ox 0.14.29 → 0.14.31

package/tempo/MultisigConfig.ts

@@ -6,9 +6,21 @@ import * as Hex from '../core/Hex.js'
 import type { Compute, OneOf } from '../core/internal/types.js'
 
 /** Maximum number of owners allowed in a native multisig config. */
-export const maxOwners = 10
+export const maxOwners = 255
 
-/** Maximum encoded byte length for one primitive owner approval. */
+/** Maximum threshold accepted by a native multisig config. */
+export const maxThreshold = 8
+
+/** Maximum number of owner approvals in a native multisig signature. */
+export const maxSignatures = maxThreshold
+
+/**
+ * Maximum number of native multisig signatures in one nested authorization
+ * path, including the top-level transaction signature.
+ */
+export const maxNestingDepth = 2
+
+/** Maximum encoded byte length for one owner approval. */
 export const maxOwnerSignatureBytes = 2049
 
 /** Tempo signature type byte for native multisig signatures. */
@@ -20,20 +32,17 @@ export const zeroSalt = `0x${'00'.repeat(32)}` as const
 /** Domain prefix for the native multisig account address derivation. */
 const accountDomain = 'tempo:multisig:account'
 
-/** Domain prefix for the native multisig config ID derivation. */
-const configDomain = 'tempo:multisig:config'
-
 /** Domain prefix for native multisig owner approvals. */
 const signatureDomain = 'tempo:multisig:signature'
 
 /**
- * Native multisig configuration. Determines the permanent config ID and the
- * stable multisig account address.
+ * Native multisig configuration. Determines the stable multisig account
+ * address.
  */
 export type Config<numberType = number> = Compute<{
   /**
-   * Caller-chosen 32-byte salt mixed into the permanent config ID. Defaults to
-   * the zero salt (`MultisigConfig.zeroSalt`) when omitted.
+   * Caller-chosen 32-byte salt mixed into the derived account address.
+   * Defaults to the zero salt (`MultisigConfig.zeroSalt`) when omitted.
    */
   salt?: Hex.Hex | undefined
   /** Minimum total owner weight required to authorize a transaction. */
@@ -44,7 +53,7 @@ export type Config<numberType = number> = Compute<{
 
 /** Native multisig owner entry. */
 export type Owner<numberType = number> = {
-  /** Owner address (recovered from the owner's primitive signature). */
+  /** Owner address (recovered from the owner's approval). */
   owner: Address.Address
   /** Nonzero owner weight. */
   weight: numberType
@@ -60,10 +69,10 @@ export type Tuple = readonly [
 /**
  * Asserts that a native multisig {@link ox#MultisigConfig.Config} is valid.
  *
- * Mirrors the Tempo `validate_multisig_config` rules: owners non-empty and
+ * Mirrors the Tempo `InitMultisig::validate` rules: owners non-empty and
  * `<= maxOwners`, strictly ascending unique nonzero owner addresses, nonzero
- * owner weights, `threshold >= 1`, total weight `<= u32::MAX`, and
- * `threshold <= total weight`.
+ * integer owner weights, integer `threshold` between `1` and `maxThreshold`,
+ * total weight `<= 255` (u8 max), and `threshold <= total weight`.
  *
  * @example
  * ```ts twoslash
@@ -88,14 +97,22 @@ export function assert<numberType = number>(config: Config<numberType>): void {
     throw new InvalidConfigError({ reason: 'owners cannot be empty' })
   if (owners.length > maxOwners)
     throw new InvalidConfigError({ reason: 'too many owners' })
+  if (!Number.isInteger(Number(threshold)))
+    throw new InvalidConfigError({ reason: 'threshold must be an integer' })
   if (Number(threshold) < 1)
     throw new InvalidConfigError({ reason: 'threshold cannot be zero' })
+  if (Number(threshold) > maxThreshold)
+    throw new InvalidConfigError({ reason: 'threshold exceeds max threshold' })
 
   let totalWeight = 0
   let previous: bigint | undefined
   for (const owner of owners) {
     if (!Address.validate(owner.owner) || Hex.toBigInt(owner.owner) === 0n)
       throw new InvalidConfigError({ reason: 'owner cannot be zero' })
+    if (!Number.isInteger(Number(owner.weight)))
+      throw new InvalidConfigError({
+        reason: 'owner weight must be an integer',
+      })
     if (Number(owner.weight) < 1)
       throw new InvalidConfigError({ reason: 'owner weight cannot be zero' })
 
@@ -109,9 +126,9 @@ export function assert<numberType = number>(config: Config<numberType>): void {
     totalWeight += Number(owner.weight)
   }
 
-  if (totalWeight > 0xffffffff)
+  if (totalWeight > 0xff)
     throw new InvalidConfigError({
-      reason: 'total owner weight exceeds u32 max',
+      reason: 'total owner weight exceeds u8 max',
     })
   if (Number(threshold) > totalWeight)
     throw new InvalidConfigError({
@@ -127,7 +144,7 @@ export declare namespace assert {
  * Normalizes a native multisig {@link ox#MultisigConfig.Config}.
  *
  * Sorts owners into strictly ascending `owner` address order (the canonical
- * form required for config ID derivation) and asserts the config is valid.
+ * form required for account derivation) and asserts the config is valid.
  *
  * @example
  * ```ts twoslash
@@ -197,7 +214,11 @@ export function fromTuple(tuple: Tuple): Config {
 /**
  * Derives the stable native multisig account address.
  *
- * `keccak256("tempo:multisig:account" || config_id)[12:32]`.
+ * Preimage (fixed-width big-endian, **not** RLP):
+ * `keccak256("tempo:multisig:account" || salt || u8(threshold) || u8(owners.length) || (owner || u8(weight)) for each owner)[12:32]`.
+ *
+ * The address is derived once from the initial (bootstrap) config and never
+ * changes — config updates do not affect it.
  *
  * @example
  * ```ts twoslash
@@ -213,49 +234,37 @@ export function fromTuple(tuple: Tuple): Config {
  * const address = MultisigConfig.getAddress(genesisConfig)
  * ```
  *
- * @example
- * ### From an genesis config ID
- *
- * If you already have the permanent `genesisConfigId`, pass it directly:
- *
- * ```ts twoslash
- * import { MultisigConfig } from 'ox/tempo'
- *
- * const genesisConfigId =
- *   `0x${'00'.repeat(32)}` as const
- *
- * const address = MultisigConfig.getAddress({ genesisConfigId })
- * ```
- *
- * @param value - The genesis config (positional) or `{ genesisConfigId }`.
+ * @param config - The initial (bootstrap) multisig config.
  * @returns The multisig account address.
  */
-export function getAddress(value: getAddress.Value): Address.Address {
-  const id =
-    typeof value === 'object' && 'genesisConfigId' in value
-      ? value.genesisConfigId
-      : toId(value)
-  const hash = Hash.keccak256(Hex.concat(Hex.fromString(accountDomain), id))
-  return Address.from(Hex.slice(hash, 12, 32))
+export function getAddress(config: Config): Address.Address {
+  assert(config)
+  const hash = Hash.keccak256(
+    Hex.concat(
+      Hex.fromString(accountDomain),
+      Hex.padLeft(config.salt ?? zeroSalt, 32),
+      Hex.fromNumber(config.threshold, { size: 1 }),
+      Hex.fromNumber(config.owners.length, { size: 1 }),
+      ...config.owners.flatMap((owner) => [
+        owner.owner,
+        Hex.fromNumber(owner.weight, { size: 1 }),
+      ]),
+    ),
+  )
+  const account = Address.from(Hex.slice(hash, 12, 32))
+  if (Hex.toBigInt(account) === 0n)
+    throw new InvalidConfigError({ reason: 'derived account cannot be zero' })
+  return account
 }
 
 export declare namespace getAddress {
-  type Value =
-    | Config
-    | {
-        /**
-         * The permanent genesis config ID (`MultisigConfig.toId(genesisConfig)`).
-         * Config updates never change this value, so it identifies the
-         * account permanently.
-         */
-        genesisConfigId: Hex.Hex
-      }
-
   type ErrorType =
-    | toId.ErrorType
+    | assert.ErrorType
     | Address.from.ErrorType
     | Hash.keccak256.ErrorType
     | Hex.concat.ErrorType
+    | Hex.fromNumber.ErrorType
+    | Hex.fromString.ErrorType
     | Hex.slice.ErrorType
     | Errors.GlobalErrorType
 }
@@ -263,14 +272,16 @@ export declare namespace getAddress {
 /**
  * Computes the digest a native multisig owner approves (signs).
  *
- * `keccak256("tempo:multisig:signature" || inner_digest || account || config_id)`,
+ * `keccak256("tempo:multisig:signature" || inner_digest || account)`,
  * where `inner_digest` is the transaction sign payload
  * ({@link ox#TxEnvelopeTempo.(getSignPayload:function)}).
  *
- * The digest is always keyed on the permanent `account`/`genesisConfigId`
- * derived from the genesis (bootstrap) config — config updates never change
- * these values, so the genesis config is the correct input even for
- * post-update transactions.
+ * The digest is keyed on the permanent `account` derived from the genesis
+ * (bootstrap) config — config updates never change it, so the genesis config
+ * is the correct input even for post-update transactions.
+ *
+ * For a nested multisig owner approval, the parent digest becomes the nested
+ * approval's `payload`, with the nested multisig `account`.
  *
  * @example
  * ```ts twoslash
@@ -295,10 +306,10 @@ export declare namespace getAddress {
  * ```
  *
  * @example
- * ### From `account` + `genesisConfigId`
+ * ### From `account`
  *
- * If you already have the permanent `account` and `genesisConfigId` (for
- * example, recovered from a stored envelope), pass them directly:
+ * If you already have the permanent `account` (for example, recovered from a
+ * stored envelope), pass it directly:
  *
  * ```ts twoslash
  * import { MultisigConfig, TxEnvelopeTempo } from 'ox/tempo'
@@ -309,15 +320,13 @@ export declare namespace getAddress {
  *     { owner: '0x1111111111111111111111111111111111111111', weight: 1 },
  *   ],
  * })
- * const genesisConfigId = MultisigConfig.toId(genesisConfig)
  * const account = MultisigConfig.getAddress(genesisConfig)
  *
  * const envelope = TxEnvelopeTempo.from({ chainId: 1, calls: [] })
  *
  * const digest = MultisigConfig.getSignPayload({
  *   payload: TxEnvelopeTempo.getSignPayload(envelope),
- *   account,
- *   genesisConfigId,
+ *   account
  * })
  * ```
  *
@@ -330,17 +339,8 @@ export function getSignPayload(value: getSignPayload.Value): Hex.Hex {
     'account' in value && value.account
       ? value.account
       : getAddress((value as { genesisConfig: Config }).genesisConfig)
-  const genesisConfigId =
-    'genesisConfigId' in value && value.genesisConfigId
-      ? value.genesisConfigId
-      : toId((value as { genesisConfig: Config }).genesisConfig)
   return Hash.keccak256(
-    Hex.concat(
-      Hex.fromString(signatureDomain),
-      Hex.from(payload),
-      account,
-      genesisConfigId,
-    ),
+    Hex.concat(Hex.fromString(signatureDomain), Hex.from(payload), account),
   )
 }
 
@@ -352,16 +352,13 @@ export declare namespace getSignPayload {
     | {
         /** The native multisig account address. */
         account: Address.Address
-        /** The permanent config ID. */
-        genesisConfigId: Hex.Hex
       }
     | {
         /**
          * The initial multisig config (the bootstrap config that derived the
-         * permanent `account` and `genesisConfigId`). Used to derive both values
-         * automatically. Config updates never change `account`/`genesisConfigId`,
-         * so the genesis config is also the correct input for post-update
-         * transactions.
+         * permanent `account`). Used to derive the account automatically.
+         * Config updates never change `account`, so the genesis config is
+         * also the correct input for post-update transactions.
          */
         genesisConfig: Config
       }
@@ -369,66 +366,12 @@ export declare namespace getSignPayload {
 
   type ErrorType =
     | getAddress.ErrorType
-    | toId.ErrorType
     | Hash.keccak256.ErrorType
     | Hex.concat.ErrorType
     | Hex.from.ErrorType
     | Errors.GlobalErrorType
 }
 
-/**
- * Derives the permanent config ID for a native multisig
- * {@link ox#MultisigConfig.Config}.
- *
- * Preimage (fixed-width big-endian, **not** RLP):
- * `keccak256("tempo:multisig:config" || salt || be_u32(threshold) || be_u32(owners.length) || (owner || be_u32(weight)) for each owner)`.
- *
- * @example
- * ```ts twoslash
- * import { MultisigConfig } from 'ox/tempo'
- *
- * const config = MultisigConfig.from({
- *   threshold: 1,
- *   owners: [
- *     { owner: '0x1111111111111111111111111111111111111111', weight: 1 },
- *   ],
- * })
- *
- * const genesisConfigId = MultisigConfig.toId(config)
- * ```
- *
- * @param config - The multisig config.
- * @returns The 32-byte config ID.
- */
-export function toId(config: Config): Hex.Hex {
-  assert(config)
-  const id = Hash.keccak256(
-    Hex.concat(
-      Hex.fromString(configDomain),
-      Hex.padLeft(config.salt ?? zeroSalt, 32),
-      Hex.fromNumber(config.threshold, { size: 4 }),
-      Hex.fromNumber(config.owners.length, { size: 4 }),
-      ...config.owners.flatMap((owner) => [
-        owner.owner,
-        Hex.fromNumber(owner.weight, { size: 4 }),
-      ]),
-    ),
-  )
-  if (Hex.toBigInt(id) === 0n)
-    throw new InvalidConfigError({ reason: 'config ID cannot be zero' })
-  return id
-}
-
-export declare namespace toId {
-  type ErrorType =
-    | assert.ErrorType
-    | Hash.keccak256.ErrorType
-    | Hex.concat.ErrorType
-    | Hex.fromNumber.ErrorType
-    | Hex.fromString.ErrorType
-    | Errors.GlobalErrorType
-}
-
 /**
  * Converts a {@link ox#MultisigConfig.Config} to its RLP tuple form (carried
  * by the multisig signature `init`).

package/tempo/SignatureEnvelope.test-d/package.json

@@ -0,0 +1,6 @@
+{
+  "type": "module",
+  "types": "../../_types/tempo/SignatureEnvelope.test-d.d.ts",
+  "main": "../../_cjs/tempo/SignatureEnvelope.test-d.js",
+  "module": "../../_esm/tempo/SignatureEnvelope.test-d.js"
+}

package/tempo/SignatureEnvelope.test-d.ts

@@ -0,0 +1,97 @@
+import { expectTypeOf, test } from 'vitest'
+import * as SignatureEnvelope from './SignatureEnvelope.js'
+
+const signatureRpc = {
+  r: '0x01',
+  s: '0x02',
+  type: 'secp256k1',
+  yParity: '0x0',
+} as const satisfies SignatureEnvelope.SignatureEnvelopeRpc
+
+const signature = {
+  signature: {
+    r: 1n,
+    s: 2n,
+    yParity: 0,
+  },
+  type: 'secp256k1',
+} as const satisfies SignatureEnvelope.Secp256k1
+
+test('toRpc preserves the signature type', () => {
+  expectTypeOf(
+    SignatureEnvelope.toRpc(signature),
+  ).toEqualTypeOf<SignatureEnvelope.Secp256k1Rpc>()
+})
+
+test('MultisigRpc uses static initialized and bootstrap shapes', () => {
+  const initialized = {
+    account: '0x1111111111111111111111111111111111111111',
+    signatures: [signatureRpc],
+  } as const satisfies SignatureEnvelope.MultisigRpc
+  const bootstrap = {
+    init: {
+      owners: [
+        {
+          owner: '0x1111111111111111111111111111111111111111',
+          weight: 1,
+        },
+      ],
+      threshold: 1,
+    },
+    signatures: [signatureRpc],
+  } as const satisfies SignatureEnvelope.MultisigRpc
+  const bootstrapWithAccountUndefined: SignatureEnvelope.MultisigRpc = {
+    ...bootstrap,
+    account: undefined,
+  }
+
+  expectTypeOf(initialized.signatures).toMatchTypeOf<
+    readonly SignatureEnvelope.SignatureEnvelopeRpc[]
+  >()
+  expectTypeOf(bootstrap.signatures).toMatchTypeOf<
+    readonly SignatureEnvelope.SignatureEnvelopeRpc[]
+  >()
+  expectTypeOf(
+    bootstrapWithAccountUndefined,
+  ).toMatchTypeOf<SignatureEnvelope.MultisigRpc>()
+  expectTypeOf<
+    SignatureEnvelope.GetType<typeof bootstrap>
+  >().toEqualTypeOf<'multisig'>()
+})
+
+test('MultisigRpc rejects legacy shapes', () => {
+  const combined = {
+    account: '0x1111111111111111111111111111111111111111',
+    init: {
+      owners: [
+        {
+          owner: '0x1111111111111111111111111111111111111111',
+          weight: 1,
+        },
+      ],
+      threshold: 1,
+    },
+    signatures: [signatureRpc],
+  } as const
+  // @ts-expect-error Bootstrap RPC signatures omit `account`.
+  const combinedRpc: SignatureEnvelope.MultisigRpc = combined
+
+  const serialized = {
+    account: '0x1111111111111111111111111111111111111111',
+    signatures: ['0x1234'],
+  } as const
+  // @ts-expect-error Owner approvals use structured RPC envelopes.
+  const serializedRpc: SignatureEnvelope.MultisigRpc = serialized
+
+  const tagged = {
+    account: '0x1111111111111111111111111111111111111111',
+    signatures: [signatureRpc],
+    type: 'multisig',
+  } as const
+  // @ts-expect-error Multisig RPC signatures are untagged.
+  const taggedRpc: SignatureEnvelope.MultisigRpc = tagged
+
+  expectTypeOf(combinedRpc).toEqualTypeOf<SignatureEnvelope.MultisigRpc>()
+  expectTypeOf(serializedRpc).toEqualTypeOf<SignatureEnvelope.MultisigRpc>()
+  expectTypeOf(taggedRpc).toEqualTypeOf<SignatureEnvelope.MultisigRpc>()
+})