feat: Add @aptos-labs/aptos-keystore — Encrypted Private Key Storage Package

CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to the Aptos TypeScript SDK will be captured in this file. T
 
 # Unreleased
 
+## Added
+
+- Add Aptos Keystore: encrypted private key storage standard based on Ethereum's Web3 Secret Storage Definition
+  - Supports all Aptos key types: Ed25519, Secp256k1, Secp256r1
+  - AES-256-GCM authenticated encryption (no separate MAC needed)
+  - Argon2id KDF by default when optional `hash-wasm` peer dependency is installed, falls back to scrypt
+  - PBKDF2-HMAC-SHA256 also supported as an alternative KDF
+  - Password-based or key-file-based encryption
+  - Portable JSON format designed for cross-SDK compatibility (TypeScript, Rust, Python, Go, etc.)
+  - New exports: `encryptKeystore`, `decryptKeystore`, `AptosKeyStore`, `KeystorePrivateKey`, `KeystoreEncryptOptions`
+
 ## Fixed
 
 - Fix simple function arguments for `Vector<Option<T>>` types: BCS-encoded values (e.g. `AccountAddress.ONE`) passed as elements of `vector<Option<address>>` are now automatically wrapped in `MoveOption` instead of throwing a type mismatch error

package.json

@@ -83,6 +83,14 @@
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
   },
+  "peerDependencies": {
+    "hash-wasm": "^4.12.0"
+  },
+  "peerDependenciesMeta": {
+    "hash-wasm": {
+      "optional": true
+    }
+  },
   "version": "6.2.0",
   "pnpm": {
     "overrides": {

src/core/crypto/index.ts

@@ -5,6 +5,7 @@ export * from "./abstraction";
 export * from "./ed25519";
 export * from "./ephemeral";
 export * from "./federatedKeyless";
+export * from "./keystore";
 export * from "./hdKey";
 export * from "./keyless";
 export * from "./multiEd25519";