Merge pull request #973 from LIT-Protocol/feat/get-derived-pubkey

Feat/get derived pubkey

Author: Ansonhkg

.changeset/two-mangos-lead.md

@@ -0,0 +1,8 @@
+---
+'@lit-protocol/lit-client': minor
+'@lit-protocol/contracts': minor
+'@lit-protocol/networks': minor
+'@lit-protocol/e2e': minor
+---
+
+introduce `litClient.utils.getDerivedKeyId` - a little helper to resolve the Lit Action public key outside of the Action runtime

docs/guides/lit-action-sign-as-action.mdx

@@ -69,3 +69,21 @@ const { keccak256, arrayify } = ethers.utils;
 ```
 
 This approach keeps the derivation entirely within the Lit Action context. Because the public key depends only on the Action CID and signing scheme, you can rely on `Lit.Actions.getActionPublicKey` for a deterministic identity without needing to execute the Action externally first.
+
+## Derive the Same Public Key from Client Code
+
+If you prefer to resolve the Lit Action public key outside of the Action runtime - e.g., inside tests or other tooling—the SDK now exposes a helper that calls the on-chain PubkeyRouter contract.
+
+```ts
+import { createLitClient } from "@lit-protocol/lit-client";
+import { nagaDev } from "@lit-protocol/networks";
+import { keccak256, stringToBytes } from "viem";
+
+const litClient = await createLitClient({ network: nagaDev });
+const derivedKeyId = keccak256(stringToBytes(`lit_action_${actionIpfsCid}`));
+const actionPublicKey = await litClient.utils.getDerivedKeyId(derivedKeyId);
+
+console.log("Derived Lit Action pubkey:", actionPublicKey);
+```
+
+Under the hood, `getDerivedKeyId` routes through `PubkeyRouter.getDerivedPubkey`, passing the staking contract address and the default Naga key set (`naga-keyset1`) (will be dynamic in the future). This mirrors the same key derivation the nodes perform, letting you confirm identities or signatures without re-running the Lit Action.

docs/sdk/sdk-reference/lit-client/functions/createLitClient.mdx

@@ -1046,6 +1046,33 @@ Create a Viem-compatible account backed by a PKP.
   </Expandable>
 </ResponseField>
 
+### utils.getDerivedKeyId
+
+Resolve the uncompressed PKP public key for a given derived key identifier.
+
+#### Parameters
+
+<ResponseField name="derivedKeyId" type="string" required>
+  0x-prefixed bytes32 identifier (for example, <code>keccak256(stringToBytes(`lit_action_${ipfsCid}`))</code>).
+</ResponseField>
+
+#### Returns
+
+<ResponseField name="result" type="Promise<string>">
+  0x-prefixed uncompressed public key as returned by the PubkeyRouter contract.
+</ResponseField>
+
+#### Example
+
+```ts
+import { keccak256, stringToBytes } from "viem";
+
+const derivedKeyId = keccak256(stringToBytes(`lit_action_${ipfsCid}`));
+const derivedPubkey = await litClient.utils.getDerivedKeyId(derivedKeyId);
+```
+
+> Note: this helper currently calls `PubkeyRouter.getDerivedPubkey` with the default Naga key set (`naga-keyset1`). See the [Derive Lit Action Public Keys guide](../../../../guides/lit-action-sign-as-action) for an end-to-end workflow.
+
 ### getChainConfig
 
 Returns the chain configuration for the current network.
@@ -1074,4 +1101,4 @@ Stop background state updates and release resources.
 none
 
 #### Returns
-void
+void

packages/contracts/dist/dev/develop.cjs

@@ -15431,11 +15431,6 @@ module.exports = {
               "name": "CallerNotOwner",
               "type": "error"
             },
-            {
-              "inputs": [],
-              "name": "MustBeLessThan100",
-              "type": "error"
-            },
             {
               "inputs": [],
               "name": "MustBeNonzero",

packages/contracts/dist/dev/develop.js

@@ -15429,11 +15429,6 @@ export const develop = {
               "name": "CallerNotOwner",
               "type": "error"
             },
-            {
-              "inputs": [],
-              "name": "MustBeLessThan100",
-              "type": "error"
-            },
             {
               "inputs": [],
               "name": "MustBeNonzero",

packages/contracts/dist/dev/develop.json

@@ -15429,11 +15429,6 @@
               "name": "CallerNotOwner",
               "type": "error"
             },
-            {
-              "inputs": [],
-              "name": "MustBeLessThan100",
-              "type": "error"
-            },
             {
               "inputs": [],
               "name": "MustBeNonzero",

packages/contracts/dist/dev/develop.ts

@@ -15429,11 +15429,6 @@ export const develop = {
               "name": "CallerNotOwner",
               "type": "error"
             },
-            {
-              "inputs": [],
-              "name": "MustBeLessThan100",
-              "type": "error"
-            },
             {
               "inputs": [],
               "name": "MustBeNonzero",

packages/contracts/dist/signatures/datil-dev.cjs

@@ -673,6 +673,30 @@ const signatures = {
         "stateMutability": "view",
         "type": "function"
       },
+      "getDerivedPubkey": {
+        "inputs": [
+          {
+            "internalType": "address",
+            "name": "stakingContract",
+            "type": "address"
+          },
+          {
+            "internalType": "bytes32",
+            "name": "derivedKeyId",
+            "type": "bytes32"
+          }
+        ],
+        "name": "getDerivedPubkey",
+        "outputs": [
+          {
+            "internalType": "bytes",
+            "name": "",
+            "type": "bytes"
+          }
+        ],
+        "stateMutability": "view",
+        "type": "function"
+      },
       "getEthAddress": {
         "inputs": [
           {

packages/contracts/dist/signatures/datil-dev.d.ts

@@ -673,6 +673,30 @@ export const signatures = {
         "stateMutability": "view",
         "type": "function"
       },
+      "getDerivedPubkey": {
+        "inputs": [
+          {
+            "internalType": "address",
+            "name": "stakingContract",
+            "type": "address"
+          },
+          {
+            "internalType": "bytes32",
+            "name": "derivedKeyId",
+            "type": "bytes32"
+          }
+        ],
+        "name": "getDerivedPubkey",
+        "outputs": [
+          {
+            "internalType": "bytes",
+            "name": "",
+            "type": "bytes"
+          }
+        ],
+        "stateMutability": "view",
+        "type": "function"
+      },
       "getEthAddress": {
         "inputs": [
           {

packages/contracts/dist/signatures/datil-dev.js

@@ -673,6 +673,30 @@ export const signatures = {
         "stateMutability": "view",
         "type": "function"
       },
+      "getDerivedPubkey": {
+        "inputs": [
+          {
+            "internalType": "address",
+            "name": "stakingContract",
+            "type": "address"
+          },
+          {
+            "internalType": "bytes32",
+            "name": "derivedKeyId",
+            "type": "bytes32"
+          }
+        ],
+        "name": "getDerivedPubkey",
+        "outputs": [
+          {
+            "internalType": "bytes",
+            "name": "",
+            "type": "bytes"
+          }
+        ],
+        "stateMutability": "view",
+        "type": "function"
+      },
       "getEthAddress": {
         "inputs": [
           {