ox 1.6.1 → 1.6.3

package/src/tempo/KeyAuthorization.test.ts

@@ -53,11 +53,17 @@ const signature_webauthn = SignatureEnvelope.from({
   },
 })
 
-const signature_multisig = SignatureEnvelope.from({
+const signature_multisig = {
   account: address,
   signatures: [SignatureEnvelope.from(signature_secp256k1)],
   type: 'multisig',
-})
+} as const satisfies SignatureEnvelope.Multisig
+
+const signature_keychain = {
+  inner: SignatureEnvelope.from(signature_secp256k1),
+  type: 'keychain',
+  userAddress: address,
+} as const satisfies SignatureEnvelope.Keychain
 
 describe('from', () => {
   test('default', () => {
@@ -423,7 +429,34 @@ describe('from', () => {
     `)
   })
 
-  test('rejects a multisig signature', () => {
+  test('with signature (multisig)', () => {
+    const authorization = KeyAuthorization.from({
+      address,
+      chainId: 1n,
+      type: 'secp256k1',
+    })
+
+    const signed = KeyAuthorization.from(authorization, {
+      signature: signature_multisig,
+    })
+    expect(signed.signature).toEqual(signature_multisig)
+    expect(
+      KeyAuthorization.from(authorization, {
+        signature: SignatureEnvelope.serialize(signature_multisig),
+      }).signature,
+    ).toEqual(signature_multisig)
+    expect(
+      KeyAuthorization.from({
+        ...authorization,
+        signature: signature_multisig,
+      }).signature,
+    ).toEqual(signature_multisig)
+    expect(
+      KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)),
+    ).toEqual(signed)
+  })
+
+  test('rejects a keychain signature', () => {
     const authorization = KeyAuthorization.from({
       address,
       chainId: 1n,
@@ -432,43 +465,55 @@ describe('from', () => {
 
     expect(() =>
       KeyAuthorization.from(authorization, {
-        signature: signature_multisig as never,
+        signature: signature_keychain as never,
       }),
     ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.]`,
     )
 
     expect(() =>
       KeyAuthorization.from(authorization, {
-        signature: SignatureEnvelope.serialize(signature_multisig),
+        signature: SignatureEnvelope.serialize(signature_keychain),
       }),
     ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.]`,
     )
 
     expect(() =>
       KeyAuthorization.from({
         ...authorization,
-        signature: signature_multisig,
+        signature: signature_keychain,
       } as never),
     ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.]`,
     )
   })
 })
 
 describe('fromRpc', () => {
-  test('rejects a multisig signature', () => {
+  test('multisig', () => {
+    const authorization = KeyAuthorization.fromRpc({
+      chainId: '0x1',
+      expiry: null,
+      keyId: address,
+      keyType: 'secp256k1',
+      signature: SignatureEnvelope.toRpc(signature_multisig),
+    })
+
+    expect(authorization.signature).toEqual(signature_multisig)
+  })
+
+  test('rejects a keychain signature', () => {
     expect(() =>
       KeyAuthorization.fromRpc({
         chainId: '0x1',
         expiry: null,
         keyId: address,
         keyType: 'secp256k1',
-        signature: SignatureEnvelope.toRpc(signature_multisig),
+        signature: SignatureEnvelope.toRpc(signature_keychain),
       } as never),
     ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`multisig\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.]`,
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.]`,
     )
   })
 
@@ -2401,12 +2446,12 @@ describe('admin keys (TIP-1049)', () => {
     expect(restored.account).toBeUndefined()
   })
 
-  test('fromTuple: drops orphan account without isAdmin', () => {
+  test('fromTuple: preserves a non-admin account binding', () => {
     const restored = KeyAuthorization.fromTuple([
       ['0x01', '0x', address, '0x', [], [], '0x', '0x', account],
     ])
-    expect(restored.isAdmin).toBeUndefined()
-    expect(restored.account).toBeUndefined()
+    expect(restored.isAdmin).toBe(false)
+    expect(restored.account).toBe(account)
   })
 
   test('fromTuple: extracts isAdmin + account together', () => {
@@ -2441,6 +2486,20 @@ describe('admin keys (TIP-1049)', () => {
     expect(restored.account).toBe(account)
   })
 
+  test('serialize/deserialize: roundtrip with non-admin account binding', () => {
+    const authorization = KeyAuthorization.from({
+      address,
+      account,
+      chainId: 1n,
+      isAdmin: false,
+      type: 'secp256k1',
+    })
+    const serialized = KeyAuthorization.serialize(authorization)
+    const restored = KeyAuthorization.deserialize(serialized)
+    expect(restored.isAdmin).toBe(false)
+    expect(restored.account).toBe(account)
+  })
+
   test('toRpc/fromRpc: roundtrip with isAdmin + account', () => {
     const authorization = KeyAuthorization.from(
       {
@@ -2471,15 +2530,15 @@ describe('admin keys (TIP-1049)', () => {
     expect(restored.account).toBeUndefined()
   })
 
-  test('fromRpc: drops orphan account without isAdmin', () => {
+  test('fromRpc: preserves a non-admin account binding', () => {
     const authorization = KeyAuthorization.from(
       { address, chainId: 1n, type: 'secp256k1' },
       { signature: SignatureEnvelope.from(signature_secp256k1) },
     )
     const rpc = KeyAuthorization.toRpc(authorization)
     const restored = KeyAuthorization.fromRpc({ ...rpc, account })
-    expect(restored.isAdmin).toBeUndefined()
-    expect(restored.account).toBeUndefined()
+    expect(restored.isAdmin).toBe(false)
+    expect(restored.account).toBe(account)
   })
 
   test('hash: changes when admin pair is added', () => {

package/src/tempo/KeyAuthorization.ts

@@ -78,11 +78,22 @@ export type KeyAuthorization<
   | {}
 > &
   (signed extends true
-    ? { signature: SignatureEnvelope.Primitive<numberType> }
+    ? { signature: Signature<numberType> }
     : {
-        signature?: SignatureEnvelope.Primitive<numberType> | undefined
+        signature?: Signature<numberType> | undefined
       })
 
+/** Signature that can authorize an access key. */
+export type Signature<numberType = number> = OneOf<
+  | SignatureEnvelope.Primitive<numberType>
+  | SignatureEnvelope.Multisig<numberType>
+>
+
+/** RPC-formatted signature that can authorize an access key. */
+export type SignatureRpc = OneOf<
+  SignatureEnvelope.PrimitiveRpc | SignatureEnvelope.MultisigRpc
+>
+
 /** Input type for a Key Authorization. */
 export type Input = KeyAuthorization<false, bigint, number>
 
@@ -104,8 +115,8 @@ export type Rpc = {
   keyType: SignatureEnvelope.Type
   /** Token spending limits. */
   limits?: readonly RpcTokenLimit[] | null | undefined
-  /** Primitive signature authorizing this key. */
-  signature: SignatureEnvelope.PrimitiveRpc
+  /** Signature authorizing this key. */
+  signature: SignatureRpc
   /** Optional 32-byte witness (hex). */
   witness?: Hex.Hex | null | undefined
 }
@@ -136,10 +147,11 @@ export type Signed<bigintType = bigint, numberType = number> = KeyAuthorization<
   numberType
 >
 
-type PrimitiveSignatureValue =
-  | UnionPartialBy<SignatureEnvelope.Primitive, 'prehash' | 'type'>
+type SignatureValue =
+  | UnionPartialBy<Signature, 'prehash' | 'type'>
   | SignatureEnvelope.Secp256k1Flat
   | SignatureEnvelope.Serialized
+  | SignatureEnvelope.from.MultisigFromInitialConfig
 
 type BaseTuple = readonly [
   chainId: Hex.Hex,
@@ -415,7 +427,7 @@ export type TokenLimit<bigintType = bigint, numberType = number> = {
  */
 export function from<
   const authorization extends Input | Rpc,
-  const signature extends PrimitiveSignatureValue | undefined = undefined,
+  const signature extends SignatureValue | undefined = undefined,
 >(
   authorization: authorization | KeyAuthorization,
   options: from.Options<signature> = {},
@@ -457,28 +469,24 @@ export function from<
 
 export declare namespace from {
   type Options<
-    signature extends PrimitiveSignatureValue | undefined =
-      | PrimitiveSignatureValue
-      | undefined,
+    signature extends SignatureValue | undefined = SignatureValue | undefined,
   > = {
-    /** The primitive signature to attach to the Key Authorization. */
-    signature?: signature | SignatureEnvelope.Primitive | undefined
+    /** The signature to attach to the Key Authorization. */
+    signature?: signature | Signature | undefined
   }
 
   type ReturnType<
     authorization extends KeyAuthorization | Input | Rpc = KeyAuthorization,
-    signature extends PrimitiveSignatureValue | undefined =
-      | PrimitiveSignatureValue
-      | undefined,
+    signature extends SignatureValue | undefined = SignatureValue | undefined,
   > = Compute<
     authorization extends Rpc
       ? Signed
       : authorization &
-          (signature extends PrimitiveSignatureValue
+          (signature extends SignatureValue
             ? {
                 signature: Extract<
                   SignatureEnvelope.from.ReturnValue<signature>,
-                  SignatureEnvelope.Primitive
+                  Signature
                 >
               }
             : {})
@@ -544,11 +552,8 @@ export function fromRpc(authorization: Rpc): Signed {
       })
     : undefined
 
-  // TIP-1049 admin fields are paired: emit both or neither; orphan wire
-  // fields are dropped. Separate conditional spreads break `Signed`
-  // assignability without `exactOptionalPropertyTypes` (#290).
-  const adminPair =
-    account !== undefined && isAdmin ? { account, isAdmin: true as const } : {}
+  const accountBinding =
+    account !== undefined ? { account, isAdmin: isAdmin ?? false } : {}
 
   return {
     address: keyId,
@@ -565,7 +570,7 @@ export function fromRpc(authorization: Rpc): Signed {
     signature,
     type: keyType,
     ...(witness !== undefined ? { witness } : {}),
-    ...adminPair,
+    ...accountBinding,
   }
 }
 
@@ -697,11 +702,8 @@ export function fromTuple<const tuple extends Tuple>(
   const account = isAbsent(rawAccount)
     ? undefined
     : (rawAccount as Address.Address)
-  // TIP-1049 admin fields are paired: only emit both when both are present on
-  // the wire. Wire shapes carrying only one are tolerated for forward-compat
-  // but the orphan field is dropped (since the public API requires both).
-  const adminPair =
-    account !== undefined && isAdmin ? { account, isAdmin: true as const } : {}
+  const accountBinding =
+    account !== undefined ? { account, isAdmin: isAdmin ?? false } : {}
   const args: KeyAuthorization = {
     address: keyId,
     chainId: chainId === '0x' ? 0n : Hex.toBigInt(chainId),
@@ -710,7 +712,7 @@ export function fromTuple<const tuple extends Tuple>(
     ...(limits !== undefined ? { limits } : {}),
     ...(scopes !== undefined ? { scopes } : {}),
     ...(witness !== undefined ? { witness } : {}),
-    ...adminPair,
+    ...accountBinding,
   }
   if (signatureSerialized) {
     const signature = SignatureEnvelope.deserialize(signatureSerialized)
@@ -982,9 +984,7 @@ export function toRpc(authorization: toRpc.Input): Rpc {
       limit: Quantity.fromNumberish(limit),
       ...(period ? { period: Quantity.fromNumberish(period) } : {}),
     })),
-    signature: SignatureEnvelope.toRpc(
-      signature,
-    ) as SignatureEnvelope.PrimitiveRpc,
+    signature: SignatureEnvelope.toRpc(signature) as SignatureRpc,
     ...(allowedCalls ? { allowedCalls } : {}),
     ...(witness !== undefined ? { witness } : {}),
     ...(isAdmin ? { isAdmin: true } : {}),
@@ -1186,8 +1186,8 @@ function assertWitness(witness: Hex.Hex): void {
 
 function assertSignature<numberType>(
   signature: SignatureEnvelope.SignatureEnvelope<numberType>,
-): asserts signature is SignatureEnvelope.Primitive<numberType> {
-  if (signature.type === 'keychain' || signature.type === 'multisig')
+): asserts signature is Signature<numberType> {
+  if (signature.type === 'keychain')
     throw new InvalidSignatureTypeError(signature.type)
 }
 
@@ -1215,12 +1215,12 @@ export class InvalidAdminMarkerError extends Error {
   }
 }
 
-/** Thrown when a key authorization contains a non-primitive signature. */
+/** Thrown when a key authorization contains a keychain signature. */
 export class InvalidSignatureTypeError extends Error {
   override readonly name = 'KeyAuthorization.InvalidSignatureTypeError'
   constructor(type: SignatureEnvelope.SignatureEnvelope['type']) {
     super(
-      `Signature type \`${type}\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, or \`webAuthn\`.`,
+      `Signature type \`${type}\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.`,
     )
   }
 }

package/src/tempo/MultisigConfig.test.ts

@@ -86,24 +86,44 @@ describe('getSignPayload', () => {
   test('matches independent ground truth', () => {
     expect(
       MultisigConfig.getSignPayload({
-        payload: `0x${'de'.repeat(32)}`,
-        genesisConfig: singleOwnerConfig,
+        payload: `0x${'42'.repeat(32)}`,
+        initialConfig: singleOwnerConfig,
       }),
     ).toMatchInlineSnapshot(
-      `"0x7df8cb9fef4fc2aeb271b617d1a4c6178b720ae1d7564f48a363069b7d77a079"`,
+      `"0xbf944a7a752b2cfab0418d5fb4591c5a7ff62976488edce11794d7f35fb34f41"`,
     )
   })
 
-  test('behavior: `genesisConfig` and `{ account }` produce identical digests', () => {
+  test('behavior: `initialConfig` and `{ account }` produce identical digests', () => {
     const account = MultisigConfig.getAddress(singleOwnerConfig)
     const payload = `0x${'42'.repeat(32)}` as const
     expect(
       MultisigConfig.getSignPayload({
         payload,
-        genesisConfig: singleOwnerConfig,
+        initialConfig: singleOwnerConfig,
       }),
     ).toBe(MultisigConfig.getSignPayload({ payload, account }))
   })
+
+  test('differs for a different config version', () => {
+    const value = {
+      payload: `0x${'42'.repeat(32)}` as const,
+      initialConfig: singleOwnerConfig,
+    }
+    expect(MultisigConfig.getSignPayload(value)).not.toBe(
+      MultisigConfig.getSignPayload({ ...value, version: 1n }),
+    )
+  })
+
+  test('defaults the config version to zero', () => {
+    const value = {
+      payload: `0x${'42'.repeat(32)}` as const,
+      initialConfig: singleOwnerConfig,
+    }
+    expect(MultisigConfig.getSignPayload(value)).toBe(
+      MultisigConfig.getSignPayload({ ...value, version: 0n }),
+    )
+  })
 })
 
 describe('toTuple / fromTuple', () => {
@@ -149,8 +169,8 @@ describe('assert / validate', () => {
     expect(MultisigConfig.validate({ threshold: 1, owners: [] })).toBe(false)
   })
 
-  test('accepts 255 owners', () => {
-    const owners = Array.from({ length: 255 }, (_, i) => ({
+  test('accepts 50 owners', () => {
+    const owners = Array.from({ length: 50 }, (_, i) => ({
       owner: `0x${(i + 1).toString(16).padStart(40, '0')}` as `0x${string}`,
       weight: 1,
     }))
@@ -163,7 +183,7 @@ describe('assert / validate', () => {
   })
 
   test('too many owners', () => {
-    const owners = Array.from({ length: 256 }, (_, i) => ({
+    const owners = Array.from({ length: 51 }, (_, i) => ({
       owner: `0x${(i + 1).toString(16).padStart(40, '0')}` as `0x${string}`,
       weight: 1,
     }))

package/src/tempo/MultisigConfig.ts

@@ -6,7 +6,7 @@ import * as Hex from '../core/Hex.js'
 import type { Compute, OneOf } from '../core/internal/types.js'
 
 /** Maximum number of owners allowed in a native multisig config. */
-export const maxOwners = 255
+export const maxOwners = 50
 
 /** Maximum threshold accepted by a native multisig config. */
 export const maxThreshold = 8
@@ -20,7 +20,7 @@ export const maxSignatures = maxThreshold
  */
 export const maxNestingDepth = 2
 
-/** Maximum encoded byte length for one owner approval. */
+/** Maximum encoded byte length for one primitive owner approval. */
 export const maxOwnerSignatureBytes = 2049
 
 /** Tempo signature type byte for native multisig signatures. */
@@ -233,7 +233,7 @@ export function fromTuple(tuple: Tuple): Config {
  * ```ts twoslash
  * import { MultisigConfig } from 'ox/tempo'
  *
- * const genesisConfig = MultisigConfig.from({
+ * const initialConfig = MultisigConfig.from({
  *   threshold: 1,
  *   owners: [
  *     {
@@ -243,7 +243,7 @@ export function fromTuple(tuple: Tuple): Config {
  *   ]
  * })
  *
- * const address = MultisigConfig.getAddress(genesisConfig)
+ * const address = MultisigConfig.getAddress(initialConfig)
  * ```
  *
  * @param config - The initial (bootstrap) multisig config.
@@ -284,13 +284,13 @@ export declare namespace getAddress {
 /**
  * Computes the digest a native multisig owner approves (signs).
  *
- * `keccak256("tempo:multisig:signature" || inner_digest || account)`,
+ * `keccak256("tempo:multisig:signature" || inner_digest || account || uint64be(version))`,
  * where `inner_digest` is the transaction sign payload
  * ({@link ox#TxEnvelopeTempo.(getSignPayload:function)}).
  *
- * The digest is keyed on the permanent `account` derived from the genesis
- * (bootstrap) config — config updates never change it, so the genesis config
- * is the correct input even for post-update transactions.
+ * The digest is keyed on the permanent `account` derived from the initial
+ * (bootstrap) config and the current config `version`. Bootstrap approvals use
+ * version `0n`, which is also the default; each config update increments it.
  *
  * For a nested multisig owner approval, the parent digest becomes the nested
  * approval's `payload`, with the nested multisig `account`.
@@ -299,7 +299,7 @@ export declare namespace getAddress {
  * ```ts twoslash
  * import { MultisigConfig, TxEnvelopeTempo } from 'ox/tempo'
  *
- * const genesisConfig = MultisigConfig.from({
+ * const initialConfig = MultisigConfig.from({
  *   threshold: 1,
  *   owners: [
  *     {
@@ -316,7 +316,7 @@ export declare namespace getAddress {
  *
  * const digest = MultisigConfig.getSignPayload({
  *   payload: TxEnvelopeTempo.getSignPayload(envelope),
- *   genesisConfig
+ *   initialConfig
  * })
  * ```
  *
@@ -329,7 +329,7 @@ export declare namespace getAddress {
  * ```ts twoslash
  * import { MultisigConfig, TxEnvelopeTempo } from 'ox/tempo'
  *
- * const genesisConfig = MultisigConfig.from({
+ * const initialConfig = MultisigConfig.from({
  *   threshold: 1,
  *   owners: [
  *     {
@@ -338,7 +338,7 @@ export declare namespace getAddress {
  *     }
  *   ]
  * })
- * const account = MultisigConfig.getAddress(genesisConfig)
+ * const account = MultisigConfig.getAddress(initialConfig)
  *
  * const envelope = TxEnvelopeTempo.from({
  *   chainId: 1,
@@ -347,7 +347,8 @@ export declare namespace getAddress {
  *
  * const digest = MultisigConfig.getSignPayload({
  *   payload: TxEnvelopeTempo.getSignPayload(envelope),
- *   account
+ *   account,
+ *   version: 1n
  * })
  * ```
  *
@@ -355,13 +356,18 @@ export declare namespace getAddress {
  * @returns The owner approval digest.
  */
 export function getSignPayload(value: getSignPayload.Value): Hex.Hex {
-  const { payload } = value
+  const { payload, version = 0n } = value
   const account =
     'account' in value && value.account
       ? value.account
-      : getAddress((value as { genesisConfig: Config }).genesisConfig)
+      : getAddress((value as { initialConfig: Config }).initialConfig)
   return Hash.keccak256(
-    Hex.concat(Hex.fromString(signatureDomain), Hex.from(payload), account),
+    Hex.concat(
+      Hex.fromString(signatureDomain),
+      Hex.from(payload),
+      account,
+      Hex.fromNumber(version, { size: 8 }),
+    ),
   )
 }
 
@@ -369,6 +375,8 @@ export declare namespace getSignPayload {
   type Value = {
     /** The inner transaction sign payload (`tx.signature_hash()`). */
     payload: Hex.Hex | Bytes.Bytes
+    /** Current multisig config version. Defaults to `0n`. */
+    version?: bigint | undefined
   } & OneOf<
     | {
         /** The native multisig account address. */
@@ -378,10 +386,10 @@ export declare namespace getSignPayload {
         /**
          * The initial multisig config (the bootstrap config that derived the
          * permanent `account`). Used to derive the account automatically.
-         * Config updates never change `account`, so the genesis config is
-         * also the correct input for post-update transactions.
+         * Config updates never change `account`, so the initial config can
+         * continue deriving the account for post-update transactions.
          */
-        genesisConfig: Config
+        initialConfig: Config
       }
   >
 
@@ -390,6 +398,7 @@ export declare namespace getSignPayload {
     | Hash.keccak256.ErrorType
     | Hex.concat.ErrorType
     | Hex.from.ErrorType
+    | Hex.fromNumber.ErrorType
     | Errors.GlobalErrorType
 }