ox 0.14.32 → 0.14.34

package/tempo/KeyAuthorization.test-d.ts

@@ -23,6 +23,12 @@ const multisig = {
   type: 'multisig',
 } as const satisfies SignatureEnvelope.Multisig
 
+const keychain = {
+  inner: signature,
+  type: 'keychain',
+  userAddress: authorization.address,
+} as const satisfies SignatureEnvelope.Keychain
+
 test('accepts primitive signatures', () => {
   const signed = KeyAuthorization.from(authorization, { signature })
 
@@ -31,11 +37,12 @@ test('accepts primitive signatures', () => {
   >()
 })
 
-test('rejects multisig signatures', () => {
-  KeyAuthorization.from(authorization, {
-    // @ts-expect-error Key authorizations accept only primitive signatures.
-    signature: multisig,
-  })
+test('accepts multisig signatures', () => {
+  const signed = KeyAuthorization.from(authorization, { signature: multisig })
+
+  expectTypeOf(signed.signature).toMatchTypeOf<
+    KeyAuthorization.Signed['signature']
+  >()
 
   const multisigRpc = {
     account: multisig.account,
@@ -54,9 +61,37 @@ test('rejects multisig signatures', () => {
     expiry: null,
     keyId: authorization.address,
     keyType: authorization.type,
-    // @ts-expect-error Key authorizations accept only primitive RPC signatures.
     signature: multisigRpc,
   }
 
   expectTypeOf(rpc).toEqualTypeOf<KeyAuthorization.Rpc>()
 })
+
+test('rejects keychain signatures', () => {
+  KeyAuthorization.from(authorization, {
+    // @ts-expect-error Key authorizations do not accept keychain signatures.
+    signature: keychain,
+  })
+
+  const keychainRpc = {
+    signature: {
+      r: '0x01',
+      s: '0x02',
+      type: 'secp256k1',
+      yParity: '0x0',
+    },
+    type: 'keychain',
+    userAddress: authorization.address,
+  } as const satisfies SignatureEnvelope.KeychainRpc
+
+  const rpc: KeyAuthorization.Rpc = {
+    chainId: '0x1',
+    expiry: null,
+    keyId: authorization.address,
+    keyType: authorization.type,
+    // @ts-expect-error Key authorizations do not accept keychain RPC signatures.
+    signature: keychainRpc,
+  }
+
+  expectTypeOf(rpc).toEqualTypeOf<KeyAuthorization.Rpc>()
+})

package/tempo/KeyAuthorization.test.ts

@@ -53,11 +53,17 @@ const signature_webauthn = SignatureEnvelope.from({
   },
 })
 
-const signature_multisig = SignatureEnvelope.from({
+const signature_multisig = {
   account: address,
   signatures: [SignatureEnvelope.from(signature_secp256k1)],
   type: 'multisig',
-})
+} as const satisfies SignatureEnvelope.Multisig
+
+const signature_keychain = {
+  inner: SignatureEnvelope.from(signature_secp256k1),
+  type: 'keychain',
+  userAddress: address,
+} as const satisfies SignatureEnvelope.Keychain
 
 describe('from', () => {
   test('default', () => {
@@ -448,7 +454,34 @@ describe('from', () => {
     `)
   })
 
-  test('rejects a multisig signature', () => {
+  test('with signature (multisig)', () => {
+    const authorization = KeyAuthorization.from({
+      address,
+      chainId: 1n,
+      type: 'secp256k1',
+    })
+
+    const signed = KeyAuthorization.from(authorization, {
+      signature: signature_multisig,
+    })
+    expect(signed.signature).toEqual(signature_multisig)
+    expect(
+      KeyAuthorization.from(authorization, {
+        signature: SignatureEnvelope.serialize(signature_multisig),
+      }).signature,
+    ).toEqual(signature_multisig)
+    expect(
+      KeyAuthorization.from({
+        ...authorization,
+        signature: signature_multisig,
+      }).signature,
+    ).toEqual(signature_multisig)
+    expect(
+      KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)),
+    ).toEqual(signed)
+  })
+
+  test('rejects a keychain signature', () => {
     const authorization = KeyAuthorization.from({
       address,
       chainId: 1n,
@@ -457,50 +490,55 @@ describe('from', () => {
 
     expect(() =>
       KeyAuthorization.from(authorization, {
-        signature: signature_multisig as never,
+        signature: signature_keychain as never,
       }),
     ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.]`,
     )
 
     expect(() =>
       KeyAuthorization.from(authorization, {
-        signature: SignatureEnvelope.serialize(signature_multisig),
+        signature: SignatureEnvelope.serialize(signature_keychain),
       }),
     ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.]`,
     )
 
     expect(() =>
       KeyAuthorization.from({
         ...authorization,
-        signature: signature_multisig,
+        signature: signature_keychain,
       } as never),
     ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.]`,
     )
   })
 })
 
 describe('fromRpc', () => {
-  test('rejects a multisig signature', () => {
+  test('multisig', () => {
+    const authorization = KeyAuthorization.fromRpc({
+      chainId: '0x1',
+      expiry: null,
+      keyId: address,
+      keyType: 'secp256k1',
+      signature: SignatureEnvelope.toRpc(signature_multisig),
+    })
+
+    expect(authorization.signature).toEqual(signature_multisig)
+  })
+
+  test('rejects a keychain signature', () => {
     expect(() =>
       KeyAuthorization.fromRpc({
         chainId: '0x1',
         expiry: null,
         keyId: address,
         keyType: 'secp256k1',
-        signature: {
-          account: address,
-          signatures: [
-            SignatureEnvelope.toRpc(
-              SignatureEnvelope.from(signature_secp256k1),
-            ),
-          ],
-        },
+        signature: SignatureEnvelope.toRpc(signature_keychain),
       } as never),
     ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.]`,
     )
   })
 
@@ -721,15 +759,13 @@ describe('fromRpc', () => {
 })
 
 describe('fromTuple', () => {
-  test('rejects a multisig signature', () => {
-    expect(() =>
-      KeyAuthorization.fromTuple([
-        ['0x1', '0x', address],
-        SignatureEnvelope.serialize(signature_multisig),
-      ]),
-    ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
-    )
+  test('multisig', () => {
+    const authorization = KeyAuthorization.fromTuple([
+      ['0x1', '0x', address],
+      SignatureEnvelope.serialize(signature_multisig),
+    ])
+
+    expect(authorization.signature).toEqual(signature_multisig)
   })
 
   test('default', () => {
@@ -1069,16 +1105,14 @@ describe('getSignPayload', () => {
 })
 
 describe('deserialize', () => {
-  test('rejects a multisig signature', () => {
+  test('multisig', () => {
     const serialized = Rlp.fromHex([
       ['0x1', '0x', address],
       SignatureEnvelope.serialize(signature_multisig),
     ])
 
-    expect(() =>
-      KeyAuthorization.deserialize(serialized),
-    ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+    expect(KeyAuthorization.deserialize(serialized).signature).toEqual(
+      signature_multisig,
     )
   })
 
@@ -1252,16 +1286,16 @@ describe('serialize', () => {
 })
 
 describe('toRpc', () => {
-  test('rejects a multisig signature', () => {
-    expect(() =>
-      KeyAuthorization.toRpc({
-        address,
-        chainId: 1n,
-        signature: signature_multisig,
-        type: 'secp256k1',
-      } as never),
-    ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+  test('multisig', () => {
+    const authorization = KeyAuthorization.toRpc({
+      address,
+      chainId: 1n,
+      signature: signature_multisig,
+      type: 'secp256k1',
+    })
+
+    expect(authorization.signature).toEqual(
+      SignatureEnvelope.toRpc(signature_multisig),
     )
   })
 
@@ -1522,17 +1556,15 @@ describe('toRpc', () => {
 })
 
 describe('toTuple', () => {
-  test('rejects a multisig signature', () => {
-    expect(() =>
-      KeyAuthorization.toTuple({
-        address,
-        chainId: 1n,
-        signature: signature_multisig,
-        type: 'secp256k1',
-      } as never),
-    ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
-    )
+  test('multisig', () => {
+    const tuple = KeyAuthorization.toTuple({
+      address,
+      chainId: 1n,
+      signature: signature_multisig,
+      type: 'secp256k1',
+    })
+
+    expect(tuple[1]).toBe(SignatureEnvelope.serialize(signature_multisig))
   })
 
   test('default', () => {
@@ -2483,12 +2515,12 @@ describe('admin keys (TIP-1049)', () => {
     expect(restored.account).toBeUndefined()
   })
 
-  test('fromTuple: drops orphan account without isAdmin', () => {
+  test('fromTuple: preserves a non-admin account binding', () => {
     const restored = KeyAuthorization.fromTuple([
       ['0x01', '0x', address, '0x', [], [], '0x', '0x', account],
     ])
-    expect(restored.isAdmin).toBeUndefined()
-    expect(restored.account).toBeUndefined()
+    expect(restored.isAdmin).toBe(false)
+    expect(restored.account).toBe(account)
   })
 
   test('fromTuple: extracts isAdmin + account together', () => {
@@ -2523,6 +2555,20 @@ describe('admin keys (TIP-1049)', () => {
     expect(restored.account).toBe(account)
   })
 
+  test('serialize/deserialize: roundtrip with non-admin account binding', () => {
+    const authorization = KeyAuthorization.from({
+      address,
+      account,
+      chainId: 1n,
+      isAdmin: false,
+      type: 'secp256k1',
+    })
+    const serialized = KeyAuthorization.serialize(authorization)
+    const restored = KeyAuthorization.deserialize(serialized)
+    expect(restored.isAdmin).toBe(false)
+    expect(restored.account).toBe(account)
+  })
+
   test('toRpc/fromRpc: roundtrip with isAdmin + account', () => {
     const authorization = KeyAuthorization.from(
       {
@@ -2553,15 +2599,15 @@ describe('admin keys (TIP-1049)', () => {
     expect(restored.account).toBeUndefined()
   })
 
-  test('fromRpc: drops orphan account without isAdmin', () => {
+  test('fromRpc: preserves a non-admin account binding', () => {
     const authorization = KeyAuthorization.from(
       { address, chainId: 1n, type: 'secp256k1' },
       { signature: SignatureEnvelope.from(signature_secp256k1) },
     )
     const rpc = KeyAuthorization.toRpc(authorization)
     const restored = KeyAuthorization.fromRpc({ ...rpc, account })
-    expect(restored.isAdmin).toBeUndefined()
-    expect(restored.account).toBeUndefined()
+    expect(restored.isAdmin).toBe(false)
+    expect(restored.account).toBe(account)
   })
 
   test('hash: changes when admin pair is added', () => {

package/tempo/KeyAuthorization.ts

@@ -81,13 +81,22 @@ export type KeyAuthorization<
   | {}
 > &
   (signed extends true
-    ? { signature: SignatureEnvelope.Primitive<bigintType, numberType> }
+    ? { signature: Signature<bigintType, numberType> }
     : {
-        signature?:
-          | SignatureEnvelope.Primitive<bigintType, numberType>
-          | undefined
+        signature?: Signature<bigintType, numberType> | undefined
       })
 
+/** Signature that can authorize an access key. */
+export type Signature<bigintType = bigint, numberType = number> = OneOf<
+  | SignatureEnvelope.Primitive<bigintType, numberType>
+  | SignatureEnvelope.Multisig<bigintType, numberType>
+>
+
+/** RPC-formatted signature that can authorize an access key. */
+export type SignatureRpc = OneOf<
+  SignatureEnvelope.PrimitiveRpc | SignatureEnvelope.MultisigRpc
+>
+
 /** Input type for a Key Authorization. */
 export type Input = KeyAuthorization<
   false,
@@ -114,8 +123,8 @@ export type Rpc = {
   keyType: SignatureEnvelope.Type
   /** Token spending limits. */
   limits?: readonly RpcTokenLimit[] | undefined
-  /** Primitive signature authorizing this key. */
-  signature: SignatureEnvelope.PrimitiveRpc
+  /** Signature authorizing this key. */
+  signature: SignatureRpc
   /** Optional 32-byte witness (hex). */
   witness?: Hex.Hex | null | undefined
 }
@@ -146,10 +155,11 @@ export type Signed<
   addressType = Address.Address,
 > = KeyAuthorization<true, bigintType, numberType, addressType>
 
-type PrimitiveSignatureValue =
-  | UnionPartialBy<SignatureEnvelope.Primitive, 'prehash' | 'type'>
+type SignatureValue =
+  | UnionPartialBy<Signature, 'prehash' | 'type'>
   | SignatureEnvelope.Secp256k1Flat
   | SignatureEnvelope.Serialized
+  | SignatureEnvelope.from.MultisigFromInitialConfig
 
 type BaseTuple = readonly [
   chainId: Hex.Hex,
@@ -408,7 +418,7 @@ export type TokenLimit<
  */
 export function from<
   const authorization extends Input | Rpc,
-  const signature extends PrimitiveSignatureValue | undefined = undefined,
+  const signature extends SignatureValue | undefined = undefined,
 >(
   authorization: authorization | KeyAuthorization,
   options: from.Options<signature> = {},
@@ -467,29 +477,25 @@ export function from<
 
 export declare namespace from {
   type Options<
-    signature extends PrimitiveSignatureValue | undefined =
-      | PrimitiveSignatureValue
-      | undefined,
+    signature extends SignatureValue | undefined = SignatureValue | undefined,
   > = {
-    /** The primitive signature to attach to the Key Authorization. */
-    signature?: signature | SignatureEnvelope.Primitive | undefined
+    /** The signature to attach to the Key Authorization. */
+    signature?: signature | Signature | undefined
   }
 
   type ReturnType<
     authorization extends KeyAuthorization | Input | Rpc = KeyAuthorization,
-    signature extends PrimitiveSignatureValue | undefined =
-      | PrimitiveSignatureValue
-      | undefined,
+    signature extends SignatureValue | undefined = SignatureValue | undefined,
   > = Compute<
     authorization extends Rpc
       ? Signed
       : TempoAddress.ResolveAddresses<
           authorization &
-            (signature extends PrimitiveSignatureValue
+            (signature extends SignatureValue
               ? {
                   signature: Extract<
                     SignatureEnvelope.from.ReturnValue<signature>,
-                    SignatureEnvelope.Primitive
+                    Signature
                   >
                 }
               : {})
@@ -551,11 +557,8 @@ export function fromRpc(authorization: Rpc): Signed {
       })
     : undefined
 
-  // TIP-1049 admin fields are paired: emit both or neither; orphan wire
-  // fields are dropped. Separate conditional spreads break `Signed`
-  // assignability without `exactOptionalPropertyTypes` (#290).
-  const adminPair =
-    account !== undefined && isAdmin ? { account, isAdmin: true as const } : {}
+  const accountBinding =
+    account !== undefined ? { account, isAdmin: isAdmin ?? false } : {}
 
   return {
     address: keyId,
@@ -572,7 +575,7 @@ export function fromRpc(authorization: Rpc): Signed {
     signature,
     type: keyType,
     ...(witness !== undefined ? { witness } : {}),
-    ...adminPair,
+    ...accountBinding,
   }
 }
 
@@ -694,11 +697,8 @@ export function fromTuple<const tuple extends Tuple>(
   const account = isAbsent(rawAccount)
     ? undefined
     : (rawAccount as Address.Address)
-  // TIP-1049 admin fields are paired: only emit both when both are present on
-  // the wire. Wire shapes carrying only one are tolerated for forward-compat
-  // but the orphan field is dropped (since the public API requires both).
-  const adminPair =
-    account !== undefined && isAdmin ? { account, isAdmin: true as const } : {}
+  const accountBinding =
+    account !== undefined ? { account, isAdmin: isAdmin ?? false } : {}
   const args: KeyAuthorization = {
     address: keyId,
     chainId: chainId === '0x' ? 0n : Hex.toBigInt(chainId),
@@ -707,7 +707,7 @@ export function fromTuple<const tuple extends Tuple>(
     ...(limits !== undefined ? { limits } : {}),
     ...(scopes !== undefined ? { scopes } : {}),
     ...(witness !== undefined ? { witness } : {}),
-    ...adminPair,
+    ...accountBinding,
   }
   if (signatureSerialized) {
     const signature = SignatureEnvelope.deserialize(signatureSerialized)
@@ -963,9 +963,7 @@ export function toRpc(authorization: Signed): Rpc {
       limit: Hex.fromNumber(limit),
       ...(period ? { period: numberToHex(period) } : {}),
     })),
-    signature: SignatureEnvelope.toRpc(
-      signature,
-    ) as SignatureEnvelope.PrimitiveRpc,
+    signature: SignatureEnvelope.toRpc(signature) as SignatureRpc,
     ...(allowedCalls ? { allowedCalls } : {}),
     ...(witness !== undefined ? { witness } : {}),
     ...(isAdmin ? { isAdmin: true } : {}),
@@ -1162,8 +1160,8 @@ function assertWitness(witness: Hex.Hex): void {
 
 function assertSignature<bigintType, numberType>(
   signature: SignatureEnvelope.SignatureEnvelope<bigintType, numberType>,
-): asserts signature is SignatureEnvelope.Primitive<bigintType, numberType> {
-  if (signature.type === 'keychain' || signature.type === 'multisig')
+): asserts signature is Signature<bigintType, numberType> {
+  if (signature.type === 'keychain')
     throw new InvalidSignatureTypeError(signature.type)
 }
 
@@ -1191,12 +1189,12 @@ export class InvalidAdminMarkerError extends Error {
   }
 }
 
-/** Thrown when a key authorization contains a non-primitive signature. */
+/** Thrown when a key authorization contains a keychain signature. */
 export class InvalidSignatureTypeError extends Error {
   override readonly name = 'KeyAuthorization.InvalidSignatureTypeError'
   constructor(type: SignatureEnvelope.SignatureEnvelope['type']) {
     super(
-      `Signature type \`${type}\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.`,
+      `Signature type \`${type}\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.`,
     )
   }
 }

package/tempo/MultisigConfig.test.ts

@@ -86,24 +86,44 @@ describe('getSignPayload', () => {
   test('matches independent ground truth', () => {
     expect(
       MultisigConfig.getSignPayload({
-        payload: `0x${'de'.repeat(32)}`,
-        genesisConfig: singleOwnerConfig,
+        payload: `0x${'42'.repeat(32)}`,
+        initialConfig: singleOwnerConfig,
       }),
     ).toMatchInlineSnapshot(
-      `"0x7df8cb9fef4fc2aeb271b617d1a4c6178b720ae1d7564f48a363069b7d77a079"`,
+      `"0xbf944a7a752b2cfab0418d5fb4591c5a7ff62976488edce11794d7f35fb34f41"`,
     )
   })
 
-  test('behavior: `genesisConfig` and `{ account }` produce identical digests', () => {
+  test('behavior: `initialConfig` and `{ account }` produce identical digests', () => {
     const account = MultisigConfig.getAddress(singleOwnerConfig)
     const payload = `0x${'42'.repeat(32)}` as const
     expect(
       MultisigConfig.getSignPayload({
         payload,
-        genesisConfig: singleOwnerConfig,
+        initialConfig: singleOwnerConfig,
       }),
     ).toBe(MultisigConfig.getSignPayload({ payload, account }))
   })
+
+  test('differs for a different config version', () => {
+    const value = {
+      payload: `0x${'42'.repeat(32)}` as const,
+      initialConfig: singleOwnerConfig,
+    }
+    expect(MultisigConfig.getSignPayload(value)).not.toBe(
+      MultisigConfig.getSignPayload({ ...value, version: 1n }),
+    )
+  })
+
+  test('defaults the config version to zero', () => {
+    const value = {
+      payload: `0x${'42'.repeat(32)}` as const,
+      initialConfig: singleOwnerConfig,
+    }
+    expect(MultisigConfig.getSignPayload(value)).toBe(
+      MultisigConfig.getSignPayload({ ...value, version: 0n }),
+    )
+  })
 })
 
 describe('toTuple / fromTuple', () => {
@@ -149,8 +169,8 @@ describe('assert / validate', () => {
     expect(MultisigConfig.validate({ threshold: 1, owners: [] })).toBe(false)
   })
 
-  test('accepts 255 owners', () => {
-    const owners = Array.from({ length: 255 }, (_, i) => ({
+  test('accepts 50 owners', () => {
+    const owners = Array.from({ length: 50 }, (_, i) => ({
       owner: `0x${(i + 1).toString(16).padStart(40, '0')}` as `0x${string}`,
       weight: 1,
     }))
@@ -163,7 +183,7 @@ describe('assert / validate', () => {
   })
 
   test('too many owners', () => {
-    const owners = Array.from({ length: 256 }, (_, i) => ({
+    const owners = Array.from({ length: 51 }, (_, i) => ({
       owner: `0x${(i + 1).toString(16).padStart(40, '0')}` as `0x${string}`,
       weight: 1,
     }))