solana-kms-signer 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +21 -0
- package/README.md +610 -0
- package/dist/errors/index.d.ts +54 -0
- package/dist/errors/index.d.ts.map +1 -0
- package/dist/errors/index.js +63 -0
- package/dist/errors/index.js.map +1 -0
- package/dist/index.d.ts +14 -0
- package/dist/index.d.ts.map +1 -0
- package/dist/index.js +17 -0
- package/dist/index.js.map +1 -0
- package/dist/kms/client.d.ts +60 -0
- package/dist/kms/client.d.ts.map +1 -0
- package/dist/kms/client.js +108 -0
- package/dist/kms/client.js.map +1 -0
- package/dist/kms/signer.d.ts +170 -0
- package/dist/kms/signer.d.ts.map +1 -0
- package/dist/kms/signer.js +230 -0
- package/dist/kms/signer.js.map +1 -0
- package/dist/types/index.d.ts +39 -0
- package/dist/types/index.d.ts.map +1 -0
- package/dist/types/index.js +2 -0
- package/dist/types/index.js.map +1 -0
- package/dist/utils/publicKey.d.ts +28 -0
- package/dist/utils/publicKey.d.ts.map +1 -0
- package/dist/utils/publicKey.js +56 -0
- package/dist/utils/publicKey.js.map +1 -0
- package/package.json +73 -0
- package/src/errors/index.test.ts +173 -0
- package/src/errors/index.ts +61 -0
- package/src/index.ts +27 -0
- package/src/kms/client.test.ts +285 -0
- package/src/kms/client.ts +132 -0
- package/src/kms/signer.test.ts +446 -0
- package/src/kms/signer.ts +274 -0
- package/src/types/index.ts +44 -0
- package/src/utils/publicKey.test.ts +135 -0
- package/src/utils/publicKey.ts +70 -0
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Custom error class for AWS KMS API-related errors.
|
|
3
|
+
*
|
|
4
|
+
* Thrown when AWS KMS operations fail, including:
|
|
5
|
+
* - GetPublicKey failures (AccessDeniedException, KeyNotFoundException, etc.)
|
|
6
|
+
* - Sign failures (ThrottlingException, KeyUnavailableException, etc.)
|
|
7
|
+
* - Network timeouts and service unavailability
|
|
8
|
+
*
|
|
9
|
+
* @example
|
|
10
|
+
* ```typescript
|
|
11
|
+
* throw new KmsClientError('Failed to get public key from KMS', originalError);
|
|
12
|
+
* ```
|
|
13
|
+
*/
|
|
14
|
+
export class KmsClientError extends Error {
|
|
15
|
+
constructor(message, cause) {
|
|
16
|
+
super(message);
|
|
17
|
+
this.cause = cause;
|
|
18
|
+
this.name = 'KmsClientError';
|
|
19
|
+
}
|
|
20
|
+
}
|
|
21
|
+
/**
|
|
22
|
+
* Custom error class for DER-encoded public key extraction errors.
|
|
23
|
+
*
|
|
24
|
+
* Thrown when extracting ED25519 public key from DER format fails, including:
|
|
25
|
+
* - Invalid DER structure (missing SEQUENCE tag)
|
|
26
|
+
* - Missing BIT STRING in DER encoding
|
|
27
|
+
* - Unexpected BIT STRING length (not 33 bytes)
|
|
28
|
+
* - Malformed SubjectPublicKeyInfo structure
|
|
29
|
+
*
|
|
30
|
+
* @example
|
|
31
|
+
* ```typescript
|
|
32
|
+
* throw new PublicKeyExtractionError('Invalid DER encoding: missing SEQUENCE tag');
|
|
33
|
+
* ```
|
|
34
|
+
*/
|
|
35
|
+
export class PublicKeyExtractionError extends Error {
|
|
36
|
+
constructor(message, cause) {
|
|
37
|
+
super(message);
|
|
38
|
+
this.cause = cause;
|
|
39
|
+
this.name = 'PublicKeyExtractionError';
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
/**
|
|
43
|
+
* Custom error class for ED25519 signature verification errors.
|
|
44
|
+
*
|
|
45
|
+
* Thrown when signature validation fails, including:
|
|
46
|
+
* - Signature verification returns false (invalid signature)
|
|
47
|
+
* - Incorrect signature length (not 64 bytes)
|
|
48
|
+
* - Signature does not match public key and message
|
|
49
|
+
* - Cryptographic verification failure
|
|
50
|
+
*
|
|
51
|
+
* @example
|
|
52
|
+
* ```typescript
|
|
53
|
+
* throw new SignatureVerificationError('Signature verification failed', { signature, publicKey });
|
|
54
|
+
* ```
|
|
55
|
+
*/
|
|
56
|
+
export class SignatureVerificationError extends Error {
|
|
57
|
+
constructor(message, cause) {
|
|
58
|
+
super(message);
|
|
59
|
+
this.cause = cause;
|
|
60
|
+
this.name = 'SignatureVerificationError';
|
|
61
|
+
}
|
|
62
|
+
}
|
|
63
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/errors/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe,EAAkB,KAAe;QAC1D,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,UAAK,GAAL,KAAK,CAAU;QAE1D,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAe,EAAkB,KAAe;QAC1D,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,UAAK,GAAL,KAAK,CAAU;QAE1D,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,OAAe,EAAkB,KAAe;QAC1D,KAAK,CAAC,OAAO,CAAC,CAAC;QAD4B,UAAK,GAAL,KAAK,CAAU;QAE1D,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF"}
|
package/dist/index.d.ts
ADDED
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Solana KMS Signer
|
|
3
|
+
*
|
|
4
|
+
* A TypeScript library for signing Solana transactions using AWS KMS with ED25519 keys.
|
|
5
|
+
*
|
|
6
|
+
* @module solana-kms-signer
|
|
7
|
+
*/
|
|
8
|
+
export { KmsClient } from './kms/client.js';
|
|
9
|
+
export { SolanaKmsSigner } from './kms/signer.js';
|
|
10
|
+
export { extractEd25519PublicKey } from './utils/publicKey.js';
|
|
11
|
+
export type { KmsConfig, SolanaKmsSignerConfig } from './types/index.js';
|
|
12
|
+
export { KmsClientError, PublicKeyExtractionError, SignatureVerificationError, } from './errors/index.js';
|
|
13
|
+
export { PublicKey, Transaction, VersionedTransaction } from '@solana/web3.js';
|
|
14
|
+
//# sourceMappingURL=index.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAGlD,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAG/D,YAAY,EAAE,SAAS,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AAGzE,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC"}
|
package/dist/index.js
ADDED
|
@@ -0,0 +1,17 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* Solana KMS Signer
|
|
3
|
+
*
|
|
4
|
+
* A TypeScript library for signing Solana transactions using AWS KMS with ED25519 keys.
|
|
5
|
+
*
|
|
6
|
+
* @module solana-kms-signer
|
|
7
|
+
*/
|
|
8
|
+
// Core classes
|
|
9
|
+
export { KmsClient } from './kms/client.js';
|
|
10
|
+
export { SolanaKmsSigner } from './kms/signer.js';
|
|
11
|
+
// Utility functions
|
|
12
|
+
export { extractEd25519PublicKey } from './utils/publicKey.js';
|
|
13
|
+
// Error classes
|
|
14
|
+
export { KmsClientError, PublicKeyExtractionError, SignatureVerificationError, } from './errors/index.js';
|
|
15
|
+
// Re-export commonly used Solana types for convenience
|
|
16
|
+
export { PublicKey, Transaction, VersionedTransaction } from '@solana/web3.js';
|
|
17
|
+
//# sourceMappingURL=index.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,eAAe;AACf,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAElD,oBAAoB;AACpB,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAK/D,gBAAgB;AAChB,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,0BAA0B,GAC3B,MAAM,mBAAmB,CAAC;AAE3B,uDAAuD;AACvD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC"}
|
|
@@ -0,0 +1,60 @@
|
|
|
1
|
+
import type { KmsConfig } from '../types/index.js';
|
|
2
|
+
/**
|
|
3
|
+
* AWS KMS client wrapper for ED25519 key operations.
|
|
4
|
+
*
|
|
5
|
+
* Provides methods to retrieve public keys and sign messages using
|
|
6
|
+
* AWS KMS ED25519 keys (KeySpec: ECC_ED25519).
|
|
7
|
+
*
|
|
8
|
+
* @example
|
|
9
|
+
* ```typescript
|
|
10
|
+
* const client = new KmsClient({
|
|
11
|
+
* region: 'us-east-1',
|
|
12
|
+
* keyId: 'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012'
|
|
13
|
+
* });
|
|
14
|
+
*
|
|
15
|
+
* const publicKey = await client.getPublicKey();
|
|
16
|
+
* const signature = await client.sign(message);
|
|
17
|
+
* ```
|
|
18
|
+
*/
|
|
19
|
+
export declare class KmsClient {
|
|
20
|
+
private readonly kmsClient;
|
|
21
|
+
private readonly config;
|
|
22
|
+
/**
|
|
23
|
+
* Creates a new KmsClient instance.
|
|
24
|
+
*
|
|
25
|
+
* @param config - Configuration for AWS KMS connection
|
|
26
|
+
*/
|
|
27
|
+
constructor(config: KmsConfig);
|
|
28
|
+
/**
|
|
29
|
+
* Retrieves the public key from AWS KMS.
|
|
30
|
+
*
|
|
31
|
+
* Returns DER-encoded SubjectPublicKeyInfo (X.509 format).
|
|
32
|
+
* Use `extractEd25519PublicKey` to extract the raw 32-byte public key.
|
|
33
|
+
*
|
|
34
|
+
* @returns DER-encoded public key as Uint8Array (typically 42-44 bytes)
|
|
35
|
+
* @throws {KmsClientError} If KMS API call fails
|
|
36
|
+
*
|
|
37
|
+
* @example
|
|
38
|
+
* ```typescript
|
|
39
|
+
* const derPublicKey = await client.getPublicKey();
|
|
40
|
+
* const rawPublicKey = extractEd25519PublicKey(derPublicKey);
|
|
41
|
+
* ```
|
|
42
|
+
*/
|
|
43
|
+
getPublicKey(): Promise<Uint8Array>;
|
|
44
|
+
/**
|
|
45
|
+
* Signs a message using the ED25519 key in AWS KMS.
|
|
46
|
+
*
|
|
47
|
+
* @param message - Message to sign as Uint8Array
|
|
48
|
+
* @returns ED25519 signature (64 bytes)
|
|
49
|
+
* @throws {KmsClientError} If KMS API call fails or signature is invalid
|
|
50
|
+
*
|
|
51
|
+
* @example
|
|
52
|
+
* ```typescript
|
|
53
|
+
* const message = new TextEncoder().encode('Hello, Solana!');
|
|
54
|
+
* const signature = await client.sign(message);
|
|
55
|
+
* console.log('Signature length:', signature.length); // 64
|
|
56
|
+
* ```
|
|
57
|
+
*/
|
|
58
|
+
sign(message: Uint8Array): Promise<Uint8Array>;
|
|
59
|
+
}
|
|
60
|
+
//# sourceMappingURL=client.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/kms/client.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGnD;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IAEnC;;;;OAIG;gBACS,MAAM,EAAE,SAAS;IAQ7B;;;;;;;;;;;;;;OAcG;IACG,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC;IAyBzC;;;;;;;;;;;;;OAaG;IACG,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;CAmCrD"}
|
|
@@ -0,0 +1,108 @@
|
|
|
1
|
+
import { KMSClient, GetPublicKeyCommand, SignCommand, } from '@aws-sdk/client-kms';
|
|
2
|
+
import { KmsClientError } from '../errors/index.js';
|
|
3
|
+
/**
|
|
4
|
+
* AWS KMS client wrapper for ED25519 key operations.
|
|
5
|
+
*
|
|
6
|
+
* Provides methods to retrieve public keys and sign messages using
|
|
7
|
+
* AWS KMS ED25519 keys (KeySpec: ECC_ED25519).
|
|
8
|
+
*
|
|
9
|
+
* @example
|
|
10
|
+
* ```typescript
|
|
11
|
+
* const client = new KmsClient({
|
|
12
|
+
* region: 'us-east-1',
|
|
13
|
+
* keyId: 'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012'
|
|
14
|
+
* });
|
|
15
|
+
*
|
|
16
|
+
* const publicKey = await client.getPublicKey();
|
|
17
|
+
* const signature = await client.sign(message);
|
|
18
|
+
* ```
|
|
19
|
+
*/
|
|
20
|
+
export class KmsClient {
|
|
21
|
+
/**
|
|
22
|
+
* Creates a new KmsClient instance.
|
|
23
|
+
*
|
|
24
|
+
* @param config - Configuration for AWS KMS connection
|
|
25
|
+
*/
|
|
26
|
+
constructor(config) {
|
|
27
|
+
this.config = config;
|
|
28
|
+
this.kmsClient = new KMSClient({
|
|
29
|
+
region: config.region,
|
|
30
|
+
credentials: config.credentials,
|
|
31
|
+
});
|
|
32
|
+
}
|
|
33
|
+
/**
|
|
34
|
+
* Retrieves the public key from AWS KMS.
|
|
35
|
+
*
|
|
36
|
+
* Returns DER-encoded SubjectPublicKeyInfo (X.509 format).
|
|
37
|
+
* Use `extractEd25519PublicKey` to extract the raw 32-byte public key.
|
|
38
|
+
*
|
|
39
|
+
* @returns DER-encoded public key as Uint8Array (typically 42-44 bytes)
|
|
40
|
+
* @throws {KmsClientError} If KMS API call fails
|
|
41
|
+
*
|
|
42
|
+
* @example
|
|
43
|
+
* ```typescript
|
|
44
|
+
* const derPublicKey = await client.getPublicKey();
|
|
45
|
+
* const rawPublicKey = extractEd25519PublicKey(derPublicKey);
|
|
46
|
+
* ```
|
|
47
|
+
*/
|
|
48
|
+
async getPublicKey() {
|
|
49
|
+
try {
|
|
50
|
+
const command = new GetPublicKeyCommand({
|
|
51
|
+
KeyId: this.config.keyId,
|
|
52
|
+
});
|
|
53
|
+
const response = await this.kmsClient.send(command);
|
|
54
|
+
if (!response.PublicKey) {
|
|
55
|
+
throw new KmsClientError('GetPublicKey response missing PublicKey field');
|
|
56
|
+
}
|
|
57
|
+
// Convert Buffer/Uint8Array to Uint8Array
|
|
58
|
+
return new Uint8Array(response.PublicKey);
|
|
59
|
+
}
|
|
60
|
+
catch (error) {
|
|
61
|
+
if (error instanceof KmsClientError) {
|
|
62
|
+
throw error;
|
|
63
|
+
}
|
|
64
|
+
throw new KmsClientError(`Failed to get public key from KMS: ${error instanceof Error ? error.message : String(error)}`, error);
|
|
65
|
+
}
|
|
66
|
+
}
|
|
67
|
+
/**
|
|
68
|
+
* Signs a message using the ED25519 key in AWS KMS.
|
|
69
|
+
*
|
|
70
|
+
* @param message - Message to sign as Uint8Array
|
|
71
|
+
* @returns ED25519 signature (64 bytes)
|
|
72
|
+
* @throws {KmsClientError} If KMS API call fails or signature is invalid
|
|
73
|
+
*
|
|
74
|
+
* @example
|
|
75
|
+
* ```typescript
|
|
76
|
+
* const message = new TextEncoder().encode('Hello, Solana!');
|
|
77
|
+
* const signature = await client.sign(message);
|
|
78
|
+
* console.log('Signature length:', signature.length); // 64
|
|
79
|
+
* ```
|
|
80
|
+
*/
|
|
81
|
+
async sign(message) {
|
|
82
|
+
try {
|
|
83
|
+
const command = new SignCommand({
|
|
84
|
+
KeyId: this.config.keyId,
|
|
85
|
+
Message: message,
|
|
86
|
+
MessageType: 'RAW',
|
|
87
|
+
SigningAlgorithm: 'ED25519_SHA_512',
|
|
88
|
+
});
|
|
89
|
+
const response = await this.kmsClient.send(command);
|
|
90
|
+
if (!response.Signature) {
|
|
91
|
+
throw new KmsClientError('Sign response missing Signature field');
|
|
92
|
+
}
|
|
93
|
+
const signature = new Uint8Array(response.Signature);
|
|
94
|
+
// Validate signature length (ED25519 signatures are always 64 bytes)
|
|
95
|
+
if (signature.length !== 64) {
|
|
96
|
+
throw new KmsClientError(`Invalid signature length: expected 64 bytes, got ${signature.length} bytes`);
|
|
97
|
+
}
|
|
98
|
+
return signature;
|
|
99
|
+
}
|
|
100
|
+
catch (error) {
|
|
101
|
+
if (error instanceof KmsClientError) {
|
|
102
|
+
throw error;
|
|
103
|
+
}
|
|
104
|
+
throw new KmsClientError(`Failed to sign message with KMS: ${error instanceof Error ? error.message : String(error)}`, error);
|
|
105
|
+
}
|
|
106
|
+
}
|
|
107
|
+
}
|
|
108
|
+
//# sourceMappingURL=client.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/kms/client.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,mBAAmB,EACnB,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,SAAS;IAIpB;;;;OAIG;IACH,YAAY,MAAiB;QAC3B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC;YAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,YAAY;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC;gBACtC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;aACzB,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEpD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,cAAc,CAAC,+CAA+C,CAAC,CAAC;YAC5E,CAAC;YAED,0CAA0C;YAC1C,OAAO,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;gBACpC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,cAAc,CACtB,sCAAsC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC9F,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,IAAI,CAAC,OAAmB;QAC5B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,WAAW,CAAC;gBAC9B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;gBACxB,OAAO,EAAE,OAAO;gBAChB,WAAW,EAAE,KAAK;gBAClB,gBAAgB,EAAE,iBAAiB;aACpC,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEpD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,cAAc,CAAC,uCAAuC,CAAC,CAAC;YACpE,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAErD,qEAAqE;YACrE,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC5B,MAAM,IAAI,cAAc,CACtB,oDAAoD,SAAS,CAAC,MAAM,QAAQ,CAC7E,CAAC;YACJ,CAAC;YAED,OAAO,SAAS,CAAC;QACnB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;gBACpC,MAAM,KAAK,CAAC;YACd,CAAC;YACD,MAAM,IAAI,cAAc,CACtB,oCAAoC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC5F,KAAK,CACN,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
|
|
@@ -0,0 +1,170 @@
|
|
|
1
|
+
import { PublicKey, Transaction, VersionedTransaction } from '@solana/web3.js';
|
|
2
|
+
import { KmsClient } from './client.js';
|
|
3
|
+
import type { KmsConfig } from '../types/index.js';
|
|
4
|
+
/**
|
|
5
|
+
* Solana transaction signer using AWS KMS ED25519 keys.
|
|
6
|
+
*
|
|
7
|
+
* Provides methods to sign Solana transactions and arbitrary messages
|
|
8
|
+
* using AWS KMS-managed ED25519 keys. Caches the public key after
|
|
9
|
+
* first retrieval to minimize KMS API calls.
|
|
10
|
+
*
|
|
11
|
+
* @example
|
|
12
|
+
* ```typescript
|
|
13
|
+
* // Create with KmsConfig
|
|
14
|
+
* const signer = new SolanaKmsSigner({
|
|
15
|
+
* region: 'us-east-1',
|
|
16
|
+
* keyId: 'arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012'
|
|
17
|
+
* });
|
|
18
|
+
*
|
|
19
|
+
* // Or create with existing KmsClient
|
|
20
|
+
* const client = new KmsClient(config);
|
|
21
|
+
* const signer = new SolanaKmsSigner(client);
|
|
22
|
+
*
|
|
23
|
+
* // Get public key
|
|
24
|
+
* const publicKey = await signer.getPublicKey();
|
|
25
|
+
*
|
|
26
|
+
* // Sign message
|
|
27
|
+
* const message = new TextEncoder().encode('Hello, Solana!');
|
|
28
|
+
* const signature = await signer.signMessage(message);
|
|
29
|
+
*
|
|
30
|
+
* // Sign transaction
|
|
31
|
+
* const transaction = new Transaction().add(instruction);
|
|
32
|
+
* transaction.recentBlockhash = recentBlockhash;
|
|
33
|
+
* transaction.feePayer = publicKey;
|
|
34
|
+
* const signedTx = await signer.signTransaction(transaction);
|
|
35
|
+
* ```
|
|
36
|
+
*/
|
|
37
|
+
export declare class SolanaKmsSigner {
|
|
38
|
+
private readonly kmsClient;
|
|
39
|
+
private publicKey?;
|
|
40
|
+
private rawPublicKey?;
|
|
41
|
+
/**
|
|
42
|
+
* Creates a new SolanaKmsSigner instance.
|
|
43
|
+
*
|
|
44
|
+
* @param config - Either KmsConfig or an existing KmsClient instance
|
|
45
|
+
*
|
|
46
|
+
* @example
|
|
47
|
+
* ```typescript
|
|
48
|
+
* // With KmsConfig
|
|
49
|
+
* const signer = new SolanaKmsSigner({
|
|
50
|
+
* region: 'us-east-1',
|
|
51
|
+
* keyId: 'key-id'
|
|
52
|
+
* });
|
|
53
|
+
*
|
|
54
|
+
* // With KmsClient
|
|
55
|
+
* const client = new KmsClient(config);
|
|
56
|
+
* const signer = new SolanaKmsSigner(client);
|
|
57
|
+
* ```
|
|
58
|
+
*/
|
|
59
|
+
constructor(config: KmsConfig | KmsClient);
|
|
60
|
+
/**
|
|
61
|
+
* Retrieves the Solana PublicKey associated with the KMS key.
|
|
62
|
+
*
|
|
63
|
+
* The public key is cached after first retrieval to minimize KMS API calls.
|
|
64
|
+
*
|
|
65
|
+
* @returns Solana PublicKey object
|
|
66
|
+
* @throws {KmsClientError} If KMS API call fails
|
|
67
|
+
* @throws {PublicKeyExtractionError} If DER decoding fails
|
|
68
|
+
*
|
|
69
|
+
* @example
|
|
70
|
+
* ```typescript
|
|
71
|
+
* const publicKey = await signer.getPublicKey();
|
|
72
|
+
* console.log('Address:', publicKey.toBase58());
|
|
73
|
+
* ```
|
|
74
|
+
*/
|
|
75
|
+
getPublicKey(): Promise<PublicKey>;
|
|
76
|
+
/**
|
|
77
|
+
* Retrieves the raw 32-byte ED25519 public key.
|
|
78
|
+
*
|
|
79
|
+
* The public key is cached after first retrieval to minimize KMS API calls.
|
|
80
|
+
*
|
|
81
|
+
* @returns Raw 32-byte public key as Uint8Array
|
|
82
|
+
* @throws {KmsClientError} If KMS API call fails
|
|
83
|
+
* @throws {PublicKeyExtractionError} If DER decoding fails
|
|
84
|
+
*
|
|
85
|
+
* @example
|
|
86
|
+
* ```typescript
|
|
87
|
+
* const rawPublicKey = await signer.getRawPublicKey();
|
|
88
|
+
* console.log('Raw public key length:', rawPublicKey.length); // 32
|
|
89
|
+
* ```
|
|
90
|
+
*/
|
|
91
|
+
getRawPublicKey(): Promise<Uint8Array>;
|
|
92
|
+
/**
|
|
93
|
+
* Signs an arbitrary message using the KMS key.
|
|
94
|
+
*
|
|
95
|
+
* The signature is verified using tweetnacl before being returned
|
|
96
|
+
* to ensure cryptographic correctness.
|
|
97
|
+
*
|
|
98
|
+
* @param message - Message to sign as Uint8Array
|
|
99
|
+
* @returns ED25519 signature (64 bytes)
|
|
100
|
+
* @throws {KmsClientError} If KMS API call fails
|
|
101
|
+
* @throws {SignatureVerificationError} If signature verification fails
|
|
102
|
+
*
|
|
103
|
+
* @example
|
|
104
|
+
* ```typescript
|
|
105
|
+
* const message = new TextEncoder().encode('Hello, Solana!');
|
|
106
|
+
* const signature = await signer.signMessage(message);
|
|
107
|
+
* console.log('Signature length:', signature.length); // 64
|
|
108
|
+
* ```
|
|
109
|
+
*/
|
|
110
|
+
signMessage(message: Uint8Array): Promise<Uint8Array>;
|
|
111
|
+
/**
|
|
112
|
+
* Signs a Solana legacy Transaction.
|
|
113
|
+
*
|
|
114
|
+
* The transaction must have recentBlockhash and feePayer set before signing.
|
|
115
|
+
*
|
|
116
|
+
* @param transaction - Transaction to sign
|
|
117
|
+
* @returns Signed transaction
|
|
118
|
+
* @throws {KmsClientError} If KMS API call fails
|
|
119
|
+
* @throws {SignatureVerificationError} If signature verification fails
|
|
120
|
+
*
|
|
121
|
+
* @example
|
|
122
|
+
* ```typescript
|
|
123
|
+
* const transaction = new Transaction().add(instruction);
|
|
124
|
+
* transaction.recentBlockhash = recentBlockhash;
|
|
125
|
+
* transaction.feePayer = await signer.getPublicKey();
|
|
126
|
+
* const signedTx = await signer.signTransaction(transaction);
|
|
127
|
+
* ```
|
|
128
|
+
*/
|
|
129
|
+
signTransaction(transaction: Transaction): Promise<Transaction>;
|
|
130
|
+
/**
|
|
131
|
+
* Signs a Solana VersionedTransaction.
|
|
132
|
+
*
|
|
133
|
+
* The transaction must have a valid message with recentBlockhash set.
|
|
134
|
+
*
|
|
135
|
+
* @param transaction - VersionedTransaction to sign
|
|
136
|
+
* @returns Signed versioned transaction
|
|
137
|
+
* @throws {KmsClientError} If KMS API call fails
|
|
138
|
+
* @throws {SignatureVerificationError} If signature verification fails
|
|
139
|
+
*
|
|
140
|
+
* @example
|
|
141
|
+
* ```typescript
|
|
142
|
+
* const message = MessageV0.compile({
|
|
143
|
+
* payerKey: await signer.getPublicKey(),
|
|
144
|
+
* instructions: [instruction],
|
|
145
|
+
* recentBlockhash: recentBlockhash
|
|
146
|
+
* });
|
|
147
|
+
* const transaction = new VersionedTransaction(message);
|
|
148
|
+
* const signedTx = await signer.signVersionedTransaction(transaction);
|
|
149
|
+
* ```
|
|
150
|
+
*/
|
|
151
|
+
signVersionedTransaction(transaction: VersionedTransaction): Promise<VersionedTransaction>;
|
|
152
|
+
/**
|
|
153
|
+
* Signs multiple Solana transactions in parallel.
|
|
154
|
+
*
|
|
155
|
+
* All transactions must have recentBlockhash and feePayer set before signing.
|
|
156
|
+
*
|
|
157
|
+
* @param transactions - Array of transactions to sign
|
|
158
|
+
* @returns Array of signed transactions in the same order
|
|
159
|
+
* @throws {KmsClientError} If any KMS API call fails
|
|
160
|
+
* @throws {SignatureVerificationError} If any signature verification fails
|
|
161
|
+
*
|
|
162
|
+
* @example
|
|
163
|
+
* ```typescript
|
|
164
|
+
* const transactions = [tx1, tx2, tx3];
|
|
165
|
+
* const signedTxs = await signer.signAllTransactions(transactions);
|
|
166
|
+
* ```
|
|
167
|
+
*/
|
|
168
|
+
signAllTransactions(transactions: Transaction[]): Promise<Transaction[]>;
|
|
169
|
+
}
|
|
170
|
+
//# sourceMappingURL=signer.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"signer.d.ts","sourceRoot":"","sources":["../../src/kms/signer.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,WAAW,EACX,oBAAoB,EACrB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;IACtC,OAAO,CAAC,SAAS,CAAC,CAAY;IAC9B,OAAO,CAAC,YAAY,CAAC,CAAa;IAElC;;;;;;;;;;;;;;;;;OAiBG;gBACS,MAAM,EAAE,SAAS,GAAG,SAAS;IAQzC;;;;;;;;;;;;;;OAcG;IACG,YAAY,IAAI,OAAO,CAAC,SAAS,CAAC;IAmBxC;;;;;;;;;;;;;;OAcG;IACG,eAAe,IAAI,OAAO,CAAC,UAAU,CAAC;IAe5C;;;;;;;;;;;;;;;;;OAiBG;IACG,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IAuB3D;;;;;;;;;;;;;;;;;OAiBG;IACG,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;IAgBrE;;;;;;;;;;;;;;;;;;;;OAoBG;IACG,wBAAwB,CAC5B,WAAW,EAAE,oBAAoB,GAChC,OAAO,CAAC,oBAAoB,CAAC;IAahC;;;;;;;;;;;;;;;OAeG;IACG,mBAAmB,CACvB,YAAY,EAAE,WAAW,EAAE,GAC1B,OAAO,CAAC,WAAW,EAAE,CAAC;CAK1B"}
|