ox 1.0.2 → 1.0.3

package/src/zod/tempo/SignatureEnvelope.ts

@@ -1,6 +1,7 @@
 /* eslint-disable jsdoc-js/require-jsdoc, jsdoc-js/require-description, jsdoc-js/require-example */
 import * as core_SignatureEnvelope from '../../tempo/SignatureEnvelope.js'
 import * as core_Hex from '../../core/Hex.js'
+import * as core_MultisigConfig from '../../tempo/MultisigConfig.js'
 import * as z_Address from '../Address.js'
 import * as z_Hex from '../Hex.js'
 import * as z_MultisigConfig from './MultisigConfig.js'
@@ -67,6 +68,9 @@ export const WebAuthnRpc = z.object({
   webauthnData: z_Hex.Hex,
 })
 
+/** RPC primitive signature envelope schema. */
+export const PrimitiveRpc = z.union([Secp256k1Rpc, P256Rpc, WebAuthnRpc])
+
 /** RPC keychain signature envelope schema. */
 export const KeychainRpc = z.object({
   keyId: z.optional(z_Address.Address),
@@ -81,13 +85,54 @@ export const KeychainRpc = z.object({
 })
 
 /** RPC native multisig signature envelope schema. */
-export const MultisigRpc = z.object({
-  account: z_Address.Address,
-  init: z.optional(z_MultisigConfig.Config),
-  // Owner approvals are raw serialized signatures (node `Vec<Bytes>`).
-  signatures: z.readonly(z.array(z_Hex.Hex)),
-  type: z.literal('multisig'),
-})
+export const MultisigRpc = z
+  .union([
+    z.strictObject({
+      account: z_Address.Address,
+      signatures: z.lazy(
+        (): z.ZodMiniType<
+          readonly core_SignatureEnvelope.SignatureEnvelopeRpc[],
+          readonly core_SignatureEnvelope.SignatureEnvelopeRpc[]
+        > =>
+          z.readonly(
+            z
+              .array(Rpc)
+              .check(
+                z.minLength(1),
+                z.maxLength(core_MultisigConfig.maxSignatures),
+              ),
+          ) as never,
+      ),
+    }),
+    z.strictObject({
+      init: z_MultisigConfig.Config,
+      signatures: z.lazy(
+        (): z.ZodMiniType<
+          readonly core_SignatureEnvelope.SignatureEnvelopeRpc[],
+          readonly core_SignatureEnvelope.SignatureEnvelopeRpc[]
+        > =>
+          z.readonly(
+            z
+              .array(Rpc)
+              .check(
+                z.minLength(1),
+                z.maxLength(core_MultisigConfig.maxSignatures),
+              ),
+          ) as never,
+      ),
+    }),
+  ])
+  // Keep invalid recursive approvals inside Zod's issue path.
+  .check(
+    z.refine((value) => {
+      try {
+        core_SignatureEnvelope.fromRpc(value)
+        return true
+      } catch {
+        return false
+      }
+    }, 'expected valid native multisig signature'),
+  )
 
 /** RPC signature envelope schema. */
 export const Rpc = z.union([
@@ -123,6 +168,9 @@ export const WebAuthn = z.object({
   type: z.literal('webAuthn'),
 })
 
+/** Primitive signature envelope schema. */
+export const Primitive = z.union([Secp256k1, P256, WebAuthn])
+
 /** Keychain signature envelope schema. */
 export const Keychain = z.object({
   // `inner` is recursive; type the getter concretely to break the cycle.
@@ -137,16 +185,31 @@ export const Keychain = z.object({
 })
 
 /** Native multisig signature envelope schema. */
-export const Multisig = z.object({
-  account: z_Address.Address,
-  init: z.optional(z_MultisigConfig.Config),
-  // `signatures` is recursive; type the getter concretely to break the cycle.
-  signatures: z.lazy(
-    (): z.ZodMiniType<readonly core_SignatureEnvelope.SignatureEnvelope[]> =>
-      z.readonly(z.array(Domain)) as never,
-  ),
-  type: z.literal('multisig'),
-})
+export const Multisig = z
+  .object({
+    account: z_Address.Address,
+    init: z.optional(z_MultisigConfig.Config),
+    // `signatures` is recursive; type the getter concretely to break the cycle.
+    signatures: z.lazy(
+      (): z.ZodMiniType<readonly core_SignatureEnvelope.SignatureEnvelope[]> =>
+        z.readonly(
+          z
+            .array(Domain)
+            .check(
+              z.minLength(1),
+              z.maxLength(core_MultisigConfig.maxSignatures),
+            ),
+        ) as never,
+    ),
+    type: z.literal('multisig'),
+  })
+  // Keep invalid recursive approvals inside Zod's issue path.
+  .check(
+    z.refine(
+      (value) => core_SignatureEnvelope.validate(value),
+      'expected valid native multisig signature',
+    ),
+  )
 
 /** Decoded signature envelope schema. */
 export const Domain = z.union([Secp256k1, P256, WebAuthn, Keychain, Multisig])
@@ -210,7 +273,7 @@ function fromRpc(
     }
   }
 
-  if (value.type === 'multisig')
+  if ('signatures' in value && ('account' in value || 'init' in value))
     return core_SignatureEnvelope.fromRpc(
       value as core_SignatureEnvelope.MultisigRpc,
     )

package/src/zod/tempo/_test/KeyAuthorization.test.ts

@@ -140,4 +140,29 @@ describe('KeyAuthorization', () => {
       } as never).success,
     ).toBe(false)
   })
+
+  test('rejects multisig signatures', () => {
+    const multisigRpc = {
+      account: '0x1111111111111111111111111111111111111111',
+      signatures: [rpc.signature],
+    } as const
+    expect(
+      z.safeDecode(z_KeyAuthorization.KeyAuthorization, {
+        ...rpc,
+        signature: multisigRpc,
+      } as never).success,
+    ).toBe(false)
+
+    const authorization = core_KeyAuthorization.fromRpc(rpc)
+    expect(
+      z.safeEncode(z_KeyAuthorization.KeyAuthorization, {
+        ...authorization,
+        signature: {
+          account: multisigRpc.account,
+          signatures: [authorization.signature],
+          type: 'multisig',
+        },
+      } as never).success,
+    ).toBe(false)
+  })
 })

package/src/zod/tempo/_test/MultisigConfig.test.ts

@@ -0,0 +1,44 @@
+import { describe, expect, test } from 'vp/test'
+import * as z_MultisigConfig from '../MultisigConfig.js'
+import * as z from 'zod/mini'
+
+const config = {
+  owners: [
+    {
+      owner: '0x1111111111111111111111111111111111111111',
+      weight: 1,
+    },
+  ],
+  threshold: 1,
+} as const
+
+describe('Config', () => {
+  test('accepts valid native multisig configurations', () => {
+    expect(z.safeDecode(z_MultisigConfig.Config, config).success).toBe(true)
+  })
+
+  test('rejects configurations outside protocol limits', () => {
+    expect(
+      z.safeDecode(z_MultisigConfig.Config, {
+        ...config,
+        owners: [{ ...config.owners[0], weight: 9 }],
+        threshold: 9,
+      }).success,
+    ).toMatchInlineSnapshot(`false`)
+  })
+
+  test('rejects non-canonical owner order', () => {
+    expect(
+      z.safeDecode(z_MultisigConfig.Config, {
+        ...config,
+        owners: [
+          {
+            owner: '0x2222222222222222222222222222222222222222',
+            weight: 1,
+          },
+          config.owners[0],
+        ],
+      }).success,
+    ).toMatchInlineSnapshot(`false`)
+  })
+})

package/src/zod/tempo/_test/SignatureEnvelope.test-d.ts

@@ -12,6 +12,15 @@ test('SignatureEnvelope decodes RPC into a signature envelope', () => {
   >()
 })
 
+test('MultisigRpc preserves the native multisig RPC union', () => {
+  expectTypeOf<core_SignatureEnvelope.MultisigRpc>().toExtend<
+    z.input<typeof z_SignatureEnvelope.MultisigRpc>
+  >()
+  expectTypeOf<
+    z.output<typeof z_SignatureEnvelope.MultisigRpc>
+  >().toExtend<core_SignatureEnvelope.MultisigRpc>()
+})
+
 test('Type preserves the key type union', () => {
   expectTypeOf<
     z.output<typeof z_SignatureEnvelope.Type>

package/src/zod/tempo/_test/SignatureEnvelope.test.ts

@@ -21,10 +21,21 @@ const p256 = {
 
 const multisig = {
   account: '0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c',
-  signatures: [
-    core_SignatureEnvelope.serialize(core_SignatureEnvelope.fromRpc(secp256k1)),
-  ],
-  type: 'multisig',
+  signatures: [secp256k1],
+} as const
+
+const multisigBootstrap = {
+  init: {
+    owners: [
+      {
+        owner: '0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c',
+        weight: 1,
+      },
+    ],
+    salt: '0x0000000000000000000000000000000000000000000000000000000000000000',
+    threshold: 1,
+  },
+  signatures: [secp256k1],
 } as const
 
 describe('SignatureEnvelope', () => {
@@ -51,12 +62,33 @@ describe('SignatureEnvelope', () => {
     )
   })
 
-  test('decodes a multisig envelope', () => {
+  test('decodes an initialized multisig envelope', () => {
     expect(z.decode(z_SignatureEnvelope.SignatureEnvelope, multisig)).toEqual(
       core_SignatureEnvelope.fromRpc(multisig),
     )
   })
 
+  test('decodes a bootstrap multisig envelope', () => {
+    expect(
+      z.decode(z_SignatureEnvelope.SignatureEnvelope, multisigBootstrap),
+    ).toEqual(core_SignatureEnvelope.fromRpc(multisigBootstrap))
+  })
+
+  test('decodes recursive multisig approvals', () => {
+    const nested = {
+      ...multisig,
+      signatures: [
+        {
+          account: '0x1111111111111111111111111111111111111111',
+          signatures: [secp256k1],
+        },
+      ],
+    } as const
+    expect(z.decode(z_SignatureEnvelope.SignatureEnvelope, nested)).toEqual(
+      core_SignatureEnvelope.fromRpc(nested),
+    )
+  })
+
   test('round-trips secp256k1 via encode', () => {
     const decoded = z.decode(z_SignatureEnvelope.SignatureEnvelope, secp256k1)
     expect(z.encode(z_SignatureEnvelope.SignatureEnvelope, decoded)).toEqual(
@@ -64,13 +96,117 @@ describe('SignatureEnvelope', () => {
     )
   })
 
-  test('round-trips multisig via encode', () => {
+  test('round-trips initialized multisig via encode', () => {
     const decoded = z.decode(z_SignatureEnvelope.SignatureEnvelope, multisig)
     expect(z.encode(z_SignatureEnvelope.SignatureEnvelope, decoded)).toEqual(
       core_SignatureEnvelope.toRpc(decoded),
     )
   })
 
+  test('round-trips bootstrap multisig via encode', () => {
+    const decoded = z.decode(
+      z_SignatureEnvelope.SignatureEnvelope,
+      multisigBootstrap,
+    )
+    expect(z.encode(z_SignatureEnvelope.SignatureEnvelope, decoded)).toEqual(
+      multisigBootstrap,
+    )
+  })
+
+  test('rejects invalid recursive multisig domains before encode', () => {
+    const invalid = {
+      account: multisig.account,
+      signatures: [
+        {
+          inner: core_SignatureEnvelope.fromRpc(secp256k1),
+          type: 'keychain',
+          userAddress: multisig.account,
+        },
+      ],
+      type: 'multisig',
+    } as const
+
+    expect(
+      z.safeEncode(z_SignatureEnvelope.SignatureEnvelope, invalid as never)
+        .success,
+    ).toMatchInlineSnapshot(`false`)
+  })
+
+  test('rejects legacy multisig approval encoding', () => {
+    expect(
+      z.safeDecode(z_SignatureEnvelope.SignatureEnvelope, {
+        ...multisig,
+        signatures: [
+          core_SignatureEnvelope.serialize(
+            core_SignatureEnvelope.fromRpc(secp256k1),
+          ),
+        ],
+      } as never).success,
+    ).toMatchInlineSnapshot(`false`)
+  })
+
+  test('rejects multisig approval counts outside protocol limits', () => {
+    expect(
+      z.safeDecode(z_SignatureEnvelope.SignatureEnvelope, {
+        ...multisig,
+        signatures: [],
+      }).success,
+    ).toMatchInlineSnapshot(`false`)
+    expect(
+      z.safeDecode(z_SignatureEnvelope.SignatureEnvelope, {
+        ...multisig,
+        signatures: Array.from({ length: 9 }, () => secp256k1),
+      }).success,
+    ).toMatchInlineSnapshot(`false`)
+  })
+
+  test('rejects invalid recursive multisig approvals', () => {
+    const keychain = {
+      signature: secp256k1,
+      type: 'keychain',
+      userAddress: multisig.account,
+    } as const
+    const depth2 = {
+      account: '0x1111111111111111111111111111111111111111',
+      signatures: [secp256k1],
+    } as const
+    const depth3 = {
+      account: '0x2222222222222222222222222222222222222222',
+      signatures: [depth2],
+    } as const
+
+    expect(
+      z.safeDecode(z_SignatureEnvelope.SignatureEnvelope, {
+        ...multisig,
+        signatures: [keychain],
+      }).success,
+    ).toMatchInlineSnapshot(`false`)
+    expect(
+      z.safeDecode(z_SignatureEnvelope.SignatureEnvelope, {
+        ...multisig,
+        signatures: [depth3],
+      }).success,
+    ).toMatchInlineSnapshot(`false`)
+  })
+
+  test('rejects mixed multisig initialization fields', () => {
+    expect(
+      z.safeDecode(z_SignatureEnvelope.SignatureEnvelope, {
+        ...multisigBootstrap,
+        account: multisig.account,
+      } as never).success,
+    ).toMatchInlineSnapshot(`false`)
+  })
+
+  test('rejects tagged multisig RPC envelopes', () => {
+    expect(
+      z.safeDecode(z_SignatureEnvelope.SignatureEnvelope, {
+        ...multisig,
+        type: 'multisig',
+      } as never).success,
+    ).toMatchInlineSnapshot(`false`)
+  })
+
   test('rejects an invalid envelope', () => {
     expect(
       z.safeDecode(z_SignatureEnvelope.SignatureEnvelope, {