ox 0.14.37 → 0.14.39

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # ox
 
+## 0.14.39
+
+### Patch Changes
+
+- [#412](https://github.com/wevm/ox/pull/412) [`200d9a7`](https://github.com/wevm/ox/commit/200d9a7832b676880d296b5b03fe1dde548b9f37) Thanks [@jxom](https://github.com/jxom)! - Changed native multisig configuration and signature APIs to require complete TIP-1061 witnesses with a `version`.
+
+  ```ts
+  const config = MultisigConfig.from({
+    owners,
+    threshold: 2,
+    version: 1,
+  });
+  ```
+
+## 0.14.38
+
+### Patch Changes
+
+- [#409](https://github.com/wevm/ox/pull/409) [`8f25490`](https://github.com/wevm/ox/commit/8f254906699e008e3d70ca172f27afda1a8e269a) Thanks [@jxom](https://github.com/jxom)! - Added multisig operation hashing, approval selection, and transaction serialization helpers.
+
+  ```ts
+  import { MultisigOperation } from "ox/tempo";
+
+  const selection = await MultisigOperation.selectApprovals(options);
+  const transaction = MultisigOperation.serializeTransaction(operation, {
+    approvals: selection.selectedApprovals,
+  });
+  ```
+
 ## 0.14.37
 
 ### Patch Changes

package/_cjs/tempo/MultisigConfig.js

@@ -1,30 +1,36 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.InvalidConfigError = exports.zeroSalt = exports.signatureTypeByte = exports.maxOwnerSignatureBytes = exports.maxNestingDepth = exports.maxSignatures = exports.maxThreshold = exports.maxOwners = void 0;
+exports.InvalidConfigError = exports.zeroSalt = exports.signatureTypeByte = exports.maxVersion = exports.maxThreshold = exports.maxSignatures = exports.maxOwners = exports.maxOwnerSignatureBytes = exports.maxNestingDepth = void 0;
 exports.assert = assert;
 exports.from = from;
+exports.fromRpc = fromRpc;
 exports.fromTuple = fromTuple;
 exports.getAddress = getAddress;
+exports.getCommitment = getCommitment;
 exports.getSignPayload = getSignPayload;
+exports.toRpc = toRpc;
 exports.toTuple = toTuple;
 exports.validate = validate;
 const Address = require("../core/Address.js");
 const Errors = require("../core/Errors.js");
 const Hash = require("../core/Hash.js");
 const Hex = require("../core/Hex.js");
-exports.maxOwners = 48;
-exports.maxThreshold = 0xff;
-exports.maxSignatures = 8;
 exports.maxNestingDepth = 2;
 exports.maxOwnerSignatureBytes = 2049;
+exports.maxOwners = 48;
+exports.maxSignatures = 8;
+exports.maxThreshold = 0xff;
+exports.maxVersion = 2n ** 64n - 1n;
 exports.signatureTypeByte = '0x05';
 exports.zeroSalt = `0x${'00'.repeat(32)}`;
 const accountDomain = 'tempo:multisig:account';
+const configDomain = 'tempo:multisig:config';
 const signatureDomain = 'tempo:multisig:signature';
 function assert(config) {
-    const { salt, threshold, owners } = config;
+    const { owners, salt, threshold, version = 0n } = config;
     if (typeof salt !== 'undefined' && Hex.size(salt) !== 32)
         throw new InvalidConfigError({ reason: 'salt must be 32 bytes' });
+    assertVersion(version);
     if (owners.length === 0)
         throw new InvalidConfigError({ reason: 'owners cannot be empty' });
     if (owners.length > exports.maxOwners)
@@ -75,20 +81,27 @@ function assert(config) {
         });
 }
 function from(config) {
+    const version = config.version ?? 0n;
+    assertVersion(version);
     const owners = [...config.owners].sort((a, b) => Hex.toBigInt(a.owner) < Hex.toBigInt(b.owner) ? -1 : 1);
     const normalized = {
+        owners,
         salt: config.salt ? Hex.padLeft(config.salt, 32) : exports.zeroSalt,
         threshold: config.threshold,
-        owners,
+        version: BigInt(version),
     };
     assert(normalized);
     return normalized;
 }
+function fromRpc(config) {
+    return from({
+        ...config,
+        version: Hex.toBigInt(config.version),
+    });
+}
 function fromTuple(tuple) {
-    const [salt, threshold, owners] = tuple;
+    const [salt, version, threshold, owners] = tuple;
     return {
-        salt: salt && salt !== '0x' ? Hex.padLeft(salt, 32) : exports.zeroSalt,
-        threshold: threshold === '0x' ? 0 : Hex.toNumber(threshold),
         owners: owners.map((owner) => {
             const [ownerAddress, weight] = owner;
             return {
@@ -96,10 +109,17 @@ function fromTuple(tuple) {
                 weight: !weight || weight === '0x' ? 0 : Hex.toNumber(weight),
             };
         }),
+        salt: salt && salt !== '0x' ? Hex.padLeft(salt, 32) : exports.zeroSalt,
+        threshold: threshold === '0x' ? 0 : Hex.toNumber(threshold),
+        version: version === '0x' ? 0n : Hex.toBigInt(version),
     };
 }
 function getAddress(config) {
     assert(config);
+    if (BigInt(config.version ?? 0) !== 0n)
+        throw new InvalidConfigError({
+            reason: 'account address requires version zero',
+        });
     const hash = Hash.keccak256(Hex.concat(Hex.fromString(accountDomain), Hex.padLeft(config.salt ?? exports.zeroSalt, 32), Hex.fromNumber(config.threshold, { size: 1 }), Hex.fromNumber(config.owners.length, { size: 1 }), ...config.owners.flatMap((owner) => [
         owner.owner,
         Hex.fromNumber(owner.weight, { size: 1 }),
@@ -107,20 +127,47 @@ function getAddress(config) {
     const account = Address.from(Hex.slice(hash, 12, 32));
     if (Hex.toBigInt(account) === 0n)
         throw new InvalidConfigError({ reason: 'derived account cannot be zero' });
+    if (config.owners.some((owner) => Address.isEqual(owner.owner, account)))
+        throw new InvalidConfigError({
+            reason: 'derived account cannot be an owner',
+        });
     return account;
 }
+function getCommitment(config) {
+    assert(config);
+    return Hash.keccak256(Hex.concat(Hex.fromString(configDomain), Hex.padLeft(config.salt ?? exports.zeroSalt, 32), Hex.fromNumber(config.version ?? 0n, { size: 8 }), Hex.fromNumber(config.threshold, { size: 1 }), Hex.fromNumber(config.owners.length, { size: 1 }), ...config.owners.flatMap((owner) => [
+        owner.owner,
+        Hex.fromNumber(owner.weight, { size: 1 }),
+    ])));
+}
 function getSignPayload(value) {
-    const { payload, version = 0n } = value;
-    const account = 'account' in value && value.account
-        ? value.account
-        : getAddress(value.initialConfig);
-    return Hash.keccak256(Hex.concat(Hex.fromString(signatureDomain), Hex.from(payload), account, Hex.fromNumber(version, { size: 8 })));
+    const { account, config, payload } = value;
+    assertVersion(config.version);
+    return Hash.keccak256(Hex.concat(Hex.fromString(signatureDomain), Hex.from(payload), account, Hex.fromNumber(config.version ?? 0n, { size: 8 })));
+}
+function toRpc(config) {
+    const value = from(config);
+    return {
+        owners: value.owners.map((owner) => ({
+            owner: owner.owner,
+            weight: Number(owner.weight),
+        })),
+        salt: value.salt,
+        threshold: Number(value.threshold),
+        version: Hex.fromNumber(value.version),
+    };
 }
 function toTuple(config) {
     assert(config);
     const owners = config.owners.map((owner) => [owner.owner, Hex.fromNumber(owner.weight)]);
     const salt = config.salt ? Hex.padLeft(config.salt, 32) : exports.zeroSalt;
-    return [salt, Hex.fromNumber(config.threshold), owners];
+    const version = BigInt(config.version ?? 0);
+    return [
+        salt,
+        version === 0n ? '0x' : Hex.fromNumber(version),
+        Hex.fromNumber(config.threshold),
+        owners,
+    ];
 }
 function validate(config) {
     try {
@@ -143,4 +190,13 @@ class InvalidConfigError extends Errors.BaseError {
     }
 }
 exports.InvalidConfigError = InvalidConfigError;
+function assertVersion(version) {
+    if ((typeof version !== 'bigint' && typeof version !== 'number') ||
+        (typeof version === 'number' && !Number.isSafeInteger(version)) ||
+        BigInt(version) < 0n ||
+        BigInt(version) > exports.maxVersion)
+        throw new InvalidConfigError({
+            reason: 'version must be an unsigned 64-bit integer',
+        });
+}
 //# sourceMappingURL=MultisigConfig.js.map

package/_cjs/tempo/MultisigConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"MultisigConfig.js","sourceRoot":"","sources":["../../tempo/MultisigConfig.ts"],"names":[],"mappings":";;;AA2FA,wBA0DC;AA6BD,oBAaC;AAoBD,8BAaC;AA4BD,gCAkBC;AA+ED,wCAcC;AAwDD,0BASC;AAsBD,4BAOC;AAzcD,8CAA6C;AAE7C,4CAA2C;AAC3C,wCAAuC;AACvC,sCAAqC;AAIxB,QAAA,SAAS,GAAG,EAAE,CAAA;AAGd,QAAA,YAAY,GAAG,IAAI,CAAA;AAGnB,QAAA,aAAa,GAAG,CAAC,CAAA;AAMjB,QAAA,eAAe,GAAG,CAAC,CAAA;AAGnB,QAAA,sBAAsB,GAAG,IAAI,CAAA;AAG7B,QAAA,iBAAiB,GAAG,MAAe,CAAA;AAGnC,QAAA,QAAQ,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAW,CAAA;AAGvD,MAAM,aAAa,GAAG,wBAAwB,CAAA;AAG9C,MAAM,eAAe,GAAG,0BAA0B,CAAA;AAwDlD,SAAgB,MAAM,CAAsB,MAA0B;IACpE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAAA;IAE1C,IAAI,OAAO,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;QACtD,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAA;IACnE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACrB,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAS;QAC3B,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC7D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,CAAA;IAC1E,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAA;IACtE,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,oBAAY;QAClC,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAA;IAE7E,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,QAA4B,CAAA;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;YACpE,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAA;QAClE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,MAAM,EAAE,iCAAiC;aAC1C,CAAC,CAAA;QACJ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAA;QAEzE,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,IAAI,OAAO;YACxD,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,MAAM,EAAE,mCAAmC;aAC5C,CAAC,CAAA;QACJ,QAAQ,GAAG,OAAO,CAAA;QAElB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACnC,WAAW,IAAI,MAAM,CAAA;QACrB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAED,IAAI,WAAW,GAAG,IAAI;QACpB,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,mCAAmC;SAC5C,CAAC,CAAA;IACJ,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,WAAW;QACjC,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,sCAAsC;SAC/C,CAAC,CAAA;IAEJ,MAAM,eAAe,GAAG,OAAO;SAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;SACrB,KAAK,CAAC,CAAC,EAAE,qBAAa,CAAC;SACvB,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC,CAAA;IAC3C,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,eAAe;QACrC,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,yCAAyC,qBAAa,mBAAmB;SAClF,CAAC,CAAA;AACN,CAAC;AA6BD,SAAgB,IAAI,CAClB,MAA0B;IAE1B,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC9C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACvD,CAAA;IACD,MAAM,UAAU,GAAG;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAQ;QAC3D,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM;KACe,CAAA;IACvB,MAAM,CAAC,UAAU,CAAC,CAAA;IAClB,OAAO,UAAU,CAAA;AACnB,CAAC;AAoBD,SAAgB,SAAS,CAAC,KAAY;IACpC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;IACvC,OAAO;QACL,IAAI,EAAE,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAQ;QAC9D,SAAS,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3D,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,KAA2B,CAAA;YAC1D,OAAO;gBACL,KAAK,EAAE,YAA+B;gBACtC,MAAM,EAAE,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC9D,CAAA;QACH,CAAC,CAAC;KACH,CAAA;AACH,CAAC;AA4BD,SAAgB,UAAU,CAAC,MAAc;IACvC,MAAM,CAAC,MAAM,CAAC,CAAA;IACd,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CACzB,GAAG,CAAC,MAAM,CACR,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAC7B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAQ,EAAE,EAAE,CAAC,EACxC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAC7C,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EACjD,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,KAAK,CAAC,KAAK;QACX,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;KAC1C,CAAC,CACH,CACF,CAAA;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE;QAC9B,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC,CAAA;IAC5E,OAAO,OAAO,CAAA;AAChB,CAAC;AA+ED,SAAgB,cAAc,CAAC,KAA2B;IACxD,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,KAAK,CAAA;IACvC,MAAM,OAAO,GACX,SAAS,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO;QACjC,CAAC,CAAC,KAAK,CAAC,OAAO;QACf,CAAC,CAAC,UAAU,CAAE,KAAmC,CAAC,aAAa,CAAC,CAAA;IACpE,OAAO,IAAI,CAAC,SAAS,CACnB,GAAG,CAAC,MAAM,CACR,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,EAC/B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EACjB,OAAO,EACP,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CACrC,CACF,CAAA;AACH,CAAC;AAwDD,SAAgB,OAAO,CAAC,MAAc;IACpC,MAAM,CAAC,MAAM,CAAC,CAAA;IACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAC9B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAc,CACpE,CAAA;IAGD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAQ,CAAA;IAClE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAU,CAAA;AAClE,CAAC;AAsBD,SAAgB,QAAQ,CAAC,MAAc;IACrC,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAA;QACd,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAGD,MAAa,kBAAmB,SAAQ,MAAM,CAAC,SAAS;IAEtD,YAAY,EAAE,MAAM,EAAsB;QACxC,KAAK,CAAC,mCAAmC,MAAM,GAAG,CAAC,CAAA;QAFnC;;;;mBAAO,mCAAmC;WAAA;IAG5D,CAAC;CACF;AALD,gDAKC"}
+{"version":3,"file":"MultisigConfig.js","sourceRoot":"","sources":["../../tempo/MultisigConfig.ts"],"names":[],"mappings":";;;AAqHA,wBA8DC;AA0CD,oBAgBC;AAsBD,0BAKC;AA4BD,8BAcC;AA4BD,gCA0BC;AAoCD,sCAeC;AAoDD,wCAWC;AAuCD,sBAWC;AA+BD,0BAeC;AAsBD,4BAOC;AAvlBD,8CAA6C;AAE7C,4CAA2C;AAC3C,wCAAuC;AACvC,sCAAqC;AAOxB,QAAA,eAAe,GAAG,CAAC,CAAA;AAGnB,QAAA,sBAAsB,GAAG,IAAI,CAAA;AAG7B,QAAA,SAAS,GAAG,EAAE,CAAA;AAGd,QAAA,aAAa,GAAG,CAAC,CAAA;AAGjB,QAAA,YAAY,GAAG,IAAI,CAAA;AAGnB,QAAA,UAAU,GAAG,EAAE,IAAI,GAAG,GAAG,EAAE,CAAA;AAG3B,QAAA,iBAAiB,GAAG,MAAe,CAAA;AAGnC,QAAA,QAAQ,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAW,CAAA;AAGvD,MAAM,aAAa,GAAG,wBAAwB,CAAA;AAG9C,MAAM,YAAY,GAAG,uBAAuB,CAAA;AAG5C,MAAM,eAAe,GAAG,0BAA0B,CAAA;AA4ElD,SAAgB,MAAM,CAGpB,MAAsC;IACtC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,MAAM,CAAA;IAExD,IAAI,OAAO,IAAI,KAAK,WAAW,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE;QACtD,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAA;IACnE,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACrB,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAA;IACpE,IAAI,MAAM,CAAC,MAAM,GAAG,iBAAS;QAC3B,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAA;IAC7D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACtC,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC,CAAA;IAC1E,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAA;IACtE,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,oBAAY;QAClC,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC,CAAA;IAE7E,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,QAA4B,CAAA;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;YACpE,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAA;QAClE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzC,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,MAAM,EAAE,iCAAiC;aAC1C,CAAC,CAAA;QACJ,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC;YAC1B,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC,CAAA;QAEzE,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,IAAI,OAAO;YACxD,MAAM,IAAI,kBAAkB,CAAC;gBAC3B,MAAM,EAAE,mCAAmC;aAC5C,CAAC,CAAA;QACJ,QAAQ,GAAG,OAAO,CAAA;QAElB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QACnC,WAAW,IAAI,MAAM,CAAA;QACrB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC;IAED,IAAI,WAAW,GAAG,IAAI;QACpB,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,mCAAmC;SAC5C,CAAC,CAAA;IACJ,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,WAAW;QACjC,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,sCAAsC;SAC/C,CAAC,CAAA;IAEJ,MAAM,eAAe,GAAG,OAAO;SAC5B,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;SACrB,KAAK,CAAC,CAAC,EAAE,qBAAa,CAAC;SACvB,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,EAAE,CAAC,CAAC,CAAA;IAC3C,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,eAAe;QACrC,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,yCAAyC,qBAAa,mBAAmB;SAClF,CAAC,CAAA;AACN,CAAC;AA0CD,SAAgB,IAAI,CAClB,MAA0C;IAE1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,CAAA;IACpC,aAAa,CAAC,OAAO,CAAC,CAAA;IACtB,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC9C,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CACvD,CAAA;IACD,MAAM,UAAU,GAAG;QACjB,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAQ;QAC3D,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;KACK,CAAA;IAC/B,MAAM,CAAC,UAAU,CAAC,CAAA;IAClB,OAAO,UAAU,CAAA;AACnB,CAAC;AAsBD,SAAgB,OAAO,CAAC,MAAW;IACjC,OAAO,IAAI,CAAC;QACV,GAAG,MAAM;QACT,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;KACtC,CAAC,CAAA;AACJ,CAAC;AA4BD,SAAgB,SAAS,CAAC,KAAY;IACpC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,KAAK,CAAA;IAChD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC3B,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,GAAG,KAA2B,CAAA;YAC1D,OAAO;gBACL,KAAK,EAAE,YAA+B;gBACtC,MAAM,EAAE,CAAC,MAAM,IAAI,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;aAC9D,CAAA;QACH,CAAC,CAAC;QACF,IAAI,EAAE,IAAI,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAQ;QAC9D,SAAS,EAAE,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3D,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;KACvD,CAAA;AACH,CAAC;AA4BD,SAAgB,UAAU,CAAC,MAAa;IACtC,MAAM,CAAC,MAAM,CAAC,CAAA;IACd,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,EAAE;QACpC,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,uCAAuC;SAChD,CAAC,CAAA;IACJ,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CACzB,GAAG,CAAC,MAAM,CACR,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,EAC7B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAQ,EAAE,EAAE,CAAC,EACxC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAC7C,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EACjD,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,KAAK,CAAC,KAAK;QACX,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;KAC1C,CAAC,CACH,CACF,CAAA;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;IACrD,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE;QAC9B,MAAM,IAAI,kBAAkB,CAAC,EAAE,MAAM,EAAE,gCAAgC,EAAE,CAAC,CAAA;IAC5E,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACtE,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,oCAAoC;SAC7C,CAAC,CAAA;IACJ,OAAO,OAAO,CAAA;AAChB,CAAC;AAoCD,SAAgB,aAAa,CAAC,MAAa;IACzC,MAAM,CAAC,MAAM,CAAC,CAAA;IACd,OAAO,IAAI,CAAC,SAAS,CACnB,GAAG,CAAC,MAAM,CACR,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,EAC5B,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,IAAI,gBAAQ,EAAE,EAAE,CAAC,EACxC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EACjD,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EAC7C,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,EACjD,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAClC,KAAK,CAAC,KAAK;QACX,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;KAC1C,CAAC,CACH,CACF,CAAA;AACH,CAAC;AAoDD,SAAgB,cAAc,CAAC,KAA2B;IACxD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,KAAK,CAAA;IAC1C,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IAC7B,OAAO,IAAI,CAAC,SAAS,CACnB,GAAG,CAAC,MAAM,CACR,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC,EAC/B,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,EACjB,OAAO,EACP,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAClD,CACF,CAAA;AACH,CAAC;AAuCD,SAAgB,KAAK,CAAC,MAAa;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC1B,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;SAC7B,CAAC,CAAC;QACH,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QAClC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;KACvC,CAAA;AACH,CAAC;AA+BD,SAAgB,OAAO,CAAC,MAAa;IACnC,MAAM,CAAC,MAAM,CAAC,CAAA;IACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAC9B,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAc,CACpE,CAAA;IAGD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAQ,CAAA;IAClE,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC,CAAA;IAC3C,OAAO;QACL,IAAI;QACJ,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;QAC/C,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;QAChC,MAAM;KACE,CAAA;AACZ,CAAC;AAsBD,SAAgB,QAAQ,CAAC,MAAa;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,CAAA;QACd,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAGD,MAAa,kBAAmB,SAAQ,MAAM,CAAC,SAAS;IAEtD,YAAY,EAAE,MAAM,EAAsB;QACxC,KAAK,CAAC,mCAAmC,MAAM,GAAG,CAAC,CAAA;QAFnC;;;;mBAAO,mCAAmC;WAAA;IAG5D,CAAC;CACF;AALD,gDAKC;AAGD,SAAS,aAAa,CAAC,OAAgB;IACrC,IACE,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC;QAC5D,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;QACpB,MAAM,CAAC,OAAO,CAAC,GAAG,kBAAU;QAE5B,MAAM,IAAI,kBAAkB,CAAC;YAC3B,MAAM,EAAE,4CAA4C;SACrD,CAAC,CAAA;AACN,CAAC"}

package/_cjs/tempo/MultisigOperation.js

@@ -1,6 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.InvalidOperationError = void 0;
+exports.InvalidOperationError = exports.InvalidApprovalError = void 0;
+exports.getHash = getHash;
+exports.selectApprovals = selectApprovals;
+exports.serializeTransaction = serializeTransaction;
 exports.from = from;
 exports.fromRpc = fromRpc;
 exports.toRpc = toRpc;
@@ -13,22 +16,75 @@ const MultisigConfig = require("./MultisigConfig.js");
 const SignatureEnvelope = require("./SignatureEnvelope.js");
 const TxEnvelopeTempo = require("./TxEnvelopeTempo.js");
 const maxConfigVersion = 2n ** 64n - 1n;
+function getHash(options) {
+    const { account, configVersion } = options;
+    const payload = options.type === 'transaction'
+        ? TxEnvelopeTempo.getSignPayload(TxEnvelopeTempo.deserialize(options.transaction))
+        : KeyAuthorization_.getSignPayload(KeyAuthorization_.deserialize(options.keyAuthorization));
+    return MultisigConfig.getSignPayload({
+        account,
+        config: { version: configVersion },
+        payload,
+    });
+}
+async function selectApprovals(options) {
+    const { account, approvals, hash, resolveConfig } = options;
+    if (!Address.validate(account) || Hex.toBigInt(account) === 0n)
+        throw new InvalidApprovalError({ reason: 'account is invalid' });
+    if (!Hash.validate(hash))
+        throw new InvalidApprovalError({ reason: 'hash is invalid' });
+    return selectApprovals_internal({
+        account,
+        approvals,
+        config: MultisigConfig.from(options.config),
+        hash,
+        resolveConfig,
+    }, [account.toLowerCase()]);
+}
+function serializeTransaction(operation, options) {
+    const value = from(operation);
+    const envelope = TxEnvelopeTempo.deserialize(value.transaction);
+    const approvals = options.approvals.map((approval) => SignatureEnvelope.from(approval));
+    assertRetainedApprovals(value, approvals);
+    const signatures = SignatureEnvelope.sortMultisigApprovals({
+        account: value.account,
+        config: value.config,
+        payload: TxEnvelopeTempo.getSignPayload(envelope),
+        signatures: approvals,
+    });
+    const signature = SignatureEnvelope.from({
+        account: value.account,
+        config: value.config,
+        signatures,
+    });
+    return TxEnvelopeTempo.serialize(envelope, value.transaction.startsWith(TxEnvelopeTempo.feePayerMagic)
+        ? {
+            format: 'feePayer',
+            sender: envelope.from,
+            signature,
+        }
+        : { signature });
+}
 function from(operation) {
     try {
-        const config = MultisigConfig.from(operation.config);
+        const config = MultisigConfig.from({
+            ...operation.config,
+            version: operation.configVersion,
+        });
         if (typeof config.threshold !== 'number' ||
             config.owners.some((owner) => typeof owner.weight !== 'number'))
             throw new InvalidOperationError({
                 reason: 'config threshold and owner weights must be numbers',
             });
-        assertBase(operation, config);
-        if (operation.type === 'transaction')
-            assertTransaction(operation);
-        else if (operation.type === 'keyAuthorization')
-            assertKeyAuthorization(operation, config);
+        const value = { ...operation, config };
+        assertBase(value, config);
+        if (value.type === 'transaction')
+            assertTransaction(value);
+        else if (value.type === 'keyAuthorization')
+            assertKeyAuthorization(value, config);
         else
             throw new InvalidOperationError({ reason: 'unknown operation type' });
-        return { ...operation, config };
+        return value;
     }
     catch (cause) {
         if (cause instanceof InvalidOperationError)
@@ -48,7 +104,11 @@ function fromRpc(operation) {
             throw new InvalidOperationError({
                 reason: 'configVersion must use canonical quantity encoding',
             });
-        return from({ ...operation, configVersion });
+        return from({
+            ...operation,
+            config: MultisigConfig.fromRpc(operation.config),
+            configVersion,
+        });
     }
     catch (cause) {
         if (cause instanceof InvalidOperationError)
@@ -60,9 +120,146 @@ function toRpc(operation) {
     const value = from(operation);
     return {
         ...value,
+        config: MultisigConfig.toRpc(value.config),
         configVersion: Hex.fromNumber(value.configVersion),
     };
 }
+async function selectApprovals_internal(options, path) {
+    const owners = new Map(options.config.owners.map((owner) => [
+        owner.owner.toLowerCase(),
+        { address: owner.owner, weight: Number(owner.weight) },
+    ]));
+    const groups = new Map();
+    for (const serialized of options.approvals) {
+        const signature = SignatureEnvelope.from(serialized);
+        if (signature.type === 'keychain')
+            throw new InvalidApprovalError({
+                reason: 'keychain signatures cannot approve a multisig operation',
+            });
+        const address = signature.type === 'multisig'
+            ? signature.account
+            : SignatureEnvelope.extractAddress({
+                payload: options.hash,
+                signature,
+            });
+        const owner = owners.get(address.toLowerCase());
+        if (!owner)
+            throw new InvalidApprovalError({
+                reason: `signature is from non-owner ${address}`,
+            });
+        const key = address.toLowerCase();
+        const group = groups.get(key);
+        if (group)
+            group.signatures.push(signature);
+        else
+            groups.set(key, {
+                address: owner.address,
+                signatures: [signature],
+                weight: owner.weight,
+            });
+    }
+    const valid = [];
+    const retained = [];
+    for (const group of groups.values()) {
+        const nested = group.signatures.filter((signature) => signature.type === 'multisig');
+        if (nested.length > 0) {
+            if (nested.length !== group.signatures.length)
+                throw new InvalidApprovalError({
+                    reason: `owner ${group.address} has conflicting signature types`,
+                });
+            if (path.length >= MultisigConfig.maxNestingDepth ||
+                path.includes(group.address.toLowerCase()))
+                throw new InvalidApprovalError({
+                    reason: `nested multisig owner ${group.address} is invalid`,
+                });
+            if (!options.resolveConfig)
+                throw new InvalidApprovalError({
+                    reason: `nested multisig owner ${group.address} requires a config resolver`,
+                });
+            const resolved = await options.resolveConfig({ account: group.address });
+            const config = MultisigConfig.from({
+                ...resolved.config,
+                version: resolved.version,
+            });
+            const selected = await selectApprovals_internal({
+                account: group.address,
+                approvals: nested.flatMap((signature) => signature.signatures.map((approval) => SignatureEnvelope.serialize(approval))),
+                config,
+                hash: MultisigConfig.getSignPayload({
+                    account: group.address,
+                    config,
+                    payload: options.hash,
+                }),
+                resolveConfig: options.resolveConfig,
+            }, [...path, group.address.toLowerCase()]);
+            retained.push({
+                address: group.address,
+                signature: SignatureEnvelope.serialize(SignatureEnvelope.from({
+                    account: group.address,
+                    config,
+                    signatures: selected.approvals.map((approval) => SignatureEnvelope.from(approval)),
+                })),
+            });
+            if (selected.weight >= selected.threshold)
+                valid.push({
+                    address: group.address,
+                    signature: SignatureEnvelope.serialize(SignatureEnvelope.from({
+                        account: group.address,
+                        config,
+                        signatures: selected.selectedApprovals.map((approval) => SignatureEnvelope.from(approval)),
+                    })),
+                    weight: group.weight,
+                });
+            continue;
+        }
+        const signatures = group.signatures.map((signature) => {
+            if (!SignatureEnvelope.verify(signature, {
+                address: group.address,
+                payload: options.hash,
+            }))
+                throw new InvalidApprovalError({
+                    reason: `signature from owner ${group.address} is invalid`,
+                });
+            return SignatureEnvelope.serialize(signature);
+        });
+        const signature = signatures.sort(compareHex)[0];
+        valid.push({
+            address: group.address,
+            signature,
+            weight: group.weight,
+        });
+        retained.push({ address: group.address, signature });
+    }
+    const ranked = valid.sort((a, b) => b.weight - a.weight || compareApprovalAddress(a, b));
+    const selected = [];
+    let weight = 0;
+    for (const approval of ranked.slice(0, MultisigConfig.maxSignatures)) {
+        if (weight >= Number(options.config.threshold))
+            break;
+        selected.push(approval);
+        weight += approval.weight;
+    }
+    selected.sort(compareApprovalAddress);
+    return {
+        approvals: retained
+            .sort(compareApprovalAddress)
+            .map((approval) => approval.signature),
+        selectedApprovals: selected.map((approval) => approval.signature),
+        signatureCount: selected.length,
+        threshold: Number(options.config.threshold),
+        weight,
+    };
+}
+function compareApprovalAddress(a, b) {
+    const addressA = Hex.toBigInt(a.address);
+    const addressB = Hex.toBigInt(b.address);
+    return addressA < addressB ? -1 : addressA > addressB ? 1 : 0;
+}
+function compareHex(a, b) {
+    const hexA = a.toLowerCase();
+    const hexB = b.toLowerCase();
+    return hexA < hexB ? -1 : hexA > hexB ? 1 : 0;
+}
 function assertBase(operation, config) {
     if (!Address.validate(operation.account))
         throw new InvalidOperationError({ reason: 'account is invalid' });
@@ -117,7 +314,7 @@ function assertBase(operation, config) {
         if (typeof approval !== 'string' ||
             !Hex.validate(approval, { strict: true }))
             throw new InvalidOperationError({ reason: 'approval is invalid' });
-        const signature = assertApproval(operation.account, approval);
+        const signature = assertApproval(operation.account, approval, config);
         const address = SignatureEnvelope.extractAddress({
             payload: operation.hash,
             signature,
@@ -271,13 +468,9 @@ function assertKeyAuthorization(operation, config) {
                 reason: 'key authorization signatureCount does not match its signature',
             });
         assertSelectedApprovals(operation, signature.signatures, authorization);
-        if (!!signature.init !== operation.init)
-            throw new InvalidOperationError({
-                reason: 'key authorization bootstrap state does not match',
-            });
-        if (signature.init && !sameConfig(signature.init, config))
+        if (!sameConfig(signature.config, config))
             throw new InvalidOperationError({
-                reason: 'key authorization bootstrap config does not match',
+                reason: 'key authorization config does not match',
             });
     }
     assertOperationHash(operation, KeyAuthorization_.getSignPayload(authorization));
@@ -287,10 +480,11 @@ function assertKeyAuthorization(operation, config) {
             reason: 'keyAuthorization is not canonically serialized',
         });
 }
-function assertApproval(account, serialized) {
+function assertApproval(account, serialized, config) {
     const approval = SignatureEnvelope.deserialize(serialized);
     SignatureEnvelope.assert({
         account,
+        config,
         signatures: [approval],
         type: 'multisig',
     });
@@ -299,6 +493,17 @@ function assertApproval(account, serialized) {
         throw new InvalidOperationError({ reason: 'approval is not canonical' });
     return approval;
 }
+function assertRetainedApprovals(operation, selected) {
+    const retained = operation.approvals.map((approval) => SignatureEnvelope.deserialize(approval));
+    for (const approval of selected) {
+        const index = retained.findIndex((candidate) => includesApproval(candidate, approval));
+        if (index === -1)
+            throw new InvalidOperationError({
+                reason: 'transaction signature is not a retained approval',
+            });
+        retained.splice(index, 1);
+    }
+}
 function assertSelectedApprovals(operation, selected, authorization) {
     const retained = operation.approvals.map((approval) => SignatureEnvelope.deserialize(approval));
     for (const approval of selected) {
@@ -311,8 +516,8 @@ function assertSelectedApprovals(operation, selected, authorization) {
     }
     const digest = MultisigConfig.getSignPayload({
         account: operation.account,
+        config: operation.config,
         payload: KeyAuthorization_.getSignPayload(authorization),
-        version: operation.configVersion,
     });
     const addresses = selected.map((signature) => SignatureEnvelope.extractAddress({ payload: digest, signature }));
     for (let index = 1; index < addresses.length; index++) {
@@ -334,6 +539,8 @@ function includesApproval(retained, selected) {
             SignatureEnvelope.serialize(selected).toLowerCase());
     if (retained.account.toLowerCase() !== selected.account.toLowerCase())
         return false;
+    if (!sameConfig(retained.config, selected.config))
+        return false;
     let index = 0;
     for (const approval of selected.signatures) {
         while (index < retained.signatures.length &&
@@ -357,8 +564,8 @@ function isWeightReachable(weights, signatureCount, weight) {
 function assertOperationHash(operation, payload) {
     const hash = MultisigConfig.getSignPayload({
         account: operation.account,
+        config: operation.config,
         payload,
-        version: operation.configVersion,
     });
     if (hash.toLowerCase() !== operation.hash.toLowerCase())
         throw new InvalidOperationError({
@@ -376,6 +583,7 @@ function sameConfig(a, b) {
     const configB = MultisigConfig.from(b);
     return (Hex.isEqual(configA.salt ?? MultisigConfig.zeroSalt, configB.salt ?? MultisigConfig.zeroSalt) &&
         configA.threshold === configB.threshold &&
+        configA.version === configB.version &&
         configA.owners.length === configB.owners.length &&
         configA.owners.every((owner, index) => {
             const other = configB.owners[index];
@@ -383,6 +591,20 @@ function sameConfig(a, b) {
                 owner.weight === other.weight);
         }));
 }
+class InvalidApprovalError extends Errors.BaseError {
+    constructor(options = {}) {
+        super(options.reason
+            ? `Invalid multisig approval: ${options.reason}.`
+            : 'Invalid multisig approval.', { cause: options.cause });
+        Object.defineProperty(this, "name", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 'MultisigOperation.InvalidApprovalError'
+        });
+    }
+}
+exports.InvalidApprovalError = InvalidApprovalError;
 class InvalidOperationError extends Errors.BaseError {
     constructor(options = {}) {
         super(options.reason