ox 1.8.7 → 1.8.9

package/src/tempo/AccountSimulation.ts

@@ -28,6 +28,8 @@ export type Rpc = Compute<{
   approvals: readonly ApprovalRpc[]
   /** Canonical RLP-encoded applicable configuration. */
   config: Hex.Hex
+  /** Account that signs the modeled key authorization. Omitted for a direct signature. */
+  signer?: Address.Address | undefined
 }>
 
 /** Account simulation spec used to construct an RPC simulation signature. */
@@ -36,6 +38,8 @@ export type Spec = Compute<{
   approvals: readonly Approval[]
   /** Complete applicable configuration. */
   config: AccountConfig.Config
+  /** Account that signs the modeled key authorization. Omitted for a direct signature. */
+  signer?: Address.Address | undefined
 }>
 
 /**
@@ -53,14 +57,20 @@ export type Spec = Compute<{
  * @returns The account simulation spec with decoded configurations.
  */
 export function fromRpc(spec: Rpc): Spec {
-  const { approvals, config } = spec
+  const { approvals, config, signer } = spec
   assertApprovals(approvals)
-  return { approvals, config: deserializeConfig(config) }
+  if (signer !== undefined) Address.assert(signer)
+  return {
+    approvals,
+    config: deserializeConfig(config),
+    ...(signer !== undefined ? { signer } : {}),
+  }
 }
 
 export declare namespace fromRpc {
   /** Error type for `fromRpc`. */
   export type ErrorType =
+    | Address.assert.ErrorType
     | Hex.isEqual.ErrorType
     | InvalidSimulationError
     | AccountConfig.assert.ErrorType
@@ -84,8 +94,9 @@ export declare namespace fromRpc {
  * @returns The JSON-RPC account simulation spec with encoded configurations.
  */
 export function toRpc(spec: Spec): Rpc {
-  const { approvals, config } = spec
+  const { approvals, config, signer } = spec
   assertApprovals(approvals)
+  if (signer !== undefined) Address.assert(signer)
   return {
     approvals: approvals.map(({ keyData, keyType, owner }) => ({
       ...(keyData !== undefined ? { keyData: shimKeyData(keyData) } : {}),
@@ -93,12 +104,14 @@ export function toRpc(spec: Spec): Rpc {
       owner,
     })),
     config: serializeConfig(config),
+    ...(signer !== undefined ? { signer } : {}),
   }
 }
 
 export declare namespace toRpc {
   /** Error type for `toRpc`. */
   export type ErrorType =
+    | Address.assert.ErrorType
     | Hex.fromNumber.ErrorType
     | InvalidSimulationError
     | AccountConfig.assert.ErrorType
@@ -164,12 +177,13 @@ function serializeConfig(config: AccountConfig.Input): Hex.Hex {
 }
 
 /**
- * Shims long key data into the length hint accepted by Tempo's gas estimator.
+ * Shims key data into the 1-, 2-, or 4-byte length hint accepted by Tempo's
+ * gas estimator. Other sizes are replaced by a 2-byte hint of their length.
  * @internal
  */
 function shimKeyData(data: Hex.Hex): Hex.Hex {
   const size = Hex.size(data)
-  if (size <= 4) return data
+  if (size === 1 || size === 2 || size === 4) return data
   return Hex.fromNumber(size, { size: 2 })
 }
 

package/src/tempo/KeyAuthorization.test.ts

@@ -96,42 +96,80 @@ const signature_keychain = {
 } as const satisfies SignatureEnvelope.Keychain
 
 describe('configurable account binding', () => {
-  test('rejects unbound grants before signing or encoding', () => {
-    const authorization = {
-      address,
-      chainId: 1n,
-      type: 'configurable',
-    } as const
-    const signed = {
-      ...authorization,
-      signature: SignatureEnvelope.from(signature_secp256k1),
-    }
-    for (const encode of [
-      () => KeyAuthorization.from(authorization),
-      () => KeyAuthorization.toTuple(authorization),
-      () => KeyAuthorization.getSignPayload(authorization),
-      () => KeyAuthorization.serialize(authorization),
-      () => KeyAuthorization.toRpc(signed),
-    ])
-      expect(encode).toThrowErrorMatchingInlineSnapshot(
-        `[KeyAuthorization.MissingAccountError: Configurable account key grants require a parent account binding.]`,
-      )
+  test('behavior: accepts unbound configurable grants', () => {
+    // The node binds a root-signed grant to its signer, so only admin-signed
+    // grants need `account` (TIP-1049).
+    const signed = KeyAuthorization.from(
+      { address, chainId: 1n, type: 'configurable' },
+      { signature: signature_secp256k1 },
+    )
+    const rpc = KeyAuthorization.toRpc(signed)
+    expect({
+      deserialized: KeyAuthorization.deserialize(
+        KeyAuthorization.serialize(signed),
+      ),
+      fromRpc: KeyAuthorization.fromRpc(rpc),
+      fromTuple: KeyAuthorization.fromTuple([['0x01', '0x03', address]]),
+      rpc,
+    }).toMatchInlineSnapshot(`
+      {
+        "deserialized": {
+          "address": "0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c",
+          "chainId": 1n,
+          "signature": {
+            "signature": {
+              "r": "0xfa78c5905fb0b9d6066ef531f962a62bc6ef0d5eb59ecb134056d206f75aaed7",
+              "s": "0x780926ff2601a935c2c79707d9e1799948c9f19dcdde1e090e903b19a07923d0",
+              "yParity": 1,
+            },
+            "type": "secp256k1",
+          },
+          "type": "configurable",
+        },
+        "fromRpc": {
+          "address": "0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c",
+          "chainId": 1n,
+          "limits": undefined,
+          "signature": {
+            "signature": {
+              "r": "0xfa78c5905fb0b9d6066ef531f962a62bc6ef0d5eb59ecb134056d206f75aaed7",
+              "s": "0x780926ff2601a935c2c79707d9e1799948c9f19dcdde1e090e903b19a07923d0",
+              "yParity": 1,
+            },
+            "type": "secp256k1",
+          },
+          "type": "configurable",
+        },
+        "fromTuple": {
+          "address": "0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c",
+          "chainId": 1n,
+          "type": "configurable",
+        },
+        "rpc": {
+          "chainId": "0x1",
+          "expiry": null,
+          "keyId": "0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c",
+          "keyType": "configurableAccount",
+          "limits": undefined,
+          "signature": {
+            "r": "0xfa78c5905fb0b9d6066ef531f962a62bc6ef0d5eb59ecb134056d206f75aaed7",
+            "s": "0x780926ff2601a935c2c79707d9e1799948c9f19dcdde1e090e903b19a07923d0",
+            "type": "secp256k1",
+            "yParity": "0x1",
+          },
+        },
+      }
+    `)
   })
 
-  test('rejects unbound RPC and RLP grants', () => {
+  test('behavior: preserves a bound account', () => {
     const signed = KeyAuthorization.from(
       { account: address, address, chainId: 1n, type: 'configurable' },
       { signature: signature_secp256k1 },
     )
-    const rpc = KeyAuthorization.toRpc(signed)
-    for (const account of [undefined, null])
-      expect(() => KeyAuthorization.fromRpc({ ...rpc, account })).toThrowError(
-        KeyAuthorization.MissingAccountError,
-      )
-    expect(() =>
-      KeyAuthorization.fromTuple([['0x01', '0x03', address]]),
-    ).toThrowError(KeyAuthorization.MissingAccountError)
-    expect(KeyAuthorization.fromRpc(rpc).account).toBe(address)
+    expect(
+      KeyAuthorization.fromRpc(KeyAuthorization.toRpc(signed)).account,
+    ).toBe(address)
     expect(
       KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)).account,
     ).toBe(address)
@@ -1450,13 +1488,13 @@ describe('serialize', () => {
 })
 
 describe('toRpc', () => {
-  test('behavior: configurable key type uses the RPC multisig key type', () => {
+  test('behavior: configurable key type uses the RPC configurableAccount key type', () => {
     const authorization = KeyAuthorization.from(
       { account: address, address, chainId: 1n, type: 'configurable' },
       { signature: signature_secp256k1 },
     )
     const rpc = KeyAuthorization.toRpc(authorization)
-    expect(rpc.keyType).toMatchInlineSnapshot(`"multisig"`)
+    expect(rpc.keyType).toMatchInlineSnapshot(`"configurableAccount"`)
     expect(KeyAuthorization.fromRpc(rpc).type).toMatchInlineSnapshot(
       `"configurable"`,
     )
@@ -2818,4 +2856,25 @@ describe('admin keys (TIP-1049)', () => {
     })
     expect(KeyAuthorization.hash(a)).not.toBe(KeyAuthorization.hash(b))
   })
+
+  describe('configurable admin keys', () => {
+    test('behavior: a configurable account may sign or be granted an admin key', () => {
+      const signed = KeyAuthorization.from(
+        {
+          account: signature_configurable.account,
+          address,
+          chainId: 1n,
+          isAdmin: true,
+          type: 'configurable',
+        },
+        { signature: signature_configurable },
+      )
+      expect(
+        KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)),
+      ).toEqual(signed)
+      expect(
+        KeyAuthorization.fromRpc(KeyAuthorization.toRpc(signed)),
+      ).toMatchObject({ isAdmin: true, type: 'configurable' })
+    })
+  })
 })

package/src/tempo/KeyAuthorization.ts

@@ -38,7 +38,7 @@ export type KeyAuthorization<
   bigintType = bigint,
   numberType = number,
 > = {
-  /** Account address this authorization is bound to. Required for configurable account grants. */
+  /** Account address this authorization is bound to. Required when an admin access key signs the grant (TIP-1049). */
   account?: Address.Address | undefined
   /** Address derived from the public key of the key type. */
   address: Address.Address
@@ -116,8 +116,8 @@ export type Rpc = {
   isAdmin?: boolean | null | undefined
   /** Key identifier. */
   keyId: Address.Address
-  /** Key type. Configurable accounts use the node's `multisig` key type. */
-  keyType: SignatureEnvelope.Type | 'multisig'
+  /** Key type. Configurable accounts use the node's `configurableAccount` key type. */
+  keyType: SignatureEnvelope.Type | 'configurableAccount'
   /** Token spending limits (`null`/`undefined` = unlimited, `[]` = no spending allowed). */
   limits?: readonly RpcTokenLimit[] | null | undefined
   /** Primitive or configurable account signature authorizing this key. */
@@ -445,7 +445,6 @@ export function from<
   options: from.Options<signature> = {},
 ): from.ReturnType<authorization, signature> {
   if ('keyId' in authorization) return fromRpc(authorization as Rpc) as never
-  assertAccountBinding(authorization.type, authorization.account)
   const auth = authorization as KeyAuthorization & {
     limits?: readonly { limit: bigint; token: Address.Address }[]
     scopes?: readonly {
@@ -509,10 +508,7 @@ export declare namespace from {
             : {})
   >
 
-  type ErrorType =
-    | InvalidSignatureTypeError
-    | MissingAccountError
-    | Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 /**
@@ -551,8 +547,7 @@ export function fromRpc(authorization: Rpc): Signed {
   const witness = authorization.witness ?? undefined
   const isAdmin = authorization.isAdmin ?? undefined
   const account = authorization.account ?? undefined
-  const type = keyType === 'multisig' ? 'configurable' : keyType
-  assertAccountBinding(type, account)
+  const type = keyType === 'configurableAccount' ? 'configurable' : keyType
   const signature = SignatureEnvelope.fromRpc(authorization.signature)
   assertSignature(signature)
   if (witness !== undefined) assertWitness(witness)
@@ -595,10 +590,7 @@ export function fromRpc(authorization: Rpc): Signed {
 }
 
 export declare namespace fromRpc {
-  type ErrorType =
-    | InvalidSignatureTypeError
-    | MissingAccountError
-    | Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 /**
@@ -728,7 +720,6 @@ export function fromTuple<const tuple extends Tuple>(
   const account = isAbsent(rawAccount)
     ? undefined
     : (rawAccount as Address.Address)
-  assertAccountBinding(keyType, account)
   const args: KeyAuthorization = {
     address: keyId,
     chainId: chainId === '0x' ? 0n : Hex.toBigInt(chainId),
@@ -753,10 +744,7 @@ export declare namespace fromTuple {
     KeyAuthorization<authorization extends Tuple<true> ? true : false>
   >
 
-  type ErrorType =
-    | InvalidSignatureTypeError
-    | MissingAccountError
-    | Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 /**
@@ -962,7 +950,6 @@ export declare namespace serialize {
  * @returns An RPC-formatted Key Authorization.
  */
 export function toRpc(authorization: toRpc.Input): Rpc {
-  assertAccountBinding(authorization.type, authorization.account)
   const {
     address,
     scopes,
@@ -1008,7 +995,7 @@ export function toRpc(authorization: toRpc.Input): Rpc {
     chainId: chainIdHex === '0x0' ? '0x' : chainIdHex,
     expiry: expiry != null ? Quantity.fromNumberish(expiry) : null,
     keyId: address,
-    keyType: type === 'configurable' ? 'multisig' : type,
+    keyType: type === 'configurable' ? 'configurableAccount' : type,
     limits: limits?.map(({ token, limit, period }) => ({
       token,
       limit: Quantity.fromNumberish(limit),
@@ -1028,10 +1015,7 @@ export declare namespace toRpc {
   /** Numberish input accepted by {@link ox#KeyAuthorization.(toRpc:function)}. */
   type Input = Signed<Hex.Hex | bigint | number, Hex.Hex | number>
 
-  type ErrorType =
-    | InvalidSignatureTypeError
-    | MissingAccountError
-    | Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 /**
@@ -1070,7 +1054,6 @@ export declare namespace toRpc {
 export function toTuple<const authorization extends KeyAuthorization>(
   authorization: authorization,
 ): toTuple.ReturnType<authorization> {
-  assertAccountBinding(authorization.type, authorization.account)
   const {
     address,
     chainId,
@@ -1178,10 +1161,7 @@ export declare namespace toTuple {
   type ReturnType<authorization extends KeyAuthorization = KeyAuthorization> =
     Compute<Tuple<authorization extends KeyAuthorization<true> ? true : false>>
 
-  type ErrorType =
-    | InvalidSignatureTypeError
-    | MissingAccountError
-    | Errors.GlobalErrorType
+  type ErrorType = InvalidSignatureTypeError | Errors.GlobalErrorType
 }
 
 function bigintToHex(value: bigint): Hex.Hex {
@@ -1215,14 +1195,6 @@ function resolveSelector(
   return AbiItem.getSelector(selector)
 }
 
-function assertAccountBinding(
-  type: KeyAuthorization['type'],
-  account: Address.Address | null | undefined,
-): void {
-  if (type === 'configurable' && account == null)
-    throw new MissingAccountError()
-}
-
 function assertWitness(witness: Hex.Hex): void {
   if (Hex.size(witness) !== 32) throw new InvalidWitnessSizeError(witness)
 }
@@ -1270,7 +1242,12 @@ export class InvalidSignatureTypeError extends Error {
   }
 }
 
-/** Thrown when a configurable account key grant omits its parent account binding. */
+/**
+ * Thrown when a configurable account key grant omits its parent account binding.
+ *
+ * @deprecated No longer thrown. The Tempo node only requires `account` on grants
+ * signed by an admin access key, which it checks against the transaction sender.
+ */
 export class MissingAccountError extends Error {
   override readonly name = 'KeyAuthorization.MissingAccountError'
   constructor() {

package/src/tempo/RpcSchemaTempo.test-d.ts

@@ -17,7 +17,7 @@ declare const tempoProvider: Provider.Provider<{
 declare const address: Address.Address
 declare const hash: Hex.Hex
 declare const keyAuthorization: KeyAuthorization.Rpc
-declare const multisigSimulation: AccountSimulation.Rpc
+declare const configurableAccountSimulation: AccountSimulation.Rpc
 declare const serializedTransaction: Hex.Hex
 declare const signature: Hex.Hex
 
@@ -79,7 +79,7 @@ test('tempo simulation accepts account simulation specs', () => {
           {
             calls: [
               {
-                multisigSimulation,
+                configurableAccountSimulation,
               },
             ],
           },

package/src/tempo/TransactionRequest.test-d.ts

@@ -53,19 +53,19 @@ describe('TransactionRequest type', () => {
     expectTypeOf<
       TransactionRequest.TransactionRequest['accountSimulation']
     >().toEqualTypeOf<AccountSimulation.Spec | undefined>()
-    expectTypeOf<TransactionRequest.Rpc['multisigSimulation']>().toEqualTypeOf<
-      AccountSimulation.Rpc | undefined
-    >()
+    expectTypeOf<
+      TransactionRequest.Rpc['configurableAccountSimulation']
+    >().toEqualTypeOf<AccountSimulation.Rpc | undefined>()
   })
 
-  test('maps the configurable key type to the RPC multisig key type', () => {
+  test('maps the configurable key type to the RPC configurableAccount key type', () => {
     expectTypeOf<
       TransactionRequest.TransactionRequest['keyType']
     >().toEqualTypeOf<
       'configurable' | 'p256' | 'secp256k1' | 'webAuthn' | undefined
     >()
     expectTypeOf<TransactionRequest.Rpc['keyType']>().toEqualTypeOf<
-      'multisig' | 'p256' | 'secp256k1' | 'webAuthn' | undefined
+      'configurableAccount' | 'p256' | 'secp256k1' | 'webAuthn' | undefined
     >()
   })
 })

package/src/tempo/TransactionRequest.test.ts

@@ -139,9 +139,9 @@ describe('fromRpc', () => {
     `)
   })
 
-  test('behavior: multisig key type decodes as configurable', () => {
+  test('behavior: configurableAccount key type decodes as configurable', () => {
     const request = TransactionRequest.fromRpc({
-      keyType: 'multisig',
+      keyType: 'configurableAccount',
       type: '0x76',
     })
     expect(request.keyType).toMatchInlineSnapshot(`"configurable"`)
@@ -150,7 +150,7 @@ describe('fromRpc', () => {
   test('behavior: account simulation', () => {
     const request = TransactionRequest.fromRpc({
       from: '0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
-      multisigSimulation: accountSimulationRpc,
+      configurableAccountSimulation: accountSimulationRpc,
       type: '0x76',
     })
 
@@ -266,11 +266,11 @@ describe('toRpc', () => {
     `)
   })
 
-  test('behavior: configurable key type encodes as multisig', () => {
+  test('behavior: configurable key type encodes as configurableAccount', () => {
     const request = TransactionRequest.toRpc({
       keyType: 'configurable',
     })
-    expect(request.keyType).toMatchInlineSnapshot(`"multisig"`)
+    expect(request.keyType).toMatchInlineSnapshot(`"configurableAccount"`)
   })
 
   test('behavior: account simulation', () => {
@@ -288,8 +288,7 @@ describe('toRpc', () => {
             "value": "0x",
           },
         ],
-        "from": "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
-        "multisigSimulation": {
+        "configurableAccountSimulation": {
           "approvals": [
             {
               "keyData": "0x0005",
@@ -299,6 +298,7 @@ describe('toRpc', () => {
           ],
           "config": "0xf852a011111111111111111111111111111111111111111111111111111111111111118002eed694111111111111111111111111111111111111111101d694bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb01",
         },
+        "from": "0xaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
         "type": "0x76",
       }
     `)
@@ -445,7 +445,7 @@ describe('roundtrip', () => {
       nonceKey: '0xff',
       gas: '0x186a0',
       keyAuthorizationSimulation: accountSimulationRpc,
-      multisigSimulation: accountSimulationRpc,
+      configurableAccountSimulation: accountSimulationRpc,
       type: '0x76',
     }
 
@@ -461,7 +461,9 @@ describe('roundtrip', () => {
     expect(rpc.keyAuthorizationSimulation).toEqual(
       original.keyAuthorizationSimulation,
     )
-    expect(rpc.multisigSimulation).toEqual(original.multisigSimulation)
+    expect(rpc.configurableAccountSimulation).toEqual(
+      original.configurableAccountSimulation,
+    )
     expect(rpc.type).toBe('0x76')
   })
 })

package/src/tempo/TransactionRequest.ts

@@ -70,9 +70,9 @@ export type Rpc = Omit<
   feeToken?: Hex.Hex | undefined
   keyAuthorization?: KeyAuthorization.Rpc | undefined
   keyAuthorizationSimulation?: AccountSimulation.Rpc | undefined
-  /** Key type. Configurable accounts use the node's `multisig` key type. */
-  keyType?: SignatureEnvelope.Type | 'multisig' | undefined
-  multisigSimulation?: AccountSimulation.Rpc | undefined
+  /** Key type. Configurable accounts use the node's `configurableAccount` key type. */
+  keyType?: SignatureEnvelope.Type | 'configurableAccount' | undefined
+  configurableAccountSimulation?: AccountSimulation.Rpc | undefined
   nonceKey?: Hex.Hex | undefined
   signature?: SignatureEnvelope.SignatureEnvelopeRpc | undefined
 }
@@ -104,7 +104,7 @@ export function fromRpc(request: Rpc): TransactionRequest {
     authorizationList: _,
     keyAuthorizationSimulation: __,
     keyType: ___,
-    multisigSimulation: ____,
+    configurableAccountSimulation: ____,
     ...rest
   } = request
   const request_ = ox_TransactionRequest.fromRpc(
@@ -147,10 +147,12 @@ export function fromRpc(request: Rpc): TransactionRequest {
     )
   if (typeof request.keyType !== 'undefined')
     request_.keyType =
-      request.keyType === 'multisig' ? 'configurable' : request.keyType
-  if (request.multisigSimulation)
+      request.keyType === 'configurableAccount'
+        ? 'configurable'
+        : request.keyType
+  if (request.configurableAccountSimulation)
     request_.accountSimulation = AccountSimulation.fromRpc(
-      request.multisigSimulation,
+      request.configurableAccountSimulation,
     )
   if (typeof request.validBefore !== 'undefined')
     request_.validBefore = Hex.toNumber(request.validBefore as Hex.Hex)
@@ -292,13 +294,15 @@ export function toRpc(request: toRpc.Input): Rpc {
   if (typeof request.keyId !== 'undefined') request_rpc.keyId = request.keyId
   if (typeof request.keyType !== 'undefined')
     request_rpc.keyType =
-      request.keyType === 'configurable' ? 'multisig' : request.keyType
+      request.keyType === 'configurable'
+        ? 'configurableAccount'
+        : request.keyType
   if (typeof request.keyAuthorizationSimulation !== 'undefined')
     request_rpc.keyAuthorizationSimulation = AccountSimulation.toRpc(
       request.keyAuthorizationSimulation,
     )
   if (typeof request.accountSimulation !== 'undefined')
-    request_rpc.multisigSimulation = AccountSimulation.toRpc(
+    request_rpc.configurableAccountSimulation = AccountSimulation.toRpc(
       request.accountSimulation,
     )
   if (typeof request.validBefore !== 'undefined')

package/src/version.ts

@@ -1,2 +1,2 @@
 /** @internal */
-export const version = '1.8.7'
+export const version = '1.8.9'

package/src/zod/tempo/AccountSimulation.ts

@@ -21,6 +21,7 @@ export const Domain = z.object({
       .check(z.maxLength(core_AccountConfig.maxSignatures)),
   ),
   config: z_AccountConfig.Config,
+  signer: z.optional(z_Address.Address),
 })
 
 const Rpc_ = z
@@ -31,6 +32,7 @@ const Rpc_ = z
         .check(z.maxLength(core_AccountConfig.maxSignatures)),
     ),
     config: z_Hex.Hex,
+    signer: z.optional(z_Address.Address),
   })
   .check(
     z.refine((value) => {