@mysten/docs 0.1.32 → 0.1.34
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/llms-index.md +17 -4
- package/dist/sponsor/basic-usage.md +170 -0
- package/dist/sponsor/best-practices.md +163 -0
- package/dist/sponsor/index.md +114 -0
- package/dist/sponsor/llms-index.md +7 -0
- package/dist/sponsor/validators.md +198 -0
- package/dist/sui/cryptography/index.md +225 -0
- package/dist/sui/cryptography/keypairs.md +36 -143
- package/dist/sui/cryptography/signers/aws-kms.md +110 -0
- package/dist/sui/cryptography/signers/gcp-kms.md +91 -0
- package/dist/sui/cryptography/signers/index.md +78 -0
- package/dist/sui/cryptography/signers/ledger.md +76 -0
- package/dist/sui/cryptography/{multisig.md → signers/multisig.md} +2 -2
- package/dist/sui/cryptography/{passkey.md → signers/passkey.md} +1 -1
- package/dist/sui/cryptography/{webcrypto-signer.md → signers/webcrypto.md} +6 -6
- package/dist/sui/index.md +4 -5
- package/dist/sui/llms-index.md +9 -4
- package/dist/sui/migrations/sui-2.0/index.md +14 -1
- package/dist/sui/zklogin.md +2 -2
- package/dist/walrus/index.md +6 -0
- package/package.json +21 -21
|
@@ -0,0 +1,110 @@
|
|
|
1
|
+
# AWS KMS Signer
|
|
2
|
+
|
|
3
|
+
> Sign Sui transactions with a key stored in AWS Key Management Service
|
|
4
|
+
|
|
5
|
+
The `AwsKmsSigner` signs Sui transactions using a key held in
|
|
6
|
+
[AWS Key Management Service](https://aws.amazon.com/kms/). The private key never leaves AWS; the
|
|
7
|
+
signer sends the message to KMS and receives the signature back.
|
|
8
|
+
|
|
9
|
+
AWS KMS supports the `Ed25519`, `Secp256k1`, and `Secp256r1` schemes. The curve of the KMS key
|
|
10
|
+
determines the signature scheme (`ECC_NIST_EDWARDS25519` → `Ed25519`, `ECC_SECG_P256K1` →
|
|
11
|
+
`Secp256k1`, `ECC_NIST_P256` → `Secp256r1`). `Ed25519` is Sui's native scheme.
|
|
12
|
+
|
|
13
|
+
> **Warning:** The AWS KMS Signer requires Node.js >= 22 (the package's `engines.node` constraint) and relies on
|
|
14
|
+
> the global Web Crypto API.
|
|
15
|
+
|
|
16
|
+
## Installation
|
|
17
|
+
|
|
18
|
+
```sh npm2yarn
|
|
19
|
+
npm i @mysten/aws-kms-signer
|
|
20
|
+
```
|
|
21
|
+
|
|
22
|
+
## Creating a signer
|
|
23
|
+
|
|
24
|
+
Construct the signer with `AwsKmsSigner.fromKeyId`, passing the KMS key ID and the AWS credentials
|
|
25
|
+
and region. This is async: it fetches the public key from KMS so the signer can derive the Sui
|
|
26
|
+
address.
|
|
27
|
+
|
|
28
|
+
```typescript
|
|
29
|
+
|
|
30
|
+
const { AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_REGION, AWS_KMS_KEY_ID } = process.env;
|
|
31
|
+
|
|
32
|
+
const signer = await AwsKmsSigner.fromKeyId(AWS_KMS_KEY_ID, {
|
|
33
|
+
region: AWS_REGION,
|
|
34
|
+
accessKeyId: AWS_ACCESS_KEY_ID,
|
|
35
|
+
secretAccessKey: AWS_SECRET_ACCESS_KEY,
|
|
36
|
+
});
|
|
37
|
+
```
|
|
38
|
+
|
|
39
|
+
### Parameters
|
|
40
|
+
|
|
41
|
+
`fromKeyId(keyId, options)`
|
|
42
|
+
|
|
43
|
+
| Parameter | Type | Description |
|
|
44
|
+
| ------------------------- | ----------------------- | ---------------------------------------------------------------- |
|
|
45
|
+
| `keyId` | `string` | The AWS KMS key ID |
|
|
46
|
+
| `options.region` | `string` | The AWS region the key lives in |
|
|
47
|
+
| `options.accessKeyId` | `string` | The AWS access key ID (omit when using `credentials`) |
|
|
48
|
+
| `options.secretAccessKey` | `string` | The AWS secret access key (omit when using `credentials`) |
|
|
49
|
+
| `options.credentials` | `AwsCredentialProvider` | Optional async provider resolved before each request (see below) |
|
|
50
|
+
|
|
51
|
+
You must supply either static `accessKeyId`/`secretAccessKey` **or** a `credentials` provider.
|
|
52
|
+
|
|
53
|
+
### Using a credential provider
|
|
54
|
+
|
|
55
|
+
Instead of static keys, pass an async `credentials` provider (any function returning
|
|
56
|
+
`{ accessKeyId, secretAccessKey, sessionToken? }`). This is structurally compatible with the
|
|
57
|
+
providers from
|
|
58
|
+
[`@aws-sdk/credential-providers`](https://docs.aws.amazon.com/sdk-for-javascript/v3/developer-guide/setting-credentials-node.html),
|
|
59
|
+
so the standard AWS credential chain (SSO, IAM roles, and container/instance metadata) works out of
|
|
60
|
+
the box. Credentials are resolved before each request, so temporary credentials refresh
|
|
61
|
+
automatically once their session nears expiry.
|
|
62
|
+
|
|
63
|
+
```typescript
|
|
64
|
+
|
|
65
|
+
const signer = await AwsKmsSigner.fromKeyId(process.env.AWS_KMS_KEY_ID, {
|
|
66
|
+
region: process.env.AWS_REGION,
|
|
67
|
+
credentials: fromNodeProviderChain(),
|
|
68
|
+
});
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
`@aws-sdk/credential-providers` is **not** a dependency of this package, so install it yourself if
|
|
72
|
+
you want the AWS-provided resolvers. This keeps the signer lightweight for edge, browser, and Worker
|
|
73
|
+
runtimes, where you can instead pass static credentials or a custom resolver.
|
|
74
|
+
|
|
75
|
+
## Usage
|
|
76
|
+
|
|
77
|
+
Once created, the signer behaves like any other [`Signer`](/sui/cryptography): derive the address,
|
|
78
|
+
sign messages, and sign or execute transactions.
|
|
79
|
+
|
|
80
|
+
```typescript
|
|
81
|
+
// Derive the Sui address
|
|
82
|
+
const address = signer.getPublicKey().toSuiAddress();
|
|
83
|
+
|
|
84
|
+
// Sign a personal message
|
|
85
|
+
const message = new TextEncoder().encode('Hello, AWS KMS Signer!');
|
|
86
|
+
const { signature } = await signer.signPersonalMessage(message);
|
|
87
|
+
|
|
88
|
+
// Verify the signature
|
|
89
|
+
const isValid = await signer.getPublicKey().verifyPersonalMessage(message, signature);
|
|
90
|
+
console.log(isValid); // true
|
|
91
|
+
```
|
|
92
|
+
|
|
93
|
+
To sign and submit a transaction, pass the signer to a client:
|
|
94
|
+
|
|
95
|
+
```typescript
|
|
96
|
+
|
|
97
|
+
const client = new SuiGrpcClient({
|
|
98
|
+
network: 'testnet',
|
|
99
|
+
baseUrl: 'https://fullnode.testnet.sui.io:443',
|
|
100
|
+
});
|
|
101
|
+
|
|
102
|
+
const result = await client.signAndExecuteTransaction({ transaction, signer });
|
|
103
|
+
if (result.FailedTransaction) {
|
|
104
|
+
throw new Error('Transaction failed to execute');
|
|
105
|
+
}
|
|
106
|
+
console.log(result.Transaction.digest);
|
|
107
|
+
```
|
|
108
|
+
|
|
109
|
+
See [Cryptography](/sui/cryptography) for the full signing and verification API shared by all
|
|
110
|
+
signers.
|
|
@@ -0,0 +1,91 @@
|
|
|
1
|
+
# GCP KMS Signer
|
|
2
|
+
|
|
3
|
+
> Sign Sui transactions with a key stored in Google Cloud Key Management Service
|
|
4
|
+
|
|
5
|
+
The `GcpKmsSigner` signs Sui transactions using a key held in
|
|
6
|
+
[Google Cloud KMS](https://cloud.google.com/kms). The private key never leaves GCP; the signer sends
|
|
7
|
+
the message digest to KMS and receives the signature back.
|
|
8
|
+
|
|
9
|
+
GCP KMS supports the `Secp256k1` and `Secp256r1` schemes. The curve of the KMS key determines the
|
|
10
|
+
signature scheme (`EC_SIGN_SECP256K1_SHA256` → `Secp256k1`, `EC_SIGN_P256_SHA256` → `Secp256r1`).
|
|
11
|
+
|
|
12
|
+
## Installation
|
|
13
|
+
|
|
14
|
+
```sh npm2yarn
|
|
15
|
+
npm i @mysten/gcp-kms-signer
|
|
16
|
+
```
|
|
17
|
+
|
|
18
|
+
## Creating a signer
|
|
19
|
+
|
|
20
|
+
Construct the signer with `GcpKmsSigner.fromOptions`, identifying the key by its project, location,
|
|
21
|
+
key ring, key, and version. This is async: it fetches the public key from KMS so the signer can
|
|
22
|
+
derive the Sui address.
|
|
23
|
+
|
|
24
|
+
```typescript
|
|
25
|
+
|
|
26
|
+
const signer = await GcpKmsSigner.fromOptions({
|
|
27
|
+
projectId: 'your-google-project-id',
|
|
28
|
+
location: 'your-google-location',
|
|
29
|
+
keyRing: 'your-google-keyring',
|
|
30
|
+
cryptoKey: 'your-google-key-name',
|
|
31
|
+
cryptoKeyVersion: 'your-google-key-version',
|
|
32
|
+
});
|
|
33
|
+
```
|
|
34
|
+
|
|
35
|
+
### Parameters
|
|
36
|
+
|
|
37
|
+
`fromOptions(options)`
|
|
38
|
+
|
|
39
|
+
| Parameter | Type | Description |
|
|
40
|
+
| ------------------ | -------- | --------------------- |
|
|
41
|
+
| `projectId` | `string` | The GCP project ID |
|
|
42
|
+
| `location` | `string` | The GCP location |
|
|
43
|
+
| `keyRing` | `string` | The GCP key ring name |
|
|
44
|
+
| `cryptoKey` | `string` | The GCP key name |
|
|
45
|
+
| `cryptoKeyVersion` | `string` | The GCP key version |
|
|
46
|
+
|
|
47
|
+
If you already have a fully-qualified KMS version name, construct the signer directly with
|
|
48
|
+
`GcpKmsSigner.fromVersionName`:
|
|
49
|
+
|
|
50
|
+
```typescript
|
|
51
|
+
const signer = await GcpKmsSigner.fromVersionName(
|
|
52
|
+
'projects/p/locations/l/keyRings/r/cryptoKeys/k/cryptoKeyVersions/1',
|
|
53
|
+
);
|
|
54
|
+
```
|
|
55
|
+
|
|
56
|
+
## Usage
|
|
57
|
+
|
|
58
|
+
Once created, the signer behaves like any other [`Signer`](/sui/cryptography): derive the address,
|
|
59
|
+
sign messages, and sign or execute transactions.
|
|
60
|
+
|
|
61
|
+
```typescript
|
|
62
|
+
// Derive the Sui address
|
|
63
|
+
const address = signer.getPublicKey().toSuiAddress();
|
|
64
|
+
|
|
65
|
+
// Sign a personal message
|
|
66
|
+
const message = new TextEncoder().encode('Hello, GCP KMS Signer!');
|
|
67
|
+
const { signature } = await signer.signPersonalMessage(message);
|
|
68
|
+
|
|
69
|
+
// Verify the signature
|
|
70
|
+
const isValid = await signer.getPublicKey().verifyPersonalMessage(message, signature);
|
|
71
|
+
console.log(isValid); // true
|
|
72
|
+
```
|
|
73
|
+
|
|
74
|
+
To sign and submit a transaction, pass the signer to a client:
|
|
75
|
+
|
|
76
|
+
```typescript
|
|
77
|
+
|
|
78
|
+
const client = new SuiGrpcClient({
|
|
79
|
+
network: 'testnet',
|
|
80
|
+
baseUrl: 'https://fullnode.testnet.sui.io:443',
|
|
81
|
+
});
|
|
82
|
+
|
|
83
|
+
const result = await client.signAndExecuteTransaction({ transaction, signer });
|
|
84
|
+
if (result.FailedTransaction) {
|
|
85
|
+
throw new Error('Transaction failed to execute');
|
|
86
|
+
}
|
|
87
|
+
console.log(result.Transaction.digest);
|
|
88
|
+
```
|
|
89
|
+
|
|
90
|
+
See [Cryptography](/sui/cryptography) for the full signing and verification API shared by all
|
|
91
|
+
signers.
|
|
@@ -0,0 +1,78 @@
|
|
|
1
|
+
# Signers
|
|
2
|
+
|
|
3
|
+
> Signer implementations beyond keypairs — cloud KMS, Ledger, Web Crypto, passkeys, and multisig
|
|
4
|
+
|
|
5
|
+
In addition to the in-process [keypairs](/sui/cryptography/keypairs) built into `@mysten/sui`, the
|
|
6
|
+
SDK ecosystem ships more implementations of the [`Signer`](/sui/cryptography) interface. Some keep
|
|
7
|
+
the private key outside your application — in a cloud key-management service (KMS), on a hardware
|
|
8
|
+
wallet, or as a non-extractable browser key — while others, like
|
|
9
|
+
[multisig](/sui/cryptography/signers/multisig), combine several signers together. Because each one
|
|
10
|
+
extends the same `Signer` base class, it works anywhere a keypair does.
|
|
11
|
+
|
|
12
|
+
## External signers
|
|
13
|
+
|
|
14
|
+
These signers hold the key material outside your process. Each is published as its **own package**,
|
|
15
|
+
so you install only the one you need:
|
|
16
|
+
|
|
17
|
+
| Signer | Package | Scheme | Key lives in |
|
|
18
|
+
| ----------------- | -------------------------- | ---------------------- | --------------------------------------------------------------- |
|
|
19
|
+
| `AwsKmsSigner` | `@mysten/aws-kms-signer` | Secp256k1 or Secp256r1 | [AWS KMS](/sui/cryptography/signers/aws-kms) |
|
|
20
|
+
| `GcpKmsSigner` | `@mysten/gcp-kms-signer` | Secp256k1 or Secp256r1 | [GCP KMS](/sui/cryptography/signers/gcp-kms) |
|
|
21
|
+
| `LedgerSigner` | `@mysten/ledger-signer` | Ed25519 | [Ledger hardware wallet](/sui/cryptography/signers/ledger) |
|
|
22
|
+
| `WebCryptoSigner` | `@mysten/webcrypto-signer` | Secp256r1 | [Browser Web Crypto store](/sui/cryptography/signers/webcrypto) |
|
|
23
|
+
|
|
24
|
+
For the AWS and GCP signers, the curve of the underlying KMS key determines the signature scheme
|
|
25
|
+
(`ECC_NIST_P256` → `Secp256r1`, `ECC_SECG_P256K1` → `Secp256k1`).
|
|
26
|
+
|
|
27
|
+
> Each signer above is its own npm package — import directly from `@mysten/aws-kms-signer`,
|
|
28
|
+
> `@mysten/ledger-signer`, and so on, and depend only on the ones you use. The `@mysten/signers`
|
|
29
|
+
> package is a convenience umbrella that re-exports all four under subpaths (`@mysten/signers/aws`,
|
|
30
|
+
> `@mysten/signers/gcp`, `@mysten/signers/ledger`, `@mysten/signers/webcrypto`) if you would rather
|
|
31
|
+
> depend on a single package. The individual pages below use the standalone packages.
|
|
32
|
+
|
|
33
|
+
## Other Signer implementations
|
|
34
|
+
|
|
35
|
+
Two more `Signer` implementations live in `@mysten/sui` itself rather than in a standalone package:
|
|
36
|
+
|
|
37
|
+
- **[Passkey](/sui/cryptography/signers/passkey)**: sign with a WebAuthn passkey (biometric or
|
|
38
|
+
platform authenticator) through `PasskeyKeypair`.
|
|
39
|
+
- **[Multi-signature](/sui/cryptography/signers/multisig)**: combine signatures from several public
|
|
40
|
+
keys under a configurable threshold with `MultiSigPublicKey`. Its `getSigner` method returns a
|
|
41
|
+
`MultiSigSigner` you can use anywhere a keypair works. The underlying keys can be keypairs, KMS
|
|
42
|
+
signers, passkeys, or zkLogin identifiers.
|
|
43
|
+
|
|
44
|
+
## Shared interface
|
|
45
|
+
|
|
46
|
+
Because every signer extends `Signer`, the signing API is identical regardless of where the key is
|
|
47
|
+
held; only the way you construct the signer differs:
|
|
48
|
+
|
|
49
|
+
```typescript
|
|
50
|
+
// Derive the address
|
|
51
|
+
const address = signer.getPublicKey().toSuiAddress();
|
|
52
|
+
|
|
53
|
+
// Sign a personal message
|
|
54
|
+
const message = new TextEncoder().encode('hello world');
|
|
55
|
+
const { signature } = await signer.signPersonalMessage(message);
|
|
56
|
+
|
|
57
|
+
// Sign and execute a transaction (resolves to a discriminated union)
|
|
58
|
+
const result = await client.signAndExecuteTransaction({ transaction, signer });
|
|
59
|
+
if (result.FailedTransaction) {
|
|
60
|
+
throw new Error('Transaction failed to execute');
|
|
61
|
+
}
|
|
62
|
+
console.log(result.Transaction.digest);
|
|
63
|
+
```
|
|
64
|
+
|
|
65
|
+
See [Cryptography](/sui/cryptography) for the full signing and verification API that all signers
|
|
66
|
+
share.
|
|
67
|
+
|
|
68
|
+
## Construction
|
|
69
|
+
|
|
70
|
+
Each external signer exposes a static factory rather than a public constructor, because preparing
|
|
71
|
+
the signer requires an async round-trip to fetch the public key from the KMS or device:
|
|
72
|
+
|
|
73
|
+
- `AwsKmsSigner.fromKeyId(keyId, options)`. See [AWS KMS Signer](/sui/cryptography/signers/aws-kms).
|
|
74
|
+
- `GcpKmsSigner.fromOptions(options)`. See [GCP KMS Signer](/sui/cryptography/signers/gcp-kms).
|
|
75
|
+
- `LedgerSigner.fromDerivationPath(path, ledgerClient, suiClient)`. See
|
|
76
|
+
[Ledger Signer](/sui/cryptography/signers/ledger).
|
|
77
|
+
- `WebCryptoSigner.generate()` and `WebCryptoSigner.import(exported)`. See
|
|
78
|
+
[Web Crypto Signer](/sui/cryptography/signers/webcrypto).
|
|
@@ -0,0 +1,76 @@
|
|
|
1
|
+
# Ledger Signer
|
|
2
|
+
|
|
3
|
+
> Sign Sui transactions with a Ledger hardware wallet
|
|
4
|
+
|
|
5
|
+
The `LedgerSigner` signs Sui transactions and personal messages with a
|
|
6
|
+
[Ledger](https://www.ledger.com/) hardware wallet. The private key never leaves the device; you
|
|
7
|
+
confirm each signature on the Ledger. The Ledger signer uses the `Ed25519` scheme.
|
|
8
|
+
|
|
9
|
+
## Installation
|
|
10
|
+
|
|
11
|
+
```sh npm2yarn
|
|
12
|
+
npm i @mysten/ledger-signer @mysten/ledgerjs-hw-app-sui
|
|
13
|
+
```
|
|
14
|
+
|
|
15
|
+
You also need a
|
|
16
|
+
[Ledger transport](https://github.com/LedgerHQ/ledger-live/tree/develop/libs/ledgerjs) for your
|
|
17
|
+
environment, for example `@ledgerhq/hw-transport-node-hid` in Node.js or
|
|
18
|
+
`@ledgerhq/hw-transport-webhid` in the browser.
|
|
19
|
+
|
|
20
|
+
## Creating a signer
|
|
21
|
+
|
|
22
|
+
Open a transport, wrap it in a `SuiLedgerClient`, then construct the signer with
|
|
23
|
+
`LedgerSigner.fromDerivationPath`. This is async: it fetches the public key from the device so the
|
|
24
|
+
signer can derive the Sui address.
|
|
25
|
+
|
|
26
|
+
```typescript
|
|
27
|
+
|
|
28
|
+
const transport = await Transport.open(undefined);
|
|
29
|
+
const ledgerClient = new SuiLedgerClient(transport);
|
|
30
|
+
const suiClient = new SuiGrpcClient({
|
|
31
|
+
network: 'testnet',
|
|
32
|
+
baseUrl: 'https://fullnode.testnet.sui.io:443',
|
|
33
|
+
});
|
|
34
|
+
|
|
35
|
+
const signer = await LedgerSigner.fromDerivationPath(
|
|
36
|
+
"m/44'/784'/0'/0'/0'",
|
|
37
|
+
ledgerClient,
|
|
38
|
+
suiClient,
|
|
39
|
+
);
|
|
40
|
+
```
|
|
41
|
+
|
|
42
|
+
### Parameters
|
|
43
|
+
|
|
44
|
+
`fromDerivationPath(derivationPath, ledgerClient, suiClient)`
|
|
45
|
+
|
|
46
|
+
| Parameter | Type | Description |
|
|
47
|
+
| ---------------- | ------------------- | ----------------------------------------------------- |
|
|
48
|
+
| `derivationPath` | `string` | BIP-32 derivation path (Sui uses coin type `784`) |
|
|
49
|
+
| `ledgerClient` | `SuiLedgerClient` | A `SuiLedgerClient` wrapping an open Ledger transport |
|
|
50
|
+
| `suiClient` | `ClientWithCoreApi` | A Sui client used to resolve transaction data |
|
|
51
|
+
|
|
52
|
+
## Usage
|
|
53
|
+
|
|
54
|
+
Derive the address, then sign a transaction or personal message. The user confirms each signature on
|
|
55
|
+
the device.
|
|
56
|
+
|
|
57
|
+
```typescript
|
|
58
|
+
|
|
59
|
+
// Derive the Sui address
|
|
60
|
+
const address = signer.toSuiAddress();
|
|
61
|
+
|
|
62
|
+
// Build and sign a transaction
|
|
63
|
+
const transaction = new Transaction();
|
|
64
|
+
const transactionBytes = await transaction.build({ client: suiClient });
|
|
65
|
+
const { signature } = await signer.signTransaction(transactionBytes);
|
|
66
|
+
|
|
67
|
+
// Or sign a personal message
|
|
68
|
+
const message = new TextEncoder().encode('Hello, Ledger Signer!');
|
|
69
|
+
await signer.signPersonalMessage(message);
|
|
70
|
+
```
|
|
71
|
+
|
|
72
|
+
> **Warning:** The Ledger signer supports only `signTransaction` and `signPersonalMessage`. It does not support
|
|
73
|
+
> the generic `sign` and `signWithIntent` methods, which throw an error because the device only
|
|
74
|
+
> signs recognized transaction and message payloads.
|
|
75
|
+
|
|
76
|
+
See [Cryptography](/sui/cryptography) for the signing and verification API shared by all signers.
|
|
@@ -6,8 +6,8 @@ The Sui TypeScript SDK provides a `MultiSigPublicKey` class to support
|
|
|
6
6
|
[Multi-Signature](https://docs.sui.io/concepts/cryptography/transaction-auth/multisig) (MultiSig)
|
|
7
7
|
transaction and personal message signing.
|
|
8
8
|
|
|
9
|
-
This class implements the same interface as the `PublicKey` classes that [Keypairs](
|
|
10
|
-
and you call the same methods to verify signatures for `PersonalMessages` and `Transactions`.
|
|
9
|
+
This class implements the same interface as the `PublicKey` classes that [Keypairs](../keypairs)
|
|
10
|
+
uses and you call the same methods to verify signatures for `PersonalMessages` and `Transactions`.
|
|
11
11
|
|
|
12
12
|
## Creating a MultiSigPublicKey
|
|
13
13
|
|
|
@@ -90,7 +90,7 @@ work.
|
|
|
90
90
|
|
|
91
91
|
The usage for a passkey keypair is the same as any other keypair. You can derive the public key,
|
|
92
92
|
derive the address, sign personal messages, sign transactions, and verify signatures. See the
|
|
93
|
-
[Key pairs](
|
|
93
|
+
[Key pairs](../keypairs) documentation for more details.
|
|
94
94
|
|
|
95
95
|
```typescript
|
|
96
96
|
const publicKey = keypair.getPublicKey();
|
|
@@ -1,13 +1,13 @@
|
|
|
1
1
|
# Web Crypto Signer
|
|
2
2
|
|
|
3
|
-
> Sign transactions using the Web Crypto API for secure browser-based key management
|
|
3
|
+
> Sign transactions using the Web Crypto API for secure browser-based key management
|
|
4
4
|
|
|
5
5
|
For cases where you need to create keypairs directly within client apps, you can use the Web Crypto
|
|
6
6
|
Signer. This signer leverages the
|
|
7
7
|
[Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API) to provide a
|
|
8
|
-
secure and efficient way to generate and manage cryptographic keys in the browser.
|
|
9
|
-
|
|
10
|
-
|
|
8
|
+
secure and efficient way to generate and manage cryptographic keys in the browser. It generates
|
|
9
|
+
`Secp256r1` keys that you can persist between sessions, and that client-side code (including
|
|
10
|
+
extensions) cannot extract.
|
|
11
11
|
|
|
12
12
|
Common use cases for the Web Crypto Signer include:
|
|
13
13
|
|
|
@@ -68,8 +68,8 @@ const keypair = await WebCryptoSigner.import(exported);
|
|
|
68
68
|
## Usage
|
|
69
69
|
|
|
70
70
|
The usage for a Web Crypto signer is the same as any other keypair. You can derive the public key,
|
|
71
|
-
derive the address, sign personal messages, sign transactions, and verify signatures. See
|
|
72
|
-
[
|
|
71
|
+
derive the address, sign personal messages, sign transactions, and verify signatures. See
|
|
72
|
+
[Cryptography](/sui/cryptography) for more details.
|
|
73
73
|
|
|
74
74
|
```typescript
|
|
75
75
|
const publicKey = keypair.getPublicKey();
|
package/dist/sui/index.md
CHANGED
|
@@ -34,11 +34,10 @@ what you need to keep your code light and compact.
|
|
|
34
34
|
with transactions.
|
|
35
35
|
- [`@mysten/sui/keypairs/*`](/sui/cryptography/keypairs): Modular exports for specific KeyPair
|
|
36
36
|
implementations.
|
|
37
|
-
- [`@mysten/sui/verify`](/sui/cryptography
|
|
38
|
-
|
|
39
|
-
- [`@mysten/sui/cryptography`](/sui/cryptography
|
|
40
|
-
|
|
41
|
-
- [`@mysten/sui/multisig`](/sui/cryptography/multisig): Utilities for working with multisig
|
|
37
|
+
- [`@mysten/sui/verify`](/sui/cryptography#verifying-signatures): Methods for verifying transactions
|
|
38
|
+
and messages.
|
|
39
|
+
- [`@mysten/sui/cryptography`](/sui/cryptography): Shared types and classes for cryptography.
|
|
40
|
+
- [`@mysten/sui/multisig`](/sui/cryptography/signers/multisig): Utilities for working with multisig
|
|
42
41
|
signatures.
|
|
43
42
|
- [`@mysten/sui/utils`](/sui/utils): Utilities for formatting and parsing various Sui types.
|
|
44
43
|
- [`@mysten/sui/faucet`](#faucet): Methods for requesting SUI from a faucet.
|
package/dist/sui/llms-index.md
CHANGED
|
@@ -13,10 +13,15 @@
|
|
|
13
13
|
- [Coins and Balances](./transactions/coins-and-balances.md): Work with coin objects and address balances in transactions
|
|
14
14
|
- [Commands and Inputs Reference](./transactions/reference.md): Complete reference for transaction commands and input types
|
|
15
15
|
- [Building Offline](./transactions/offline.md): Build transactions without a network connection
|
|
16
|
-
- [
|
|
17
|
-
- [
|
|
18
|
-
- [
|
|
19
|
-
- [
|
|
16
|
+
- [Cryptography](./cryptography.md): Sign and verify Sui transactions and messages with keypairs and external signers
|
|
17
|
+
- [Key pairs](./cryptography/keypairs.md): Create Ed25519, Secp256k1, and Secp256r1 keypairs and derive them from mnemonics and secret keys
|
|
18
|
+
- [Signers](./cryptography/signers.md): Signer implementations beyond keypairs — cloud KMS, Ledger, Web Crypto, passkeys, and multisig
|
|
19
|
+
- [AWS KMS Signer](./cryptography/signers/aws-kms.md): Sign Sui transactions with a key stored in AWS Key Management Service
|
|
20
|
+
- [GCP KMS Signer](./cryptography/signers/gcp-kms.md): Sign Sui transactions with a key stored in Google Cloud Key Management Service
|
|
21
|
+
- [Ledger Signer](./cryptography/signers/ledger.md): Sign Sui transactions with a Ledger hardware wallet
|
|
22
|
+
- [Web Crypto Signer](./cryptography/signers/webcrypto.md): Sign transactions using the Web Crypto API for secure browser-based key management
|
|
23
|
+
- [Passkey](./cryptography/signers/passkey.md): Use WebAuthn passkeys for Sui transaction signing.
|
|
24
|
+
- [Multi-Signature Transactions](./cryptography/signers/multisig.md): Create multi-signature transactions with multiple signers on Sui.
|
|
20
25
|
- [The `@mysten/sui/utils` package](./utils.md): Utility functions for addresses, coins, and common operations in the Sui TypeScript SDK.
|
|
21
26
|
- [Derived Objects](./utils/derived_objects.md): Compute derived object IDs from parent objects for deterministic offline derivation.
|
|
22
27
|
- [BCS](./bcs.md): Binary Canonical Serialization for encoding Sui Move types.
|
|
@@ -155,4 +155,17 @@ For wallet builders and SDK maintainers building on the Sui ecosystem:
|
|
|
155
155
|
- **[Wallet builders](/sui/migrations/sui-2.0/wallet-builders):** Guide for wallet implementations
|
|
156
156
|
adapting to `reportTransactionEffects` removal and new core API response format
|
|
157
157
|
- **[SDK maintainers](/sui/migrations/sui-2.0/sdk-maintainers):** Guide for SDK authors migrating to
|
|
158
|
-
`ClientWithCoreApi` and the new transport-agnostic architecture
|
|
158
|
+
`ClientWithCoreApi` and the new transport-agnostic architecture
|
|
159
|
+
|
|
160
|
+
## Non-existent objects
|
|
161
|
+
|
|
162
|
+
When migrating from the v1 SDK to the v2 SDK, review any code paths that read objects or dynamic
|
|
163
|
+
fields that may not exist.
|
|
164
|
+
|
|
165
|
+
In v1, methods such as `core.getObject` and `getDynamicField` return `null` when the requested
|
|
166
|
+
object or field does not exist. In v2, the same operations throw an exception instead. Applications
|
|
167
|
+
that previously relied on `null` checks should be updated to handle exceptions appropriately, either
|
|
168
|
+
through try/catch blocks or by validating object existence before attempting to read it.
|
|
169
|
+
|
|
170
|
+
This behavioral change may require updates to error handling logic to avoid unexpected runtime
|
|
171
|
+
failures after migration.
|
package/dist/sui/zklogin.md
CHANGED
|
@@ -46,8 +46,8 @@ const address = computeZkLoginAddress({
|
|
|
46
46
|
});
|
|
47
47
|
```
|
|
48
48
|
|
|
49
|
-
To use zkLogin inside a multisig, see the [Multisig Guide](../sui/cryptography/multisig) for
|
|
50
|
-
details.
|
|
49
|
+
To use zkLogin inside a multisig, see the [Multisig Guide](../sui/cryptography/signers/multisig) for
|
|
50
|
+
more details.
|
|
51
51
|
|
|
52
52
|
## Legacy addresses
|
|
53
53
|
|
package/dist/walrus/index.md
CHANGED
|
@@ -552,6 +552,12 @@ const nextConfig: NextConfig = {
|
|
|
552
552
|
};
|
|
553
553
|
```
|
|
554
554
|
|
|
555
|
+
This is the same setting for both the webpack and Turbopack (`next dev --turbo`) bundlers. Without
|
|
556
|
+
it, bundling the WASM loader into a server route can break how it locates the binary at runtime;
|
|
557
|
+
Turbopack in particular surfaces this as a virtualized path such as `/ROOT/...`. If you cannot use
|
|
558
|
+
`serverExternalPackages`, point `wasmUrl` at the web build as shown in the Vite example above, which
|
|
559
|
+
resolves the binary through `import.meta.url` instead of the filesystem.
|
|
560
|
+
|
|
555
561
|
## Known fetch limitations
|
|
556
562
|
|
|
557
563
|
- Some nodes can be slow to respond. When running in Node.js, the default `connectTimeout` is 10
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@mysten/docs",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.34",
|
|
4
4
|
"description": "LLM-friendly documentation for the Sui TypeScript SDK ecosystem",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -28,28 +28,28 @@
|
|
|
28
28
|
"next": "^16.2.9",
|
|
29
29
|
"react": "^19.2.7",
|
|
30
30
|
"react-dom": "^19.2.7",
|
|
31
|
-
"@mysten/aws-kms-signer": "0.
|
|
32
|
-
"@mysten/dapp-kit-
|
|
33
|
-
"@mysten/dapp-kit": "1.1.1",
|
|
31
|
+
"@mysten/aws-kms-signer": "0.3.0",
|
|
32
|
+
"@mysten/dapp-kit-react": "2.1.5",
|
|
34
33
|
"@mysten/bcs": "2.1.0",
|
|
35
|
-
"@mysten/dapp-kit-
|
|
36
|
-
"@mysten/
|
|
37
|
-
"@mysten/
|
|
38
|
-
"@mysten/enoki
|
|
39
|
-
"@mysten/
|
|
40
|
-
"@mysten/
|
|
41
|
-
"@mysten/
|
|
42
|
-
"@mysten/
|
|
43
|
-
"@mysten/
|
|
44
|
-
"@mysten/
|
|
45
|
-
"@mysten/
|
|
46
|
-
"@mysten/
|
|
47
|
-
"@mysten/payment-kit": "0.2.1",
|
|
34
|
+
"@mysten/dapp-kit-core": "1.6.3",
|
|
35
|
+
"@mysten/dapp-kit": "1.1.3",
|
|
36
|
+
"@mysten/deepbook-v3": "1.5.3",
|
|
37
|
+
"@mysten/enoki": "1.2.1",
|
|
38
|
+
"@mysten/kiosk": "1.3.3",
|
|
39
|
+
"@mysten/enoki-connect": "1.1.3",
|
|
40
|
+
"@mysten/gcp-kms-signer": "0.2.3",
|
|
41
|
+
"@mysten/ledger-signer": "0.2.3",
|
|
42
|
+
"@mysten/payment-kit": "0.2.3",
|
|
43
|
+
"@mysten/seal": "1.2.3",
|
|
44
|
+
"@mysten/signers": "1.1.3",
|
|
45
|
+
"@mysten/slush-wallet": "1.1.3",
|
|
48
46
|
"@mysten/utils": "0.4.0",
|
|
49
|
-
"@mysten/wallet-standard": "0.21.
|
|
50
|
-
"@mysten/
|
|
51
|
-
"@mysten/
|
|
52
|
-
"@mysten/zksend": "1.2.
|
|
47
|
+
"@mysten/wallet-standard": "0.21.3",
|
|
48
|
+
"@mysten/webcrypto-signer": "0.2.3",
|
|
49
|
+
"@mysten/walrus": "1.2.3",
|
|
50
|
+
"@mysten/zksend": "1.2.3",
|
|
51
|
+
"@mysten/suins": "1.2.3",
|
|
52
|
+
"@mysten/sui": "2.20.1"
|
|
53
53
|
},
|
|
54
54
|
"devDependencies": {
|
|
55
55
|
"@tailwindcss/postcss": "^4.3.1",
|