@openzeppelin/miden-multisig-client 0.17.0 → 0.18.0-rc.1

package/dist/utils/signature.js.map

@@ -1 +1 @@
-{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../src/utils/signature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,SAAS,EAAE,SAAS,EAAa,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,KAAK,QAAQ,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAG7D,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,qBAAqB,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,SAA0B,QAAQ;IAElC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvD,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,gBAAsB,EACtB,OAAa,EACb,SAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI,SAAS,CAAC;QAC7B,GAAG,gBAAgB,CAAC,OAAO,EAAE;QAC7B,GAAG,OAAO,CAAC,OAAO,EAAE;KACrB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAE7C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,+BAA+B,CAC7C,YAAoB,EACpB,UAAkB,EAClB,oBAA4B;IAE5B,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,WAAW,CAAC,6BAA6B,CACnD,UAAU,CAAC,UAAU,CAAC,EACtB,UAAU,CAAC,YAAY,CAAC,CACzB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;IACrE,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,uCAAuC,SAAS,uCAAuC,QAAQ,EAAE,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,OAAO,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,MAAuB;IAEvB,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpD,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,QAAe,CAAC;QACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO,gBAAgB,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAiB,EACjB,OAA6C;IAE7C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAChE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACnB,CAAC,CAAC,QAAQ,CAAC;IAEb,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,SAAiC,EACjC,iBAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,yBAAyB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,+BAA+B,CAAC,CAAC;QACrE,CAAC;QAED,OAAO;YACL,GAAG,SAAS;YACZ,QAAQ;SACT,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC"}
+{"version":3,"file":"signature.js","sourceRoot":"","sources":["../../src/utils/signature.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,IAAI,EAAE,SAAS,EAAE,SAAS,EAAa,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,KAAK,QAAQ,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAGpD,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AACtC,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC,MAAM,UAAU,YAAY,CAAC,MAAuB;IAClD,OAAO,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,qBAAqB,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,SAA0B,QAAQ;IAElC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvD,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CACvC,gBAAsB,EACtB,OAAa,EACb,SAAoB;IAEpB,MAAM,QAAQ,GAAG,IAAI,SAAS,CAAC;QAC7B,GAAG,gBAAgB,CAAC,OAAO,EAAE;QAC7B,GAAG,OAAO,CAAC,OAAO,EAAE;KACrB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAE7C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,yEAAyE;AACzE,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAEpD,SAAS,oBAAoB,CAAC,KAAiB;IAC7C,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1F,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,gBAAsB,EACtB,mBAAyB,EACzB,YAAoB,EACpB,YAAoB;IAEpB,MAAM,kBAAkB,GAAG,4BAA4B,CAAC,YAAY,CAAC,CAAC;IACtE,IAAI,kBAAkB,KAAK,gBAAgB,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;IACtF,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACjD,MAAM,mBAAmB,GAAG,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;IAC5E,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,mBAAmB,CAAC,CAAC;IAClD,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,SAAS,GAAG,yBAAyB,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,eAAe,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC;QAClD,GAAG,gBAAgB,CAAC,OAAO,EAAE;QAC7B,GAAG,mBAAmB,CAAC,OAAO,EAAE;KACjC,CAAC,CAAC,CAAC;IACJ,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,cAAc,CAAC,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9F,OAAO;QACL,GAAG;QACH,MAAM,EAAE;YACN,GAAG,oBAAoB,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAClD,GAAG,oBAAoB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACnD,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/C,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;SACjD;KACF,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,+BAA+B,CAC7C,YAAoB,EACpB,UAAkB,EAClB,oBAA4B;IAE5B,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,WAAW,CAAC,6BAA6B,CACnD,UAAU,CAAC,UAAU,CAAC,EACtB,UAAU,CAAC,YAAY,CAAC,CACzB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,kDAAkD,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;IACrE,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CACb,uCAAuC,SAAS,uCAAuC,QAAQ,EAAE,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC5D,OAAO,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,SAAiB,EACjB,MAAuB;IAEvB,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,UAAU,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpD,UAAU,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACrC,UAAU,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAEzB,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,QAAe,CAAC;QACtC,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QACnD,OAAO,gBAAgB,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,MAAiB,EACjB,OAA6C;IAE7C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAW;IAChC,OAAO,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,QAAgB;IACxD,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAChE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QACnB,CAAC,CAAC,QAAQ,CAAC;IAEb,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,OAAO,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,SAAiC,EACjC,iBAA8B;IAE9B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,yBAAyB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAC/D,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,UAAU,QAAQ,+BAA+B,CAAC,CAAC;QACrE,CAAC;QAED,OAAO;YACL,GAAG,SAAS;YACZ,QAAQ;SACT,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openzeppelin/miden-multisig-client",
-  "version": "0.17.0",
+  "version": "0.18.0-rc.1",
   "description": "TypeScript SDK for Miden multisig accounts with GUARDIAN integration",
   "repository": {
     "type": "git",
@@ -34,23 +34,28 @@
     "build": "tsc",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
+    "typecheck:tests": "tsc --noEmit -p tsconfig.test.json",
     "clean": "rm -rf dist",
     "test": "vitest run",
     "test:watch": "vitest",
-    "test:browser": "playwright test --config playwright.config.ts"
+    "test:browser": "playwright test --config playwright.config.ts",
+    "test:qualification": "vitest run --config vitest.qualification.config.ts"
   },
   "dependencies": {
-    "@miden-sdk/miden-sdk": "0.16.0",
+    "@miden-sdk/miden-sdk": "0.17.0-rc.3",
     "@noble/curves": "^1.9.7",
     "@noble/hashes": "^2.0.1",
-    "@openzeppelin/guardian-client": "^0.17.0"
+    "@openzeppelin/guardian-client": "^0.18.0-rc.1"
   },
   "devDependencies": {
+    "@openzeppelin/guardian-operator-client": "^0.18.0-rc.1",
     "@playwright/test": "^1.60.0",
+    "@types/node": "^24.13.5",
     "fake-indexeddb": "^6.2.5",
+    "viem": "^2.47.5",
     "typescript": "^5.7.2",
-    "vite": "^5.4.21",
-    "vitest": "^2.1.8"
+    "vite": "^6.4.3",
+    "vitest": "^5.0.0"
   },
   "engines": {
     "node": ">=18"

package/src/account/builder.ts

@@ -15,6 +15,8 @@ import {
   type MidenClient,
 } from "@miden-sdk/miden-sdk";
 import { getProcedureRoot } from "../procedures.js";
+import { isPublicMidenClient, type RawClientSource } from "../raw-client.js";
+import { MAX_SIGNERS } from "./layout.js";
 import type { MultisigConfig, CreateAccountResult } from "../types.js";
 import { normalizeSignerCommitment } from "../utils/signature.js";
 
@@ -82,13 +84,13 @@ function buildGuardedMultisigComponent(
 /**
  * Creates a multisig account with GUARDIAN authentication.
  *
- * @param midenClient - Initialized MidenClient
+ * @param client - Initialized MidenClient, or the WASM client behind one
  * @param config - Multisig configuration
- * @param midenRpcEndpoint - RPC endpoint for the MidenClient's network
+ * @param midenRpcEndpoint - RPC endpoint for the client's network
  * @returns The created account and seed
  */
 export async function createMultisigAccount(
-  midenClient: MidenClient,
+  client: RawClientSource,
   config: MultisigConfig,
   midenRpcEndpoint: string,
 ): Promise<CreateAccountResult> {
@@ -115,10 +117,14 @@ export async function createMultisigAccount(
 
   const result = accountBuilder.buildWithoutSchemaCommitment();
 
-  await midenClient.accounts.insert({
-    account: result.account,
-    overwrite: false,
-  });
+  if (isPublicMidenClient(client)) {
+    await client.accounts.insert({
+      account: result.account,
+      overwrite: false,
+    });
+  } else {
+    await client.newAccount(result.account, false);
+  }
 
   return {
     account: result.account,
@@ -149,6 +155,11 @@ export function validateMultisigConfig(config: MultisigConfig): void {
     signerCommitments.add(normalizedCommitment);
   }
 
+  if (config.signerCommitments.length > MAX_SIGNERS) {
+    throw new Error(
+      `too many signers (${config.signerCommitments.length}): a multisig account holds at most ${MAX_SIGNERS}`,
+    );
+  }
   if (config.threshold > config.signerCommitments.length) {
     throw new Error(
       `threshold (${config.threshold}) cannot exceed number of signers (${config.signerCommitments.length})`,

package/src/account/layout.ts

@@ -25,9 +25,9 @@ export const GUARDIAN_SLOT_NAMES = {
 } as const;
 
 /**
- * Sanity ceiling for the signer count read from `threshold_config`. The
- * contract has no on-chain maximum (the felt is only asserted to be a u32),
- * so a corrupt or adversarial account could report an arbitrarily large
- * count; readers bound their loops with this instead of trusting it.
+ * The most approvers a multisig account can hold: `ApproverSet::MAX_APPROVERS`
+ * in miden-standards, enforced at account creation and again on-chain by
+ * `update_signers_and_threshold`. Readers bound their loops with it, so a
+ * corrupt `threshold_config` cannot drive an unbounded storage walk.
  */
-export const MAX_SIGNERS = 1000;
+export const MAX_SIGNERS = 64;

package/src/client.ts

@@ -13,6 +13,8 @@ import { createMultisigAccount } from './account/index.js';
 import { AccountInspector, assertCompleteDetectedConfig } from './inspector.js';
 import { getRawMidenClient, requireConfigValue, requireMidenRpcEndpoint } from './raw-client.js';
 import type { MultisigConfig, Signer } from './types.js';
+import { isSafeToAdoptGuardianState, readOnChainCommitment } from './state/adopt.js';
+import { normalizeHexWord } from './utils/encoding.js';
 import {
   resolveProverConfig,
   type ProverConfig,
@@ -141,7 +143,7 @@ export class MultisigClient {
    * which would fail authentication first).
    *
    * @throws if `signer` does not implement `signLookupMessage`. The bundled
-   *   `FalconSigner` and `EcdsaSigner` both do.
+   *   `FalconSigner`, `EcdsaSigner`, and `LedgerSigner` do.
    */
   async recoverByKey(signer: Signer): Promise<RecoveredAccount[]> {
     this._guardianClient.setSigner(signer);
@@ -211,7 +213,9 @@ export class MultisigClient {
     for (let i = 0; i < binaryString.length; i++) {
       accountBytes[i] = binaryString.charCodeAt(i);
     }
-    const account = Account.deserialize(accountBytes);
+    const incomingAccount = Account.deserialize(accountBytes);
+
+    const account = await this.adoptGuardianAccount(accountId, incomingAccount);
 
     const detected = AccountInspector.fromAccount(account);
     // Fail closed on a partial read: the detected signer set becomes the
@@ -226,10 +230,6 @@ export class MultisigClient {
       ),
     };
 
-    const existingAccount = await this.midenClient.accounts.get(AccountId.fromHex(accountId));
-    if (!existingAccount) {
-      await this.midenClient.accounts.insert({ account, overwrite: true });
-    }
     await bindSignerAccountKey(signer, this.midenClient, accountId);
 
     return new Multisig(
@@ -244,4 +244,92 @@ export class MultisigClient {
       this.rpcConfig,
     );
   }
+
+  /**
+   * Reconcile the account GUARDIAN returned with the local store, and answer
+   * with the one that is actually current.
+   *
+   * Writing GUARDIAN's account only when the store held nothing meant a caller
+   * that already had the account kept its own copy while the returned
+   * `Multisig` carried a config derived from GUARDIAN's. One object, two
+   * sources, silently disagreeing: after a membership change the config said
+   * one thing and every account read said another, with no error.
+   *
+   * Overwriting unconditionally is not the fix either. Between pushing a delta
+   * and GUARDIAN canonicalizing it, local is legitimately ahead, and clobbering
+   * it would build the next transaction on a stale nonce. So this applies the
+   * same rule `syncState` does, and returns whichever account wins so the
+   * caller describes the state it will actually read.
+   */
+  private async adoptGuardianAccount(
+    accountId: string,
+    incomingAccount: Account,
+  ): Promise<Account> {
+    const localAccount = await this.midenClient.accounts.get(AccountId.fromHex(accountId));
+    if (!localAccount) {
+      // Still checked against chain, and through the same rule the other path
+      // uses. An empty store is the ordinary shape for loading an account this
+      // client has never held, so inserting without the check would make it the
+      // one path where GUARDIAN's word is taken on its own. Checking only that
+      // *some* commitment exists is not the check: it admits state that
+      // disagrees with chain, which is the thing being guarded against.
+      // Only for an account that has transacted. One that has not is not
+      // deployed, so there is no on-chain commitment to agree or disagree with,
+      // and reading the node for one would make loading a fresh account depend
+      // on the node as well as on GUARDIAN.
+      const transacted = incomingAccount.nonce().asInt() > BigInt(0);
+      const onChain = transacted
+        ? await readOnChainCommitment(
+            this.midenRpcEndpoint,
+            AccountId.fromHex(accountId),
+            this.rpcConfig,
+          )
+        : null;
+      // The one rule the shared predicate cannot apply here. It keys its
+      // null-commitment guard on the *local* nonce, because `syncState`
+      // legitimately meets a higher incoming nonce with no local history. With
+      // no local record at all, the incoming nonce is the only evidence there
+      // is: an account GUARDIAN reports as having transacted is deployed, so a
+      // node reporting nothing for it is an RPC or gateway failure rather than
+      // an undeployed account. `readOnChainCommitment` reports a missing
+      // account by matching `not found`, which a 404 also says.
+      if (transacted && !onChain) {
+        throw new Error(
+          `Refusing to adopt GUARDIAN state for ${accountId}: it has transacted (nonce ${incomingAccount.nonce().asInt().toString()}) but the node reported no on-chain commitment, so it could not be checked against chain`
+        );
+      }
+      // Handed the commitment already read, rather than letting the predicate
+      // read it again: two reads can disagree, and the guard above would then
+      // have passed on a different answer than the comparison rejects.
+      await isSafeToAdoptGuardianState({
+        accountId,
+        incomingAccount,
+        readCommitment: () => Promise.resolve(onChain),
+      });
+      await this.midenClient.accounts.insert({ account: incomingAccount, overwrite: true });
+      return incomingAccount;
+    }
+
+    const localCommitment = normalizeHexWord(localAccount.to_commitment().toHex());
+    const incomingCommitment = normalizeHexWord(incomingAccount.to_commitment().toHex());
+    // Equal commitments are the same state, and the safety rule reads an equal
+    // nonce as divergence, so it must not be asked about a pair that agrees.
+    if (localCommitment === incomingCommitment) {
+      return localAccount;
+    }
+
+    const adopt = await isSafeToAdoptGuardianState({
+      accountId,
+      incomingAccount,
+      localAccount,
+      readCommitment: () =>
+        readOnChainCommitment(this.midenRpcEndpoint, AccountId.fromHex(accountId), this.rpcConfig),
+    });
+    if (!adopt) {
+      return localAccount;
+    }
+
+    await this.midenClient.accounts.insert({ account: incomingAccount, overwrite: true });
+    return incomingAccount;
+  }
 }

package/src/index.ts

@@ -67,14 +67,21 @@ export { AccountInspector, type DetectedMultisigConfig, type VaultBalance } from
 export {
   chainAnchorFromBase64,
   chainAnchorToBase64,
+  chainAnchorBlockNum,
   executeForSummary,
   executeForSummaryAt,
-  summaryAuthArg,
+  summaryApprovalExpirationBlockNum,
+  summarySalt,
+  SummaryAnchorMismatchError,
   buildUpdateSignersTransactionRequest,
   buildUpdateProcedureThresholdTransactionRequest,
   buildUpdateGuardianTransactionRequest,
   buildConsumeNotesTransactionRequest,
+  buildConsumeNotesTransactionRequestFromNotes,
   buildP2idTransactionRequest,
+  requestBoundBlockNum,
+  requestSaltHex,
+  MAX_APPROVAL_EXPIRATION_DELTA,
   parseP2idNoteType,
   p2idNoteTypeToMetadata,
   type P2idTransactionOptions,
@@ -85,7 +92,12 @@ export {
 // serialized summary exactly as import verification does. Returns normalized
 // hex, directly comparable to `ExportedProposal.commitment` / `Proposal.id`.
 export { computeCommitmentFromTxSummary } from './multisig/helpers.js';
-export type { SignatureOptions } from './transaction/options.js';
+export type {
+  MidenClientMultisigRequestOptions,
+  MidenClientSignatureOptions,
+  MultisigRequestOptions,
+  SignatureOptions,
+} from './transaction/options.js';
 
 export { GuardianHttpClient, GuardianHttpError } from '@openzeppelin/guardian-client';
 export type { GuardianErrorMeta } from '@openzeppelin/guardian-client';
@@ -134,9 +146,12 @@ export type {
 export {
   FalconSigner,
   EcdsaSigner,
+  Eip712Signer,
+  LedgerSigner,
   ParaSigner,
   MidenWalletSigner,
   type ParaSigningContext,
+  type Eip1193SignerProvider,
   type WalletSigningContext,
 } from './signer.js';
 export { PublicKeyFormat } from './utils/key.js';
@@ -157,6 +172,8 @@ export {
   MAX_CONSUME_NOTES_METADATA_BYTES,
   isConsumeNotesV1,
   isConsumeNotesV2,
+  isProposalActionable,
+  type ProposalVerification,
   isP2idNoteVisibility,
   type P2idNoteVisibility,
   MAX_P2IDE_BLOCK_HEIGHT,
@@ -173,11 +190,12 @@ export {
   UnsupportedMetadataVersionError,
   ConsumeNotesMetadataOversizeError,
   LegacyConsumeNotesNoteMissingError,
+  ConsumeNoteNotAuthenticatedError,
 } from './multisig/consumeNotesErrors.js';
 
 export {
   type AuthArgErrorCode,
-  ProposalAuthArgUnresolvableError,
+  MultisigAuthArgsMissingError,
   ProposalSaltMalformedError,
 } from './multisig/authArgErrors.js';
 

package/src/multisig/authArgErrors.ts

@@ -1,16 +1,9 @@
-//! Typed failures for auth-arg recovery.
-//!
-//! The surface lands here deliberately ahead of the code that raises it: nothing in this
-//! change constructs these, and the proposal paths that do arrive in the PR that commits
-//! the anchored fee faucet. Landing the codes first keeps them out of that PR's diff and
-//! lets a caller pin `code` before the raiser exists — `public-api.test.ts` covers the
-//! barrel so a dropped re-export is caught either way.
+//! Typed failures a caller branches on rather than reports: each means the proposal or
+//! request itself is unusable, as against a transport or WASM failure a retry might clear.
+//! `public-api.test.ts` covers the barrel so a dropped re-export is caught.
 
 /** Stable error identifiers for auth-arg recovery failures. */
-export type AuthArgErrorCode =
-  | 'proposal_auth_arg_unresolvable'
-  | 'proposal_salt_malformed'
-  | 'fee_faucet_anchor_mismatch';
+export type AuthArgErrorCode = 'proposal_salt_malformed' | 'multisig_auth_args_missing';
 
 /** How much of an untrusted value an error message will quote. */
 const MAX_QUOTED_CHARS = 80;
@@ -56,11 +49,10 @@ function coerceForMessage(value: unknown): string {
  * A proposal's recorded salt is not a readable 32-byte word, so no rebuild can
  * use it.
  *
- * Coded for the same reason as {@link ProposalAuthArgUnresolvableError}, and
- * recoverable in the same one place: a `switch_guardian`'s salt is served by the
- * GUARDIAN being switched away from, which can make it unreadable as easily as
- * it can make it wrong. Treating only the latter as recoverable would leave that
- * GUARDIAN able to strand a fully signed switch.
+ * Coded because `switch_guardian` recovery acts on it rather than reporting it:
+ * the salt is served by the GUARDIAN being switched away from, which can make it
+ * unreadable, and treating that as fatal would leave that GUARDIAN able to strand
+ * a fully signed switch.
  */
 export class ProposalSaltMalformedError extends Error {
   readonly code: AuthArgErrorCode = 'proposal_salt_malformed';
@@ -90,49 +82,24 @@ export class ProposalSaltMalformedError extends Error {
 }
 
 /**
- * A proposal's signed auth arg is not the fee-conversion commitment its recorded
- * salt and anchored fee faucet derive, so no reconstruction from that salt
- * succeeds. Raised before the rebuild, so the proposal fails on the value that is
- * actually wrong rather than on an `ERR_FEE_CONVERSION_INFO_MISSING` abort at
- * proving.
- *
- * `switch_guardian` is the exception, and deliberately so: it rebuilds from the
- * summary's own auth arg, which reproduces the signed word but not the fee
- * preimage behind it, so it executes only on a zero-fee chain.
- *
- * Coded because one caller acts on it rather than reporting it:
- * `switch_guardian` recovery falls back to the summary's own auth arg when it
- * sees this or {@link ProposalSaltMalformedError}, and must not extend that
- * treatment to an unreadable anchor or a WASM failure.
+ * A request built for `accountId` came back without the multisig auth args.
+ * `feeAwareTransactionRequestBuilder` only attaches them to an account it can
+ * classify as a multisig, so this means the account is not in the client's
+ * store or its code is not the guarded-multisig component this client knows.
+ * Raised at build time: the alternative is an abort inside the auth procedure
+ * while it pipes a preimage the advice map does not hold.
  */
-export class ProposalAuthArgUnresolvableError extends Error {
-  readonly code: AuthArgErrorCode = 'proposal_auth_arg_unresolvable';
-  readonly proposalId: string;
-  readonly signedAuthArgHex: string;
-  readonly saltHex: string;
-  readonly feeFaucetIdHex: string;
+export class MultisigAuthArgsMissingError extends Error {
+  readonly code: AuthArgErrorCode = 'multisig_auth_args_missing';
+  readonly accountId: string;
 
-  constructor(details: {
-    proposalId: string;
-    signedAuthArgHex: string;
-    saltHex: string;
-    feeFaucetIdHex: string;
-  }) {
+  constructor(accountId: string) {
     super(
-      `Proposal ${quoteUntrusted(details.proposalId)} auth arg ` +
-        `${quoteUntrusted(details.signedAuthArgHex)} is not the fee-conversion commitment to ` +
-        `its metadata salt ${quoteUntrusted(details.saltHex)} under fee faucet ` +
-        `${quoteUntrusted(details.feeFaucetIdHex)}, so the signed transaction summary cannot ` +
-        `be reproduced ` +
-        'from that salt, and the proposal cannot be executed. Recreate the proposal and ' +
-        'collect signatures again, and have the original dropped server-side — while ' +
-        'GUARDIAN keeps serving it, syncing this account keeps failing on it',
+      `Account ${quoteUntrusted(accountId)} received no multisig auth args: the client does ` +
+        'not hold it as a guarded-multisig account, so a request built for it cannot be ' +
+        'authenticated. Import or create the account in this client first',
     );
-    this.name = 'ProposalAuthArgUnresolvableError';
-    this.proposalId = details.proposalId;
-    this.signedAuthArgHex = details.signedAuthArgHex;
-    this.saltHex = details.saltHex;
-    this.feeFaucetIdHex = details.feeFaucetIdHex;
+    this.name = 'MultisigAuthArgsMissingError';
+    this.accountId = accountId;
   }
 }
-

package/src/multisig/consumeNotesErrors.ts

@@ -8,7 +8,8 @@ export type ConsumeNotesErrorCode =
   | 'consume_notes_note_binding_mismatch'
   | 'consume_notes_unsupported_metadata_version'
   | 'consume_notes_metadata_oversize'
-  | 'consume_notes_legacy_note_missing';
+  | 'consume_notes_legacy_note_missing'
+  | 'consume_notes_note_not_authenticated';
 
 /**
  * v2 metadata's embedded `notes` array did not match its declared
@@ -72,3 +73,21 @@ export class LegacyConsumeNotesNoteMissingError extends Error {
     this.noteId = noteId;
   }
 }
+
+/**
+ * A note a `consume_notes` proposal consumes could not be authenticated
+ * (its inclusion proof fetched from the node and imported into the local
+ * store). The signed summary commits to authenticated consumption, so an
+ * unauthenticated rebuild would never match it (issue #409).
+ */
+export class ConsumeNoteNotAuthenticatedError extends Error {
+  readonly code: ConsumeNotesErrorCode = 'consume_notes_note_not_authenticated';
+  readonly noteId: string;
+  readonly reason: string;
+  constructor(noteId: string, reason: string) {
+    super(`consume_notes: note ${noteId} could not be authenticated: ${reason}`);
+    this.name = 'ConsumeNoteNotAuthenticatedError';
+    this.noteId = noteId;
+    this.reason = reason;
+  }
+}

package/src/multisig/signing.ts

@@ -5,12 +5,18 @@ export function toGuardianSignature(
   scheme: SignatureScheme,
   signatureHex: string,
   publicKey?: string,
+  messageFormat?: 'eip712',
 ): ProposalSignature {
   if (scheme === 'ecdsa') {
     if (!publicKey) {
       throw new Error('ECDSA signature requires publicKey');
     }
-    return { scheme: 'ecdsa', signature: signatureHex, publicKey };
+    return {
+      scheme: 'ecdsa',
+      signature: signatureHex,
+      publicKey,
+      ...(messageFormat ? { messageFormat } : {}),
+    };
   }
   return { scheme: 'falcon', signature: signatureHex };
 }
@@ -20,5 +26,5 @@ export async function buildGuardianSignatureFromSigner(
   commitment: string,
 ): Promise<ProposalSignature> {
   const signatureHex = await signer.signCommitment(commitment);
-  return toGuardianSignature(signer.scheme, signatureHex, signer.publicKey);
+  return toGuardianSignature(signer.scheme, signatureHex, signer.publicKey, signer.proposalMessageFormat);
 }