ox 0.14.41 → 0.14.43

package/tempo/AuthorizationTempo.test.ts

@@ -326,6 +326,7 @@ describe('fromRpc', () => {
         type: 'p256',
       },
     })
+    if (typeof result.signature === 'string') throw new Error('unreachable')
     expect(result.signature.type).toBe('p256')
     expect(result.signature).toHaveProperty('prehash', true)
     expect(result.signature).toHaveProperty('publicKey')
@@ -348,6 +349,7 @@ describe('fromRpc', () => {
           '0x49960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d976305000000007b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a22222c226f726967696e223a2268747470733a2f2f6578616d706c652e636f6d222c2263726f73734f726967696e223a66616c73657d',
       },
     })
+    if (typeof result.signature === 'string') throw new Error('unreachable')
     expect(result.signature.type).toBe('webAuthn')
     expect(result.signature).toHaveProperty('metadata')
     expect(result.signature).toHaveProperty('publicKey')
@@ -949,6 +951,7 @@ describe('toRpc', () => {
         type: 'p256',
       },
     })
+    if (typeof result.signature === 'string') throw new Error('unreachable')
     expect(result.signature.type).toBe('p256')
   })
 
@@ -970,6 +973,7 @@ describe('toRpc', () => {
         type: 'webAuthn',
       },
     })
+    if (typeof result.signature === 'string') throw new Error('unreachable')
     expect(result.signature.type).toBe('webAuthn')
   })
 })

package/tempo/KeyAuthorization.test-d.ts

@@ -55,18 +55,7 @@ test('accepts multisig signatures', () => {
     KeyAuthorization.Signed['signature']
   >()
 
-  const multisigRpc = {
-    account: multisig.account,
-    config: { ...multisig.config, version: 0 },
-    signatures: [
-      {
-        r: '0x01',
-        s: '0x02',
-        type: 'secp256k1',
-        yParity: '0x0',
-      },
-    ],
-  } as const satisfies SignatureEnvelope.MultisigRpc
+  const multisigRpc = '0xf8' as const satisfies SignatureEnvelope.MultisigRpc
 
   const rpc: KeyAuthorization.Rpc = {
     chainId: '0x1',

package/tempo/KeyAuthorization.test.ts

@@ -69,6 +69,8 @@ const signature_multisig = {
   signatures: [SignatureEnvelope.from(signature_secp256k1)],
   type: 'multisig',
 } as const satisfies SignatureEnvelope.Multisig
+const signature_multisig_rpc =
+  '0xf89794be95c3f554e9fc85ec51be69a3d807a0d55bcf2cf83ba000000000000000000000000000000000000000000000000000000000000000000101d7d694f39fd6e51aad88f6f4ce6ab8827279cfffb9226601f843b841fa78c5905fb0b9d6066ef531f962a62bc6ef0d5eb59ecb134056d206f75aaed7780926ff2601a935c2c79707d9e1799948c9f19dcdde1e090e903b19a07923d01c' as const
 
 const signature_keychain = {
   inner: SignatureEnvelope.from(signature_secp256k1),
@@ -527,16 +529,42 @@ describe('from', () => {
 })
 
 describe('fromRpc', () => {
-  test('multisig', () => {
+  test('behavior: multisig', () => {
     const authorization = KeyAuthorization.fromRpc({
       chainId: '0x1',
       expiry: null,
       keyId: address,
       keyType: 'secp256k1',
-      signature: SignatureEnvelope.toRpc(signature_multisig),
+      signature: signature_multisig_rpc,
     })
 
-    expect(authorization.signature).toEqual(signature_multisig)
+    expect(authorization.signature).toMatchInlineSnapshot(`
+      {
+        "account": "0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c",
+        "config": {
+          "owners": [
+            {
+              "owner": "0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266",
+              "weight": 1,
+            },
+          ],
+          "salt": "0x0000000000000000000000000000000000000000000000000000000000000000",
+          "threshold": 1,
+          "version": 1n,
+        },
+        "signatures": [
+          {
+            "signature": {
+              "r": 113291597329930009559670063131885256927775966057121513567941051428123344285399n,
+              "s": 54293712598725100598138577281441749550405991478212695085505730636505228583888n,
+              "yParity": 1,
+            },
+            "type": "secp256k1",
+          },
+        ],
+        "type": "multisig",
+      }
+    `)
   })
 
   test('rejects a keychain signature', () => {
@@ -1340,7 +1368,7 @@ describe('serialize', () => {
 })
 
 describe('toRpc', () => {
-  test('multisig', () => {
+  test('behavior: multisig', () => {
     const authorization = KeyAuthorization.toRpc({
       address,
       chainId: 1n,
@@ -1348,8 +1376,8 @@ describe('toRpc', () => {
       type: 'secp256k1',
     })
 
-    expect(authorization.signature).toEqual(
-      SignatureEnvelope.toRpc(signature_multisig),
+    expect(authorization.signature).toMatchInlineSnapshot(
+      `"${signature_multisig_rpc}"`,
     )
   })
 

package/tempo/KeyAuthorization.ts

@@ -93,9 +93,9 @@ export type Signature<bigintType = bigint, numberType = number> = OneOf<
 >
 
 /** RPC-formatted signature that can authorize an access key. */
-export type SignatureRpc = OneOf<
-  SignatureEnvelope.PrimitiveRpc | SignatureEnvelope.MultisigRpc
->
+export type SignatureRpc =
+  | SignatureEnvelope.MultisigRpc
+  | SignatureEnvelope.PrimitiveRpc
 
 /** Input type for a Key Authorization. */
 export type Input = KeyAuthorization<

package/tempo/MultisigOperation.test.ts

@@ -677,6 +677,100 @@ describe('selectApprovals', () => {
   })
 })
 
+describe('serializeKeyAuthorization', () => {
+  test('behavior: current and initial authorizations', async () => {
+    const results = []
+    for (const applicableConfig of [currentConfig, config]) {
+      const hash = MultisigOperation.getHash({
+        account,
+        config: applicableConfig,
+        keyAuthorization,
+        type: 'keyAuthorization',
+      })
+      const selection = await MultisigOperation.selectApprovals({
+        account,
+        approvals: [
+          signApproval(owners[1]!, hash),
+          signApproval(owners[0]!, hash),
+        ],
+        config: applicableConfig,
+        hash,
+      })
+      const serialized = MultisigOperation.serializeKeyAuthorization(
+        keyAuthorization,
+        {
+          account,
+          approvals: selection.selectedApprovals,
+          config: applicableConfig,
+        },
+      )
+      const value = KeyAuthorization.deserialize(serialized)
+      results.push({
+        account:
+          value.signature?.type === 'multisig'
+            ? value.signature.account
+            : undefined,
+        hash: Hash.keccak256(serialized),
+        signatureCount:
+          value.signature?.type === 'multisig'
+            ? value.signature.signatures.length
+            : 0,
+        version:
+          value.signature?.type === 'multisig'
+            ? value.signature.config.version
+            : undefined,
+      })
+    }
+
+    expect(results).toMatchInlineSnapshot(`
+      [
+        {
+          "account": "0xf81b7763d3a6876195d780865bd783dbd97dd36e",
+          "hash": "0x14b3a60f7c3120e3983b1f6e085ab5b234e71f58f0a4f39d19a5ff64b89a2afe",
+          "signatureCount": 2,
+          "version": 1n,
+        },
+        {
+          "account": "0xf81b7763d3a6876195d780865bd783dbd97dd36e",
+          "hash": "0xbfdc90810a0634f413e627bdefea88ae8c42ed41d6670a70fd1d7574aedda2a4",
+          "signatureCount": 2,
+          "version": 0n,
+        },
+      ]
+    `)
+  })
+
+  test('error: signed authorization', async () => {
+    const selection = await MultisigOperation.selectApprovals({
+      account,
+      approvals: [
+        signApproval(owners[0]!, keyAuthorizationHash),
+        signApproval(owners[1]!, keyAuthorizationHash),
+      ],
+      config: currentConfig,
+      hash: keyAuthorizationHash,
+    })
+    const signed = MultisigOperation.serializeKeyAuthorization(
+      keyAuthorization,
+      {
+        account,
+        approvals: selection.selectedApprovals,
+        config: currentConfig,
+      },
+    )
+
+    expect(() =>
+      MultisigOperation.serializeKeyAuthorization(signed, {
+        account,
+        approvals: selection.selectedApprovals,
+        config: currentConfig,
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[MultisigOperation.InvalidOperationError: Invalid multisig operation: keyAuthorization must not contain a signature.]`,
+    )
+  })
+})
+
 describe('serializeTransaction', () => {
   test('current and initial transactions', async () => {
     const results = []

package/tempo/MultisigOperation.ts

@@ -228,6 +228,89 @@ export declare namespace selectApprovals {
     | Errors.GlobalErrorType
 }
 
+/**
+ * Serializes a key authorization with selected multisig owner approvals.
+ *
+ * @example
+ * ```ts twoslash
+ * // @noErrors
+ * import { MultisigOperation } from 'ox/tempo'
+ *
+ * const authorization = MultisigOperation.serializeKeyAuthorization(
+ *   keyAuthorization,
+ *   {
+ *     account,
+ *     approvals: selection.selectedApprovals,
+ *     config,
+ *   },
+ * )
+ * ```
+ *
+ * @param keyAuthorization - Canonical serialized unsigned key authorization.
+ * @param options - Multisig account, config, and selected approvals.
+ * @returns The signed serialized key authorization.
+ */
+export function serializeKeyAuthorization(
+  keyAuthorization: Hex.Hex,
+  options: serializeKeyAuthorization.Options,
+): Hex.Hex {
+  const authorization = KeyAuthorization_.deserialize(keyAuthorization)
+  if (authorization.signature)
+    throw new InvalidOperationError({
+      reason: 'keyAuthorization must not contain a signature',
+    })
+  if (
+    KeyAuthorization_.serialize(authorization).toLowerCase() !==
+    keyAuthorization.toLowerCase()
+  )
+    throw new InvalidOperationError({
+      reason: 'keyAuthorization is not canonically serialized',
+    })
+  const config = MultisigConfig.from(options.config)
+  const signatures = SignatureEnvelope.sortMultisigApprovals({
+    account: options.account,
+    config,
+    payload: KeyAuthorization_.getSignPayload(authorization),
+    signatures: options.approvals.map((approval) =>
+      SignatureEnvelope.deserialize(approval),
+    ),
+  })
+  return KeyAuthorization_.serialize(
+    KeyAuthorization_.from(authorization, {
+      signature: SignatureEnvelope.from({
+        account: options.account,
+        config,
+        signatures,
+      }),
+    }),
+  )
+}
+
+export declare namespace serializeKeyAuthorization {
+  /** Options for `serializeKeyAuthorization`. */
+  export type Options = {
+    /** Root multisig account. */
+    account: Address.Address
+    /** Selected serialized owner approvals. */
+    approvals: readonly SignatureEnvelope.Serialized[]
+    /** Complete applicable root multisig config. */
+    config: MultisigConfig.Config
+  }
+
+  /** Error type for `serializeKeyAuthorization`. */
+  export type ErrorType =
+    | InvalidOperationError
+    | KeyAuthorization_.deserialize.ErrorType
+    | KeyAuthorization_.from.ErrorType
+    | KeyAuthorization_.getSignPayload.ErrorType
+    | KeyAuthorization_.serialize.ErrorType
+    | MultisigConfig.assert.ErrorType
+    | SignatureEnvelope.assert.ErrorType
+    | SignatureEnvelope.InvalidSerializedError
+    | SignatureEnvelope.sortMultisigApprovals.ErrorType
+    | Errors.GlobalErrorType
+}
+
 /**
  * Serializes a multisig transaction operation with selected owner approvals.
  *

package/tempo/MultisigSimulation/package.json

@@ -0,0 +1,6 @@
+{
+  "type": "module",
+  "types": "../../_types/tempo/MultisigSimulation.d.ts",
+  "main": "../../_cjs/tempo/MultisigSimulation.js",
+  "module": "../../_esm/tempo/MultisigSimulation.js"
+}

package/tempo/MultisigSimulation.test-d/package.json

@@ -0,0 +1,6 @@
+{
+  "type": "module",
+  "types": "../../_types/tempo/MultisigSimulation.test-d.d.ts",
+  "main": "../../_cjs/tempo/MultisigSimulation.test-d.js",
+  "module": "../../_esm/tempo/MultisigSimulation.test-d.js"
+}

package/tempo/MultisigSimulation.test-d.ts

@@ -0,0 +1,33 @@
+import { expectTypeOf, test } from 'vitest'
+import * as MultisigSimulation from './MultisigSimulation.js'
+
+const rpc = {
+  account: '0x2222222222222222222222222222222222222222',
+  approvals: [
+    {
+      owner: '0x1111111111111111111111111111111111111111',
+      type: 'primitive',
+    },
+  ],
+  config:
+    '0xf83ba000000000000000000000000000000000000000000000000000000000000000008001d7d694111111111111111111111111111111111111111101',
+} as const satisfies MultisigSimulation.Rpc
+
+test('fromRpc returns a domain spec', () => {
+  const spec = MultisigSimulation.fromRpc(rpc)
+
+  expectTypeOf(spec).toEqualTypeOf<MultisigSimulation.Spec>()
+  expectTypeOf(spec.config.version).toEqualTypeOf<bigint>()
+})
+
+test('RPC specs use encoded configurations', () => {
+  expectTypeOf<
+    MultisigSimulation.Rpc['config']
+  >().toEqualTypeOf<`0x${string}`>()
+})
+
+test('toRpc returns an RPC spec', () => {
+  expectTypeOf(
+    MultisigSimulation.toRpc(MultisigSimulation.fromRpc(rpc)),
+  ).toEqualTypeOf<MultisigSimulation.Rpc>()
+})

package/tempo/MultisigSimulation.test.ts

@@ -0,0 +1,284 @@
+import { MultisigConfig, MultisigSimulation } from 'ox/tempo'
+import { describe, expect, test } from 'vitest'
+
+const config =
+  '0xf852a011111111111111111111111111111111111111111111111111111111111111118002eed694111111111111111111111111111111111111111101d694bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb01' as const
+const nestedConfig =
+  '0xf83ba022222222222222222222222222222222222222222222222222222222222222220101d7d694222222222222222222222222222222222222222201' as const
+const rpc = {
+  account: '0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+  approvals: [
+    {
+      keyData: '0x0102030405',
+      keyType: 'webAuthn',
+      owner: '0x1111111111111111111111111111111111111111',
+      type: 'primitive',
+    },
+    {
+      spec: {
+        account: '0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
+        approvals: [
+          {
+            keyData: '0x010203040506',
+            keyType: 'secp256k1',
+            owner: '0x2222222222222222222222222222222222222222',
+          },
+        ],
+        config: nestedConfig,
+      },
+      type: 'multisig',
+    },
+  ],
+  config,
+} as const satisfies MultisigSimulation.Rpc
+
+describe('fromRpc', () => {
+  test('behavior: decodes root and nested configurations', () => {
+    expect(MultisigSimulation.fromRpc(rpc)).toMatchInlineSnapshot(`
+      {
+        "account": "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "approvals": [
+          {
+            "keyData": "0x0102030405",
+            "keyType": "webAuthn",
+            "owner": "0x1111111111111111111111111111111111111111",
+            "type": "primitive",
+          },
+          {
+            "spec": {
+              "account": "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+              "approvals": [
+                {
+                  "keyData": "0x010203040506",
+                  "keyType": "secp256k1",
+                  "owner": "0x2222222222222222222222222222222222222222",
+                },
+              ],
+              "config": {
+                "owners": [
+                  {
+                    "owner": "0x2222222222222222222222222222222222222222",
+                    "weight": 1,
+                  },
+                ],
+                "salt": "0x2222222222222222222222222222222222222222222222222222222222222222",
+                "threshold": 1,
+                "version": 1n,
+              },
+            },
+            "type": "multisig",
+          },
+        ],
+        "config": {
+          "owners": [
+            {
+              "owner": "0x1111111111111111111111111111111111111111",
+              "weight": 1,
+            },
+            {
+              "owner": "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+              "weight": 1,
+            },
+          ],
+          "salt": "0x1111111111111111111111111111111111111111111111111111111111111111",
+          "threshold": 2,
+          "version": 0n,
+        },
+      }
+    `)
+  })
+
+  test('behavior: preserves the maximum uint64 configuration version', () => {
+    const config =
+      '0xf843a0000000000000000000000000000000000000000000000000000000000000000088ffffffffffffffff01d7d694111111111111111111111111111111111111111101' as const
+
+    expect(
+      MultisigSimulation.fromRpc({ ...rpc, approvals: [], config }).config
+        .version,
+    ).toMatchInlineSnapshot(`18446744073709551615n`)
+  })
+
+  test('error: rejects excess root approvals', () => {
+    expect(() =>
+      MultisigSimulation.fromRpc({
+        ...rpc,
+        approvals: Array.from({ length: 9 }, () => rpc.approvals[0]),
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[MultisigSimulation.InvalidSimulationError: Invalid multisig simulation: approval count exceeds 8.]`,
+    )
+  })
+
+  test('error: rejects excess nested approvals', () => {
+    expect(() =>
+      MultisigSimulation.fromRpc({
+        ...rpc,
+        approvals: [
+          {
+            ...rpc.approvals[1],
+            spec: {
+              ...rpc.approvals[1].spec,
+              approvals: Array.from(
+                { length: 9 },
+                () => rpc.approvals[1].spec.approvals[0],
+              ),
+            },
+          },
+        ],
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[MultisigSimulation.InvalidSimulationError: Invalid multisig simulation: approval count exceeds 8.]`,
+    )
+  })
+
+  test('error: rejects trailing configuration bytes', () => {
+    expect(() =>
+      MultisigSimulation.fromRpc({ ...rpc, config: `${config}00` }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[MultisigSimulation.InvalidSimulationError: Invalid multisig simulation: noncanonical config encoding.]`,
+    )
+  })
+
+  test('error: rejects malformed configuration RLP', () => {
+    expect(() =>
+      MultisigSimulation.fromRpc({ ...rpc, config: '0xf8' }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[Cursor.PositionOutOfBoundsError: Position \`1\` is out of bounds (\`0 < position < 1\`).]`,
+    )
+  })
+
+  test('error: rejects a non-list configuration', () => {
+    expect(() =>
+      MultisigSimulation.fromRpc({ ...rpc, config: '0x01' }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[MultisigSimulation.InvalidSimulationError: Invalid multisig simulation: invalid config encoding.]`,
+    )
+  })
+
+  test('error: rejects noncanonical configuration integers', () => {
+    const noncanonical = config
+      .replace('0xf852', '0xf853')
+      .replace('118002', '11810002') as `0x${string}`
+
+    expect(() =>
+      MultisigSimulation.fromRpc({ ...rpc, config: noncanonical }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[MultisigSimulation.InvalidSimulationError: Invalid multisig simulation: invalid config encoding.]`,
+    )
+  })
+})
+
+describe('toRpc', () => {
+  test('behavior: encodes configurations and shims long key data', () => {
+    expect(
+      MultisigSimulation.toRpc(MultisigSimulation.fromRpc(rpc)),
+    ).toMatchInlineSnapshot(`
+      {
+        "account": "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
+        "approvals": [
+          {
+            "keyData": "0x0005",
+            "keyType": "webAuthn",
+            "owner": "0x1111111111111111111111111111111111111111",
+            "type": "primitive",
+          },
+          {
+            "spec": {
+              "account": "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
+              "approvals": [
+                {
+                  "keyData": "0x0006",
+                  "keyType": "secp256k1",
+                  "owner": "0x2222222222222222222222222222222222222222",
+                },
+              ],
+              "config": "${nestedConfig}",
+            },
+            "type": "multisig",
+          },
+        ],
+        "config": "${config}",
+      }
+    `)
+  })
+
+  test('behavior: preserves short key data', () => {
+    const spec = MultisigSimulation.fromRpc({
+      ...rpc,
+      approvals: [{ ...rpc.approvals[0], keyData: '0x0102' }],
+    })
+
+    expect(MultisigSimulation.toRpc(spec).approvals).toMatchInlineSnapshot(`
+      [
+        {
+          "keyData": "0x0102",
+          "keyType": "webAuthn",
+          "owner": "0x1111111111111111111111111111111111111111",
+          "type": "primitive",
+        },
+      ]
+    `)
+  })
+
+  test('behavior: encodes the maximum uint64 configuration version', () => {
+    const spec = MultisigSimulation.fromRpc(rpc)
+
+    expect(
+      MultisigSimulation.toRpc({
+        ...spec,
+        approvals: [],
+        config: MultisigConfig.from({
+          owners: [
+            {
+              owner: '0x1111111111111111111111111111111111111111',
+              weight: 1,
+            },
+          ],
+          threshold: 1,
+          version: MultisigConfig.maxVersion,
+        }),
+      }).config,
+    ).toMatchInlineSnapshot(
+      `"0xf843a0000000000000000000000000000000000000000000000000000000000000000088ffffffffffffffff01d7d694111111111111111111111111111111111111111101"`,
+    )
+  })
+
+  test('error: rejects excess root approvals', () => {
+    const spec = MultisigSimulation.fromRpc(rpc)
+
+    expect(() =>
+      MultisigSimulation.toRpc({
+        ...spec,
+        approvals: Array.from({ length: 9 }, () => spec.approvals[0]!),
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[MultisigSimulation.InvalidSimulationError: Invalid multisig simulation: approval count exceeds 8.]`,
+    )
+  })
+
+  test('error: rejects excess nested approvals', () => {
+    const spec = MultisigSimulation.fromRpc(rpc)
+    const nested = spec.approvals[1]!
+    if (nested.type !== 'multisig') throw new Error('unreachable')
+
+    expect(() =>
+      MultisigSimulation.toRpc({
+        ...spec,
+        approvals: [
+          {
+            ...nested,
+            spec: {
+              ...nested.spec,
+              approvals: Array.from(
+                { length: 9 },
+                () => nested.spec.approvals[0]!,
+              ),
+            },
+          },
+        ],
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[MultisigSimulation.InvalidSimulationError: Invalid multisig simulation: approval count exceeds 8.]`,
+    )
+  })
+})