ox 1.0.2 → 1.0.4

package/src/tempo/KeyAuthorization.ts

@@ -4,7 +4,7 @@ import type * as Errors from '../core/Errors.js'
 import * as Hash from '../core/Hash.js'
 import * as Hex from '../core/Hex.js'
 import * as Quantity from '../core/internal/quantity.js'
-import type { Compute, OneOf } from '../core/internal/types.js'
+import type { Compute, OneOf, UnionPartialBy } from '../core/internal/types.js'
 import * as Rlp from '../core/Rlp.js'
 import * as SignatureEnvelope from './SignatureEnvelope.js'
 
@@ -78,9 +78,9 @@ export type KeyAuthorization<
   | {}
 > &
   (signed extends true
-    ? { signature: SignatureEnvelope.SignatureEnvelope<numberType> }
+    ? { signature: SignatureEnvelope.Primitive<numberType> }
     : {
-        signature?: SignatureEnvelope.SignatureEnvelope<numberType> | undefined
+        signature?: SignatureEnvelope.Primitive<numberType> | undefined
       })
 
 /** Input type for a Key Authorization. */
@@ -104,8 +104,8 @@ export type Rpc = {
   keyType: SignatureEnvelope.Type
   /** Token spending limits. */
   limits?: readonly RpcTokenLimit[] | null | undefined
-  /** Signature envelope. */
-  signature: SignatureEnvelope.SignatureEnvelopeRpc
+  /** Primitive signature authorizing this key. */
+  signature: SignatureEnvelope.PrimitiveRpc
   /** Optional 32-byte witness (hex). */
   witness?: Hex.Hex | null | undefined
 }
@@ -136,6 +136,11 @@ export type Signed<bigintType = bigint, numberType = number> = KeyAuthorization<
   numberType
 >
 
+type PrimitiveSignatureValue =
+  | UnionPartialBy<SignatureEnvelope.Primitive, 'prehash' | 'type'>
+  | SignatureEnvelope.Secp256k1Flat
+  | SignatureEnvelope.Serialized
+
 type BaseTuple = readonly [
   chainId: Hex.Hex,
   keyType: Hex.Hex,
@@ -415,7 +420,7 @@ export type TokenLimit<bigintType = bigint, numberType = number> = {
  */
 export function from<
   const authorization extends Input | Rpc,
-  const signature extends SignatureEnvelope.from.Value | undefined = undefined,
+  const signature extends PrimitiveSignatureValue | undefined = undefined,
 >(
   authorization: authorization | KeyAuthorization,
   options: from.Options<signature> = {},
@@ -430,6 +435,7 @@ export function from<
     }[]
   }
   if (auth.witness !== undefined) assertWitness(auth.witness)
+  if (auth.signature) assertSignature(auth.signature)
   const resolved = {
     ...auth,
     ...(auth.scopes
@@ -441,39 +447,49 @@ export function from<
         }
       : {}),
   }
-  if (options.signature)
+  if (options.signature) {
+    const signature = SignatureEnvelope.from(
+      options.signature,
+    ) as SignatureEnvelope.SignatureEnvelope
+    assertSignature(signature)
     return {
       ...resolved,
-      signature: SignatureEnvelope.from(options.signature),
+      signature,
     } as never
+  }
   return resolved as never
 }
 
 export declare namespace from {
   type Options<
-    signature extends SignatureEnvelope.from.Value | undefined =
-      | SignatureEnvelope.from.Value
+    signature extends PrimitiveSignatureValue | undefined =
+      | PrimitiveSignatureValue
       | undefined,
   > = {
-    /** The {@link ox#SignatureEnvelope.SignatureEnvelope} to attach to the Key Authorization. */
-    signature?: signature | SignatureEnvelope.SignatureEnvelope | undefined
+    /** The primitive signature to attach to the Key Authorization. */
+    signature?: signature | SignatureEnvelope.Primitive | undefined
   }
 
   type ReturnType<
     authorization extends KeyAuthorization | Input | Rpc = KeyAuthorization,
-    signature extends SignatureEnvelope.from.Value | undefined =
-      | SignatureEnvelope.from.Value
+    signature extends PrimitiveSignatureValue | undefined =
+      | PrimitiveSignatureValue
       | undefined,
   > = Compute<
     authorization extends Rpc
       ? Signed
       : authorization &
-          (signature extends SignatureEnvelope.from.Value
-            ? { signature: SignatureEnvelope.from.ReturnValue<signature> }
+          (signature extends PrimitiveSignatureValue
+            ? {
+                signature: Extract<
+                  SignatureEnvelope.from.ReturnValue<signature>,
+                  SignatureEnvelope.Primitive
+                >
+              }
             : {})
   >
 
-  type ErrorType = Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 /**
@@ -513,6 +529,7 @@ export function fromRpc(authorization: Rpc): Signed {
   const isAdmin = authorization.isAdmin ?? undefined
   const account = authorization.account ?? undefined
   const signature = SignatureEnvelope.fromRpc(authorization.signature)
+  assertSignature(signature)
   if (witness !== undefined) assertWitness(witness)
 
   // Unflatten nested allowedCalls into flat scopes
@@ -558,7 +575,7 @@ export function fromRpc(authorization: Rpc): Signed {
 }
 
 export declare namespace fromRpc {
-  type ErrorType = Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 /**
@@ -700,8 +717,11 @@ export function fromTuple<const tuple extends Tuple>(
     ...(witness !== undefined ? { witness } : {}),
     ...adminPair,
   }
-  if (signatureSerialized)
-    args.signature = SignatureEnvelope.deserialize(signatureSerialized)
+  if (signatureSerialized) {
+    const signature = SignatureEnvelope.deserialize(signatureSerialized)
+    assertSignature(signature)
+    args.signature = signature
+  }
   return from(args) as never
 }
 
@@ -710,7 +730,7 @@ export declare namespace fromTuple {
     KeyAuthorization<authorization extends Tuple<true> ? true : false>
   >
 
-  type ErrorType = Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 /**
@@ -928,6 +948,7 @@ export function toRpc(authorization: toRpc.Input): Rpc {
     isAdmin,
     account,
   } = authorization
+  assertSignature(signature)
   if (witness !== undefined) assertWitness(witness)
 
   // Group flat scopes by address into nested allowedCalls wire format
@@ -966,7 +987,9 @@ export function toRpc(authorization: toRpc.Input): Rpc {
       limit: Quantity.fromNumberish(limit),
       ...(period ? { period: Quantity.fromNumberish(period) } : {}),
     })),
-    signature: SignatureEnvelope.toRpc(signature),
+    signature: SignatureEnvelope.toRpc(
+      signature,
+    ) as SignatureEnvelope.PrimitiveRpc,
     ...(allowedCalls ? { allowedCalls } : {}),
     ...(witness !== undefined ? { witness } : {}),
     ...(isAdmin ? { isAdmin: true } : {}),
@@ -978,7 +1001,7 @@ export declare namespace toRpc {
   /** Numberish input accepted by {@link ox#KeyAuthorization.(toRpc:function)}. */
   type Input = Signed<Hex.Hex | bigint | number, Hex.Hex | number>
 
-  type ErrorType = Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 /**
@@ -1028,9 +1051,11 @@ export function toTuple<const authorization extends KeyAuthorization>(
     account,
   } = authorization
   if (witness !== undefined) assertWitness(witness)
-  const signature = authorization.signature
-    ? SignatureEnvelope.serialize(authorization.signature)
-    : undefined
+  const signature = (() => {
+    if (!authorization.signature) return undefined
+    assertSignature(authorization.signature)
+    return SignatureEnvelope.serialize(authorization.signature)
+  })()
   const type = (() => {
     switch (authorization.type) {
       case 'secp256k1':
@@ -1126,7 +1151,7 @@ export declare namespace toTuple {
   type ReturnType<authorization extends KeyAuthorization = KeyAuthorization> =
     Compute<Tuple<authorization extends KeyAuthorization<true> ? true : false>>
 
-  type ErrorType = Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 function bigintToHex(value: bigint): Hex.Hex {
@@ -1164,6 +1189,13 @@ function assertWitness(witness: Hex.Hex): void {
   if (Hex.size(witness) !== 32) throw new InvalidWitnessSizeError(witness)
 }
 
+function assertSignature<numberType>(
+  signature: SignatureEnvelope.SignatureEnvelope<numberType>,
+): asserts signature is SignatureEnvelope.Primitive<numberType> {
+  if (signature.type === 'keychain' || signature.type === 'multisig')
+    throw new InvalidSignatureTypeError(signature.type)
+}
+
 function isAbsent(value: unknown): boolean {
   return value === undefined || value === '0x'
 }
@@ -1187,3 +1219,13 @@ export class InvalidAdminMarkerError extends Error {
     )
   }
 }
+
+/** Thrown when a key authorization contains a non-primitive signature. */
+export class InvalidSignatureTypeError extends Error {
+  override readonly name = 'KeyAuthorization.InvalidSignatureTypeError'
+  constructor(type: SignatureEnvelope.SignatureEnvelope['type']) {
+    super(
+      `Signature type \`${type}\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.`,
+    )
+  }
+}

package/src/tempo/MultisigConfig.test.ts

@@ -154,7 +154,12 @@ describe('assert / validate', () => {
       owner: `0x${(i + 1).toString(16).padStart(40, '0')}` as `0x${string}`,
       weight: 1,
     }))
-    expect(MultisigConfig.validate({ threshold: 255, owners })).toBe(true)
+    expect(
+      MultisigConfig.validate({
+        threshold: MultisigConfig.maxThreshold,
+        owners,
+      }),
+    ).toBe(true)
   })
 
   test('too many owners', () => {
@@ -174,6 +179,24 @@ describe('assert / validate', () => {
     ).toBe(false)
   })
 
+  test('threshold exceeds protocol maximum', () => {
+    expect(
+      MultisigConfig.validate({
+        threshold: MultisigConfig.maxThreshold + 1,
+        owners: [{ owner: owner1, weight: MultisigConfig.maxThreshold + 1 }],
+      }),
+    ).toBe(false)
+  })
+
+  test('fractional threshold', () => {
+    expect(
+      MultisigConfig.validate({
+        threshold: 1.5,
+        owners: [{ owner: owner1, weight: 2 }],
+      }),
+    ).toBe(false)
+  })
+
   test('threshold exceeds total weight', () => {
     expect(
       MultisigConfig.validate({
@@ -186,7 +209,7 @@ describe('assert / validate', () => {
   test('total weight exceeds u8 max', () => {
     expect(
       MultisigConfig.validate({
-        threshold: 255,
+        threshold: MultisigConfig.maxThreshold,
         owners: [
           { owner: owner1, weight: 128 },
           { owner: owner2, weight: 128 },
@@ -204,6 +227,15 @@ describe('assert / validate', () => {
     ).toBe(false)
   })
 
+  test('fractional owner weight', () => {
+    expect(
+      MultisigConfig.validate({
+        threshold: 1,
+        owners: [{ owner: owner1, weight: 1.5 }],
+      }),
+    ).toBe(false)
+  })
+
   test('zero owner address', () => {
     expect(
       MultisigConfig.validate({

package/src/tempo/MultisigConfig.ts

@@ -8,13 +8,19 @@ import type { Compute, OneOf } from '../core/internal/types.js'
 /** Maximum number of owners allowed in a native multisig config. */
 export const maxOwners = 255
 
+/** Maximum threshold accepted by a native multisig config. */
+export const maxThreshold = 8
+
+/** Maximum number of owner approvals in a native multisig signature. */
+export const maxSignatures = maxThreshold
+
 /**
  * Maximum number of native multisig signatures in one nested authorization
  * path, including the top-level transaction signature.
  */
-export const maxNestingDepth = 3
+export const maxNestingDepth = 2
 
-/** Maximum encoded byte length for one primitive owner approval. */
+/** Maximum encoded byte length for one owner approval. */
 export const maxOwnerSignatureBytes = 2049
 
 /** Tempo signature type byte for native multisig signatures. */
@@ -65,8 +71,8 @@ export type Tuple = readonly [
  *
  * Mirrors the Tempo `InitMultisig::validate` rules: owners non-empty and
  * `<= maxOwners`, strictly ascending unique nonzero owner addresses, nonzero
- * owner weights, `threshold >= 1`, total weight `<= 255` (u8 max), and
- * `threshold <= total weight`.
+ * integer owner weights, integer `threshold` between `1` and `maxThreshold`,
+ * total weight `<= 255` (u8 max), and `threshold <= total weight`.
  *
  * @example
  * ```ts twoslash
@@ -94,14 +100,22 @@ export function assert<numberType = number>(config: Config<numberType>): void {
     throw new InvalidConfigError({ reason: 'owners cannot be empty' })
   if (owners.length > maxOwners)
     throw new InvalidConfigError({ reason: 'too many owners' })
+  if (!Number.isInteger(Number(threshold)))
+    throw new InvalidConfigError({ reason: 'threshold must be an integer' })
   if (Number(threshold) < 1)
     throw new InvalidConfigError({ reason: 'threshold cannot be zero' })
+  if (Number(threshold) > maxThreshold)
+    throw new InvalidConfigError({ reason: 'threshold exceeds max threshold' })
 
   let totalWeight = 0
   let previous: bigint | undefined
   for (const owner of owners) {
     if (!Address.validate(owner.owner) || Hex.toBigInt(owner.owner) === 0n)
       throw new InvalidConfigError({ reason: 'owner cannot be zero' })
+    if (!Number.isInteger(Number(owner.weight)))
+      throw new InvalidConfigError({
+        reason: 'owner weight must be an integer',
+      })
     if (Number(owner.weight) < 1)
       throw new InvalidConfigError({ reason: 'owner weight cannot be zero' })
 

package/src/tempo/SignatureEnvelope.test-d.ts

@@ -0,0 +1,97 @@
+import { expectTypeOf, test } from 'vp/test'
+import * as SignatureEnvelope from './SignatureEnvelope.js'
+
+const signature = {
+  r: '0x01',
+  s: '0x02',
+  type: 'secp256k1',
+  yParity: '0x0',
+} as const satisfies SignatureEnvelope.SignatureEnvelopeRpc
+
+const signatureDomain = {
+  signature: {
+    r: '0x01',
+    s: '0x02',
+    yParity: 0,
+  },
+  type: 'secp256k1',
+} as const satisfies SignatureEnvelope.Secp256k1
+
+test('toRpc preserves the signature type', () => {
+  expectTypeOf(
+    SignatureEnvelope.toRpc(signatureDomain),
+  ).toEqualTypeOf<SignatureEnvelope.Secp256k1Rpc>()
+})
+
+test('MultisigRpc uses static initialized and bootstrap shapes', () => {
+  const initialized = {
+    account: '0x1111111111111111111111111111111111111111',
+    signatures: [signature],
+  } as const satisfies SignatureEnvelope.MultisigRpc
+  const bootstrap = {
+    init: {
+      owners: [
+        {
+          owner: '0x1111111111111111111111111111111111111111',
+          weight: 1,
+        },
+      ],
+      threshold: 1,
+    },
+    signatures: [signature],
+  } as const satisfies SignatureEnvelope.MultisigRpc
+  const bootstrapWithAccountUndefined: SignatureEnvelope.MultisigRpc = {
+    ...bootstrap,
+    account: undefined,
+  }
+
+  expectTypeOf(initialized.signatures).toMatchTypeOf<
+    readonly SignatureEnvelope.SignatureEnvelopeRpc[]
+  >()
+  expectTypeOf(bootstrap.signatures).toMatchTypeOf<
+    readonly SignatureEnvelope.SignatureEnvelopeRpc[]
+  >()
+  expectTypeOf(
+    bootstrapWithAccountUndefined,
+  ).toMatchTypeOf<SignatureEnvelope.MultisigRpc>()
+  expectTypeOf<
+    SignatureEnvelope.GetType<typeof bootstrap>
+  >().toEqualTypeOf<'multisig'>()
+})
+
+test('MultisigRpc rejects legacy shapes', () => {
+  const combined = {
+    account: '0x1111111111111111111111111111111111111111',
+    init: {
+      owners: [
+        {
+          owner: '0x1111111111111111111111111111111111111111',
+          weight: 1,
+        },
+      ],
+      threshold: 1,
+    },
+    signatures: [signature],
+  } as const
+  // @ts-expect-error Bootstrap RPC signatures omit `account`.
+  const combinedRpc: SignatureEnvelope.MultisigRpc = combined
+
+  const serialized = {
+    account: '0x1111111111111111111111111111111111111111',
+    signatures: ['0x1234'],
+  } as const
+  // @ts-expect-error Owner approvals use structured RPC envelopes.
+  const serializedRpc: SignatureEnvelope.MultisigRpc = serialized
+
+  const tagged = {
+    account: '0x1111111111111111111111111111111111111111',
+    signatures: [signature],
+    type: 'multisig',
+  } as const
+  // @ts-expect-error Multisig RPC signatures are untagged.
+  const taggedRpc: SignatureEnvelope.MultisigRpc = tagged
+
+  expectTypeOf(combinedRpc).toEqualTypeOf<SignatureEnvelope.MultisigRpc>()
+  expectTypeOf(serializedRpc).toEqualTypeOf<SignatureEnvelope.MultisigRpc>()
+  expectTypeOf(taggedRpc).toEqualTypeOf<SignatureEnvelope.MultisigRpc>()
+})