ox 1.7.4 → 1.8.0

package/src/core/_test/curves.test.ts

@@ -1,7 +1,12 @@
+import { secp256k1 } from '@noble/curves/secp256k1.js'
 import { p256 } from '@noble/curves/nist.js'
 import { expect, test } from 'vp/test'
-import { p256N } from '../internal/curves.js'
+import { p256N, secp256k1N } from '../internal/curves.js'
 
 test('p256N matches @noble/curves', () => {
   expect(p256N).toEqual(p256.Point.CURVE().n)
 })
+
+test('secp256k1N matches @noble/curves', () => {
+  expect(secp256k1N).toEqual(secp256k1.Point.Fn.ORDER)
+})

package/src/core/_test/index.test.ts

@@ -41,6 +41,9 @@ test('exports', () => {
       "Errors",
       "Fee",
       "Filter",
+      "Frame",
+      "FrameReceipt",
+      "FrameSignature",
       "Hash",
       "HdKey",
       "Hex",
@@ -73,6 +76,7 @@ test('exports', () => {
       "TxEnvelopeEip2930",
       "TxEnvelopeEip4844",
       "TxEnvelopeEip7702",
+      "TxEnvelopeEip8141",
       "TxEnvelopeLegacy",
       "TypedData",
       "ValidatorData",

package/src/core/internal/curves.ts

@@ -16,3 +16,7 @@
  */
 export const p256N =
   0xffffffff00000000ffffffffffffffffbce6faada7179e84f3b9cac2fc632551n
+
+/** Order of the secp256k1 curve. @internal */
+export const secp256k1N =
+  0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n

package/src/index.ts

@@ -1603,6 +1603,63 @@ export * as Fee from './core/Fee.js'
  * @category Execution Spec
  */
 export * as Filter from './core/Filter.js'
+/**
+ * Utilities for constructing, validating, and encoding [EIP-8141](https://eips.ethereum.org/EIPS/eip-8141) call frames.
+ *
+ * A {@link ox#Frame.Frame} describes a call with an execution mode, approval flags,
+ * and separate execution and state gas limits.
+ *
+ * @example
+ * ### Creating Frames
+ *
+ * Use {@link ox#Frame.(from:function)} to construct a frame with named mode and flags.
+ *
+ * ```ts twoslash
+ * import { Frame } from 'ox'
+ *
+ * const frame = Frame.from({
+ *   flags: 'approveExecutionAndPayment',
+ *   gas: 50_000n,
+ *   mode: 'verify'
+ * })
+ * ```
+ *
+ * @category Transaction Envelopes
+ */
+export * as Frame from './core/Frame.js'
+
+/**
+ * Utilities for converting EIP-8141 frame receipts between RPC and decoded forms.
+ *
+ * Frame receipts include execution gas, state gas, logs, and execution status.
+ *
+ * @category Execution Spec
+ */
+export * as FrameReceipt from './core/FrameReceipt.js'
+
+/**
+ * Utilities for constructing, validating, and encoding [EIP-8141](https://eips.ethereum.org/EIPS/eip-8141) signature entries.
+ *
+ * Supports {@link ox#FrameSignature.Arbitrary}, {@link ox#FrameSignature.Secp256k1},
+ * and {@link ox#FrameSignature.P256} entries. An empty payload selects the canonical
+ * transaction signing hash.
+ *
+ * @example
+ * ### Creating Signature Entries
+ *
+ * Use {@link ox#FrameSignature.(from:function)} to wrap arbitrary witness bytes.
+ *
+ * ```ts twoslash
+ * import { FrameSignature } from 'ox'
+ *
+ * const entry = FrameSignature.from('0xaabb')
+ * // @log: { payload: '0x', scheme: 'arbitrary', signature: '0xaabb' }
+ * ```
+ *
+ * @category Transaction Envelopes
+ */
+export * as FrameSignature from './core/FrameSignature.js'
+
 /**
  * Utility functions for hashing (keccak256, sha256, etc).
  *
@@ -3511,6 +3568,26 @@ export * as TxEnvelopeEip4844 from './core/TxEnvelopeEip4844.js'
  * @category Transaction Envelopes
  */
 export * as TxEnvelopeEip7702 from './core/TxEnvelopeEip7702.js'
+
+/**
+ * Utilities for constructing, signing, and encoding EIP-8141 frame transactions.
+ *
+ * @example
+ * ### Basic Usage
+ *
+ * ```ts twoslash
+ * import { TxEnvelopeEip8141 } from 'ox'
+ *
+ * const envelope = TxEnvelopeEip8141.from({
+ *   chainId: 1,
+ *   frames: [{ gas: 50_000n, mode: 'sender' }],
+ *   sender: '0x70997970c51812dc3a010c7d01b50e0d17dc79c8'
+ * })
+ * ```
+ *
+ * @category Transaction Envelopes
+ */
+export * as TxEnvelopeEip8141 from './core/TxEnvelopeEip8141.js'
 /**
  * Utility functions for working
  * with **Legacy Transaction Envelopes**.

package/src/tempo/AuthorizationTempo.test.ts

@@ -348,7 +348,8 @@ describe('fromRpc', () => {
         type: 'p256',
       },
     })
-    if (typeof result.signature === 'string') throw new Error('unreachable')
+    if (typeof result.signature === 'string')
+      throw new Error('Expected structured primitive signature')
     expect(result.signature.type).toBe('p256')
     expect(result.signature).toHaveProperty('prehash', true)
     expect(result.signature).toHaveProperty('publicKey')
@@ -371,7 +372,8 @@ describe('fromRpc', () => {
           '0x49960de5880e8c687434170f6476605b8fe4aeb9a28632c7995cf3ba831d976305000000007b2274797065223a22776562617574686e2e676574222c226368616c6c656e6765223a22222c226f726967696e223a2268747470733a2f2f6578616d706c652e636f6d222c2263726f73734f726967696e223a66616c73657d',
       },
     })
-    if (typeof result.signature === 'string') throw new Error('unreachable')
+    if (typeof result.signature === 'string')
+      throw new Error('Expected structured primitive signature')
     expect(result.signature.type).toBe('webAuthn')
     expect(result.signature).toHaveProperty('metadata')
     expect(result.signature).toHaveProperty('publicKey')
@@ -996,7 +998,8 @@ describe('toRpc', () => {
         type: 'p256',
       },
     })
-    if (typeof result.signature === 'string') throw new Error('unreachable')
+    if (typeof result.signature === 'string')
+      throw new Error('Expected structured primitive signature')
     expect(result.signature.type).toBe('p256')
   })
 
@@ -1022,7 +1025,8 @@ describe('toRpc', () => {
         type: 'webAuthn',
       },
     })
-    if (typeof result.signature === 'string') throw new Error('unreachable')
+    if (typeof result.signature === 'string')
+      throw new Error('Expected structured primitive signature')
     expect(result.signature.type).toBe('webAuthn')
   })
 })

package/src/tempo/KeyAuthorization.test-d.ts

@@ -1,7 +1,6 @@
 import { expectTypeOf, test } from 'vp/test'
 import * as KeyAuthorization from './KeyAuthorization.js'
-import * as MultisigConfig from './MultisigConfig.js'
-import type * as SignatureEnvelope from './SignatureEnvelope.js'
+import * as SignatureEnvelope from './SignatureEnvelope.js'
 
 const authorization = {
   address: '0x1111111111111111111111111111111111111111',
@@ -20,26 +19,18 @@ const signature = {
 
 const multisig = {
   account: '0x2222222222222222222222222222222222222222',
-  config: MultisigConfig.from({
+  config: {
+    salt: `0x${'00'.repeat(32)}`,
+    version: 0n,
+    threshold: 1,
     owners: [
-      {
-        owner: '0x1111111111111111111111111111111111111111',
-        weight: 1,
-      },
+      { owner: '0x1111111111111111111111111111111111111111', weight: 1 },
     ],
-    threshold: 1,
-    version: 1n,
-  }),
+  },
   signatures: [signature],
   type: 'multisig',
 } as const satisfies SignatureEnvelope.Multisig
 
-const keychain = {
-  inner: signature,
-  type: 'keychain',
-  userAddress: authorization.address,
-} as const satisfies SignatureEnvelope.Keychain
-
 test('accepts primitive signatures', () => {
   const signed = KeyAuthorization.from(authorization, { signature })
 
@@ -48,51 +39,13 @@ test('accepts primitive signatures', () => {
   >()
 })
 
-test('accepts multisig signatures', () => {
-  const signed = KeyAuthorization.from(authorization, { signature: multisig })
-
-  expectTypeOf(signed.signature).toMatchTypeOf<
-    KeyAuthorization.Signed['signature']
-  >()
-
-  const multisigRpc = '0xf8' as const satisfies SignatureEnvelope.MultisigRpc
-
-  const rpc: KeyAuthorization.Rpc = {
-    chainId: '0x1',
-    expiry: null,
-    keyId: authorization.address,
-    keyType: authorization.type,
-    signature: multisigRpc,
-  }
-
-  expectTypeOf(rpc).toEqualTypeOf<KeyAuthorization.Rpc>()
-})
-
-test('rejects keychain signatures', () => {
-  KeyAuthorization.from(authorization, {
-    // @ts-expect-error Key authorizations do not accept keychain signatures.
-    signature: keychain,
-  })
-
-  const keychainRpc = {
-    signature: {
-      r: '0x01',
-      s: '0x02',
-      type: 'secp256k1',
-      yParity: '0x0',
-    },
-    type: 'keychain',
-    userAddress: authorization.address,
-  } as const satisfies SignatureEnvelope.KeychainRpc
-
-  const rpc: KeyAuthorization.Rpc = {
-    chainId: '0x1',
-    expiry: null,
-    keyId: authorization.address,
-    keyType: authorization.type,
-    // @ts-expect-error Key authorizations do not accept keychain RPC signatures.
-    signature: keychainRpc,
-  }
-
-  expectTypeOf(rpc).toEqualTypeOf<KeyAuthorization.Rpc>()
+test('accepts multisig signatures and account-bound grants', () => {
+  const signed = KeyAuthorization.from(
+    { ...authorization, account: multisig.account, type: 'multisig' },
+    { signature: multisig },
+  )
+  expectTypeOf(signed).toMatchTypeOf<KeyAuthorization.Signed>()
+  expectTypeOf(
+    KeyAuthorization.toRpc(signed),
+  ).toMatchTypeOf<KeyAuthorization.Rpc>()
 })

package/src/tempo/KeyAuthorization.test.ts

@@ -78,7 +78,66 @@ const signature_keychain = {
   userAddress: address,
 } as const satisfies SignatureEnvelope.Keychain
 
+describe('multisig account binding', () => {
+  test('rejects unbound grants before signing or encoding', () => {
+    const authorization = { address, chainId: 1n, type: 'multisig' } as const
+    const signed = {
+      ...authorization,
+      signature: SignatureEnvelope.from(signature_secp256k1),
+    }
+    for (const encode of [
+      () => KeyAuthorization.from(authorization),
+      () => KeyAuthorization.toTuple(authorization),
+      () => KeyAuthorization.getSignPayload(authorization),
+      () => KeyAuthorization.serialize(authorization),
+      () => KeyAuthorization.toRpc(signed),
+    ])
+      expect(encode).toThrowErrorMatchingInlineSnapshot(
+        `[KeyAuthorization.MissingAccountError: Multisig key grants require a parent account binding.]`,
+      )
+  })
+
+  test('rejects unbound RPC and RLP grants', () => {
+    const signed = KeyAuthorization.from(
+      { account: address, address, chainId: 1n, type: 'multisig' },
+      { signature: signature_secp256k1 },
+    )
+    const rpc = KeyAuthorization.toRpc(signed)
+    for (const account of [undefined, null])
+      expect(() => KeyAuthorization.fromRpc({ ...rpc, account })).toThrowError(
+        KeyAuthorization.MissingAccountError,
+      )
+    expect(() =>
+      KeyAuthorization.fromTuple([['0x01', '0x03', address]]),
+    ).toThrowError(KeyAuthorization.MissingAccountError)
+    expect(KeyAuthorization.fromRpc(rpc).account).toBe(address)
+    expect(
+      KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)).account,
+    ).toBe(address)
+  })
+})
+
 describe('from', () => {
+  test('accepts multisig grants and delegates', () => {
+    const signed = KeyAuthorization.from(
+      {
+        address,
+        chainId: 1n,
+        type: 'multisig',
+        account: signature_multisig.account,
+      },
+      { signature: signature_multisig },
+    )
+    expect(
+      KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)),
+    ).toEqual(signed)
+    expect(KeyAuthorization.fromRpc(KeyAuthorization.toRpc(signed))).toEqual(
+      signed,
+    )
+  })
+})
+
+describe('fromRpc', () => {
   test('default', () => {
     const authorization = KeyAuthorization.from({
       address,
@@ -1112,17 +1171,16 @@ describe('getSignPayload', () => {
 describe('deserialize', () => {
   test('example: matches the frozen multisig witness vector', () => {
     const serialized =
-      '0xf8f1f85382107980941eff47bc3a10a45d4b230b5d10e37751fe6aa718808080a0535353535353535353535353535353535353535353535353535353535353535380949dba7f426b711d4893c11611eacf7cc334e7146bb89a05f897949dba7f426b711d4893c11611eacf7cc334e7146bf83ba000000000000000000000000000000000000000000000000000000000000000008001d7d6947e5f4552091a69125d5dfcb7b8c2659029395bdf01f843b8412cfed9350faf80e4115e3c4c967356b80a8e6ee42e4a49ab953c8c8a3537d8d8359bf035a9bea18f32b0da7129cdce3ce701abc09ad8919b93da21a0d57e21451b' as const
+      '0xf8f1f85382107980941eff47bc3a10a45d4b230b5d10e37751fe6aa718808080a053535353535353535353535353535353535353535353535353535353535353538094c4a590afa7337e5cd5eb3aa60cacf91c5400044bb89a05f89794c4a590afa7337e5cd5eb3aa60cacf91c5400044bf83ba000000000000000000000000000000000000000000000000000000000000000008001d7d6947e5f4552091a69125d5dfcb7b8c2659029395bdf01f843b8412cfed9350faf80e4115e3c4c967356b80a8e6ee42e4a49ab953c8c8a3537d8d8359bf035a9bea18f32b0da7129cdce3ce701abc09ad8919b93da21a0d57e21451b' as const
     const authorization = KeyAuthorization.deserialize(serialized)
 
     expect(authorization).toMatchInlineSnapshot(`
       {
-        "account": "0x9dba7f426b711d4893c11611eacf7cc334e7146b",
+        "account": "0xc4a590afa7337e5cd5eb3aa60cacf91c5400044b",
         "address": "0x1eff47bc3a10a45d4b230b5d10e37751fe6aa718",
         "chainId": 4217n,
-        "isAdmin": false,
         "signature": {
-          "account": "0x9dba7f426b711d4893c11611eacf7cc334e7146b",
+          "account": "0xc4a590afa7337e5cd5eb3aa60cacf91c5400044b",
           "config": {
             "owners": [
               {
@@ -2544,11 +2602,11 @@ describe('admin keys (TIP-1049)', () => {
     expect((authTuple as unknown as unknown[]).length).toBe(3)
   })
 
-  test('fromTuple: drops orphan isAdmin without account', () => {
+  test('fromTuple: preserves isAdmin without account', () => {
     const restored = KeyAuthorization.fromTuple([
       ['0x01', '0x', address, '0x', [], [], '0x', '0x01'],
     ])
-    expect(restored.isAdmin).toBeUndefined()
+    expect(restored.isAdmin).toBe(true)
     expect(restored.account).toBeUndefined()
   })
 
@@ -2556,7 +2614,7 @@ describe('admin keys (TIP-1049)', () => {
     const restored = KeyAuthorization.fromTuple([
       ['0x01', '0x', address, '0x', [], [], '0x', '0x', account],
     ])
-    expect(restored.isAdmin).toBe(false)
+    expect(restored.isAdmin).toBeUndefined()
     expect(restored.account).toBe(account)
   })
 
@@ -2602,7 +2660,7 @@ describe('admin keys (TIP-1049)', () => {
     })
     const serialized = KeyAuthorization.serialize(authorization)
     const restored = KeyAuthorization.deserialize(serialized)
-    expect(restored.isAdmin).toBe(false)
+    expect(restored.isAdmin).toBeUndefined()
     expect(restored.account).toBe(account)
   })
 
@@ -2625,14 +2683,14 @@ describe('admin keys (TIP-1049)', () => {
     expect(restored.account).toBe(account)
   })
 
-  test('fromRpc: drops orphan isAdmin without account', () => {
+  test('fromRpc: preserves isAdmin without account', () => {
     const authorization = KeyAuthorization.from(
       { address, chainId: 1n, type: 'secp256k1' },
       { signature: SignatureEnvelope.from(signature_secp256k1) },
     )
     const rpc = KeyAuthorization.toRpc(authorization)
     const restored = KeyAuthorization.fromRpc({ ...rpc, isAdmin: true })
-    expect(restored.isAdmin).toBeUndefined()
+    expect(restored.isAdmin).toBe(true)
     expect(restored.account).toBeUndefined()
   })
 
@@ -2643,7 +2701,7 @@ describe('admin keys (TIP-1049)', () => {
     )
     const rpc = KeyAuthorization.toRpc(authorization)
     const restored = KeyAuthorization.fromRpc({ ...rpc, account })
-    expect(restored.isAdmin).toBe(false)
+    expect(restored.isAdmin).toBeUndefined()
     expect(restored.account).toBe(account)
   })