@aptos-labs/ts-sdk 1.35.0 → 1.36.0-zeta.0

package/src/account/AbstractKeylessAccount.ts

@@ -13,9 +13,10 @@ import {
   EphemeralCertificate,
   ZeroKnowledgeSig,
   ZkProof,
-  getKeylessJWKs,
   MoveJWK,
   getKeylessConfig,
+  fetchJWK,
+  KeylessConfiguration,
 } from "../core/crypto";
 
 import { EphemeralKeyPair } from "./EphemeralKeyPair";
@@ -428,28 +429,47 @@ export abstract class AbstractKeylessAccount extends Serializable implements Key
     return this.sign(signMess);
   }
 
+  getSigningMessage(transaction: AnyRawTransaction): Uint8Array {
+    if (this.proof === undefined) {
+      throw KeylessError.fromErrorType({
+        type: KeylessErrorType.PROOF_NOT_FOUND,
+        details: "Proof not found - make sure to call `await account.checkKeylessAccountValidity()` before signing.",
+      });
+    }
+    const raw = deriveTransactionType(transaction);
+    const txnAndProof = new TransactionAndProof(raw, this.proof.proof);
+    return txnAndProof.hash();
+  }
+
   /**
    * Note - This function is currently incomplete and should only be used to verify ownership of the KeylessAccount
    *
    * Verifies a signature given the message.
    *
-   * TODO: Groth16 proof verification
-   *
    * @param args.message the message that was signed.
    * @param args.signature the KeylessSignature to verify
    * @returns boolean
    * @group Implementation
    * @category Account (On-Chain Model)
    */
-  verifySignature(args: { message: HexInput; signature: KeylessSignature }): boolean {
-    const { message, signature } = args;
-    if (this.isExpired()) {
-      return false;
-    }
-    if (!this.ephemeralKeyPair.getPublicKey().verifySignature({ message, signature: signature.ephemeralSignature })) {
-      return false;
-    }
-    return true;
+  verifySignature(args: {
+    message: HexInput;
+    signature: KeylessSignature;
+    jwk: MoveJWK;
+    keylessConfig: KeylessConfiguration;
+  }): boolean {
+    return this.publicKey.verifySignature(args);
+  }
+
+  async verifySignatureAsync(args: {
+    aptosConfig: AptosConfig;
+    message: HexInput;
+    signature: KeylessSignature;
+    options?: { throwErrorWithReason?: boolean };
+  }): Promise<boolean> {
+    return this.publicKey.verifySignatureAsync({
+      ...args,
+    });
   }
 
   /**
@@ -465,43 +485,7 @@ export abstract class AbstractKeylessAccount extends Serializable implements Key
     publicKey: KeylessPublicKey | FederatedKeylessPublicKey;
     kid: string;
   }): Promise<MoveJWK> {
-    const { aptosConfig, publicKey, kid } = args;
-    const keylessPubKey = publicKey instanceof KeylessPublicKey ? publicKey : publicKey.keylessPublicKey;
-    const { iss } = keylessPubKey;
-
-    let allJWKs: Map<string, MoveJWK[]>;
-    const jwkAddr = publicKey instanceof FederatedKeylessPublicKey ? publicKey.jwkAddress : undefined;
-    try {
-      allJWKs = await getKeylessJWKs({ aptosConfig, jwkAddr });
-    } catch (error) {
-      throw KeylessError.fromErrorType({
-        type: KeylessErrorType.FULL_NODE_JWKS_LOOKUP_ERROR,
-        error,
-        details: `Failed to fetch ${jwkAddr ? "Federated" : "Patched"}JWKs ${jwkAddr ? `for address ${jwkAddr}` : "0x1"}`,
-      });
-    }
-
-    // Find the corresponding JWK set by `iss`
-    const jwksForIssuer = allJWKs.get(iss);
-
-    if (jwksForIssuer === undefined) {
-      throw KeylessError.fromErrorType({
-        type: KeylessErrorType.INVALID_JWT_ISS_NOT_RECOGNIZED,
-        details: `JWKs for issuer ${iss} not found.`,
-      });
-    }
-
-    // Find the corresponding JWK by `kid`
-    const jwk = jwksForIssuer.find((key) => key.kid === kid);
-
-    if (jwk === undefined) {
-      throw KeylessError.fromErrorType({
-        type: KeylessErrorType.INVALID_JWT_JWK_NOT_FOUND,
-        details: `JWK with kid '${kid}' for issuer '${iss}' not found.`,
-      });
-    }
-
-    return jwk;
+    return fetchJWK(args);
   }
 }
 

package/src/account/MultiKeyAccount.ts

@@ -148,13 +148,14 @@ export class MultiKeyAccount implements Account, KeylessSigner {
    * @category Account (On-Chain Model)
    */
   static fromPublicKeysAndSigners(args: {
+    address?: AccountAddressInput;
     publicKeys: PublicKey[];
     signaturesRequired: number;
     signers: SingleKeySignerOrLegacyEd25519Account[];
   }): MultiKeyAccount {
-    const { publicKeys, signaturesRequired, signers } = args;
+    const { address, publicKeys, signaturesRequired, signers } = args;
     const multiKey = new MultiKey({ publicKeys, signaturesRequired });
-    return new MultiKeyAccount({ multiKey, signers });
+    return new MultiKeyAccount({ multiKey, signers, address });
   }
 
   /**
@@ -258,6 +259,7 @@ export class MultiKeyAccount implements Account, KeylessSigner {
    * Verify the given message and signature with the public keys.
    *
    * This function checks if the provided signatures are valid for the given message using the corresponding public keys.
+   * Note: If you are using KeylessAccounts, you must use `verifySignatureAsync` instead.
    *
    * @param args - The arguments for verifying the signature.
    * @param args.message - The raw message data in HexInput format.
@@ -266,21 +268,27 @@ export class MultiKeyAccount implements Account, KeylessSigner {
    * @group Implementation
    * @category Account (On-Chain Model)
    */
-  verifySignature(args: VerifyMultiKeySignatureArgs): boolean {
-    const { message, signature } = args;
-    const isSignerIndicesSorted = this.signerIndicies.every(
-      (value, i) => i === 0 || value >= this.signerIndicies[i - 1],
-    );
-    if (!isSignerIndicesSorted) {
-      return false;
-    }
-    for (let i = 0; i < signature.signatures.length; i += 1) {
-      const singleSignature = signature.signatures[i];
-      const publicKey = this.publicKey.publicKeys[this.signerIndicies[i]];
-      if (!publicKey.verifySignature({ message, signature: singleSignature })) {
-        return false;
-      }
-    }
-    return true;
+  verifySignature(args: { message: HexInput; signature: MultiKeySignature }): boolean {
+    return this.publicKey.verifySignature(args);
+  }
+
+  /**
+   * Verify the given message and signature with the public keys.
+   *
+   * This function checks if the provided signatures are valid for the given message using the corresponding public keys.
+   *
+   * @param args - The arguments for verifying the signature.
+   * @param args.message - The raw message data in HexInput format.
+   * @param args.signature - The signed message MultiKeySignature containing multiple signatures.
+   * @returns A boolean indicating whether the signatures are valid for the message.
+   * @group Implementation
+   * @category Account (On-Chain Model)
+   */
+  async verifySignatureAsync(args: {
+    aptosConfig: AptosConfig;
+    message: HexInput;
+    signature: MultiKeySignature;
+  }): Promise<boolean> {
+    return await this.publicKey.verifySignatureAsync(args);
   }
 }

package/src/api/general.ts

@@ -279,11 +279,11 @@ export class General {
    * async function runExample() {
    *   // Querying the Aptos Indexer for ledger information
    *   const topUserTransactions = await aptos.queryIndexer({
-   *     query: `query MyQuery {
+   *     query: { query: `query MyQuery {
    *       ledger_infos {
    *         chain_id
    *       }
-   *     }`
+   *     }`}
    *   });
    *
    *   console.log(topUserTransactions);

package/src/api/transaction.ts

@@ -24,7 +24,6 @@ import {
   FeePayerOrFeePayerAuthenticatorOrNeither,
   getSigningMessage,
   publicPackageTransaction,
-  rotateAuthKey,
   signAndSubmitAsFeePayer,
   signAndSubmitTransaction,
   signAsFeePayer,
@@ -36,13 +35,14 @@ import {
   InputGenerateTransactionOptions,
   InputGenerateTransactionPayloadData,
 } from "../transactions";
-import { AccountAddressInput, PrivateKeyInput } from "../core";
+import { AccountAddressInput, AuthenticationKey, Ed25519PrivateKey } from "../core";
 import { Account } from "../account";
 import { Build } from "./transactionSubmission/build";
 import { Simulate } from "./transactionSubmission/simulate";
 import { Submit } from "./transactionSubmission/submit";
 import { TransactionManagement } from "./transactionSubmission/management";
 import { SimpleTransaction } from "../transactions/instances/simpleTransaction";
+import { rotateAuthKey } from "../internal/account";
 
 /**
  * Represents a transaction in the Aptos blockchain,
@@ -474,13 +474,26 @@ export class Transaction {
   }
 
   /**
-   * Rotate an account's authentication key. After rotation, only the new private key can be used to sign transactions for the account.
-   * Note: Only legacy Ed25519 scheme is supported for now.
-   * More info: {@link https://aptos.dev/guides/account-management/key-rotation/}
+   * Rotates the authentication key for a given account.  Once an account is rotated, only the new private key
+   * or keyless signing scheme can be used to sign transactions for the account.
    *
-   * @param args The arguments for rotating the auth key.
-   * @param args.fromAccount The account to rotate the auth key for.
-   * @param args.toNewPrivateKey The new private key to rotate to.
+   * @param args - The arguments for rotating the authentication key.
+   * @param args.fromAccount - The account from which the authentication key will be rotated.
+   * @param args.toAccount - (Optional) The target account to rotate to. Required if not using toNewPrivateKey or toAuthKey.
+   * @param args.toNewPrivateKey - (Optional) The new private key to rotate to. Required if not using toAccount or toAuthKey.
+   * @param args.toAuthKey - (Optional) The new authentication key to rotate to. Can only be used with dangerouslySkipVerification=true.
+   * @param args.dangerouslySkipVerification - (Optional) If true, skips verification steps after rotation. Required when using toAuthKey.
+   *
+   * @remarks
+   * This function supports three modes of rotation:
+   * 1. Using a target Account object (toAccount)
+   * 2. Using a new private key (toNewPrivateKey)
+   * 3. Using a raw authentication key (toAuthKey) - requires dangerouslySkipVerification=true
+   *
+   * When not using dangerouslySkipVerification, the function performs additional safety checks and account setup.
+   *
+   * If the new key is a multi key, skipping verification is dangerous because verification will publish the public key onchain and
+   * prevent users from being locked out of the account from loss of knowledge of one of the public keys.
    *
    * @returns PendingTransactionResponse
    *
@@ -506,7 +519,15 @@ export class Transaction {
    * ```
    * @group Transaction
    */
-  async rotateAuthKey(args: { fromAccount: Account; toNewPrivateKey: PrivateKeyInput }): Promise<TransactionResponse> {
+  async rotateAuthKey(
+    args: {
+      fromAccount: Account;
+    } & (
+      | { toAccount: Account; dangerouslySkipVerification?: never }
+      | { toNewPrivateKey: Ed25519PrivateKey; dangerouslySkipVerification?: never }
+      | { toAuthKey: AuthenticationKey; dangerouslySkipVerification: true }
+    ),
+  ): Promise<PendingTransactionResponse> {
     return rotateAuthKey({ aptosConfig: this.config, ...args });
   }
 

package/src/cli/localNode.ts

@@ -89,23 +89,14 @@ export class LocalNode {
     const cliArgs = ["aptos", "node", "run-localnet", "--force-restart", "--assume-yes", "--with-indexer-api"];
 
     const currentPlatform = platform();
-    let childProcess;
-    // Check if current OS is windows
-    if (currentPlatform === "win32") {
-      childProcess = spawn(cliCommand, cliArgs, { shell: true });
-    } else {
-      childProcess = spawn(cliCommand, cliArgs);
-    }
-
-    this.process = childProcess;
+    const spawnConfig = {
+      env: { ...process.env, ENABLE_KEYLESS_DEFAULT: "1" },
+      ...(currentPlatform === "win32" && { shell: true }),
+    };
 
-    childProcess.stderr?.on("data", (data: any) => {
-      const str = data.toString();
-      // Print local node output error log
-      console.log(str);
-    });
+    this.process = spawn(cliCommand, cliArgs, spawnConfig);
 
-    childProcess.stdout?.on("data", (data: any) => {
+    this.process.stdout?.on("data", (data: any) => {
       const str = data.toString();
       // Print local node output log
       if (this.showStdout) {

package/src/core/crypto/abstraction.ts

@@ -3,7 +3,7 @@ import { HexInput } from "../../types";
 import { AccountAddress } from "../accountAddress";
 import { AuthenticationKey } from "../authenticationKey";
 import { Hex } from "../hex";
-import { AccountPublicKey, VerifySignatureArgs } from "./publicKey";
+import { AccountPublicKey, VerifySignatureArgs, VerifySignatureAsyncArgs } from "./publicKey";
 import { Signature } from "./signature";
 
 export class AbstractSignature extends Signature {
@@ -40,6 +40,11 @@ export class AbstractPublicKey extends AccountPublicKey {
     throw new Error("This function is not implemented for AbstractPublicKey.");
   }
 
+  // eslint-disable-next-line class-methods-use-this, @typescript-eslint/no-unused-vars
+  async verifySignatureAsync(args: VerifySignatureAsyncArgs): Promise<boolean> {
+    throw new Error("This function is not implemented for AbstractPublicKey.");
+  }
+
   // eslint-disable-next-line class-methods-use-this, @typescript-eslint/no-unused-vars
   serialize(serializer: Serializer): void {
     throw new Error("This function is not implemented for AbstractPublicKey.");

package/src/core/crypto/ed25519.ts

@@ -9,7 +9,7 @@ import { Hex } from "../hex";
 import { HexInput, SigningScheme as AuthenticationKeyScheme, PrivateKeyVariants } from "../../types";
 import { CKDPriv, deriveKey, HARDENED_OFFSET, isValidHardenedPath, mnemonicToSeed, splitPath } from "./hdKey";
 import { PrivateKey } from "./privateKey";
-import { AccountPublicKey, PublicKey, VerifySignatureArgs } from "./publicKey";
+import { AccountPublicKey, PublicKey, VerifySignatureArgs, VerifySignatureAsyncArgs } from "./publicKey";
 import { Signature } from "./signature";
 import { convertSigningMessage } from "./utils";
 
@@ -120,6 +120,24 @@ export class Ed25519PublicKey extends AccountPublicKey {
     return ed25519.verify(signatureBytes, messageBytes, publicKeyBytes);
   }
 
+  /**
+   * Note: Ed25519Signatures can be verified syncronously.
+   *
+   * Verifies the provided signature against the given message.
+   * This function helps ensure the integrity and authenticity of the message by confirming that the signature is valid.
+   *
+   * @param args - The arguments for signature verification.
+   * @param args.aptosConfig - The configuration object for connecting to the Aptos network
+   * @param args.message - The message that was signed.
+   * @param args.signature - The signature to verify, which must be an instance of Secp256k1Signature.
+   * @returns A boolean indicating whether the signature is valid for the given message.
+   * @group Implementation
+   * @category Serialization
+   */
+  async verifySignatureAsync(args: VerifySignatureAsyncArgs): Promise<boolean> {
+    return this.verifySignature(args);
+  }
+
   /**
    * Generates an authentication key from the public key using the Ed25519 scheme.
    * This function is essential for creating a secure authentication key that can be used for further cryptographic operations.

package/src/core/crypto/ephemeral.ts

@@ -4,6 +4,7 @@ import { PublicKey } from "./publicKey";
 import { Signature } from "./signature";
 import { Ed25519PublicKey, Ed25519Signature } from "./ed25519";
 import { Hex } from "../hex";
+import { AptosConfig } from "../../api";
 
 /**
  * Represents ephemeral public keys for Aptos Keyless accounts.
@@ -64,6 +65,14 @@ export class EphemeralPublicKey extends PublicKey {
     return this.publicKey.verifySignature({ message, signature: signature.signature });
   }
 
+  async verifySignatureAsync(args: {
+    aptosConfig: AptosConfig;
+    message: HexInput;
+    signature: EphemeralSignature;
+  }): Promise<boolean> {
+    return this.verifySignature(args);
+  }
+
   /**
    * Serializes the current instance, specifically handling the Ed25519 signature type.
    * This function ensures that the signature is properly serialized using the provided serializer.

package/src/core/crypto/federatedKeyless.ts

@@ -6,7 +6,15 @@ import { Deserializer, Serializer } from "../../bcs";
 import { HexInput, AnyPublicKeyVariant, SigningScheme } from "../../types";
 import { AuthenticationKey } from "../authenticationKey";
 import { AccountAddress, AccountAddressInput } from "../accountAddress";
-import { KeylessPublicKey, KeylessSignature } from "./keyless";
+import {
+  KeylessConfiguration,
+  KeylessPublicKey,
+  KeylessSignature,
+  MoveJWK,
+  verifyKeylessSignature,
+  verifyKeylessSignatureWithJwkAndConfig,
+} from "./keyless";
+import { AptosConfig } from "../../api";
 
 /**
  * Represents the FederatedKeylessPublicKey public key
@@ -60,13 +68,19 @@ export class FederatedKeylessPublicKey extends AccountPublicKey {
    *
    * @param args.message message
    * @param args.signature The signature
+   * @param args.jwk - The JWK to use for verification.
+   * @param args.keylessConfig - The keyless configuration to use for verification.
    * @returns true if the signature is valid
    * @group Implementation
    * @category Serialization
    */
-  // eslint-disable-next-line @typescript-eslint/no-unused-vars, class-methods-use-this
-  verifySignature(args: { message: HexInput; signature: KeylessSignature }): boolean {
-    throw new Error("Not yet implemented");
+  verifySignature(args: {
+    message: HexInput;
+    signature: KeylessSignature;
+    jwk: MoveJWK;
+    keylessConfig: KeylessConfiguration;
+  }): boolean {
+    return verifyKeylessSignatureWithJwkAndConfig({ ...args, publicKey: this });
   }
 
   serialize(serializer: Serializer): void {
@@ -84,6 +98,28 @@ export class FederatedKeylessPublicKey extends AccountPublicKey {
     return publicKey instanceof FederatedKeylessPublicKey;
   }
 
+  /**
+   * Verifies a keyless signature for a given message.  It will fetch the keyless configuration and the JWK to
+   * use for verification from the appropriate network as defined by the aptosConfig.
+   *
+   * @param args.aptosConfig The aptos config to use for fetching the keyless configuration.
+   * @param args.message The message to verify the signature against.
+   * @param args.signature The signature to verify.
+   * @param args.options.throwErrorWithReason Whether to throw an error with the reason for the failure instead of returning false.
+   * @returns true if the signature is valid
+   */
+  async verifySignatureAsync(args: {
+    aptosConfig: AptosConfig;
+    message: HexInput;
+    signature: KeylessSignature;
+    options?: { throwErrorWithReason?: boolean };
+  }): Promise<boolean> {
+    return verifyKeylessSignature({
+      ...args,
+      publicKey: this,
+    });
+  }
+
   /**
    * Creates a FederatedKeylessPublicKey from the JWT components plus pepper
    *

package/src/core/crypto/index.ts

@@ -1,13 +1,14 @@
 // Copyright © Aptos Foundation
 // SPDX-License-Identifier: Apache-2.0
 
+export * from "./abstraction";
 export * from "./ed25519";
-export * from "./hdKey";
-export * from "./multiEd25519";
-export * from "./multiKey";
 export * from "./ephemeral";
 export * from "./federatedKeyless";
+export * from "./hdKey";
 export * from "./keyless";
+export * from "./multiEd25519";
+export * from "./multiKey";
 export * from "./poseidon";
 export * from "./privateKey";
 export * from "./publicKey";