@aptos-labs/ts-sdk 1.35.0 → 1.36.0-zeta.0

package/src/core/crypto/multiEd25519.ts

@@ -1,12 +1,12 @@
 // Copyright © Aptos Foundation
 // SPDX-License-Identifier: Apache-2.0
 
+import { AptosConfig } from "../../api";
 import { Deserializer, Serializer } from "../../bcs";
-import { SigningScheme as AuthenticationKeyScheme } from "../../types";
+import { SigningScheme as AuthenticationKeyScheme, HexInput } from "../../types";
 import { AuthenticationKey } from "../authenticationKey";
 import { Ed25519PublicKey, Ed25519Signature } from "./ed25519";
 import { AbstractMultiKey } from "./multiKey";
-import { VerifySignatureArgs } from "./publicKey";
 import { Signature } from "./signature";
 
 /**
@@ -106,7 +106,7 @@ export class MultiEd25519PublicKey extends AbstractMultiKey {
    * @group Implementation
    * @category Serialization
    */
-  verifySignature(args: VerifySignatureArgs): boolean {
+  verifySignature(args: { message: HexInput; signature: MultiEd25519Signature }): boolean {
     const { message, signature } = args;
     if (!(signature instanceof MultiEd25519Signature)) {
       return false;
@@ -141,6 +141,14 @@ export class MultiEd25519PublicKey extends AbstractMultiKey {
     return true;
   }
 
+  async verifySignatureAsync(args: {
+    aptosConfig: AptosConfig;
+    message: HexInput;
+    signature: MultiEd25519Signature;
+  }): Promise<boolean> {
+    return this.verifySignature(args);
+  }
+
   /**
    * Generates an authentication key based on the current instance's byte representation.
    * This function is essential for creating a secure authentication key that can be used for various cryptographic operations.

package/src/core/crypto/multiKey.ts

@@ -1,10 +1,11 @@
-import { SigningScheme as AuthenticationKeyScheme } from "../../types";
+import { SigningScheme as AuthenticationKeyScheme, HexInput } from "../../types";
 import { Deserializer } from "../../bcs/deserializer";
 import { Serializer } from "../../bcs/serializer";
 import { AuthenticationKey } from "../authenticationKey";
 import { AccountPublicKey, PublicKey, VerifySignatureArgs } from "./publicKey";
 import { Signature } from "./signature";
 import { AnyPublicKey, AnySignature } from "./singleKey";
+import { AptosConfig } from "../../api";
 
 /**
  * Counts the number of set bits (1s) in a byte.
@@ -165,19 +166,63 @@ export class MultiKey extends AbstractMultiKey {
 
   // region AccountPublicKey
 
+  /**
+   * Verifies the provided signature against the given message.
+   * This function helps ensure the integrity and authenticity of the message by checking if the signature is valid.
+   *
+   * Note: This function will fail if a keyless signature is used.  Use `verifySignatureAsync` instead.
+   *
+   * @param args - The arguments for verifying the signature.
+   * @param args.message - The message that was signed.
+   * @param args.signature - The signature to verify.
+   * @group Implementation
+   * @category Serialization
+   */
+  verifySignature(args: { message: HexInput; signature: MultiKeySignature }): boolean {
+    const { message, signature } = args;
+    if (signature.signatures.length !== this.signaturesRequired) {
+      throw new Error("The number of signatures does not match the number of required signatures");
+    }
+    const signerIndices = signature.bitMapToSignerIndices();
+    for (let i = 0; i < signature.signatures.length; i += 1) {
+      const singleSignature = signature.signatures[i];
+      const publicKey = this.publicKeys[signerIndices[i]];
+      if (!publicKey.verifySignature({ message, signature: singleSignature })) {
+        return false;
+      }
+    }
+    return true;
+  }
+
   /**
    * Verifies the provided signature against the given message.
    * This function helps ensure the integrity and authenticity of the message by checking if the signature is valid.
    *
    * @param args - The arguments for verifying the signature.
+   * @param args.aptosConfig - The Aptos configuration to use
    * @param args.message - The message that was signed.
    * @param args.signature - The signature to verify.
    * @group Implementation
    * @category Serialization
    */
-  // eslint-disable-next-line class-methods-use-this, @typescript-eslint/no-unused-vars
-  verifySignature(args: VerifySignatureArgs): boolean {
-    throw new Error("not implemented");
+  async verifySignatureAsync(args: {
+    aptosConfig: AptosConfig;
+    message: HexInput;
+    signature: MultiKeySignature;
+  }): Promise<boolean> {
+    const { message, signature, aptosConfig } = args;
+    if (signature.signatures.length !== this.signaturesRequired) {
+      throw new Error("The number of signatures does not match the number of required signatures");
+    }
+    const signerIndices = signature.bitMapToSignerIndices();
+    for (let i = 0; i < signature.signatures.length; i += 1) {
+      const singleSignature = signature.signatures[i];
+      const publicKey = this.publicKeys[signerIndices[i]];
+      if (!(await publicKey.verifySignatureAsync({ aptosConfig, message, signature: singleSignature }))) {
+        return false;
+      }
+    }
+    return true;
   }
 
   /**
@@ -380,6 +425,31 @@ export class MultiKeySignature extends Signature {
     return bitmap;
   }
 
+  /**
+   * Converts the bitmap to an array of signer indices.
+   *
+   * Example:
+   *
+   * bitmap: [0b10001000, 0b01000000, 0b00000000, 0b00000000]
+   * signerIndices: [0, 4, 9]
+   *
+   * @returns An array of signer indices.
+   * @group Implementation
+   * @category Serialization
+   */
+  bitMapToSignerIndices(): number[] {
+    const signerIndices: number[] = [];
+    for (let i = 0; i < this.bitmap.length; i += 1) {
+      const byte = this.bitmap[i];
+      for (let bit = 0; bit < 8; bit += 1) {
+        if ((byte & (128 >> bit)) !== 0) {
+          signerIndices.push(i * 8 + bit);
+        }
+      }
+    }
+    return signerIndices;
+  }
+
   // region Serializable
 
   serialize(serializer: Serializer): void {

package/src/core/crypto/publicKey.ts

@@ -1,3 +1,4 @@
+import { AptosConfig } from "../../api";
 import { Serializable } from "../../bcs";
 import { HexInput } from "../../types";
 import { AuthenticationKey } from "../authenticationKey";
@@ -17,6 +18,23 @@ export interface VerifySignatureArgs {
   signature: Signature;
 }
 
+/**
+ * Represents the arguments required to verify a digital signature asynchronously.
+ *
+ * The validity of certain types of signatures are dependent on network state.  This is the case for
+ * Keyless signatures which need to lookup the verification key and keyless configuration.
+ *
+ * @param aptosConfig - The Aptos configuration to use
+ * @param message - The original message that was signed.
+ * @param signature - The signature to be verified against the message.
+ * @group Implementation
+ * @category Serialization
+ */
+export type VerifySignatureAsyncArgs = VerifySignatureArgs & {
+  aptosConfig: AptosConfig;
+  options?: any;
+};
+
 /**
  * Represents an abstract public key.
  *
@@ -35,6 +53,16 @@ export abstract class PublicKey extends Serializable {
    */
   abstract verifySignature(args: VerifySignatureArgs): boolean;
 
+  /**
+   * Verifies signature with the public key and makes any network calls required to get state required to verify the signature.
+   * @param args.aptosConfig The Aptos configuration
+   * @param args.message The message that was signed
+   * @param args.signature The signature to verify
+   * @group Implementation
+   * @category Serialization
+   */
+  abstract verifySignatureAsync(args: VerifySignatureAsyncArgs): Promise<boolean>;
+
   /**
    * Get the raw public key bytes
    * @group Implementation

package/src/core/crypto/secp256k1.ts

@@ -9,9 +9,10 @@ import { Hex } from "../hex";
 import { HexInput, PrivateKeyVariants } from "../../types";
 import { isValidBIP44Path, mnemonicToSeed } from "./hdKey";
 import { PrivateKey } from "./privateKey";
-import { PublicKey, VerifySignatureArgs } from "./publicKey";
+import { PublicKey } from "./publicKey";
 import { Signature } from "./signature";
 import { convertSigningMessage } from "./utils";
+import { AptosConfig } from "../../api";
 
 /**
  * Represents a Secp256k1 ECDSA public key.
@@ -69,7 +70,7 @@ export class Secp256k1PublicKey extends PublicKey {
    * @group Implementation
    * @category Serialization
    */
-  verifySignature(args: VerifySignatureArgs): boolean {
+  verifySignature(args: { message: HexInput; signature: Secp256k1Signature }): boolean {
     const { message, signature } = args;
     const messageToVerify = convertSigningMessage(message);
     const messageBytes = Hex.fromHexInput(messageToVerify).toUint8Array();
@@ -78,6 +79,28 @@ export class Secp256k1PublicKey extends PublicKey {
     return secp256k1.verify(signatureBytes, messageSha3Bytes, this.key.toUint8Array(), { lowS: true });
   }
 
+  /**
+   * Note: Secp256k1Signatures can be verified syncronously.
+   *
+   * Verifies the provided signature against the given message.
+   * This function helps ensure the integrity and authenticity of the message by confirming that the signature is valid.
+   *
+   * @param args - The arguments for signature verification.
+   * @param args.aptosConfig - The configuration object for connecting to the Aptos network
+   * @param args.message - The message that was signed.
+   * @param args.signature - The signature to verify, which must be an instance of Secp256k1Signature.
+   * @returns A boolean indicating whether the signature is valid for the given message.
+   * @group Implementation
+   * @category Serialization
+   */
+  async verifySignatureAsync(args: {
+    aptosConfig: AptosConfig;
+    message: HexInput;
+    signature: Secp256k1Signature;
+  }): Promise<boolean> {
+    return this.verifySignature(args);
+  }
+
   /**
    * Get the data as a Uint8Array representation.
    *

package/src/core/crypto/singleKey.ts

@@ -1,12 +1,18 @@
 import { Deserializer, Serializer } from "../../bcs";
-import { AnyPublicKeyVariant, AnySignatureVariant, SigningScheme as AuthenticationKeyScheme } from "../../types";
+import {
+  AnyPublicKeyVariant,
+  AnySignatureVariant,
+  SigningScheme as AuthenticationKeyScheme,
+  HexInput,
+} from "../../types";
 import { AuthenticationKey } from "../authenticationKey";
 import { Ed25519PrivateKey, Ed25519PublicKey, Ed25519Signature } from "./ed25519";
-import { AccountPublicKey, PublicKey, VerifySignatureArgs } from "./publicKey";
+import { AccountPublicKey, PublicKey, VerifySignatureArgs, VerifySignatureAsyncArgs } from "./publicKey";
 import { Secp256k1PrivateKey, Secp256k1PublicKey, Secp256k1Signature } from "./secp256k1";
 import { KeylessPublicKey, KeylessSignature } from "./keyless";
 import { Signature } from "./signature";
 import { FederatedKeylessPublicKey } from "./federatedKeyless";
+import { AptosConfig } from "../../api";
 
 export type PrivateKeyInput = Ed25519PrivateKey | Secp256k1PrivateKey;
 
@@ -77,18 +83,37 @@ export class AnyPublicKey extends AccountPublicKey {
    * @group Implementation
    * @category Serialization
    */
-  verifySignature(args: VerifySignatureArgs): boolean {
+  verifySignature(args: { message: HexInput; signature: AnySignature }): boolean {
     const { message, signature } = args;
-    if (!AnySignature.isInstance(signature)) {
-      return false;
-    }
-
     return this.publicKey.verifySignature({
       message,
       signature: signature.signature,
     });
   }
 
+  /**
+   * Verifies the provided signature against the given message.
+   * This function helps ensure the integrity and authenticity of the message by confirming that the signature is valid.
+   *
+   * @param args - The arguments for signature verification.
+   * @param args.aptosConfig - The configuration object for connecting to the Aptos network
+   * @param args.message - The message that was signed.
+   * @param args.signature - The signature to verify, which must be an instance of AnySignature.
+   * @returns A boolean indicating whether the signature is valid for the given message.
+   * @group Implementation
+   * @category Serialization
+   */
+  async verifySignatureAsync(args: {
+    aptosConfig: AptosConfig;
+    message: HexInput;
+    signature: AnySignature;
+  }): Promise<boolean> {
+    return await this.publicKey.verifySignatureAsync({
+      ...args,
+      signature: args.signature.signature,
+    });
+  }
+
   /**
    * Generates an authentication key from the current instance's byte representation.
    * This function is essential for creating a unique identifier for authentication purposes.

package/src/errors/index.ts

@@ -7,6 +7,7 @@ export enum KeylessErrorCategory {
   EXTERNAL_API_ERROR,
   SESSION_EXPIRED,
   INVALID_STATE,
+  INVALID_SIGNATURE,
   UNKNOWN,
 }
 
@@ -79,6 +80,20 @@ export enum KeylessErrorType {
 
   FULL_NODE_OTHER,
 
+  SIGNATURE_TYPE_INVALID,
+
+  SIGNATURE_EXPIRED,
+
+  MAX_EXPIRY_HORIZON_EXCEEDED,
+
+  EPHEMERAL_SIGNATURE_VERIFICATION_FAILED,
+
+  TRAINING_WHEELS_SIGNATURE_MISSING,
+
+  TRAINING_WHEELS_SIGNATURE_VERIFICATION_FAILED,
+
+  PROOF_VERIFICATION_FAILED,
+
   UNKNOWN,
 }
 
@@ -213,6 +228,41 @@ const KeylessErrors: { [key in KeylessErrorType]: [string, KeylessErrorCategory,
     KeylessErrorCategory.API_ERROR,
     KeylessErrorResolutionTip.SERVER_ERROR,
   ],
+  [KeylessErrorType.SIGNATURE_TYPE_INVALID]: [
+    "The signature is not a valid Keyless signature.",
+    KeylessErrorCategory.INVALID_SIGNATURE,
+    KeylessErrorResolutionTip.JOIN_SUPPORT_GROUP,
+  ],
+  [KeylessErrorType.SIGNATURE_EXPIRED]: [
+    "The ephemeral key pair used to sign the message has expired.",
+    KeylessErrorCategory.INVALID_SIGNATURE,
+    KeylessErrorResolutionTip.REAUTHENTICATE,
+  ],
+  [KeylessErrorType.MAX_EXPIRY_HORIZON_EXCEEDED]: [
+    "The expiry horizon on the signature exceeds the maximum allowed value.",
+    KeylessErrorCategory.INVALID_SIGNATURE,
+    KeylessErrorResolutionTip.REAUTHENTICATE,
+  ],
+  [KeylessErrorType.EPHEMERAL_SIGNATURE_VERIFICATION_FAILED]: [
+    "Failed to verify the ephemeral signature with the ephemeral public key.",
+    KeylessErrorCategory.INVALID_SIGNATURE,
+    KeylessErrorResolutionTip.REAUTHENTICATE,
+  ],
+  [KeylessErrorType.TRAINING_WHEELS_SIGNATURE_MISSING]: [
+    "The training wheels signature is missing but is required by the Keyless configuration.",
+    KeylessErrorCategory.INVALID_SIGNATURE,
+    KeylessErrorResolutionTip.REAUTHENTICATE,
+  ],
+  [KeylessErrorType.TRAINING_WHEELS_SIGNATURE_VERIFICATION_FAILED]: [
+    "Failed to verify the training wheels signature with the training wheels public key.",
+    KeylessErrorCategory.INVALID_SIGNATURE,
+    KeylessErrorResolutionTip.REAUTHENTICATE,
+  ],
+  [KeylessErrorType.PROOF_VERIFICATION_FAILED]: [
+    "The proof verification failed.",
+    KeylessErrorCategory.INVALID_SIGNATURE,
+    KeylessErrorResolutionTip.REAUTHENTICATE,
+  ],
   [KeylessErrorType.UNKNOWN]: [
     "An unknown error has occurred.",
     KeylessErrorCategory.UNKNOWN,

package/src/internal/account.ts

@@ -23,14 +23,16 @@ import {
   MoveStructId,
   OrderByArg,
   PaginationArgs,
+  PendingTransactionResponse,
   TokenStandardArg,
   TransactionResponse,
   WhereArg,
 } from "../types";
 import { AccountAddress, AccountAddressInput } from "../core/accountAddress";
-import { Account } from "../account";
+import { Account, Ed25519Account, MultiEd25519Account } from "../account";
 import { AnyPublicKey, Ed25519PublicKey, PrivateKey } from "../core/crypto";
 import { queryIndexer } from "./general";
+import { getModules as getModulesUtil, getModule as getModuleUtil, getInfo as getInfoUtil } from "./utils";
 import {
   GetAccountCoinsCountQuery,
   GetAccountCoinsDataQuery,
@@ -51,12 +53,15 @@ import {
   GetAccountTokensCount,
   GetAccountTransactionsCount,
 } from "../types/generated/queries";
-import { memoizeAsync } from "../utils/memoize";
 import { Secp256k1PrivateKey, AuthenticationKey, Ed25519PrivateKey, createObjectAddress } from "../core";
 import { CurrentFungibleAssetBalancesBoolExp } from "../types/generated/types";
 import { getTableItem } from "./table";
 import { APTOS_COIN } from "../utils";
 import { AptosApiError } from "../errors";
+import { signAndSubmitTransaction, generateTransaction } from "./transactionSubmission";
+import { EntryFunctionABI, RotationProofChallenge, TypeTagU8, TypeTagVector } from "../transactions";
+import { U8, MoveVector } from "../bcs";
+import { waitForTransaction } from "./transaction";
 
 /**
  * Retrieves account information for a specified account address.
@@ -70,13 +75,7 @@ export async function getInfo(args: {
   aptosConfig: AptosConfig;
   accountAddress: AccountAddressInput;
 }): Promise<AccountData> {
-  const { aptosConfig, accountAddress } = args;
-  const { data } = await getAptosFullNode<{}, AccountData>({
-    aptosConfig,
-    originMethod: "getInfo",
-    path: `accounts/${AccountAddress.from(accountAddress).toString()}`,
-  });
-  return data;
+  return getInfoUtil(args);
 }
 
 /**
@@ -96,17 +95,7 @@ export async function getModules(args: {
   accountAddress: AccountAddressInput;
   options?: PaginationArgs & LedgerVersionArg;
 }): Promise<MoveModuleBytecode[]> {
-  const { aptosConfig, accountAddress, options } = args;
-  return paginateWithObfuscatedCursor<{}, MoveModuleBytecode[]>({
-    aptosConfig,
-    originMethod: "getModules",
-    path: `accounts/${AccountAddress.from(accountAddress).toString()}/modules`,
-    params: {
-      ledger_version: options?.ledgerVersion,
-      offset: options?.offset,
-      limit: options?.limit ?? 1000,
-    },
-  });
+  return getModulesUtil(args);
 }
 
 /**
@@ -128,45 +117,7 @@ export async function getModule(args: {
   moduleName: string;
   options?: LedgerVersionArg;
 }): Promise<MoveModuleBytecode> {
-  // We don't memoize the account module by ledger version, as it's not a common use case, this would be handled
-  // by the developer directly
-  if (args.options?.ledgerVersion !== undefined) {
-    return getModuleInner(args);
-  }
-
-  return memoizeAsync(
-    async () => getModuleInner(args),
-    `module-${args.accountAddress}-${args.moduleName}`,
-    1000 * 60 * 5, // 5 minutes
-  )();
-}
-
-/**
- * Retrieves the bytecode of a specified module from a given account address.
- *
- * @param args - The parameters for retrieving the module bytecode.
- * @param args.aptosConfig - The configuration for connecting to the Aptos network.
- * @param args.accountAddress - The address of the account from which to retrieve the module.
- * @param args.moduleName - The name of the module to retrieve.
- * @param args.options - Optional parameters for specifying the ledger version.
- * @param args.options.ledgerVersion - The specific ledger version to query.
- * @group Implementation
- */
-async function getModuleInner(args: {
-  aptosConfig: AptosConfig;
-  accountAddress: AccountAddressInput;
-  moduleName: string;
-  options?: LedgerVersionArg;
-}): Promise<MoveModuleBytecode> {
-  const { aptosConfig, accountAddress, moduleName, options } = args;
-
-  const { data } = await getAptosFullNode<{}, MoveModuleBytecode>({
-    aptosConfig,
-    originMethod: "getModule",
-    path: `accounts/${AccountAddress.from(accountAddress).toString()}/module/${moduleName}`,
-    params: { ledger_version: options?.ledgerVersion },
-  });
-  return data;
+  return getModuleUtil(args);
 }
 
 /**
@@ -815,3 +766,194 @@ export async function isAccountExist(args: { aptosConfig: AptosConfig; authKey:
     throw new Error(`Error while looking for an account info ${accountAddress.toString()}`);
   }
 }
+
+const rotateAuthKeyAbi: EntryFunctionABI = {
+  typeParameters: [],
+  parameters: [
+    new TypeTagU8(),
+    TypeTagVector.u8(),
+    new TypeTagU8(),
+    TypeTagVector.u8(),
+    TypeTagVector.u8(),
+    TypeTagVector.u8(),
+  ],
+};
+
+/**
+ * Rotates the authentication key for a given account.
+ *
+ * @param args - The arguments for rotating the authentication key.
+ * @param args.aptosConfig - The configuration settings for the Aptos network.
+ * @param args.fromAccount - The account from which the authentication key will be rotated.
+ * @param args.toAccount - (Optional) The target account to rotate to. Required if not using toNewPrivateKey or toAuthKey.
+ * @param args.toNewPrivateKey - (Optional) The new private key to rotate to. Required if not using toAccount or toAuthKey.
+ * @param args.toAuthKey - (Optional) The new authentication key to rotate to. Can only be used with dangerouslySkipVerification=true.
+ * @param args.dangerouslySkipVerification - (Optional) If true, skips verification steps after rotation. Required when using toAuthKey.
+ *
+ * @remarks
+ * This function supports three modes of rotation:
+ * 1. Using a target Account object (toAccount)
+ * 2. Using a new private key (toNewPrivateKey)
+ * 3. Using a raw authentication key (toAuthKey) - requires dangerouslySkipVerification=true
+ *
+ * When not using dangerouslySkipVerification, the function performs additional safety checks and account setup.
+ *
+ * If the new key is a multi key, skipping verification is dangerous because verification will publish the public key onchain and
+ * prevent users from being locked out of the account from loss of knowledge of one of the public keys.
+ *
+ * @returns A promise that resolves to the pending transaction response.
+ * @throws Error if the rotation fails or verification fails.
+ *
+ * @group Implementation
+ */
+export async function rotateAuthKey(
+  args: {
+    aptosConfig: AptosConfig;
+    fromAccount: Account;
+  } & (
+    | { toAccount: Account; dangerouslySkipVerification?: never }
+    | { toNewPrivateKey: Ed25519PrivateKey; dangerouslySkipVerification?: never }
+    | { toAuthKey: AuthenticationKey; dangerouslySkipVerification: true }
+  ),
+): Promise<PendingTransactionResponse> {
+  const { aptosConfig, fromAccount, dangerouslySkipVerification } = args;
+  if ("toNewPrivateKey" in args) {
+    return rotateAuthKeyWithChallenge({
+      aptosConfig,
+      fromAccount,
+      toNewPrivateKey: args.toNewPrivateKey,
+    });
+  }
+  let authKey: AuthenticationKey;
+  if ("toAccount" in args) {
+    if (args.toAccount instanceof Ed25519Account) {
+      return rotateAuthKeyWithChallenge({ aptosConfig, fromAccount, toNewPrivateKey: args.toAccount.privateKey });
+    }
+    if (args.toAccount instanceof MultiEd25519Account) {
+      return rotateAuthKeyWithChallenge({ aptosConfig, fromAccount, toAccount: args.toAccount });
+    }
+    authKey = args.toAccount.publicKey.authKey();
+  } else if ("toAuthKey" in args) {
+    authKey = args.toAuthKey;
+  } else {
+    throw new Error("Invalid arguments");
+  }
+
+  const pendingTxn = await rotateAuthKeyUnverified({
+    aptosConfig,
+    fromAccount,
+    toAuthKey: authKey,
+  });
+
+  if (dangerouslySkipVerification === true) {
+    return pendingTxn;
+  }
+
+  const rotateAuthKeyTxnResponse = await waitForTransaction({
+    aptosConfig,
+    transactionHash: pendingTxn.hash,
+  });
+  if (!rotateAuthKeyTxnResponse.success) {
+    throw new Error(`Failed to rotate authentication key - ${rotateAuthKeyTxnResponse}`);
+  }
+
+  // Verify the rotation by setting the originating address to the new account.
+  // This verifies the rotation even if the transaction payload fails to execute successfully.
+  const verificationTxn = await generateTransaction({
+    aptosConfig,
+    sender: fromAccount.accountAddress,
+    data: {
+      function: "0x1::account::set_originating_address",
+      functionArguments: [],
+    },
+  });
+
+  return signAndSubmitTransaction({
+    aptosConfig,
+    signer: args.toAccount, // Use the new account to sign
+    transaction: verificationTxn,
+  });
+}
+
+async function rotateAuthKeyWithChallenge(
+  args: {
+    aptosConfig: AptosConfig;
+    fromAccount: Account;
+  } & ({ toNewPrivateKey: Ed25519PrivateKey } | { toAccount: MultiEd25519Account }),
+): Promise<PendingTransactionResponse> {
+  const { aptosConfig, fromAccount } = args;
+  const accountInfo = await getInfo({
+    aptosConfig,
+    accountAddress: fromAccount.accountAddress,
+  });
+
+  let newAccount: Account;
+  if ("toNewPrivateKey" in args) {
+    newAccount = Account.fromPrivateKey({ privateKey: args.toNewPrivateKey, legacy: true });
+  } else {
+    newAccount = args.toAccount;
+  }
+
+  const challenge = new RotationProofChallenge({
+    sequenceNumber: BigInt(accountInfo.sequence_number),
+    originator: fromAccount.accountAddress,
+    currentAuthKey: AccountAddress.from(accountInfo.authentication_key),
+    newPublicKey: newAccount.publicKey,
+  });
+
+  // Sign the challenge
+  const challengeHex = challenge.bcsToBytes();
+  const proofSignedByCurrentKey = fromAccount.sign(challengeHex);
+  const proofSignedByNewKey = newAccount.sign(challengeHex);
+
+  // Generate transaction
+  const rawTxn = await generateTransaction({
+    aptosConfig,
+    sender: fromAccount.accountAddress,
+    data: {
+      function: "0x1::account::rotate_authentication_key",
+      functionArguments: [
+        new U8(fromAccount.signingScheme), // from scheme
+        MoveVector.U8(fromAccount.publicKey.toUint8Array()),
+        new U8(newAccount.signingScheme), // to scheme
+        MoveVector.U8(newAccount.publicKey.toUint8Array()),
+        MoveVector.U8(proofSignedByCurrentKey.toUint8Array()),
+        MoveVector.U8(proofSignedByNewKey.toUint8Array()),
+      ],
+      abi: rotateAuthKeyAbi,
+    },
+  });
+  return signAndSubmitTransaction({
+    aptosConfig,
+    signer: fromAccount,
+    transaction: rawTxn,
+  });
+}
+
+const rotateAuthKeyUnverifiedAbi: EntryFunctionABI = {
+  typeParameters: [],
+  parameters: [TypeTagVector.u8()],
+};
+
+async function rotateAuthKeyUnverified(args: {
+  aptosConfig: AptosConfig;
+  fromAccount: Account;
+  toAuthKey: AuthenticationKey;
+}): Promise<PendingTransactionResponse> {
+  const { aptosConfig, fromAccount, toAuthKey } = args;
+  const authKey = toAuthKey;
+  const rawTxn = await generateTransaction({
+    aptosConfig,
+    sender: fromAccount.accountAddress,
+    data: {
+      function: "0x1::account::rotate_authentication_key_call",
+      functionArguments: [MoveVector.U8(authKey.toUint8Array())],
+      abi: rotateAuthKeyUnverifiedAbi,
+    },
+  });
+  return signAndSubmitTransaction({
+    aptosConfig,
+    signer: fromAccount,
+    transaction: rawTxn,
+  });
+}