@aptos-labs/ts-sdk 1.27.1 → 1.28.0-zeta.1

package/src/api/account.ts

@@ -15,6 +15,7 @@ import {
   MoveModuleBytecode,
   MoveResource,
   MoveStructId,
+  MoveValue,
   OrderByArg,
   PaginationArgs,
   TokenStandardArg,
@@ -40,10 +41,12 @@ import {
   getTransactions,
   lookupOriginalAccountAddress,
 } from "../internal/account";
-import { APTOS_COIN, ProcessorType } from "../utils/const";
+import { APTOS_COIN, APTOS_FA, ProcessorType } from "../utils/const";
 import { AptosConfig } from "./aptosConfig";
 import { waitForIndexerOnVersion } from "./utils";
 import { CurrentFungibleAssetBalancesBoolExp } from "../types/generated/types";
+import { view } from "../internal/view";
+import { isEncodedStruct, parseEncodedStruct } from "../utils";
 
 /**
  * A class to query all `Account` related queries on Aptos.
@@ -428,7 +431,7 @@ export class Account {
     accountAddress: AccountAddressInput;
     minimumLedgerVersion?: AnyNumber;
   }): Promise<number> {
-    return this.getAccountCoinAmount({ coinType: APTOS_COIN, ...args });
+    return this.getAccountCoinAmount({ coinType: APTOS_COIN, faMetadataAddress: APTOS_FA, ...args });
   }
 
   /**
@@ -438,7 +441,8 @@ export class Account {
    * const accountCoinAmount = await aptos.getAccountCoinAmount({accountAddress:"0x123", coinType:"0x1::aptos_coin::AptosCoin"})
    *
    * @param args.accountAddress The account address we want to get the total count for
-   * @param args.coinType The coin type to query
+   * @param args.coinType The coin type to query.
+   *        Note: faMetadataAddress will automatically fill this in if not provided when migrated to fungible assets
    * @param args.faMetadataAddress The fungible asset metadata address to query.
    *        Note: coinType will automatically fill this in if not provided when migrated to fungible assets
    * @param args.minimumLedgerVersion Optional ledger version to sync up to, before querying
@@ -450,12 +454,35 @@ export class Account {
     faMetadataAddress?: AccountAddressInput;
     minimumLedgerVersion?: AnyNumber;
   }): Promise<number> {
+    const { coinType, faMetadataAddress } = args;
     await waitForIndexerOnVersion({
       config: this.config,
       minimumLedgerVersion: args.minimumLedgerVersion,
       processorType: ProcessorType.FUNGIBLE_ASSET_PROCESSOR,
     });
-    return getAccountCoinAmount({ aptosConfig: this.config, ...args });
+
+    // Attempt to populate the CoinType field if the FA address is provided.
+    // We cannot do this internally due to dependency cycles issue.
+    let coinAssetType: MoveStructId | undefined = coinType;
+    if (coinType === undefined && faMetadataAddress !== undefined) {
+      try {
+        const pairedCoinTypeStruct = (
+          await view({
+            aptosConfig: this.config,
+            payload: { function: "0x1::coin::paired_coin", functionArguments: [faMetadataAddress] },
+          })
+        ).at(0) as { vec: MoveValue[] };
+
+        // Check if the Option has a value, and if so, parse the struct
+        if (pairedCoinTypeStruct.vec.length > 0 && isEncodedStruct(pairedCoinTypeStruct.vec[0])) {
+          coinAssetType = parseEncodedStruct(pairedCoinTypeStruct.vec[0]);
+        }
+      } catch (error) {
+        /* No paired coin type found */
+      }
+    }
+
+    return getAccountCoinAmount({ aptosConfig: this.config, ...args, coinType: coinAssetType });
   }
 
   /**

package/src/api/keyless.ts

@@ -1,9 +1,16 @@
 // Copyright © Aptos Foundation
 // SPDX-License-Identifier: Apache-2.0
 
-import { EphemeralKeyPair, KeylessAccount, ProofFetchCallback } from "../account";
-import { ZeroKnowledgeSig } from "../core";
-import { deriveKeylessAccount, getPepper, getProof } from "../internal/keyless";
+import { Account, EphemeralKeyPair, KeylessAccount, ProofFetchCallback } from "../account";
+import { FederatedKeylessAccount } from "../account/FederatedKeylessAccount";
+import { AccountAddressInput, ZeroKnowledgeSig } from "../core";
+import {
+  deriveKeylessAccount,
+  getPepper,
+  getProof,
+  updateFederatedKeylessJwkSetTransaction,
+} from "../internal/keyless";
+import { SimpleTransaction } from "../transactions";
 import { HexInput } from "../types";
 import { AptosConfig } from "./aptosConfig";
 
@@ -52,12 +59,30 @@ export class Keyless {
     return getProof({ aptosConfig: this.config, ...args });
   }
 
+  async deriveKeylessAccount(args: {
+    jwt: string;
+    ephemeralKeyPair: EphemeralKeyPair;
+    uidKey?: string;
+    pepper?: HexInput;
+    proofFetchCallback?: ProofFetchCallback;
+  }): Promise<KeylessAccount>;
+
+  async deriveKeylessAccount(args: {
+    jwt: string;
+    ephemeralKeyPair: EphemeralKeyPair;
+    jwkAddress: AccountAddressInput;
+    uidKey?: string;
+    pepper?: HexInput;
+    proofFetchCallback?: ProofFetchCallback;
+  }): Promise<FederatedKeylessAccount>;
+
   /**
    * Derives the Keyless Account from the JWT token and corresponding EphemeralKeyPair.  It will lookup the pepper from
    * the pepper service if not explicitly provided.  It will compute the proof via the proving service.  It will ch
    *
    * @param args.jwt JWT token
    * @param args.ephemeralKeyPair the EphemeralKeyPair used to generate the nonce in the JWT token
+   * @param args.jwkAddress the where the JWKs used to verify signatures are found.  Setting the value derives a FederatedKeylessAccount
    * @param args.uidKey a key in the JWT token to use to set the uidVal in the IdCommitment
    * @param args.pepper the pepper
    * @param args.proofFetchCallback a callback function that if set, the fetch of the proof will be done in the background. Once
@@ -69,10 +94,31 @@ export class Keyless {
   async deriveKeylessAccount(args: {
     jwt: string;
     ephemeralKeyPair: EphemeralKeyPair;
+    jwkAddress?: AccountAddressInput;
     uidKey?: string;
     pepper?: HexInput;
     proofFetchCallback?: ProofFetchCallback;
-  }): Promise<KeylessAccount> {
+  }): Promise<KeylessAccount | FederatedKeylessAccount> {
     return deriveKeylessAccount({ aptosConfig: this.config, ...args });
   }
+
+  /**
+   * This installs a set of FederatedJWKs at an address for a given iss.
+   *
+   * It will fetch the JWK set from the well-known endpoint and update the FederatedJWKs at the sender's address
+   * to reflect it.
+   *
+   * @param args.sender The account that will install the JWKs
+   * @param args.iss the iss claim of the federated OIDC provider.
+   * @param args.jwksUrl the URL to find the corresponding JWKs. For supported IDP providers this parameter in not necessary.
+   *
+   * @returns The pending transaction that results from submission.
+   */
+  async updateFederatedKeylessJwkSetTransaction(args: {
+    sender: Account;
+    iss: string;
+    jwksUrl?: string;
+  }): Promise<SimpleTransaction> {
+    return updateFederatedKeylessJwkSetTransaction({ aptosConfig: this.config, ...args });
+  }
 }

package/src/bcs/serializable/moveStructs.ts

@@ -67,13 +67,12 @@ export class MoveVector<T extends Serializable & EntryFunctionArgument>
    * @param serializer
    */
   serializeForScriptFunction(serializer: Serializer): void {
-    // runtime check to ensure that you can't serialize anything other than vector<u8>
-    const isU8 = this.values[0] instanceof U8;
-    // if the inner array is length 0, we can't check the type because it has no instance, so we assume it's a u8
-    // it may not be, but we don't care because regardless of a vector's type,
-    // a zero-length vector is serialized to a single byte value: 0
-    if (!isU8 && this.values[0] !== undefined) {
-      throw new Error("Script function arguments only accept u8 vectors");
+    // This checks if the type of a non-empty vector is of type other than U8.  If so, we use the Serialized
+    // transaction argument type to serialize the argument.
+    if (this.values[0] !== undefined && !(this.values[0] instanceof U8)) {
+      const serialized = new Serialized(this.bcsToBytes());
+      serialized.serializeForScriptFunction(serializer);
+      return;
     }
     serializer.serializeU32AsUleb128(ScriptTransactionArgumentVariants.U8Vector);
     serializer.serialize(this);
@@ -225,6 +224,39 @@ export class MoveVector<T extends Serializable & EntryFunctionArgument>
   }
 }
 
+export class Serialized extends Serializable implements TransactionArgument {
+  public readonly value: Uint8Array;
+
+  constructor(value: HexInput) {
+    super();
+    this.value = Hex.fromHexInput(value).toUint8Array();
+  }
+
+  serialize(serializer: Serializer): void {
+    serializer.serializeBytes(this.value);
+  }
+
+  serializeForEntryFunction(serializer: Serializer): void {
+    this.serialize(serializer);
+  }
+
+  serializeForScriptFunction(serializer: Serializer): void {
+    serializer.serializeU32AsUleb128(ScriptTransactionArgumentVariants.Serialized);
+    this.serialize(serializer);
+  }
+
+  static deserialize(deserializer: Deserializer): Serialized {
+    return new Serialized(deserializer.deserializeBytes());
+  }
+
+  toMoveVector<T extends Serializable & EntryFunctionArgument>(cls: Deserializable<T>): MoveVector<T> {
+    const deserializer = new Deserializer(this.bcsToBytes());
+    deserializer.deserializeUleb128AsU32();
+    const vec = deserializer.deserializeVector(cls);
+    return new MoveVector(vec);
+  }
+}
+
 export class MoveString extends Serializable implements TransactionArgument {
   public value: string;
 
@@ -244,7 +276,8 @@ export class MoveString extends Serializable implements TransactionArgument {
 
   serializeForScriptFunction(serializer: Serializer): void {
     // Serialize the string as a fixed byte string, i.e., without the length prefix
-    const fixedStringBytes = this.bcsToBytes().slice(1);
+    const textEncoder = new TextEncoder();
+    const fixedStringBytes = textEncoder.encode(this.value);
     // Put those bytes into a vector<u8> and serialize it as a script function argument
     const vectorU8 = MoveVector.U8(fixedStringBytes);
     vectorU8.serializeForScriptFunction(serializer);

package/src/cli/move.ts

@@ -425,7 +425,7 @@ export class Move {
    */
   // eslint-disable-next-line class-methods-use-this
   private extractAddressFromOutput(output: string): string {
-    const match = output.match("Code was successfully deployed to object address (0x[0-9a-fA-F]+)\\.");
+    const match = output.match("Code was successfully deployed to object address (0x[0-9a-fA-F]+)");
     if (match) {
       return match[1];
     }

package/src/core/crypto/federatedKeyless.ts

@@ -0,0 +1,134 @@
+// Copyright © Aptos Foundation
+// SPDX-License-Identifier: Apache-2.0
+
+import { AccountPublicKey, PublicKey } from "./publicKey";
+import { Deserializer, Serializer } from "../../bcs";
+import { Hex } from "../hex";
+import { HexInput, AnyPublicKeyVariant, SigningScheme } from "../../types";
+import { AuthenticationKey } from "../authenticationKey";
+import { AccountAddress, AccountAddressInput } from "../accountAddress";
+import { KeylessPublicKey, KeylessSignature } from "./keyless";
+
+/**
+ * Represents the FederatedKeylessPublicKey public key
+ *
+ * These keys use an onchain address as a source of truth for the JWK used to verify signatures.
+ *
+ * FederatedKeylessPublicKey authentication key is represented in the SDK as `AnyPublicKey`.
+ */
+export class FederatedKeylessPublicKey extends AccountPublicKey {
+  /**
+   * The address that contains the JWK set to be used for verification.
+   */
+  readonly jwkAddress: AccountAddress;
+
+  /**
+   * The inner public key which contains the standard Keyless public key.
+   */
+  readonly keylessPublicKey: KeylessPublicKey;
+
+  constructor(jwkAddress: AccountAddressInput, keylessPublicKey: KeylessPublicKey) {
+    super();
+    this.jwkAddress = AccountAddress.from(jwkAddress);
+    this.keylessPublicKey = keylessPublicKey;
+  }
+
+  /**
+   * Get the authentication key for the federated keyless public key
+   *
+   * @returns AuthenticationKey
+   */
+  authKey(): AuthenticationKey {
+    const serializer = new Serializer();
+    serializer.serializeU32AsUleb128(AnyPublicKeyVariant.FederatedKeyless);
+    serializer.serializeFixedBytes(this.bcsToBytes());
+    return AuthenticationKey.fromSchemeAndBytes({
+      scheme: SigningScheme.SingleKey,
+      input: serializer.toUint8Array(),
+    });
+  }
+
+  /**
+   * Get the public key in bytes (Uint8Array).
+   *
+   * @returns Uint8Array representation of the public key
+   */
+  toUint8Array(): Uint8Array {
+    return this.bcsToBytes();
+  }
+
+  /**
+   * Get the public key as a hex string with the 0x prefix.
+   *
+   * @returns string representation of the public key
+   */
+  toString(): string {
+    return Hex.fromHexInput(this.toUint8Array()).toString();
+  }
+
+  /**
+   * Verifies a signed data with a public key
+   *
+   * @param args.message message
+   * @param args.signature The signature
+   * @returns true if the signature is valid
+   */
+  // eslint-disable-next-line @typescript-eslint/no-unused-vars, class-methods-use-this
+  verifySignature(args: { message: HexInput; signature: KeylessSignature }): boolean {
+    throw new Error("Not yet implemented");
+  }
+
+  serialize(serializer: Serializer): void {
+    this.jwkAddress.serialize(serializer);
+    this.keylessPublicKey.serialize(serializer);
+  }
+
+  static deserialize(deserializer: Deserializer): FederatedKeylessPublicKey {
+    const jwkAddress = AccountAddress.deserialize(deserializer);
+    const keylessPublicKey = KeylessPublicKey.deserialize(deserializer);
+    return new FederatedKeylessPublicKey(jwkAddress, keylessPublicKey);
+  }
+
+  static isPublicKey(publicKey: PublicKey): publicKey is FederatedKeylessPublicKey {
+    return publicKey instanceof FederatedKeylessPublicKey;
+  }
+
+  /**
+   * Creates a FederatedKeylessPublicKey from the JWT components plus pepper
+   *
+   * @param args.iss the iss of the identity
+   * @param args.uidKey the key to use to get the uidVal in the JWT token
+   * @param args.uidVal the value of the uidKey in the JWT token
+   * @param args.aud the client ID of the application
+   * @param args.pepper The pepper used to maintain privacy of the account
+   * @returns FederatedKeylessPublicKey
+   */
+  static create(args: {
+    iss: string;
+    uidKey: string;
+    uidVal: string;
+    aud: string;
+    pepper: HexInput;
+    jwkAddress: AccountAddressInput;
+  }): FederatedKeylessPublicKey {
+    return new FederatedKeylessPublicKey(args.jwkAddress, KeylessPublicKey.create(args));
+  }
+
+  static fromJwtAndPepper(args: {
+    jwt: string;
+    pepper: HexInput;
+    jwkAddress: AccountAddressInput;
+    uidKey?: string;
+  }): FederatedKeylessPublicKey {
+    return new FederatedKeylessPublicKey(args.jwkAddress, KeylessPublicKey.fromJwtAndPepper(args));
+  }
+
+  static isInstance(publicKey: PublicKey) {
+    return (
+      "jwkAddress" in publicKey &&
+      publicKey.jwkAddress instanceof AccountAddress &&
+      "keylessPublicKey" in publicKey &&
+      publicKey.keylessPublicKey instanceof KeylessPublicKey
+    );
+  }
+}

package/src/core/crypto/index.ts

@@ -6,6 +6,7 @@ export * from "./hdKey";
 export * from "./multiEd25519";
 export * from "./multiKey";
 export * from "./ephemeral";
+export * from "./federatedKeyless";
 export * from "./keyless";
 export * from "./privateKey";
 export * from "./publicKey";

package/src/core/crypto/singleKey.ts

@@ -6,6 +6,7 @@ import { AccountPublicKey, PublicKey, VerifySignatureArgs } from "./publicKey";
 import { Secp256k1PublicKey, Secp256k1Signature } from "./secp256k1";
 import { KeylessPublicKey, KeylessSignature } from "./keyless";
 import { Signature } from "./signature";
+import { FederatedKeylessPublicKey } from "./federatedKeyless";
 
 /**
  * Represents any public key supported by Aptos.
@@ -37,6 +38,8 @@ export class AnyPublicKey extends AccountPublicKey {
       this.variant = AnyPublicKeyVariant.Secp256k1;
     } else if (publicKey instanceof KeylessPublicKey) {
       this.variant = AnyPublicKeyVariant.Keyless;
+    } else if (publicKey instanceof FederatedKeylessPublicKey) {
+      this.variant = AnyPublicKeyVariant.FederatedKeyless;
     } else {
       throw new Error("Unsupported public key type");
     }
@@ -91,6 +94,9 @@ export class AnyPublicKey extends AccountPublicKey {
       case AnyPublicKeyVariant.Keyless:
         publicKey = KeylessPublicKey.deserialize(deserializer);
         break;
+      case AnyPublicKeyVariant.FederatedKeyless:
+        publicKey = FederatedKeylessPublicKey.deserialize(deserializer);
+        break;
       default:
         throw new Error(`Unknown variant index for AnyPublicKey: ${variantIndex}`);
     }

package/src/internal/account.ts

@@ -409,26 +409,27 @@ export async function getAccountCoinAmount(args: {
   faMetadataAddress?: AccountAddressInput;
 }): Promise<number> {
   const { aptosConfig, accountAddress, coinType, faMetadataAddress } = args;
-  let coinAssetType: string | undefined;
+
+  let coinAssetType: string | undefined = coinType;
   let faAddress: string;
 
   if (coinType !== undefined && faMetadataAddress !== undefined) {
     faAddress = AccountAddress.from(faMetadataAddress).toStringLong();
   } else if (coinType !== undefined && faMetadataAddress === undefined) {
-    coinAssetType = coinType;
     // TODO Move to a separate function as defined in the AIP for coin migration
-    if (args.coinType === APTOS_COIN) {
+    if (coinType === APTOS_COIN) {
       faAddress = AccountAddress.A.toStringLong();
     } else {
       faAddress = createObjectAddress(AccountAddress.A, coinType).toStringLong();
     }
   } else if (coinType === undefined && faMetadataAddress !== undefined) {
-    // TODO: add a view function lookup for non-APT migrated coins
     const addr = AccountAddress.from(faMetadataAddress);
     faAddress = addr.toStringLong();
     if (addr === AccountAddress.A) {
       coinAssetType = APTOS_COIN;
     }
+    // The paired CoinType should be populated outside of this function in another
+    // async call. We cannot do this internally due to dependency cycles issue.
   } else {
     throw new Error("Either coinType, fungibleAssetAddress, or both must be provided");
   }
@@ -436,7 +437,7 @@ export async function getAccountCoinAmount(args: {
 
   // Search by fungible asset address, unless it has a coin it migrated from
   let where: any = { asset_type: { _eq: faAddress } };
-  if (coinType !== undefined) {
+  if (coinAssetType !== undefined) {
     where = { asset_type: { _in: [coinAssetType, faAddress] } };
   }
 

package/src/internal/event.ts

@@ -31,9 +31,16 @@ export async function getModuleEventsByEventType(args: {
   const { aptosConfig, eventType, options } = args;
 
   const whereCondition: EventsBoolExp = {
-    account_address: { _eq: "0x0000000000000000000000000000000000000000000000000000000000000000" },
-    creation_number: { _eq: "0" },
-    sequence_number: { _eq: "0" },
+    _or: [
+      // EventHandle events
+      { account_address: { _eq: eventType.split("::")[0] } },
+      // Module events
+      {
+        account_address: { _eq: "0x0000000000000000000000000000000000000000000000000000000000000000" },
+        sequence_number: { _eq: 0 },
+        creation_number: { _eq: 0 },
+      },
+    ],
     indexed_type: { _eq: eventType },
   };
 

package/src/internal/keyless.ts

@@ -7,9 +7,11 @@
  * other namespaces and processes can access these methods without depending on the entire
  * keyless namespace and without having a dependency cycle error.
  */
+import { jwtDecode, JwtPayload } from "jwt-decode";
 import { AptosConfig } from "../api/aptosConfig";
 import { postAptosPepperService, postAptosProvingService } from "../client";
 import {
+  AccountAddressInput,
   EphemeralSignature,
   Groth16Zkp,
   Hex,
@@ -19,10 +21,14 @@ import {
   getKeylessConfig,
 } from "../core";
 import { HexInput, ZkpVariant } from "../types";
-import { EphemeralKeyPair, KeylessAccount, ProofFetchCallback } from "../account";
+import { Account, EphemeralKeyPair, KeylessAccount, ProofFetchCallback } from "../account";
 import { PepperFetchRequest, PepperFetchResponse, ProverRequest, ProverResponse } from "../types/keyless";
-import { nowInSeconds } from "../utils/helpers";
 import { lookupOriginalAccountAddress } from "./account";
+import { FederatedKeylessPublicKey } from "../core/crypto/federatedKeyless";
+import { FederatedKeylessAccount } from "../account/FederatedKeylessAccount";
+import { MoveVector } from "../bcs";
+import { generateTransaction } from "./transactionSubmission";
+import { SimpleTransaction } from "../transactions";
 
 export async function getPepper(args: {
   aptosConfig: AptosConfig;
@@ -63,7 +69,7 @@ export async function getProof(args: {
     throw new Error(`Pepper needs to be ${KeylessAccount.PEPPER_LENGTH} bytes`);
   }
   const { maxExpHorizonSecs } = await getKeylessConfig({ aptosConfig });
-  if (maxExpHorizonSecs < ephemeralKeyPair.expiryDateSecs - nowInSeconds()) {
+  if (maxExpHorizonSecs < ephemeralKeyPair.expiryDateSecs - jwtDecode<JwtPayload>(jwt).iat!) {
     throw Error(`The EphemeralKeyPair is too long lived.  It's lifespan must be less than ${maxExpHorizonSecs}`);
   }
   const json = {
@@ -76,6 +82,8 @@ export async function getProof(args: {
     uid_key: uidKey,
   };
 
+  console.log(JSON.stringify(json))
+
   const { data } = await postAptosProvingService<ProverRequest, ProverResponse>({
     aptosConfig,
     path: "prove",
@@ -84,6 +92,8 @@ export async function getProof(args: {
     overrides: { WITH_CREDENTIALS: false },
   });
 
+  console.log(JSON.stringify(data))
+
   const proofPoints = data.proof;
   const groth16Zkp = new Groth16Zkp({
     a: proofPoints.a,
@@ -106,8 +116,28 @@ export async function deriveKeylessAccount(args: {
   uidKey?: string;
   pepper?: HexInput;
   proofFetchCallback?: ProofFetchCallback;
-}): Promise<KeylessAccount> {
-  const { aptosConfig, jwt, uidKey, proofFetchCallback, pepper = await getPepper(args) } = args;
+}): Promise<KeylessAccount>;
+
+export async function deriveKeylessAccount(args: {
+  aptosConfig: AptosConfig;
+  jwt: string;
+  ephemeralKeyPair: EphemeralKeyPair;
+  jwkAddress: AccountAddressInput;
+  uidKey?: string;
+  pepper?: HexInput;
+  proofFetchCallback?: ProofFetchCallback;
+}): Promise<FederatedKeylessAccount>;
+
+export async function deriveKeylessAccount(args: {
+  aptosConfig: AptosConfig;
+  jwt: string;
+  ephemeralKeyPair: EphemeralKeyPair;
+  jwkAddress?: AccountAddressInput;
+  uidKey?: string;
+  pepper?: HexInput;
+  proofFetchCallback?: ProofFetchCallback;
+}): Promise<KeylessAccount | FederatedKeylessAccount> {
+  const { aptosConfig, jwt, jwkAddress, uidKey, proofFetchCallback, pepper = await getPepper(args) } = args;
   const proofPromise = getProof({ ...args, pepper });
   // If a callback is provided, pass in the proof as a promise to KeylessAccount.create.  This will make the proof be fetched in the
   // background and the callback will handle the outcome of the fetch.  This allows the developer to not have to block on the proof fetch
@@ -116,14 +146,62 @@ export async function deriveKeylessAccount(args: {
   // If no callback is provided, the just await the proof fetch and continue syncronously.
   const proof = proofFetchCallback ? proofPromise : await proofPromise;
 
-  // Look up the original address to handle key rotations
+  // Look up the original address to handle key rotations and then instantiate the account.
+  if (jwkAddress !== undefined) {
+    const publicKey = FederatedKeylessPublicKey.fromJwtAndPepper({ jwt, pepper, jwkAddress, uidKey });
+    const address = await lookupOriginalAccountAddress({
+      aptosConfig,
+      authenticationKey: publicKey.authKey().derivedAddress(),
+    });
+
+    return FederatedKeylessAccount.create({ ...args, address, proof, pepper, proofFetchCallback, jwkAddress });
+  }
+
   const publicKey = KeylessPublicKey.fromJwtAndPepper({ jwt, pepper, uidKey });
   const address = await lookupOriginalAccountAddress({
     aptosConfig,
     authenticationKey: publicKey.authKey().derivedAddress(),
   });
+  return KeylessAccount.create({ ...args, address, proof, pepper, proofFetchCallback });
+}
 
-  const keylessAccount = KeylessAccount.create({ ...args, address, proof, pepper, proofFetchCallback });
+interface JWK {
+  kty: string; // Key type
+  kid: string; // Key ID
+  alg: string; // Algorithm used with the key
+  n: string; // Modulus (for RSA keys)
+  e: string; // Exponent (for RSA keys)
+}
+
+interface JWKS {
+  keys: JWK[];
+}
 
-  return keylessAccount;
+export async function updateFederatedKeylessJwkSetTransaction(args: {
+  aptosConfig: AptosConfig;
+  sender: Account;
+  iss: string;
+  jwksUrl?: string;
+}): Promise<SimpleTransaction> {
+  const { aptosConfig, sender, iss } = args;
+  const jwksUrl = args.jwksUrl ?? (iss.endsWith("/") ? `${iss}.well-known/jwks.json` : `${iss}/.well-known/jwks.json`);
+  const response = await fetch(jwksUrl);
+  if (!response.ok) {
+    throw new Error(`Failed to fetch JWKS: ${response.status} ${response.statusText}`);
+  }
+  const jwks: JWKS = await response.json();
+  return generateTransaction({
+    aptosConfig,
+    sender: sender.accountAddress,
+    data: {
+      function: "0x1::jwks::update_federated_jwk_set",
+      functionArguments: [
+        iss,
+        MoveVector.MoveString(jwks.keys.map((key) => key.kid)),
+        MoveVector.MoveString(jwks.keys.map((key) => key.alg)),
+        MoveVector.MoveString(jwks.keys.map((key) => key.e)),
+        MoveVector.MoveString(jwks.keys.map((key) => key.n)),
+      ],
+    },
+  });
 }

package/src/internal/transactionSubmission.ts

@@ -8,7 +8,7 @@
 import { AptosConfig } from "../api/aptosConfig";
 import { MoveVector, U8 } from "../bcs";
 import { postAptosFullNode } from "../client";
-import { Account, KeylessAccount, MultiKeyAccount } from "../account";
+import { Account, KeylessAccountCommon, MultiKeyAccount } from "../account";
 import { AccountAddress, AccountAddressInput } from "../core/accountAddress";
 import { PrivateKey } from "../core/crypto";
 import { AccountAuthenticator } from "../transactions/authenticator/account";
@@ -277,7 +277,7 @@ export async function signAndSubmitTransaction(args: {
   const { aptosConfig, signer, transaction } = args;
   // If the signer contains a KeylessAccount, await proof fetching in case the proof
   // was fetched asyncronously.
-  if (signer instanceof KeylessAccount || signer instanceof MultiKeyAccount) {
+  if (signer instanceof KeylessAccountCommon || signer instanceof MultiKeyAccount) {
     await signer.waitForProofFetch();
   }
   const authenticator = signTransaction({ signer, transaction });

package/src/transactions/instances/transactionPayload.ts

@@ -7,7 +7,7 @@ import { Deserializer } from "../../bcs/deserializer";
 import { Serializable, Serializer } from "../../bcs/serializer";
 import { EntryFunctionBytes } from "../../bcs/serializable/entryFunctionBytes";
 import { Bool, U128, U16, U256, U32, U64, U8 } from "../../bcs/serializable/movePrimitives";
-import { MoveVector } from "../../bcs/serializable/moveStructs";
+import { MoveVector, Serialized } from "../../bcs/serializable/moveStructs";
 import { AccountAddress } from "../../core";
 import { Identifier } from "./identifier";
 import { ModuleId } from "./moduleId";
@@ -40,6 +40,8 @@ export function deserializeFromScriptArgument(deserializer: Deserializer): Trans
       return U32.deserialize(deserializer);
     case ScriptTransactionArgumentVariants.U256:
       return U256.deserialize(deserializer);
+    case ScriptTransactionArgumentVariants.Serialized:
+      return Serialized.deserialize(deserializer);
     default:
       throw new Error(`Unknown variant index for ScriptTransactionArgument: ${index}`);
   }