ox 1.0.2 → 1.0.3

package/dist/zod/tempo/TxEnvelopeTempo.d.ts

@@ -189,24 +189,6 @@ export declare const TxEnvelopeTempo: z.ZodMiniObject<{
                 s: z.ZodMiniTemplateLiteral<`0x${string}`>;
             }, z.core.$strip>;
             type: z.ZodMiniLiteral<"webAuthn">;
-        }, z.core.$strip>, z.ZodMiniObject<{
-            inner: z.ZodMiniLazy<z.ZodMiniType<import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>, unknown, z.core.$ZodTypeInternals<import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>, unknown>>>;
-            keyId: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
-            type: z.ZodMiniLiteral<"keychain">;
-            userAddress: z.ZodMiniTemplateLiteral<`0x${string}`>;
-            version: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"v1">, z.ZodMiniLiteral<"v2">]>>;
-        }, z.core.$strip>, z.ZodMiniObject<{
-            account: z.ZodMiniTemplateLiteral<`0x${string}`>;
-            init: z.ZodMiniOptional<z.ZodMiniObject<{
-                salt: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
-                threshold: z.ZodMiniNumber<number>;
-                owners: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniObject<{
-                    owner: z.ZodMiniTemplateLiteral<`0x${string}`>;
-                    weight: z.ZodMiniNumber<number>;
-                }, z.core.$strip>>>;
-            }, z.core.$strip>>;
-            signatures: z.ZodMiniLazy<z.ZodMiniType<readonly import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>[], unknown, z.core.$ZodTypeInternals<readonly import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>[], unknown>>>;
-            type: z.ZodMiniLiteral<"multisig">;
         }, z.core.$strip>]>;
         type: z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"secp256k1">, z.ZodMiniLiteral<"p256">, z.ZodMiniLiteral<"webAuthn">]>;
         witness: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
@@ -258,24 +240,6 @@ export declare const TxEnvelopeTempo: z.ZodMiniObject<{
                 s: z.ZodMiniTemplateLiteral<`0x${string}`>;
             }, z.core.$strip>;
             type: z.ZodMiniLiteral<"webAuthn">;
-        }, z.core.$strip>, z.ZodMiniObject<{
-            inner: z.ZodMiniLazy<z.ZodMiniType<import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>, unknown, z.core.$ZodTypeInternals<import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>, unknown>>>;
-            keyId: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
-            type: z.ZodMiniLiteral<"keychain">;
-            userAddress: z.ZodMiniTemplateLiteral<`0x${string}`>;
-            version: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"v1">, z.ZodMiniLiteral<"v2">]>>;
-        }, z.core.$strip>, z.ZodMiniObject<{
-            account: z.ZodMiniTemplateLiteral<`0x${string}`>;
-            init: z.ZodMiniOptional<z.ZodMiniObject<{
-                salt: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
-                threshold: z.ZodMiniNumber<number>;
-                owners: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniObject<{
-                    owner: z.ZodMiniTemplateLiteral<`0x${string}`>;
-                    weight: z.ZodMiniNumber<number>;
-                }, z.core.$strip>>>;
-            }, z.core.$strip>>;
-            signatures: z.ZodMiniLazy<z.ZodMiniType<readonly import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>[], unknown, z.core.$ZodTypeInternals<readonly import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>[], unknown>>>;
-            type: z.ZodMiniLiteral<"multisig">;
         }, z.core.$strip>]>;
         type: z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"secp256k1">, z.ZodMiniLiteral<"p256">, z.ZodMiniLiteral<"webAuthn">]>;
         witness: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
@@ -470,24 +434,6 @@ export declare const Signed: z.ZodMiniObject<{
                 s: z.ZodMiniTemplateLiteral<`0x${string}`>;
             }, z.core.$strip>;
             type: z.ZodMiniLiteral<"webAuthn">;
-        }, z.core.$strip>, z.ZodMiniObject<{
-            inner: z.ZodMiniLazy<z.ZodMiniType<import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>, unknown, z.core.$ZodTypeInternals<import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>, unknown>>>;
-            keyId: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
-            type: z.ZodMiniLiteral<"keychain">;
-            userAddress: z.ZodMiniTemplateLiteral<`0x${string}`>;
-            version: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"v1">, z.ZodMiniLiteral<"v2">]>>;
-        }, z.core.$strip>, z.ZodMiniObject<{
-            account: z.ZodMiniTemplateLiteral<`0x${string}`>;
-            init: z.ZodMiniOptional<z.ZodMiniObject<{
-                salt: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
-                threshold: z.ZodMiniNumber<number>;
-                owners: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniObject<{
-                    owner: z.ZodMiniTemplateLiteral<`0x${string}`>;
-                    weight: z.ZodMiniNumber<number>;
-                }, z.core.$strip>>>;
-            }, z.core.$strip>>;
-            signatures: z.ZodMiniLazy<z.ZodMiniType<readonly import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>[], unknown, z.core.$ZodTypeInternals<readonly import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>[], unknown>>>;
-            type: z.ZodMiniLiteral<"multisig">;
         }, z.core.$strip>]>;
         type: z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"secp256k1">, z.ZodMiniLiteral<"p256">, z.ZodMiniLiteral<"webAuthn">]>;
         witness: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
@@ -539,24 +485,6 @@ export declare const Signed: z.ZodMiniObject<{
                 s: z.ZodMiniTemplateLiteral<`0x${string}`>;
             }, z.core.$strip>;
             type: z.ZodMiniLiteral<"webAuthn">;
-        }, z.core.$strip>, z.ZodMiniObject<{
-            inner: z.ZodMiniLazy<z.ZodMiniType<import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>, unknown, z.core.$ZodTypeInternals<import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>, unknown>>>;
-            keyId: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
-            type: z.ZodMiniLiteral<"keychain">;
-            userAddress: z.ZodMiniTemplateLiteral<`0x${string}`>;
-            version: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"v1">, z.ZodMiniLiteral<"v2">]>>;
-        }, z.core.$strip>, z.ZodMiniObject<{
-            account: z.ZodMiniTemplateLiteral<`0x${string}`>;
-            init: z.ZodMiniOptional<z.ZodMiniObject<{
-                salt: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
-                threshold: z.ZodMiniNumber<number>;
-                owners: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniObject<{
-                    owner: z.ZodMiniTemplateLiteral<`0x${string}`>;
-                    weight: z.ZodMiniNumber<number>;
-                }, z.core.$strip>>>;
-            }, z.core.$strip>>;
-            signatures: z.ZodMiniLazy<z.ZodMiniType<readonly import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>[], unknown, z.core.$ZodTypeInternals<readonly import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>[], unknown>>>;
-            type: z.ZodMiniLiteral<"multisig">;
         }, z.core.$strip>]>;
         type: z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"secp256k1">, z.ZodMiniLiteral<"p256">, z.ZodMiniLiteral<"webAuthn">]>;
         witness: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
@@ -751,24 +679,6 @@ export declare const serialized: z.ZodMiniCodec<z.ZodMiniTemplateLiteral<`0x${st
                 s: z.ZodMiniTemplateLiteral<`0x${string}`>;
             }, z.core.$strip>;
             type: z.ZodMiniLiteral<"webAuthn">;
-        }, z.core.$strip>, z.ZodMiniObject<{
-            inner: z.ZodMiniLazy<z.ZodMiniType<import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>, unknown, z.core.$ZodTypeInternals<import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>, unknown>>>;
-            keyId: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
-            type: z.ZodMiniLiteral<"keychain">;
-            userAddress: z.ZodMiniTemplateLiteral<`0x${string}`>;
-            version: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"v1">, z.ZodMiniLiteral<"v2">]>>;
-        }, z.core.$strip>, z.ZodMiniObject<{
-            account: z.ZodMiniTemplateLiteral<`0x${string}`>;
-            init: z.ZodMiniOptional<z.ZodMiniObject<{
-                salt: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
-                threshold: z.ZodMiniNumber<number>;
-                owners: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniObject<{
-                    owner: z.ZodMiniTemplateLiteral<`0x${string}`>;
-                    weight: z.ZodMiniNumber<number>;
-                }, z.core.$strip>>>;
-            }, z.core.$strip>>;
-            signatures: z.ZodMiniLazy<z.ZodMiniType<readonly import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>[], unknown, z.core.$ZodTypeInternals<readonly import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>[], unknown>>>;
-            type: z.ZodMiniLiteral<"multisig">;
         }, z.core.$strip>]>;
         type: z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"secp256k1">, z.ZodMiniLiteral<"p256">, z.ZodMiniLiteral<"webAuthn">]>;
         witness: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
@@ -820,24 +730,6 @@ export declare const serialized: z.ZodMiniCodec<z.ZodMiniTemplateLiteral<`0x${st
                 s: z.ZodMiniTemplateLiteral<`0x${string}`>;
             }, z.core.$strip>;
             type: z.ZodMiniLiteral<"webAuthn">;
-        }, z.core.$strip>, z.ZodMiniObject<{
-            inner: z.ZodMiniLazy<z.ZodMiniType<import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>, unknown, z.core.$ZodTypeInternals<import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>, unknown>>>;
-            keyId: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
-            type: z.ZodMiniLiteral<"keychain">;
-            userAddress: z.ZodMiniTemplateLiteral<`0x${string}`>;
-            version: z.ZodMiniOptional<z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"v1">, z.ZodMiniLiteral<"v2">]>>;
-        }, z.core.$strip>, z.ZodMiniObject<{
-            account: z.ZodMiniTemplateLiteral<`0x${string}`>;
-            init: z.ZodMiniOptional<z.ZodMiniObject<{
-                salt: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;
-                threshold: z.ZodMiniNumber<number>;
-                owners: z.ZodMiniReadonly<z.ZodMiniArray<z.ZodMiniObject<{
-                    owner: z.ZodMiniTemplateLiteral<`0x${string}`>;
-                    weight: z.ZodMiniNumber<number>;
-                }, z.core.$strip>>>;
-            }, z.core.$strip>>;
-            signatures: z.ZodMiniLazy<z.ZodMiniType<readonly import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>[], unknown, z.core.$ZodTypeInternals<readonly import("../../tempo/SignatureEnvelope.js").SignatureEnvelope<number>[], unknown>>>;
-            type: z.ZodMiniLiteral<"multisig">;
         }, z.core.$strip>]>;
         type: z.ZodMiniUnion<readonly [z.ZodMiniLiteral<"secp256k1">, z.ZodMiniLiteral<"p256">, z.ZodMiniLiteral<"webAuthn">]>;
         witness: z.ZodMiniOptional<z.ZodMiniTemplateLiteral<`0x${string}`>>;

package/dist/zod/tempo/TxEnvelopeTempo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TxEnvelopeTempo.d.ts","sourceRoot":"","sources":["../../../src/zod/tempo/TxEnvelopeTempo.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAY7B,8CAA8C;AAC9C,eAAO,MAAM,IAAI,2BAAqB,CAAA;AAEtC,qCAAqC;AACrC,eAAO,MAAM,IAAI;;;;iBAIf,CAAA;AAqBF,yCAAyC;AACzC,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1B,CAAA;AAEF,gDAAgD;AAChD,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGjB,CAAA;AAEF,yFAAyF;AACzF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBASrB,CAAA"}
+{"version":3,"file":"TxEnvelopeTempo.d.ts","sourceRoot":"","sources":["../../../src/zod/tempo/TxEnvelopeTempo.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,CAAC,MAAM,UAAU,CAAA;AAY7B,8CAA8C;AAC9C,eAAO,MAAM,IAAI,2BAAqB,CAAA;AAEtC,qCAAqC;AACrC,eAAO,MAAM,IAAI;;;;iBAIf,CAAA;AAqBF,yCAAyC;AACzC,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAG1B,CAAA;AAEF,gDAAgD;AAChD,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAGjB,CAAA;AAEF,yFAAyF;AACzF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBASrB,CAAA"}

package/package.json

@@ -2,7 +2,7 @@
   "name": "ox",
   "description": "Ethereum Standard Library",
   "type": "module",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "main": "./dist/index.js",
   "sideEffects": false,
   "license": "MIT",

package/src/tempo/KeyAuthorization.test-d.ts

@@ -0,0 +1,62 @@
+import { expectTypeOf, test } from 'vp/test'
+import * as KeyAuthorization from './KeyAuthorization.js'
+import * as SignatureEnvelope from './SignatureEnvelope.js'
+
+const authorization = {
+  address: '0x1111111111111111111111111111111111111111',
+  chainId: 1n,
+  type: 'secp256k1',
+} as const satisfies KeyAuthorization.Input
+
+const signature = {
+  signature: {
+    r: '0x01',
+    s: '0x02',
+    yParity: 0,
+  },
+  type: 'secp256k1',
+} as const satisfies SignatureEnvelope.Secp256k1
+
+const multisig = {
+  account: '0x2222222222222222222222222222222222222222',
+  signatures: [signature],
+  type: 'multisig',
+} as const satisfies SignatureEnvelope.Multisig
+
+test('accepts primitive signatures', () => {
+  const signed = KeyAuthorization.from(authorization, { signature })
+
+  expectTypeOf(signed.signature).toMatchTypeOf<
+    KeyAuthorization.Signed['signature']
+  >()
+})
+
+test('rejects multisig signatures', () => {
+  KeyAuthorization.from(authorization, {
+    // @ts-expect-error Key authorizations accept only primitive signatures.
+    signature: multisig,
+  })
+
+  const multisigRpc = {
+    account: multisig.account,
+    signatures: [
+      {
+        r: '0x01',
+        s: '0x02',
+        type: 'secp256k1',
+        yParity: '0x0',
+      },
+    ],
+  } as const satisfies SignatureEnvelope.MultisigRpc
+
+  const rpc: KeyAuthorization.Rpc = {
+    chainId: '0x1',
+    expiry: null,
+    keyId: authorization.address,
+    keyType: authorization.type,
+    // @ts-expect-error Key authorizations accept only primitive RPC signatures.
+    signature: multisigRpc,
+  }
+
+  expectTypeOf(rpc).toEqualTypeOf<KeyAuthorization.Rpc>()
+})

package/src/tempo/KeyAuthorization.test.ts

@@ -53,6 +53,12 @@ const signature_webauthn = SignatureEnvelope.from({
   },
 })
 
+const signature_multisig = SignatureEnvelope.from({
+  account: address,
+  signatures: [SignatureEnvelope.from(signature_secp256k1)],
+  type: 'multisig',
+})
+
 describe('from', () => {
   test('default', () => {
     const authorization = KeyAuthorization.from({
@@ -416,9 +422,56 @@ describe('from', () => {
       }
     `)
   })
+
+  test('rejects a multisig signature', () => {
+    const authorization = KeyAuthorization.from({
+      address,
+      chainId: 1n,
+      type: 'secp256k1',
+    })
+
+    expect(() =>
+      KeyAuthorization.from(authorization, {
+        signature: signature_multisig as never,
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+    )
+
+    expect(() =>
+      KeyAuthorization.from(authorization, {
+        signature: SignatureEnvelope.serialize(signature_multisig),
+      }),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+    )
+
+    expect(() =>
+      KeyAuthorization.from({
+        ...authorization,
+        signature: signature_multisig,
+      } as never),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+    )
+  })
 })
 
 describe('fromRpc', () => {
+  test('rejects a multisig signature', () => {
+    expect(() =>
+      KeyAuthorization.fromRpc({
+        chainId: '0x1',
+        expiry: null,
+        keyId: address,
+        keyType: 'secp256k1',
+        signature: SignatureEnvelope.toRpc(signature_multisig),
+      } as never),
+    ).toThrowErrorMatchingInlineSnapshot(
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+    )
+  })
+
   test('secp256k1', () => {
     const authorization = KeyAuthorization.fromRpc({
       chainId: '0x1',

package/src/tempo/KeyAuthorization.ts

@@ -4,7 +4,7 @@ import type * as Errors from '../core/Errors.js'
 import * as Hash from '../core/Hash.js'
 import * as Hex from '../core/Hex.js'
 import * as Quantity from '../core/internal/quantity.js'
-import type { Compute, OneOf } from '../core/internal/types.js'
+import type { Compute, OneOf, UnionPartialBy } from '../core/internal/types.js'
 import * as Rlp from '../core/Rlp.js'
 import * as SignatureEnvelope from './SignatureEnvelope.js'
 
@@ -78,9 +78,9 @@ export type KeyAuthorization<
   | {}
 > &
   (signed extends true
-    ? { signature: SignatureEnvelope.SignatureEnvelope<numberType> }
+    ? { signature: SignatureEnvelope.Primitive<numberType> }
     : {
-        signature?: SignatureEnvelope.SignatureEnvelope<numberType> | undefined
+        signature?: SignatureEnvelope.Primitive<numberType> | undefined
       })
 
 /** Input type for a Key Authorization. */
@@ -104,8 +104,8 @@ export type Rpc = {
   keyType: SignatureEnvelope.Type
   /** Token spending limits. */
   limits?: readonly RpcTokenLimit[] | null | undefined
-  /** Signature envelope. */
-  signature: SignatureEnvelope.SignatureEnvelopeRpc
+  /** Primitive signature authorizing this key. */
+  signature: SignatureEnvelope.PrimitiveRpc
   /** Optional 32-byte witness (hex). */
   witness?: Hex.Hex | null | undefined
 }
@@ -136,6 +136,11 @@ export type Signed<bigintType = bigint, numberType = number> = KeyAuthorization<
   numberType
 >
 
+type PrimitiveSignatureValue =
+  | UnionPartialBy<SignatureEnvelope.Primitive, 'prehash' | 'type'>
+  | SignatureEnvelope.Secp256k1Flat
+  | SignatureEnvelope.Serialized
+
 type BaseTuple = readonly [
   chainId: Hex.Hex,
   keyType: Hex.Hex,
@@ -415,7 +420,7 @@ export type TokenLimit<bigintType = bigint, numberType = number> = {
  */
 export function from<
   const authorization extends Input | Rpc,
-  const signature extends SignatureEnvelope.from.Value | undefined = undefined,
+  const signature extends PrimitiveSignatureValue | undefined = undefined,
 >(
   authorization: authorization | KeyAuthorization,
   options: from.Options<signature> = {},
@@ -430,6 +435,7 @@ export function from<
     }[]
   }
   if (auth.witness !== undefined) assertWitness(auth.witness)
+  if (auth.signature) assertSignature(auth.signature)
   const resolved = {
     ...auth,
     ...(auth.scopes
@@ -441,39 +447,49 @@ export function from<
         }
       : {}),
   }
-  if (options.signature)
+  if (options.signature) {
+    const signature = SignatureEnvelope.from(
+      options.signature,
+    ) as SignatureEnvelope.SignatureEnvelope
+    assertSignature(signature)
     return {
       ...resolved,
-      signature: SignatureEnvelope.from(options.signature),
+      signature,
     } as never
+  }
   return resolved as never
 }
 
 export declare namespace from {
   type Options<
-    signature extends SignatureEnvelope.from.Value | undefined =
-      | SignatureEnvelope.from.Value
+    signature extends PrimitiveSignatureValue | undefined =
+      | PrimitiveSignatureValue
       | undefined,
   > = {
-    /** The {@link ox#SignatureEnvelope.SignatureEnvelope} to attach to the Key Authorization. */
-    signature?: signature | SignatureEnvelope.SignatureEnvelope | undefined
+    /** The primitive signature to attach to the Key Authorization. */
+    signature?: signature | SignatureEnvelope.Primitive | undefined
   }
 
   type ReturnType<
     authorization extends KeyAuthorization | Input | Rpc = KeyAuthorization,
-    signature extends SignatureEnvelope.from.Value | undefined =
-      | SignatureEnvelope.from.Value
+    signature extends PrimitiveSignatureValue | undefined =
+      | PrimitiveSignatureValue
       | undefined,
   > = Compute<
     authorization extends Rpc
       ? Signed
       : authorization &
-          (signature extends SignatureEnvelope.from.Value
-            ? { signature: SignatureEnvelope.from.ReturnValue<signature> }
+          (signature extends PrimitiveSignatureValue
+            ? {
+                signature: Extract<
+                  SignatureEnvelope.from.ReturnValue<signature>,
+                  SignatureEnvelope.Primitive
+                >
+              }
             : {})
   >
 
-  type ErrorType = Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 /**
@@ -513,6 +529,7 @@ export function fromRpc(authorization: Rpc): Signed {
   const isAdmin = authorization.isAdmin ?? undefined
   const account = authorization.account ?? undefined
   const signature = SignatureEnvelope.fromRpc(authorization.signature)
+  assertSignature(signature)
   if (witness !== undefined) assertWitness(witness)
 
   // Unflatten nested allowedCalls into flat scopes
@@ -558,7 +575,7 @@ export function fromRpc(authorization: Rpc): Signed {
 }
 
 export declare namespace fromRpc {
-  type ErrorType = Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 /**
@@ -700,8 +717,11 @@ export function fromTuple<const tuple extends Tuple>(
     ...(witness !== undefined ? { witness } : {}),
     ...adminPair,
   }
-  if (signatureSerialized)
-    args.signature = SignatureEnvelope.deserialize(signatureSerialized)
+  if (signatureSerialized) {
+    const signature = SignatureEnvelope.deserialize(signatureSerialized)
+    assertSignature(signature)
+    args.signature = signature
+  }
   return from(args) as never
 }
 
@@ -710,7 +730,7 @@ export declare namespace fromTuple {
     KeyAuthorization<authorization extends Tuple<true> ? true : false>
   >
 
-  type ErrorType = Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 /**
@@ -928,6 +948,7 @@ export function toRpc(authorization: toRpc.Input): Rpc {
     isAdmin,
     account,
   } = authorization
+  assertSignature(signature)
   if (witness !== undefined) assertWitness(witness)
 
   // Group flat scopes by address into nested allowedCalls wire format
@@ -966,7 +987,9 @@ export function toRpc(authorization: toRpc.Input): Rpc {
       limit: Quantity.fromNumberish(limit),
       ...(period ? { period: Quantity.fromNumberish(period) } : {}),
     })),
-    signature: SignatureEnvelope.toRpc(signature),
+    signature: SignatureEnvelope.toRpc(
+      signature,
+    ) as SignatureEnvelope.PrimitiveRpc,
     ...(allowedCalls ? { allowedCalls } : {}),
     ...(witness !== undefined ? { witness } : {}),
     ...(isAdmin ? { isAdmin: true } : {}),
@@ -978,7 +1001,7 @@ export declare namespace toRpc {
   /** Numberish input accepted by {@link ox#KeyAuthorization.(toRpc:function)}. */
   type Input = Signed<Hex.Hex | bigint | number, Hex.Hex | number>
 
-  type ErrorType = Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 /**
@@ -1028,9 +1051,11 @@ export function toTuple<const authorization extends KeyAuthorization>(
     account,
   } = authorization
   if (witness !== undefined) assertWitness(witness)
-  const signature = authorization.signature
-    ? SignatureEnvelope.serialize(authorization.signature)
-    : undefined
+  const signature = (() => {
+    if (!authorization.signature) return undefined
+    assertSignature(authorization.signature)
+    return SignatureEnvelope.serialize(authorization.signature)
+  })()
   const type = (() => {
     switch (authorization.type) {
       case 'secp256k1':
@@ -1126,7 +1151,7 @@ export declare namespace toTuple {
   type ReturnType<authorization extends KeyAuthorization = KeyAuthorization> =
     Compute<Tuple<authorization extends KeyAuthorization<true> ? true : false>>
 
-  type ErrorType = Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 function bigintToHex(value: bigint): Hex.Hex {
@@ -1164,6 +1189,13 @@ function assertWitness(witness: Hex.Hex): void {
   if (Hex.size(witness) !== 32) throw new InvalidWitnessSizeError(witness)
 }
 
+function assertSignature<numberType>(
+  signature: SignatureEnvelope.SignatureEnvelope<numberType>,
+): asserts signature is SignatureEnvelope.Primitive<numberType> {
+  if (signature.type === 'keychain' || signature.type === 'multisig')
+    throw new InvalidSignatureTypeError(signature.type)
+}
+
 function isAbsent(value: unknown): boolean {
   return value === undefined || value === '0x'
 }
@@ -1187,3 +1219,13 @@ export class InvalidAdminMarkerError extends Error {
     )
   }
 }
+
+/** Thrown when a key authorization contains a non-primitive signature. */
+export class InvalidSignatureTypeError extends Error {
+  override readonly name = 'KeyAuthorization.InvalidSignatureTypeError'
+  constructor(type: SignatureEnvelope.SignatureEnvelope['type']) {
+    super(
+      `Signature type \`${type}\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.`,
+    )
+  }
+}

package/src/tempo/MultisigConfig.test.ts

@@ -154,7 +154,12 @@ describe('assert / validate', () => {
       owner: `0x${(i + 1).toString(16).padStart(40, '0')}` as `0x${string}`,
       weight: 1,
     }))
-    expect(MultisigConfig.validate({ threshold: 255, owners })).toBe(true)
+    expect(
+      MultisigConfig.validate({
+        threshold: MultisigConfig.maxThreshold,
+        owners,
+      }),
+    ).toBe(true)
   })
 
   test('too many owners', () => {
@@ -174,6 +179,24 @@ describe('assert / validate', () => {
     ).toBe(false)
   })
 
+  test('threshold exceeds protocol maximum', () => {
+    expect(
+      MultisigConfig.validate({
+        threshold: MultisigConfig.maxThreshold + 1,
+        owners: [{ owner: owner1, weight: MultisigConfig.maxThreshold + 1 }],
+      }),
+    ).toBe(false)
+  })
+
+  test('fractional threshold', () => {
+    expect(
+      MultisigConfig.validate({
+        threshold: 1.5,
+        owners: [{ owner: owner1, weight: 2 }],
+      }),
+    ).toBe(false)
+  })
+
   test('threshold exceeds total weight', () => {
     expect(
       MultisigConfig.validate({
@@ -186,7 +209,7 @@ describe('assert / validate', () => {
   test('total weight exceeds u8 max', () => {
     expect(
       MultisigConfig.validate({
-        threshold: 255,
+        threshold: MultisigConfig.maxThreshold,
         owners: [
           { owner: owner1, weight: 128 },
           { owner: owner2, weight: 128 },
@@ -204,6 +227,15 @@ describe('assert / validate', () => {
     ).toBe(false)
   })
 
+  test('fractional owner weight', () => {
+    expect(
+      MultisigConfig.validate({
+        threshold: 1,
+        owners: [{ owner: owner1, weight: 1.5 }],
+      }),
+    ).toBe(false)
+  })
+
   test('zero owner address', () => {
     expect(
       MultisigConfig.validate({

package/src/tempo/MultisigConfig.ts

@@ -8,13 +8,19 @@ import type { Compute, OneOf } from '../core/internal/types.js'
 /** Maximum number of owners allowed in a native multisig config. */
 export const maxOwners = 255
 
+/** Maximum threshold accepted by a native multisig config. */
+export const maxThreshold = 8
+
+/** Maximum number of owner approvals in a native multisig signature. */
+export const maxSignatures = maxThreshold
+
 /**
  * Maximum number of native multisig signatures in one nested authorization
  * path, including the top-level transaction signature.
  */
-export const maxNestingDepth = 3
+export const maxNestingDepth = 2
 
-/** Maximum encoded byte length for one primitive owner approval. */
+/** Maximum encoded byte length for one owner approval. */
 export const maxOwnerSignatureBytes = 2049
 
 /** Tempo signature type byte for native multisig signatures. */
@@ -65,8 +71,8 @@ export type Tuple = readonly [
  *
  * Mirrors the Tempo `InitMultisig::validate` rules: owners non-empty and
  * `<= maxOwners`, strictly ascending unique nonzero owner addresses, nonzero
- * owner weights, `threshold >= 1`, total weight `<= 255` (u8 max), and
- * `threshold <= total weight`.
+ * integer owner weights, integer `threshold` between `1` and `maxThreshold`,
+ * total weight `<= 255` (u8 max), and `threshold <= total weight`.
  *
  * @example
  * ```ts twoslash
@@ -94,14 +100,22 @@ export function assert<numberType = number>(config: Config<numberType>): void {
     throw new InvalidConfigError({ reason: 'owners cannot be empty' })
   if (owners.length > maxOwners)
     throw new InvalidConfigError({ reason: 'too many owners' })
+  if (!Number.isInteger(Number(threshold)))
+    throw new InvalidConfigError({ reason: 'threshold must be an integer' })
   if (Number(threshold) < 1)
     throw new InvalidConfigError({ reason: 'threshold cannot be zero' })
+  if (Number(threshold) > maxThreshold)
+    throw new InvalidConfigError({ reason: 'threshold exceeds max threshold' })
 
   let totalWeight = 0
   let previous: bigint | undefined
   for (const owner of owners) {
     if (!Address.validate(owner.owner) || Hex.toBigInt(owner.owner) === 0n)
       throw new InvalidConfigError({ reason: 'owner cannot be zero' })
+    if (!Number.isInteger(Number(owner.weight)))
+      throw new InvalidConfigError({
+        reason: 'owner weight must be an integer',
+      })
     if (Number(owner.weight) < 1)
       throw new InvalidConfigError({ reason: 'owner weight cannot be zero' })