@fhevm/sdk 1.1.0-alpha.6 → 1.1.0-alpha.8

package/core/host-contracts/readKmsSignersContext-p.ts

@@ -1,21 +1,20 @@
 import type { KmsSignersContext } from '../types/kmsSignersContext.js';
 import type { BytesHex, ChecksummedAddress, Uint256BigInt } from '../types/primitives.js';
 import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
-import {
-  assertIsKmsSignersContext,
-  createKmsSignersContext,
-  kmsSignersContextToExtraData,
-} from './KmsSignersContext-p.js';
+import type { KmsExtraData } from '../types/kms-p.js';
+import { assertIsKmsSignersContext, createKmsSignersContext } from './KmsSignersContext-p.js';
 import { getCurrentKmsContextId } from './getCurrentKmsContextId-p.js';
 import { getCurrentKmsContextAndEpoch } from './getCurrentKmsContextAndEpoch-p.js';
 import { getHostContractVersion, isVersionStrictlyBefore } from './HostContractVersion-p.js';
 import {
   assertIsKmsExtraData,
-  EXTRA_DATA_V1,
-  EXTRA_DATA_V2,
-  fromKmsExtraData,
-  toKmsExtraData,
-} from '../kms/kmsExtraData.js';
+  createKmsExtraData,
+  createKmsExtraDataV1,
+  createKmsExtraDataV2,
+  equalsKmsExtraData,
+  fromKmsExtraDataBytesHex,
+  isKmsExtraDataCompatibleWithKmsVerifier,
+} from '../kms/kmsExtraData-p.js';
 import { getKmsContextSignersAndThresholdFromExtraData } from './getKmsContextSignersAndThresholdFromExtraData-p.js';
 import { getKmsSignersAndThreshold } from './getKmsContextSignersAndThreshold-p.js';
 
@@ -31,29 +30,72 @@ type Parameters = {
   readonly kmsVerifierAddress: ChecksummedAddress;
   readonly protocolConfigAddress: ChecksummedAddress | undefined;
   readonly forceRefresh?: boolean | undefined;
-  readonly kmsContextId?: Uint256BigInt | undefined;
-  readonly kmsEpochId?: Uint256BigInt | undefined;
+};
+
+type ParametersWithExtraData = Parameters & {
+  readonly extraData: KmsExtraData;
+};
+
+type ParametersWithOptionalExtraData = Parameters & {
+  readonly extraData?: KmsExtraData | undefined;
 };
 
 type ReturnType = KmsSignersContext;
 
 ////////////////////////////////////////////////////////////////////////////////
 
-export async function readKmsSignersContext(context: Context, parameters: Parameters): Promise<ReturnType> {
+export async function readCurrentKmsSignersContext(context: Context, parameters: Parameters): Promise<ReturnType> {
+  return _readKmsSignersContext(context, parameters);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * Reads the {@link KmsSignersContext} for a caller-provided `extraData`.
+ *
+ * Accepts an `extraData` of any version (v0, v1, v2, …); the underlying resolver
+ * selects the right protocol path and verifies the version is compatible with
+ * the on-chain KMSVerifier, throwing if it is not.
+ */
+export async function readKmsSignersContextFromExtraData(
+  context: Context,
+  parameters: ParametersWithExtraData,
+): Promise<ReturnType> {
+  assertIsKmsExtraData(parameters.extraData, {});
+  return _readKmsSignersContext(context, parameters);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+async function _readKmsSignersContext(
+  context: Context,
+  parameters: ParametersWithOptionalExtraData,
+): Promise<ReturnType> {
   // TTL-cached
   const kmsVerifierVersion = await getHostContractVersion(context, {
     address: parameters.kmsVerifierAddress,
   });
 
+  if (parameters.extraData !== undefined) {
+    if (!isKmsExtraDataCompatibleWithKmsVerifier(parameters.extraData, kmsVerifierVersion)) {
+      throw new Error(
+        `KmsExtraData ${parameters.extraData.toBytesHex()} is not compatible with ${kmsVerifierVersion.contractName} ${kmsVerifierVersion.version}`,
+      );
+    }
+  }
+
   if (isVersionStrictlyBefore(kmsVerifierVersion, { major: 0, minor: 2 })) {
+    // extraData.version = 0 only
     return _readKmsSignersContext_Protocol_11(context, parameters);
   }
 
   if (isVersionStrictlyBefore(kmsVerifierVersion, { major: 0, minor: 4 })) {
+    // extraData.version = 0 or 1 only
     return _readKmsSignersContext_Protocol_12_13(context, parameters);
   }
 
-  return _readKmsSignersContext_Protocol_14(context, parameters);
+  // any extraData.version
+  return _readKmsSignersContext_Protocol_14_or_higher(context, parameters);
 }
 
 ////////////////////////////////////////////////////////////////////////////////
@@ -62,10 +104,6 @@ export async function readKmsSignersContext(context: Context, parameters: Parame
 // context ID is 0. Any other value is invalid and should throw.
 // eslint-disable-next-line @typescript-eslint/naming-convention
 async function _readKmsSignersContext_Protocol_11(context: Context, parameters: Parameters): Promise<ReturnType> {
-  if (parameters.kmsContextId !== undefined && parameters.kmsContextId !== 0n) {
-    throw new Error('Impossible on protocol v0.11.0');
-  }
-
   // TTL-Cached
   const c = await getKmsSignersAndThreshold(context, parameters);
 
@@ -84,40 +122,44 @@ async function _readKmsSignersContext_Protocol_11(context: Context, parameters:
 
 // Protocol v0.12.0 / v0.13.0 (KMSVerifier = v0.2.0 / v0.3.0)
 // eslint-disable-next-line @typescript-eslint/naming-convention
-async function _readKmsSignersContext_Protocol_12_13(context: Context, parameters: Parameters): Promise<ReturnType> {
-  if (parameters.kmsEpochId !== undefined && parameters.kmsEpochId !== 0n) {
-    throw new Error('kmsEpochId should be 0 on protocol v0.12.0 / v0.13.0');
-  }
-
-  let kmsContextId: Uint256BigInt;
-  if (parameters.kmsContextId === undefined) {
+async function _readKmsSignersContext_Protocol_12_13(
+  context: Context,
+  parameters: ParametersWithOptionalExtraData,
+): Promise<ReturnType> {
+  // On protocol v0.12/v0.13, the KMS signers and threshold are looked up by
+  // `extraData` (which encodes the KMS context id). The caller may pass one in;
+  // if not, we derive it from the chain's current KMS context id using the v1
+  // extraData encoding (version byte + context id, no epoch).
+  let extraData: KmsExtraData;
+
+  if (parameters.extraData === undefined) {
     // TTL-Cached
-    kmsContextId = await getCurrentKmsContextId(context, parameters);
+    const kmsContextId = await getCurrentKmsContextId(context, parameters);
+    extraData = createKmsExtraDataV1({
+      kmsContextId,
+    });
   } else {
-    if (parameters.kmsContextId === 0n) {
-      throw new Error('kmsContextId cannot be 0 on protocol v0.12.0 / v0.13.0');
-    }
-    kmsContextId = parameters.kmsContextId;
+    // v0 or v1
+    extraData = parameters.extraData;
   }
 
-  const extraData = toKmsExtraData({
-    version: EXTRA_DATA_V1,
-    kmsContextId,
-    kmsEpochId: 0n as Uint256BigInt,
-  });
-
   // Permanent-Cached
-  const c = await getKmsContextSignersAndThresholdFromExtraData(context, {
-    ...parameters,
-    extraData,
-  });
+  // On protocol v0.12/v0.13, getKmsContextSignersAndThresholdFromExtraData
+  // supports extraData v0 and v1 only.
+  const { signers: kmsSigners, threshold: kmsSignerThreshold } = await getKmsContextSignersAndThresholdFromExtraData(
+    context,
+    {
+      ...parameters,
+      extraData,
+    },
+  );
 
   return createKmsSignersContext(new WeakRef(context.runtime), {
     ...parameters,
-    kmsContextId,
+    kmsContextId: extraData.kmsContextId,
     kmsEpochId: 0n as Uint256BigInt,
-    kmsSigners: c.signers,
-    kmsSignerThreshold: c.threshold,
+    kmsSigners,
+    kmsSignerThreshold,
   });
 }
 
@@ -125,57 +167,54 @@ async function _readKmsSignersContext_Protocol_12_13(context: Context, parameter
 
 // Protocol v0.14.0+ (KMSVerifier = v0.4.0+)
 // eslint-disable-next-line @typescript-eslint/naming-convention
-async function _readKmsSignersContext_Protocol_14(context: Context, parameters: Parameters): Promise<ReturnType> {
+async function _readKmsSignersContext_Protocol_14_or_higher(
+  context: Context,
+  parameters: ParametersWithOptionalExtraData,
+): Promise<ReturnType> {
   if (parameters.protocolConfigAddress === undefined) {
     throw new Error('protocolConfigAddress is required on protocol v0.14.0+');
   }
   const protocolConfigAddress = parameters.protocolConfigAddress;
 
-  let kmsContextId: Uint256BigInt;
-  if (parameters.kmsContextId === undefined) {
-    // TTL-Cached
-    ({ contextId: kmsContextId } = await getCurrentKmsContextAndEpoch(context, { protocolConfigAddress }));
-  } else {
-    if (parameters.kmsContextId === 0n) {
-      throw new Error('kmsContextId cannot be 0 on protocol v0.14.0+');
-    }
-    kmsContextId = parameters.kmsContextId;
-  }
+  let extraData: KmsExtraData;
 
-  let kmsEpochId: Uint256BigInt;
-  if (parameters.kmsEpochId === undefined) {
+  if (parameters.extraData === undefined) {
     // TTL-Cached
-    ({ epochId: kmsEpochId } = await getCurrentKmsContextAndEpoch(context, { protocolConfigAddress }));
+    const { contextId, epochId } = await getCurrentKmsContextAndEpoch(context, { protocolConfigAddress });
+    extraData = createKmsExtraDataV2({
+      kmsContextId: contextId,
+      kmsEpochId: epochId,
+    });
   } else {
-    if (parameters.kmsEpochId === 0n) {
-      throw new Error('kmsEpochId cannot be 0 on protocol v0.14.0+');
-    }
-    kmsEpochId = parameters.kmsEpochId;
+    // any version: v0, v1, v2, ... vn
+    extraData = parameters.extraData;
   }
 
-  const extraData = toKmsExtraData({
-    version: EXTRA_DATA_V2,
-    kmsContextId,
-    kmsEpochId,
-  });
-
   // Permanent-Cached
-  const c = await getKmsContextSignersAndThresholdFromExtraData(context, {
-    ...parameters,
-    extraData,
-  });
+  // May revert if extraData.version is incompatible (see `getKmsContextSignersAndThresholdFromExtraData` comments)
+  const { signers: kmsSigners, threshold: kmsSignerThreshold } = await getKmsContextSignersAndThresholdFromExtraData(
+    context,
+    {
+      ...parameters,
+      extraData,
+    },
+  );
 
   return createKmsSignersContext(new WeakRef(context.runtime), {
     ...parameters,
-    kmsContextId,
-    kmsEpochId,
-    kmsSigners: c.signers,
-    kmsSignerThreshold: c.threshold,
+    kmsContextId: extraData.kmsContextId,
+    kmsEpochId: extraData.kmsEpochId,
+    kmsSigners,
+    kmsSignerThreshold,
   });
 }
 
 ////////////////////////////////////////////////////////////////////////////////
 
+////////////////////////////////////////////////////////////////////////////////
+
+export type ReconcileMode = 'exact' | 'strict' | 'loose';
+
 /**
  * Reconciles the KMS signers context used by the SDK with the one the relayer
  * actually used when forwarding the decryption request to KMS nodes.
@@ -190,8 +229,10 @@ async function _readKmsSignersContext_Protocol_14(context: Context, parameters:
  *
  * ### Nomenclature
  *
- * - `requestedExtraData` — `kmsSignersContextToExtraData(requestedKmsSignersContext)`.
- * - `relayerKmsContextId` — `fromKmsExtraData(relayerExtraData).kmsContextId`.
+ * - `requestedKmsExtraData` — `createKmsExtraData({ kmsContextId, kmsEpochId })`
+ *   derived from `requestedKmsSignersContext`.
+ * - `relayerKmsExtraData` — `fromKmsExtraDataBytesHex(relayerKmsExtraDataBytesHex)`
+ *   (its `.kmsContextId` / `.kmsEpochId`).
  *
  * ### Host-Contract Compatibility
  *
@@ -202,69 +243,70 @@ async function _readKmsSignersContext_Protocol_14(context: Context, parameters:
  * - host-contracts v12 and v13 support `extraData` v0 and v1.
  * - host-contracts v14 support `extraData` v0, v1, and v2.
  *
- * ### Resolution (checked in order)
+ * ### Resolution (checked in order, then by `mode`)
  *
- * 1. `relayerExtraData === requestedExtraData` → exact byte match, return
- *    `requestedKmsSignersContext`. This is the **only** path that trusts cached data.
- * 2. In `'exact'` mode, any byte mismatch → **always throw**. This mode does
- *    not parse, refresh, or reconcile different `extraData`.
- * 3. Serialization version mismatch → **always throw**. The SDK and relayer must
- *    agree on the `extraData` encoding format, even if the context ID is the same.
- * 4. Context IDs differ → **full on-chain refetch**. The cached context is never
- *    reused, because any mismatch means on-chain state may have diverged
- *    (rotation, destruction, signer changes, etc.).
- *    - Context is **valid** on-chain (current or non-destroyed) → return it.
- *    - Context is **destroyed or out of range** → throw.
+ * 1. `relayerKmsExtraData` equals `requestedKmsExtraData` → return
+ *    `requestedKmsSignersContext`. This is the **only** path that trusts cached
+ *    data, and it applies in every mode.
+ * 2. Otherwise, in `'exact'` mode → **throw**. This mode never parses, refreshes,
+ *    or reconciles differing `extraData`.
+ * 3. `extraData` serialization version mismatch → **throw** (`'strict'`/`'loose'`).
+ *    The SDK and relayer must agree on the encoding format, even for the same context ID.
+ * 4. Versions match but context/epoch differ → force a **full on-chain refetch**
+ *    (cached data is never reused, since a mismatch means on-chain state may have
+ *    diverged: rotation, destruction, signer/epoch changes). The accept criterion
+ *    then depends on `mode`:
+ *    - `'strict'` → accept **only** if the relayer's context equals the *current*
+ *      on-chain context (both `kmsContextId` and `kmsEpochId`); otherwise throw.
+ *    - `'loose'` → accept **any** on-chain-valid context (non-destroyed, in range),
+ *      current or not; throw only if destroyed / out of range.
  *
  * ### Modes
  *
- * - `'exact'` — Accept only step 1 (byte-for-byte `extraData` equality).
- *   Rejects any relayer/context drift without parsing or on-chain recovery.
- * - `'strict'` — Accept step 1 (exact match) or both `relayerKmsContextId === currentKmsContextId`
- *   and `relayerKmsEpochId === currentKmsEpochId`. Rejects valid-but-not-current contexts.
- *   The epoch check is required because RFC 005 introduces same-context epoch rotations
- *   (new shares, same party set) — a stale epoch must be rejected even if the context matches.
+ * - `'exact'` — Accept only step 1 (`extraData` equality). Rejects any
+ *   relayer/context drift without parsing or on-chain recovery.
+ * - `'strict'` — Accept step 1, or a relayer context whose `kmsContextId` **and**
+ *   `kmsEpochId` equal the current on-chain values. Rejects valid-but-not-current
+ *   contexts. The epoch check is required because RFC 005 introduces same-context
+ *   epoch rotations (new shares, same party set) — a stale epoch must be rejected
+ *   even when the context ID matches.
  * - `'loose'` — Accept any on-chain valid context (non-destroyed, in range),
  *   regardless of whether it is current. Covers context rotations in either direction.
  */
-
-////////////////////////////////////////////////////////////////////////////////
-
-export type ReconcileMode = 'exact' | 'strict' | 'loose';
-
 export async function reconcileKmsSignersContext(
   context: Context,
   parameters: {
     readonly kmsVerifierAddress: ChecksummedAddress;
     readonly protocolConfigAddress: ChecksummedAddress | undefined;
     readonly requestedKmsSignersContext: KmsSignersContext;
-    readonly relayerExtraData: BytesHex;
+    readonly relayerKmsExtraDataBytesHex: BytesHex;
     readonly mode: ReconcileMode;
   },
 ): Promise<KmsSignersContext> {
-  const { kmsVerifierAddress, protocolConfigAddress, requestedKmsSignersContext, relayerExtraData, mode } = parameters;
+  const { kmsVerifierAddress, protocolConfigAddress, requestedKmsSignersContext, relayerKmsExtraDataBytesHex, mode } =
+    parameters;
+
+  const relayerKmsExtraData = fromKmsExtraDataBytesHex(relayerKmsExtraDataBytesHex);
 
-  assertIsKmsExtraData(relayerExtraData, {});
   assertIsKmsSignersContext(requestedKmsSignersContext, {});
 
-  const requestedExtraData = kmsSignersContextToExtraData(requestedKmsSignersContext);
+  const requestedKmsExtraData = createKmsExtraData({
+    kmsContextId: requestedKmsSignersContext.id,
+    kmsEpochId: requestedKmsSignersContext.epochId,
+  });
 
   // 1. Exact match — the relayer used the same context as the SDK.
-  if (relayerExtraData === requestedExtraData) {
+  if (equalsKmsExtraData(relayerKmsExtraData, requestedKmsExtraData)) {
     return requestedKmsSignersContext;
   }
 
   if (mode === 'exact') {
     throw new Error(
-      `Exact reconciliation failed: relayer extraData ${relayerExtraData} ` +
-        `does not match requested extraData ${requestedExtraData}.`,
+      `Exact reconciliation failed: relayer extraData ${relayerKmsExtraData.toBytesHex()} ` +
+        `does not match requested extraData ${requestedKmsExtraData.toBytesHex()}.`,
     );
   }
 
-  // Bytes differ — extract and compare serialization versions.
-  const relayerKmsExtraData = fromKmsExtraData(relayerExtraData);
-  const requestedKmsExtraData = fromKmsExtraData(requestedExtraData);
-
   // Reject if extraData serialization version differs.
   if (relayerKmsExtraData.version !== requestedKmsExtraData.version) {
     throw new Error(
@@ -282,7 +324,7 @@ export async function reconcileKmsSignersContext(
   if (mode === 'strict') {
     // `readKmsSignersContext` with `forceRefresh` fetches the current context.
     // If `relayerKmsContextId` matches current, we're good.
-    const currentContext = await readKmsSignersContext(context, {
+    const currentContext = await readCurrentKmsSignersContext(context, {
       kmsVerifierAddress,
       protocolConfigAddress,
       forceRefresh: true,
@@ -301,11 +343,10 @@ export async function reconcileKmsSignersContext(
   // 3. Loose mode — accept any valid (non-destroyed, in-range) context.
   //    `readKmsSignersContext` with `forceRefresh` + specific `kmsContextId`/`kmsEpochId` will
   //    throw if the context is destroyed or out of range.
-  return readKmsSignersContext(context, {
+  return readKmsSignersContextFromExtraData(context, {
     kmsVerifierAddress,
     protocolConfigAddress,
-    kmsContextId: relayerKmsContextId,
-    kmsEpochId: relayerKmsEpochId,
     forceRefresh: true,
+    extraData: relayerKmsExtraData,
   });
 }

package/core/kms/KmsSigncryptedShares-p.ts

@@ -7,8 +7,37 @@ import type { FhevmChain } from '../types/fhevmChain.js';
 import type { TkmsVersion } from '../../wasm/tkms/KmsLibApi.js';
 import { assertIsKmsSignersContext } from '../host-contracts/KmsSignersContext-p.js';
 import { ensure0x } from '../base/string.js';
-import { assertIsKmsExtraData } from './kmsExtraData.js';
 import { reconcileKmsSignersContext } from '../host-contracts/readKmsSignersContext-p.js';
+import { recoverSigners } from '../utils-p/runtime/recoverSigners.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * EIP-712 types for the KMS `UserDecryptResponseVerification` structure that each
+ * KMS node signs per response share (see gateway `Decryption.sol`).
+ *
+ * CRITICAL: field order and types are authoritative — they define the EIP-712
+ * type hash and must match the on-chain struct exactly.
+ *
+ * Note: `ctHandles` is declared `bytes32[]` to match `Decryption.sol` (the tkms
+ * WASM doc comments it as `uint256[]`; both encode the same 32 bytes, but the
+ * type string participates in the type hash — if verification unexpectedly
+ * fails, `uint256[]` is the first thing to try).
+ */
+const kmsUserDecryptResponseEip712Types = {
+  EIP712Domain: [
+    { name: 'name', type: 'string' },
+    { name: 'version', type: 'string' },
+    { name: 'chainId', type: 'uint256' },
+    { name: 'verifyingContract', type: 'address' },
+  ],
+  UserDecryptResponseVerification: [
+    { name: 'publicKey', type: 'bytes' },
+    { name: 'ctHandles', type: 'bytes32[]' },
+    { name: 'userDecryptedShare', type: 'bytes' },
+    { name: 'extraData', type: 'bytes' },
+  ],
+} as const;
 
 ////////////////////////////////////////////////////////////////////////////////
 
@@ -103,6 +132,60 @@ function assertUniformExtraData(shares: readonly KmsSigncryptedShare[]): BytesHe
   return firstExtraData;
 }
 
+/**
+ * Helper:
+ * Verifies the EIP-712 signature of a single KMS signcrypted share.
+ *
+ * Rebuilds the `UserDecryptResponseVerification` payload the KMS node signed,
+ * recovers the signer, and asserts it belongs to the reconciled KMS signers
+ * context. This is an independent, JS-only check — the same verification is also
+ * performed inside the tkms WASM during reconstruction (`verify=true`), so this
+ * is primarily a test/defense-in-depth pass and is not required for correctness.
+ *
+ * @throws If the signer cannot be recovered, or is not a known KMS signer.
+ */
+export async function verifyKmsSigncryptedShare(
+  context: Context,
+  parameters: {
+    readonly share: KmsSigncryptedShare;
+    readonly metadata: KmsSigncryptedSharesMetadata;
+    readonly transportPublicKey: BytesHex;
+  },
+): Promise<void> {
+  const { share, metadata, transportPublicKey } = parameters;
+
+  // Rebuild the exact EIP-712 message each KMS node signs per response share
+  // (gateway Decryption.sol `UserDecryptResponseVerification`). `userDecryptedShare`
+  // is the serialized share bytes carried in `share.payload`.
+  const message = {
+    publicKey: transportPublicKey,
+    ctHandles: metadata.handles.map((h) => h.bytes32Hex),
+    userDecryptedShare: ensure0x(share.payload),
+    // v0 extraData is signed as '0x' (never '0x00').
+    extraData: share.extraData === '' || share.extraData === '00' ? '0x' : ensure0x(share.extraData),
+  };
+
+  // Recover the signer of this share. The KMS EIP-712 domain lives in `metadata`.
+  const [recoveredAddress] = await recoverSigners(context, {
+    domain: metadata.eip712Domain,
+    types: kmsUserDecryptResponseEip712Types,
+    primaryType: 'UserDecryptResponseVerification',
+    signatures: [ensure0x(share.signature)],
+    message,
+  });
+
+  if (recoveredAddress === undefined) {
+    throw new Error('Failed to recover signer from KMS signcrypted share signature.');
+  }
+
+  // The recovered signer must be one of the reconciled KMS signers (case-insensitive).
+  if (!metadata.kmsSignersContext.has(recoveredAddress)) {
+    throw new Error(
+      `KMS signcrypted share signature was not signed by a known KMS signer (recovered ${recoveredAddress}).`,
+    );
+  }
+}
+
 /**
  * Creates a validated {@link KmsSigncryptedShares} instance.
  *
@@ -121,6 +204,7 @@ export async function createKmsSigncryptedShares(
   },
 ): Promise<KmsSigncryptedShares> {
   const { metadata, shares } = parameters;
+
   /*
     TODO: add an optional signature verification pass. 
     (13 signatures verifications. Could be CPU costly)
@@ -140,14 +224,13 @@ export async function createKmsSigncryptedShares(
   assertIsKmsSignersContext(metadata.kmsSignersContext, {});
 
   // Extract the common extraData from all shares and validate its format.
-  const relayerExtraData: BytesHex = ensure0x(assertUniformExtraData(shares));
-  assertIsKmsExtraData(relayerExtraData, {});
+  const relayerKmsExtraDataBytesHex: BytesHex = ensure0x(assertUniformExtraData(shares));
 
   // Reconcile KMS signer context using 'loose' mode.
   const reconciledKmsSignersContext: KmsSignersContext = await reconcileKmsSignersContext(context, {
     kmsVerifierAddress: context.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
     protocolConfigAddress: context.chain.fhevm.contracts.protocolConfig?.address as ChecksummedAddress | undefined,
-    relayerExtraData,
+    relayerKmsExtraDataBytesHex,
     requestedKmsSignersContext: metadata.kmsSignersContext,
     mode: 'loose',
   });

package/core/kms/PublicDecryptionProof-p.ts

@@ -6,11 +6,13 @@ import type { FhevmRuntime } from '../types/coreFhevmRuntime.js';
 import type { ClearValueType, SolidityPrimitiveTypeName } from '../types/fheType.js';
 import type { NonEmptyReadonlyArray } from '../types/utils.js';
 import type { ClearValue, Handle } from '../types/encryptedTypes-p.js';
+import type { KmsExtraData } from '../types/kms-p.js';
 import { concatBytesHex } from '../base/bytes.js';
 import { abiEncodeClearValues, createClearValueArray } from '../handle/ClearValue.js';
 import { toClearValueType } from '../handle/FheType.js';
 import { kmsSignersContextToExtraData } from '../host-contracts/KmsSignersContext-p.js';
 import { verifyKmsPublicDecryptEip712 } from './verifyKmsPublicDecryptEip712-p.js';
+import { EXTRA_DATA_V0 } from './kmsExtraData-p.js';
 
 //////////////////////////////////////////////////////////////////////////////
 
@@ -89,7 +91,7 @@ type Parameters = {
   readonly originToken: symbol;
   readonly orderedHandles: readonly Handle[];
   readonly orderedAbiEncodedClearValues: BytesHex;
-  readonly kmsPublicDecryptEIP712Signatures: readonly Bytes65Hex[];
+  readonly kmsPublicDecryptEip712Signatures: readonly Bytes65Hex[];
   readonly kmsSignersContext: KmsSignersContext;
 };
 
@@ -108,7 +110,7 @@ export async function createPublicDecryptionProof(
   const {
     orderedHandles: orderedEncryptedValues,
     orderedAbiEncodedClearValues,
-    kmsPublicDecryptEIP712Signatures,
+    kmsPublicDecryptEip712Signatures,
     kmsSignersContext,
     originToken,
   } = parameters;
@@ -117,7 +119,7 @@ export async function createPublicDecryptionProof(
   // Compute extraData using KmsSignersContext
   //////////////////////////////////////////////////////////////////////////////
 
-  const extraData = kmsSignersContextToExtraData(kmsSignersContext);
+  const extraData: KmsExtraData = kmsSignersContextToExtraData(kmsSignersContext);
 
   ////////////////////////////////////////////////////////////////////////////
   //
@@ -125,7 +127,7 @@ export async function createPublicDecryptionProof(
   //
   ////////////////////////////////////////////////////////////////////////////
 
-  const signedExtraData = extraData === ('0x00' as BytesHex) ? ('0x' as BytesHex) : extraData;
+  const signedExtraDataBytesHex = extraData.version === EXTRA_DATA_V0 ? ('0x' as BytesHex) : extraData.toBytesHex();
 
   //////////////////////////////////////////////////////////////////////////////
   // Compute the proof as numSigners + KMS signatures + extraData
@@ -133,15 +135,15 @@ export async function createPublicDecryptionProof(
 
   const packedNumSigners: BytesHex = context.runtime.ethereum.encodePacked({
     types: ['uint8'],
-    values: [kmsPublicDecryptEIP712Signatures.length],
+    values: [kmsPublicDecryptEip712Signatures.length],
   });
 
   const packedSignatures = context.runtime.ethereum.encodePacked({
-    types: Array(kmsPublicDecryptEIP712Signatures.length).fill('bytes') as string[],
-    values: kmsPublicDecryptEIP712Signatures,
+    types: Array(kmsPublicDecryptEip712Signatures.length).fill('bytes') as string[],
+    values: kmsPublicDecryptEip712Signatures,
   });
 
-  const decryptionProof: BytesHex = concatBytesHex([packedNumSigners, packedSignatures, signedExtraData]);
+  const decryptionProof: BytesHex = concatBytesHex([packedNumSigners, packedSignatures, signedExtraDataBytesHex]);
 
   //////////////////////////////////////////////////////////////////////////////
   // Deserialize ordered decrypted result
@@ -176,6 +178,6 @@ export async function createPublicDecryptionProof(
     decryptionProof: decryptionProof,
     orderedClearValues: orderedDecryptedFhevmHandles,
     orderedAbiEncodedClearValues: orderedAbiEncodedDecryptedFhevmHandles.abiEncodedClearValues,
-    extraData: signedExtraData,
+    extraData: signedExtraDataBytesHex,
   });
 }