ox 0.14.28 → 0.14.30

package/tempo/MultisigConfig.test.ts

@@ -30,31 +30,51 @@ describe('from', () => {
   })
 })
 
-describe('configId', () => {
+describe('getAddress', () => {
   test('matches independent ground truth', () => {
-    expect(MultisigConfig.toId(singleOwnerConfig)).toMatchInlineSnapshot(
-      `"0xd1f20e1a5bfdd89488f57f68db5bd1aae9a51b510f4a042b2604b57a0b7b471d"`,
+    expect(MultisigConfig.getAddress(singleOwnerConfig)).toMatchInlineSnapshot(
+      `"0x8820d1497eeaf4f68e00b2cfc00a2f3b1dbb00da"`,
     )
   })
 
+  test('matches independent ground truth (salt + weights)', () => {
+    expect(
+      MultisigConfig.getAddress({
+        salt: `0x${'42'.repeat(32)}`,
+        threshold: 2,
+        owners: [
+          { owner: owner1, weight: 1 },
+          { owner: owner2, weight: 2 },
+        ],
+      }),
+    ).toMatchInlineSnapshot(`"0x0773e28146400643e42cb28f6659b74e7c0b451d"`)
+  })
+
   test('is stable across calls', () => {
-    expect(MultisigConfig.toId(singleOwnerConfig)).toBe(
-      MultisigConfig.toId(singleOwnerConfig),
+    expect(MultisigConfig.getAddress(singleOwnerConfig)).toBe(
+      MultisigConfig.getAddress(singleOwnerConfig),
     )
   })
 
   test('differs for a different salt', () => {
-    expect(MultisigConfig.toId(singleOwnerConfig)).not.toBe(
-      MultisigConfig.toId({
+    expect(MultisigConfig.getAddress(singleOwnerConfig)).not.toBe(
+      MultisigConfig.getAddress({
         ...singleOwnerConfig,
         salt: `0x${'42'.repeat(32)}`,
       }),
     )
   })
 
+  test('address is chain-independent', () => {
+    // Derivation does not include chain ID; identical config → identical address.
+    const a = MultisigConfig.getAddress(singleOwnerConfig)
+    const b = MultisigConfig.getAddress(MultisigConfig.from(singleOwnerConfig))
+    expect(a).toBe(b)
+  })
+
   test('throws on invalid config', () => {
     expect(() =>
-      MultisigConfig.toId({
+      MultisigConfig.getAddress({
         threshold: 5,
         owners: singleOwnerConfig.owners,
       }),
@@ -62,41 +82,27 @@ describe('configId', () => {
   })
 })
 
-describe('getAddress', () => {
+describe('getSignPayload', () => {
   test('matches independent ground truth', () => {
     expect(
-      MultisigConfig.getAddress({ config: singleOwnerConfig }),
-    ).toMatchInlineSnapshot(`"0x6ca655065b1de473d903eebd50e5cb4996e10468"`)
-  })
-
-  test('derives from config or configId identically', () => {
-    const configId = MultisigConfig.toId(singleOwnerConfig)
-    expect(MultisigConfig.getAddress({ configId })).toBe(
-      MultisigConfig.getAddress({ config: singleOwnerConfig }),
+      MultisigConfig.getSignPayload({
+        payload: `0x${'de'.repeat(32)}`,
+        genesisConfig: singleOwnerConfig,
+      }),
+    ).toMatchInlineSnapshot(
+      `"0x7df8cb9fef4fc2aeb271b617d1a4c6178b720ae1d7564f48a363069b7d77a079"`,
     )
   })
 
-  test('config ID and address are chain-independent', () => {
-    // Derivation does not include chain ID; identical config → identical id/address.
-    const a = MultisigConfig.toId(singleOwnerConfig)
-    const b = MultisigConfig.toId(MultisigConfig.from(singleOwnerConfig))
-    expect(a).toBe(b)
-  })
-})
-
-describe('getSignPayload', () => {
-  test('matches independent ground truth', () => {
-    const configId = MultisigConfig.toId(singleOwnerConfig)
-    const account = MultisigConfig.getAddress({ configId })
+  test('behavior: `genesisConfig` and `{ account }` produce identical digests', () => {
+    const account = MultisigConfig.getAddress(singleOwnerConfig)
+    const payload = `0x${'42'.repeat(32)}` as const
     expect(
       MultisigConfig.getSignPayload({
-        payload: `0x${'42'.repeat(32)}`,
-        account,
-        configId,
+        payload,
+        genesisConfig: singleOwnerConfig,
       }),
-    ).toMatchInlineSnapshot(
-      `"0xe3d66f6118b89a67c71c8137c46abf0c829056a46ee6a038a1b42c84529fc17e"`,
-    )
+    ).toBe(MultisigConfig.getSignPayload({ payload, account }))
   })
 })
 
@@ -143,8 +149,16 @@ describe('assert / validate', () => {
     expect(MultisigConfig.validate({ threshold: 1, owners: [] })).toBe(false)
   })
 
+  test('accepts 255 owners', () => {
+    const owners = Array.from({ length: 255 }, (_, i) => ({
+      owner: `0x${(i + 1).toString(16).padStart(40, '0')}` as `0x${string}`,
+      weight: 1,
+    }))
+    expect(MultisigConfig.validate({ threshold: 255, owners })).toBe(true)
+  })
+
   test('too many owners', () => {
-    const owners = Array.from({ length: 11 }, (_, i) => ({
+    const owners = Array.from({ length: 256 }, (_, i) => ({
       owner: `0x${(i + 1).toString(16).padStart(40, '0')}` as `0x${string}`,
       weight: 1,
     }))
@@ -169,6 +183,18 @@ describe('assert / validate', () => {
     ).toBe(false)
   })
 
+  test('total weight exceeds u8 max', () => {
+    expect(
+      MultisigConfig.validate({
+        threshold: 255,
+        owners: [
+          { owner: owner1, weight: 128 },
+          { owner: owner2, weight: 128 },
+        ],
+      }),
+    ).toBe(false)
+  })
+
   test('zero owner weight', () => {
     expect(
       MultisigConfig.validate({

package/tempo/MultisigConfig.ts

@@ -3,10 +3,16 @@ import type * as Bytes from '../core/Bytes.js'
 import * as Errors from '../core/Errors.js'
 import * as Hash from '../core/Hash.js'
 import * as Hex from '../core/Hex.js'
-import type { Compute } from '../core/internal/types.js'
+import type { Compute, OneOf } from '../core/internal/types.js'
 
 /** Maximum number of owners allowed in a native multisig config. */
-export const maxOwners = 10
+export const maxOwners = 255
+
+/**
+ * Maximum number of native multisig signatures in one nested authorization
+ * path, including the top-level transaction signature.
+ */
+export const maxNestingDepth = 3
 
 /** Maximum encoded byte length for one primitive owner approval. */
 export const maxOwnerSignatureBytes = 2049
@@ -20,20 +26,17 @@ export const zeroSalt = `0x${'00'.repeat(32)}` as const
 /** Domain prefix for the native multisig account address derivation. */
 const accountDomain = 'tempo:multisig:account'
 
-/** Domain prefix for the native multisig config ID derivation. */
-const configDomain = 'tempo:multisig:config'
-
 /** Domain prefix for native multisig owner approvals. */
 const signatureDomain = 'tempo:multisig:signature'
 
 /**
- * Native multisig configuration. Determines the permanent config ID and the
- * stable multisig account address.
+ * Native multisig configuration. Determines the stable multisig account
+ * address.
  */
 export type Config<numberType = number> = Compute<{
   /**
-   * Caller-chosen 32-byte salt mixed into the permanent config ID. Defaults to
-   * the zero salt (`MultisigConfig.zeroSalt`) when omitted.
+   * Caller-chosen 32-byte salt mixed into the derived account address.
+   * Defaults to the zero salt (`MultisigConfig.zeroSalt`) when omitted.
    */
   salt?: Hex.Hex | undefined
   /** Minimum total owner weight required to authorize a transaction. */
@@ -44,7 +47,7 @@ export type Config<numberType = number> = Compute<{
 
 /** Native multisig owner entry. */
 export type Owner<numberType = number> = {
-  /** Owner address (recovered from the owner's primitive signature). */
+  /** Owner address (recovered from the owner's approval). */
   owner: Address.Address
   /** Nonzero owner weight. */
   weight: numberType
@@ -60,9 +63,9 @@ export type Tuple = readonly [
 /**
  * Asserts that a native multisig {@link ox#MultisigConfig.Config} is valid.
  *
- * Mirrors the Tempo `validate_multisig_config` rules: owners non-empty and
+ * Mirrors the Tempo `InitMultisig::validate` rules: owners non-empty and
  * `<= maxOwners`, strictly ascending unique nonzero owner addresses, nonzero
- * owner weights, `threshold >= 1`, total weight `<= u32::MAX`, and
+ * owner weights, `threshold >= 1`, total weight `<= 255` (u8 max), and
  * `threshold <= total weight`.
  *
  * @example
@@ -109,9 +112,9 @@ export function assert<numberType = number>(config: Config<numberType>): void {
     totalWeight += Number(owner.weight)
   }
 
-  if (totalWeight > 0xffffffff)
+  if (totalWeight > 0xff)
     throw new InvalidConfigError({
-      reason: 'total owner weight exceeds u32 max',
+      reason: 'total owner weight exceeds u8 max',
     })
   if (Number(threshold) > totalWeight)
     throw new InvalidConfigError({
@@ -127,7 +130,7 @@ export declare namespace assert {
  * Normalizes a native multisig {@link ox#MultisigConfig.Config}.
  *
  * Sorts owners into strictly ascending `owner` address order (the canonical
- * form required for config ID derivation) and asserts the config is valid.
+ * form required for account derivation) and asserts the config is valid.
  *
  * @example
  * ```ts twoslash
@@ -197,39 +200,57 @@ export function fromTuple(tuple: Tuple): Config {
 /**
  * Derives the stable native multisig account address.
  *
- * `keccak256("tempo:multisig:account" || config_id)[12:32]`.
+ * Preimage (fixed-width big-endian, **not** RLP):
+ * `keccak256("tempo:multisig:account" || salt || u8(threshold) || u8(owners.length) || (owner || u8(weight)) for each owner)[12:32]`.
+ *
+ * The address is derived once from the initial (bootstrap) config and never
+ * changes — config updates do not affect it.
  *
  * @example
  * ```ts twoslash
  * import { MultisigConfig } from 'ox/tempo'
  *
- * const config = MultisigConfig.from({
+ * const genesisConfig = MultisigConfig.from({
  *   threshold: 1,
  *   owners: [
  *     { owner: '0x1111111111111111111111111111111111111111', weight: 1 },
  *   ],
  * })
  *
- * const address = MultisigConfig.getAddress({ config })
+ * const address = MultisigConfig.getAddress(genesisConfig)
  * ```
  *
- * @param value - The config or config ID to derive the address from.
+ * @param config - The initial (bootstrap) multisig config.
  * @returns The multisig account address.
  */
-export function getAddress(value: getAddress.Value): Address.Address {
-  const id = 'configId' in value ? value.configId : toId(value.config)
-  const hash = Hash.keccak256(Hex.concat(Hex.fromString(accountDomain), id))
-  return Address.from(Hex.slice(hash, 12, 32))
+export function getAddress(config: Config): Address.Address {
+  assert(config)
+  const hash = Hash.keccak256(
+    Hex.concat(
+      Hex.fromString(accountDomain),
+      Hex.padLeft(config.salt ?? zeroSalt, 32),
+      Hex.fromNumber(config.threshold, { size: 1 }),
+      Hex.fromNumber(config.owners.length, { size: 1 }),
+      ...config.owners.flatMap((owner) => [
+        owner.owner,
+        Hex.fromNumber(owner.weight, { size: 1 }),
+      ]),
+    ),
+  )
+  const account = Address.from(Hex.slice(hash, 12, 32))
+  if (Hex.toBigInt(account) === 0n)
+    throw new InvalidConfigError({ reason: 'derived account cannot be zero' })
+  return account
 }
 
 export declare namespace getAddress {
-  type Value = { config: Config } | { configId: Hex.Hex }
-
   type ErrorType =
-    | toId.ErrorType
+    | assert.ErrorType
     | Address.from.ErrorType
     | Hash.keccak256.ErrorType
     | Hex.concat.ErrorType
+    | Hex.fromNumber.ErrorType
+    | Hex.fromString.ErrorType
     | Hex.slice.ErrorType
     | Errors.GlobalErrorType
 }
@@ -237,22 +258,27 @@ export declare namespace getAddress {
 /**
  * Computes the digest a native multisig owner approves (signs).
  *
- * `keccak256("tempo:multisig:signature" || inner_digest || account || config_id)`,
+ * `keccak256("tempo:multisig:signature" || inner_digest || account)`,
  * where `inner_digest` is the transaction sign payload
  * ({@link ox#TxEnvelopeTempo.(getSignPayload:function)}).
  *
+ * The digest is keyed on the permanent `account` derived from the genesis
+ * (bootstrap) config — config updates never change it, so the genesis config
+ * is the correct input even for post-update transactions.
+ *
+ * For a nested multisig owner approval, the parent digest becomes the nested
+ * approval's `payload`, with the nested multisig `account`.
+ *
  * @example
  * ```ts twoslash
  * import { MultisigConfig, TxEnvelopeTempo } from 'ox/tempo'
  *
- * const config = MultisigConfig.from({
+ * const genesisConfig = MultisigConfig.from({
  *   threshold: 1,
  *   owners: [
  *     { owner: '0x1111111111111111111111111111111111111111', weight: 1 },
  *   ],
  * })
- * const configId = MultisigConfig.toId(config)
- * const account = MultisigConfig.getAddress({ configId })
  *
  * const envelope = TxEnvelopeTempo.from({
  *   chainId: 1,
@@ -261,93 +287,74 @@ export declare namespace getAddress {
  *
  * const digest = MultisigConfig.getSignPayload({
  *   payload: TxEnvelopeTempo.getSignPayload(envelope),
- *   account,
- *   configId,
+ *   genesisConfig,
  * })
  * ```
  *
- * @param value - The digest derivation parameters.
- * @returns The owner approval digest.
- */
-export function getSignPayload(value: getSignPayload.Value): Hex.Hex {
-  const { payload, account, configId } = value
-  return Hash.keccak256(
-    Hex.concat(
-      Hex.fromString(signatureDomain),
-      Hex.from(payload),
-      account,
-      configId,
-    ),
-  )
-}
-
-export declare namespace getSignPayload {
-  type Value = {
-    /** The inner transaction sign payload (`tx.signature_hash()`). */
-    payload: Hex.Hex | Bytes.Bytes
-    /** The native multisig account address. */
-    account: Address.Address
-    /** The permanent config ID. */
-    configId: Hex.Hex
-  }
-
-  type ErrorType =
-    | Hash.keccak256.ErrorType
-    | Hex.concat.ErrorType
-    | Hex.from.ErrorType
-    | Errors.GlobalErrorType
-}
-
-/**
- * Derives the permanent config ID for a native multisig
- * {@link ox#MultisigConfig.Config}.
+ * @example
+ * ### From `account`
  *
- * Preimage (fixed-width big-endian, **not** RLP):
- * `keccak256("tempo:multisig:config" || salt || be_u32(threshold) || be_u32(owners.length) || (owner || be_u32(weight)) for each owner)`.
+ * If you already have the permanent `account` (for example, recovered from a
+ * stored envelope), pass it directly:
  *
- * @example
  * ```ts twoslash
- * import { MultisigConfig } from 'ox/tempo'
+ * import { MultisigConfig, TxEnvelopeTempo } from 'ox/tempo'
  *
- * const config = MultisigConfig.from({
+ * const genesisConfig = MultisigConfig.from({
  *   threshold: 1,
  *   owners: [
  *     { owner: '0x1111111111111111111111111111111111111111', weight: 1 },
  *   ],
  * })
+ * const account = MultisigConfig.getAddress(genesisConfig)
  *
- * const configId = MultisigConfig.toId(config)
+ * const envelope = TxEnvelopeTempo.from({ chainId: 1, calls: [] })
+ *
+ * const digest = MultisigConfig.getSignPayload({
+ *   payload: TxEnvelopeTempo.getSignPayload(envelope),
+ *   account
+ * })
  * ```
  *
- * @param config - The multisig config.
- * @returns The 32-byte config ID.
+ * @param value - The digest derivation parameters.
+ * @returns The owner approval digest.
  */
-export function toId(config: Config): Hex.Hex {
-  assert(config)
-  const id = Hash.keccak256(
-    Hex.concat(
-      Hex.fromString(configDomain),
-      Hex.padLeft(config.salt ?? zeroSalt, 32),
-      Hex.fromNumber(config.threshold, { size: 4 }),
-      Hex.fromNumber(config.owners.length, { size: 4 }),
-      ...config.owners.flatMap((owner) => [
-        owner.owner,
-        Hex.fromNumber(owner.weight, { size: 4 }),
-      ]),
-    ),
+export function getSignPayload(value: getSignPayload.Value): Hex.Hex {
+  const { payload } = value
+  const account =
+    'account' in value && value.account
+      ? value.account
+      : getAddress((value as { genesisConfig: Config }).genesisConfig)
+  return Hash.keccak256(
+    Hex.concat(Hex.fromString(signatureDomain), Hex.from(payload), account),
   )
-  if (Hex.toBigInt(id) === 0n)
-    throw new InvalidConfigError({ reason: 'config ID cannot be zero' })
-  return id
 }
 
-export declare namespace toId {
+export declare namespace getSignPayload {
+  type Value = {
+    /** The inner transaction sign payload (`tx.signature_hash()`). */
+    payload: Hex.Hex | Bytes.Bytes
+  } & OneOf<
+    | {
+        /** The native multisig account address. */
+        account: Address.Address
+      }
+    | {
+        /**
+         * The initial multisig config (the bootstrap config that derived the
+         * permanent `account`). Used to derive the account automatically.
+         * Config updates never change `account`, so the genesis config is
+         * also the correct input for post-update transactions.
+         */
+        genesisConfig: Config
+      }
+  >
+
   type ErrorType =
-    | assert.ErrorType
+    | getAddress.ErrorType
     | Hash.keccak256.ErrorType
     | Hex.concat.ErrorType
-    | Hex.fromNumber.ErrorType
-    | Hex.fromString.ErrorType
+    | Hex.from.ErrorType
     | Errors.GlobalErrorType
 }