@aptos-labs/ts-sdk 1.33.2 → 1.35.0-zeta.0

package/dist/esm/chunk-46VPRC7E.mjs

@@ -0,0 +1,407 @@
+import {
+  deriveTransactionType,
+  generateSigningMessage
+} from "./chunk-JOVCSFQC.mjs";
+import {
+  AccountAuthenticatorSingleKey
+} from "./chunk-AGKEC2IM.mjs";
+import {
+  EphemeralKeyPair
+} from "./chunk-XIBOO3WF.mjs";
+import {
+  AnyPublicKey,
+  AnySignature
+} from "./chunk-IPUAVRGL.mjs";
+import {
+  FederatedKeylessPublicKey
+} from "./chunk-6SNGKTWE.mjs";
+import {
+  EphemeralCertificate,
+  KeylessPublicKey,
+  KeylessSignature,
+  ZeroKnowledgeSig,
+  getKeylessConfig,
+  getKeylessJWKs
+} from "./chunk-T573PCIR.mjs";
+import {
+  KeylessError
+} from "./chunk-32UQAST6.mjs";
+import {
+  base64UrlDecode
+} from "./chunk-RQS33JAS.mjs";
+import {
+  AccountAddress
+} from "./chunk-CXLXUSCG.mjs";
+import {
+  Serializable
+} from "./chunk-C7T6GW5P.mjs";
+import {
+  Hex
+} from "./chunk-BDM6FBUO.mjs";
+
+// src/account/AbstractKeylessAccount.ts
+import EventEmitter from "eventemitter3";
+import { jwtDecode } from "jwt-decode";
+function isKeylessSigner(obj) {
+  return obj !== null && obj !== void 0 && typeof obj.checkKeylessAccountValidity === "function";
+}
+var _AbstractKeylessAccount = class _AbstractKeylessAccount extends Serializable {
+  /**
+   * Use the static generator `create(...)` instead.
+   * Creates an instance of the KeylessAccount with an optional proof.
+   *
+   * @param args - The parameters for creating a KeylessAccount.
+   * @param args.address - Optional account address associated with the KeylessAccount.
+   * @param args.publicKey - A KeylessPublicKey or FederatedKeylessPublicKey.
+   * @param args.ephemeralKeyPair - The ephemeral key pair used in the account creation.
+   * @param args.iss - A JWT issuer.
+   * @param args.uidKey - The claim on the JWT to identify a user.  This is typically 'sub' or 'email'.
+   * @param args.uidVal - The unique id for this user, intended to be a stable user identifier.
+   * @param args.aud - The value of the 'aud' claim on the JWT, also known as client ID.  This is the identifier for the dApp's
+   * OIDC registration with the identity provider.
+   * @param args.pepper - A hexadecimal input used for additional security.
+   * @param args.proof - A Zero Knowledge Signature or a promise that resolves to one.
+   * @param args.proofFetchCallback - Optional callback function for fetching proof.
+   * @param args.jwt - A JSON Web Token used for authentication.
+   * @param args.verificationKeyHash Optional 32-byte verification key hash as hex input used to check proof validity.
+   */
+  constructor(args) {
+    super();
+    /**
+     * Signing scheme used to sign transactions
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    this.signingScheme = 2 /* SingleKey */;
+    const {
+      address,
+      ephemeralKeyPair,
+      publicKey,
+      uidKey,
+      uidVal,
+      aud,
+      pepper,
+      proof,
+      proofFetchCallback,
+      jwt,
+      verificationKeyHash
+    } = args;
+    this.ephemeralKeyPair = ephemeralKeyPair;
+    this.publicKey = publicKey;
+    this.accountAddress = address ? AccountAddress.from(address) : this.publicKey.authKey().derivedAddress();
+    this.uidKey = uidKey;
+    this.uidVal = uidVal;
+    this.aud = aud;
+    this.jwt = jwt;
+    this.emitter = new EventEmitter();
+    this.proofOrPromise = proof;
+    if (proof instanceof ZeroKnowledgeSig) {
+      this.proof = proof;
+    } else {
+      if (proofFetchCallback === void 0) {
+        throw new Error("Must provide callback for async proof fetch");
+      }
+      this.emitter.on("proofFetchFinish", async (status) => {
+        await proofFetchCallback(status);
+        this.emitter.removeAllListeners();
+      });
+      this.init(proof);
+    }
+    const pepperBytes = Hex.fromHexInput(pepper).toUint8Array();
+    if (pepperBytes.length !== _AbstractKeylessAccount.PEPPER_LENGTH) {
+      throw new Error(`Pepper length in bytes should be ${_AbstractKeylessAccount.PEPPER_LENGTH}`);
+    }
+    this.pepper = pepperBytes;
+    if (verificationKeyHash !== void 0) {
+      if (Hex.hexInputToUint8Array(verificationKeyHash).length !== 32) {
+        throw new Error("verificationKeyHash must be 32 bytes");
+      }
+      this.verificationKeyHash = Hex.hexInputToUint8Array(verificationKeyHash);
+    }
+  }
+  getAnyPublicKey() {
+    return new AnyPublicKey(this.publicKey);
+  }
+  /**
+   * This initializes the asynchronous proof fetch
+   * @return Emits whether the proof succeeds or fails, but has no return.
+   * @group Implementation
+   * @category Account (On-Chain Model)
+   */
+  async init(promise) {
+    try {
+      this.proof = await promise;
+      this.emitter.emit("proofFetchFinish", { status: "Success" });
+    } catch (error) {
+      if (error instanceof Error) {
+        this.emitter.emit("proofFetchFinish", { status: "Failed", error: error.toString() });
+      } else {
+        this.emitter.emit("proofFetchFinish", { status: "Failed", error: "Unknown" });
+      }
+    }
+  }
+  /**
+   * Serializes the jwt data into a format suitable for transmission or storage.
+   * This function ensures that both the jwt data and the proof are properly serialized.
+   *
+   * @param serializer - The serializer instance used to convert the jwt data into bytes.
+   */
+  serialize(serializer) {
+    this.accountAddress.serialize(serializer);
+    serializer.serializeStr(this.jwt);
+    serializer.serializeStr(this.uidKey);
+    serializer.serializeFixedBytes(this.pepper);
+    this.ephemeralKeyPair.serialize(serializer);
+    if (this.proof === void 0) {
+      throw new Error("Cannot serialize - proof undefined");
+    }
+    this.proof.serialize(serializer);
+    serializer.serializeOption(this.verificationKeyHash, 32);
+  }
+  static partialDeserialize(deserializer) {
+    const address = AccountAddress.deserialize(deserializer);
+    const jwt = deserializer.deserializeStr();
+    const uidKey = deserializer.deserializeStr();
+    const pepper = deserializer.deserializeFixedBytes(31);
+    const ephemeralKeyPair = EphemeralKeyPair.deserialize(deserializer);
+    const proof = ZeroKnowledgeSig.deserialize(deserializer);
+    const verificationKeyHash = deserializer.deserializeOption("fixedBytes", 32);
+    return { address, jwt, uidKey, pepper, ephemeralKeyPair, proof, verificationKeyHash };
+  }
+  /**
+   * Checks if the proof is expired.  If so the account must be re-derived with a new EphemeralKeyPair
+   * and JWT token.
+   * @return boolean
+   * @group Implementation
+   * @category Account (On-Chain Model)
+   */
+  isExpired() {
+    return this.ephemeralKeyPair.isExpired();
+  }
+  /**
+   * Sign a message using Keyless.
+   * @param message the message to sign, as binary input
+   * @return the AccountAuthenticator containing the signature, together with the account's public key
+   * @group Implementation
+   * @category Account (On-Chain Model)
+   */
+  signWithAuthenticator(message) {
+    const signature = new AnySignature(this.sign(message));
+    const publicKey = new AnyPublicKey(this.publicKey);
+    return new AccountAuthenticatorSingleKey(publicKey, signature);
+  }
+  /**
+   * Sign a transaction using Keyless.
+   * @param transaction the raw transaction
+   * @return the AccountAuthenticator containing the signature of the transaction, together with the account's public key
+   * @group Implementation
+   * @category Account (On-Chain Model)
+   */
+  signTransactionWithAuthenticator(transaction) {
+    const signature = new AnySignature(this.signTransaction(transaction));
+    const publicKey = new AnyPublicKey(this.publicKey);
+    return new AccountAuthenticatorSingleKey(publicKey, signature);
+  }
+  /**
+   * Waits for asynchronous proof fetching to finish.
+   * @return
+   * @group Implementation
+   * @category Account (On-Chain Model)
+   */
+  async waitForProofFetch() {
+    if (this.proofOrPromise instanceof Promise) {
+      await this.proofOrPromise;
+    }
+  }
+  /**
+   * Validates that the Keyless Account can be used to sign transactions.
+   * @return
+   */
+  async checkKeylessAccountValidity(aptosConfig) {
+    if (this.isExpired()) {
+      throw KeylessError.fromErrorType({
+        type: 0 /* EPHEMERAL_KEY_PAIR_EXPIRED */
+      });
+    }
+    await this.waitForProofFetch();
+    if (this.proof === void 0) {
+      throw KeylessError.fromErrorType({
+        type: 2 /* ASYNC_PROOF_FETCH_FAILED */
+      });
+    }
+    const header = jwtDecode(this.jwt, { header: true });
+    if (header.kid === void 0) {
+      throw KeylessError.fromErrorType({
+        type: 12 /* JWT_PARSING_ERROR */,
+        details: "checkKeylessAccountValidity failed. JWT is missing 'kid' in header. This should never happen."
+      });
+    }
+    if (this.verificationKeyHash !== void 0) {
+      const { verificationKey } = await getKeylessConfig({ aptosConfig });
+      if (Hex.hexInputToString(verificationKey.hash()) !== Hex.hexInputToString(this.verificationKeyHash)) {
+        throw KeylessError.fromErrorType({
+          type: 4 /* INVALID_PROOF_VERIFICATION_KEY_NOT_FOUND */
+        });
+      }
+    } else {
+      console.warn(
+        "[Aptos SDK] The verification key hash was not set. Proof may be invalid if the verification key has rotated."
+      );
+    }
+    await _AbstractKeylessAccount.fetchJWK({ aptosConfig, publicKey: this.publicKey, kid: header.kid });
+  }
+  /**
+   * Sign the given message using Keyless.
+   * @param message in HexInput format
+   * @returns Signature
+   * @group Implementation
+   * @category Account (On-Chain Model)
+   */
+  sign(message) {
+    const { expiryDateSecs } = this.ephemeralKeyPair;
+    if (this.isExpired()) {
+      throw KeylessError.fromErrorType({
+        type: 0 /* EPHEMERAL_KEY_PAIR_EXPIRED */
+      });
+    }
+    if (this.proof === void 0) {
+      throw KeylessError.fromErrorType({
+        type: 1 /* PROOF_NOT_FOUND */,
+        details: "Proof not found - make sure to call `await account.checkKeylessAccountValidity()` before signing."
+      });
+    }
+    const ephemeralPublicKey = this.ephemeralKeyPair.getPublicKey();
+    const ephemeralSignature = this.ephemeralKeyPair.sign(message);
+    return new KeylessSignature({
+      jwtHeader: base64UrlDecode(this.jwt.split(".")[0]),
+      ephemeralCertificate: new EphemeralCertificate(this.proof, 0 /* ZkProof */),
+      expiryDateSecs,
+      ephemeralPublicKey,
+      ephemeralSignature
+    });
+  }
+  /**
+   * Sign the given transaction with Keyless.
+   * Signs the transaction and proof to guard against proof malleability.
+   * @param transaction the transaction to be signed
+   * @returns KeylessSignature
+   * @group Implementation
+   * @category Account (On-Chain Model)
+   */
+  signTransaction(transaction) {
+    if (this.proof === void 0) {
+      throw KeylessError.fromErrorType({
+        type: 1 /* PROOF_NOT_FOUND */,
+        details: "Proof not found - make sure to call `await account.checkKeylessAccountValidity()` before signing."
+      });
+    }
+    const raw = deriveTransactionType(transaction);
+    const txnAndProof = new TransactionAndProof(raw, this.proof.proof);
+    const signMess = txnAndProof.hash();
+    return this.sign(signMess);
+  }
+  /**
+   * Note - This function is currently incomplete and should only be used to verify ownership of the KeylessAccount
+   *
+   * Verifies a signature given the message.
+   *
+   * TODO: Groth16 proof verification
+   *
+   * @param args.message the message that was signed.
+   * @param args.signature the KeylessSignature to verify
+   * @returns boolean
+   * @group Implementation
+   * @category Account (On-Chain Model)
+   */
+  verifySignature(args) {
+    const { message, signature } = args;
+    if (this.isExpired()) {
+      return false;
+    }
+    if (!this.ephemeralKeyPair.getPublicKey().verifySignature({ message, signature: signature.ephemeralSignature })) {
+      return false;
+    }
+    return true;
+  }
+  /**
+   * Fetches the JWK from the issuer's well-known JWKS endpoint.
+   *
+   * @param args.publicKey The keyless public key to query
+   * @param args.kid The kid of the JWK to fetch
+   * @returns A JWK matching the `kid` in the JWT header.
+   * @throws {KeylessError} If the JWK cannot be fetched
+   */
+  static async fetchJWK(args) {
+    const { aptosConfig, publicKey, kid } = args;
+    const keylessPubKey = publicKey instanceof KeylessPublicKey ? publicKey : publicKey.keylessPublicKey;
+    const { iss } = keylessPubKey;
+    let allJWKs;
+    const jwkAddr = publicKey instanceof FederatedKeylessPublicKey ? publicKey.jwkAddress : void 0;
+    try {
+      allJWKs = await getKeylessJWKs({ aptosConfig, jwkAddr });
+    } catch (error) {
+      throw KeylessError.fromErrorType({
+        type: 24 /* FULL_NODE_JWKS_LOOKUP_ERROR */,
+        error,
+        details: `Failed to fetch ${jwkAddr ? "Federated" : "Patched"}JWKs ${jwkAddr ? `for address ${jwkAddr}` : "0x1"}`
+      });
+    }
+    const jwksForIssuer = allJWKs.get(iss);
+    if (jwksForIssuer === void 0) {
+      throw KeylessError.fromErrorType({
+        type: 7 /* INVALID_JWT_ISS_NOT_RECOGNIZED */,
+        details: `JWKs for issuer ${iss} not found.`
+      });
+    }
+    const jwk = jwksForIssuer.find((key) => key.kid === kid);
+    if (jwk === void 0) {
+      throw KeylessError.fromErrorType({
+        type: 6 /* INVALID_JWT_JWK_NOT_FOUND */,
+        details: `JWK with kid '${kid}' for issuer '${iss}' not found.`
+      });
+    }
+    return jwk;
+  }
+};
+_AbstractKeylessAccount.PEPPER_LENGTH = 31;
+var AbstractKeylessAccount = _AbstractKeylessAccount;
+var TransactionAndProof = class extends Serializable {
+  constructor(transaction, proof) {
+    super();
+    /**
+     * The domain separator prefix used when hashing.
+     * @group Implementation
+     * @category Account (On-Chain Model)
+     */
+    this.domainSeparator = "APTOS::TransactionAndProof";
+    this.transaction = transaction;
+    this.proof = proof;
+  }
+  /**
+   * Serializes the transaction data into a format suitable for transmission or storage.
+   * This function ensures that both the transaction bytes and the proof are properly serialized.
+   *
+   * @param serializer - The serializer instance used to convert the transaction data into bytes.
+   */
+  serialize(serializer) {
+    serializer.serializeFixedBytes(this.transaction.bcsToBytes());
+    serializer.serializeOption(this.proof);
+  }
+  /**
+   * Hashes the bcs serialized from of the class. This is the typescript corollary to the BCSCryptoHash macro in aptos-core.
+   *
+   * @returns Uint8Array
+   * @group Implementation
+   * @category Account (On-Chain Model)
+   */
+  hash() {
+    return generateSigningMessage(this.bcsToBytes(), this.domainSeparator);
+  }
+};
+
+export {
+  isKeylessSigner,
+  AbstractKeylessAccount,
+  TransactionAndProof
+};
+//# sourceMappingURL=chunk-46VPRC7E.mjs.map

package/dist/esm/{chunk-QQEK7WVP.mjs.map → chunk-46VPRC7E.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../../src/account/AbstractKeylessAccount.ts"],"sourcesContent":["// Copyright © Aptos Foundation\n// SPDX-License-Identifier: Apache-2.0\n\nimport EventEmitter from \"eventemitter3\";\nimport { jwtDecode } from \"jwt-decode\";\nimport { EphemeralCertificateVariant, HexInput, SigningScheme } from \"../types\";\nimport { AccountAddress } from \"../core/accountAddress\";\nimport {\n  AnyPublicKey,\n  AnySignature,\n  KeylessPublicKey,\n  KeylessSignature,\n  EphemeralCertificate,\n  ZeroKnowledgeSig,\n  ZkProof,\n  getKeylessJWKs,\n  MoveJWK,\n  getKeylessConfig,\n} from \"../core/crypto\";\n\nimport { EphemeralKeyPair } from \"./EphemeralKeyPair\";\nimport { Hex } from \"../core/hex\";\nimport { AccountAuthenticatorSingleKey } from \"../transactions/authenticator/account\";\nimport { Deserializer, Serializable, Serializer } from \"../bcs\";\nimport { deriveTransactionType, generateSigningMessage } from \"../transactions/transactionBuilder/signingMessage\";\nimport { AnyRawTransaction, AnyRawTransactionInstance } from \"../transactions/types\";\nimport { base64UrlDecode } from \"../utils/helpers\";\nimport { FederatedKeylessPublicKey } from \"../core/crypto/federatedKeyless\";\nimport { Account } from \"./Account\";\nimport { AptosConfig } from \"../api/aptosConfig\";\nimport { KeylessError, KeylessErrorType } from \"../errors\";\nimport type { SingleKeySigner } from \"./SingleKeyAccount\";\n\n/**\n * An interface which defines if an Account utilizes Keyless signing.\n */\nexport interface KeylessSigner extends Account {\n  checkKeylessAccountValidity(aptosConfig: AptosConfig): Promise<void>;\n}\n\nexport function isKeylessSigner(obj: any): obj is KeylessSigner {\n  return obj !== null && obj !== undefined && typeof obj.checkKeylessAccountValidity === \"function\";\n}\n\n/**\n * Account implementation for the Keyless authentication scheme.  This abstract class is used for standard Keyless Accounts\n * and Federated Keyless Accounts.\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport abstract class AbstractKeylessAccount extends Serializable implements KeylessSigner, SingleKeySigner {\n  static readonly PEPPER_LENGTH: number = 31;\n\n  /**\n   * The KeylessPublicKey associated with the account\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly publicKey: KeylessPublicKey | FederatedKeylessPublicKey;\n\n  /**\n   * The EphemeralKeyPair used to generate sign.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly ephemeralKeyPair: EphemeralKeyPair;\n\n  /**\n   * The claim on the JWT to identify a user.  This is typically 'sub' or 'email'.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly uidKey: string;\n\n  /**\n   * The value of the uidKey claim on the JWT.  This intended to be a stable user identifier.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly uidVal: string;\n\n  /**\n   * The value of the 'aud' claim on the JWT, also known as client ID.  This is the identifier for the dApp's\n   * OIDC registration with the identity provider.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly aud: string;\n\n  /**\n   * A value contains 31 bytes of entropy that preserves privacy of the account. Typically fetched from a pepper provider.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly pepper: Uint8Array;\n\n  /**\n   * Account address associated with the account\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly accountAddress: AccountAddress;\n\n  /**\n   * The zero knowledge signature (if ready) which contains the proof used to validate the EphemeralKeyPair.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  proof: ZeroKnowledgeSig | undefined;\n\n  /**\n   * The proof of the EphemeralKeyPair or a promise that provides the proof.  This is used to allow for awaiting on\n   * fetching the proof.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly proofOrPromise: ZeroKnowledgeSig | Promise<ZeroKnowledgeSig>;\n\n  /**\n   * Signing scheme used to sign transactions\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly signingScheme: SigningScheme = SigningScheme.SingleKey;\n\n  /**\n   * The JWT token used to derive the account\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly jwt: string;\n\n  /**\n   * The hash of the verification key used to verify the proof. This is optional and can be used to check verifying key\n   * rotations which may invalidate the proof.\n   */\n  readonly verificationKeyHash?: Uint8Array;\n\n  /**\n   * An event emitter used to assist in handling asynchronous proof fetching.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  private readonly emitter: EventEmitter<ProofFetchEvents>;\n\n  /**\n   * Use the static generator `create(...)` instead.\n   * Creates an instance of the KeylessAccount with an optional proof.\n   *\n   * @param args - The parameters for creating a KeylessAccount.\n   * @param args.address - Optional account address associated with the KeylessAccount.\n   * @param args.publicKey - A KeylessPublicKey or FederatedKeylessPublicKey.\n   * @param args.ephemeralKeyPair - The ephemeral key pair used in the account creation.\n   * @param args.iss - A JWT issuer.\n   * @param args.uidKey - The claim on the JWT to identify a user.  This is typically 'sub' or 'email'.\n   * @param args.uidVal - The unique id for this user, intended to be a stable user identifier.\n   * @param args.aud - The value of the 'aud' claim on the JWT, also known as client ID.  This is the identifier for the dApp's\n   * OIDC registration with the identity provider.\n   * @param args.pepper - A hexadecimal input used for additional security.\n   * @param args.proof - A Zero Knowledge Signature or a promise that resolves to one.\n   * @param args.proofFetchCallback - Optional callback function for fetching proof.\n   * @param args.jwt - A JSON Web Token used for authentication.\n   * @param args.verificationKeyHash Optional 32-byte verification key hash as hex input used to check proof validity.\n   */\n  protected constructor(args: {\n    address?: AccountAddress;\n    publicKey: KeylessPublicKey | FederatedKeylessPublicKey;\n    ephemeralKeyPair: EphemeralKeyPair;\n    iss: string;\n    uidKey: string;\n    uidVal: string;\n    aud: string;\n    pepper: HexInput;\n    proof: ZeroKnowledgeSig | Promise<ZeroKnowledgeSig>;\n    proofFetchCallback?: ProofFetchCallback;\n    jwt: string;\n    verificationKeyHash?: HexInput;\n  }) {\n    super();\n    const {\n      address,\n      ephemeralKeyPair,\n      publicKey,\n      uidKey,\n      uidVal,\n      aud,\n      pepper,\n      proof,\n      proofFetchCallback,\n      jwt,\n      verificationKeyHash,\n    } = args;\n    this.ephemeralKeyPair = ephemeralKeyPair;\n    this.publicKey = publicKey;\n    this.accountAddress = address ? AccountAddress.from(address) : this.publicKey.authKey().derivedAddress();\n    this.uidKey = uidKey;\n    this.uidVal = uidVal;\n    this.aud = aud;\n    this.jwt = jwt;\n    this.emitter = new EventEmitter<ProofFetchEvents>();\n    this.proofOrPromise = proof;\n    if (proof instanceof ZeroKnowledgeSig) {\n      this.proof = proof;\n    } else {\n      if (proofFetchCallback === undefined) {\n        throw new Error(\"Must provide callback for async proof fetch\");\n      }\n      this.emitter.on(\"proofFetchFinish\", async (status) => {\n        await proofFetchCallback(status);\n        this.emitter.removeAllListeners();\n      });\n      // Note, this is purposely not awaited to be non-blocking.  The caller should await on the proofFetchCallback.\n      this.init(proof);\n    }\n    const pepperBytes = Hex.fromHexInput(pepper).toUint8Array();\n    if (pepperBytes.length !== AbstractKeylessAccount.PEPPER_LENGTH) {\n      throw new Error(`Pepper length in bytes should be ${AbstractKeylessAccount.PEPPER_LENGTH}`);\n    }\n    this.pepper = pepperBytes;\n    if (verificationKeyHash !== undefined) {\n      if (Hex.hexInputToUint8Array(verificationKeyHash).length !== 32) {\n        throw new Error(\"verificationKeyHash must be 32 bytes\");\n      }\n      this.verificationKeyHash = Hex.hexInputToUint8Array(verificationKeyHash);\n    }\n  }\n\n  getAnyPublicKey(): AnyPublicKey {\n    return new AnyPublicKey(this.publicKey);\n  }\n\n  /**\n   * This initializes the asynchronous proof fetch\n   * @return Emits whether the proof succeeds or fails, but has no return.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  async init(promise: Promise<ZeroKnowledgeSig>) {\n    try {\n      this.proof = await promise;\n      this.emitter.emit(\"proofFetchFinish\", { status: \"Success\" });\n    } catch (error) {\n      if (error instanceof Error) {\n        this.emitter.emit(\"proofFetchFinish\", { status: \"Failed\", error: error.toString() });\n      } else {\n        this.emitter.emit(\"proofFetchFinish\", { status: \"Failed\", error: \"Unknown\" });\n      }\n    }\n  }\n\n  /**\n   * Serializes the jwt data into a format suitable for transmission or storage.\n   * This function ensures that both the jwt data and the proof are properly serialized.\n   *\n   * @param serializer - The serializer instance used to convert the jwt data into bytes.\n   */\n  serialize(serializer: Serializer): void {\n    this.accountAddress.serialize(serializer);\n    serializer.serializeStr(this.jwt);\n    serializer.serializeStr(this.uidKey);\n    serializer.serializeFixedBytes(this.pepper);\n    this.ephemeralKeyPair.serialize(serializer);\n    if (this.proof === undefined) {\n      throw new Error(\"Cannot serialize - proof undefined\");\n    }\n    this.proof.serialize(serializer);\n    serializer.serializeOption(this.verificationKeyHash, 32);\n  }\n\n  static partialDeserialize(deserializer: Deserializer): {\n    address: AccountAddress;\n    jwt: string;\n    uidKey: string;\n    pepper: Uint8Array;\n    ephemeralKeyPair: EphemeralKeyPair;\n    proof: ZeroKnowledgeSig;\n    verificationKeyHash?: Uint8Array;\n  } {\n    const address = AccountAddress.deserialize(deserializer);\n    const jwt = deserializer.deserializeStr();\n    const uidKey = deserializer.deserializeStr();\n    const pepper = deserializer.deserializeFixedBytes(31);\n    const ephemeralKeyPair = EphemeralKeyPair.deserialize(deserializer);\n    const proof = ZeroKnowledgeSig.deserialize(deserializer);\n    const verificationKeyHash = deserializer.deserializeOption(\"fixedBytes\", 32);\n\n    return { address, jwt, uidKey, pepper, ephemeralKeyPair, proof, verificationKeyHash };\n  }\n\n  /**\n   * Checks if the proof is expired.  If so the account must be re-derived with a new EphemeralKeyPair\n   * and JWT token.\n   * @return boolean\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  isExpired(): boolean {\n    return this.ephemeralKeyPair.isExpired();\n  }\n\n  /**\n   * Sign a message using Keyless.\n   * @param message the message to sign, as binary input\n   * @return the AccountAuthenticator containing the signature, together with the account's public key\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  signWithAuthenticator(message: HexInput): AccountAuthenticatorSingleKey {\n    const signature = new AnySignature(this.sign(message));\n    const publicKey = new AnyPublicKey(this.publicKey);\n    return new AccountAuthenticatorSingleKey(publicKey, signature);\n  }\n\n  /**\n   * Sign a transaction using Keyless.\n   * @param transaction the raw transaction\n   * @return the AccountAuthenticator containing the signature of the transaction, together with the account's public key\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  signTransactionWithAuthenticator(transaction: AnyRawTransaction): AccountAuthenticatorSingleKey {\n    const signature = new AnySignature(this.signTransaction(transaction));\n    const publicKey = new AnyPublicKey(this.publicKey);\n    return new AccountAuthenticatorSingleKey(publicKey, signature);\n  }\n\n  /**\n   * Waits for asynchronous proof fetching to finish.\n   * @return\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  async waitForProofFetch() {\n    if (this.proofOrPromise instanceof Promise) {\n      await this.proofOrPromise;\n    }\n  }\n\n  /**\n   * Validates that the Keyless Account can be used to sign transactions.\n   * @return\n   */\n  async checkKeylessAccountValidity(aptosConfig: AptosConfig): Promise<void> {\n    if (this.isExpired()) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.EPHEMERAL_KEY_PAIR_EXPIRED,\n      });\n    }\n    await this.waitForProofFetch();\n    if (this.proof === undefined) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.ASYNC_PROOF_FETCH_FAILED,\n      });\n    }\n    const header = jwtDecode(this.jwt, { header: true });\n    if (header.kid === undefined) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.JWT_PARSING_ERROR,\n        details: \"checkKeylessAccountValidity failed. JWT is missing 'kid' in header. This should never happen.\",\n      });\n    }\n    if (this.verificationKeyHash !== undefined) {\n      const { verificationKey } = await getKeylessConfig({ aptosConfig });\n      if (Hex.hexInputToString(verificationKey.hash()) !== Hex.hexInputToString(this.verificationKeyHash)) {\n        throw KeylessError.fromErrorType({\n          type: KeylessErrorType.INVALID_PROOF_VERIFICATION_KEY_NOT_FOUND,\n        });\n      }\n    } else {\n      // eslint-disable-next-line no-console\n      console.warn(\n        \"[Aptos SDK] The verification key hash was not set. Proof may be invalid if the verification key has rotated.\",\n      );\n    }\n    await AbstractKeylessAccount.fetchJWK({ aptosConfig, publicKey: this.publicKey, kid: header.kid });\n  }\n\n  /**\n   * Sign the given message using Keyless.\n   * @param message in HexInput format\n   * @returns Signature\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  sign(message: HexInput): KeylessSignature {\n    const { expiryDateSecs } = this.ephemeralKeyPair;\n    if (this.isExpired()) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.EPHEMERAL_KEY_PAIR_EXPIRED,\n      });\n    }\n    if (this.proof === undefined) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.PROOF_NOT_FOUND,\n        details: \"Proof not found - make sure to call `await account.checkKeylessAccountValidity()` before signing.\",\n      });\n    }\n    const ephemeralPublicKey = this.ephemeralKeyPair.getPublicKey();\n    const ephemeralSignature = this.ephemeralKeyPair.sign(message);\n\n    return new KeylessSignature({\n      jwtHeader: base64UrlDecode(this.jwt.split(\".\")[0]),\n      ephemeralCertificate: new EphemeralCertificate(this.proof, EphemeralCertificateVariant.ZkProof),\n      expiryDateSecs,\n      ephemeralPublicKey,\n      ephemeralSignature,\n    });\n  }\n\n  /**\n   * Sign the given transaction with Keyless.\n   * Signs the transaction and proof to guard against proof malleability.\n   * @param transaction the transaction to be signed\n   * @returns KeylessSignature\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  signTransaction(transaction: AnyRawTransaction): KeylessSignature {\n    if (this.proof === undefined) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.PROOF_NOT_FOUND,\n        details: \"Proof not found - make sure to call `await account.checkKeylessAccountValidity()` before signing.\",\n      });\n    }\n    const raw = deriveTransactionType(transaction);\n    const txnAndProof = new TransactionAndProof(raw, this.proof.proof);\n    const signMess = txnAndProof.hash();\n    return this.sign(signMess);\n  }\n\n  /**\n   * Note - This function is currently incomplete and should only be used to verify ownership of the KeylessAccount\n   *\n   * Verifies a signature given the message.\n   *\n   * TODO: Groth16 proof verification\n   *\n   * @param args.message the message that was signed.\n   * @param args.signature the KeylessSignature to verify\n   * @returns boolean\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  verifySignature(args: { message: HexInput; signature: KeylessSignature }): boolean {\n    const { message, signature } = args;\n    if (this.isExpired()) {\n      return false;\n    }\n    if (!this.ephemeralKeyPair.getPublicKey().verifySignature({ message, signature: signature.ephemeralSignature })) {\n      return false;\n    }\n    return true;\n  }\n\n  /**\n   * Fetches the JWK from the issuer's well-known JWKS endpoint.\n   *\n   * @param args.publicKey The keyless public key to query\n   * @param args.kid The kid of the JWK to fetch\n   * @returns A JWK matching the `kid` in the JWT header.\n   * @throws {KeylessError} If the JWK cannot be fetched\n   */\n  static async fetchJWK(args: {\n    aptosConfig: AptosConfig;\n    publicKey: KeylessPublicKey | FederatedKeylessPublicKey;\n    kid: string;\n  }): Promise<MoveJWK> {\n    const { aptosConfig, publicKey, kid } = args;\n    const keylessPubKey = publicKey instanceof KeylessPublicKey ? publicKey : publicKey.keylessPublicKey;\n    const { iss } = keylessPubKey;\n\n    let allJWKs: Map<string, MoveJWK[]>;\n    const jwkAddr = publicKey instanceof FederatedKeylessPublicKey ? publicKey.jwkAddress : undefined;\n    try {\n      allJWKs = await getKeylessJWKs({ aptosConfig, jwkAddr });\n    } catch (error) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.FULL_NODE_JWKS_LOOKUP_ERROR,\n        error,\n        details: `Failed to fetch ${jwkAddr ? \"Federated\" : \"Patched\"}JWKs ${jwkAddr ? `for address ${jwkAddr}` : \"0x1\"}`,\n      });\n    }\n\n    // Find the corresponding JWK set by `iss`\n    const jwksForIssuer = allJWKs.get(iss);\n\n    if (jwksForIssuer === undefined) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.INVALID_JWT_ISS_NOT_RECOGNIZED,\n        details: `JWKs for issuer ${iss} not found.`,\n      });\n    }\n\n    // Find the corresponding JWK by `kid`\n    const jwk = jwksForIssuer.find((key) => key.kid === kid);\n\n    if (jwk === undefined) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.INVALID_JWT_JWK_NOT_FOUND,\n        details: `JWK with kid '${kid}' for issuer '${iss}' not found.`,\n      });\n    }\n\n    return jwk;\n  }\n}\n\n/**\n * A container class to hold a transaction and a proof.  It implements CryptoHashable which is used to create\n * the signing message for Keyless transactions.  We sign over the proof to ensure non-malleability.\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport class TransactionAndProof extends Serializable {\n  /**\n   * The transaction to sign.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  transaction: AnyRawTransactionInstance;\n\n  /**\n   * The zero knowledge proof used in signing the transaction.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  proof?: ZkProof;\n\n  /**\n   * The domain separator prefix used when hashing.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly domainSeparator = \"APTOS::TransactionAndProof\";\n\n  constructor(transaction: AnyRawTransactionInstance, proof?: ZkProof) {\n    super();\n    this.transaction = transaction;\n    this.proof = proof;\n  }\n\n  /**\n   * Serializes the transaction data into a format suitable for transmission or storage.\n   * This function ensures that both the transaction bytes and the proof are properly serialized.\n   *\n   * @param serializer - The serializer instance used to convert the transaction data into bytes.\n   */\n  serialize(serializer: Serializer): void {\n    serializer.serializeFixedBytes(this.transaction.bcsToBytes());\n    serializer.serializeOption(this.proof);\n  }\n\n  /**\n   * Hashes the bcs serialized from of the class. This is the typescript corollary to the BCSCryptoHash macro in aptos-core.\n   *\n   * @returns Uint8Array\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  hash(): Uint8Array {\n    return generateSigningMessage(this.bcsToBytes(), this.domainSeparator);\n  }\n}\n/**\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport type ProofFetchSuccess = {\n  status: \"Success\";\n};\n/**\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport type ProofFetchFailure = {\n  status: \"Failed\";\n  error: string;\n};\n/**\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport type ProofFetchStatus = ProofFetchSuccess | ProofFetchFailure;\n/**\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport type ProofFetchCallback = (status: ProofFetchStatus) => Promise<void>;\n/**\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport interface ProofFetchEvents {\n  proofFetchFinish: (status: ProofFetchStatus) => void;\n}\n"],"mappings":"ofAGA,OAAOA,MAAkB,gBACzB,OAAS,aAAAC,MAAiB,aAoCnB,SAASC,GAAgBC,EAAgC,CAC9D,OAAOA,GAAQ,MAA6B,OAAOA,EAAI,6BAAgC,UACzF,CAQO,IAAeC,EAAf,MAAeA,UAA+BC,CAAuD,CAkHhG,YAAYC,EAanB,CACD,MAAM,EAvDR,KAAS,cAA+B,EAwDtC,GAAM,CACJ,QAAAC,EACA,iBAAAC,EACA,UAAAC,EACA,OAAAC,EACA,OAAAC,EACA,IAAAC,EACA,OAAAC,EACA,MAAAC,EACA,mBAAAC,EACA,IAAAC,EACA,oBAAAC,CACF,EAAIX,EAUJ,GATA,KAAK,iBAAmBE,EACxB,KAAK,UAAYC,EACjB,KAAK,eAAiBF,EAAUW,EAAe,KAAKX,CAAO,EAAI,KAAK,UAAU,QAAQ,EAAE,eAAe,EACvG,KAAK,OAASG,EACd,KAAK,OAASC,EACd,KAAK,IAAMC,EACX,KAAK,IAAMI,EACX,KAAK,QAAU,IAAIG,EACnB,KAAK,eAAiBL,EAClBA,aAAiBM,EACnB,KAAK,MAAQN,MACR,CACL,GAAIC,IAAuB,OACzB,MAAM,IAAI,MAAM,6CAA6C,EAE/D,KAAK,QAAQ,GAAG,mBAAoB,MAAOM,GAAW,CACpD,MAAMN,EAAmBM,CAAM,EAC/B,KAAK,QAAQ,mBAAmB,CAClC,CAAC,EAED,KAAK,KAAKP,CAAK,CACjB,CACA,IAAMQ,EAAcC,EAAI,aAAaV,CAAM,EAAE,aAAa,EAC1D,GAAIS,EAAY,SAAWlB,EAAuB,cAChD,MAAM,IAAI,MAAM,oCAAoCA,EAAuB,aAAa,EAAE,EAG5F,GADA,KAAK,OAASkB,EACVL,IAAwB,OAAW,CACrC,GAAIM,EAAI,qBAAqBN,CAAmB,EAAE,SAAW,GAC3D,MAAM,IAAI,MAAM,sCAAsC,EAExD,KAAK,oBAAsBM,EAAI,qBAAqBN,CAAmB,CACzE,CACF,CAEA,iBAAgC,CAC9B,OAAO,IAAIO,EAAa,KAAK,SAAS,CACxC,CAQA,MAAM,KAAKC,EAAoC,CAC7C,GAAI,CACF,KAAK,MAAQ,MAAMA,EACnB,KAAK,QAAQ,KAAK,mBAAoB,CAAE,OAAQ,SAAU,CAAC,CAC7D,OAASC,EAAO,CACVA,aAAiB,MACnB,KAAK,QAAQ,KAAK,mBAAoB,CAAE,OAAQ,SAAU,MAAOA,EAAM,SAAS,CAAE,CAAC,EAEnF,KAAK,QAAQ,KAAK,mBAAoB,CAAE,OAAQ,SAAU,MAAO,SAAU,CAAC,CAEhF,CACF,CAQA,UAAUC,EAA8B,CAMtC,GALA,KAAK,eAAe,UAAUA,CAAU,EACxCA,EAAW,aAAa,KAAK,GAAG,EAChCA,EAAW,aAAa,KAAK,MAAM,EACnCA,EAAW,oBAAoB,KAAK,MAAM,EAC1C,KAAK,iBAAiB,UAAUA,CAAU,EACtC,KAAK,QAAU,OACjB,MAAM,IAAI,MAAM,oCAAoC,EAEtD,KAAK,MAAM,UAAUA,CAAU,EAC/BA,EAAW,gBAAgB,KAAK,oBAAqB,EAAE,CACzD,CAEA,OAAO,mBAAmBC,EAQxB,CACA,IAAMrB,EAAUW,EAAe,YAAYU,CAAY,EACjDZ,EAAMY,EAAa,eAAe,EAClClB,EAASkB,EAAa,eAAe,EACrCf,EAASe,EAAa,sBAAsB,EAAE,EAC9CpB,EAAmBqB,EAAiB,YAAYD,CAAY,EAC5Dd,EAAQM,EAAiB,YAAYQ,CAAY,EACjDX,EAAsBW,EAAa,kBAAkB,aAAc,EAAE,EAE3E,MAAO,CAAE,QAAArB,EAAS,IAAAS,EAAK,OAAAN,EAAQ,OAAAG,EAAQ,iBAAAL,EAAkB,MAAAM,EAAO,oBAAAG,CAAoB,CACtF,CASA,WAAqB,CACnB,OAAO,KAAK,iBAAiB,UAAU,CACzC,CASA,sBAAsBa,EAAkD,CACtE,IAAMC,EAAY,IAAIC,EAAa,KAAK,KAAKF,CAAO,CAAC,EAC/CrB,EAAY,IAAIe,EAAa,KAAK,SAAS,EACjD,OAAO,IAAIS,EAA8BxB,EAAWsB,CAAS,CAC/D,CASA,iCAAiCG,EAA+D,CAC9F,IAAMH,EAAY,IAAIC,EAAa,KAAK,gBAAgBE,CAAW,CAAC,EAC9DzB,EAAY,IAAIe,EAAa,KAAK,SAAS,EACjD,OAAO,IAAIS,EAA8BxB,EAAWsB,CAAS,CAC/D,CAQA,MAAM,mBAAoB,CACpB,KAAK,0BAA0B,SACjC,MAAM,KAAK,cAEf,CAMA,MAAM,4BAA4BI,EAAyC,CACzE,GAAI,KAAK,UAAU,EACjB,MAAMC,EAAa,cAAc,CAC/B,MACF,CAAC,EAGH,GADA,MAAM,KAAK,kBAAkB,EACzB,KAAK,QAAU,OACjB,MAAMA,EAAa,cAAc,CAC/B,MACF,CAAC,EAEH,IAAMC,EAASC,EAAU,KAAK,IAAK,CAAE,OAAQ,EAAK,CAAC,EACnD,GAAID,EAAO,MAAQ,OACjB,MAAMD,EAAa,cAAc,CAC/B,QACA,QAAS,+FACX,CAAC,EAEH,GAAI,KAAK,sBAAwB,OAAW,CAC1C,GAAM,CAAE,gBAAAG,CAAgB,EAAI,MAAMC,EAAiB,CAAE,YAAAL,CAAY,CAAC,EAClE,GAAIZ,EAAI,iBAAiBgB,EAAgB,KAAK,CAAC,IAAMhB,EAAI,iBAAiB,KAAK,mBAAmB,EAChG,MAAMa,EAAa,cAAc,CAC/B,MACF,CAAC,CAEL,MAEE,QAAQ,KACN,8GACF,EAEF,MAAMhC,EAAuB,SAAS,CAAE,YAAA+B,EAAa,UAAW,KAAK,UAAW,IAAKE,EAAO,GAAI,CAAC,CACnG,CASA,KAAKP,EAAqC,CACxC,GAAM,CAAE,eAAAW,CAAe,EAAI,KAAK,iBAChC,GAAI,KAAK,UAAU,EACjB,MAAML,EAAa,cAAc,CAC/B,MACF,CAAC,EAEH,GAAI,KAAK,QAAU,OACjB,MAAMA,EAAa,cAAc,CAC/B,OACA,QAAS,mGACX,CAAC,EAEH,IAAMM,EAAqB,KAAK,iBAAiB,aAAa,EACxDC,EAAqB,KAAK,iBAAiB,KAAKb,CAAO,EAE7D,OAAO,IAAIc,EAAiB,CAC1B,UAAWC,EAAgB,KAAK,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,EACjD,qBAAsB,IAAIC,EAAqB,KAAK,OAA0C,EAC9F,eAAAL,EACA,mBAAAC,EACA,mBAAAC,CACF,CAAC,CACH,CAUA,gBAAgBT,EAAkD,CAChE,GAAI,KAAK,QAAU,OACjB,MAAME,EAAa,cAAc,CAC/B,OACA,QAAS,mGACX,CAAC,EAEH,IAAMW,EAAMC,EAAsBd,CAAW,EAEvCe,EADc,IAAIC,EAAoBH,EAAK,KAAK,MAAM,KAAK,EACpC,KAAK,EAClC,OAAO,KAAK,KAAKE,CAAQ,CAC3B,CAeA,gBAAgB3C,EAAmE,CACjF,GAAM,CAAE,QAAAwB,EAAS,UAAAC,CAAU,EAAIzB,EAI/B,MAHI,OAAK,UAAU,GAGf,CAAC,KAAK,iBAAiB,aAAa,EAAE,gBAAgB,CAAE,QAAAwB,EAAS,UAAWC,EAAU,kBAAmB,CAAC,EAIhH,CAUA,aAAa,SAASzB,EAID,CACnB,GAAM,CAAE,YAAA6B,EAAa,UAAA1B,EAAW,IAAA0C,CAAI,EAAI7C,EAClC8C,EAAgB3C,aAAqB4C,EAAmB5C,EAAYA,EAAU,iBAC9E,CAAE,IAAA6C,CAAI,EAAIF,EAEZG,EACEC,EAAU/C,aAAqBgD,EAA4BhD,EAAU,WAAa,OACxF,GAAI,CACF8C,EAAU,MAAMG,EAAe,CAAE,YAAAvB,EAAa,QAAAqB,CAAQ,CAAC,CACzD,OAAS9B,EAAO,CACd,MAAMU,EAAa,cAAc,CAC/B,QACA,MAAAV,EACA,QAAS,mBAAmB8B,EAAU,YAAc,SAAS,QAAQA,EAAU,eAAeA,CAAO,GAAK,KAAK,EACjH,CAAC,CACH,CAGA,IAAMG,EAAgBJ,EAAQ,IAAID,CAAG,EAErC,GAAIK,IAAkB,OACpB,MAAMvB,EAAa,cAAc,CAC/B,OACA,QAAS,mBAAmBkB,CAAG,aACjC,CAAC,EAIH,IAAMM,EAAMD,EAAc,KAAME,GAAQA,EAAI,MAAQV,CAAG,EAEvD,GAAIS,IAAQ,OACV,MAAMxB,EAAa,cAAc,CAC/B,OACA,QAAS,iBAAiBe,CAAG,iBAAiBG,CAAG,cACnD,CAAC,EAGH,OAAOM,CACT,CACF,EAvcsBxD,EACJ,cAAwB,GADnC,IAAe0D,EAAf1D,EA+cM8C,EAAN,cAAkC7C,CAAa,CAsBpD,YAAY6B,EAAwCpB,EAAiB,CACnE,MAAM,EAHR,KAAS,gBAAkB,6BAIzB,KAAK,YAAcoB,EACnB,KAAK,MAAQpB,CACf,CAQA,UAAUa,EAA8B,CACtCA,EAAW,oBAAoB,KAAK,YAAY,WAAW,CAAC,EAC5DA,EAAW,gBAAgB,KAAK,KAAK,CACvC,CASA,MAAmB,CACjB,OAAOoC,EAAuB,KAAK,WAAW,EAAG,KAAK,eAAe,CACvE,CACF","names":["EventEmitter","jwtDecode","isKeylessSigner","obj","_AbstractKeylessAccount","Serializable","args","address","ephemeralKeyPair","publicKey","uidKey","uidVal","aud","pepper","proof","proofFetchCallback","jwt","verificationKeyHash","AccountAddress","EventEmitter","ZeroKnowledgeSig","status","pepperBytes","Hex","AnyPublicKey","promise","error","serializer","deserializer","EphemeralKeyPair","message","signature","AnySignature","AccountAuthenticatorSingleKey","transaction","aptosConfig","KeylessError","header","jwtDecode","verificationKey","getKeylessConfig","expiryDateSecs","ephemeralPublicKey","ephemeralSignature","KeylessSignature","base64UrlDecode","EphemeralCertificate","raw","deriveTransactionType","signMess","TransactionAndProof","kid","keylessPubKey","KeylessPublicKey","iss","allJWKs","jwkAddr","FederatedKeylessPublicKey","getKeylessJWKs","jwksForIssuer","jwk","key","AbstractKeylessAccount","generateSigningMessage"]}
+{"version":3,"sources":["../../src/account/AbstractKeylessAccount.ts"],"sourcesContent":["// Copyright © Aptos Foundation\n// SPDX-License-Identifier: Apache-2.0\n\nimport EventEmitter from \"eventemitter3\";\nimport { jwtDecode } from \"jwt-decode\";\nimport { EphemeralCertificateVariant, HexInput, SigningScheme } from \"../types\";\nimport { AccountAddress } from \"../core/accountAddress\";\nimport {\n  AnyPublicKey,\n  AnySignature,\n  KeylessPublicKey,\n  KeylessSignature,\n  EphemeralCertificate,\n  ZeroKnowledgeSig,\n  ZkProof,\n  getKeylessJWKs,\n  MoveJWK,\n  getKeylessConfig,\n} from \"../core/crypto\";\n\nimport { EphemeralKeyPair } from \"./EphemeralKeyPair\";\nimport { Hex } from \"../core/hex\";\nimport { AccountAuthenticatorSingleKey } from \"../transactions/authenticator/account\";\nimport { Deserializer, Serializable, Serializer } from \"../bcs\";\nimport { deriveTransactionType, generateSigningMessage } from \"../transactions/transactionBuilder/signingMessage\";\nimport { AnyRawTransaction, AnyRawTransactionInstance } from \"../transactions/types\";\nimport { base64UrlDecode } from \"../utils/helpers\";\nimport { FederatedKeylessPublicKey } from \"../core/crypto/federatedKeyless\";\nimport { Account } from \"./Account\";\nimport { AptosConfig } from \"../api/aptosConfig\";\nimport { KeylessError, KeylessErrorType } from \"../errors\";\nimport type { SingleKeySigner } from \"./SingleKeyAccount\";\n\n/**\n * An interface which defines if an Account utilizes Keyless signing.\n */\nexport interface KeylessSigner extends Account {\n  checkKeylessAccountValidity(aptosConfig: AptosConfig): Promise<void>;\n}\n\nexport function isKeylessSigner(obj: any): obj is KeylessSigner {\n  return obj !== null && obj !== undefined && typeof obj.checkKeylessAccountValidity === \"function\";\n}\n\n/**\n * Account implementation for the Keyless authentication scheme.  This abstract class is used for standard Keyless Accounts\n * and Federated Keyless Accounts.\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport abstract class AbstractKeylessAccount extends Serializable implements KeylessSigner, SingleKeySigner {\n  static readonly PEPPER_LENGTH: number = 31;\n\n  /**\n   * The KeylessPublicKey associated with the account\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly publicKey: KeylessPublicKey | FederatedKeylessPublicKey;\n\n  /**\n   * The EphemeralKeyPair used to generate sign.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly ephemeralKeyPair: EphemeralKeyPair;\n\n  /**\n   * The claim on the JWT to identify a user.  This is typically 'sub' or 'email'.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly uidKey: string;\n\n  /**\n   * The value of the uidKey claim on the JWT.  This intended to be a stable user identifier.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly uidVal: string;\n\n  /**\n   * The value of the 'aud' claim on the JWT, also known as client ID.  This is the identifier for the dApp's\n   * OIDC registration with the identity provider.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly aud: string;\n\n  /**\n   * A value contains 31 bytes of entropy that preserves privacy of the account. Typically fetched from a pepper provider.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly pepper: Uint8Array;\n\n  /**\n   * Account address associated with the account\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly accountAddress: AccountAddress;\n\n  /**\n   * The zero knowledge signature (if ready) which contains the proof used to validate the EphemeralKeyPair.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  proof: ZeroKnowledgeSig | undefined;\n\n  /**\n   * The proof of the EphemeralKeyPair or a promise that provides the proof.  This is used to allow for awaiting on\n   * fetching the proof.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly proofOrPromise: ZeroKnowledgeSig | Promise<ZeroKnowledgeSig>;\n\n  /**\n   * Signing scheme used to sign transactions\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly signingScheme: SigningScheme = SigningScheme.SingleKey;\n\n  /**\n   * The JWT token used to derive the account\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly jwt: string;\n\n  /**\n   * The hash of the verification key used to verify the proof. This is optional and can be used to check verifying key\n   * rotations which may invalidate the proof.\n   */\n  readonly verificationKeyHash?: Uint8Array;\n\n  /**\n   * An event emitter used to assist in handling asynchronous proof fetching.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  private readonly emitter: EventEmitter<ProofFetchEvents>;\n\n  /**\n   * Use the static generator `create(...)` instead.\n   * Creates an instance of the KeylessAccount with an optional proof.\n   *\n   * @param args - The parameters for creating a KeylessAccount.\n   * @param args.address - Optional account address associated with the KeylessAccount.\n   * @param args.publicKey - A KeylessPublicKey or FederatedKeylessPublicKey.\n   * @param args.ephemeralKeyPair - The ephemeral key pair used in the account creation.\n   * @param args.iss - A JWT issuer.\n   * @param args.uidKey - The claim on the JWT to identify a user.  This is typically 'sub' or 'email'.\n   * @param args.uidVal - The unique id for this user, intended to be a stable user identifier.\n   * @param args.aud - The value of the 'aud' claim on the JWT, also known as client ID.  This is the identifier for the dApp's\n   * OIDC registration with the identity provider.\n   * @param args.pepper - A hexadecimal input used for additional security.\n   * @param args.proof - A Zero Knowledge Signature or a promise that resolves to one.\n   * @param args.proofFetchCallback - Optional callback function for fetching proof.\n   * @param args.jwt - A JSON Web Token used for authentication.\n   * @param args.verificationKeyHash Optional 32-byte verification key hash as hex input used to check proof validity.\n   */\n  protected constructor(args: {\n    address?: AccountAddress;\n    publicKey: KeylessPublicKey | FederatedKeylessPublicKey;\n    ephemeralKeyPair: EphemeralKeyPair;\n    iss: string;\n    uidKey: string;\n    uidVal: string;\n    aud: string;\n    pepper: HexInput;\n    proof: ZeroKnowledgeSig | Promise<ZeroKnowledgeSig>;\n    proofFetchCallback?: ProofFetchCallback;\n    jwt: string;\n    verificationKeyHash?: HexInput;\n  }) {\n    super();\n    const {\n      address,\n      ephemeralKeyPair,\n      publicKey,\n      uidKey,\n      uidVal,\n      aud,\n      pepper,\n      proof,\n      proofFetchCallback,\n      jwt,\n      verificationKeyHash,\n    } = args;\n    this.ephemeralKeyPair = ephemeralKeyPair;\n    this.publicKey = publicKey;\n    this.accountAddress = address ? AccountAddress.from(address) : this.publicKey.authKey().derivedAddress();\n    this.uidKey = uidKey;\n    this.uidVal = uidVal;\n    this.aud = aud;\n    this.jwt = jwt;\n    this.emitter = new EventEmitter<ProofFetchEvents>();\n    this.proofOrPromise = proof;\n    if (proof instanceof ZeroKnowledgeSig) {\n      this.proof = proof;\n    } else {\n      if (proofFetchCallback === undefined) {\n        throw new Error(\"Must provide callback for async proof fetch\");\n      }\n      this.emitter.on(\"proofFetchFinish\", async (status) => {\n        await proofFetchCallback(status);\n        this.emitter.removeAllListeners();\n      });\n      // Note, this is purposely not awaited to be non-blocking.  The caller should await on the proofFetchCallback.\n      this.init(proof);\n    }\n    const pepperBytes = Hex.fromHexInput(pepper).toUint8Array();\n    if (pepperBytes.length !== AbstractKeylessAccount.PEPPER_LENGTH) {\n      throw new Error(`Pepper length in bytes should be ${AbstractKeylessAccount.PEPPER_LENGTH}`);\n    }\n    this.pepper = pepperBytes;\n    if (verificationKeyHash !== undefined) {\n      if (Hex.hexInputToUint8Array(verificationKeyHash).length !== 32) {\n        throw new Error(\"verificationKeyHash must be 32 bytes\");\n      }\n      this.verificationKeyHash = Hex.hexInputToUint8Array(verificationKeyHash);\n    }\n  }\n\n  getAnyPublicKey(): AnyPublicKey {\n    return new AnyPublicKey(this.publicKey);\n  }\n\n  /**\n   * This initializes the asynchronous proof fetch\n   * @return Emits whether the proof succeeds or fails, but has no return.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  async init(promise: Promise<ZeroKnowledgeSig>) {\n    try {\n      this.proof = await promise;\n      this.emitter.emit(\"proofFetchFinish\", { status: \"Success\" });\n    } catch (error) {\n      if (error instanceof Error) {\n        this.emitter.emit(\"proofFetchFinish\", { status: \"Failed\", error: error.toString() });\n      } else {\n        this.emitter.emit(\"proofFetchFinish\", { status: \"Failed\", error: \"Unknown\" });\n      }\n    }\n  }\n\n  /**\n   * Serializes the jwt data into a format suitable for transmission or storage.\n   * This function ensures that both the jwt data and the proof are properly serialized.\n   *\n   * @param serializer - The serializer instance used to convert the jwt data into bytes.\n   */\n  serialize(serializer: Serializer): void {\n    this.accountAddress.serialize(serializer);\n    serializer.serializeStr(this.jwt);\n    serializer.serializeStr(this.uidKey);\n    serializer.serializeFixedBytes(this.pepper);\n    this.ephemeralKeyPair.serialize(serializer);\n    if (this.proof === undefined) {\n      throw new Error(\"Cannot serialize - proof undefined\");\n    }\n    this.proof.serialize(serializer);\n    serializer.serializeOption(this.verificationKeyHash, 32);\n  }\n\n  static partialDeserialize(deserializer: Deserializer): {\n    address: AccountAddress;\n    jwt: string;\n    uidKey: string;\n    pepper: Uint8Array;\n    ephemeralKeyPair: EphemeralKeyPair;\n    proof: ZeroKnowledgeSig;\n    verificationKeyHash?: Uint8Array;\n  } {\n    const address = AccountAddress.deserialize(deserializer);\n    const jwt = deserializer.deserializeStr();\n    const uidKey = deserializer.deserializeStr();\n    const pepper = deserializer.deserializeFixedBytes(31);\n    const ephemeralKeyPair = EphemeralKeyPair.deserialize(deserializer);\n    const proof = ZeroKnowledgeSig.deserialize(deserializer);\n    const verificationKeyHash = deserializer.deserializeOption(\"fixedBytes\", 32);\n\n    return { address, jwt, uidKey, pepper, ephemeralKeyPair, proof, verificationKeyHash };\n  }\n\n  /**\n   * Checks if the proof is expired.  If so the account must be re-derived with a new EphemeralKeyPair\n   * and JWT token.\n   * @return boolean\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  isExpired(): boolean {\n    return this.ephemeralKeyPair.isExpired();\n  }\n\n  /**\n   * Sign a message using Keyless.\n   * @param message the message to sign, as binary input\n   * @return the AccountAuthenticator containing the signature, together with the account's public key\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  signWithAuthenticator(message: HexInput): AccountAuthenticatorSingleKey {\n    const signature = new AnySignature(this.sign(message));\n    const publicKey = new AnyPublicKey(this.publicKey);\n    return new AccountAuthenticatorSingleKey(publicKey, signature);\n  }\n\n  /**\n   * Sign a transaction using Keyless.\n   * @param transaction the raw transaction\n   * @return the AccountAuthenticator containing the signature of the transaction, together with the account's public key\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  signTransactionWithAuthenticator(transaction: AnyRawTransaction): AccountAuthenticatorSingleKey {\n    const signature = new AnySignature(this.signTransaction(transaction));\n    const publicKey = new AnyPublicKey(this.publicKey);\n    return new AccountAuthenticatorSingleKey(publicKey, signature);\n  }\n\n  /**\n   * Waits for asynchronous proof fetching to finish.\n   * @return\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  async waitForProofFetch() {\n    if (this.proofOrPromise instanceof Promise) {\n      await this.proofOrPromise;\n    }\n  }\n\n  /**\n   * Validates that the Keyless Account can be used to sign transactions.\n   * @return\n   */\n  async checkKeylessAccountValidity(aptosConfig: AptosConfig): Promise<void> {\n    if (this.isExpired()) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.EPHEMERAL_KEY_PAIR_EXPIRED,\n      });\n    }\n    await this.waitForProofFetch();\n    if (this.proof === undefined) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.ASYNC_PROOF_FETCH_FAILED,\n      });\n    }\n    const header = jwtDecode(this.jwt, { header: true });\n    if (header.kid === undefined) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.JWT_PARSING_ERROR,\n        details: \"checkKeylessAccountValidity failed. JWT is missing 'kid' in header. This should never happen.\",\n      });\n    }\n    if (this.verificationKeyHash !== undefined) {\n      const { verificationKey } = await getKeylessConfig({ aptosConfig });\n      if (Hex.hexInputToString(verificationKey.hash()) !== Hex.hexInputToString(this.verificationKeyHash)) {\n        throw KeylessError.fromErrorType({\n          type: KeylessErrorType.INVALID_PROOF_VERIFICATION_KEY_NOT_FOUND,\n        });\n      }\n    } else {\n      // eslint-disable-next-line no-console\n      console.warn(\n        \"[Aptos SDK] The verification key hash was not set. Proof may be invalid if the verification key has rotated.\",\n      );\n    }\n    await AbstractKeylessAccount.fetchJWK({ aptosConfig, publicKey: this.publicKey, kid: header.kid });\n  }\n\n  /**\n   * Sign the given message using Keyless.\n   * @param message in HexInput format\n   * @returns Signature\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  sign(message: HexInput): KeylessSignature {\n    const { expiryDateSecs } = this.ephemeralKeyPair;\n    if (this.isExpired()) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.EPHEMERAL_KEY_PAIR_EXPIRED,\n      });\n    }\n    if (this.proof === undefined) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.PROOF_NOT_FOUND,\n        details: \"Proof not found - make sure to call `await account.checkKeylessAccountValidity()` before signing.\",\n      });\n    }\n    const ephemeralPublicKey = this.ephemeralKeyPair.getPublicKey();\n    const ephemeralSignature = this.ephemeralKeyPair.sign(message);\n\n    return new KeylessSignature({\n      jwtHeader: base64UrlDecode(this.jwt.split(\".\")[0]),\n      ephemeralCertificate: new EphemeralCertificate(this.proof, EphemeralCertificateVariant.ZkProof),\n      expiryDateSecs,\n      ephemeralPublicKey,\n      ephemeralSignature,\n    });\n  }\n\n  /**\n   * Sign the given transaction with Keyless.\n   * Signs the transaction and proof to guard against proof malleability.\n   * @param transaction the transaction to be signed\n   * @returns KeylessSignature\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  signTransaction(transaction: AnyRawTransaction): KeylessSignature {\n    if (this.proof === undefined) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.PROOF_NOT_FOUND,\n        details: \"Proof not found - make sure to call `await account.checkKeylessAccountValidity()` before signing.\",\n      });\n    }\n    const raw = deriveTransactionType(transaction);\n    const txnAndProof = new TransactionAndProof(raw, this.proof.proof);\n    const signMess = txnAndProof.hash();\n    return this.sign(signMess);\n  }\n\n  /**\n   * Note - This function is currently incomplete and should only be used to verify ownership of the KeylessAccount\n   *\n   * Verifies a signature given the message.\n   *\n   * TODO: Groth16 proof verification\n   *\n   * @param args.message the message that was signed.\n   * @param args.signature the KeylessSignature to verify\n   * @returns boolean\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  verifySignature(args: { message: HexInput; signature: KeylessSignature }): boolean {\n    const { message, signature } = args;\n    if (this.isExpired()) {\n      return false;\n    }\n    if (!this.ephemeralKeyPair.getPublicKey().verifySignature({ message, signature: signature.ephemeralSignature })) {\n      return false;\n    }\n    return true;\n  }\n\n  /**\n   * Fetches the JWK from the issuer's well-known JWKS endpoint.\n   *\n   * @param args.publicKey The keyless public key to query\n   * @param args.kid The kid of the JWK to fetch\n   * @returns A JWK matching the `kid` in the JWT header.\n   * @throws {KeylessError} If the JWK cannot be fetched\n   */\n  static async fetchJWK(args: {\n    aptosConfig: AptosConfig;\n    publicKey: KeylessPublicKey | FederatedKeylessPublicKey;\n    kid: string;\n  }): Promise<MoveJWK> {\n    const { aptosConfig, publicKey, kid } = args;\n    const keylessPubKey = publicKey instanceof KeylessPublicKey ? publicKey : publicKey.keylessPublicKey;\n    const { iss } = keylessPubKey;\n\n    let allJWKs: Map<string, MoveJWK[]>;\n    const jwkAddr = publicKey instanceof FederatedKeylessPublicKey ? publicKey.jwkAddress : undefined;\n    try {\n      allJWKs = await getKeylessJWKs({ aptosConfig, jwkAddr });\n    } catch (error) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.FULL_NODE_JWKS_LOOKUP_ERROR,\n        error,\n        details: `Failed to fetch ${jwkAddr ? \"Federated\" : \"Patched\"}JWKs ${jwkAddr ? `for address ${jwkAddr}` : \"0x1\"}`,\n      });\n    }\n\n    // Find the corresponding JWK set by `iss`\n    const jwksForIssuer = allJWKs.get(iss);\n\n    if (jwksForIssuer === undefined) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.INVALID_JWT_ISS_NOT_RECOGNIZED,\n        details: `JWKs for issuer ${iss} not found.`,\n      });\n    }\n\n    // Find the corresponding JWK by `kid`\n    const jwk = jwksForIssuer.find((key) => key.kid === kid);\n\n    if (jwk === undefined) {\n      throw KeylessError.fromErrorType({\n        type: KeylessErrorType.INVALID_JWT_JWK_NOT_FOUND,\n        details: `JWK with kid '${kid}' for issuer '${iss}' not found.`,\n      });\n    }\n\n    return jwk;\n  }\n}\n\n/**\n * A container class to hold a transaction and a proof.  It implements CryptoHashable which is used to create\n * the signing message for Keyless transactions.  We sign over the proof to ensure non-malleability.\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport class TransactionAndProof extends Serializable {\n  /**\n   * The transaction to sign.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  transaction: AnyRawTransactionInstance;\n\n  /**\n   * The zero knowledge proof used in signing the transaction.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  proof?: ZkProof;\n\n  /**\n   * The domain separator prefix used when hashing.\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  readonly domainSeparator = \"APTOS::TransactionAndProof\";\n\n  constructor(transaction: AnyRawTransactionInstance, proof?: ZkProof) {\n    super();\n    this.transaction = transaction;\n    this.proof = proof;\n  }\n\n  /**\n   * Serializes the transaction data into a format suitable for transmission or storage.\n   * This function ensures that both the transaction bytes and the proof are properly serialized.\n   *\n   * @param serializer - The serializer instance used to convert the transaction data into bytes.\n   */\n  serialize(serializer: Serializer): void {\n    serializer.serializeFixedBytes(this.transaction.bcsToBytes());\n    serializer.serializeOption(this.proof);\n  }\n\n  /**\n   * Hashes the bcs serialized from of the class. This is the typescript corollary to the BCSCryptoHash macro in aptos-core.\n   *\n   * @returns Uint8Array\n   * @group Implementation\n   * @category Account (On-Chain Model)\n   */\n  hash(): Uint8Array {\n    return generateSigningMessage(this.bcsToBytes(), this.domainSeparator);\n  }\n}\n/**\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport type ProofFetchSuccess = {\n  status: \"Success\";\n};\n/**\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport type ProofFetchFailure = {\n  status: \"Failed\";\n  error: string;\n};\n/**\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport type ProofFetchStatus = ProofFetchSuccess | ProofFetchFailure;\n/**\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport type ProofFetchCallback = (status: ProofFetchStatus) => Promise<void>;\n/**\n * @group Implementation\n * @category Account (On-Chain Model)\n */\nexport interface ProofFetchEvents {\n  proofFetchFinish: (status: ProofFetchStatus) => void;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA,OAAO,kBAAkB;AACzB,SAAS,iBAAiB;AAoCnB,SAAS,gBAAgB,KAAgC;AAC9D,SAAO,QAAQ,QAAQ,QAAQ,UAAa,OAAO,IAAI,gCAAgC;AACzF;AAQO,IAAe,0BAAf,MAAe,gCAA+B,aAAuD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAkHhG,YAAY,MAanB;AACD,UAAM;AAvDR;AAAA;AAAA;AAAA;AAAA;AAAA,SAAS;AAwDP,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI;AACJ,SAAK,mBAAmB;AACxB,SAAK,YAAY;AACjB,SAAK,iBAAiB,UAAU,eAAe,KAAK,OAAO,IAAI,KAAK,UAAU,QAAQ,EAAE,eAAe;AACvG,SAAK,SAAS;AACd,SAAK,SAAS;AACd,SAAK,MAAM;AACX,SAAK,MAAM;AACX,SAAK,UAAU,IAAI,aAA+B;AAClD,SAAK,iBAAiB;AACtB,QAAI,iBAAiB,kBAAkB;AACrC,WAAK,QAAQ;AAAA,IACf,OAAO;AACL,UAAI,uBAAuB,QAAW;AACpC,cAAM,IAAI,MAAM,6CAA6C;AAAA,MAC/D;AACA,WAAK,QAAQ,GAAG,oBAAoB,OAAO,WAAW;AACpD,cAAM,mBAAmB,MAAM;AAC/B,aAAK,QAAQ,mBAAmB;AAAA,MAClC,CAAC;AAED,WAAK,KAAK,KAAK;AAAA,IACjB;AACA,UAAM,cAAc,IAAI,aAAa,MAAM,EAAE,aAAa;AAC1D,QAAI,YAAY,WAAW,wBAAuB,eAAe;AAC/D,YAAM,IAAI,MAAM,oCAAoC,wBAAuB,aAAa,EAAE;AAAA,IAC5F;AACA,SAAK,SAAS;AACd,QAAI,wBAAwB,QAAW;AACrC,UAAI,IAAI,qBAAqB,mBAAmB,EAAE,WAAW,IAAI;AAC/D,cAAM,IAAI,MAAM,sCAAsC;AAAA,MACxD;AACA,WAAK,sBAAsB,IAAI,qBAAqB,mBAAmB;AAAA,IACzE;AAAA,EACF;AAAA,EAEA,kBAAgC;AAC9B,WAAO,IAAI,aAAa,KAAK,SAAS;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAK,SAAoC;AAC7C,QAAI;AACF,WAAK,QAAQ,MAAM;AACnB,WAAK,QAAQ,KAAK,oBAAoB,EAAE,QAAQ,UAAU,CAAC;AAAA,IAC7D,SAAS,OAAO;AACd,UAAI,iBAAiB,OAAO;AAC1B,aAAK,QAAQ,KAAK,oBAAoB,EAAE,QAAQ,UAAU,OAAO,MAAM,SAAS,EAAE,CAAC;AAAA,MACrF,OAAO;AACL,aAAK,QAAQ,KAAK,oBAAoB,EAAE,QAAQ,UAAU,OAAO,UAAU,CAAC;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,UAAU,YAA8B;AACtC,SAAK,eAAe,UAAU,UAAU;AACxC,eAAW,aAAa,KAAK,GAAG;AAChC,eAAW,aAAa,KAAK,MAAM;AACnC,eAAW,oBAAoB,KAAK,MAAM;AAC1C,SAAK,iBAAiB,UAAU,UAAU;AAC1C,QAAI,KAAK,UAAU,QAAW;AAC5B,YAAM,IAAI,MAAM,oCAAoC;AAAA,IACtD;AACA,SAAK,MAAM,UAAU,UAAU;AAC/B,eAAW,gBAAgB,KAAK,qBAAqB,EAAE;AAAA,EACzD;AAAA,EAEA,OAAO,mBAAmB,cAQxB;AACA,UAAM,UAAU,eAAe,YAAY,YAAY;AACvD,UAAM,MAAM,aAAa,eAAe;AACxC,UAAM,SAAS,aAAa,eAAe;AAC3C,UAAM,SAAS,aAAa,sBAAsB,EAAE;AACpD,UAAM,mBAAmB,iBAAiB,YAAY,YAAY;AAClE,UAAM,QAAQ,iBAAiB,YAAY,YAAY;AACvD,UAAM,sBAAsB,aAAa,kBAAkB,cAAc,EAAE;AAE3E,WAAO,EAAE,SAAS,KAAK,QAAQ,QAAQ,kBAAkB,OAAO,oBAAoB;AAAA,EACtF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,YAAqB;AACnB,WAAO,KAAK,iBAAiB,UAAU;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,sBAAsB,SAAkD;AACtE,UAAM,YAAY,IAAI,aAAa,KAAK,KAAK,OAAO,CAAC;AACrD,UAAM,YAAY,IAAI,aAAa,KAAK,SAAS;AACjD,WAAO,IAAI,8BAA8B,WAAW,SAAS;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,iCAAiC,aAA+D;AAC9F,UAAM,YAAY,IAAI,aAAa,KAAK,gBAAgB,WAAW,CAAC;AACpE,UAAM,YAAY,IAAI,aAAa,KAAK,SAAS;AACjD,WAAO,IAAI,8BAA8B,WAAW,SAAS;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,oBAAoB;AACxB,QAAI,KAAK,0BAA0B,SAAS;AAC1C,YAAM,KAAK;AAAA,IACb;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,4BAA4B,aAAyC;AACzE,QAAI,KAAK,UAAU,GAAG;AACpB,YAAM,aAAa,cAAc;AAAA,QAC/B;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,KAAK,kBAAkB;AAC7B,QAAI,KAAK,UAAU,QAAW;AAC5B,YAAM,aAAa,cAAc;AAAA,QAC/B;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,SAAS,UAAU,KAAK,KAAK,EAAE,QAAQ,KAAK,CAAC;AACnD,QAAI,OAAO,QAAQ,QAAW;AAC5B,YAAM,aAAa,cAAc;AAAA,QAC/B;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,QAAI,KAAK,wBAAwB,QAAW;AAC1C,YAAM,EAAE,gBAAgB,IAAI,MAAM,iBAAiB,EAAE,YAAY,CAAC;AAClE,UAAI,IAAI,iBAAiB,gBAAgB,KAAK,CAAC,MAAM,IAAI,iBAAiB,KAAK,mBAAmB,GAAG;AACnG,cAAM,aAAa,cAAc;AAAA,UAC/B;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,OAAO;AAEL,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF;AACA,UAAM,wBAAuB,SAAS,EAAE,aAAa,WAAW,KAAK,WAAW,KAAK,OAAO,IAAI,CAAC;AAAA,EACnG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,KAAK,SAAqC;AACxC,UAAM,EAAE,eAAe,IAAI,KAAK;AAChC,QAAI,KAAK,UAAU,GAAG;AACpB,YAAM,aAAa,cAAc;AAAA,QAC/B;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI,KAAK,UAAU,QAAW;AAC5B,YAAM,aAAa,cAAc;AAAA,QAC/B;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,qBAAqB,KAAK,iBAAiB,aAAa;AAC9D,UAAM,qBAAqB,KAAK,iBAAiB,KAAK,OAAO;AAE7D,WAAO,IAAI,iBAAiB;AAAA,MAC1B,WAAW,gBAAgB,KAAK,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC;AAAA,MACjD,sBAAsB,IAAI,qBAAqB,KAAK,sBAA0C;AAAA,MAC9F;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,gBAAgB,aAAkD;AAChE,QAAI,KAAK,UAAU,QAAW;AAC5B,YAAM,aAAa,cAAc;AAAA,QAC/B;AAAA,QACA,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AACA,UAAM,MAAM,sBAAsB,WAAW;AAC7C,UAAM,cAAc,IAAI,oBAAoB,KAAK,KAAK,MAAM,KAAK;AACjE,UAAM,WAAW,YAAY,KAAK;AAClC,WAAO,KAAK,KAAK,QAAQ;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,gBAAgB,MAAmE;AACjF,UAAM,EAAE,SAAS,UAAU,IAAI;AAC/B,QAAI,KAAK,UAAU,GAAG;AACpB,aAAO;AAAA,IACT;AACA,QAAI,CAAC,KAAK,iBAAiB,aAAa,EAAE,gBAAgB,EAAE,SAAS,WAAW,UAAU,mBAAmB,CAAC,GAAG;AAC/G,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,aAAa,SAAS,MAID;AACnB,UAAM,EAAE,aAAa,WAAW,IAAI,IAAI;AACxC,UAAM,gBAAgB,qBAAqB,mBAAmB,YAAY,UAAU;AACpF,UAAM,EAAE,IAAI,IAAI;AAEhB,QAAI;AACJ,UAAM,UAAU,qBAAqB,4BAA4B,UAAU,aAAa;AACxF,QAAI;AACF,gBAAU,MAAM,eAAe,EAAE,aAAa,QAAQ,CAAC;AAAA,IACzD,SAAS,OAAO;AACd,YAAM,aAAa,cAAc;AAAA,QAC/B;AAAA,QACA;AAAA,QACA,SAAS,mBAAmB,UAAU,cAAc,SAAS,QAAQ,UAAU,eAAe,OAAO,KAAK,KAAK;AAAA,MACjH,CAAC;AAAA,IACH;AAGA,UAAM,gBAAgB,QAAQ,IAAI,GAAG;AAErC,QAAI,kBAAkB,QAAW;AAC/B,YAAM,aAAa,cAAc;AAAA,QAC/B;AAAA,QACA,SAAS,mBAAmB,GAAG;AAAA,MACjC,CAAC;AAAA,IACH;AAGA,UAAM,MAAM,cAAc,KAAK,CAAC,QAAQ,IAAI,QAAQ,GAAG;AAEvD,QAAI,QAAQ,QAAW;AACrB,YAAM,aAAa,cAAc;AAAA,QAC/B;AAAA,QACA,SAAS,iBAAiB,GAAG,iBAAiB,GAAG;AAAA,MACnD,CAAC;AAAA,IACH;AAEA,WAAO;AAAA,EACT;AACF;AAvcsB,wBACJ,gBAAwB;AADnC,IAAe,yBAAf;AA+cA,IAAM,sBAAN,cAAkC,aAAa;AAAA,EAsBpD,YAAY,aAAwC,OAAiB;AACnE,UAAM;AAHR;AAAA;AAAA;AAAA;AAAA;AAAA,SAAS,kBAAkB;AAIzB,SAAK,cAAc;AACnB,SAAK,QAAQ;AAAA,EACf;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,UAAU,YAA8B;AACtC,eAAW,oBAAoB,KAAK,YAAY,WAAW,CAAC;AAC5D,eAAW,gBAAgB,KAAK,KAAK;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAmB;AACjB,WAAO,uBAAuB,KAAK,WAAW,GAAG,KAAK,eAAe;AAAA,EACvE;AACF;","names":[]}

package/dist/esm/chunk-4BXAKN6A.mjs

@@ -0,0 +1,84 @@
+import {
+  AbstractPublicKey,
+  AbstractSignature
+} from "./chunk-AKXCFBYF.mjs";
+import {
+  Account
+} from "./chunk-KEKNIJHE.mjs";
+import {
+  generateSigningMessageForTransaction
+} from "./chunk-JOVCSFQC.mjs";
+import {
+  AccountAuthenticatorAbstraction
+} from "./chunk-AGKEC2IM.mjs";
+import {
+  isValidFunctionInfo
+} from "./chunk-RQS33JAS.mjs";
+import {
+  Serializer
+} from "./chunk-C7T6GW5P.mjs";
+
+// src/account/AbstractedAccount.ts
+import { sha3_256 } from "@noble/hashes/sha3";
+var AbstractedAccount = class _AbstractedAccount extends Account {
+  constructor({ signer, accountAddress, authenticationFunction }) {
+    super();
+    this.signingScheme = 2 /* SingleKey */;
+    if (!isValidFunctionInfo(authenticationFunction)) {
+      throw new Error(`Invalid authentication function ${authenticationFunction} passed into AbstractedAccount`);
+    }
+    this.authenticationFunction = authenticationFunction;
+    this.accountAddress = accountAddress;
+    this.publicKey = new AbstractPublicKey(this.accountAddress);
+    this.sign = (digest) => new AbstractSignature(signer(digest));
+  }
+  /**
+   * Creates an `AbstractedAccount` from an `Ed25519Account` that has a permissioned signer function and
+   * using the `0x1::permissioned_delegation::authenticate` function to verify the signature.
+   *
+   * @param signer - The `Ed25519Account` that can be used to sign permissioned transactions.
+   * @returns The `AbstractedAccount`
+   */
+  static fromPermissionedSigner({
+    signer,
+    accountAddress
+  }) {
+    return new _AbstractedAccount({
+      signer: (digest) => {
+        const serializer = new Serializer();
+        signer.publicKey.serialize(serializer);
+        signer.sign(digest).serialize(serializer);
+        return serializer.toUint8Array();
+      },
+      accountAddress: accountAddress ?? signer.accountAddress,
+      authenticationFunction: "0x1::permissioned_delegation::authenticate"
+    });
+  }
+  signWithAuthenticator(message) {
+    return new AccountAuthenticatorAbstraction(
+      this.authenticationFunction,
+      sha3_256(message),
+      this.sign(sha3_256(message)).toUint8Array()
+    );
+  }
+  signTransactionWithAuthenticator(transaction) {
+    return this.signWithAuthenticator(generateSigningMessageForTransaction(transaction));
+  }
+  signTransaction(transaction) {
+    return this.sign(generateSigningMessageForTransaction(transaction));
+  }
+  /**
+   * Update the signer function for the account. This can be done after asynchronous operations are complete
+   * to update the context of the signer function.
+   *
+   * @param signer - The new signer function to use for the account.
+   */
+  setSigner(signer) {
+    this.sign = (digest) => new AbstractSignature(signer(digest));
+  }
+};
+
+export {
+  AbstractedAccount
+};
+//# sourceMappingURL=chunk-4BXAKN6A.mjs.map

package/dist/esm/chunk-4BXAKN6A.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/account/AbstractedAccount.ts"],"sourcesContent":["import { sha3_256 } from \"@noble/hashes/sha3\";\nimport { AccountAddress } from \"../core\";\nimport { AbstractPublicKey, AbstractSignature } from \"../core/crypto/abstraction\";\nimport { SigningScheme, HexInput } from \"../types\";\nimport { Account } from \"./Account\";\nimport { AnyRawTransaction } from \"../transactions/types\";\nimport { generateSigningMessageForTransaction } from \"../transactions/transactionBuilder/signingMessage\";\nimport { AccountAuthenticatorAbstraction } from \"../transactions/authenticator/account\";\nimport { Ed25519Account } from \"./Ed25519Account\";\nimport { Serializer } from \"../bcs/serializer\";\nimport { isValidFunctionInfo } from \"../utils/helpers\";\n\ntype AbstractedAccountConstructorArgs = {\n  /**\n   * The account address of the account.\n   */\n  accountAddress: AccountAddress;\n  /**\n   * The signer function signs transactions and returns the `authenticator` bytes in the `AbstractionAuthData`.\n   *\n   * @param digest - The SHA256 hash of the transaction signing message\n   * @returns The `authenticator` bytes that can be used to verify the signature.\n   */\n  signer: (digest: HexInput) => HexInput;\n  /**\n   * The authentication function that will be used to verify the signature.\n   *\n   * @example\n   * ```ts\n   * const authenticationFunction = `${accountAddress}::permissioned_delegation::authenticate`;\n   * ```\n   */\n  authenticationFunction: string;\n};\n\nexport class AbstractedAccount extends Account {\n  public readonly publicKey: AbstractPublicKey;\n\n  readonly accountAddress: AccountAddress;\n\n  readonly authenticationFunction: string;\n\n  readonly signingScheme = SigningScheme.SingleKey;\n\n  constructor({ signer, accountAddress, authenticationFunction }: AbstractedAccountConstructorArgs) {\n    super();\n\n    if (!isValidFunctionInfo(authenticationFunction)) {\n      throw new Error(`Invalid authentication function ${authenticationFunction} passed into AbstractedAccount`);\n    }\n\n    this.authenticationFunction = authenticationFunction;\n    this.accountAddress = accountAddress;\n    this.publicKey = new AbstractPublicKey(this.accountAddress);\n    this.sign = (digest: HexInput) => new AbstractSignature(signer(digest));\n  }\n\n  /**\n   * Creates an `AbstractedAccount` from an `Ed25519Account` that has a permissioned signer function and\n   * using the `0x1::permissioned_delegation::authenticate` function to verify the signature.\n   *\n   * @param signer - The `Ed25519Account` that can be used to sign permissioned transactions.\n   * @returns The `AbstractedAccount`\n   */\n  public static fromPermissionedSigner({\n    signer,\n    accountAddress,\n  }: {\n    signer: Ed25519Account;\n    accountAddress?: AccountAddress;\n  }) {\n    return new AbstractedAccount({\n      signer: (digest: HexInput) => {\n        const serializer = new Serializer();\n        signer.publicKey.serialize(serializer);\n        signer.sign(digest).serialize(serializer);\n        return serializer.toUint8Array();\n      },\n      accountAddress: accountAddress ?? signer.accountAddress,\n      authenticationFunction: \"0x1::permissioned_delegation::authenticate\",\n    });\n  }\n\n  signWithAuthenticator(message: HexInput): AccountAuthenticatorAbstraction {\n    return new AccountAuthenticatorAbstraction(\n      this.authenticationFunction,\n      sha3_256(message),\n      this.sign(sha3_256(message)).toUint8Array(),\n    );\n  }\n\n  signTransactionWithAuthenticator(transaction: AnyRawTransaction): AccountAuthenticatorAbstraction {\n    return this.signWithAuthenticator(generateSigningMessageForTransaction(transaction));\n  }\n\n  sign: (message: HexInput) => AbstractSignature;\n\n  signTransaction(transaction: AnyRawTransaction): AbstractSignature {\n    return this.sign(generateSigningMessageForTransaction(transaction));\n  }\n\n  /**\n   * Update the signer function for the account. This can be done after asynchronous operations are complete\n   * to update the context of the signer function.\n   *\n   * @param signer - The new signer function to use for the account.\n   */\n  public setSigner(signer: (digest: HexInput) => HexInput): void {\n    this.sign = (digest: HexInput) => new AbstractSignature(signer(digest));\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,gBAAgB;AAmClB,IAAM,oBAAN,MAAM,2BAA0B,QAAQ;AAAA,EAS7C,YAAY,EAAE,QAAQ,gBAAgB,uBAAuB,GAAqC;AAChG,UAAM;AAHR,SAAS;AAKP,QAAI,CAAC,oBAAoB,sBAAsB,GAAG;AAChD,YAAM,IAAI,MAAM,mCAAmC,sBAAsB,gCAAgC;AAAA,IAC3G;AAEA,SAAK,yBAAyB;AAC9B,SAAK,iBAAiB;AACtB,SAAK,YAAY,IAAI,kBAAkB,KAAK,cAAc;AAC1D,SAAK,OAAO,CAAC,WAAqB,IAAI,kBAAkB,OAAO,MAAM,CAAC;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,OAAc,uBAAuB;AAAA,IACnC;AAAA,IACA;AAAA,EACF,GAGG;AACD,WAAO,IAAI,mBAAkB;AAAA,MAC3B,QAAQ,CAAC,WAAqB;AAC5B,cAAM,aAAa,IAAI,WAAW;AAClC,eAAO,UAAU,UAAU,UAAU;AACrC,eAAO,KAAK,MAAM,EAAE,UAAU,UAAU;AACxC,eAAO,WAAW,aAAa;AAAA,MACjC;AAAA,MACA,gBAAgB,kBAAkB,OAAO;AAAA,MACzC,wBAAwB;AAAA,IAC1B,CAAC;AAAA,EACH;AAAA,EAEA,sBAAsB,SAAoD;AACxE,WAAO,IAAI;AAAA,MACT,KAAK;AAAA,MACL,SAAS,OAAO;AAAA,MAChB,KAAK,KAAK,SAAS,OAAO,CAAC,EAAE,aAAa;AAAA,IAC5C;AAAA,EACF;AAAA,EAEA,iCAAiC,aAAiE;AAChG,WAAO,KAAK,sBAAsB,qCAAqC,WAAW,CAAC;AAAA,EACrF;AAAA,EAIA,gBAAgB,aAAmD;AACjE,WAAO,KAAK,KAAK,qCAAqC,WAAW,CAAC;AAAA,EACpE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQO,UAAU,QAA8C;AAC7D,SAAK,OAAO,CAAC,WAAqB,IAAI,kBAAkB,OAAO,MAAM,CAAC;AAAA,EACxE;AACF;","names":[]}