@mysten/sui 2.19.0 → 2.20.0

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @mysten/sui.js
 
+## 2.20.0
+
+### Minor Changes
+
+- 7452835: Add `ZkLoginSigner`, a transport- and provider-agnostic zkLogin signer. It wraps any
+  ephemeral `Signer` and transforms its signatures into zkLogin signatures using the supplied proof
+  `inputs` and `maxEpoch`:
+  `new ZkLoginSigner({ ephemeralSigner, maxEpoch, inputs, legacyAddress })`. The address is derived
+  from the proof; `legacyAddress` is a required boolean (consistent with `jwtToAddress`,
+  `toZkLoginPublicIdentifier`, and the other zkLogin address APIs). Optionally pass `address` to
+  validate the derived address (throws on mismatch) and `client` to make the derived public key able
+  to verify signatures. Like other composite signers (e.g. `MultiSigSigner`), calling `sign()`
+  directly throws — use `signTransaction` / `signPersonalMessage`.
+
+  Also adds a read-only `legacyAddress` getter to `ZkLoginPublicIdentifier`.
+
 ## 2.19.0
 
 ### Minor Changes

package/dist/bcs/bcs.d.mts

@@ -1,21 +1,21 @@
 import { TypeTag as TypeTag$1 } from "./types.mjs";
-import * as _mysten_bcs823 from "@mysten/bcs";
+import * as _mysten_bcs810 from "@mysten/bcs";
 import { BcsType } from "@mysten/bcs";
 
 //#region src/bcs/bcs.d.ts
 declare const TypeTag: BcsType<string, string | TypeTag$1, string>;
-declare function IntentMessage<T extends BcsType<any>>(T: T): _mysten_bcs823.BcsStruct<{
-  intent: _mysten_bcs823.BcsStruct<{
-    scope: _mysten_bcs823.BcsEnum<{
+declare function IntentMessage<T extends BcsType<any>>(T: T): _mysten_bcs810.BcsStruct<{
+  intent: _mysten_bcs810.BcsStruct<{
+    scope: _mysten_bcs810.BcsEnum<{
       TransactionData: null;
       TransactionEffects: null;
       CheckpointSummary: null;
       PersonalMessage: null;
     }, "IntentScope">;
-    version: _mysten_bcs823.BcsEnum<{
+    version: _mysten_bcs810.BcsEnum<{
       V0: null;
     }, "IntentVersion">;
-    appId: _mysten_bcs823.BcsEnum<{
+    appId: _mysten_bcs810.BcsEnum<{
       Sui: null;
     }, "AppId">;
   }, string>;

package/dist/bcs/index.d.mts

@@ -545,7 +545,7 @@ declare const suiBcs: {
           version: string;
           digest: string;
         };
-      }, "ImmOrOwnedObject" | "SharedObject" | "Receiving">;
+      }, "Receiving" | "ImmOrOwnedObject" | "SharedObject">;
       FundsWithdrawal: {
         reservation: {
           MaxAmountU64: string;
@@ -560,7 +560,7 @@ declare const suiBcs: {
           Sponsor: true;
         }, "Sender" | "Sponsor">;
       };
-    }, "Pure" | "Object" | "FundsWithdrawal">[], Iterable<_mysten_bcs0.EnumInputShape<{
+    }, "Object" | "Pure" | "FundsWithdrawal">[], Iterable<_mysten_bcs0.EnumInputShape<{
       Pure: {
         bytes: string | Uint8Array<ArrayBufferLike>;
       };
@@ -793,7 +793,7 @@ declare const suiBcs: {
           TransactionEffects: true;
           CheckpointSummary: true;
           PersonalMessage: true;
-        }, "TransactionData" | "TransactionEffects" | "CheckpointSummary" | "PersonalMessage">;
+        }, "TransactionEffects" | "TransactionData" | "CheckpointSummary" | "PersonalMessage">;
         version: {
           V0: true;
           $kind: "V0";
@@ -827,7 +827,7 @@ declare const suiBcs: {
                     version: string;
                     digest: string;
                   };
-                }, "ImmOrOwnedObject" | "SharedObject" | "Receiving">;
+                }, "Receiving" | "ImmOrOwnedObject" | "SharedObject">;
                 FundsWithdrawal: {
                   reservation: {
                     MaxAmountU64: string;
@@ -842,7 +842,7 @@ declare const suiBcs: {
                     Sponsor: true;
                   }, "Sender" | "Sponsor">;
                 };
-              }, "Pure" | "Object" | "FundsWithdrawal">[];
+              }, "Object" | "Pure" | "FundsWithdrawal">[];
               commands: _mysten_bcs0.EnumOutputShapeWithKeys<{
                 MoveCall: {
                   package: string;
@@ -950,7 +950,7 @@ declare const suiBcs: {
               chain: string;
               nonce: number;
             };
-          }, "None" | "Epoch" | "ValidDuring">;
+          }, "Epoch" | "None" | "ValidDuring">;
         };
         $kind: "V1";
       };
@@ -1193,7 +1193,7 @@ declare const suiBcs: {
                     version: string;
                     digest: string;
                   };
-                }, "ImmOrOwnedObject" | "SharedObject" | "Receiving">;
+                }, "Receiving" | "ImmOrOwnedObject" | "SharedObject">;
                 FundsWithdrawal: {
                   reservation: {
                     MaxAmountU64: string;
@@ -1208,7 +1208,7 @@ declare const suiBcs: {
                     Sponsor: true;
                   }, "Sender" | "Sponsor">;
                 };
-              }, "Pure" | "Object" | "FundsWithdrawal">[], Iterable<_mysten_bcs0.EnumInputShape<{
+              }, "Object" | "Pure" | "FundsWithdrawal">[], Iterable<_mysten_bcs0.EnumInputShape<{
                 Pure: {
                   bytes: string | Uint8Array<ArrayBufferLike>;
                 };
@@ -1508,7 +1508,7 @@ declare const suiBcs: {
                 version: string;
                 digest: string;
               };
-            }, "ImmOrOwnedObject" | "SharedObject" | "Receiving">;
+            }, "Receiving" | "ImmOrOwnedObject" | "SharedObject">;
             FundsWithdrawal: {
               reservation: {
                 MaxAmountU64: string;
@@ -1523,7 +1523,7 @@ declare const suiBcs: {
                 Sponsor: true;
               }, "Sender" | "Sponsor">;
             };
-          }, "Pure" | "Object" | "FundsWithdrawal">[], Iterable<_mysten_bcs0.EnumInputShape<{
+          }, "Object" | "Pure" | "FundsWithdrawal">[], Iterable<_mysten_bcs0.EnumInputShape<{
             Pure: {
               bytes: string | Uint8Array<ArrayBufferLike>;
             };
@@ -1799,7 +1799,7 @@ declare const suiBcs: {
               version: string;
               digest: string;
             };
-          }, "ImmOrOwnedObject" | "SharedObject" | "Receiving">;
+          }, "Receiving" | "ImmOrOwnedObject" | "SharedObject">;
           FundsWithdrawal: {
             reservation: {
               MaxAmountU64: string;
@@ -1814,7 +1814,7 @@ declare const suiBcs: {
               Sponsor: true;
             }, "Sender" | "Sponsor">;
           };
-        }, "Pure" | "Object" | "FundsWithdrawal">[], Iterable<_mysten_bcs0.EnumInputShape<{
+        }, "Object" | "Pure" | "FundsWithdrawal">[], Iterable<_mysten_bcs0.EnumInputShape<{
           Pure: {
             bytes: string | Uint8Array<ArrayBufferLike>;
           };
@@ -2271,7 +2271,7 @@ declare const suiBcs: {
           startVersion: string;
           owner: string;
         };
-      }, "AddressOwner" | "ObjectOwner" | "Shared" | "Immutable" | "ConsensusAddressOwner">][], Iterable<readonly [{
+      }, "AddressOwner" | "ConsensusAddressOwner" | "Immutable" | "ObjectOwner" | "Shared">][], Iterable<readonly [{
         objectId: string | Uint8Array<ArrayBufferLike>;
         version: string | number | bigint;
         digest: string;
@@ -2304,7 +2304,7 @@ declare const suiBcs: {
           startVersion: string;
           owner: string;
         };
-      }, "AddressOwner" | "ObjectOwner" | "Shared" | "Immutable" | "ConsensusAddressOwner">][], Iterable<readonly [{
+      }, "AddressOwner" | "ConsensusAddressOwner" | "Immutable" | "ObjectOwner" | "Shared">][], Iterable<readonly [{
         objectId: string | Uint8Array<ArrayBufferLike>;
         version: string | number | bigint;
         digest: string;
@@ -2337,7 +2337,7 @@ declare const suiBcs: {
           startVersion: string;
           owner: string;
         };
-      }, "AddressOwner" | "ObjectOwner" | "Shared" | "Immutable" | "ConsensusAddressOwner">][], Iterable<readonly [{
+      }, "AddressOwner" | "ConsensusAddressOwner" | "Immutable" | "ObjectOwner" | "Shared">][], Iterable<readonly [{
         objectId: string | Uint8Array<ArrayBufferLike>;
         version: string | number | bigint;
         digest: string;
@@ -2604,7 +2604,7 @@ declare const suiBcs: {
               startVersion: string;
               owner: string;
             };
-          }, "AddressOwner" | "ObjectOwner" | "Shared" | "Immutable" | "ConsensusAddressOwner">];
+          }, "AddressOwner" | "ConsensusAddressOwner" | "Immutable" | "ObjectOwner" | "Shared">];
         }, "NotExist" | "Exist">;
         outputState: _mysten_bcs0.EnumOutputShapeWithKeys<{
           NotExist: true;
@@ -2619,7 +2619,7 @@ declare const suiBcs: {
               startVersion: string;
               owner: string;
             };
-          }, "AddressOwner" | "ObjectOwner" | "Shared" | "Immutable" | "ConsensusAddressOwner">];
+          }, "AddressOwner" | "ConsensusAddressOwner" | "Immutable" | "ObjectOwner" | "Shared">];
           PackageWrite: [string, string];
           AccumulatorWriteV1: {
             address: {
@@ -2705,7 +2705,7 @@ declare const suiBcs: {
         ReadConsensusStreamEnded: string;
         Cancelled: string;
         PerEpochConfig: true;
-      }, "ReadOnlyRoot" | "MutateConsensusStreamEnded" | "ReadConsensusStreamEnded" | "Cancelled" | "PerEpochConfig">][], Iterable<readonly [string | Uint8Array<ArrayBufferLike>, _mysten_bcs0.EnumInputShape<{
+      }, "MutateConsensusStreamEnded" | "PerEpochConfig" | "ReadConsensusStreamEnded" | "ReadOnlyRoot" | "Cancelled">][], Iterable<readonly [string | Uint8Array<ArrayBufferLike>, _mysten_bcs0.EnumInputShape<{
         ReadOnlyRoot: readonly [string | number | bigint, string];
         MutateConsensusStreamEnded: string | number | bigint;
         ReadConsensusStreamEnded: string | number | bigint;
@@ -2751,7 +2751,7 @@ declare const suiBcs: {
             version: string;
             digest: string;
           };
-        }, "ImmOrOwnedObject" | "SharedObject" | "Receiving">;
+        }, "Receiving" | "ImmOrOwnedObject" | "SharedObject">;
         FundsWithdrawal: {
           reservation: {
             MaxAmountU64: string;
@@ -2766,7 +2766,7 @@ declare const suiBcs: {
             Sponsor: true;
           }, "Sender" | "Sponsor">;
         };
-      }, "Pure" | "Object" | "FundsWithdrawal">[], Iterable<_mysten_bcs0.EnumInputShape<{
+      }, "Object" | "Pure" | "FundsWithdrawal">[], Iterable<_mysten_bcs0.EnumInputShape<{
         Pure: {
           bytes: string | Uint8Array<ArrayBufferLike>;
         };

package/dist/cryptography/signature.d.mts

@@ -30,12 +30,6 @@ declare function parseSerializedSignature(serializedSignature: string): {
   clientDataJson: string;
   userSignature: Uint8Array<ArrayBuffer>;
   publicKey: Uint8Array<ArrayBuffer>;
-} | {
-  serializedSignature: string;
-  signatureScheme: "ED25519" | "Secp256k1" | "Secp256r1";
-  signature: Uint8Array<ArrayBuffer>;
-  publicKey: Uint8Array<ArrayBuffer>;
-  bytes: Uint8Array<ArrayBuffer>;
 } | {
   serializedSignature: string;
   signatureScheme: "ZkLogin";
@@ -60,6 +54,12 @@ declare function parseSerializedSignature(serializedSignature: string): {
   };
   signature: Uint8Array<ArrayBufferLike>;
   publicKey: Uint8Array<ArrayBuffer>;
+} | {
+  serializedSignature: string;
+  signatureScheme: "ED25519" | "Secp256k1" | "Secp256r1";
+  signature: Uint8Array<ArrayBuffer>;
+  publicKey: Uint8Array<ArrayBuffer>;
+  bytes: Uint8Array<ArrayBuffer>;
 } | {
   serializedSignature: string;
   signatureScheme: "MultiSig";

package/dist/grpc/proto/sui/rpc/v2/ledger_service.client.d.mts

@@ -1,6 +1,6 @@
 import { BatchGetObjectsRequest, BatchGetObjectsResponse, BatchGetTransactionsRequest, BatchGetTransactionsResponse, GetCheckpointRequest, GetCheckpointResponse, GetEpochRequest, GetEpochResponse, GetObjectRequest, GetObjectResponse, GetServiceInfoRequest, GetServiceInfoResponse, GetTransactionRequest, GetTransactionResponse } from "./ledger_service.mjs";
-import * as _protobuf_ts_runtime1 from "@protobuf-ts/runtime";
-import * as _protobuf_ts_runtime_rpc1 from "@protobuf-ts/runtime-rpc";
+import * as _protobuf_ts_runtime3 from "@protobuf-ts/runtime";
+import * as _protobuf_ts_runtime_rpc3 from "@protobuf-ts/runtime-rpc";
 import { RpcOptions, RpcTransport, ServiceInfo, UnaryCall } from "@protobuf-ts/runtime-rpc";
 
 //#region src/grpc/proto/sui/rpc/v2/ledger_service.client.d.ts
@@ -45,9 +45,9 @@ interface ILedgerServiceClient {
 declare class LedgerServiceClient implements ILedgerServiceClient, ServiceInfo {
   private readonly _transport;
   typeName: string;
-  methods: _protobuf_ts_runtime_rpc1.MethodInfo<any, any>[];
+  methods: _protobuf_ts_runtime_rpc3.MethodInfo<any, any>[];
   options: {
-    [extensionName: string]: _protobuf_ts_runtime1.JsonValue;
+    [extensionName: string]: _protobuf_ts_runtime3.JsonValue;
   };
   constructor(_transport: RpcTransport);
   /**

package/dist/grpc/proto/sui/rpc/v2/move_package_service.client.d.mts

@@ -1,6 +1,6 @@
 import { GetDatatypeRequest, GetDatatypeResponse, GetFunctionRequest, GetFunctionResponse, GetPackageRequest, GetPackageResponse, ListPackageVersionsRequest, ListPackageVersionsResponse } from "./move_package_service.mjs";
-import * as _protobuf_ts_runtime2 from "@protobuf-ts/runtime";
-import * as _protobuf_ts_runtime_rpc2 from "@protobuf-ts/runtime-rpc";
+import * as _protobuf_ts_runtime0 from "@protobuf-ts/runtime";
+import * as _protobuf_ts_runtime_rpc0 from "@protobuf-ts/runtime-rpc";
 import { RpcOptions, RpcTransport, ServiceInfo, UnaryCall } from "@protobuf-ts/runtime-rpc";
 
 //#region src/grpc/proto/sui/rpc/v2/move_package_service.client.d.ts
@@ -31,9 +31,9 @@ interface IMovePackageServiceClient {
 declare class MovePackageServiceClient implements IMovePackageServiceClient, ServiceInfo {
   private readonly _transport;
   typeName: string;
-  methods: _protobuf_ts_runtime_rpc2.MethodInfo<any, any>[];
+  methods: _protobuf_ts_runtime_rpc0.MethodInfo<any, any>[];
   options: {
-    [extensionName: string]: _protobuf_ts_runtime2.JsonValue;
+    [extensionName: string]: _protobuf_ts_runtime0.JsonValue;
   };
   constructor(_transport: RpcTransport);
   /**

package/dist/grpc/proto/sui/rpc/v2/name_service.client.d.mts

@@ -1,6 +1,6 @@
 import { LookupNameRequest, LookupNameResponse, ReverseLookupNameRequest, ReverseLookupNameResponse } from "./name_service.mjs";
-import * as _protobuf_ts_runtime6 from "@protobuf-ts/runtime";
-import * as _protobuf_ts_runtime_rpc6 from "@protobuf-ts/runtime-rpc";
+import * as _protobuf_ts_runtime5 from "@protobuf-ts/runtime";
+import * as _protobuf_ts_runtime_rpc5 from "@protobuf-ts/runtime-rpc";
 import { RpcOptions, RpcTransport, ServiceInfo, UnaryCall } from "@protobuf-ts/runtime-rpc";
 
 //#region src/grpc/proto/sui/rpc/v2/name_service.client.d.ts
@@ -23,9 +23,9 @@ interface INameServiceClient {
 declare class NameServiceClient implements INameServiceClient, ServiceInfo {
   private readonly _transport;
   typeName: string;
-  methods: _protobuf_ts_runtime_rpc6.MethodInfo<any, any>[];
+  methods: _protobuf_ts_runtime_rpc5.MethodInfo<any, any>[];
   options: {
-    [extensionName: string]: _protobuf_ts_runtime6.JsonValue;
+    [extensionName: string]: _protobuf_ts_runtime5.JsonValue;
   };
   constructor(_transport: RpcTransport);
   /**

package/dist/grpc/proto/sui/rpc/v2/signature_verification_service.client.d.mts

@@ -1,6 +1,6 @@
 import { VerifySignatureRequest, VerifySignatureResponse } from "./signature_verification_service.mjs";
-import * as _protobuf_ts_runtime3 from "@protobuf-ts/runtime";
-import * as _protobuf_ts_runtime_rpc3 from "@protobuf-ts/runtime-rpc";
+import * as _protobuf_ts_runtime2 from "@protobuf-ts/runtime";
+import * as _protobuf_ts_runtime_rpc2 from "@protobuf-ts/runtime-rpc";
 import { RpcOptions, RpcTransport, ServiceInfo, UnaryCall } from "@protobuf-ts/runtime-rpc";
 
 //#region src/grpc/proto/sui/rpc/v2/signature_verification_service.client.d.ts
@@ -21,9 +21,9 @@ interface ISignatureVerificationServiceClient {
 declare class SignatureVerificationServiceClient implements ISignatureVerificationServiceClient, ServiceInfo {
   private readonly _transport;
   typeName: string;
-  methods: _protobuf_ts_runtime_rpc3.MethodInfo<any, any>[];
+  methods: _protobuf_ts_runtime_rpc2.MethodInfo<any, any>[];
   options: {
-    [extensionName: string]: _protobuf_ts_runtime3.JsonValue;
+    [extensionName: string]: _protobuf_ts_runtime2.JsonValue;
   };
   constructor(_transport: RpcTransport);
   /**

package/dist/grpc/proto/sui/rpc/v2/subscription_service.client.d.mts

@@ -1,6 +1,6 @@
 import { SubscribeCheckpointsRequest, SubscribeCheckpointsResponse } from "./subscription_service.mjs";
-import * as _protobuf_ts_runtime5 from "@protobuf-ts/runtime";
-import * as _protobuf_ts_runtime_rpc5 from "@protobuf-ts/runtime-rpc";
+import * as _protobuf_ts_runtime6 from "@protobuf-ts/runtime";
+import * as _protobuf_ts_runtime_rpc6 from "@protobuf-ts/runtime-rpc";
 import { RpcOptions, RpcTransport, ServerStreamingCall, ServiceInfo } from "@protobuf-ts/runtime-rpc";
 
 //#region src/grpc/proto/sui/rpc/v2/subscription_service.client.d.ts
@@ -31,9 +31,9 @@ interface ISubscriptionServiceClient {
 declare class SubscriptionServiceClient implements ISubscriptionServiceClient, ServiceInfo {
   private readonly _transport;
   typeName: string;
-  methods: _protobuf_ts_runtime_rpc5.MethodInfo<any, any>[];
+  methods: _protobuf_ts_runtime_rpc6.MethodInfo<any, any>[];
   options: {
-    [extensionName: string]: _protobuf_ts_runtime5.JsonValue;
+    [extensionName: string]: _protobuf_ts_runtime6.JsonValue;
   };
   constructor(_transport: RpcTransport);
   /**

package/dist/grpc/proto/sui/rpc/v2/transaction_execution_service.client.d.mts

@@ -1,6 +1,6 @@
 import { ExecuteTransactionRequest, ExecuteTransactionResponse, SimulateTransactionRequest, SimulateTransactionResponse } from "./transaction_execution_service.mjs";
-import * as _protobuf_ts_runtime0 from "@protobuf-ts/runtime";
-import * as _protobuf_ts_runtime_rpc0 from "@protobuf-ts/runtime-rpc";
+import * as _protobuf_ts_runtime1 from "@protobuf-ts/runtime";
+import * as _protobuf_ts_runtime_rpc1 from "@protobuf-ts/runtime-rpc";
 import { RpcOptions, RpcTransport, ServiceInfo, UnaryCall } from "@protobuf-ts/runtime-rpc";
 
 //#region src/grpc/proto/sui/rpc/v2/transaction_execution_service.client.d.ts
@@ -23,9 +23,9 @@ interface ITransactionExecutionServiceClient {
 declare class TransactionExecutionServiceClient implements ITransactionExecutionServiceClient, ServiceInfo {
   private readonly _transport;
   typeName: string;
-  methods: _protobuf_ts_runtime_rpc0.MethodInfo<any, any>[];
+  methods: _protobuf_ts_runtime_rpc1.MethodInfo<any, any>[];
   options: {
-    [extensionName: string]: _protobuf_ts_runtime0.JsonValue;
+    [extensionName: string]: _protobuf_ts_runtime1.JsonValue;
   };
   constructor(_transport: RpcTransport);
   /**

package/dist/transactions/Transaction.d.mts

@@ -102,7 +102,7 @@ declare class Transaction {
         chain: string;
         nonce: number;
       };
-    }, "None" | "Epoch" | "ValidDuring"> | null | undefined;
+    }, "Epoch" | "None" | "ValidDuring"> | null | undefined;
     gasData: {
       budget: string | number | null;
       price: string | number | null;
@@ -130,7 +130,7 @@ declare class Transaction {
           version: string | number;
           digest: string;
         };
-      }, "ImmOrOwnedObject" | "SharedObject" | "Receiving">;
+      }, "Receiving" | "ImmOrOwnedObject" | "SharedObject">;
       Pure: {
         bytes: string;
       };
@@ -158,7 +158,7 @@ declare class Transaction {
           Sponsor: true;
         }, "Sender" | "Sponsor">;
       };
-    }, "Pure" | "Object" | "FundsWithdrawal" | "UnresolvedPure" | "UnresolvedObject">[];
+    }, "Object" | "Pure" | "FundsWithdrawal" | "UnresolvedPure" | "UnresolvedObject">[];
     commands: _mysten_bcs1124.EnumOutputShapeWithKeys<{
       MoveCall: {
         package: string;

package/dist/version.mjs

@@ -1,5 +1,5 @@
 //#region src/version.ts
-const PACKAGE_VERSION = "2.19.0";
+const PACKAGE_VERSION = "2.20.0";
 
 //#endregion
 export { PACKAGE_VERSION };

package/dist/version.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"version.mjs","names":[],"sources":["../src/version.ts"],"sourcesContent":["// Copyright (c) Mysten Labs, Inc.\n// SPDX-License-Identifier: Apache-2.0\n\n// This file is generated by genversion.mjs. Do not edit it directly.\n\nexport const PACKAGE_VERSION = '2.19.0';\n"],"mappings":";AAKA,MAAa,kBAAkB"}
+{"version":3,"file":"version.mjs","names":[],"sources":["../src/version.ts"],"sourcesContent":["// Copyright (c) Mysten Labs, Inc.\n// SPDX-License-Identifier: Apache-2.0\n\n// This file is generated by genversion.mjs. Do not edit it directly.\n\nexport const PACKAGE_VERSION = '2.20.0';\n"],"mappings":";AAKA,MAAa,kBAAkB"}

package/dist/zklogin/bcs.d.mts

@@ -1,31 +1,31 @@
-import * as _mysten_bcs810 from "@mysten/bcs";
+import * as _mysten_bcs1111 from "@mysten/bcs";
 import { InferBcsInput } from "@mysten/bcs";
 
 //#region src/zklogin/bcs.d.ts
-declare const zkLoginSignature: _mysten_bcs810.BcsStruct<{
-  inputs: _mysten_bcs810.BcsStruct<{
-    proofPoints: _mysten_bcs810.BcsStruct<{
-      a: _mysten_bcs810.BcsType<string[], Iterable<string> & {
+declare const zkLoginSignature: _mysten_bcs1111.BcsStruct<{
+  inputs: _mysten_bcs1111.BcsStruct<{
+    proofPoints: _mysten_bcs1111.BcsStruct<{
+      a: _mysten_bcs1111.BcsType<string[], Iterable<string> & {
         length: number;
       }, string>;
-      b: _mysten_bcs810.BcsType<string[][], Iterable<Iterable<string> & {
+      b: _mysten_bcs1111.BcsType<string[][], Iterable<Iterable<string> & {
         length: number;
       }> & {
         length: number;
       }, string>;
-      c: _mysten_bcs810.BcsType<string[], Iterable<string> & {
+      c: _mysten_bcs1111.BcsType<string[], Iterable<string> & {
         length: number;
       }, string>;
     }, string>;
-    issBase64Details: _mysten_bcs810.BcsStruct<{
-      value: _mysten_bcs810.BcsType<string, string, "string">;
-      indexMod4: _mysten_bcs810.BcsType<number, number, "u8">;
+    issBase64Details: _mysten_bcs1111.BcsStruct<{
+      value: _mysten_bcs1111.BcsType<string, string, "string">;
+      indexMod4: _mysten_bcs1111.BcsType<number, number, "u8">;
     }, string>;
-    headerBase64: _mysten_bcs810.BcsType<string, string, "string">;
-    addressSeed: _mysten_bcs810.BcsType<string, string, "string">;
+    headerBase64: _mysten_bcs1111.BcsType<string, string, "string">;
+    addressSeed: _mysten_bcs1111.BcsType<string, string, "string">;
   }, string>;
-  maxEpoch: _mysten_bcs810.BcsType<string, string | number | bigint, "u64">;
-  userSignature: _mysten_bcs810.BcsType<Uint8Array<ArrayBufferLike>, Iterable<number>, "vector<u8>">;
+  maxEpoch: _mysten_bcs1111.BcsType<string, string | number | bigint, "u64">;
+  userSignature: _mysten_bcs1111.BcsType<Uint8Array<ArrayBufferLike>, Iterable<number>, "vector<u8>">;
 }, string>;
 type ZkLoginSignature = InferBcsInput<typeof zkLoginSignature>;
 type ZkLoginSignatureInputs = ZkLoginSignature['inputs'];

package/dist/zklogin/bcs.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"bcs.d.mts","names":[],"sources":["../../src/zklogin/bcs.ts"],"mappings":";;;;cAMa,gBAAA,iBAAgB,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;KAkBjB,gBAAA,GAAmB,aAAA,QAAqB,gBAAA;AAAA,KACxC,sBAAA,GAAyB,gBAAA"}
+{"version":3,"file":"bcs.d.mts","names":[],"sources":["../../src/zklogin/bcs.ts"],"mappings":";;;;cAMa,gBAAA,kBAAgB,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;KAkBjB,gBAAA,GAAmB,aAAA,QAAqB,gBAAA;AAAA,KACxC,sBAAA,GAAyB,gBAAA"}

package/dist/zklogin/index.d.mts

@@ -3,7 +3,8 @@ import { getZkLoginSignature, parseZkLoginSignature } from "./signature.mjs";
 import { genAddressSeed, getExtendedEphemeralPublicKey, hashASCIIStrToField, toBigEndianBytes, toPaddedBigEndianBytes } from "./utils.mjs";
 import { ComputeZkLoginAddressOptions, computeZkLoginAddress, computeZkLoginAddressFromSeed, jwtToAddress } from "./address.mjs";
 import { ZkLoginPublicIdentifier, toZkLoginPublicIdentifier } from "./publickey.mjs";
+import { ZkLoginSigner, ZkLoginSignerOptions } from "./signer.mjs";
 import { poseidonHash } from "./poseidon.mjs";
 import { generateNonce, generateRandomness } from "./nonce.mjs";
 import { decodeJwt } from "./jwt-utils.mjs";
-export { type ComputeZkLoginAddressOptions, ZkLoginPublicIdentifier, type ZkLoginSignatureInputs, computeZkLoginAddress, computeZkLoginAddressFromSeed, decodeJwt, genAddressSeed, generateNonce, generateRandomness, getExtendedEphemeralPublicKey, getZkLoginSignature, hashASCIIStrToField, jwtToAddress, parseZkLoginSignature, poseidonHash, toBigEndianBytes, toPaddedBigEndianBytes, toZkLoginPublicIdentifier };
+export { type ComputeZkLoginAddressOptions, ZkLoginPublicIdentifier, type ZkLoginSignatureInputs, ZkLoginSigner, type ZkLoginSignerOptions, computeZkLoginAddress, computeZkLoginAddressFromSeed, decodeJwt, genAddressSeed, generateNonce, generateRandomness, getExtendedEphemeralPublicKey, getZkLoginSignature, hashASCIIStrToField, jwtToAddress, parseZkLoginSignature, poseidonHash, toBigEndianBytes, toPaddedBigEndianBytes, toZkLoginPublicIdentifier };

package/dist/zklogin/index.mjs

@@ -4,6 +4,7 @@ import { decodeJwt } from "./jwt-utils.mjs";
 import { getZkLoginSignature, parseZkLoginSignature } from "./signature.mjs";
 import { ZkLoginPublicIdentifier, toZkLoginPublicIdentifier } from "./publickey.mjs";
 import { computeZkLoginAddress, computeZkLoginAddressFromSeed, jwtToAddress } from "./address.mjs";
+import { ZkLoginSigner } from "./signer.mjs";
 import { generateNonce, generateRandomness } from "./nonce.mjs";
 
-export { ZkLoginPublicIdentifier, computeZkLoginAddress, computeZkLoginAddressFromSeed, decodeJwt, genAddressSeed, generateNonce, generateRandomness, getExtendedEphemeralPublicKey, getZkLoginSignature, hashASCIIStrToField, jwtToAddress, parseZkLoginSignature, poseidonHash, toBigEndianBytes, toPaddedBigEndianBytes, toZkLoginPublicIdentifier };
+export { ZkLoginPublicIdentifier, ZkLoginSigner, computeZkLoginAddress, computeZkLoginAddressFromSeed, decodeJwt, genAddressSeed, generateNonce, generateRandomness, getExtendedEphemeralPublicKey, getZkLoginSignature, hashASCIIStrToField, jwtToAddress, parseZkLoginSignature, poseidonHash, toBigEndianBytes, toPaddedBigEndianBytes, toZkLoginPublicIdentifier };

package/dist/zklogin/publickey.d.mts

@@ -17,6 +17,10 @@ declare class ZkLoginPublicIdentifier extends PublicKey {
   }?: {
     client?: ClientWithCoreApi;
   });
+  /**
+   * Whether this identifier resolves to the deprecated legacy address derivation.
+   */
+  get legacyAddress(): boolean;
   static fromBytes(bytes: Uint8Array, {
     client,
     address,

package/dist/zklogin/publickey.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"publickey.d.mts","names":[],"sources":["../../src/zklogin/publickey.ts"],"mappings":";;;;;;AAoBA;;cAAa,uBAAA,SAAgC,SAAA;EAAA;EASJ;;;;cAA5B,KAAA,EAAO,iBAAA;IAAqB;EAAA;IAAY,MAAA,GAAS,iBAAA;EAAA;EAAA,OAmBtD,SAAA,CACN,KAAA,EAAO,UAAA;IAEN,MAAA;IACA,OAAA;IACA;EAAA;IACI,MAAA,GAAS,iBAAA;IAAmB,OAAA;IAAkB,aAAA;EAAA,IAA8B,uBAAA;EAAA,OAmC3E,SAAA,CAAU,OAAA,UAAiB,KAAA,EAAO,sBAAA,GAAsB,uBAAA;EAiExC;;;EAvCd,MAAA,CAAO,SAAA,EAAW,uBAAA;EAIlB,YAAA,CAAA;EA0CmE;;;EArB5E,UAAA,CAAA,GAAc,UAAA,CAAW,WAAA;EAxHmB;;;EA+H5C,IAAA,CAAA;;;;EAOM,MAAA,CAAO,QAAA,EAAU,UAAA,EAAY,UAAA,EAAY,UAAA,YAAsB,OAAA;EA7H7B;;;EAoIxC,qBAAA,CAAsB,OAAA,EAAS,UAAA,EAAY,SAAA,EAAW,UAAA,YAAsB,OAAA;EAjHrE;;;EAiIP,iBAAA,CAAkB,WAAA,EAAa,UAAA,EAAY,SAAA,EAAW,UAAA,YAAsB,OAAA;EA9H1E;;;EA6IO,aAAA,CAAc,OAAA;AAAA;AAAA,iBAMR,yBAAA,CACf,WAAA,UACA,GAAA,UACA,OAAA;EAAW,MAAA,GAAS,iBAAA;EAAmB,aAAA;AAAA,IACrC,uBAAA"}
+{"version":3,"file":"publickey.d.mts","names":[],"sources":["../../src/zklogin/publickey.ts"],"mappings":";;;;;;AAoBA;;cAAa,uBAAA,SAAgC,SAAA;EAAA;EASJ;;;;cAA5B,KAAA,EAAO,iBAAA;IAAqB;EAAA;IAAY,MAAA,GAAS,iBAAA;EAAA;EAgCqB;;;EAAA,IAV9E,aAAA,CAAA;EAAA,OAIG,SAAA,CACN,KAAA,EAAO,UAAA;IAEN,MAAA;IACA,OAAA;IACA;EAAA;IACI,MAAA,GAAS,iBAAA;IAAmB,OAAA;IAAkB,aAAA;EAAA,IAA8B,uBAAA;EAAA,OAmC3E,SAAA,CAAU,OAAA,UAAiB,KAAA,EAAO,sBAAA,GAAsB,uBAAA;EAwET;;;EA9C7C,MAAA,CAAO,SAAA,EAAW,uBAAA;EAIlB,YAAA,CAAA;EA1GmC;;;EA+H5C,UAAA,CAAA,GAAc,UAAA,CAAW,WAAA;;;;EAOzB,IAAA,CAAA;EA7HwC;;;EAoIlC,MAAA,CAAO,QAAA,EAAU,UAAA,EAAY,UAAA,EAAY,UAAA,YAAsB,OAAA;EA9GjE;;;EAqHJ,qBAAA,CAAsB,OAAA,EAAS,UAAA,EAAY,SAAA,EAAW,UAAA,YAAsB,OAAA;EA9G1E;;;EA8HF,iBAAA,CAAkB,WAAA,EAAa,UAAA,EAAY,SAAA,EAAW,UAAA,YAAsB,OAAA;EA5H1E;;;EA2IO,aAAA,CAAc,OAAA;AAAA;AAAA,iBAMR,yBAAA,CACf,WAAA,UACA,GAAA,UACA,OAAA;EAAW,MAAA,GAAS,iBAAA;EAAmB,aAAA;AAAA,IACrC,uBAAA"}

package/dist/zklogin/publickey.mjs

@@ -29,6 +29,12 @@ var ZkLoginPublicIdentifier = class ZkLoginPublicIdentifier extends PublicKey {
 		this.#legacyAddress = this.#data.length !== this.#data[0] + 1 + 32;
 		if (this.#legacyAddress) this.#data = normalizeZkLoginPublicKeyBytes(this.#data, false);
 	}
+	/**
+	* Whether this identifier resolves to the deprecated legacy address derivation.
+	*/
+	get legacyAddress() {
+		return this.#legacyAddress;
+	}
 	static fromBytes(bytes, { client, address, legacyAddress } = {}) {
 		let publicKey;
 		if (legacyAddress === true) publicKey = new ZkLoginPublicIdentifier(normalizeZkLoginPublicKeyBytes(bytes, true), { client });

package/dist/zklogin/publickey.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"publickey.mjs","names":["#client","#data","#legacyAddress","#toLegacyAddress"],"sources":["../../src/zklogin/publickey.ts"],"sourcesContent":["// Copyright (c) Mysten Labs, Inc.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { fromBase64, toBase64, toHex } from '@mysten/bcs';\nimport { blake2b } from '@noble/hashes/blake2.js';\nimport { bytesToHex } from '@noble/hashes/utils.js';\n\nimport { PublicKey } from '../cryptography/publickey.js';\nimport type { PublicKeyInitData } from '../cryptography/publickey.js';\nimport { SIGNATURE_SCHEME_TO_FLAG } from '../cryptography/signature-scheme.js';\nimport { normalizeSuiAddress, SUI_ADDRESS_LENGTH } from '../utils/sui-types.js';\nimport type { ZkLoginSignatureInputs } from './bcs.js';\nimport { extractClaimValue } from './jwt-utils.js';\nimport { parseZkLoginSignature } from './signature.js';\nimport { normalizeZkLoginIssuer, toBigEndianBytes, toPaddedBigEndianBytes } from './utils.js';\nimport type { ClientWithCoreApi } from '../client/core.js';\n\n/**\n * A zkLogin public identifier\n */\nexport class ZkLoginPublicIdentifier extends PublicKey {\n\t#data: Uint8Array<ArrayBuffer>;\n\t#client?: ClientWithCoreApi;\n\t#legacyAddress: boolean;\n\n\t/**\n\t * Create a new ZkLoginPublicIdentifier object\n\t * @param value zkLogin public identifier as buffer or base-64 encoded string\n\t */\n\tconstructor(value: PublicKeyInitData, { client }: { client?: ClientWithCoreApi } = {}) {\n\t\tsuper();\n\n\t\tthis.#client = client;\n\n\t\tif (typeof value === 'string') {\n\t\t\tthis.#data = fromBase64(value);\n\t\t} else if (value instanceof Uint8Array) {\n\t\t\tthis.#data = value as Uint8Array<ArrayBuffer>;\n\t\t} else {\n\t\t\tthis.#data = Uint8Array.from(value);\n\t\t}\n\t\tthis.#legacyAddress = this.#data.length !== this.#data[0] + 1 + 32;\n\n\t\tif (this.#legacyAddress) {\n\t\t\tthis.#data = normalizeZkLoginPublicKeyBytes(this.#data, false);\n\t\t}\n\t}\n\n\tstatic fromBytes(\n\t\tbytes: Uint8Array,\n\t\t{\n\t\t\tclient,\n\t\t\taddress,\n\t\t\tlegacyAddress,\n\t\t}: { client?: ClientWithCoreApi; address?: string; legacyAddress?: boolean } = {},\n\t) {\n\t\tlet publicKey: ZkLoginPublicIdentifier;\n\n\t\tif (legacyAddress === true) {\n\t\t\tpublicKey = new ZkLoginPublicIdentifier(normalizeZkLoginPublicKeyBytes(bytes, true), {\n\t\t\t\tclient,\n\t\t\t});\n\t\t} else if (legacyAddress === false) {\n\t\t\tpublicKey = new ZkLoginPublicIdentifier(normalizeZkLoginPublicKeyBytes(bytes, false), {\n\t\t\t\tclient,\n\t\t\t});\n\t\t} else if (address) {\n\t\t\tpublicKey = new ZkLoginPublicIdentifier(normalizeZkLoginPublicKeyBytes(bytes, false), {\n\t\t\t\tclient,\n\t\t\t});\n\n\t\t\tif (publicKey.toSuiAddress() !== address) {\n\t\t\t\tpublicKey = new ZkLoginPublicIdentifier(normalizeZkLoginPublicKeyBytes(bytes, true), {\n\t\t\t\t\tclient,\n\t\t\t\t});\n\t\t\t}\n\t\t} else {\n\t\t\tpublicKey = new ZkLoginPublicIdentifier(bytes, {\n\t\t\t\tclient,\n\t\t\t});\n\t\t}\n\n\t\tif (address && publicKey.toSuiAddress() !== address) {\n\t\t\tthrow new Error('Public key bytes do not match the provided address');\n\t\t}\n\n\t\treturn publicKey;\n\t}\n\n\tstatic fromProof(address: string, proof: ZkLoginSignatureInputs) {\n\t\tconst { issBase64Details, addressSeed } = proof;\n\t\tconst iss = extractClaimValue<string>(issBase64Details, 'iss');\n\n\t\tconst legacyPublicKey = toZkLoginPublicIdentifier(BigInt(addressSeed), iss, {\n\t\t\tlegacyAddress: true,\n\t\t});\n\n\t\tif (legacyPublicKey.toSuiAddress() === address) {\n\t\t\treturn legacyPublicKey;\n\t\t}\n\n\t\tconst publicKey = toZkLoginPublicIdentifier(BigInt(addressSeed), iss, {\n\t\t\tlegacyAddress: false,\n\t\t});\n\n\t\tif (publicKey.toSuiAddress() !== address) {\n\t\t\tthrow new Error('Proof does not match address');\n\t\t}\n\n\t\treturn publicKey;\n\t}\n\n\t/**\n\t * Checks if two zkLogin public identifiers are equal\n\t */\n\toverride equals(publicKey: ZkLoginPublicIdentifier): boolean {\n\t\treturn super.equals(publicKey);\n\t}\n\n\toverride toSuiAddress(): string {\n\t\tif (this.#legacyAddress) {\n\t\t\treturn this.#toLegacyAddress();\n\t\t}\n\n\t\treturn super.toSuiAddress();\n\t}\n\n\t#toLegacyAddress() {\n\t\tconst legacyBytes = normalizeZkLoginPublicKeyBytes(this.#data, true);\n\t\tconst addressBytes = new Uint8Array(legacyBytes.length + 1);\n\t\taddressBytes[0] = this.flag();\n\t\taddressBytes.set(legacyBytes, 1);\n\t\treturn normalizeSuiAddress(\n\t\t\tbytesToHex(blake2b(addressBytes, { dkLen: 32 })).slice(0, SUI_ADDRESS_LENGTH * 2),\n\t\t);\n\t}\n\n\t/**\n\t * Return the byte array representation of the zkLogin public identifier\n\t */\n\ttoRawBytes(): Uint8Array<ArrayBuffer> {\n\t\treturn this.#data;\n\t}\n\n\t/**\n\t * Return the Sui address associated with this ZkLogin public identifier\n\t */\n\tflag(): number {\n\t\treturn SIGNATURE_SCHEME_TO_FLAG['ZkLogin'];\n\t}\n\n\t/**\n\t * Verifies that the signature is valid for for the provided message\n\t */\n\tasync verify(_message: Uint8Array, _signature: Uint8Array | string): Promise<boolean> {\n\t\tthrow Error('does not support');\n\t}\n\n\t/**\n\t * Verifies that the signature is valid for for the provided PersonalMessage\n\t */\n\tverifyPersonalMessage(message: Uint8Array, signature: Uint8Array | string): Promise<boolean> {\n\t\tconst parsedSignature = parseSerializedZkLoginSignature(signature);\n\t\tconst address = new ZkLoginPublicIdentifier(parsedSignature.publicKey).toSuiAddress();\n\n\t\treturn graphqlVerifyZkLoginSignature({\n\t\t\taddress: address,\n\t\t\tbytes: toBase64(message),\n\t\t\tsignature: parsedSignature.serializedSignature,\n\t\t\tintentScope: 'PersonalMessage',\n\t\t\tclient: this.#client,\n\t\t});\n\t}\n\n\t/**\n\t * Verifies that the signature is valid for for the provided Transaction\n\t */\n\tverifyTransaction(transaction: Uint8Array, signature: Uint8Array | string): Promise<boolean> {\n\t\tconst parsedSignature = parseSerializedZkLoginSignature(signature);\n\t\tconst address = new ZkLoginPublicIdentifier(parsedSignature.publicKey).toSuiAddress();\n\t\treturn graphqlVerifyZkLoginSignature({\n\t\t\taddress: address,\n\t\t\tbytes: toBase64(transaction),\n\t\t\tsignature: parsedSignature.serializedSignature,\n\t\t\tintentScope: 'TransactionData',\n\t\t\tclient: this.#client,\n\t\t});\n\t}\n\n\t/**\n\t * Verifies that the public key is associated with the provided address\n\t */\n\toverride verifyAddress(address: string): boolean {\n\t\treturn address === super.toSuiAddress() || address === this.#toLegacyAddress();\n\t}\n}\n\n// Derive the public identifier for zklogin based on address seed and iss.\nexport function toZkLoginPublicIdentifier(\n\taddressSeed: bigint,\n\tiss: string,\n\toptions: { client?: ClientWithCoreApi; legacyAddress: boolean },\n): ZkLoginPublicIdentifier {\n\tif (options.legacyAddress === undefined) {\n\t\tthrow new Error('legacyAddress parameter must be specified');\n\t}\n\t// Consists of iss_bytes_len || iss_bytes || padded_32_byte_address_seed.\n\tconst addressSeedBytesBigEndian = options.legacyAddress\n\t\t? toBigEndianBytes(addressSeed, 32)\n\t\t: toPaddedBigEndianBytes(addressSeed, 32);\n\n\tconst issBytes = new TextEncoder().encode(normalizeZkLoginIssuer(iss));\n\tconst tmp = new Uint8Array(1 + issBytes.length + addressSeedBytesBigEndian.length);\n\ttmp.set([issBytes.length], 0);\n\ttmp.set(issBytes, 1);\n\ttmp.set(addressSeedBytesBigEndian, 1 + issBytes.length);\n\treturn new ZkLoginPublicIdentifier(tmp, options);\n}\n\nfunction normalizeZkLoginPublicKeyBytes(bytes: Uint8Array, legacyAddress: boolean) {\n\tconst issByteLength = bytes[0] + 1;\n\tconst addressSeed = BigInt(`0x${toHex(bytes.slice(issByteLength))}`);\n\tconst seedBytes = legacyAddress\n\t\t? toBigEndianBytes(addressSeed, 32)\n\t\t: toPaddedBigEndianBytes(addressSeed, 32);\n\tconst data = new Uint8Array(issByteLength + seedBytes.length);\n\tdata.set(bytes.slice(0, issByteLength), 0);\n\tdata.set(seedBytes, issByteLength);\n\treturn data;\n}\n\nasync function graphqlVerifyZkLoginSignature({\n\taddress,\n\tbytes,\n\tsignature,\n\tintentScope,\n\tclient,\n}: {\n\taddress: string;\n\tbytes: string;\n\tsignature: string;\n\tintentScope: 'PersonalMessage' | 'TransactionData';\n\tclient?: ClientWithCoreApi;\n}) {\n\tif (!client) {\n\t\tthrow new Error(\n\t\t\t'A Sui Client (GRPC, GraphQL, or JSON RPC) is required to verify zkLogin signatures',\n\t\t);\n\t}\n\tconst resp = await client.core.verifyZkLoginSignature({\n\t\tbytes,\n\t\tsignature,\n\t\tintentScope,\n\t\taddress: address,\n\t});\n\n\treturn resp.success === true && resp.errors.length === 0;\n}\n\nexport function parseSerializedZkLoginSignature(signature: Uint8Array | string) {\n\tconst bytes = typeof signature === 'string' ? fromBase64(signature) : signature;\n\n\tif (bytes[0] !== SIGNATURE_SCHEME_TO_FLAG.ZkLogin) {\n\t\tthrow new Error('Invalid signature scheme');\n\t}\n\n\tconst signatureBytes = bytes.slice(1);\n\tconst { inputs, maxEpoch, userSignature } = parseZkLoginSignature(signatureBytes);\n\tconst { issBase64Details, addressSeed } = inputs;\n\tconst iss = extractClaimValue<string>(issBase64Details, 'iss');\n\tconst publicIdentifier = toZkLoginPublicIdentifier(BigInt(addressSeed), iss, {\n\t\tlegacyAddress: false,\n\t});\n\treturn {\n\t\tserializedSignature: toBase64(bytes),\n\t\tsignatureScheme: 'ZkLogin' as const,\n\t\tzkLogin: {\n\t\t\tinputs,\n\t\t\tmaxEpoch,\n\t\t\tuserSignature,\n\t\t\tiss,\n\t\t\taddressSeed: BigInt(addressSeed),\n\t\t},\n\t\tsignature: bytes,\n\t\tpublicKey: publicIdentifier.toRawBytes(),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;AAoBA,IAAa,0BAAb,MAAa,gCAAgC,UAAU;CACtD;CACA;CACA;;;;;CAMA,YAAY,OAA0B,EAAE,WAA2C,EAAE,EAAE;AACtF,SAAO;AAEP,QAAKA,SAAU;AAEf,MAAI,OAAO,UAAU,SACpB,OAAKC,OAAQ,WAAW,MAAM;WACpB,iBAAiB,WAC3B,OAAKA,OAAQ;MAEb,OAAKA,OAAQ,WAAW,KAAK,MAAM;AAEpC,QAAKC,gBAAiB,MAAKD,KAAM,WAAW,MAAKA,KAAM,KAAK,IAAI;AAEhE,MAAI,MAAKC,cACR,OAAKD,OAAQ,+BAA+B,MAAKA,MAAO,MAAM;;CAIhE,OAAO,UACN,OACA,EACC,QACA,SACA,kBAC8E,EAAE,EAChF;EACD,IAAI;AAEJ,MAAI,kBAAkB,KACrB,aAAY,IAAI,wBAAwB,+BAA+B,OAAO,KAAK,EAAE,EACpF,QACA,CAAC;WACQ,kBAAkB,MAC5B,aAAY,IAAI,wBAAwB,+BAA+B,OAAO,MAAM,EAAE,EACrF,QACA,CAAC;WACQ,SAAS;AACnB,eAAY,IAAI,wBAAwB,+BAA+B,OAAO,MAAM,EAAE,EACrF,QACA,CAAC;AAEF,OAAI,UAAU,cAAc,KAAK,QAChC,aAAY,IAAI,wBAAwB,+BAA+B,OAAO,KAAK,EAAE,EACpF,QACA,CAAC;QAGH,aAAY,IAAI,wBAAwB,OAAO,EAC9C,QACA,CAAC;AAGH,MAAI,WAAW,UAAU,cAAc,KAAK,QAC3C,OAAM,IAAI,MAAM,qDAAqD;AAGtE,SAAO;;CAGR,OAAO,UAAU,SAAiB,OAA+B;EAChE,MAAM,EAAE,kBAAkB,gBAAgB;EAC1C,MAAM,MAAM,kBAA0B,kBAAkB,MAAM;EAE9D,MAAM,kBAAkB,0BAA0B,OAAO,YAAY,EAAE,KAAK,EAC3E,eAAe,MACf,CAAC;AAEF,MAAI,gBAAgB,cAAc,KAAK,QACtC,QAAO;EAGR,MAAM,YAAY,0BAA0B,OAAO,YAAY,EAAE,KAAK,EACrE,eAAe,OACf,CAAC;AAEF,MAAI,UAAU,cAAc,KAAK,QAChC,OAAM,IAAI,MAAM,+BAA+B;AAGhD,SAAO;;;;;CAMR,AAAS,OAAO,WAA6C;AAC5D,SAAO,MAAM,OAAO,UAAU;;CAG/B,AAAS,eAAuB;AAC/B,MAAI,MAAKC,cACR,QAAO,MAAKC,iBAAkB;AAG/B,SAAO,MAAM,cAAc;;CAG5B,mBAAmB;EAClB,MAAM,cAAc,+BAA+B,MAAKF,MAAO,KAAK;EACpE,MAAM,eAAe,IAAI,WAAW,YAAY,SAAS,EAAE;AAC3D,eAAa,KAAK,KAAK,MAAM;AAC7B,eAAa,IAAI,aAAa,EAAE;AAChC,SAAO,oBACN,WAAW,QAAQ,cAAc,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,qBAAqB,EAAE,CACjF;;;;;CAMF,aAAsC;AACrC,SAAO,MAAKA;;;;;CAMb,OAAe;AACd,SAAO,yBAAyB;;;;;CAMjC,MAAM,OAAO,UAAsB,YAAmD;AACrF,QAAM,MAAM,mBAAmB;;;;;CAMhC,sBAAsB,SAAqB,WAAkD;EAC5F,MAAM,kBAAkB,gCAAgC,UAAU;AAGlE,SAAO,8BAA8B;GACpC,SAHe,IAAI,wBAAwB,gBAAgB,UAAU,CAAC,cAAc;GAIpF,OAAO,SAAS,QAAQ;GACxB,WAAW,gBAAgB;GAC3B,aAAa;GACb,QAAQ,MAAKD;GACb,CAAC;;;;;CAMH,kBAAkB,aAAyB,WAAkD;EAC5F,MAAM,kBAAkB,gCAAgC,UAAU;AAElE,SAAO,8BAA8B;GACpC,SAFe,IAAI,wBAAwB,gBAAgB,UAAU,CAAC,cAAc;GAGpF,OAAO,SAAS,YAAY;GAC5B,WAAW,gBAAgB;GAC3B,aAAa;GACb,QAAQ,MAAKA;GACb,CAAC;;;;;CAMH,AAAS,cAAc,SAA0B;AAChD,SAAO,YAAY,MAAM,cAAc,IAAI,YAAY,MAAKG,iBAAkB;;;AAKhF,SAAgB,0BACf,aACA,KACA,SAC0B;AAC1B,KAAI,QAAQ,kBAAkB,OAC7B,OAAM,IAAI,MAAM,4CAA4C;CAG7D,MAAM,4BAA4B,QAAQ,gBACvC,iBAAiB,aAAa,GAAG,GACjC,uBAAuB,aAAa,GAAG;CAE1C,MAAM,WAAW,IAAI,aAAa,CAAC,OAAO,uBAAuB,IAAI,CAAC;CACtE,MAAM,MAAM,IAAI,WAAW,IAAI,SAAS,SAAS,0BAA0B,OAAO;AAClF,KAAI,IAAI,CAAC,SAAS,OAAO,EAAE,EAAE;AAC7B,KAAI,IAAI,UAAU,EAAE;AACpB,KAAI,IAAI,2BAA2B,IAAI,SAAS,OAAO;AACvD,QAAO,IAAI,wBAAwB,KAAK,QAAQ;;AAGjD,SAAS,+BAA+B,OAAmB,eAAwB;CAClF,MAAM,gBAAgB,MAAM,KAAK;CACjC,MAAM,cAAc,OAAO,KAAK,MAAM,MAAM,MAAM,cAAc,CAAC,GAAG;CACpE,MAAM,YAAY,gBACf,iBAAiB,aAAa,GAAG,GACjC,uBAAuB,aAAa,GAAG;CAC1C,MAAM,OAAO,IAAI,WAAW,gBAAgB,UAAU,OAAO;AAC7D,MAAK,IAAI,MAAM,MAAM,GAAG,cAAc,EAAE,EAAE;AAC1C,MAAK,IAAI,WAAW,cAAc;AAClC,QAAO;;AAGR,eAAe,8BAA8B,EAC5C,SACA,OACA,WACA,aACA,UAOE;AACF,KAAI,CAAC,OACJ,OAAM,IAAI,MACT,qFACA;CAEF,MAAM,OAAO,MAAM,OAAO,KAAK,uBAAuB;EACrD;EACA;EACA;EACS;EACT,CAAC;AAEF,QAAO,KAAK,YAAY,QAAQ,KAAK,OAAO,WAAW;;AAGxD,SAAgB,gCAAgC,WAAgC;CAC/E,MAAM,QAAQ,OAAO,cAAc,WAAW,WAAW,UAAU,GAAG;AAEtE,KAAI,MAAM,OAAO,yBAAyB,QACzC,OAAM,IAAI,MAAM,2BAA2B;CAI5C,MAAM,EAAE,QAAQ,UAAU,kBAAkB,sBADrB,MAAM,MAAM,EAAE,CAC4C;CACjF,MAAM,EAAE,kBAAkB,gBAAgB;CAC1C,MAAM,MAAM,kBAA0B,kBAAkB,MAAM;CAC9D,MAAM,mBAAmB,0BAA0B,OAAO,YAAY,EAAE,KAAK,EAC5E,eAAe,OACf,CAAC;AACF,QAAO;EACN,qBAAqB,SAAS,MAAM;EACpC,iBAAiB;EACjB,SAAS;GACR;GACA;GACA;GACA;GACA,aAAa,OAAO,YAAY;GAChC;EACD,WAAW;EACX,WAAW,iBAAiB,YAAY;EACxC"}
+{"version":3,"file":"publickey.mjs","names":["#client","#data","#legacyAddress","#toLegacyAddress"],"sources":["../../src/zklogin/publickey.ts"],"sourcesContent":["// Copyright (c) Mysten Labs, Inc.\n// SPDX-License-Identifier: Apache-2.0\n\nimport { fromBase64, toBase64, toHex } from '@mysten/bcs';\nimport { blake2b } from '@noble/hashes/blake2.js';\nimport { bytesToHex } from '@noble/hashes/utils.js';\n\nimport { PublicKey } from '../cryptography/publickey.js';\nimport type { PublicKeyInitData } from '../cryptography/publickey.js';\nimport { SIGNATURE_SCHEME_TO_FLAG } from '../cryptography/signature-scheme.js';\nimport { normalizeSuiAddress, SUI_ADDRESS_LENGTH } from '../utils/sui-types.js';\nimport type { ZkLoginSignatureInputs } from './bcs.js';\nimport { extractClaimValue } from './jwt-utils.js';\nimport { parseZkLoginSignature } from './signature.js';\nimport { normalizeZkLoginIssuer, toBigEndianBytes, toPaddedBigEndianBytes } from './utils.js';\nimport type { ClientWithCoreApi } from '../client/core.js';\n\n/**\n * A zkLogin public identifier\n */\nexport class ZkLoginPublicIdentifier extends PublicKey {\n\t#data: Uint8Array<ArrayBuffer>;\n\t#client?: ClientWithCoreApi;\n\t#legacyAddress: boolean;\n\n\t/**\n\t * Create a new ZkLoginPublicIdentifier object\n\t * @param value zkLogin public identifier as buffer or base-64 encoded string\n\t */\n\tconstructor(value: PublicKeyInitData, { client }: { client?: ClientWithCoreApi } = {}) {\n\t\tsuper();\n\n\t\tthis.#client = client;\n\n\t\tif (typeof value === 'string') {\n\t\t\tthis.#data = fromBase64(value);\n\t\t} else if (value instanceof Uint8Array) {\n\t\t\tthis.#data = value as Uint8Array<ArrayBuffer>;\n\t\t} else {\n\t\t\tthis.#data = Uint8Array.from(value);\n\t\t}\n\t\tthis.#legacyAddress = this.#data.length !== this.#data[0] + 1 + 32;\n\n\t\tif (this.#legacyAddress) {\n\t\t\tthis.#data = normalizeZkLoginPublicKeyBytes(this.#data, false);\n\t\t}\n\t}\n\n\t/**\n\t * Whether this identifier resolves to the deprecated legacy address derivation.\n\t */\n\tget legacyAddress(): boolean {\n\t\treturn this.#legacyAddress;\n\t}\n\n\tstatic fromBytes(\n\t\tbytes: Uint8Array,\n\t\t{\n\t\t\tclient,\n\t\t\taddress,\n\t\t\tlegacyAddress,\n\t\t}: { client?: ClientWithCoreApi; address?: string; legacyAddress?: boolean } = {},\n\t) {\n\t\tlet publicKey: ZkLoginPublicIdentifier;\n\n\t\tif (legacyAddress === true) {\n\t\t\tpublicKey = new ZkLoginPublicIdentifier(normalizeZkLoginPublicKeyBytes(bytes, true), {\n\t\t\t\tclient,\n\t\t\t});\n\t\t} else if (legacyAddress === false) {\n\t\t\tpublicKey = new ZkLoginPublicIdentifier(normalizeZkLoginPublicKeyBytes(bytes, false), {\n\t\t\t\tclient,\n\t\t\t});\n\t\t} else if (address) {\n\t\t\tpublicKey = new ZkLoginPublicIdentifier(normalizeZkLoginPublicKeyBytes(bytes, false), {\n\t\t\t\tclient,\n\t\t\t});\n\n\t\t\tif (publicKey.toSuiAddress() !== address) {\n\t\t\t\tpublicKey = new ZkLoginPublicIdentifier(normalizeZkLoginPublicKeyBytes(bytes, true), {\n\t\t\t\t\tclient,\n\t\t\t\t});\n\t\t\t}\n\t\t} else {\n\t\t\tpublicKey = new ZkLoginPublicIdentifier(bytes, {\n\t\t\t\tclient,\n\t\t\t});\n\t\t}\n\n\t\tif (address && publicKey.toSuiAddress() !== address) {\n\t\t\tthrow new Error('Public key bytes do not match the provided address');\n\t\t}\n\n\t\treturn publicKey;\n\t}\n\n\tstatic fromProof(address: string, proof: ZkLoginSignatureInputs) {\n\t\tconst { issBase64Details, addressSeed } = proof;\n\t\tconst iss = extractClaimValue<string>(issBase64Details, 'iss');\n\n\t\tconst legacyPublicKey = toZkLoginPublicIdentifier(BigInt(addressSeed), iss, {\n\t\t\tlegacyAddress: true,\n\t\t});\n\n\t\tif (legacyPublicKey.toSuiAddress() === address) {\n\t\t\treturn legacyPublicKey;\n\t\t}\n\n\t\tconst publicKey = toZkLoginPublicIdentifier(BigInt(addressSeed), iss, {\n\t\t\tlegacyAddress: false,\n\t\t});\n\n\t\tif (publicKey.toSuiAddress() !== address) {\n\t\t\tthrow new Error('Proof does not match address');\n\t\t}\n\n\t\treturn publicKey;\n\t}\n\n\t/**\n\t * Checks if two zkLogin public identifiers are equal\n\t */\n\toverride equals(publicKey: ZkLoginPublicIdentifier): boolean {\n\t\treturn super.equals(publicKey);\n\t}\n\n\toverride toSuiAddress(): string {\n\t\tif (this.#legacyAddress) {\n\t\t\treturn this.#toLegacyAddress();\n\t\t}\n\n\t\treturn super.toSuiAddress();\n\t}\n\n\t#toLegacyAddress() {\n\t\tconst legacyBytes = normalizeZkLoginPublicKeyBytes(this.#data, true);\n\t\tconst addressBytes = new Uint8Array(legacyBytes.length + 1);\n\t\taddressBytes[0] = this.flag();\n\t\taddressBytes.set(legacyBytes, 1);\n\t\treturn normalizeSuiAddress(\n\t\t\tbytesToHex(blake2b(addressBytes, { dkLen: 32 })).slice(0, SUI_ADDRESS_LENGTH * 2),\n\t\t);\n\t}\n\n\t/**\n\t * Return the byte array representation of the zkLogin public identifier\n\t */\n\ttoRawBytes(): Uint8Array<ArrayBuffer> {\n\t\treturn this.#data;\n\t}\n\n\t/**\n\t * Return the Sui address associated with this ZkLogin public identifier\n\t */\n\tflag(): number {\n\t\treturn SIGNATURE_SCHEME_TO_FLAG['ZkLogin'];\n\t}\n\n\t/**\n\t * Verifies that the signature is valid for for the provided message\n\t */\n\tasync verify(_message: Uint8Array, _signature: Uint8Array | string): Promise<boolean> {\n\t\tthrow Error('does not support');\n\t}\n\n\t/**\n\t * Verifies that the signature is valid for for the provided PersonalMessage\n\t */\n\tverifyPersonalMessage(message: Uint8Array, signature: Uint8Array | string): Promise<boolean> {\n\t\tconst parsedSignature = parseSerializedZkLoginSignature(signature);\n\t\tconst address = new ZkLoginPublicIdentifier(parsedSignature.publicKey).toSuiAddress();\n\n\t\treturn graphqlVerifyZkLoginSignature({\n\t\t\taddress: address,\n\t\t\tbytes: toBase64(message),\n\t\t\tsignature: parsedSignature.serializedSignature,\n\t\t\tintentScope: 'PersonalMessage',\n\t\t\tclient: this.#client,\n\t\t});\n\t}\n\n\t/**\n\t * Verifies that the signature is valid for for the provided Transaction\n\t */\n\tverifyTransaction(transaction: Uint8Array, signature: Uint8Array | string): Promise<boolean> {\n\t\tconst parsedSignature = parseSerializedZkLoginSignature(signature);\n\t\tconst address = new ZkLoginPublicIdentifier(parsedSignature.publicKey).toSuiAddress();\n\t\treturn graphqlVerifyZkLoginSignature({\n\t\t\taddress: address,\n\t\t\tbytes: toBase64(transaction),\n\t\t\tsignature: parsedSignature.serializedSignature,\n\t\t\tintentScope: 'TransactionData',\n\t\t\tclient: this.#client,\n\t\t});\n\t}\n\n\t/**\n\t * Verifies that the public key is associated with the provided address\n\t */\n\toverride verifyAddress(address: string): boolean {\n\t\treturn address === super.toSuiAddress() || address === this.#toLegacyAddress();\n\t}\n}\n\n// Derive the public identifier for zklogin based on address seed and iss.\nexport function toZkLoginPublicIdentifier(\n\taddressSeed: bigint,\n\tiss: string,\n\toptions: { client?: ClientWithCoreApi; legacyAddress: boolean },\n): ZkLoginPublicIdentifier {\n\tif (options.legacyAddress === undefined) {\n\t\tthrow new Error('legacyAddress parameter must be specified');\n\t}\n\t// Consists of iss_bytes_len || iss_bytes || padded_32_byte_address_seed.\n\tconst addressSeedBytesBigEndian = options.legacyAddress\n\t\t? toBigEndianBytes(addressSeed, 32)\n\t\t: toPaddedBigEndianBytes(addressSeed, 32);\n\n\tconst issBytes = new TextEncoder().encode(normalizeZkLoginIssuer(iss));\n\tconst tmp = new Uint8Array(1 + issBytes.length + addressSeedBytesBigEndian.length);\n\ttmp.set([issBytes.length], 0);\n\ttmp.set(issBytes, 1);\n\ttmp.set(addressSeedBytesBigEndian, 1 + issBytes.length);\n\treturn new ZkLoginPublicIdentifier(tmp, options);\n}\n\nfunction normalizeZkLoginPublicKeyBytes(bytes: Uint8Array, legacyAddress: boolean) {\n\tconst issByteLength = bytes[0] + 1;\n\tconst addressSeed = BigInt(`0x${toHex(bytes.slice(issByteLength))}`);\n\tconst seedBytes = legacyAddress\n\t\t? toBigEndianBytes(addressSeed, 32)\n\t\t: toPaddedBigEndianBytes(addressSeed, 32);\n\tconst data = new Uint8Array(issByteLength + seedBytes.length);\n\tdata.set(bytes.slice(0, issByteLength), 0);\n\tdata.set(seedBytes, issByteLength);\n\treturn data;\n}\n\nasync function graphqlVerifyZkLoginSignature({\n\taddress,\n\tbytes,\n\tsignature,\n\tintentScope,\n\tclient,\n}: {\n\taddress: string;\n\tbytes: string;\n\tsignature: string;\n\tintentScope: 'PersonalMessage' | 'TransactionData';\n\tclient?: ClientWithCoreApi;\n}) {\n\tif (!client) {\n\t\tthrow new Error(\n\t\t\t'A Sui Client (GRPC, GraphQL, or JSON RPC) is required to verify zkLogin signatures',\n\t\t);\n\t}\n\tconst resp = await client.core.verifyZkLoginSignature({\n\t\tbytes,\n\t\tsignature,\n\t\tintentScope,\n\t\taddress: address,\n\t});\n\n\treturn resp.success === true && resp.errors.length === 0;\n}\n\nexport function parseSerializedZkLoginSignature(signature: Uint8Array | string) {\n\tconst bytes = typeof signature === 'string' ? fromBase64(signature) : signature;\n\n\tif (bytes[0] !== SIGNATURE_SCHEME_TO_FLAG.ZkLogin) {\n\t\tthrow new Error('Invalid signature scheme');\n\t}\n\n\tconst signatureBytes = bytes.slice(1);\n\tconst { inputs, maxEpoch, userSignature } = parseZkLoginSignature(signatureBytes);\n\tconst { issBase64Details, addressSeed } = inputs;\n\tconst iss = extractClaimValue<string>(issBase64Details, 'iss');\n\tconst publicIdentifier = toZkLoginPublicIdentifier(BigInt(addressSeed), iss, {\n\t\tlegacyAddress: false,\n\t});\n\treturn {\n\t\tserializedSignature: toBase64(bytes),\n\t\tsignatureScheme: 'ZkLogin' as const,\n\t\tzkLogin: {\n\t\t\tinputs,\n\t\t\tmaxEpoch,\n\t\t\tuserSignature,\n\t\t\tiss,\n\t\t\taddressSeed: BigInt(addressSeed),\n\t\t},\n\t\tsignature: bytes,\n\t\tpublicKey: publicIdentifier.toRawBytes(),\n\t};\n}\n"],"mappings":";;;;;;;;;;;;;;AAoBA,IAAa,0BAAb,MAAa,gCAAgC,UAAU;CACtD;CACA;CACA;;;;;CAMA,YAAY,OAA0B,EAAE,WAA2C,EAAE,EAAE;AACtF,SAAO;AAEP,QAAKA,SAAU;AAEf,MAAI,OAAO,UAAU,SACpB,OAAKC,OAAQ,WAAW,MAAM;WACpB,iBAAiB,WAC3B,OAAKA,OAAQ;MAEb,OAAKA,OAAQ,WAAW,KAAK,MAAM;AAEpC,QAAKC,gBAAiB,MAAKD,KAAM,WAAW,MAAKA,KAAM,KAAK,IAAI;AAEhE,MAAI,MAAKC,cACR,OAAKD,OAAQ,+BAA+B,MAAKA,MAAO,MAAM;;;;;CAOhE,IAAI,gBAAyB;AAC5B,SAAO,MAAKC;;CAGb,OAAO,UACN,OACA,EACC,QACA,SACA,kBAC8E,EAAE,EAChF;EACD,IAAI;AAEJ,MAAI,kBAAkB,KACrB,aAAY,IAAI,wBAAwB,+BAA+B,OAAO,KAAK,EAAE,EACpF,QACA,CAAC;WACQ,kBAAkB,MAC5B,aAAY,IAAI,wBAAwB,+BAA+B,OAAO,MAAM,EAAE,EACrF,QACA,CAAC;WACQ,SAAS;AACnB,eAAY,IAAI,wBAAwB,+BAA+B,OAAO,MAAM,EAAE,EACrF,QACA,CAAC;AAEF,OAAI,UAAU,cAAc,KAAK,QAChC,aAAY,IAAI,wBAAwB,+BAA+B,OAAO,KAAK,EAAE,EACpF,QACA,CAAC;QAGH,aAAY,IAAI,wBAAwB,OAAO,EAC9C,QACA,CAAC;AAGH,MAAI,WAAW,UAAU,cAAc,KAAK,QAC3C,OAAM,IAAI,MAAM,qDAAqD;AAGtE,SAAO;;CAGR,OAAO,UAAU,SAAiB,OAA+B;EAChE,MAAM,EAAE,kBAAkB,gBAAgB;EAC1C,MAAM,MAAM,kBAA0B,kBAAkB,MAAM;EAE9D,MAAM,kBAAkB,0BAA0B,OAAO,YAAY,EAAE,KAAK,EAC3E,eAAe,MACf,CAAC;AAEF,MAAI,gBAAgB,cAAc,KAAK,QACtC,QAAO;EAGR,MAAM,YAAY,0BAA0B,OAAO,YAAY,EAAE,KAAK,EACrE,eAAe,OACf,CAAC;AAEF,MAAI,UAAU,cAAc,KAAK,QAChC,OAAM,IAAI,MAAM,+BAA+B;AAGhD,SAAO;;;;;CAMR,AAAS,OAAO,WAA6C;AAC5D,SAAO,MAAM,OAAO,UAAU;;CAG/B,AAAS,eAAuB;AAC/B,MAAI,MAAKA,cACR,QAAO,MAAKC,iBAAkB;AAG/B,SAAO,MAAM,cAAc;;CAG5B,mBAAmB;EAClB,MAAM,cAAc,+BAA+B,MAAKF,MAAO,KAAK;EACpE,MAAM,eAAe,IAAI,WAAW,YAAY,SAAS,EAAE;AAC3D,eAAa,KAAK,KAAK,MAAM;AAC7B,eAAa,IAAI,aAAa,EAAE;AAChC,SAAO,oBACN,WAAW,QAAQ,cAAc,EAAE,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,qBAAqB,EAAE,CACjF;;;;;CAMF,aAAsC;AACrC,SAAO,MAAKA;;;;;CAMb,OAAe;AACd,SAAO,yBAAyB;;;;;CAMjC,MAAM,OAAO,UAAsB,YAAmD;AACrF,QAAM,MAAM,mBAAmB;;;;;CAMhC,sBAAsB,SAAqB,WAAkD;EAC5F,MAAM,kBAAkB,gCAAgC,UAAU;AAGlE,SAAO,8BAA8B;GACpC,SAHe,IAAI,wBAAwB,gBAAgB,UAAU,CAAC,cAAc;GAIpF,OAAO,SAAS,QAAQ;GACxB,WAAW,gBAAgB;GAC3B,aAAa;GACb,QAAQ,MAAKD;GACb,CAAC;;;;;CAMH,kBAAkB,aAAyB,WAAkD;EAC5F,MAAM,kBAAkB,gCAAgC,UAAU;AAElE,SAAO,8BAA8B;GACpC,SAFe,IAAI,wBAAwB,gBAAgB,UAAU,CAAC,cAAc;GAGpF,OAAO,SAAS,YAAY;GAC5B,WAAW,gBAAgB;GAC3B,aAAa;GACb,QAAQ,MAAKA;GACb,CAAC;;;;;CAMH,AAAS,cAAc,SAA0B;AAChD,SAAO,YAAY,MAAM,cAAc,IAAI,YAAY,MAAKG,iBAAkB;;;AAKhF,SAAgB,0BACf,aACA,KACA,SAC0B;AAC1B,KAAI,QAAQ,kBAAkB,OAC7B,OAAM,IAAI,MAAM,4CAA4C;CAG7D,MAAM,4BAA4B,QAAQ,gBACvC,iBAAiB,aAAa,GAAG,GACjC,uBAAuB,aAAa,GAAG;CAE1C,MAAM,WAAW,IAAI,aAAa,CAAC,OAAO,uBAAuB,IAAI,CAAC;CACtE,MAAM,MAAM,IAAI,WAAW,IAAI,SAAS,SAAS,0BAA0B,OAAO;AAClF,KAAI,IAAI,CAAC,SAAS,OAAO,EAAE,EAAE;AAC7B,KAAI,IAAI,UAAU,EAAE;AACpB,KAAI,IAAI,2BAA2B,IAAI,SAAS,OAAO;AACvD,QAAO,IAAI,wBAAwB,KAAK,QAAQ;;AAGjD,SAAS,+BAA+B,OAAmB,eAAwB;CAClF,MAAM,gBAAgB,MAAM,KAAK;CACjC,MAAM,cAAc,OAAO,KAAK,MAAM,MAAM,MAAM,cAAc,CAAC,GAAG;CACpE,MAAM,YAAY,gBACf,iBAAiB,aAAa,GAAG,GACjC,uBAAuB,aAAa,GAAG;CAC1C,MAAM,OAAO,IAAI,WAAW,gBAAgB,UAAU,OAAO;AAC7D,MAAK,IAAI,MAAM,MAAM,GAAG,cAAc,EAAE,EAAE;AAC1C,MAAK,IAAI,WAAW,cAAc;AAClC,QAAO;;AAGR,eAAe,8BAA8B,EAC5C,SACA,OACA,WACA,aACA,UAOE;AACF,KAAI,CAAC,OACJ,OAAM,IAAI,MACT,qFACA;CAEF,MAAM,OAAO,MAAM,OAAO,KAAK,uBAAuB;EACrD;EACA;EACA;EACS;EACT,CAAC;AAEF,QAAO,KAAK,YAAY,QAAQ,KAAK,OAAO,WAAW;;AAGxD,SAAgB,gCAAgC,WAAgC;CAC/E,MAAM,QAAQ,OAAO,cAAc,WAAW,WAAW,UAAU,GAAG;AAEtE,KAAI,MAAM,OAAO,yBAAyB,QACzC,OAAM,IAAI,MAAM,2BAA2B;CAI5C,MAAM,EAAE,QAAQ,UAAU,kBAAkB,sBADrB,MAAM,MAAM,EAAE,CAC4C;CACjF,MAAM,EAAE,kBAAkB,gBAAgB;CAC1C,MAAM,MAAM,kBAA0B,kBAAkB,MAAM;CAC9D,MAAM,mBAAmB,0BAA0B,OAAO,YAAY,EAAE,KAAK,EAC5E,eAAe,OACf,CAAC;AACF,QAAO;EACN,qBAAqB,SAAS,MAAM;EACpC,iBAAiB;EACjB,SAAS;GACR;GACA;GACA;GACA;GACA,aAAa,OAAO,YAAY;GAChC;EACD,WAAW;EACX,WAAW,iBAAiB,YAAY;EACxC"}

package/dist/zklogin/signer.d.mts

@@ -0,0 +1,55 @@
+import { IntentScope } from "../cryptography/intent.mjs";
+import { SignatureScheme } from "../cryptography/signature-scheme.mjs";
+import { SignatureWithBytes, Signer } from "../cryptography/keypair.mjs";
+import { ClientWithCoreApi } from "../client/core.mjs";
+import { ZkLoginSignatureInputs } from "./bcs.mjs";
+import { ZkLoginPublicIdentifier } from "./publickey.mjs";
+
+//#region src/zklogin/signer.d.ts
+interface ZkLoginSignerOptions {
+  /** The ephemeral signer whose signature is wrapped by the zkLogin proof. */
+  ephemeralSigner: Signer;
+  /** The maxEpoch the proof was generated for. */
+  maxEpoch: number;
+  /** The zkLogin proof inputs, including the `addressSeed`. */
+  inputs: ZkLoginSignatureInputs;
+  /**
+   * Whether this account uses the deprecated legacy address derivation. The zkLogin address is
+   * derived from the proof inputs; this flag disambiguates legacy vs. current derivation, matching
+   * the rest of the zkLogin address API (e.g. `jwtToAddress`, `toZkLoginPublicIdentifier`).
+   *
+   * A wrong flag silently yields a signer for the wrong address; pass `address` to guard against it.
+   */
+  legacyAddress: boolean;
+  /**
+   * The expected zkLogin address. When provided, the address derived from `inputs` + `legacyAddress`
+   * is validated against it and the constructor throws on mismatch — guarding against a wrong
+   * `legacyAddress` flag producing a signer for the wrong address.
+   */
+  address?: string;
+  /** Optional client, threaded into the derived public key so it can verify signatures. */
+  client?: ClientWithCoreApi;
+}
+/**
+ * A transport- and provider-agnostic zkLogin signer.
+ *
+ * It wraps any ephemeral {@link Signer} and, for every signing operation, transforms the ephemeral
+ * signature into a zkLogin signature using the supplied proof inputs and `maxEpoch`. Because every
+ * signing method on {@link Signer} funnels through `signWithIntent`, overriding that single method is
+ * enough to cover `signTransaction`, `signPersonalMessage`, and `signAndExecuteTransaction`.
+ */
+declare class ZkLoginSigner extends Signer {
+  #private;
+  constructor(options: ZkLoginSignerOptions);
+  /**
+   * The single extension point: the ephemeral signature is produced with the requested intent and
+   * then wrapped in a zkLogin signature.
+   */
+  signWithIntent(bytes: Uint8Array, intent: IntentScope): Promise<SignatureWithBytes>;
+  sign(_data: Uint8Array): never;
+  getKeyScheme(): SignatureScheme;
+  getPublicKey(): ZkLoginPublicIdentifier;
+}
+//#endregion
+export { ZkLoginSigner, ZkLoginSignerOptions };
+//# sourceMappingURL=signer.d.mts.map

package/dist/zklogin/signer.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.d.mts","names":[],"sources":["../../src/zklogin/signer.ts"],"mappings":";;;;;;;;UAaiB,oBAAA;EAAA;EAEhB,eAAA,EAAiB,MAAA;;EAEjB,QAAA;EAEQ;EAAR,MAAA,EAAQ,sBAAA;EAgBkB;;;;;;;EAR1B,aAAA;EAMA;;;;;EAAA,OAAA;EAa0B;EAX1B,MAAA,GAAS,iBAAA;AAAA;;;;;;;;;cAWG,aAAA,SAAsB,MAAA;EAAA;cAQtB,OAAA,EAAS,oBAAA;;;;;EAoCN,cAAA,CACd,KAAA,EAAO,UAAA,EACP,MAAA,EAAQ,WAAA,GACN,OAAA,CAAQ,kBAAA;EAcX,IAAA,CAAK,KAAA,EAAO,UAAA;EAMZ,YAAA,CAAA,GAAgB,eAAA;EAIhB,YAAA,CAAA,GAAgB,uBAAA;AAAA"}

package/dist/zklogin/signer.mjs

@@ -0,0 +1,68 @@
+import { extractClaimValue } from "./jwt-utils.mjs";
+import { getZkLoginSignature } from "./signature.mjs";
+import { toZkLoginPublicIdentifier } from "./publickey.mjs";
+import { Signer } from "../cryptography/keypair.mjs";
+
+//#region src/zklogin/signer.ts
+/**
+* A transport- and provider-agnostic zkLogin signer.
+*
+* It wraps any ephemeral {@link Signer} and, for every signing operation, transforms the ephemeral
+* signature into a zkLogin signature using the supplied proof inputs and `maxEpoch`. Because every
+* signing method on {@link Signer} funnels through `signWithIntent`, overriding that single method is
+* enough to cover `signTransaction`, `signPersonalMessage`, and `signAndExecuteTransaction`.
+*/
+var ZkLoginSigner = class extends Signer {
+	#ephemeralSigner;
+	#maxEpoch;
+	#inputs;
+	#legacyAddress;
+	#client;
+	#publicKey;
+	constructor(options) {
+		super();
+		this.#ephemeralSigner = options.ephemeralSigner;
+		this.#maxEpoch = options.maxEpoch;
+		this.#inputs = options.inputs;
+		this.#legacyAddress = options.legacyAddress;
+		this.#client = options.client;
+		if (options.address !== void 0) {
+			const derived = this.#derivePublicKey().toSuiAddress();
+			if (derived !== options.address) throw new Error(`zkLogin proof does not match the provided address (derived ${derived}, expected ${options.address}) — check the \`legacyAddress\` flag`);
+		}
+	}
+	#derivePublicKey() {
+		return this.#publicKey ??= toZkLoginPublicIdentifier(BigInt(this.#inputs.addressSeed), extractClaimValue(this.#inputs.issBase64Details, "iss"), {
+			legacyAddress: this.#legacyAddress,
+			client: this.#client
+		});
+	}
+	/**
+	* The single extension point: the ephemeral signature is produced with the requested intent and
+	* then wrapped in a zkLogin signature.
+	*/
+	async signWithIntent(bytes, intent) {
+		const { bytes: signedBytes, signature: userSignature } = await this.#ephemeralSigner.signWithIntent(bytes, intent);
+		return {
+			bytes: signedBytes,
+			signature: getZkLoginSignature({
+				inputs: this.#inputs,
+				maxEpoch: this.#maxEpoch,
+				userSignature
+			})
+		};
+	}
+	sign(_data) {
+		throw new Error("ZkLoginSigner does not support signing directly. Use signTransaction or signPersonalMessage instead");
+	}
+	getKeyScheme() {
+		return "ZkLogin";
+	}
+	getPublicKey() {
+		return this.#derivePublicKey();
+	}
+};
+
+//#endregion
+export { ZkLoginSigner };
+//# sourceMappingURL=signer.mjs.map

package/dist/zklogin/signer.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signer.mjs","names":["#ephemeralSigner","#maxEpoch","#inputs","#legacyAddress","#client","#derivePublicKey","#publicKey"],"sources":["../../src/zklogin/signer.ts"],"sourcesContent":["// Copyright (c) Mysten Labs, Inc.\n// SPDX-License-Identifier: Apache-2.0\n\nimport type { ClientWithCoreApi } from '../client/core.js';\nimport type { IntentScope } from '../cryptography/intent.js';\nimport type { SignatureWithBytes } from '../cryptography/keypair.js';\nimport { Signer } from '../cryptography/keypair.js';\nimport type { SignatureScheme } from '../cryptography/signature-scheme.js';\nimport type { ZkLoginSignatureInputs } from './bcs.js';\nimport { extractClaimValue } from './jwt-utils.js';\nimport { toZkLoginPublicIdentifier, ZkLoginPublicIdentifier } from './publickey.js';\nimport { getZkLoginSignature } from './signature.js';\n\nexport interface ZkLoginSignerOptions {\n\t/** The ephemeral signer whose signature is wrapped by the zkLogin proof. */\n\tephemeralSigner: Signer;\n\t/** The maxEpoch the proof was generated for. */\n\tmaxEpoch: number;\n\t/** The zkLogin proof inputs, including the `addressSeed`. */\n\tinputs: ZkLoginSignatureInputs;\n\t/**\n\t * Whether this account uses the deprecated legacy address derivation. The zkLogin address is\n\t * derived from the proof inputs; this flag disambiguates legacy vs. current derivation, matching\n\t * the rest of the zkLogin address API (e.g. `jwtToAddress`, `toZkLoginPublicIdentifier`).\n\t *\n\t * A wrong flag silently yields a signer for the wrong address; pass `address` to guard against it.\n\t */\n\tlegacyAddress: boolean;\n\t/**\n\t * The expected zkLogin address. When provided, the address derived from `inputs` + `legacyAddress`\n\t * is validated against it and the constructor throws on mismatch — guarding against a wrong\n\t * `legacyAddress` flag producing a signer for the wrong address.\n\t */\n\taddress?: string;\n\t/** Optional client, threaded into the derived public key so it can verify signatures. */\n\tclient?: ClientWithCoreApi;\n}\n\n/**\n * A transport- and provider-agnostic zkLogin signer.\n *\n * It wraps any ephemeral {@link Signer} and, for every signing operation, transforms the ephemeral\n * signature into a zkLogin signature using the supplied proof inputs and `maxEpoch`. Because every\n * signing method on {@link Signer} funnels through `signWithIntent`, overriding that single method is\n * enough to cover `signTransaction`, `signPersonalMessage`, and `signAndExecuteTransaction`.\n */\nexport class ZkLoginSigner extends Signer {\n\t#ephemeralSigner: Signer;\n\t#maxEpoch: number;\n\t#inputs: ZkLoginSignatureInputs;\n\t#legacyAddress: boolean;\n\t#client?: ClientWithCoreApi;\n\t#publicKey?: ZkLoginPublicIdentifier;\n\n\tconstructor(options: ZkLoginSignerOptions) {\n\t\tsuper();\n\t\tthis.#ephemeralSigner = options.ephemeralSigner;\n\t\tthis.#maxEpoch = options.maxEpoch;\n\t\tthis.#inputs = options.inputs;\n\t\tthis.#legacyAddress = options.legacyAddress;\n\t\tthis.#client = options.client;\n\n\t\tif (options.address !== undefined) {\n\t\t\tconst derived = this.#derivePublicKey().toSuiAddress();\n\t\t\tif (derived !== options.address) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`zkLogin proof does not match the provided address (derived ${derived}, expected ` +\n\t\t\t\t\t\t`${options.address}) — check the \\`legacyAddress\\` flag`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t// Shared derive-and-memoize used by both the constructor's address validation and getPublicKey().\n\t// It is `#private` (non-virtual) on purpose: the constructor must derive the *base* address even\n\t// when a subclass overrides getPublicKey() — calling the overridable getPublicKey() from the\n\t// constructor would dispatch to the subclass before its fields are initialized. Laziness also\n\t// means subclasses that override getPublicKey() (e.g. EnokiKeypair) never pay for this derivation.\n\t#derivePublicKey(): ZkLoginPublicIdentifier {\n\t\treturn (this.#publicKey ??= toZkLoginPublicIdentifier(\n\t\t\tBigInt(this.#inputs.addressSeed),\n\t\t\textractClaimValue<string>(this.#inputs.issBase64Details, 'iss'),\n\t\t\t{ legacyAddress: this.#legacyAddress, client: this.#client },\n\t\t));\n\t}\n\n\t/**\n\t * The single extension point: the ephemeral signature is produced with the requested intent and\n\t * then wrapped in a zkLogin signature.\n\t */\n\toverride async signWithIntent(\n\t\tbytes: Uint8Array,\n\t\tintent: IntentScope,\n\t): Promise<SignatureWithBytes> {\n\t\tconst { bytes: signedBytes, signature: userSignature } =\n\t\t\tawait this.#ephemeralSigner.signWithIntent(bytes, intent);\n\n\t\treturn {\n\t\t\tbytes: signedBytes,\n\t\t\tsignature: getZkLoginSignature({\n\t\t\t\tinputs: this.#inputs,\n\t\t\t\tmaxEpoch: this.#maxEpoch,\n\t\t\t\tuserSignature,\n\t\t\t}),\n\t\t};\n\t}\n\n\tsign(_data: Uint8Array): never {\n\t\tthrow new Error(\n\t\t\t'ZkLoginSigner does not support signing directly. Use signTransaction or signPersonalMessage instead',\n\t\t);\n\t}\n\n\tgetKeyScheme(): SignatureScheme {\n\t\treturn 'ZkLogin';\n\t}\n\n\tgetPublicKey(): ZkLoginPublicIdentifier {\n\t\treturn this.#derivePublicKey();\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;AA8CA,IAAa,gBAAb,cAAmC,OAAO;CACzC;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,SAA+B;AAC1C,SAAO;AACP,QAAKA,kBAAmB,QAAQ;AAChC,QAAKC,WAAY,QAAQ;AACzB,QAAKC,SAAU,QAAQ;AACvB,QAAKC,gBAAiB,QAAQ;AAC9B,QAAKC,SAAU,QAAQ;AAEvB,MAAI,QAAQ,YAAY,QAAW;GAClC,MAAM,UAAU,MAAKC,iBAAkB,CAAC,cAAc;AACtD,OAAI,YAAY,QAAQ,QACvB,OAAM,IAAI,MACT,8DAA8D,QAAQ,aAClE,QAAQ,QAAQ,sCACpB;;;CAUJ,mBAA4C;AAC3C,SAAQ,MAAKC,cAAe,0BAC3B,OAAO,MAAKJ,OAAQ,YAAY,EAChC,kBAA0B,MAAKA,OAAQ,kBAAkB,MAAM,EAC/D;GAAE,eAAe,MAAKC;GAAgB,QAAQ,MAAKC;GAAS,CAC5D;;;;;;CAOF,MAAe,eACd,OACA,QAC8B;EAC9B,MAAM,EAAE,OAAO,aAAa,WAAW,kBACtC,MAAM,MAAKJ,gBAAiB,eAAe,OAAO,OAAO;AAE1D,SAAO;GACN,OAAO;GACP,WAAW,oBAAoB;IAC9B,QAAQ,MAAKE;IACb,UAAU,MAAKD;IACf;IACA,CAAC;GACF;;CAGF,KAAK,OAA0B;AAC9B,QAAM,IAAI,MACT,sGACA;;CAGF,eAAgC;AAC/B,SAAO;;CAGR,eAAwC;AACvC,SAAO,MAAKI,iBAAkB"}

package/package.json

@@ -3,7 +3,7 @@
   "author": "Mysten Labs <build@mystenlabs.com>",
   "description": "Sui TypeScript API",
   "homepage": "https://sdk.mystenlabs.com",
-  "version": "2.19.0",
+  "version": "2.20.0",
   "license": "Apache-2.0",
   "sideEffects": false,
   "files": [

package/src/version.ts

@@ -3,4 +3,4 @@
 
 // This file is generated by genversion.mjs. Do not edit it directly.
 
-export const PACKAGE_VERSION = '2.19.0';
+export const PACKAGE_VERSION = '2.20.0';

package/src/zklogin/index.ts

@@ -12,6 +12,8 @@ export {
 export { computeZkLoginAddressFromSeed, computeZkLoginAddress, jwtToAddress } from './address.js';
 export type { ComputeZkLoginAddressOptions } from './address.js';
 export { toZkLoginPublicIdentifier, ZkLoginPublicIdentifier } from './publickey.js';
+export { ZkLoginSigner } from './signer.js';
+export type { ZkLoginSignerOptions } from './signer.js';
 export type { ZkLoginSignatureInputs } from './bcs.js';
 export { poseidonHash } from './poseidon.js';
 export { generateNonce, generateRandomness } from './nonce.js';

package/src/zklogin/publickey.ts

@@ -46,6 +46,13 @@ export class ZkLoginPublicIdentifier extends PublicKey {
 		}
 	}
 
+	/**
+	 * Whether this identifier resolves to the deprecated legacy address derivation.
+	 */
+	get legacyAddress(): boolean {
+		return this.#legacyAddress;
+	}
+
 	static fromBytes(
 		bytes: Uint8Array,
 		{

package/src/zklogin/signer.ts

@@ -0,0 +1,121 @@
+// Copyright (c) Mysten Labs, Inc.
+// SPDX-License-Identifier: Apache-2.0
+
+import type { ClientWithCoreApi } from '../client/core.js';
+import type { IntentScope } from '../cryptography/intent.js';
+import type { SignatureWithBytes } from '../cryptography/keypair.js';
+import { Signer } from '../cryptography/keypair.js';
+import type { SignatureScheme } from '../cryptography/signature-scheme.js';
+import type { ZkLoginSignatureInputs } from './bcs.js';
+import { extractClaimValue } from './jwt-utils.js';
+import { toZkLoginPublicIdentifier, ZkLoginPublicIdentifier } from './publickey.js';
+import { getZkLoginSignature } from './signature.js';
+
+export interface ZkLoginSignerOptions {
+	/** The ephemeral signer whose signature is wrapped by the zkLogin proof. */
+	ephemeralSigner: Signer;
+	/** The maxEpoch the proof was generated for. */
+	maxEpoch: number;
+	/** The zkLogin proof inputs, including the `addressSeed`. */
+	inputs: ZkLoginSignatureInputs;
+	/**
+	 * Whether this account uses the deprecated legacy address derivation. The zkLogin address is
+	 * derived from the proof inputs; this flag disambiguates legacy vs. current derivation, matching
+	 * the rest of the zkLogin address API (e.g. `jwtToAddress`, `toZkLoginPublicIdentifier`).
+	 *
+	 * A wrong flag silently yields a signer for the wrong address; pass `address` to guard against it.
+	 */
+	legacyAddress: boolean;
+	/**
+	 * The expected zkLogin address. When provided, the address derived from `inputs` + `legacyAddress`
+	 * is validated against it and the constructor throws on mismatch — guarding against a wrong
+	 * `legacyAddress` flag producing a signer for the wrong address.
+	 */
+	address?: string;
+	/** Optional client, threaded into the derived public key so it can verify signatures. */
+	client?: ClientWithCoreApi;
+}
+
+/**
+ * A transport- and provider-agnostic zkLogin signer.
+ *
+ * It wraps any ephemeral {@link Signer} and, for every signing operation, transforms the ephemeral
+ * signature into a zkLogin signature using the supplied proof inputs and `maxEpoch`. Because every
+ * signing method on {@link Signer} funnels through `signWithIntent`, overriding that single method is
+ * enough to cover `signTransaction`, `signPersonalMessage`, and `signAndExecuteTransaction`.
+ */
+export class ZkLoginSigner extends Signer {
+	#ephemeralSigner: Signer;
+	#maxEpoch: number;
+	#inputs: ZkLoginSignatureInputs;
+	#legacyAddress: boolean;
+	#client?: ClientWithCoreApi;
+	#publicKey?: ZkLoginPublicIdentifier;
+
+	constructor(options: ZkLoginSignerOptions) {
+		super();
+		this.#ephemeralSigner = options.ephemeralSigner;
+		this.#maxEpoch = options.maxEpoch;
+		this.#inputs = options.inputs;
+		this.#legacyAddress = options.legacyAddress;
+		this.#client = options.client;
+
+		if (options.address !== undefined) {
+			const derived = this.#derivePublicKey().toSuiAddress();
+			if (derived !== options.address) {
+				throw new Error(
+					`zkLogin proof does not match the provided address (derived ${derived}, expected ` +
+						`${options.address}) — check the \`legacyAddress\` flag`,
+				);
+			}
+		}
+	}
+
+	// Shared derive-and-memoize used by both the constructor's address validation and getPublicKey().
+	// It is `#private` (non-virtual) on purpose: the constructor must derive the *base* address even
+	// when a subclass overrides getPublicKey() — calling the overridable getPublicKey() from the
+	// constructor would dispatch to the subclass before its fields are initialized. Laziness also
+	// means subclasses that override getPublicKey() (e.g. EnokiKeypair) never pay for this derivation.
+	#derivePublicKey(): ZkLoginPublicIdentifier {
+		return (this.#publicKey ??= toZkLoginPublicIdentifier(
+			BigInt(this.#inputs.addressSeed),
+			extractClaimValue<string>(this.#inputs.issBase64Details, 'iss'),
+			{ legacyAddress: this.#legacyAddress, client: this.#client },
+		));
+	}
+
+	/**
+	 * The single extension point: the ephemeral signature is produced with the requested intent and
+	 * then wrapped in a zkLogin signature.
+	 */
+	override async signWithIntent(
+		bytes: Uint8Array,
+		intent: IntentScope,
+	): Promise<SignatureWithBytes> {
+		const { bytes: signedBytes, signature: userSignature } =
+			await this.#ephemeralSigner.signWithIntent(bytes, intent);
+
+		return {
+			bytes: signedBytes,
+			signature: getZkLoginSignature({
+				inputs: this.#inputs,
+				maxEpoch: this.#maxEpoch,
+				userSignature,
+			}),
+		};
+	}
+
+	sign(_data: Uint8Array): never {
+		throw new Error(
+			'ZkLoginSigner does not support signing directly. Use signTransaction or signPersonalMessage instead',
+		);
+	}
+
+	getKeyScheme(): SignatureScheme {
+		return 'ZkLogin';
+	}
+
+	getPublicKey(): ZkLoginPublicIdentifier {
+		return this.#derivePublicKey();
+	}
+}