@fhevm/sdk 0.0.1 → 1.0.0-alpha.1

package/core/types/record-p.ts

@@ -0,0 +1,32 @@
+import type { Uint, ChecksummedAddress, Uint256, Address } from './primitives.js';
+
+/**
+ * Generic helper type that creates a record with a specific property of type T.
+ */
+export type RecordWithPropertyType<K extends string, T> = Record<string, unknown> & Record<K, NonNullable<T>>;
+
+export type RecordNonNullablePropertyType<K extends string> = RecordWithPropertyType<K, unknown>;
+
+export type RecordArrayPropertyType<K extends string> = RecordWithPropertyType<K, unknown[]>;
+
+export type RecordStringPropertyType<K extends string> = RecordWithPropertyType<K, string>;
+
+export type RecordStringArrayPropertyType<K extends string> = RecordWithPropertyType<K, string[]>;
+
+export type RecordBooleanPropertyType<K extends string> = RecordWithPropertyType<K, boolean>;
+
+export type RecordUintPropertyType<K extends string> = RecordWithPropertyType<K, Uint>;
+export type RecordUint256PropertyType<K extends string> = RecordWithPropertyType<K, Uint256>;
+
+export type RecordUint8ArrayPropertyType<K extends string> = RecordWithPropertyType<K, Uint8Array>;
+
+export type RecordChecksummedAddressPropertyType<K extends string> = RecordWithPropertyType<K, ChecksummedAddress>;
+
+export type RecordChecksummedAddressArrayPropertyType<K extends string> = RecordWithPropertyType<
+  K,
+  ChecksummedAddress[]
+>;
+
+export type RecordAddressPropertyType<K extends string> = RecordWithPropertyType<K, Address>;
+
+export type RecordAddressArrayPropertyType<K extends string> = RecordWithPropertyType<K, Address[]>;

package/core/types/relayer-p.ts

@@ -0,0 +1,406 @@
+import type {
+  Bytes32Hex,
+  Bytes65Hex,
+  Bytes65HexNo0x,
+  BytesHex,
+  BytesHexNo0x,
+  ChecksummedAddress,
+} from './primitives.js';
+import type { NonEmptyExtract } from './utils.js';
+import type { FetchInputProofResult, FetchPublicDecryptResult, FetchUserDecryptResult } from './relayer.js';
+import type { HandleBytes32Hex } from './encryptedTypes-p.js';
+
+////////////////////////////////////////////////////////////////////////////////
+// RelayerOperation
+////////////////////////////////////////////////////////////////////////////////
+
+export interface FetchPostOperationResultMap {
+  INPUT_PROOF: FetchInputProofResult;
+  PUBLIC_DECRYPT: FetchPublicDecryptResult;
+  USER_DECRYPT: FetchUserDecryptResult;
+  DELEGATED_USER_DECRYPT: FetchUserDecryptResult;
+}
+
+export type RelayerGetOperation = 'KEY_URL';
+export type RelayerPostOperation = keyof FetchPostOperationResultMap;
+export type RelayerOperation = RelayerPostOperation | RelayerGetOperation;
+
+////////////////////////////////////////////////////////////////////////////////
+// Fetch Payload
+////////////////////////////////////////////////////////////////////////////////
+
+// https://github.com/zama-ai/fhevm-relayer/blob/96151ef300f787658c5fbaf1b4471263160032d5/src/http/input_http_listener.rs#L17
+export type FetchInputProofPayload = {
+  // Hex encoded uint256 string without prefix
+  readonly contractChainId: `0x${string}`;
+  // Hex encoded address with 0x prefix.
+  readonly contractAddress: ChecksummedAddress;
+  // Hex encoded address with 0x prefix.
+  readonly userAddress: ChecksummedAddress;
+  // List of hex encoded binary proof without 0x prefix
+  readonly ciphertextWithInputVerification: BytesHexNo0x;
+  // Hex encoded bytes with 0x prefix. Default: 0x00
+  readonly extraData: BytesHex;
+};
+
+// https://github.com/zama-ai/fhevm-relayer/blob/96151ef300f787658c5fbaf1b4471263160032d5/src/http/public_decrypt_http_listener.rs#L19
+export type RelayerFetchPublicDecryptPayload = {
+  readonly ciphertextHandles: readonly BytesHex[];
+  // Hex encoded bytes with 0x prefix. Default: 0x00
+  readonly extraData: BytesHex;
+};
+
+// https://github.com/zama-ai/fhevm-relayer/blob/96151ef300f787658c5fbaf1b4471263160032d5/src/http/userdecrypt_http_listener.rs#L33
+export type HandleContractPair = {
+  // Hex encoded bytes32 with 0x prefix.
+  readonly handle: HandleBytes32Hex;
+  // Hex encoded address with 0x prefix.
+  readonly contractAddress: ChecksummedAddress;
+};
+
+// https://github.com/zama-ai/fhevm-relayer/blob/96151ef300f787658c5fbaf1b4471263160032d5/src/http/userdecrypt_http_listener.rs#L20
+export type FetchUserDecryptPayload = {
+  readonly handleContractPairs: readonly HandleContractPair[];
+  readonly requestValidity: {
+    // Number as a string
+    readonly startTimestamp: string;
+    // Number as a string
+    readonly durationDays: string;
+  };
+  // Number as a string
+  readonly contractsChainId: string;
+  // List of hex encoded addresses with 0x prefix
+  readonly contractAddresses: readonly ChecksummedAddress[];
+  // Hex encoded address with 0x prefix.
+  readonly userAddress: ChecksummedAddress;
+  // Hex encoded signature without 0x prefix.
+  readonly signature: Bytes65HexNo0x;
+  // Hex encoded key without 0x prefix.
+  readonly publicKey: BytesHexNo0x;
+  // Hex encoded bytes with 0x prefix. Default: 0x00
+  readonly extraData: BytesHex;
+};
+
+export type FetchDelegatedUserDecryptPayload = {
+  readonly handleContractPairs: readonly HandleContractPair[];
+  // Hex encoded uint256 string without prefix
+  readonly contractsChainId: string;
+  // List of hex encoded addresses with 0x prefix
+  readonly contractAddresses: readonly ChecksummedAddress[];
+  // The address grating permission. Hex encoded address with 0x prefix.
+  readonly delegatorAddress: ChecksummedAddress;
+  // The address receiving permission. Hex encoded address with 0x prefix.
+  readonly delegateAddress: ChecksummedAddress;
+  // Number as a string
+  readonly startTimestamp: string;
+  // Number as a string
+  readonly durationDays: string;
+  // Hex encoded signature without 0x prefix.
+  readonly signature: Bytes65HexNo0x;
+  // Hex encoded key without 0x prefix.
+  readonly publicKey: BytesHexNo0x;
+  // Hex encoded bytes with 0x prefix. Default: 0x00
+  readonly extraData: BytesHex;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// Relayer Async Request
+////////////////////////////////////////////////////////////////////////////////
+
+export type RelayerAsyncRequestState = {
+  aborted: boolean;
+  canceled: boolean;
+  failed: boolean;
+  fetching: boolean;
+  running: boolean;
+  succeeded: boolean;
+  terminated: boolean;
+  timeout: boolean;
+};
+
+export type RelayerTerminateReason = 'succeeded' | 'failed' | 'timeout' | 'abort';
+
+////////////////////////////////////////////////////////////////////////////////
+// Relayer Status Codes
+////////////////////////////////////////////////////////////////////////////////
+
+export type RelayerFetchMethod = 'GET' | 'POST';
+export type RelayerSuccessStatus = 200 | 202;
+export type RelayerFailureStatus = 400 | 401 | 404 | 429 | 500 | 503;
+
+export type RelayerPostResponseStatus =
+  | NonEmptyExtract<RelayerSuccessStatus, 202>
+  | NonEmptyExtract<RelayerFailureStatus, 400 | 401 | 429 | 500 | 503>;
+
+// export type RelayerPostResponse =
+//   | RelayerResponseFailed
+//   | RelayerPostResponse202Queued;
+
+// GET:  200 | 202 | 400 | 401 | 404 | 500 | 503
+export type RelayerGetResponseStatus =
+  | NonEmptyExtract<RelayerSuccessStatus, 200 | 202>
+  | NonEmptyExtract<RelayerFailureStatus, 400 | 401 | 404 | 500 | 503>;
+
+////////////////////////////////////////////////////////////////////////////////
+// Succeeded: 200
+////////////////////////////////////////////////////////////////////////////////
+
+export interface RelayerGetResponse200Map {
+  INPUT_PROOF: RelayerResult200InputProofAccepted | RelayerResult200InputProofRejected;
+  PUBLIC_DECRYPT: RelayerResult200PublicDecrypt;
+  USER_DECRYPT: RelayerResult200UserDecrypt;
+}
+
+export type RelayerGetResponse200<A extends keyof RelayerGetResponse200Map> = {
+  status: 'succeeded';
+  requestId: string; // request id field. use it for identifying the request and asking support
+  result: RelayerGetResponse200Map[A];
+};
+
+export type RelayerResult200InputProofAccepted = {
+  accepted: true;
+  extraData: BytesHex;
+  // Ordered List of hex encoded handles with 0x prefix.
+  handles: Bytes32Hex[];
+  // Attestation signatures for Input verification for the ordered list of handles with 0x prefix.
+  signatures: Bytes65Hex[];
+};
+
+export type RelayerResult200InputProofRejected = {
+  accepted: false;
+  extraData: BytesHex;
+};
+
+export type RelayerResult200PublicDecrypt = {
+  signatures: BytesHexNo0x[];
+  decryptedValue: BytesHexNo0x;
+  extraData: BytesHex;
+};
+
+export type RelayerResult200UserDecrypt = {
+  result: Array<{
+    payload: BytesHexNo0x;
+    signature: Bytes65HexNo0x;
+    extraData: BytesHex;
+  }>;
+};
+
+/**
+ * Relayer 200 response for input proof requests:
+ * ```json
+ * {
+ *   "status": "succeeded",
+ *   "requestId": "string",
+ *   "result": {
+ *     "accepted": true,
+ *     "extraData": "0x...",
+ *     "handles": ["0x..."],
+ *     "signatures": ["0x..."]
+ *   } | {
+ *     "accepted": false,
+ *     "extraData": "0x..."
+ *   }
+ * }
+ * ```
+ */
+export type RelayerInputProofSucceeded = RelayerGetResponse200<'INPUT_PROOF'>;
+
+/**
+ * Relayer 200 response for public decrypt requests:
+ * ```json
+ * {
+ *   "status": "succeeded",
+ *   "requestId": "string",
+ *   "result": {
+ *     "signatures": ["hexNo0x..."],
+ *     "decryptedValue": "hexNo0x...",
+ *     "extraData": "0x..."
+ *   }
+ * }
+ * ```
+ */
+export type RelayerPublicDecryptSucceeded = RelayerGetResponse200<'PUBLIC_DECRYPT'>;
+
+/**
+ * Relayer 200 response for user decrypt requests:
+ * ```json
+ * {
+ *   "status": "succeeded",
+ *   "requestId": "string",
+ *   "result": {
+ *     "result": [{
+ *       "payload": "hexNo0x...",
+ *       "signature": "hexNo0x...",
+ *       "extraData": "hex_or_hexNo0x_?..."
+ *     }]
+ *   }
+ * }
+ * ```
+ */
+export type RelayerUserDecryptSucceeded = RelayerGetResponse200<'USER_DECRYPT'>;
+
+////////////////////////////////////////////////////////////////////////////////
+// Queued: 202
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * Relayer 202 get response schema:
+ * ```json
+ * {
+ *   "result": {
+ *     "status": "queued",
+ *     "requestId": "string",
+ *   }
+ * }
+ * ```
+ */
+export type RelayerGetResponse202Queued = {
+  status: 'queued';
+  requestId: string; // request id field. use it for identifying the request and asking support
+};
+
+/**
+ * Relayer 202 post response schema:
+ * ```json
+ * {
+ *   "result": {
+ *     "status": "queued",
+ *     "requestId": "string",
+ *     "result": {
+ *        jobId: "string",
+ *      }
+ *   }
+ * }
+ * ```
+ */
+export type RelayerPostResponse202Queued = {
+  status: 'queued';
+  requestId: string; // request id field. use it for identifying the request and asking support
+  result: RelayerResult202Queued;
+};
+
+export type RelayerResult202Queued = {
+  jobId: string;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// Relayer Response Failed
+////////////////////////////////////////////////////////////////////////////////
+
+/**
+ * Optional request id field. Would be empty in case of 429 from Cloudflare/Kong.
+ * In other cases, use it for identifying the request and asking support
+ */
+export type RelayerResponseFailed = {
+  status: 'failed';
+  requestId?: string;
+  error: RelayerApiError;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// Relayer API Errors (400 | 401 | 404 | 429 | 500 | 503)
+////////////////////////////////////////////////////////////////////////////////
+
+export type RelayerApiError =
+  | RelayerApiError400
+  | RelayerApiError401
+  | RelayerApiError404
+  | RelayerApiError429
+  | RelayerApiError500
+  | RelayerApiError503;
+
+/**
+ * Status: 400
+ */
+export type RelayerApiError400 = RelayerApiError400NoDetails | RelayerApiError400WithDetails;
+
+/**
+ * Status: 400 (no details)
+ */
+export type RelayerApiError400NoDetails = {
+  label: 'malformed_json' | 'request_error' | 'not_ready_for_decryption';
+  message: string;
+};
+
+/**
+ * Status: 400 (with details)
+ */
+export type RelayerApiError400WithDetails = {
+  label: 'missing_fields' | 'validation_failed';
+  message: string;
+  details: RelayerErrorDetail[];
+};
+
+export type RelayerErrorDetail = {
+  field: string;
+  issue: string;
+};
+
+/**
+ * Status: 401
+ */
+export type RelayerApiError401 = {
+  label: 'unauthorized';
+  message: string;
+};
+
+/**
+ * Status: 404
+ */
+export type RelayerApiError404 = {
+  label: 'not_found';
+  message: string;
+};
+
+/**
+ * Status: 429
+ */
+export type RelayerApiError429 = {
+  label: 'rate_limited' | 'protocol_overload';
+  message: string;
+};
+
+/**
+ * Status: 500
+ */
+export type RelayerApiError500 = {
+  label: 'internal_server_error';
+  message: string;
+};
+
+/**
+ * Status: 503
+ */
+export type RelayerApiError503 = {
+  label: 'protocol_paused' | 'gateway_not_reachable' | 'readiness_check_timed_out' | 'response_timed_out';
+  message: string;
+};
+
+export type FetchKeyUrlResult = {
+  readonly fheKeyInfo: [
+    {
+      readonly fhePublicKey: {
+        readonly dataId: string;
+        readonly urls: readonly [string];
+      };
+    },
+  ];
+  readonly crs: {
+    readonly 2048: {
+      readonly dataId: string;
+      readonly urls: readonly [string];
+    };
+  };
+};
+
+/**
+ * Parameters for fetching TFHE resources with retry support.
+ */
+export type TfheFetchParams = {
+  /** Optional fetch init options (headers, signal, etc.) */
+  init?: RequestInit | undefined;
+  /** Number of retry attempts on network failure (default: 3) */
+  retries?: number | undefined;
+  /** Delay in milliseconds between retries (default: 1000) */
+  retryDelayMs?: number | undefined;
+};

package/core/types/relayer.ts

@@ -0,0 +1,183 @@
+import type { Bytes65Hex, Bytes65HexNo0x, BytesHex, BytesHexNo0x } from './primitives.js';
+import type { Prettify } from './utils.js';
+import type { Auth } from './auth.js';
+import type { InputHandle } from './encryptedTypes-p.js';
+
+export type RelayerSuccessStatus = 200 | 202;
+export type RelayerFailureStatus = 400 | 401 | 404 | 429 | 500 | 503;
+
+export type FetchInputProofResult = {
+  // Ordered List of hex encoded handles with 0x prefix.
+  readonly handles: readonly InputHandle[];
+  // Attestation signatures for Input verification for the ordered list of handles with 0x prefix.
+  readonly signatures: readonly Bytes65Hex[];
+  readonly extraData: BytesHex;
+};
+
+export type FetchPublicDecryptResult = {
+  readonly signatures: readonly BytesHexNo0x[];
+  readonly decryptedValue: BytesHexNo0x;
+  readonly extraData: BytesHex;
+};
+
+export type FetchUserDecryptResultItem = {
+  readonly payload: BytesHexNo0x;
+  readonly signature: Bytes65HexNo0x;
+  readonly extraData: BytesHex;
+};
+export type FetchUserDecryptResult = readonly FetchUserDecryptResultItem[];
+export type FetchDelegatedUserDecryptResult = readonly FetchUserDecryptResultItem[];
+
+////////////////////////////////////////////////////////////////////////////////
+// Options
+////////////////////////////////////////////////////////////////////////////////
+
+export type RelayerCommonOptions = {
+  auth?: Auth | undefined;
+  debug?: boolean | undefined;
+  fetchRetries?: number | undefined;
+  fetchRetryDelayInMilliseconds?: number | undefined;
+  signal?: AbortSignal;
+  timeout?: number;
+};
+
+export type RelayerKeyUrlOptions = Prettify<
+  Omit<RelayerCommonOptions, 'timeout'> & {
+    onProgress?: ((args: RelayerKeyUrlProgressArgs) => void) | undefined;
+  }
+>;
+
+export type RelayerInputProofOptions = Prettify<
+  RelayerCommonOptions & {
+    onProgress?: ((args: RelayerInputProofProgressArgs) => void) | undefined;
+  }
+>;
+
+export type RelayerUserDecryptOptions = Prettify<
+  RelayerCommonOptions & {
+    onProgress?: ((args: RelayerUserDecryptProgressArgs) => void) | undefined;
+  }
+>;
+
+export type RelayerDelegatedUserDecryptOptions = Prettify<
+  RelayerCommonOptions & {
+    onProgress?: ((args: RelayerDelegatedUserDecryptProgressArgs) => void) | undefined;
+  }
+>;
+
+export type RelayerPublicDecryptOptions = Prettify<
+  RelayerCommonOptions & {
+    onProgress?: ((args: RelayerPublicDecryptProgressArgs) => void) | undefined;
+  }
+>;
+
+////////////////////////////////////////////////////////////////////////////////
+// Progress
+////////////////////////////////////////////////////////////////////////////////
+
+export type RelayerProgressTypeValue = 'abort' | 'queued' | 'failed' | 'timeout' | 'succeeded' | 'throttled';
+
+export type RelayerPostOperation = 'INPUT_PROOF' | 'PUBLIC_DECRYPT' | 'USER_DECRYPT' | 'DELEGATED_USER_DECRYPT';
+
+export type FetchResultOf<O extends RelayerPostOperation> = O extends 'INPUT_PROOF'
+  ? FetchInputProofResult
+  : O extends 'PUBLIC_DECRYPT'
+    ? FetchPublicDecryptResult
+    : FetchUserDecryptResult;
+
+export type RelayerProgressArgs<O extends RelayerPostOperation> =
+  | RelayerProgressQueued<O>
+  | RelayerProgressThrottled<O>
+  | RelayerProgressSucceeded<O>
+  | RelayerProgressTimeout<O>
+  | RelayerProgressAbort<O>
+  | RelayerProgressFailed<O>;
+
+export type RelayerKeyUrlProgressArgs = {
+  readonly url: string;
+  readonly operation: 'KEY_URL';
+  readonly retryCount: number;
+  readonly method: 'GET';
+};
+export type RelayerInputProofProgressArgs = RelayerProgressArgs<'INPUT_PROOF'>;
+export type RelayerUserDecryptProgressArgs = RelayerProgressArgs<'USER_DECRYPT'>;
+export type RelayerDelegatedUserDecryptProgressArgs = RelayerProgressArgs<'DELEGATED_USER_DECRYPT'>;
+export type RelayerPublicDecryptProgressArgs = RelayerProgressArgs<'PUBLIC_DECRYPT'>;
+
+export type RelayerProgressBase<T extends RelayerProgressTypeValue, O extends RelayerPostOperation> = {
+  readonly type: T;
+  readonly url: string;
+  readonly method?: 'POST' | 'GET';
+  readonly operation: O;
+  readonly jobId?: string | undefined;
+  readonly retryCount: number;
+  readonly totalSteps: number;
+  readonly step: number;
+};
+
+export type RelayerProgressStatusBase<
+  T extends RelayerProgressTypeValue,
+  O extends RelayerPostOperation,
+  S extends RelayerSuccessStatus | RelayerFailureStatus,
+> = Prettify<
+  RelayerProgressBase<T, O> & {
+    readonly method: 'POST' | 'GET';
+    readonly status: S;
+  }
+>;
+
+export type RelayerProgressJobIdBase<
+  T extends RelayerProgressTypeValue,
+  O extends RelayerPostOperation,
+  S extends RelayerSuccessStatus | RelayerFailureStatus,
+> = Prettify<
+  RelayerProgressStatusBase<T, O, S> & {
+    readonly jobId: string;
+  }
+>;
+
+// 202 is GET or POST
+export type RelayerProgressQueued<O extends RelayerPostOperation> = Prettify<
+  RelayerProgressJobIdBase<'queued', O, 202> & {
+    readonly requestId: string;
+    readonly retryAfterMs: number;
+    readonly elapsed: number;
+  }
+>;
+
+export type RelayerProgressThrottled<O extends RelayerPostOperation> = Prettify<
+  RelayerProgressStatusBase<'throttled', O, 429> & {
+    readonly method: 'POST';
+    readonly retryAfterMs: number;
+    readonly elapsed: number;
+    readonly relayerApiError: {
+      readonly label: string;
+      readonly message: string;
+    };
+  }
+>;
+
+export type RelayerProgressSucceeded<O extends RelayerPostOperation> = Prettify<
+  RelayerProgressJobIdBase<'succeeded', O, 200> & {
+    readonly requestId: string;
+    readonly elapsed: number;
+    readonly result: FetchResultOf<O>;
+  }
+>;
+
+export type RelayerProgressFailed<
+  O extends RelayerPostOperation,
+  S extends RelayerFailureStatus = RelayerFailureStatus,
+> = Prettify<
+  RelayerProgressStatusBase<'failed', O, S> & {
+    readonly elapsed: number;
+    readonly relayerApiError: {
+      readonly label: string;
+      readonly message: string;
+    };
+  }
+>;
+
+export type RelayerProgressTimeout<O extends RelayerPostOperation> = Prettify<RelayerProgressBase<'timeout', O>>;
+
+export type RelayerProgressAbort<O extends RelayerPostOperation> = Prettify<RelayerProgressBase<'abort', O>>;

package/core/types/signedDecryptionPermit.ts

@@ -0,0 +1,50 @@
+import type { KmsDelegatedUserDecryptEip712, KmsUserDecryptEip712 } from './kms.js';
+import type { Bytes65Hex, BytesHex, ChecksummedAddress } from './primitives.js';
+
+/**
+ * A signed EIP-712 authorization that allows the signer's ephemeral key
+ * to request decryption of the signer's own FHE handles from the KMS.
+ *
+ * Created once, serializable, and reusable across multiple decrypt calls.
+ */
+export type SignedDecryptionPermitBase = {
+  /** The EIP-712 signature. */
+  readonly signature: Bytes65Hex;
+  /** The account that signed the permit. */
+  readonly signerAddress: ChecksummedAddress;
+  /**
+   * The account that owns the encrypted data this permit covers.
+   *
+   * - **Self permit:** equals `signerAddress` — the signer authorizes decryption
+   *   of their own data.
+   *
+   * - **Delegated permit:** differs from `signerAddress`. Step by step:
+   *   1. Alice owns encrypted values on-chain (ebool, euint8, etc.).
+   *   2. Alice calls the ACL contract to grant Bob permission to decrypt her data.
+   *   3. Bob signs an EIP-712 delegated decryption permit referencing Alice as the
+   *      `encryptedDataOwnerAddress` (= `delegatorAddress` in the EIP-712 message).
+   *   4. The KMS verifies Bob's signature (`signerAddress`) and that Alice
+   *      (`encryptedDataOwnerAddress`) has granted him on-chain permission.
+   *   5. Bob can now decrypt Alice's encrypted values using this permit.
+   */
+  readonly encryptedDataOwnerAddress: ChecksummedAddress;
+  /** The E2E transport public key embedded in the EIP-712 message. */
+  readonly e2eTransportPublicKey: BytesHex;
+
+  /** @throws If the permit has expired based on `startTimestamp` + `durationDays`. */
+  assertNotExpired(): void;
+};
+
+export type SignedSelfDecryptionPermit = SignedDecryptionPermitBase & {
+  readonly eip712: KmsUserDecryptEip712;
+  /** Always `false` for non-delegated permits. `encryptedDataOwnerAddress === signerAddress`. */
+  readonly isDelegated: false;
+};
+
+export type SignedDelegatedDecryptionPermit = SignedDecryptionPermitBase & {
+  readonly eip712: KmsDelegatedUserDecryptEip712;
+  /** Always `true` for delegated permits. `v` is the delegated account. (see `SenderCannotBeDelegate` is ACL.sol) */
+  readonly isDelegated: true;
+};
+
+export type SignedDecryptionPermit = SignedSelfDecryptionPermit | SignedDelegatedDecryptionPermit;

package/core/types/tkms-p.ts

@@ -0,0 +1,5 @@
+export declare const TkmsPrivateKeyBrand: unique symbol;
+
+export type TkmsPrivateKey = {
+  readonly [TkmsPrivateKeyBrand]: never;
+};