ox 1.8.5 → 1.8.7

package/src/tempo/KeyAuthorization.test.ts

@@ -8,8 +8,8 @@ import {
   WebAuthnP256,
 } from 'ox'
 import { describe, expect, test } from 'vp/test'
+import * as AccountConfig from './AccountConfig.js'
 import * as KeyAuthorization from './KeyAuthorization.js'
-import * as MultisigConfig from './MultisigConfig.js'
 import * as Period from './Period.js'
 import * as SignatureEnvelope from './SignatureEnvelope.js'
 
@@ -17,6 +17,23 @@ const address = '0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c'
 const expiry = 1234567890
 const token = '0x20c0000000000000000000000000000000000001'
 
+// Unsigned RLP and hashes produced by the Tempo node's `KeyAuthorization::encode`
+// (`tempo-primitives`) for `address` on chain 1337.
+const limitsVectors = {
+  denyAll: {
+    hash: '0x647445af52e13830d879f11656840959bf7cffd26c5858b6e79696ef051e1115',
+    rlp: '0xdb8205398094be95c3f554e9fc85ec51be69a3d807a0d55bcf2c80c0',
+  },
+  scopedDenyAll: {
+    hash: '0xed04735d65180756db1cac8134ee53ed77737803902572beff10d5da03eab2cf',
+    rlp: '0xf38205398094be95c3f554e9fc85ec51be69a3d807a0d55bcf2c80c0d7d69420c0000000000000000000000000000000000001c0',
+  },
+  scopedUnlimited: {
+    hash: '0x4c30b56b178f44172feee4a80a27222101e19b72de396be4d764e2f4054f32d7',
+    rlp: '0xf38205398094be95c3f554e9fc85ec51be69a3d807a0d55bcf2c8080d7d69420c0000000000000000000000000000000000001c0',
+  },
+} as const
+
 const privateKey_secp256k1 =
   '0xac0974bec39a17e36ba4a6b4d238ff944bacb478cbed5efcae784d7bf4f2ff80'
 const signature_secp256k1 = Secp256k1.sign({
@@ -54,9 +71,9 @@ const signature_webauthn = SignatureEnvelope.from({
   },
 })
 
-const signature_multisig = {
+const signature_configurable = {
   account: address,
-  config: MultisigConfig.from({
+  config: AccountConfig.from({
     owners: [
       {
         owner: '0xf39fd6e51aad88f6f4ce6ab8827279cfffb92266',
@@ -67,9 +84,9 @@ const signature_multisig = {
     version: 1n,
   }),
   signatures: [SignatureEnvelope.from(signature_secp256k1)],
-  type: 'multisig',
-} as const satisfies SignatureEnvelope.Multisig
-const signature_multisig_rpc =
+  type: 'configurable',
+} as const satisfies SignatureEnvelope.Configurable
+const signature_configurable_rpc =
   '0xf89794be95c3f554e9fc85ec51be69a3d807a0d55bcf2cf83ba000000000000000000000000000000000000000000000000000000000000000000101d7d694f39fd6e51aad88f6f4ce6ab8827279cfffb9226601f843b841fa78c5905fb0b9d6066ef531f962a62bc6ef0d5eb59ecb134056d206f75aaed7780926ff2601a935c2c79707d9e1799948c9f19dcdde1e090e903b19a07923d01c' as const
 
 const signature_keychain = {
@@ -78,9 +95,13 @@ const signature_keychain = {
   userAddress: address,
 } as const satisfies SignatureEnvelope.Keychain
 
-describe('multisig account binding', () => {
+describe('configurable account binding', () => {
   test('rejects unbound grants before signing or encoding', () => {
-    const authorization = { address, chainId: 1n, type: 'multisig' } as const
+    const authorization = {
+      address,
+      chainId: 1n,
+      type: 'configurable',
+    } as const
     const signed = {
       ...authorization,
       signature: SignatureEnvelope.from(signature_secp256k1),
@@ -93,13 +114,13 @@ describe('multisig account binding', () => {
       () => KeyAuthorization.toRpc(signed),
     ])
       expect(encode).toThrowErrorMatchingInlineSnapshot(
-        `[KeyAuthorization.MissingAccountError: Multisig key grants require a parent account binding.]`,
+        `[KeyAuthorization.MissingAccountError: Configurable account key grants require a parent account binding.]`,
       )
   })
 
   test('rejects unbound RPC and RLP grants', () => {
     const signed = KeyAuthorization.from(
-      { account: address, address, chainId: 1n, type: 'multisig' },
+      { account: address, address, chainId: 1n, type: 'configurable' },
       { signature: signature_secp256k1 },
     )
     const rpc = KeyAuthorization.toRpc(signed)
@@ -118,15 +139,36 @@ describe('multisig account binding', () => {
 })
 
 describe('from', () => {
-  test('accepts multisig grants and delegates', () => {
+  test('behavior: limits encode like the Tempo node', () => {
+    const encode = (authorization: KeyAuthorization.KeyAuthorization) => ({
+      hash: KeyAuthorization.hash(authorization),
+      rlp: Rlp.fromHex(KeyAuthorization.toTuple(authorization)[0]),
+    })
+    const base = { address, chainId: 1337n, type: 'secp256k1' } as const
+    expect({
+      denyAll: encode(KeyAuthorization.from({ ...base, limits: [] })),
+      scopedDenyAll: encode(
+        KeyAuthorization.from({
+          ...base,
+          limits: [],
+          scopes: [{ address: token }],
+        }),
+      ),
+      scopedUnlimited: encode(
+        KeyAuthorization.from({ ...base, scopes: [{ address: token }] }),
+      ),
+    }).toEqual(limitsVectors)
+  })
+
+  test('accepts configurable grants and delegates', () => {
     const signed = KeyAuthorization.from(
       {
         address,
         chainId: 1n,
-        type: 'multisig',
-        account: signature_multisig.account,
+        type: 'configurable',
+        account: signature_configurable.account,
       },
-      { signature: signature_multisig },
+      { signature: signature_configurable },
     )
     expect(
       KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)),
@@ -501,7 +543,7 @@ describe('fromRpc', () => {
     `)
   })
 
-  test('with signature (multisig)', () => {
+  test('with signature (configurable)', () => {
     const authorization = KeyAuthorization.from({
       address,
       chainId: 1n,
@@ -509,20 +551,20 @@ describe('fromRpc', () => {
     })
 
     const signed = KeyAuthorization.from(authorization, {
-      signature: signature_multisig,
+      signature: signature_configurable,
     })
-    expect(signed.signature).toEqual(signature_multisig)
+    expect(signed.signature).toEqual(signature_configurable)
     expect(
       KeyAuthorization.from(authorization, {
-        signature: SignatureEnvelope.serialize(signature_multisig),
+        signature: SignatureEnvelope.serialize(signature_configurable),
       }).signature,
-    ).toEqual(signature_multisig)
+    ).toEqual(signature_configurable)
     expect(
       KeyAuthorization.from({
         ...authorization,
-        signature: signature_multisig,
+        signature: signature_configurable,
       }).signature,
-    ).toEqual(signature_multisig)
+    ).toEqual(signature_configurable)
     expect(
       KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)),
     ).toEqual(signed)
@@ -540,7 +582,7 @@ describe('fromRpc', () => {
         signature: signature_keychain as never,
       }),
     ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.]`,
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`configurable\`.]`,
     )
 
     expect(() =>
@@ -548,7 +590,7 @@ describe('fromRpc', () => {
         signature: SignatureEnvelope.serialize(signature_keychain),
       }),
     ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.]`,
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`configurable\`.]`,
     )
 
     expect(() =>
@@ -557,19 +599,19 @@ describe('fromRpc', () => {
         signature: signature_keychain,
       } as never),
     ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.]`,
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`configurable\`.]`,
     )
   })
 })
 
 describe('fromRpc', () => {
-  test('behavior: multisig', () => {
+  test('behavior: configurable', () => {
     const authorization = KeyAuthorization.fromRpc({
       chainId: '0x1',
       expiry: null,
       keyId: address,
       keyType: 'secp256k1',
-      signature: signature_multisig_rpc,
+      signature: signature_configurable_rpc,
     })
 
     expect(authorization.signature).toMatchInlineSnapshot(`
@@ -596,7 +638,7 @@ describe('fromRpc', () => {
             "type": "secp256k1",
           },
         ],
-        "type": "multisig",
+        "type": "configurable",
       }
     `)
   })
@@ -611,7 +653,7 @@ describe('fromRpc', () => {
         signature: SignatureEnvelope.toRpc(signature_keychain),
       } as never),
     ).toThrowErrorMatchingInlineSnapshot(
-      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.]`,
+      `[KeyAuthorization.InvalidSignatureTypeError: Signature type \`keychain\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`configurable\`.]`,
     )
   })
 
@@ -832,6 +874,22 @@ describe('fromRpc', () => {
 })
 
 describe('fromTuple', () => {
+  test('behavior: keeps absent and empty limits distinct', () => {
+    const decoded = Object.fromEntries(
+      Object.entries(limitsVectors).map(([name, { rlp }]) => [
+        name,
+        KeyAuthorization.fromTuple([Rlp.toHex(rlp) as never]).limits,
+      ]),
+    )
+    expect(decoded).toMatchInlineSnapshot(`
+      {
+        "denyAll": [],
+        "scopedDenyAll": [],
+        "scopedUnlimited": undefined,
+      }
+    `)
+  })
+
   test('default', () => {
     const authorization = KeyAuthorization.fromTuple([
       [
@@ -1169,7 +1227,7 @@ describe('getSignPayload', () => {
 })
 
 describe('deserialize', () => {
-  test('example: matches the frozen multisig witness vector', () => {
+  test('example: matches the frozen configurable witness vector', () => {
     const serialized =
       '0xf8f1f85382107980941eff47bc3a10a45d4b230b5d10e37751fe6aa718808080a053535353535353535353535353535353535353535353535353535353535353538094c4a590afa7337e5cd5eb3aa60cacf91c5400044bb89a05f89794c4a590afa7337e5cd5eb3aa60cacf91c5400044bf83ba000000000000000000000000000000000000000000000000000000000000000008001d7d6947e5f4552091a69125d5dfcb7b8c2659029395bdf01f843b8412cfed9350faf80e4115e3c4c967356b80a8e6ee42e4a49ab953c8c8a3537d8d8359bf035a9bea18f32b0da7129cdce3ce701abc09ad8919b93da21a0d57e21451b' as const
     const authorization = KeyAuthorization.deserialize(serialized)
@@ -1202,7 +1260,7 @@ describe('deserialize', () => {
               "type": "secp256k1",
             },
           ],
-          "type": "multisig",
+          "type": "configurable",
         },
         "type": "secp256k1",
         "witness": "0x5353535353535353535353535353535353535353535353535353535353535353",
@@ -1211,14 +1269,14 @@ describe('deserialize', () => {
     expect(KeyAuthorization.serialize(authorization)).toBe(serialized)
   })
 
-  test('multisig', () => {
+  test('configurable', () => {
     const serialized = Rlp.fromHex([
       ['0x1', '0x', address],
-      SignatureEnvelope.serialize(signature_multisig),
+      SignatureEnvelope.serialize(signature_configurable),
     ])
 
     expect(KeyAuthorization.deserialize(serialized).signature).toEqual(
-      signature_multisig,
+      signature_configurable,
     )
   })
 
@@ -1392,16 +1450,28 @@ describe('serialize', () => {
 })
 
 describe('toRpc', () => {
-  test('behavior: multisig', () => {
+  test('behavior: configurable key type uses the RPC multisig key type', () => {
+    const authorization = KeyAuthorization.from(
+      { account: address, address, chainId: 1n, type: 'configurable' },
+      { signature: signature_secp256k1 },
+    )
+    const rpc = KeyAuthorization.toRpc(authorization)
+    expect(rpc.keyType).toMatchInlineSnapshot(`"multisig"`)
+    expect(KeyAuthorization.fromRpc(rpc).type).toMatchInlineSnapshot(
+      `"configurable"`,
+    )
+  })
+
+  test('behavior: configurable', () => {
     const authorization = KeyAuthorization.toRpc({
       address,
       chainId: 1n,
-      signature: signature_multisig,
+      signature: signature_configurable,
       type: 'secp256k1',
     })
 
     expect(authorization.signature).toMatchInlineSnapshot(
-      `"${signature_multisig_rpc}"`,
+      `"${signature_configurable_rpc}"`,
     )
   })
 
@@ -1662,6 +1732,16 @@ describe('toRpc', () => {
 })
 
 describe('toTuple', () => {
+  test('behavior: round-trips Tempo node limits encoding', () => {
+    for (const { hash, rlp } of Object.values(limitsVectors)) {
+      const authorization = KeyAuthorization.fromTuple([
+        Rlp.toHex(rlp) as never,
+      ])
+      expect(Rlp.fromHex(KeyAuthorization.toTuple(authorization)[0])).toBe(rlp)
+      expect(KeyAuthorization.hash(authorization)).toBe(hash)
+    }
+  })
+
   test('default', () => {
     const authorization = KeyAuthorization.from({
       address,
@@ -2074,7 +2154,7 @@ describe('toTuple', () => {
           "0x",
           "0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c",
           "0x",
-          [],
+          "0x",
           [
             [
               "0x1234567890123456789012345678901234567890",

package/src/tempo/KeyAuthorization.ts

@@ -29,7 +29,7 @@ import * as SignatureEnvelope from './SignatureEnvelope.js'
  * - `chainId`: Chain ID for replay protection (0 = valid on any chain)
  * - `expiry`: Unix timestamp when the key expires (undefined = never expires)
  * - `limits`: Per-TIP-20 token spending limits (only applies to `transfer()` and `approve()` calls)
- * - `type`: Key type (`secp256k1`, `p256`, `webAuthn`, or `multisig`)
+ * - `type`: Key type (`secp256k1`, `p256`, `webAuthn`, or `configurable`)
  *
  * [Access Keys Specification](https://docs.tempo.xyz/protocol/transactions/spec-tempo-transaction#access-keys)
  */
@@ -38,7 +38,7 @@ export type KeyAuthorization<
   bigintType = bigint,
   numberType = number,
 > = {
-  /** Account address this authorization is bound to. Required for multisig grants. */
+  /** Account address this authorization is bound to. Required for configurable account grants. */
   account?: Address.Address | undefined
   /** Address derived from the public key of the key type. */
   address: Address.Address
@@ -48,7 +48,13 @@ export type KeyAuthorization<
   expiry?: numberType | null | undefined
   /** Whether this authorization provisions an admin access key. */
   isAdmin?: boolean | undefined
-  /** TIP20 spending limits for this key. */
+  /**
+   * TIP20 spending limits for this key.
+   *
+   * - `undefined` = unlimited spending
+   * - `[]` = no spending allowed
+   * - `[...]` = only listed token limits allowed
+   */
   limits?: readonly TokenLimit<bigintType, numberType>[] | undefined
   /**
    * Call scopes restricting which contracts/selectors this key can call.
@@ -58,8 +64,8 @@ export type KeyAuthorization<
    * - `[...]` = only listed contract+selector combinations allowed
    */
   scopes?: readonly Scope[] | undefined
-  /** Key type (secp256k1, P256, WebAuthn, or multisig). */
-  type: SignatureEnvelope.Type | 'multisig'
+  /** Key type (secp256k1, P256, WebAuthn, or configurable account). */
+  type: SignatureEnvelope.Type | 'configurable'
   /**
    * Optional 32-byte witness bound into the signing hash.
    *
@@ -74,23 +80,23 @@ export type KeyAuthorization<
   ? {
       signature:
         | SignatureEnvelope.Primitive<numberType>
-        | SignatureEnvelope.Multisig<numberType>
+        | SignatureEnvelope.Configurable<numberType>
     }
   : {
       signature?:
         | SignatureEnvelope.Primitive<numberType>
-        | SignatureEnvelope.Multisig<numberType>
+        | SignatureEnvelope.Configurable<numberType>
         | undefined
     })
 
 /** Signature that can authorize an access key. */
 export type Signature<numberType = number> =
   | SignatureEnvelope.Primitive<numberType>
-  | SignatureEnvelope.Multisig<numberType>
+  | SignatureEnvelope.Configurable<numberType>
 
 /** RPC-formatted signature that can authorize an access key. */
 export type SignatureRpc =
-  | SignatureEnvelope.MultisigRpc
+  | SignatureEnvelope.ConfigurableRpc
   | SignatureEnvelope.PrimitiveRpc
 
 /** Input type for a Key Authorization. */
@@ -110,12 +116,12 @@ export type Rpc = {
   isAdmin?: boolean | null | undefined
   /** Key identifier. */
   keyId: Address.Address
-  /** Key type. */
+  /** Key type. Configurable accounts use the node's `multisig` key type. */
   keyType: SignatureEnvelope.Type | 'multisig'
-  /** Token spending limits. */
+  /** Token spending limits (`null`/`undefined` = unlimited, `[]` = no spending allowed). */
   limits?: readonly RpcTokenLimit[] | null | undefined
-  /** Primitive or multisig signature authorizing this key. */
-  signature: SignatureEnvelope.PrimitiveRpc | SignatureEnvelope.MultisigRpc
+  /** Primitive or configurable account signature authorizing this key. */
+  signature: SignatureEnvelope.PrimitiveRpc | SignatureEnvelope.ConfigurableRpc
   /** Optional 32-byte witness (hex). */
   witness?: Hex.Hex | null | undefined
 }
@@ -147,9 +153,9 @@ export type Signed<bigintType = bigint, numberType = number> = KeyAuthorization<
 >
 
 type SignatureValue =
-  | SignatureEnvelope.from.MultisigFromConfig
+  | SignatureEnvelope.from.ConfigurableFromConfig
   | UnionPartialBy<SignatureEnvelope.Primitive, 'prehash' | 'type'>
-  | PartialBy<SignatureEnvelope.Multisig, 'type'>
+  | PartialBy<SignatureEnvelope.Configurable, 'type'>
   | SignatureEnvelope.Secp256k1Flat
   | SignatureEnvelope.Serialized
 
@@ -173,36 +179,42 @@ type CallScopeTuple = readonly [
   selectorRules: readonly SelectorRuleTuple[],
 ]
 
+/** Spending limits slot; `'0x'` (RLP null) when skipped before a later field. */
+type LimitsTuple = readonly TokenLimitTuple[] | '0x'
+
+/** Call scopes slot; `'0x'` (RLP null) when skipped before a later field. */
+type CallsTuple = readonly CallScopeTuple[] | '0x'
+
 type AuthorizationTuple =
   | BaseTuple
   | readonly [...BaseTuple, expiry: Hex.Hex]
-  | readonly [...BaseTuple, expiry: Hex.Hex, limits: readonly TokenLimitTuple[]]
+  | readonly [...BaseTuple, expiry: Hex.Hex, limits: LimitsTuple]
   | readonly [
       ...BaseTuple,
       expiry: Hex.Hex,
-      limits: readonly TokenLimitTuple[],
-      calls: readonly CallScopeTuple[],
+      limits: LimitsTuple,
+      calls: CallsTuple,
     ]
   | readonly [
       ...BaseTuple,
       expiry: Hex.Hex,
-      limits: readonly TokenLimitTuple[],
-      calls: readonly CallScopeTuple[],
+      limits: LimitsTuple,
+      calls: CallsTuple,
       witness: Hex.Hex,
     ]
   | readonly [
       ...BaseTuple,
       expiry: Hex.Hex,
-      limits: readonly TokenLimitTuple[],
-      calls: readonly CallScopeTuple[],
+      limits: LimitsTuple,
+      calls: CallsTuple,
       witness: Hex.Hex,
       isAdmin: Hex.Hex,
     ]
   | readonly [
       ...BaseTuple,
       expiry: Hex.Hex,
-      limits: readonly TokenLimitTuple[],
-      calls: readonly CallScopeTuple[],
+      limits: LimitsTuple,
+      calls: CallsTuple,
       witness: Hex.Hex,
       isAdmin: Hex.Hex,
       account: Address.Address,
@@ -472,11 +484,11 @@ export declare namespace from {
   type Options<
     signature extends SignatureValue | undefined = SignatureValue | undefined,
   > = {
-    /** The primitive or multisig signature to attach to the Key Authorization. */
+    /** The primitive or configurable account signature to attach to the Key Authorization. */
     signature?:
       | signature
       | SignatureEnvelope.Primitive
-      | SignatureEnvelope.Multisig
+      | SignatureEnvelope.Configurable
       | undefined
   }
 
@@ -491,7 +503,7 @@ export declare namespace from {
             ? {
                 signature: Extract<
                   SignatureEnvelope.from.ReturnValue<signature>,
-                  SignatureEnvelope.Primitive | SignatureEnvelope.Multisig
+                  SignatureEnvelope.Primitive | SignatureEnvelope.Configurable
                 >
               }
             : {})
@@ -539,7 +551,8 @@ export function fromRpc(authorization: Rpc): Signed {
   const witness = authorization.witness ?? undefined
   const isAdmin = authorization.isAdmin ?? undefined
   const account = authorization.account ?? undefined
-  assertAccountBinding(keyType, account)
+  const type = keyType === 'multisig' ? 'configurable' : keyType
+  assertAccountBinding(type, account)
   const signature = SignatureEnvelope.fromRpc(authorization.signature)
   assertSignature(signature)
   if (witness !== undefined) assertWitness(witness)
@@ -574,7 +587,7 @@ export function fromRpc(authorization: Rpc): Signed {
     })),
     ...(scopes ? { scopes } : {}),
     signature,
-    type: keyType,
+    type,
     ...(witness !== undefined ? { witness } : {}),
     ...(account !== undefined ? { account } : {}),
     ...(isAdmin ? { isAdmin: true as const } : {}),
@@ -658,7 +671,7 @@ export function fromTuple<const tuple extends Tuple>(
       case '0x02':
         return 'webAuthn'
       case '0x03':
-        return 'multisig'
+        return 'configurable'
       default:
         throw new Error(`Invalid key type: ${keyType_hex}`)
     }
@@ -671,17 +684,18 @@ export function fromTuple<const tuple extends Tuple>(
   const expiry = isAbsent(rawExpiry)
     ? undefined
     : hexToNumber(rawExpiry as Hex.Hex) || undefined
-  const limits =
-    Array.isArray(rawLimits) && rawLimits.length > 0
-      ? rawLimits.map((limitTuple: any) => {
-          const [token, limit, period] = limitTuple
-          return {
-            token,
-            limit: hexToBigint(limit),
-            ...(period !== undefined ? { period: hexToNumber(period) } : {}),
-          }
-        })
-      : undefined
+  // An empty list (`0xc0`) is an explicit deny-all, distinct from an absent
+  // field (`0x80` or omitted), which leaves spending unlimited.
+  const limits = Array.isArray(rawLimits)
+    ? rawLimits.map((limitTuple: any) => {
+        const [token, limit, period] = limitTuple
+        return {
+          token,
+          limit: hexToBigint(limit),
+          ...(period !== undefined ? { period: hexToNumber(period) } : {}),
+        }
+      })
+    : undefined
   const scopes = Array.isArray(rawScopes)
     ? rawScopes.flatMap((scopeTuple: any) => {
         const [address, selectorRules] = scopeTuple
@@ -994,7 +1008,7 @@ export function toRpc(authorization: toRpc.Input): Rpc {
     chainId: chainIdHex === '0x0' ? '0x' : chainIdHex,
     expiry: expiry != null ? Quantity.fromNumberish(expiry) : null,
     keyId: address,
-    keyType: type,
+    keyType: type === 'configurable' ? 'multisig' : type,
     limits: limits?.map(({ token, limit, period }) => ({
       token,
       limit: Quantity.fromNumberish(limit),
@@ -1002,7 +1016,7 @@ export function toRpc(authorization: toRpc.Input): Rpc {
     })),
     signature: SignatureEnvelope.toRpc(signature) as
       | SignatureEnvelope.PrimitiveRpc
-      | SignatureEnvelope.MultisigRpc,
+      | SignatureEnvelope.ConfigurableRpc,
     ...(allowedCalls ? { allowedCalls } : {}),
     ...(witness !== undefined ? { witness } : {}),
     ...(isAdmin ? { isAdmin: true } : {}),
@@ -1081,7 +1095,7 @@ export function toTuple<const authorization extends KeyAuthorization>(
         return '0x01'
       case 'webAuthn':
         return '0x02'
-      case 'multisig':
+      case 'configurable':
         return '0x03'
       default:
         throw new Error(`Invalid key type: ${authorization.type}`)
@@ -1121,18 +1135,12 @@ export function toTuple<const authorization extends KeyAuthorization>(
   // Optional trailing fields in wire order. Each entry's `placeholder` is
   // emitted when this field is skipped but a later field is present.
   //
-  // Placeholder convention:
-  // - `'0x'` (RLP null) is the canonical placeholder for fields added at or
-  //   after TIP-1053. The node decodes it as `None` (unrestricted).
-  // - `limits` keeps `[]` as its skipped placeholder for pre-TIP-1053 wire
-  //   shapes — preserving byte-for-byte equivalence with signed payloads
-  //   produced before TIP-1053 was added. When any TIP-1053+ field is
-  //   present, the canonical `'0x'` placeholder is used instead.
+  // `'0x'` (RLP null) is the canonical placeholder: the node decodes it as
+  // `None` (unrestricted). An empty list would decode as `Some([])`, so a
+  // skipped `limits` must never use `[]` (that reads as deny-all spending).
   //
   // To add a new optional trailing field (e.g. from a future TIP): append a
   // single entry to this list with `placeholder: '0x'`.
-  const hasTip1053Plus =
-    witness !== undefined || isAdmin || account !== undefined
   const optionals: readonly { placeholder: unknown; value: unknown }[] = [
     {
       value:
@@ -1143,7 +1151,7 @@ export function toTuple<const authorization extends KeyAuthorization>(
     },
     {
       value: limitsValue,
-      placeholder: hasTip1053Plus ? '0x' : [],
+      placeholder: '0x',
     },
     { value: callsValue, placeholder: '0x' },
     { value: witness, placeholder: '0x' },
@@ -1211,7 +1219,8 @@ function assertAccountBinding(
   type: KeyAuthorization['type'],
   account: Address.Address | null | undefined,
 ): void {
-  if (type === 'multisig' && account == null) throw new MissingAccountError()
+  if (type === 'configurable' && account == null)
+    throw new MissingAccountError()
 }
 
 function assertWitness(witness: Hex.Hex): void {
@@ -1222,7 +1231,7 @@ function assertSignature<numberType>(
   signature: SignatureEnvelope.SignatureEnvelope<numberType>,
 ): asserts signature is
   | SignatureEnvelope.Primitive<numberType>
-  | SignatureEnvelope.Multisig<numberType> {
+  | SignatureEnvelope.Configurable<numberType> {
   if (signature.type === 'keychain')
     throw new InvalidSignatureTypeError(signature.type)
 }
@@ -1256,15 +1265,15 @@ export class InvalidSignatureTypeError extends Error {
   override readonly name = 'KeyAuthorization.InvalidSignatureTypeError'
   constructor(type: SignatureEnvelope.SignatureEnvelope['type']) {
     super(
-      `Signature type \`${type}\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`multisig\`.`,
+      `Signature type \`${type}\` is invalid for key authorizations; expected \`secp256k1\`, \`p256\`, \`webAuthn\`, or \`configurable\`.`,
     )
   }
 }
 
-/** Thrown when a multisig key grant omits its parent account binding. */
+/** Thrown when a configurable account key grant omits its parent account binding. */
 export class MissingAccountError extends Error {
   override readonly name = 'KeyAuthorization.MissingAccountError'
   constructor() {
-    super('Multisig key grants require a parent account binding.')
+    super('Configurable account key grants require a parent account binding.')
   }
 }