@ember-finance/sdk 2.0.6 → 2.0.7

package/dist/src/evm-vaults/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./interfaces/index.js";
 export * from "./on-chain-calls/index.js";
+export * from "./signers/index.js";
 export * from "./utils/index.js";
 /**
  * Converts an EVM address to bytes32 format

package/dist/src/evm-vaults/index.js

@@ -1,5 +1,6 @@
 export * from "./interfaces/index.js";
 export * from "./on-chain-calls/index.js";
+export * from "./signers/index.js";
 export * from "./utils/index.js";
 /**
  * Converts an EVM address to bytes32 format

package/dist/src/evm-vaults/signers/evm-kms-signer.d.ts

@@ -0,0 +1,42 @@
+import { KMSClient } from "@aws-sdk/client-kms";
+import { AbstractSigner, Provider, TransactionRequest, TypedDataDomain, TypedDataField } from "ethers";
+export interface EvmKmsSignerOptions {
+    /** KMS key ID, ARN, or alias (e.g. "alias/ember-vaults-ops-evm-manager-wallet"). */
+    keyId: string;
+    /** AWS region. Defaults to AWS_REGION env or the SDK default. */
+    region?: string;
+    /** Pre-built KMSClient. If supplied, `region` is ignored. */
+    kmsClient?: KMSClient;
+}
+/**
+ * EvmKmsSigner is an ethers v6 Signer backed by an AWS KMS asymmetric key
+ * with usage `SIGN_VERIFY` and key spec `ECC_SECG_P256K1` (secp256k1). The
+ * private material never leaves KMS; every signing operation is one
+ * `kms:Sign` call.
+ *
+ * Caches the public key after first use so subsequent signs do not re-hit
+ * KMS for the address.
+ *
+ * Compatible with ethers v6. Pair with a Provider via `connect(provider)`
+ * before submitting transactions.
+ */
+export declare class EvmKmsSigner extends AbstractSigner {
+    private readonly kms;
+    private readonly keyId;
+    private addressCache;
+    private uncompressedPubKeyCache;
+    constructor(opts: EvmKmsSignerOptions, provider?: Provider | null);
+    connect(provider: Provider | null): EvmKmsSigner;
+    getAddress(): Promise<string>;
+    signMessage(message: string | Uint8Array): Promise<string>;
+    signTypedData(domain: TypedDataDomain, types: Record<string, Array<TypedDataField>>, value: Record<string, unknown>): Promise<string>;
+    signTransaction(tx: TransactionRequest): Promise<string>;
+    /** Returns a 65-byte compact signature as a 0x-prefixed hex string. */
+    private signDigest;
+    /**
+     * Sends the digest to KMS, decodes the DER signature, normalises s,
+     * and recovers the y-parity by matching against our address.
+     */
+    private signDigestRaw;
+    private getUncompressedPublicKey;
+}

package/dist/src/evm-vaults/signers/evm-kms-signer.js

@@ -0,0 +1,143 @@
+import { GetPublicKeyCommand, KMSClient, MessageType, SignCommand, SigningAlgorithmSpec } from "@aws-sdk/client-kms";
+import { secp256k1 } from "@noble/curves/secp256k1.js";
+import asn1 from "asn1.js";
+import { AbstractSigner, computeAddress, getBytes, hashMessage, resolveAddress, Signature, SigningKey, Transaction, TypedDataEncoder } from "ethers";
+// ASN.1 schemas for the DER blobs AWS KMS returns.
+//
+// GetPublicKey returns SubjectPublicKeyInfo (RFC 5480 §2):
+//   SEQUENCE { algo: AlgorithmIdentifier, pubKey: BIT STRING }
+//   The bit string contains the SEC1 uncompressed point (0x04 || X || Y).
+//
+// Sign returns DER ECDSA signature (RFC 3279 §2.2.3):
+//   SEQUENCE { r: INTEGER, s: INTEGER }
+const EcdsaPubKeyAsn = asn1.define("EcdsaPubKey", function () {
+    this.seq().obj(this.key("algo")
+        .seq()
+        .obj(this.key("algorithm").objid(), this.key("parameters").objid()), this.key("pubKey").bitstr());
+});
+const EcdsaSigAsn = asn1.define("EcdsaSig", function () {
+    this.seq().obj(this.key("r").int(), this.key("s").int());
+});
+/**
+ * EvmKmsSigner is an ethers v6 Signer backed by an AWS KMS asymmetric key
+ * with usage `SIGN_VERIFY` and key spec `ECC_SECG_P256K1` (secp256k1). The
+ * private material never leaves KMS; every signing operation is one
+ * `kms:Sign` call.
+ *
+ * Caches the public key after first use so subsequent signs do not re-hit
+ * KMS for the address.
+ *
+ * Compatible with ethers v6. Pair with a Provider via `connect(provider)`
+ * before submitting transactions.
+ */
+export class EvmKmsSigner extends AbstractSigner {
+    constructor(opts, provider = null) {
+        super(provider);
+        this.keyId = opts.keyId;
+        this.kms = opts.kmsClient ?? new KMSClient({ region: opts.region });
+    }
+    connect(provider) {
+        const next = new EvmKmsSigner({ keyId: this.keyId, kmsClient: this.kms }, provider);
+        // Carry caches over so reconnecting doesn't force a re-fetch.
+        next.uncompressedPubKeyCache = this.uncompressedPubKeyCache;
+        next.addressCache = this.addressCache;
+        return next;
+    }
+    async getAddress() {
+        if (this.addressCache)
+            return this.addressCache;
+        const pub = await this.getUncompressedPublicKey();
+        // ethers' computeAddress accepts a 0x04-prefixed uncompressed key
+        // and returns a checksummed address.
+        this.addressCache = computeAddress("0x" + Buffer.from(pub).toString("hex"));
+        return this.addressCache;
+    }
+    async signMessage(message) {
+        return this.signDigest(hashMessage(message));
+    }
+    async signTypedData(domain, types, value) {
+        // Resolve any ENS-style names that EIP-712 allows in the domain/types.
+        const populated = await TypedDataEncoder.resolveNames(domain, types, value, async (name) => {
+            if (!this.provider) {
+                throw new Error("EvmKmsSigner.signTypedData: name resolution requires a provider");
+            }
+            const addr = await this.provider.resolveName(name);
+            if (!addr)
+                throw new Error(`unable to resolve name: ${name}`);
+            return addr;
+        });
+        return this.signDigest(TypedDataEncoder.hash(populated.domain, types, populated.value));
+    }
+    async signTransaction(tx) {
+        // ethers requires `from` to be absent on a serialized signed tx —
+        // it gets recovered from the signature. Validate it matches us.
+        if (tx.from != null) {
+            const expected = await this.getAddress();
+            const from = await resolveAddress(tx.from, this.provider);
+            if (from.toLowerCase() !== expected.toLowerCase()) {
+                throw new Error(`EvmKmsSigner.signTransaction: from=${from} does not match signer=${expected}`);
+            }
+            tx = { ...tx, from: undefined };
+        }
+        // ethers' TransactionRequest and TransactionLike overlap structurally
+        // but aren't unifiable in the type system; Transaction.from accepts
+        // the looser shape at runtime.
+        const txObj = Transaction.from(tx);
+        const sig = await this.signDigestRaw(txObj.unsignedHash);
+        txObj.signature = sig;
+        return txObj.serialized;
+    }
+    /** Returns a 65-byte compact signature as a 0x-prefixed hex string. */
+    async signDigest(digest) {
+        const sig = await this.signDigestRaw(digest);
+        return sig.serialized;
+    }
+    /**
+     * Sends the digest to KMS, decodes the DER signature, normalises s,
+     * and recovers the y-parity by matching against our address.
+     */
+    async signDigestRaw(digest) {
+        const digestBytes = getBytes(digest);
+        const res = await this.kms.send(new SignCommand({
+            KeyId: this.keyId,
+            Message: digestBytes,
+            MessageType: MessageType.DIGEST,
+            SigningAlgorithm: SigningAlgorithmSpec.ECDSA_SHA_256
+        }));
+        if (!res.Signature) {
+            throw new Error("EvmKmsSigner: KMS Sign returned no Signature");
+        }
+        const decoded = EcdsaSigAsn.decode(Buffer.from(res.Signature), "der");
+        const r = BigInt("0x" + decoded.r.toString(16).padStart(64, "0"));
+        let s = BigInt("0x" + decoded.s.toString(16).padStart(64, "0"));
+        // EIP-2: only accept low-s signatures. KMS happily returns either side.
+        const N = secp256k1.Point.Fn.ORDER;
+        if (s > N / 2n)
+            s = N - s;
+        const rHex = "0x" + r.toString(16).padStart(64, "0");
+        const sHex = "0x" + s.toString(16).padStart(64, "0");
+        // Recover the right y-parity by trying both candidates and matching
+        // against the address we know belongs to this KMS key.
+        const expectedAddr = (await this.getAddress()).toLowerCase();
+        for (const yParity of [0, 1]) {
+            const candidate = Signature.from({ r: rHex, s: sHex, yParity });
+            const recoveredPubKey = SigningKey.recoverPublicKey(digestBytes, candidate);
+            if (computeAddress(recoveredPubKey).toLowerCase() === expectedAddr) {
+                return candidate;
+            }
+        }
+        throw new Error("EvmKmsSigner: recovered address does not match KMS key — signature integrity failure");
+    }
+    async getUncompressedPublicKey() {
+        if (this.uncompressedPubKeyCache)
+            return this.uncompressedPubKeyCache;
+        const res = await this.kms.send(new GetPublicKeyCommand({ KeyId: this.keyId }));
+        if (!res.PublicKey) {
+            throw new Error("EvmKmsSigner: KMS GetPublicKey returned no PublicKey");
+        }
+        const decoded = EcdsaPubKeyAsn.decode(Buffer.from(res.PublicKey), "der");
+        // pubKey.data is the SEC1 uncompressed point (0x04 || X || Y), 65 bytes.
+        this.uncompressedPubKeyCache = new Uint8Array(decoded.pubKey.data);
+        return this.uncompressedPubKeyCache;
+    }
+}

package/dist/src/evm-vaults/signers/index.d.ts

@@ -0,0 +1 @@
+export * from "./evm-kms-signer.js";

package/dist/src/evm-vaults/signers/index.js

@@ -0,0 +1 @@
+export * from "./evm-kms-signer.js";

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@ember-finance/sdk",
     "description": "Ember Protocol SDK",
-    "version": "2.0.6",
+    "version": "2.0.7",
     "type": "module",
     "module": "./dist/index.js",
     "main": "./dist/index.js",
@@ -79,14 +79,16 @@
         "test": "tests"
     },
     "dependencies": {
+        "@aws-sdk/client-kms": "^3.1044.0",
         "@firefly-exchange/library-sui": "^3.0.0",
+        "@noble/curves": "^2.2.0",
+        "asn1.js": "^5.4.1",
         "axios": "1.13.6",
         "yarn": "^1.22.19"
     },
     "devDependencies": {
         "@mysten/bcs": "^2.0.3",
         "@mysten/sui": "^2.0.0",
-        "ethers": "6.13.4",
         "@openapitools/openapi-generator-cli": "^2.24.0",
         "@types/chai": "^4.3.3",
         "@types/chai-as-promised": "^7.1.5",
@@ -101,6 +103,7 @@
         "eslint-plugin-import": "^2.25.2",
         "eslint-plugin-n": "^15.0.0",
         "eslint-plugin-promise": "^6.0.0",
+        "ethers": "6.13.4",
         "git-format-staged": "^3.0.0",
         "husky": "^8.0.0",
         "mocha": "^10.1.0",