === 1) {
+      assertPermitV1IncludesContractAddresses(signedPermit, contractAddresses);
+    }
 
     if (parameters.transportKeyPair !== undefined) {
       assertPermitMatchesKeyPair(signedPermit, parameters.transportKeyPair);

package/core/host-contracts/getCoprocessorContextSignersAndThreshold-p.ts

@@ -5,7 +5,7 @@ import { asUint8Number, isUint8 } from '../base/uint.js';
 import { executeWithBatching } from '../base/promise.js';
 import { getTrustedClient } from '../runtime/CoreFhevm-p.js';
 import { getCoprocessorSignersAbi, getThresholdAbi } from './abi-fragments/fragments.js';
-import { CACHE_TTL_24H, createCachedFetch } from '../base/cachedFetch.js';
+import { CACHE_TTL_15MIN, createCachedFetch } from '../base/cachedFetch.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -30,7 +30,7 @@ const cachedGetCoprocessorContextSignersAndThreshold = createCachedFetch<Context
   executeFn: _getCoprocessorContextSignersAndThreshold,
   cacheKeyFn: (context, params) => `${context.runtime.uid.toLowerCase()}:${params.address.toLowerCase()}`,
   // Signers are not Use long TTL
-  ttlMs: CACHE_TTL_24H,
+  ttlMs: CACHE_TTL_15MIN,
 });
 
 ////////////////////////////////////////////////////////////////////////////////

package/core/host-contracts/getCurrentKmsContextAndEpoch-p.ts

@@ -4,7 +4,7 @@ import { getCurrentKmsContextAndEpochAbi } from './abi-fragments/fragments.js';
 import { getTrustedClient } from '../runtime/CoreFhevm-p.js';
 import { getHostContractVersion, isVersionStrictlyBefore } from './HostContractVersion-p.js';
 import { assertIsUint256 } from '../base/uint.js';
-import { CACHE_TTL_24H, createCachedFetch } from '../base/cachedFetch.js';
+import { CACHE_TTL_15MIN, createCachedFetch } from '../base/cachedFetch.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -25,7 +25,7 @@ const cachedGetCurrentKmsContextAndEpoch = createCachedFetch<Context, Parameters
   executeFn: _getCurrentKmsContextAndEpoch,
   cacheKeyFn: (context, params) => `${context.runtime.uid.toLowerCase()}:${params.protocolConfigAddress.toLowerCase()}`,
   // Host contract values are immutable per deployment, so a long TTL is safe.
-  ttlMs: CACHE_TTL_24H,
+  ttlMs: CACHE_TTL_15MIN,
 });
 
 /**

package/core/host-contracts/getCurrentKmsContextId-p.ts

@@ -4,7 +4,7 @@ import { getCurrentKmsContextIdAbi } from './abi-fragments/fragments.js';
 import { getTrustedClient } from '../runtime/CoreFhevm-p.js';
 import { getHostContractVersion, isVersionStrictlyBefore } from './HostContractVersion-p.js';
 import { assertIsUint256 } from '../base/uint.js';
-import { CACHE_TTL_24H, createCachedFetch } from '../base/cachedFetch.js';
+import { CACHE_TTL_15MIN, createCachedFetch } from '../base/cachedFetch.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -25,7 +25,7 @@ const cachedGetCurrentKmsContextId = createCachedFetch<Context, Parameters, Retu
   executeFn: _getCurrentKmsContextId,
   cacheKeyFn: (context, params) => `${context.runtime.uid.toLowerCase()}:${params.kmsVerifierAddress.toLowerCase()}`,
   // Host contract versions are immutable per deployment, so a long TTL is safe.
-  ttlMs: CACHE_TTL_24H,
+  ttlMs: CACHE_TTL_15MIN,
 });
 
 /**

package/core/host-contracts/getKmsContextSignersAndThreshold-p.ts

@@ -7,7 +7,7 @@ import { isVersionStrictlyBefore } from '../host-contracts/HostContractVersion-p
 import { executeWithBatching } from '../base/promise.js';
 import { getTrustedClient } from '../runtime/CoreFhevm-p.js';
 import { getKmsSignersAbi, getThresholdAbi } from './abi-fragments/fragments.js';
-import { CACHE_TTL_24H, createCachedFetch } from '../base/cachedFetch.js';
+import { CACHE_TTL_15MIN, createCachedFetch } from '../base/cachedFetch.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -32,7 +32,7 @@ const cachedGetKmsContextSignersAndThreshold = createCachedFetch<Context, Parame
   executeFn: _getKmsContextSignersAndThreshold,
   cacheKeyFn: (context, params) => `${context.runtime.uid.toLowerCase()}:${params.kmsVerifierAddress.toLowerCase()}`,
   // Host contract versions are immutable per deployment, so a long TTL is safe.
-  ttlMs: CACHE_TTL_24H,
+  ttlMs: CACHE_TTL_15MIN,
 });
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -68,6 +68,7 @@ async function _getKmsContextSignersAndThreshold(context: Context, parameters: P
   if (!isVersionStrictlyBefore(kmsVerifierVersion, { major: 0, minor: 2 })) {
     throw new Error('getContextSignersAndThreshold requires KMSVerifier < v0.2.0');
   }
+
   ////////////////////////////////////////////////////////////////////////////
   //
   // Important remark:

package/core/host-contracts/getKmsContextSignersAndThresholdFromExtraData-p.ts

@@ -1,12 +1,13 @@
-import type { BytesHex, ChecksummedAddress, Uint8Number } from '../types/primitives.js';
+import type { ChecksummedAddress, Uint8Number } from '../types/primitives.js';
 import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
+import type { KmsExtraData } from '../types/kms-p.js';
 import { getHostContractVersion, isVersionStrictlyBefore } from './HostContractVersion-p.js';
 import { createCachedFetch } from '../base/cachedFetch.js';
-import { assertIsKmsExtraData, fromKmsExtraData } from '../kms/kmsExtraData.js';
 import { assertIsChecksummedAddressArray } from '../base/address.js';
 import { isUint8 } from '../base/uint.js';
 import { getContextSignersAndThresholdFromExtraDataAbi } from './abi-fragments/fragments.js';
 import { getTrustedClient } from '../runtime/CoreFhevm-p.js';
+import { assertIsKmsExtraData } from '../kms/kmsExtraData-p.js';
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -17,7 +18,7 @@ type Context = {
 
 type Parameters = {
   readonly kmsVerifierAddress: ChecksummedAddress;
-  readonly extraData: BytesHex;
+  readonly extraData: KmsExtraData;
 };
 
 type ReturnType = {
@@ -30,9 +31,9 @@ type ReturnType = {
 const cachedGetKmsContextSignersAndThresholdFromExtraData = createCachedFetch<Context, Parameters, ReturnType>({
   executeFn: _getKmsContextSignersAndThresholdFromExtraData,
   cacheKeyFn: (context, params) => {
-    const { kmsContextId } = fromKmsExtraData(params.extraData);
-    const contextIdHex = kmsContextId.toString(16).padStart(64, '0');
-    return `${context.runtime.uid.toLowerCase()}:${params.kmsVerifierAddress.toLowerCase()}:${contextIdHex}`;
+    const kmsContextId = params.extraData.kmsContextId;
+    const kmsContextIdHex = kmsContextId.toString(16).padStart(64, '0');
+    return `${context.runtime.uid.toLowerCase()}:${params.kmsVerifierAddress.toLowerCase()}:${kmsContextIdHex}`;
   },
   // Permanent cache: signers and threshold are immutable per context ID.
 });
@@ -76,10 +77,12 @@ async function _getKmsContextSignersAndThresholdFromExtraData(
 
   const trustedClient = getTrustedClient(context);
 
+  const extraDataBytesHex = parameters.extraData.toBytesHex();
+
   const res = await context.runtime.ethereum.readContract(trustedClient, {
     address: parameters.kmsVerifierAddress,
     abi: getContextSignersAndThresholdFromExtraDataAbi,
-    args: [parameters.extraData],
+    args: [extraDataBytesHex],
     functionName: getContextSignersAndThresholdFromExtraDataAbi[0].name,
   });