tkms 0.14.2 → 0.15.0-1

package/kms_lib.d.ts

@@ -97,10 +97,6 @@ export class TypedCiphertext {
      * CiphertextFormat::default() is used if unspecified.
      */
     ciphertext_format: number;
-    /**
-     * The actual ciphertext to decrypt, taken directly from fhevm.
-     */
-    ciphertext: Uint8Array;
     /**
      * The external handle of the ciphertext (the handle used in the copro).
      */
@@ -110,6 +106,10 @@ export class TypedCiphertext {
      * <https://github.com/zama-ai/tfhe-rs/blob/main/tfhe/src/high_level_api/mod.rs>
      */
     fhe_type: number;
+    /**
+     * The actual ciphertext to decrypt, taken directly from fhevm.
+     */
+    ciphertext: Uint8Array;
 }
 
 export class TypedPlaintext {
@@ -127,6 +127,27 @@ export class TypedPlaintext {
     fhe_type: number;
 }
 
+/**
+ * A single signature together with the scheme that produced it.
+ *
+ * Used to carry a chain-native signature for one signing scheme when a response
+ * may be signed under several schemes at once (e.g. ECDSA/secp256k1 EIP-712 for
+ * an EVM, ed25519 for Solana, ML-DSA for post-quantum).
+ */
+export class TypedSignature {
+    private constructor();
+    free(): void;
+    [Symbol.dispose](): void;
+    /**
+     * The signature scheme that produced `signature`.
+     */
+    scheme: number;
+    /**
+     * The raw, scheme-specific signature bytes.
+     */
+    signature: Uint8Array;
+}
+
 export class TypedSigncryptedCiphertext {
     private constructor();
     free(): void;
@@ -162,16 +183,12 @@ export class UserDecryptionRequest {
     client_address: string;
     /**
      * MPC context ID which is used to identify the context to use for this request.
-     *
-     * NOTE: at the moment this can be None since we do not fully support multiple contexts.
-     * See <https://github.com/zama-ai/kms-internal/issues/2530>
+     * If unset, the server's default context is used.
      */
     get context_id(): RequestId | undefined;
     /**
      * MPC context ID which is used to identify the context to use for this request.
-     *
-     * NOTE: at the moment this can be None since we do not fully support multiple contexts.
-     * See <https://github.com/zama-ai/kms-internal/issues/2530>
+     * If unset, the server's default context is used.
      */
     set context_id(value: RequestId | null | undefined);
     /**
@@ -188,11 +205,13 @@ export class UserDecryptionRequest {
      */
     enc_key: Uint8Array;
     /**
-     * The epoch number placeholder (zama-ai/kms-internal#2743).
+     * The MPC epoch ID identifying which epoch's key material and session to
+     * use for this request.
      */
     get epoch_id(): RequestId | undefined;
     /**
-     * The epoch number placeholder (zama-ai/kms-internal#2743).
+     * The MPC epoch ID identifying which epoch's key material and session to
+     * use for this request.
      */
     set epoch_id(value: RequestId | null | undefined);
     /**
@@ -219,6 +238,12 @@ export class UserDecryptionRequest {
      * prefix. Future queries for the result must use this request ID.
      */
     set request_id(value: RequestId | null | undefined);
+    /**
+     * The signature schemes to include in the response `signatures` field.
+     * If empty, it defaults to ECDSA256K1, so the response carries a single ECDSA
+     * entry.
+     */
+    signing_schemes: Int32Array;
     /**
      * The list of ciphertexts to decrypt for the user.
      */
@@ -230,7 +255,7 @@ export class UserDecryptionResponse {
     free(): void;
     [Symbol.dispose](): void;
     /**
-     * This is the external signature created from the Eip712 domain
+     * This is the external ECDSA signature created from the Eip712 domain
      * on the structure, where userDecryptedShare is bc2wrap::serialize(&payload)
      * struct UserDecryptResponseVerification {
      * bytes publicKey;
@@ -238,6 +263,7 @@ export class UserDecryptionResponse {
      * bytes userDecryptedShare; // serialization of payload
      * bytes extraData;
      * }
+     * DEPRECATED: To be removed in 0.16 TODO(0.16)
      */
     external_signature: Uint8Array;
     /**
@@ -252,7 +278,19 @@ export class UserDecryptionResponse {
      * The actual \[UserDecryptionResponsePayload\].
      */
     set payload(value: UserDecryptionResponsePayload | null | undefined);
+    /**
+     * DEPRECATED to be removed in 0.16.0 TODO(0.16)
+     * The KMS-internal ECDSA/secp256k1 authenticity signature over
+     * the serialization of \[UserDecryptionResponsePayload\]. Kept at field 1 (and
+     * kept populated) for wire backward-compatibility with clients that predate
+     * the multi-scheme `signatures` list.
+     */
     signature: Uint8Array;
+    /**
+     * Per-scheme KMS signatures, one per scheme requested in the request's
+     * `signing_schemes`.
+     */
+    signatures: TypedSignature[];
 }
 
 export class UserDecryptionResponsePayload {
@@ -423,11 +461,6 @@ export type InitInput = RequestInfo | URL | Response | BufferSource | WebAssembl
 
 export interface InitOutput {
     readonly memory: WebAssembly.Memory;
-    readonly __wbg_client_free: (a: number, b: number) => void;
-    readonly __wbg_ciphertexthandle_free: (a: number, b: number) => void;
-    readonly __wbg_parseduserdecryptionrequest_free: (a: number, b: number) => void;
-    readonly __wbg_privatesigkey_free: (a: number, b: number) => void;
-    readonly __wbg_publicsigkey_free: (a: number, b: number) => void;
     readonly __wbg_privateenckeymlkem512_free: (a: number, b: number) => void;
     readonly __wbg_publicenckeymlkem512_free: (a: number, b: number) => void;
     readonly __wbg_serveridaddr_free: (a: number, b: number) => void;
@@ -451,25 +484,33 @@ export interface InitOutput {
     readonly u8vec_to_ml_kem_pke_sk: (a: number, b: number) => [number, number, number];
     readonly u8vec_to_private_sig_key: (a: number, b: number) => [number, number, number];
     readonly u8vec_to_public_sig_key: (a: number, b: number) => [number, number, number];
+    readonly __wbg_privatesigkey_free: (a: number, b: number) => void;
+    readonly __wbg_publicsigkey_free: (a: number, b: number) => void;
+    readonly __wbg_ciphertexthandle_free: (a: number, b: number) => void;
+    readonly __wbg_parseduserdecryptionrequest_free: (a: number, b: number) => void;
+    readonly __wbg_client_free: (a: number, b: number) => void;
     readonly __wbg_eip712domainmsg_free: (a: number, b: number) => void;
     readonly __wbg_get_eip712domainmsg_chain_id: (a: number) => [number, number];
     readonly __wbg_get_eip712domainmsg_name: (a: number) => [number, number];
     readonly __wbg_get_eip712domainmsg_salt: (a: number) => [number, number];
     readonly __wbg_get_eip712domainmsg_verifying_contract: (a: number) => [number, number];
     readonly __wbg_get_eip712domainmsg_version: (a: number) => [number, number];
-    readonly __wbg_get_typedciphertext_ciphertext: (a: number) => [number, number];
     readonly __wbg_get_typedciphertext_ciphertext_format: (a: number) => number;
     readonly __wbg_get_typedciphertext_external_handle: (a: number) => [number, number];
     readonly __wbg_get_typedciphertext_fhe_type: (a: number) => number;
     readonly __wbg_get_typedplaintext_fhe_type: (a: number) => number;
+    readonly __wbg_get_typedsigncryptedciphertext_external_handle: (a: number) => [number, number];
+    readonly __wbg_get_typedsigncryptedciphertext_fhe_type: (a: number) => number;
     readonly __wbg_get_userdecryptionrequest_context_id: (a: number) => number;
     readonly __wbg_get_userdecryptionrequest_domain: (a: number) => number;
     readonly __wbg_get_userdecryptionrequest_epoch_id: (a: number) => number;
     readonly __wbg_get_userdecryptionrequest_extra_data: (a: number) => [number, number];
     readonly __wbg_get_userdecryptionrequest_key_id: (a: number) => number;
     readonly __wbg_get_userdecryptionrequest_request_id: (a: number) => number;
+    readonly __wbg_get_userdecryptionrequest_signing_schemes: (a: number) => [number, number];
     readonly __wbg_get_userdecryptionrequest_typed_ciphertexts: (a: number) => [number, number];
     readonly __wbg_get_userdecryptionresponse_payload: (a: number) => number;
+    readonly __wbg_get_userdecryptionresponse_signatures: (a: number) => [number, number];
     readonly __wbg_get_userdecryptionresponsepayload_degree: (a: number) => number;
     readonly __wbg_get_userdecryptionresponsepayload_party_id: (a: number) => number;
     readonly __wbg_get_userdecryptionresponsepayload_signcrypted_ciphertexts: (a: number) => [number, number];
@@ -482,41 +523,36 @@ export interface InitOutput {
     readonly __wbg_set_typedciphertext_ciphertext_format: (a: number, b: number) => void;
     readonly __wbg_set_typedciphertext_fhe_type: (a: number, b: number) => void;
     readonly __wbg_set_typedplaintext_fhe_type: (a: number, b: number) => void;
+    readonly __wbg_set_typedsigncryptedciphertext_fhe_type: (a: number, b: number) => void;
     readonly __wbg_set_userdecryptionrequest_context_id: (a: number, b: number) => void;
     readonly __wbg_set_userdecryptionrequest_domain: (a: number, b: number) => void;
     readonly __wbg_set_userdecryptionrequest_epoch_id: (a: number, b: number) => void;
     readonly __wbg_set_userdecryptionrequest_key_id: (a: number, b: number) => void;
     readonly __wbg_set_userdecryptionrequest_request_id: (a: number, b: number) => void;
+    readonly __wbg_set_userdecryptionrequest_signing_schemes: (a: number, b: number, c: number) => void;
     readonly __wbg_set_userdecryptionrequest_typed_ciphertexts: (a: number, b: number, c: number) => void;
     readonly __wbg_set_userdecryptionresponse_payload: (a: number, b: number) => void;
+    readonly __wbg_set_userdecryptionresponse_signatures: (a: number, b: number, c: number) => void;
     readonly __wbg_set_userdecryptionresponsepayload_degree: (a: number, b: number) => void;
     readonly __wbg_set_userdecryptionresponsepayload_party_id: (a: number, b: number) => void;
     readonly __wbg_set_userdecryptionresponsepayload_signcrypted_ciphertexts: (a: number, b: number, c: number) => void;
     readonly __wbg_typedciphertext_free: (a: number, b: number) => void;
     readonly __wbg_typedplaintext_free: (a: number, b: number) => void;
+    readonly __wbg_typedsignature_free: (a: number, b: number) => void;
     readonly __wbg_typedsigncryptedciphertext_free: (a: number, b: number) => void;
     readonly __wbg_userdecryptionrequest_free: (a: number, b: number) => void;
     readonly __wbg_userdecryptionresponse_free: (a: number, b: number) => void;
     readonly __wbg_userdecryptionresponsepayload_free: (a: number, b: number) => void;
     readonly __wbg_get_requestid_request_id: (a: number) => [number, number];
     readonly __wbg_get_userdecryptionrequest_client_address: (a: number) => [number, number];
-    readonly __wbg_set_typedsigncryptedciphertext_fhe_type: (a: number, b: number) => void;
-    readonly __wbg_set_typedsigncryptedciphertext_packing_factor: (a: number, b: number) => void;
-    readonly __wbg_get_typedsigncryptedciphertext_fhe_type: (a: number) => number;
+    readonly __wbg_get_typedsignature_scheme: (a: number) => number;
     readonly __wbg_get_typedsigncryptedciphertext_packing_factor: (a: number) => number;
-    readonly __wbg_get_typedplaintext_bytes: (a: number) => [number, number];
-    readonly __wbg_get_typedsigncryptedciphertext_external_handle: (a: number) => [number, number];
-    readonly __wbg_get_typedsigncryptedciphertext_signcrypted_ciphertext: (a: number) => [number, number];
-    readonly __wbg_get_userdecryptionrequest_enc_key: (a: number) => [number, number];
-    readonly __wbg_get_userdecryptionresponse_external_signature: (a: number) => [number, number];
-    readonly __wbg_get_userdecryptionresponse_extra_data: (a: number) => [number, number];
-    readonly __wbg_get_userdecryptionresponse_signature: (a: number) => [number, number];
-    readonly __wbg_get_userdecryptionresponsepayload_digest: (a: number) => [number, number];
-    readonly __wbg_get_userdecryptionresponsepayload_verification_key: (a: number) => [number, number];
+    readonly __wbg_set_typedsignature_scheme: (a: number, b: number) => void;
+    readonly __wbg_set_typedsigncryptedciphertext_packing_factor: (a: number, b: number) => void;
     readonly __wbg_set_requestid_request_id: (a: number, b: number, c: number) => void;
-    readonly __wbg_set_typedciphertext_ciphertext: (a: number, b: number, c: number) => void;
     readonly __wbg_set_typedciphertext_external_handle: (a: number, b: number, c: number) => void;
     readonly __wbg_set_typedplaintext_bytes: (a: number, b: number, c: number) => void;
+    readonly __wbg_set_typedsignature_signature: (a: number, b: number, c: number) => void;
     readonly __wbg_set_typedsigncryptedciphertext_external_handle: (a: number, b: number, c: number) => void;
     readonly __wbg_set_typedsigncryptedciphertext_signcrypted_ciphertext: (a: number, b: number, c: number) => void;
     readonly __wbg_set_userdecryptionrequest_client_address: (a: number, b: number, c: number) => void;
@@ -527,6 +563,17 @@ export interface InitOutput {
     readonly __wbg_set_userdecryptionresponse_signature: (a: number, b: number, c: number) => void;
     readonly __wbg_set_userdecryptionresponsepayload_digest: (a: number, b: number, c: number) => void;
     readonly __wbg_set_userdecryptionresponsepayload_verification_key: (a: number, b: number, c: number) => void;
+    readonly __wbg_get_typedplaintext_bytes: (a: number) => [number, number];
+    readonly __wbg_get_typedsignature_signature: (a: number) => [number, number];
+    readonly __wbg_get_typedsigncryptedciphertext_signcrypted_ciphertext: (a: number) => [number, number];
+    readonly __wbg_get_userdecryptionrequest_enc_key: (a: number) => [number, number];
+    readonly __wbg_get_userdecryptionresponse_external_signature: (a: number) => [number, number];
+    readonly __wbg_get_userdecryptionresponse_extra_data: (a: number) => [number, number];
+    readonly __wbg_get_userdecryptionresponse_signature: (a: number) => [number, number];
+    readonly __wbg_get_userdecryptionresponsepayload_digest: (a: number) => [number, number];
+    readonly __wbg_get_userdecryptionresponsepayload_verification_key: (a: number) => [number, number];
+    readonly typedciphertext_ciphertext: (a: number) => [number, number];
+    readonly typedciphertext_set_ciphertext: (a: number, b: number, c: number) => void;
     readonly __wbindgen_malloc: (a: number, b: number) => number;
     readonly __wbindgen_realloc: (a: number, b: number, c: number, d: number) => number;
     readonly __wbindgen_exn_store: (a: number) => void;

package/kms_lib.js

@@ -375,16 +375,6 @@ export class TypedCiphertext {
         const ret = wasm.__wbg_get_typedciphertext_ciphertext_format(this.__wbg_ptr);
         return ret;
     }
-    /**
-     * The actual ciphertext to decrypt, taken directly from fhevm.
-     * @returns {Uint8Array}
-     */
-    get ciphertext() {
-        const ret = wasm.__wbg_get_typedciphertext_ciphertext(this.__wbg_ptr);
-        var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
-        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
-        return v1;
-    }
     /**
      * The external handle of the ciphertext (the handle used in the copro).
      * @returns {Uint8Array}
@@ -412,15 +402,6 @@ export class TypedCiphertext {
     set ciphertext_format(arg0) {
         wasm.__wbg_set_typedciphertext_ciphertext_format(this.__wbg_ptr, arg0);
     }
-    /**
-     * The actual ciphertext to decrypt, taken directly from fhevm.
-     * @param {Uint8Array} arg0
-     */
-    set ciphertext(arg0) {
-        const ptr0 = passArray8ToWasm0(arg0, wasm.__wbindgen_malloc);
-        const len0 = WASM_VECTOR_LEN;
-        wasm.__wbg_set_typedciphertext_ciphertext(this.__wbg_ptr, ptr0, len0);
-    }
     /**
      * The external handle of the ciphertext (the handle used in the copro).
      * @param {Uint8Array} arg0
@@ -438,6 +419,25 @@ export class TypedCiphertext {
     set fhe_type(arg0) {
         wasm.__wbg_set_typedciphertext_fhe_type(this.__wbg_ptr, arg0);
     }
+    /**
+     * The actual ciphertext to decrypt, taken directly from fhevm.
+     * @returns {Uint8Array}
+     */
+    get ciphertext() {
+        const ret = wasm.typedciphertext_ciphertext(this.__wbg_ptr);
+        var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        return v1;
+    }
+    /**
+     * Replaces the ciphertext bytes.
+     * @param {Uint8Array} ciphertext
+     */
+    set ciphertext(ciphertext) {
+        const ptr0 = passArray8ToWasm0(ciphertext, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.typedciphertext_set_ciphertext(this.__wbg_ptr, ptr0, len0);
+    }
 }
 if (Symbol.dispose) TypedCiphertext.prototype[Symbol.dispose] = TypedCiphertext.prototype.free;
 
@@ -497,6 +497,73 @@ export class TypedPlaintext {
 }
 if (Symbol.dispose) TypedPlaintext.prototype[Symbol.dispose] = TypedPlaintext.prototype.free;
 
+/**
+ * A single signature together with the scheme that produced it.
+ *
+ * Used to carry a chain-native signature for one signing scheme when a response
+ * may be signed under several schemes at once (e.g. ECDSA/secp256k1 EIP-712 for
+ * an EVM, ed25519 for Solana, ML-DSA for post-quantum).
+ */
+export class TypedSignature {
+    static __wrap(ptr) {
+        const obj = Object.create(TypedSignature.prototype);
+        obj.__wbg_ptr = ptr;
+        TypedSignatureFinalization.register(obj, obj.__wbg_ptr, obj);
+        return obj;
+    }
+    static __unwrap(jsValue) {
+        if (!(jsValue instanceof TypedSignature)) {
+            return 0;
+        }
+        return jsValue.__destroy_into_raw();
+    }
+    __destroy_into_raw() {
+        const ptr = this.__wbg_ptr;
+        this.__wbg_ptr = 0;
+        TypedSignatureFinalization.unregister(this);
+        return ptr;
+    }
+    free() {
+        const ptr = this.__destroy_into_raw();
+        wasm.__wbg_typedsignature_free(ptr, 0);
+    }
+    /**
+     * The signature scheme that produced `signature`.
+     * @returns {number}
+     */
+    get scheme() {
+        const ret = wasm.__wbg_get_typedsignature_scheme(this.__wbg_ptr);
+        return ret;
+    }
+    /**
+     * The raw, scheme-specific signature bytes.
+     * @returns {Uint8Array}
+     */
+    get signature() {
+        const ret = wasm.__wbg_get_typedsignature_signature(this.__wbg_ptr);
+        var v1 = getArrayU8FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 1, 1);
+        return v1;
+    }
+    /**
+     * The signature scheme that produced `signature`.
+     * @param {number} arg0
+     */
+    set scheme(arg0) {
+        wasm.__wbg_set_typedsignature_scheme(this.__wbg_ptr, arg0);
+    }
+    /**
+     * The raw, scheme-specific signature bytes.
+     * @param {Uint8Array} arg0
+     */
+    set signature(arg0) {
+        const ptr0 = passArray8ToWasm0(arg0, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_typedsignature_signature(this.__wbg_ptr, ptr0, len0);
+    }
+}
+if (Symbol.dispose) TypedSignature.prototype[Symbol.dispose] = TypedSignature.prototype.free;
+
 export class TypedSigncryptedCiphertext {
     static __wrap(ptr) {
         const obj = Object.create(TypedSigncryptedCiphertext.prototype);
@@ -626,9 +693,7 @@ export class UserDecryptionRequest {
     }
     /**
      * MPC context ID which is used to identify the context to use for this request.
-     *
-     * NOTE: at the moment this can be None since we do not fully support multiple contexts.
-     * See <https://github.com/zama-ai/kms-internal/issues/2530>
+     * If unset, the server's default context is used.
      * @returns {RequestId | undefined}
      */
     get context_id() {
@@ -655,7 +720,8 @@ export class UserDecryptionRequest {
         return v1;
     }
     /**
-     * The epoch number placeholder (zama-ai/kms-internal#2743).
+     * The MPC epoch ID identifying which epoch's key material and session to
+     * use for this request.
      * @returns {RequestId | undefined}
      */
     get epoch_id() {
@@ -690,13 +756,25 @@ export class UserDecryptionRequest {
         const ret = wasm.__wbg_get_userdecryptionrequest_request_id(this.__wbg_ptr);
         return ret === 0 ? undefined : RequestId.__wrap(ret);
     }
+    /**
+     * The signature schemes to include in the response `signatures` field.
+     * If empty, it defaults to ECDSA256K1, so the response carries a single ECDSA
+     * entry.
+     * @returns {Int32Array}
+     */
+    get signing_schemes() {
+        const ret = wasm.__wbg_get_userdecryptionrequest_signing_schemes(this.__wbg_ptr);
+        var v1 = getArrayI32FromWasm0(ret[0], ret[1]).slice();
+        wasm.__wbindgen_free(ret[0], ret[1] * 4, 4);
+        return v1;
+    }
     /**
      * The list of ciphertexts to decrypt for the user.
      * @returns {TypedCiphertext[]}
      */
     get typed_ciphertexts() {
         const ret = wasm.__wbg_get_userdecryptionrequest_typed_ciphertexts(this.__wbg_ptr);
-        var v1 = getArrayJsValueFromWasm0(ret[0], ret[1]).slice();
+        var v1 = getArrayJsValueFromWasm0(ret[0], ret[1]);
         wasm.__wbindgen_free(ret[0], ret[1] * 4, 4);
         return v1;
     }
@@ -711,9 +789,7 @@ export class UserDecryptionRequest {
     }
     /**
      * MPC context ID which is used to identify the context to use for this request.
-     *
-     * NOTE: at the moment this can be None since we do not fully support multiple contexts.
-     * See <https://github.com/zama-ai/kms-internal/issues/2530>
+     * If unset, the server's default context is used.
      * @param {RequestId | null} [arg0]
      */
     set context_id(arg0) {
@@ -747,7 +823,8 @@ export class UserDecryptionRequest {
         wasm.__wbg_set_userdecryptionrequest_enc_key(this.__wbg_ptr, ptr0, len0);
     }
     /**
-     * The epoch number placeholder (zama-ai/kms-internal#2743).
+     * The MPC epoch ID identifying which epoch's key material and session to
+     * use for this request.
      * @param {RequestId | null} [arg0]
      */
     set epoch_id(arg0) {
@@ -793,6 +870,17 @@ export class UserDecryptionRequest {
         }
         wasm.__wbg_set_userdecryptionrequest_request_id(this.__wbg_ptr, ptr0);
     }
+    /**
+     * The signature schemes to include in the response `signatures` field.
+     * If empty, it defaults to ECDSA256K1, so the response carries a single ECDSA
+     * entry.
+     * @param {Int32Array} arg0
+     */
+    set signing_schemes(arg0) {
+        const ptr0 = passArray32ToWasm0(arg0, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_userdecryptionrequest_signing_schemes(this.__wbg_ptr, ptr0, len0);
+    }
     /**
      * The list of ciphertexts to decrypt for the user.
      * @param {TypedCiphertext[]} arg0
@@ -817,7 +905,7 @@ export class UserDecryptionResponse {
         wasm.__wbg_userdecryptionresponse_free(ptr, 0);
     }
     /**
-     * This is the external signature created from the Eip712 domain
+     * This is the external ECDSA signature created from the Eip712 domain
      * on the structure, where userDecryptedShare is bc2wrap::serialize(&payload)
      * struct UserDecryptResponseVerification {
      * bytes publicKey;
@@ -825,6 +913,7 @@ export class UserDecryptionResponse {
      * bytes userDecryptedShare; // serialization of payload
      * bytes extraData;
      * }
+     * DEPRECATED: To be removed in 0.16 TODO(0.16)
      * @returns {Uint8Array}
      */
     get external_signature() {
@@ -852,6 +941,11 @@ export class UserDecryptionResponse {
         return ret === 0 ? undefined : UserDecryptionResponsePayload.__wrap(ret);
     }
     /**
+     * DEPRECATED to be removed in 0.16.0 TODO(0.16)
+     * The KMS-internal ECDSA/secp256k1 authenticity signature over
+     * the serialization of \[UserDecryptionResponsePayload\]. Kept at field 1 (and
+     * kept populated) for wire backward-compatibility with clients that predate
+     * the multi-scheme `signatures` list.
      * @returns {Uint8Array}
      */
     get signature() {
@@ -861,7 +955,18 @@ export class UserDecryptionResponse {
         return v1;
     }
     /**
-     * This is the external signature created from the Eip712 domain
+     * Per-scheme KMS signatures, one per scheme requested in the request's
+     * `signing_schemes`.
+     * @returns {TypedSignature[]}
+     */
+    get signatures() {
+        const ret = wasm.__wbg_get_userdecryptionresponse_signatures(this.__wbg_ptr);
+        var v1 = getArrayJsValueFromWasm0(ret[0], ret[1]);
+        wasm.__wbindgen_free(ret[0], ret[1] * 4, 4);
+        return v1;
+    }
+    /**
+     * This is the external ECDSA signature created from the Eip712 domain
      * on the structure, where userDecryptedShare is bc2wrap::serialize(&payload)
      * struct UserDecryptResponseVerification {
      * bytes publicKey;
@@ -869,6 +974,7 @@ export class UserDecryptionResponse {
      * bytes userDecryptedShare; // serialization of payload
      * bytes extraData;
      * }
+     * DEPRECATED: To be removed in 0.16 TODO(0.16)
      * @param {Uint8Array} arg0
      */
     set external_signature(arg0) {
@@ -898,6 +1004,11 @@ export class UserDecryptionResponse {
         wasm.__wbg_set_userdecryptionresponse_payload(this.__wbg_ptr, ptr0);
     }
     /**
+     * DEPRECATED to be removed in 0.16.0 TODO(0.16)
+     * The KMS-internal ECDSA/secp256k1 authenticity signature over
+     * the serialization of \[UserDecryptionResponsePayload\]. Kept at field 1 (and
+     * kept populated) for wire backward-compatibility with clients that predate
+     * the multi-scheme `signatures` list.
      * @param {Uint8Array} arg0
      */
     set signature(arg0) {
@@ -905,6 +1016,16 @@ export class UserDecryptionResponse {
         const len0 = WASM_VECTOR_LEN;
         wasm.__wbg_set_userdecryptionresponse_signature(this.__wbg_ptr, ptr0, len0);
     }
+    /**
+     * Per-scheme KMS signatures, one per scheme requested in the request's
+     * `signing_schemes`.
+     * @param {TypedSignature[]} arg0
+     */
+    set signatures(arg0) {
+        const ptr0 = passArrayJsValueToWasm0(arg0, wasm.__wbindgen_malloc);
+        const len0 = WASM_VECTOR_LEN;
+        wasm.__wbg_set_userdecryptionresponse_signatures(this.__wbg_ptr, ptr0, len0);
+    }
 }
 if (Symbol.dispose) UserDecryptionResponse.prototype[Symbol.dispose] = UserDecryptionResponse.prototype.free;
 
@@ -962,7 +1083,7 @@ export class UserDecryptionResponsePayload {
      */
     get signcrypted_ciphertexts() {
         const ret = wasm.__wbg_get_userdecryptionresponsepayload_signcrypted_ciphertexts(this.__wbg_ptr);
-        var v1 = getArrayJsValueFromWasm0(ret[0], ret[1]).slice();
+        var v1 = getArrayJsValueFromWasm0(ret[0], ret[1]);
         wasm.__wbindgen_free(ret[0], ret[1] * 4, 4);
         return v1;
     }
@@ -1064,7 +1185,7 @@ export function get_client_secret_key(client) {
 export function get_server_addrs(client) {
     _assertClass(client, Client);
     const ret = wasm.get_server_addrs(client.__wbg_ptr);
-    var v1 = getArrayJsValueFromWasm0(ret[0], ret[1]).slice();
+    var v1 = getArrayJsValueFromWasm0(ret[0], ret[1]);
     wasm.__wbindgen_free(ret[0], ret[1] * 4, 4);
     return v1;
 }
@@ -1313,7 +1434,7 @@ export function process_user_decryption_resp_from_js(client, request, eip712_dom
     if (ret[3]) {
         throw takeFromExternrefTable0(ret[2]);
     }
-    var v1 = getArrayJsValueFromWasm0(ret[0], ret[1]).slice();
+    var v1 = getArrayJsValueFromWasm0(ret[0], ret[1]);
     wasm.__wbindgen_free(ret[0], ret[1] * 4, 4);
     return v1;
 }
@@ -1388,11 +1509,11 @@ export function u8vec_to_public_sig_key(v) {
 function __wbg_get_imports() {
     const import0 = {
         __proto__: null,
-        __wbg_Error_fdd633d4bb5dd76a: function(arg0, arg1) {
+        __wbg_Error_408e67f47ca7b58b: function(arg0, arg1) {
             const ret = Error(getStringFromWasm0(arg0, arg1));
             return ret;
         },
-        __wbg_Number_c4bdf66bb78f7977: function(arg0) {
+        __wbg_Number_3890faa6d3ff057d: function(arg0) {
             const ret = Number(arg0);
             return ret;
         },
@@ -1403,54 +1524,54 @@ function __wbg_get_imports() {
             getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
             getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
         },
-        __wbg___wbindgen_boolean_get_edaed31a367ce1bd: function(arg0) {
+        __wbg___wbindgen_boolean_get_c9c83ebd41b34df3: function(arg0) {
             const v = arg0;
             const ret = typeof(v) === 'boolean' ? v : undefined;
             return isLikeNone(ret) ? 0xFFFFFF : ret ? 1 : 0;
         },
-        __wbg___wbindgen_debug_string_8a447059637473e2: function(arg0, arg1) {
+        __wbg___wbindgen_debug_string_a57024b9c6e4a48b: function(arg0, arg1) {
             const ret = debugString(arg1);
             const ptr1 = passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
             const len1 = WASM_VECTOR_LEN;
             getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
             getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
         },
-        __wbg___wbindgen_in_4990f46af709e33c: function(arg0, arg1) {
+        __wbg___wbindgen_in_ac983077f137f2e6: function(arg0, arg1) {
             const ret = arg0 in arg1;
             return ret;
         },
-        __wbg___wbindgen_is_function_acc5528be2b923f2: function(arg0) {
+        __wbg___wbindgen_is_function_5e4570eb24ffa122: function(arg0) {
             const ret = typeof(arg0) === 'function';
             return ret;
         },
-        __wbg___wbindgen_is_null_6d937fbfb6478470: function(arg0) {
+        __wbg___wbindgen_is_null_7d13f41e1a2d5140: function(arg0) {
             const ret = arg0 === null;
             return ret;
         },
-        __wbg___wbindgen_is_object_0beba4a1980d3eea: function(arg0) {
+        __wbg___wbindgen_is_object_a2790eb24c211ea0: function(arg0) {
             const val = arg0;
             const ret = typeof(val) === 'object' && val !== null;
             return ret;
         },
-        __wbg___wbindgen_is_string_1fca8072260dd261: function(arg0) {
+        __wbg___wbindgen_is_string_e6f02f0ea5f20a32: function(arg0) {
             const ret = typeof(arg0) === 'string';
             return ret;
         },
-        __wbg___wbindgen_is_undefined_721f8decd50c87a3: function(arg0) {
+        __wbg___wbindgen_is_undefined_6cff064c44e0d823: function(arg0) {
             const ret = arg0 === undefined;
             return ret;
         },
-        __wbg___wbindgen_jsval_loose_eq_4b9aba9e5b3c4582: function(arg0, arg1) {
+        __wbg___wbindgen_jsval_loose_eq_acf2776254a8d832: function(arg0, arg1) {
             const ret = arg0 == arg1;
             return ret;
         },
-        __wbg___wbindgen_number_get_1cc01dd708740256: function(arg0, arg1) {
+        __wbg___wbindgen_number_get_136b9679cab35cfb: function(arg0, arg1) {
             const obj = arg1;
             const ret = typeof(obj) === 'number' ? obj : undefined;
             getDataViewMemory0().setFloat64(arg0 + 8 * 1, isLikeNone(ret) ? 0 : ret, true);
             getDataViewMemory0().setInt32(arg0 + 4 * 0, !isLikeNone(ret), true);
         },
-        __wbg___wbindgen_string_get_71bb4348194e31f0: function(arg0, arg1) {
+        __wbg___wbindgen_string_get_d154f1e671052120: function(arg0, arg1) {
             const obj = arg1;
             const ret = typeof(obj) === 'string' ? obj : undefined;
             var ptr1 = isLikeNone(ret) ? 0 : passStringToWasm0(ret, wasm.__wbindgen_malloc, wasm.__wbindgen_realloc);
@@ -1458,26 +1579,26 @@ function __wbg_get_imports() {
             getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
             getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
         },
-        __wbg___wbindgen_throw_ea4887a5f8f9a9db: function(arg0, arg1) {
+        __wbg___wbindgen_throw_bb96b2010945f0bc: function(arg0, arg1) {
             throw new Error(getStringFromWasm0(arg0, arg1));
         },
-        __wbg_call_5575218572ead796: function() { return handleError(function (arg0, arg1, arg2) {
-            const ret = arg0.call(arg1, arg2);
+        __wbg_call_1c5886ab9c57d1c7: function() { return handleError(function (arg0, arg1) {
+            const ret = arg0.call(arg1);
             return ret;
         }, arguments); },
-        __wbg_call_8e98ed2f3c86c4b5: function() { return handleError(function (arg0, arg1) {
-            const ret = arg0.call(arg1);
+        __wbg_call_35dba3c747ad7521: function() { return handleError(function (arg0, arg1, arg2) {
+            const ret = arg0.call(arg1, arg2);
             return ret;
         }, arguments); },
         __wbg_crypto_38df2bab126b63dc: function(arg0) {
             const ret = arg0.crypto;
             return ret;
         },
-        __wbg_done_b62d4a7d2286852a: function(arg0) {
+        __wbg_done_669171204c3dcae2: function(arg0) {
             const ret = arg0.done;
             return ret;
         },
-        __wbg_error_a6fa202b58aa1cd3: function(arg0, arg1) {
+        __wbg_error_757e9472f8410341: function(arg0, arg1) {
             let deferred0_0;
             let deferred0_1;
             try {
@@ -1491,11 +1612,11 @@ function __wbg_get_imports() {
         __wbg_getRandomValues_c44a50d8cfdaebeb: function() { return handleError(function (arg0, arg1) {
             arg0.getRandomValues(arg1);
         }, arguments); },
-        __wbg_get_9a29be2cb383ed9a: function() { return handleError(function (arg0, arg1) {
+        __wbg_get_d173c0308df22d37: function() { return handleError(function (arg0, arg1) {
             const ret = Reflect.get(arg0, arg1);
             return ret;
         }, arguments); },
-        __wbg_get_unchecked_54a4374c38e08460: function(arg0, arg1) {
+        __wbg_get_unchecked_e20b893aeafc3fca: function(arg0, arg1) {
             const ret = arg0[arg1 >>> 0];
             return ret;
         },
@@ -1503,7 +1624,7 @@ function __wbg_get_imports() {
             const ret = arg0[arg1];
             return ret;
         },
-        __wbg_instanceof_ArrayBuffer_2a7bb09fee70c2da: function(arg0) {
+        __wbg_instanceof_ArrayBuffer_993d02d2d254cad1: function(arg0) {
             let result;
             try {
                 result = arg0 instanceof ArrayBuffer;
@@ -1513,7 +1634,7 @@ function __wbg_get_imports() {
             const ret = result;
             return ret;
         },
-        __wbg_instanceof_Uint8Array_f080092dc70f5d58: function(arg0) {
+        __wbg_instanceof_Uint8Array_f935dbb0aa7cdeed: function(arg0) {
             let result;
             try {
                 result = arg0 instanceof Uint8Array;
@@ -1523,23 +1644,23 @@ function __wbg_get_imports() {
             const ret = result;
             return ret;
         },
-        __wbg_isArray_145a34fd0a38d37b: function(arg0) {
+        __wbg_isArray_6339f732981044bf: function(arg0) {
             const ret = Array.isArray(arg0);
             return ret;
         },
-        __wbg_isSafeInteger_a3389a198582f5f6: function(arg0) {
+        __wbg_isSafeInteger_f3d6cd19ccfe4512: function(arg0) {
             const ret = Number.isSafeInteger(arg0);
             return ret;
         },
-        __wbg_iterator_cc47ba25a2be735a: function() {
+        __wbg_iterator_5cebbb86e33c6dd6: function() {
             const ret = Symbol.iterator;
             return ret;
         },
-        __wbg_length_589238bdcf171f0e: function(arg0) {
+        __wbg_length_36bd29c6848c2144: function(arg0) {
             const ret = arg0.length;
             return ret;
         },
-        __wbg_length_c6054974c0a6cdb9: function(arg0) {
+        __wbg_length_ecfa2c63d3d0d82c: function(arg0) {
             const ret = arg0.length;
             return ret;
         },
@@ -1551,19 +1672,19 @@ function __wbg_get_imports() {
             const ret = new Error();
             return ret;
         },
-        __wbg_new_81880fb5002cb255: function(arg0) {
+        __wbg_new_77cc4f4f472aeb81: function(arg0) {
             const ret = new Uint8Array(arg0);
             return ret;
         },
-        __wbg_new_with_length_9b650f44b5c44a4e: function(arg0) {
+        __wbg_new_with_length_3ffc1c56427c525c: function(arg0) {
             const ret = new Uint8Array(arg0 >>> 0);
             return ret;
         },
-        __wbg_next_0c4066e251d2eff9: function() { return handleError(function (arg0) {
+        __wbg_next_42cf16ee0dafc9e2: function() { return handleError(function (arg0) {
             const ret = arg0.next();
             return ret;
         }, arguments); },
-        __wbg_next_402fa10b59ab20c3: function(arg0) {
+        __wbg_next_8f26b64fa5e9f64b: function(arg0) {
             const ret = arg0.next;
             return ret;
         },
@@ -1575,7 +1696,7 @@ function __wbg_get_imports() {
             const ret = arg0.process;
             return ret;
         },
-        __wbg_prototypesetcall_d721637c7ca66eb8: function(arg0, arg1, arg2) {
+        __wbg_prototypesetcall_de8e0d9553586985: function(arg0, arg1, arg2) {
             Uint8Array.prototype.set.call(getArrayU8FromWasm0(arg0, arg1), arg2);
         },
         __wbg_randomFillSync_6c25eac9869eb53c: function() { return handleError(function (arg0, arg1) {
@@ -1600,23 +1721,23 @@ function __wbg_get_imports() {
             getDataViewMemory0().setInt32(arg0 + 4 * 1, len1, true);
             getDataViewMemory0().setInt32(arg0 + 4 * 0, ptr1, true);
         },
-        __wbg_static_accessor_GLOBAL_THIS_2fee5048bcca5938: function() {
+        __wbg_static_accessor_GLOBAL_THIS_466428f93b4eaa76: function() {
             const ret = typeof globalThis === 'undefined' ? null : globalThis;
             return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
         },
-        __wbg_static_accessor_GLOBAL_ce44e66a4935da8c: function() {
+        __wbg_static_accessor_GLOBAL_c7aea38d4de089bc: function() {
             const ret = typeof global === 'undefined' ? null : global;
             return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
         },
-        __wbg_static_accessor_SELF_44f6e0cb5e67cdad: function() {
+        __wbg_static_accessor_SELF_42d4fae05e59267a: function() {
             const ret = typeof self === 'undefined' ? null : self;
             return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
         },
-        __wbg_static_accessor_WINDOW_168f178805d978fe: function() {
+        __wbg_static_accessor_WINDOW_e0db14a0eba6a812: function() {
             const ret = typeof window === 'undefined' ? null : window;
             return isLikeNone(ret) ? 0 : addToExternrefTable0(ret);
         },
-        __wbg_subarray_b0e8ac4ed313fea8: function(arg0, arg1, arg2) {
+        __wbg_subarray_a4cc58201c7359fd: function(arg0, arg1, arg2) {
             const ret = arg0.subarray(arg1 >>> 0, arg2 >>> 0);
             return ret;
         },
@@ -1632,6 +1753,14 @@ function __wbg_get_imports() {
             const ret = TypedPlaintext.__wrap(arg0);
             return ret;
         },
+        __wbg_typedsignature_new: function(arg0) {
+            const ret = TypedSignature.__wrap(arg0);
+            return ret;
+        },
+        __wbg_typedsignature_unwrap: function(arg0) {
+            const ret = TypedSignature.__unwrap(arg0);
+            return ret;
+        },
         __wbg_typedsigncryptedciphertext_new: function(arg0) {
             const ret = TypedSigncryptedCiphertext.__wrap(arg0);
             return ret;
@@ -1640,7 +1769,7 @@ function __wbg_get_imports() {
             const ret = TypedSigncryptedCiphertext.__unwrap(arg0);
             return ret;
         },
-        __wbg_value_49f783bb59765962: function(arg0) {
+        __wbg_value_1e2369fab29b420e: function(arg0) {
             const ret = arg0.value;
             return ret;
         },
@@ -1710,6 +1839,9 @@ const TypedCiphertextFinalization = (typeof FinalizationRegistry === 'undefined'
 const TypedPlaintextFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_typedplaintext_free(ptr, 1));
+const TypedSignatureFinalization = (typeof FinalizationRegistry === 'undefined')
+    ? { register: () => {}, unregister: () => {} }
+    : new FinalizationRegistry(ptr => wasm.__wbg_typedsignature_free(ptr, 1));
 const TypedSigncryptedCiphertextFinalization = (typeof FinalizationRegistry === 'undefined')
     ? { register: () => {}, unregister: () => {} }
     : new FinalizationRegistry(ptr => wasm.__wbg_typedsigncryptedciphertext_free(ptr, 1));
@@ -1800,6 +1932,11 @@ function debugString(val) {
     return className;
 }
 
+function getArrayI32FromWasm0(ptr, len) {
+    ptr = ptr >>> 0;
+    return getInt32ArrayMemory0().subarray(ptr / 4, ptr / 4 + len);
+}
+
 function getArrayJsValueFromWasm0(ptr, len) {
     ptr = ptr >>> 0;
     const mem = getDataViewMemory0();
@@ -1824,10 +1961,26 @@ function getDataViewMemory0() {
     return cachedDataViewMemory0;
 }
 
+let cachedInt32ArrayMemory0 = null;
+function getInt32ArrayMemory0() {
+    if (cachedInt32ArrayMemory0 === null || cachedInt32ArrayMemory0.byteLength === 0) {
+        cachedInt32ArrayMemory0 = new Int32Array(wasm.memory.buffer);
+    }
+    return cachedInt32ArrayMemory0;
+}
+
 function getStringFromWasm0(ptr, len) {
     return decodeText(ptr >>> 0, len);
 }
 
+let cachedUint32ArrayMemory0 = null;
+function getUint32ArrayMemory0() {
+    if (cachedUint32ArrayMemory0 === null || cachedUint32ArrayMemory0.byteLength === 0) {
+        cachedUint32ArrayMemory0 = new Uint32Array(wasm.memory.buffer);
+    }
+    return cachedUint32ArrayMemory0;
+}
+
 let cachedUint8ArrayMemory0 = null;
 function getUint8ArrayMemory0() {
     if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
@@ -1849,6 +2002,13 @@ function isLikeNone(x) {
     return x === undefined || x === null;
 }
 
+function passArray32ToWasm0(arg, malloc) {
+    const ptr = malloc(arg.length * 4, 4) >>> 0;
+    getUint32ArrayMemory0().set(arg, ptr / 4);
+    WASM_VECTOR_LEN = arg.length;
+    return ptr;
+}
+
 function passArray8ToWasm0(arg, malloc) {
     const ptr = malloc(arg.length * 1, 1) >>> 0;
     getUint8ArrayMemory0().set(arg, ptr / 1);
@@ -1944,6 +2104,8 @@ function __wbg_finalize_init(instance, module) {
     wasm = instance.exports;
     wasmModule = module;
     cachedDataViewMemory0 = null;
+    cachedInt32ArrayMemory0 = null;
+    cachedUint32ArrayMemory0 = null;
     cachedUint8ArrayMemory0 = null;
     wasm.__wbindgen_start();
     return wasm;
@@ -1951,11 +2113,15 @@ function __wbg_finalize_init(instance, module) {
 
 async function __wbg_load(module, imports) {
     if (typeof Response === 'function' && module instanceof Response) {
+        if (!module.ok) {
+            throw new Error(`failed to fetch Wasm: ${module.status} ${module.statusText} fetching '${module.url}'`);
+        }
+
         if (typeof WebAssembly.instantiateStreaming === 'function') {
             try {
                 return await WebAssembly.instantiateStreaming(module, imports);
             } catch (e) {
-                const validResponse = module.ok && expectedResponseType(module.type);
+                const validResponse = expectedResponseType(module.type);
 
                 if (validResponse && module.headers.get('Content-Type') !== 'application/wasm') {
                     console.warn("`WebAssembly.instantiateStreaming` failed because your server does not serve Wasm with `application/wasm` MIME type. Falling back to `WebAssembly.instantiate` which is slower. Original error:\n", e);

package/package.json

@@ -5,7 +5,7 @@
     "Zama"
   ],
   "description": "Key Management System for the Zama Protocol.",
-  "version": "v0.14.2",
+  "version": "v0.15.0-1",
   "license": "BSD-3-Clause-Clear",
   "repository": {
     "type": "git",
@@ -21,4 +21,4 @@
   "sideEffects": [
     "./snippets/*"
   ]
-}
+}