@fhevm/sdk 1.0.0-alpha.1 → 1.0.0-alpha.3

package/core/modules/ethereum/types-ct.ts

@@ -0,0 +1,89 @@
+import type { Bytes65Hex, BytesHex, ChecksummedAddress } from '../../types/primitives.js';
+import type { Prettify } from '../../types/utils.js';
+import type { EthereumModule } from './types.js';
+
+////////////////////////////////////////////////////////////////////////////////
+// mnemonicToAccount
+////////////////////////////////////////////////////////////////////////////////
+
+export type MnemonicToAccountParameters = Readonly<{
+  mnemonic: string;
+  path: `m/44'/60'/${string}`;
+}>;
+
+export type MnemonicToAccountReturnType = { readonly privateKey: BytesHex; readonly address: ChecksummedAddress };
+
+export type MnemonicToAccountModuleFunction = {
+  mnemonicToAccount(parameters: MnemonicToAccountParameters): MnemonicToAccountReturnType;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// sign
+////////////////////////////////////////////////////////////////////////////////
+
+export type SignParameters = Readonly<{
+  hash: BytesHex;
+  privateKey: BytesHex;
+}>;
+
+export type SignReturnType = Bytes65Hex;
+
+export type SignModuleFunction = {
+  sign(parameters: SignParameters): Promise<SignReturnType>;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// generatePrivateKey
+////////////////////////////////////////////////////////////////////////////////
+
+export type GeneratePrivateKeyReturnType = BytesHex;
+
+export type GeneratePrivateKeyModuleFunction = {
+  generatePrivateKey(): GeneratePrivateKeyReturnType;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// getPublicKey
+////////////////////////////////////////////////////////////////////////////////
+
+export type GetPublicKeyParameters = Readonly<{
+  privateKey: BytesHex;
+}>;
+
+export type GetPublicKeyReturnType = BytesHex;
+
+export type GetPublicKeyModuleFunction = {
+  getPublicKey(parameters: GetPublicKeyParameters): GetPublicKeyReturnType;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// recoverAddress
+////////////////////////////////////////////////////////////////////////////////
+
+export type RecoverAddressParameters = Readonly<{
+  hash: BytesHex;
+  signature: Bytes65Hex;
+}>;
+
+export type RecoverAddressReturnType = ChecksummedAddress;
+
+export type RecoverAddressModuleFunction = {
+  recoverAddress(parameters: RecoverAddressParameters): Promise<RecoverAddressReturnType>;
+};
+
+////////////////////////////////////////////////////////////////////////////////
+// cleartextEthereumModule
+////////////////////////////////////////////////////////////////////////////////
+
+export type CleartextEthereumModule = EthereumModule &
+  Prettify<
+    MnemonicToAccountModuleFunction &
+      SignModuleFunction &
+      GeneratePrivateKeyModuleFunction &
+      GetPublicKeyModuleFunction &
+      RecoverAddressModuleFunction
+  >;
+
+export type CleartextEthereumModuleFactory = () => {
+  readonly ethereum: CleartextEthereumModule;
+};

package/core/modules/relayer/cleartext/fetchCoprocessorSignatures.ts

@@ -0,0 +1,94 @@
+import type { Bytes65Hex, BytesHex, ChecksummedAddress } from '../../../types/primitives.js';
+import type { CleartextEthereumModule } from '../../ethereum/types-ct.js';
+import type {
+  FetchCoprocessorSignaturesParameters,
+  FetchCoprocessorSignaturesReturnType,
+  RelayerClientWithRuntime,
+} from '../types.js';
+import { asUint32BigInt, randomUniqueUints } from '../../../base/uint.js';
+import { getTrustedClient } from '../../../runtime/CoreFhevm-p.js';
+import { getCoprocessorSignersPrivateKeyMap } from './signers.js';
+
+/*
+export type FetchCoprocessorSignaturesReturnType = {
+  readonly handles: readonly InputHandle[];
+  readonly coprocessorEip712Signatures: readonly Bytes65Hex[];
+  readonly extraData: BytesHex;
+};
+
+*/
+const inputProofAbi = [
+  {
+    type: 'function',
+    name: 'inputProof',
+    inputs: [
+      {
+        name: 'ctHandles',
+        type: 'bytes32[]',
+        internalType: 'bytes32[]',
+      },
+      { name: 'userAddress', type: 'address', internalType: 'address' },
+      {
+        name: 'contractAddress',
+        type: 'address',
+        internalType: 'address',
+      },
+      { name: 'extraData', type: 'bytes', internalType: 'bytes' },
+    ],
+    outputs: [
+      { name: 'digest', type: 'bytes32', internalType: 'bytes32' },
+      { name: 'signers', type: 'address[]', internalType: 'address[]' },
+      { name: 'threshold', type: 'uint256', internalType: 'uint256' },
+    ],
+    stateMutability: 'view',
+  },
+] as const;
+
+export async function fetchCoprocessorSignatures(
+  relayerClient: RelayerClientWithRuntime,
+  parameters: FetchCoprocessorSignaturesParameters,
+): Promise<FetchCoprocessorSignaturesReturnType> {
+  const cleartextEthereumModule = relayerClient.runtime.ethereum as CleartextEthereumModule;
+  const { payload } = parameters;
+
+  const trustedClient = getTrustedClient(relayerClient);
+  const res = (await relayerClient.runtime.ethereum.readContract(trustedClient, {
+    abi: inputProofAbi,
+    address: relayerClient.chain.fhevm.contracts.inputVerifier.address as ChecksummedAddress,
+    args: [
+      payload.zkProof.getInputHandles().map((h) => h.bytes32Hex),
+      payload.zkProof.userAddress,
+      payload.zkProof.contractAddress,
+      payload.zkProof.getExtraData(),
+    ],
+    functionName: inputProofAbi[0].name,
+  })) as unknown[];
+
+  const digest = res[0] as BytesHex;
+  const signersAddress = res[1] as ChecksummedAddress[];
+  const threshold = asUint32BigInt(res[2]);
+  const signers = getCoprocessorSignersPrivateKeyMap(relayerClient);
+
+  const randomSignersAddress = randomUniqueUints(signersAddress.length, Number(threshold)).map(
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    (i) => signersAddress[i]!,
+  );
+
+  const coprocessorEip712Signatures: Bytes65Hex[] = [];
+
+  for (const signerAddress of randomSignersAddress) {
+    const privateKey = signers.get(signerAddress);
+    if (privateKey === undefined) {
+      throw new Error(`Unable to find KMS signer for address ${signerAddress}`);
+    }
+
+    const signature = await cleartextEthereumModule.sign({ hash: digest, privateKey });
+    coprocessorEip712Signatures.push(signature);
+  }
+
+  return Promise.resolve({
+    extraData: payload.zkProof.getExtraData(),
+    handles: payload.zkProof.getInputHandles(),
+    coprocessorEip712Signatures,
+  });
+}

package/core/modules/relayer/cleartext/fetchDelegatedUserDecrypt.ts

@@ -0,0 +1,147 @@
+import type { BytesHex, ChecksummedAddress } from '../../../types/primitives.js';
+import type { FetchUserDecryptResultItem } from '../../../types/relayer.js';
+import type { CleartextEthereumModule } from '../../ethereum/types-ct.js';
+import type {
+  FetchDelegatedUserDecryptParameters,
+  FetchUserDecryptReturnType,
+  RelayerClientWithRuntime,
+} from '../types.js';
+import { remove0x } from '../../../base/string.js';
+import { asUint32BigInt, parseUintBigIntString, randomUniqueUints } from '../../../base/uint.js';
+import { getTrustedClient } from '../../../runtime/CoreFhevm-p.js';
+import { userDecryptResultToKmsSigncryptedShares } from '../utils.js';
+import { getKmsSignersPrivateKeyMap } from './signers.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+const delegatedUserDecryptAbi = [
+  {
+    type: 'function',
+    name: 'delegatedUserDecrypt',
+    inputs: [
+      {
+        name: 'pairs',
+        type: 'tuple[]',
+        internalType: 'struct HandleContractPair[]',
+        components: [
+          { name: 'handle', type: 'bytes32', internalType: 'bytes32' },
+          {
+            name: 'contractAddress',
+            type: 'address',
+            internalType: 'address',
+          },
+        ],
+      },
+      { name: 'delegator', type: 'address', internalType: 'address' },
+      { name: 'delegate', type: 'address', internalType: 'address' },
+      { name: 'publicKey', type: 'bytes', internalType: 'bytes' },
+      {
+        name: 'contractAddresses',
+        type: 'address[]',
+        internalType: 'address[]',
+      },
+      {
+        name: 'startTimestamp',
+        type: 'uint256',
+        internalType: 'uint256',
+      },
+      {
+        name: 'durationDays',
+        type: 'uint256',
+        internalType: 'uint256',
+      },
+      { name: 'delegateSignature', type: 'bytes', internalType: 'bytes' },
+    ],
+    outputs: [
+      { name: 'payload', type: 'bytes', internalType: 'bytes' },
+      { name: 'signers', type: 'address[]', internalType: 'address[]' },
+      { name: 'threshold', type: 'uint256', internalType: 'uint256' },
+      { name: 'extraData', type: 'bytes', internalType: 'bytes' },
+    ],
+    stateMutability: 'view',
+  },
+] as const;
+
+////////////////////////////////////////////////////////////////////////////////
+
+export async function fetchDelegatedUserDecrypt(
+  relayerClient: RelayerClientWithRuntime,
+  parameters: FetchDelegatedUserDecryptParameters,
+): Promise<FetchUserDecryptReturnType> {
+  const cleartextEthereumModule = relayerClient.runtime.ethereum as CleartextEthereumModule;
+  const { payload } = parameters;
+  const pairs = payload.handleContractPairs;
+  const contractAddresses = payload.kmsDecryptEip712Message.contractAddresses;
+
+  const authCount = contractAddresses.length;
+  for (const { contractAddress: c } of pairs) {
+    let authorized: boolean = false;
+    for (let i = 0; i < authCount; ++i) {
+      if (contractAddresses[i] == c) {
+        authorized = true;
+        break;
+      }
+    }
+    if (!authorized) {
+      throw new Error(`ContractAddressNotAuthorized: ${c} is not in the EIP-712 authorized contractAddresses list.`);
+    }
+  }
+
+  const { kmsDecryptEip712Message, kmsDecryptEip712Signer, kmsDecryptEip712Signature } = payload;
+  const trustedClient = getTrustedClient(relayerClient);
+  const res = (await relayerClient.runtime.ethereum.readContract(trustedClient, {
+    abi: delegatedUserDecryptAbi,
+    address: relayerClient.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
+    args: [
+      pairs.map((p) => ({
+        handle: p.handle.bytes32Hex,
+        contractAddress: p.contractAddress,
+      })),
+      kmsDecryptEip712Message.delegatorAddress,
+      kmsDecryptEip712Signer,
+      kmsDecryptEip712Message.publicKey,
+      kmsDecryptEip712Message.contractAddresses,
+      _parseUintBigIntString('kmsDecryptEip712Message.startTimestamp', kmsDecryptEip712Message.startTimestamp),
+      _parseUintBigIntString('kmsDecryptEip712Message.durationDays', kmsDecryptEip712Message.durationDays),
+      kmsDecryptEip712Signature,
+    ],
+    functionName: delegatedUserDecryptAbi[0].name,
+  })) as unknown[];
+
+  const commonKmsSigncryptedSharePayload = res[0] as BytesHex;
+  const commonKmsSigncryptedSharePayloadNo0x = remove0x(commonKmsSigncryptedSharePayload);
+  const signersAddress = res[1] as readonly ChecksummedAddress[];
+  const threshold = asUint32BigInt(res[2]);
+  const extraData = res[3] as BytesHex;
+
+  const signers = getKmsSignersPrivateKeyMap(relayerClient);
+
+  const randomSignersAddress = randomUniqueUints(signersAddress.length, Number(threshold)).map(
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    (i) => signersAddress[i]!,
+  );
+
+  const result: FetchUserDecryptResultItem[] = [];
+
+  for (const signerAddress of randomSignersAddress) {
+    const privateKey = signers.get(signerAddress);
+    if (privateKey === undefined) {
+      throw new Error(`Unable to find KMS signer for address ${signerAddress}`);
+    }
+
+    const signature = await cleartextEthereumModule.sign({ hash: commonKmsSigncryptedSharePayload, privateKey });
+    result.push({ signature: remove0x(signature), payload: commonKmsSigncryptedSharePayloadNo0x, extraData });
+  }
+
+  return userDecryptResultToKmsSigncryptedShares(result);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+function _parseUintBigIntString(label: string, value: string): bigint {
+  const bn = parseUintBigIntString(value);
+  if (bn === undefined) {
+    throw new Error(`${label} is not a valid uint string, got ${JSON.stringify(value)}`);
+  }
+  return bn;
+}

package/core/modules/relayer/cleartext/fetchPublicDecrypt.ts

@@ -0,0 +1,67 @@
+import type { Bytes32Hex, Bytes65Hex, BytesHex, ChecksummedAddress } from '../../../types/primitives.js';
+import type { CleartextEthereumModule } from '../../ethereum/types-ct.js';
+import type { FetchPublicDecryptParameters, FetchPublicDecryptReturnType, RelayerClientWithRuntime } from '../types.js';
+import { getTrustedClient } from '../../../runtime/CoreFhevm-p.js';
+import { getKmsSignersPrivateKeyMap } from './signers.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+const publicDecryptAbi = [
+  {
+    type: 'function',
+    name: 'publicDecrypt',
+    inputs: [{ name: 'handles', type: 'bytes32[]', internalType: 'bytes32[]' }],
+    outputs: [
+      {
+        name: 'abiEncodedCleartexts',
+        type: 'bytes',
+        internalType: 'bytes',
+      },
+      { name: 'digest', type: 'bytes32', internalType: 'bytes32' },
+      { name: 'signers', type: 'address[]', internalType: 'address[]' },
+      { name: 'threshold', type: 'uint256', internalType: 'uint256' },
+      { name: 'extraData', type: 'bytes', internalType: 'bytes' },
+    ],
+    stateMutability: 'view',
+  },
+] as const;
+
+////////////////////////////////////////////////////////////////////////////////
+
+export async function fetchPublicDecrypt(
+  relayerClient: RelayerClientWithRuntime,
+  parameters: FetchPublicDecryptParameters,
+): Promise<FetchPublicDecryptReturnType> {
+  const cleartextEthereumModule = relayerClient.runtime.ethereum as CleartextEthereumModule;
+
+  const trustedClient = getTrustedClient(relayerClient);
+  const res = (await relayerClient.runtime.ethereum.readContract(trustedClient, {
+    abi: publicDecryptAbi,
+    address: relayerClient.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
+    args: [parameters.payload.orderedHandles.map((h) => h.bytes32Hex)],
+    functionName: publicDecryptAbi[0].name,
+  })) as unknown[];
+
+  const digest = res[1] as Bytes32Hex;
+  const signersAddress = res[2] as readonly ChecksummedAddress[];
+  const signers = getKmsSignersPrivateKeyMap(relayerClient);
+
+  const kmsPublicDecryptEIP712Signatures: Bytes65Hex[] = [];
+
+  for (let i = 0; i < signersAddress.length; ++i) {
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    const privateKey = signers.get(signersAddress[i]!);
+    if (privateKey === undefined) {
+      throw new Error('Unable to find kms signer');
+    }
+
+    const signature = await cleartextEthereumModule.sign({ hash: digest, privateKey });
+    kmsPublicDecryptEIP712Signatures.push(signature);
+  }
+
+  return {
+    orderedAbiEncodedClearValues: res[0] as BytesHex,
+    kmsPublicDecryptEIP712Signatures,
+    extraData: res[4] as BytesHex,
+  };
+}

package/core/modules/relayer/cleartext/fetchUserDecrypt.ts

@@ -0,0 +1,141 @@
+import type { BytesHex, ChecksummedAddress } from '../../../types/primitives.js';
+import type { FetchUserDecryptResultItem } from '../../../types/relayer.js';
+import type { CleartextEthereumModule } from '../../ethereum/types-ct.js';
+import type { FetchUserDecryptParameters, FetchUserDecryptReturnType, RelayerClientWithRuntime } from '../types.js';
+import { remove0x } from '../../../base/string.js';
+import { asUint32BigInt, parseUintBigIntString, randomUniqueUints } from '../../../base/uint.js';
+import { getTrustedClient } from '../../../runtime/CoreFhevm-p.js';
+import { userDecryptResultToKmsSigncryptedShares } from '../utils.js';
+import { getKmsSignersPrivateKeyMap } from './signers.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+const userDecryptAbi = [
+  {
+    type: 'function',
+    name: 'userDecrypt',
+    inputs: [
+      {
+        name: 'pairs',
+        type: 'tuple[]',
+        internalType: 'struct HandleContractPair[]',
+        components: [
+          { name: 'handle', type: 'bytes32', internalType: 'bytes32' },
+          {
+            name: 'contractAddress',
+            type: 'address',
+            internalType: 'address',
+          },
+        ],
+      },
+      { name: 'userAddress', type: 'address', internalType: 'address' },
+      { name: 'publicKey', type: 'bytes', internalType: 'bytes' },
+      {
+        name: 'contractAddresses',
+        type: 'address[]',
+        internalType: 'address[]',
+      },
+      {
+        name: 'startTimestamp',
+        type: 'uint256',
+        internalType: 'uint256',
+      },
+      {
+        name: 'durationDays',
+        type: 'uint256',
+        internalType: 'uint256',
+      },
+      { name: 'userSignature', type: 'bytes', internalType: 'bytes' },
+    ],
+    outputs: [
+      { name: 'payload', type: 'bytes', internalType: 'bytes' },
+      { name: 'signers', type: 'address[]', internalType: 'address[]' },
+      { name: 'threshold', type: 'uint256', internalType: 'uint256' },
+      { name: 'extraData', type: 'bytes', internalType: 'bytes' },
+    ],
+    stateMutability: 'view',
+  },
+] as const;
+
+////////////////////////////////////////////////////////////////////////////////
+
+export async function fetchUserDecrypt(
+  relayerClient: RelayerClientWithRuntime,
+  parameters: FetchUserDecryptParameters,
+): Promise<FetchUserDecryptReturnType> {
+  const cleartextEthereumModule = relayerClient.runtime.ethereum as CleartextEthereumModule;
+  const { payload } = parameters;
+  const pairs = payload.handleContractPairs;
+  const contractAddresses = payload.kmsDecryptEip712Message.contractAddresses;
+
+  const authCount = contractAddresses.length;
+  for (const { contractAddress: c } of pairs) {
+    let authorized: boolean = false;
+    for (let i = 0; i < authCount; ++i) {
+      if (contractAddresses[i] == c) {
+        authorized = true;
+        break;
+      }
+    }
+    if (!authorized) {
+      throw new Error(`ContractAddressNotAuthorized: ${c} is not in the EIP-712 authorized contractAddresses list.`);
+    }
+  }
+
+  const { kmsDecryptEip712Message, kmsDecryptEip712Signer, kmsDecryptEip712Signature } = payload;
+  const trustedClient = getTrustedClient(relayerClient);
+  const res = (await relayerClient.runtime.ethereum.readContract(trustedClient, {
+    abi: userDecryptAbi,
+    address: relayerClient.chain.fhevm.contracts.kmsVerifier.address as ChecksummedAddress,
+    args: [
+      pairs.map((p) => ({
+        handle: p.handle.bytes32Hex,
+        contractAddress: p.contractAddress,
+      })),
+      kmsDecryptEip712Signer,
+      kmsDecryptEip712Message.publicKey,
+      kmsDecryptEip712Message.contractAddresses,
+      _parseUintBigIntString('kmsDecryptEip712Message.startTimestamp', kmsDecryptEip712Message.startTimestamp),
+      _parseUintBigIntString('kmsDecryptEip712Message.durationDays', kmsDecryptEip712Message.durationDays),
+      kmsDecryptEip712Signature,
+    ],
+    functionName: userDecryptAbi[0].name,
+  })) as unknown[];
+
+  const commonKmsSigncryptedSharePayload = res[0] as BytesHex;
+  const commonKmsSigncryptedSharePayloadNo0x = remove0x(commonKmsSigncryptedSharePayload);
+  const signersAddress = res[1] as readonly ChecksummedAddress[];
+  const threshold = asUint32BigInt(res[2]);
+  const extraData = res[3] as BytesHex;
+
+  const signers = getKmsSignersPrivateKeyMap(relayerClient);
+
+  const randomSignersAddress = randomUniqueUints(signersAddress.length, Number(threshold)).map(
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    (i) => signersAddress[i]!,
+  );
+
+  const result: FetchUserDecryptResultItem[] = [];
+
+  for (const signerAddress of randomSignersAddress) {
+    const privateKey = signers.get(signerAddress);
+    if (privateKey === undefined) {
+      throw new Error(`Unable to find KMS signer for address ${signerAddress}`);
+    }
+
+    const signature = await cleartextEthereumModule.sign({ hash: commonKmsSigncryptedSharePayload, privateKey });
+    result.push({ signature: remove0x(signature), payload: commonKmsSigncryptedSharePayloadNo0x, extraData });
+  }
+
+  return userDecryptResultToKmsSigncryptedShares(result);
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+function _parseUintBigIntString(label: string, value: string): bigint {
+  const bn = parseUintBigIntString(value);
+  if (bn === undefined) {
+    throw new Error(`${label} is not a valid uint string, got ${JSON.stringify(value)}`);
+  }
+  return bn;
+}

package/core/modules/relayer/cleartext/mock.ts

@@ -0,0 +1,54 @@
+import type { UintNumber } from '../../../types/primitives.js';
+import type {
+  FetchFheEncryptionKeyBytesParameters,
+  FetchFheEncryptionKeyBytesReturnType,
+  FetchFheEncryptionKeySourceParameters,
+  RelayerClient,
+  RelayerModuleFactory,
+} from '../types.js';
+import { createDeadbeefBytes } from '../../../base/bytes.js';
+import { fetchUserDecrypt } from './fetchUserDecrypt.js';
+import { fetchPublicDecrypt } from './fetchPublicDecrypt.js';
+import { fetchDelegatedUserDecrypt } from './fetchDelegatedUserDecrypt.js';
+import { fetchCoprocessorSignatures } from './fetchCoprocessorSignatures.js';
+
+////////////////////////////////////////////////////////////////////////////////
+// relayerModule
+////////////////////////////////////////////////////////////////////////////////
+
+export const relayerModule: RelayerModuleFactory = () => {
+  return Object.freeze({
+    relayer: Object.freeze({
+      fetchFheEncryptionKeySource: (
+        _relayerClient: RelayerClient,
+        _parameters: FetchFheEncryptionKeySourceParameters,
+      ) => {
+        throw new Error('Not yet implemented');
+      },
+      fetchFheEncryptionKeyBytes: (
+        relayerClient: RelayerClient,
+        _parameters: FetchFheEncryptionKeyBytesParameters,
+      ): Promise<FetchFheEncryptionKeyBytesReturnType> => {
+        return Promise.resolve({
+          publicKeyBytes: {
+            id: 'fhe-public-key-data-id',
+            bytes: createDeadbeefBytes(256),
+          },
+          crsBytes: {
+            bytes: createDeadbeefBytes(256),
+            capacity: 2048 as UintNumber,
+            id: 'crs-data-id',
+          },
+          metadata: {
+            relayerUrl: relayerClient.relayerUrl,
+            chainId: relayerClient.chainId,
+          },
+        });
+      },
+      fetchCoprocessorSignatures,
+      fetchPublicDecrypt,
+      fetchUserDecrypt,
+      fetchDelegatedUserDecrypt,
+    }),
+  });
+};

package/core/modules/relayer/cleartext/signers.ts

@@ -0,0 +1,52 @@
+import type { BytesHex, ChecksummedAddress } from '../../../types/primitives.js';
+import type { CleartextEthereumModule } from '../../ethereum/types-ct.js';
+import type { RelayerClientWithRuntime } from '../types.js';
+
+////////////////////////////////////////////////////////////////////////////////
+
+const FHEVM_TEST_MNEMONIC = 'test test test test test test test future home engine virtual motion';
+const COPROCESSOR_PATH = "0'/2/";
+const KMS_PATH = "0'/3/";
+
+type PrivateKeyMap = Map<ChecksummedAddress, BytesHex>;
+
+const signersPrivateKeyMap: { readonly coprocessor: PrivateKeyMap; readonly kms: PrivateKeyMap } = {
+  coprocessor: new Map<ChecksummedAddress, BytesHex>(),
+  kms: new Map<ChecksummedAddress, BytesHex>(),
+};
+
+////////////////////////////////////////////////////////////////////////////////
+
+export function getCoprocessorSignersPrivateKeyMap(relayerClient: RelayerClientWithRuntime): PrivateKeyMap {
+  if (signersPrivateKeyMap.coprocessor.size === 0) {
+    _fillSignersPrivateKey(relayerClient, COPROCESSOR_PATH, 20, signersPrivateKeyMap.coprocessor);
+  }
+  return signersPrivateKeyMap.coprocessor;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+export function getKmsSignersPrivateKeyMap(relayerClient: RelayerClientWithRuntime): PrivateKeyMap {
+  if (signersPrivateKeyMap.kms.size === 0) {
+    _fillSignersPrivateKey(relayerClient, KMS_PATH, 20, signersPrivateKeyMap.kms);
+  }
+  return signersPrivateKeyMap.kms;
+}
+
+////////////////////////////////////////////////////////////////////////////////
+
+function _fillSignersPrivateKey(
+  relayerClient: RelayerClientWithRuntime,
+  hdPathSuffix: string,
+  count: number,
+  map: PrivateKeyMap,
+): void {
+  const cleartextEthereumModule = relayerClient.runtime.ethereum as CleartextEthereumModule;
+  for (let i = 0; i < count; ++i) {
+    const account = cleartextEthereumModule.mnemonicToAccount({
+      mnemonic: FHEVM_TEST_MNEMONIC,
+      path: `m/44'/60'/${hdPathSuffix}${i}`,
+    });
+    map.set(account.address, account.privateKey);
+  }
+}