ox 1.8.8 → 1.8.9

package/src/tempo/AccountConfig.ts

@@ -33,17 +33,25 @@ export const signatureTypeByte = '0x05' as const
 export const zeroSalt = `0x${'00'.repeat(32)}` as const
 
 /** Domain prefix for the configurable account address derivation. */
-const accountDomain = 'tempo:multisig:account'
+const accountDomain = 'tempo:configurable-account:account'
 
 /** Domain prefix for account configuration commitments. */
-const configDomain = 'tempo:multisig:config'
+const configDomain = 'tempo:configurable-account:config'
 
-/** Keccak-256 of the canonical recovery wallet creation code. */
-const recoveryWalletInitCodeHash =
+/**
+ * Keccak-256 of the account proxy creation code.
+ *
+ * Placeholder until [TIP-1110](https://tips.sh/1110) fixes the canonical
+ * account proxy, which will change every derived address.
+ */
+const accountProxyInitCodeHash =
   '0x583cc63a2e37f645b43eac911b1a6d6de08b83abdc308c61364edda8cfc3bd37'
 
 /** Domain prefix for configurable account owner approvals. */
-const signatureDomain = 'tempo:multisig:signature'
+const signatureDomain = 'tempo:configurable-account:signature'
+
+/** Domain prefix for the salt of an account migrated in place. */
+const upgradeDomain = 'tempo:configurable-account:upgrade'
 
 /**
  * Complete account configuration witness.
@@ -347,12 +355,75 @@ export function fromTuple(tuple: Tuple): Config {
   return config
 }
 
+/**
+ * Derives the configuration an existing account installs when it migrates in
+ * place with the `upgradeAccount` precompile call
+ * ([TIP-1113](https://tips.sh/1113)).
+ *
+ * The account keeps its address. Its salt is
+ * `keccak256("tempo:configurable-account:upgrade" || account)` and its version
+ * is `1n`. Owners are sorted into canonical order and the config is validated.
+ * The account itself may be listed as an owner.
+ *
+ * @example
+ * ```ts twoslash
+ * import { AccountConfig } from 'ox/tempo'
+ *
+ * const config = AccountConfig.fromUpgrade(
+ *   '0x3333333333333333333333333333333333333333',
+ *   {
+ *     owners: [
+ *       {
+ *         owner: '0x1111111111111111111111111111111111111111',
+ *         weight: 1
+ *       }
+ *     ],
+ *     threshold: 1
+ *   }
+ * )
+ * // config.version === 1n
+ * ```
+ *
+ * @param account - The account migrating in place.
+ * @param options - The owners and threshold to install.
+ * @returns The installed account config.
+ */
+export function fromUpgrade<numberType = number>(
+  account: Address.Address,
+  options: fromUpgrade.Options<numberType>,
+): Config<1n, numberType> {
+  Address.assert(account)
+  return from({
+    owners: options.owners,
+    salt: Hash.keccak256(Hex.concat(Hex.fromString(upgradeDomain), account)),
+    threshold: options.threshold,
+    version: 1n,
+  })
+}
+
+export declare namespace fromUpgrade {
+  type Options<numberType = number> = {
+    /** Weighted owners to install. Sorted into canonical order. */
+    owners: readonly Owner<numberType>[]
+    /** Minimum total owner weight required for authorization. */
+    threshold: numberType
+  }
+
+  type ErrorType =
+    | Address.assert.ErrorType
+    | assert.ErrorType
+    | Hash.keccak256.ErrorType
+    | Hex.concat.ErrorType
+    | Hex.fromString.ErrorType
+    | Errors.GlobalErrorType
+}
+
 /**
  * Derives the stable configurable account address.
  *
  * The initial config is hashed into a CREATE2 salt using fixed-width
  * big-endian fields, not RLP. The account uses the chain-configured recovery
- * factory and wallet init-code hash.
+ * factory and account proxy init-code hash.
  *
  * The address is derived once from the initial version-0 config. Config
  * updates do not change it.
@@ -403,7 +474,7 @@ export function getAddress(
     ),
   )
   const account = ContractAddress.fromCreate2({
-    bytecodeHash: recoveryWalletInitCodeHash,
+    bytecodeHash: accountProxyInitCodeHash,
     from: options.factory,
     salt: accountSalt,
   })
@@ -436,7 +507,7 @@ export declare namespace getAddress {
  * Computes the commitment for an account configuration.
  *
  * The commitment uses raw fixed-width fields, not RLP or ABI encoding:
- * `keccak256("tempo:multisig:config" || salt || uint64be(version) || uint8(threshold) || uint8(owners.length) || owners)`.
+ * `keccak256("tempo:configurable-account:config" || salt || uint64be(version) || uint8(threshold) || uint8(owners.length) || owners)`.
  *
  * @example
  * ```ts twoslash
@@ -487,7 +558,7 @@ export declare namespace getCommitment {
 /**
  * Computes the digest a configurable account owner approves (signs).
  *
- * `keccak256("tempo:multisig:signature" || inner_digest || account || uint64be(version))`,
+ * `keccak256("tempo:configurable-account:signature" || inner_digest || account || uint64be(version))`,
  * where `inner_digest` is the transaction sign payload
  * ({@link ox#TxEnvelopeTempo.(getSignPayload:function)}).
  *

package/src/tempo/AccountOperation.test.ts

@@ -153,8 +153,8 @@ describe('getHash', () => {
       }),
     }).toMatchInlineSnapshot(`
       {
-        "keyAuthorization": "0xa83016f0e94c4a6125483ffeba3abb0a8df1bc0f5a503f63639e806b793520bb",
-        "transaction": "0x2d7e3c7c38a9acf85f0a9d70a39b0e9e5a05d92c7a73b633a47a45be4a112b3b",
+        "keyAuthorization": "0xd18f389ae23bdc81939861c9a1079201968a2ec5fbd67ad1063556b46af8914f",
+        "transaction": "0x246027f7c6940fb4b68a746c49819c1c45737aa6c975aafcce721b4a619a9ab1",
       }
     `)
   })
@@ -345,14 +345,14 @@ describe('serializeKeyAuthorization', () => {
     expect(results).toMatchInlineSnapshot(`
       [
         {
-          "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
-          "hash": "0xcd4283709cc1853dc8ed9cc4dd8c3b6a22e1b01f19ad3f6348f4bebe79590408",
+          "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
+          "hash": "0x8d72c92f8aca5cf651ff914a928a32b1717e51b70fce97e305aaab02617474f5",
           "signatureCount": 2,
           "version": 1n,
         },
         {
-          "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
-          "hash": "0x1f66e6adc4ddf8ac9d4575f518be11509ca616ac13d4e0a286b4eef7b96959f2",
+          "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
+          "hash": "0x1dce79ae000bb60526cbe3b18be29d517319ee0958b01e5e3e89608e19c13459",
           "signatureCount": 2,
           "version": 0n,
         },
@@ -446,15 +446,15 @@ describe('serializeTransaction', () => {
     expect(results).toMatchInlineSnapshot(`
       [
         {
-          "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
-          "hash": "0x6a034f208339f7eaa4a42b3fa03aad5df77ebe83659dac2e4d2b11226d221928",
+          "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
+          "hash": "0x75106153400c34efbeb7380828e3fef939340eb0a3a42dda6a22f798f94665d0",
           "signatureCount": 2,
           "type": "0x76",
           "version": 1n,
         },
         {
-          "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
-          "hash": "0x04d36e54d7a816b080dfa03370da6fbeb3523ce3eff5211d7f22a3c7e87476ee",
+          "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
+          "hash": "0x2718b956492b1f8ff4e25165ac425e9e7064580b76eb087ce764e263723152bc",
           "signatureCount": 2,
           "type": "0x76",
           "version": 0n,
@@ -535,7 +535,7 @@ describe('serializeTransaction', () => {
       [
         {
           "feePayerSignature": null,
-          "from": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
+          "from": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
           "signatureCount": 2,
           "type": "0x78",
         },
@@ -545,7 +545,7 @@ describe('serializeTransaction', () => {
             "s": "0x0000000000000000000000000000000000000000000000000000000000000006",
             "yParity": 0,
           },
-          "from": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
+          "from": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
           "signatureCount": 2,
           "type": "0x78",
         },
@@ -617,7 +617,7 @@ describe('from', () => {
     expect({ pending, submitting, success }).toMatchInlineSnapshot(`
       {
         "pending": {
-          "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
+          "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
           "approvals": [
             "0x01000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200",
           ],
@@ -637,7 +637,7 @@ describe('from', () => {
             "version": 1n,
           },
           "createdAt": 1,
-          "hash": "0x2d7e3c7c38a9acf85f0a9d70a39b0e9e5a05d92c7a73b633a47a45be4a112b3b",
+          "hash": "0x246027f7c6940fb4b68a746c49819c1c45737aa6c975aafcce721b4a619a9ab1",
           "signatureCount": 1,
           "status": "pending",
           "threshold": 2,
@@ -647,7 +647,7 @@ describe('from', () => {
           "weight": 1,
         },
         "submitting": {
-          "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
+          "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
           "approvals": [
             "0x01000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200",
             "0x01000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000047cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997807775510db8ed040293d9ac69f7430dbba7dade63ce982299e04b79d227873d100",
@@ -669,7 +669,7 @@ describe('from', () => {
           },
           "createdAt": 1,
           "expiresAt": 10,
-          "hash": "0x2d7e3c7c38a9acf85f0a9d70a39b0e9e5a05d92c7a73b633a47a45be4a112b3b",
+          "hash": "0x246027f7c6940fb4b68a746c49819c1c45737aa6c975aafcce721b4a619a9ab1",
           "signatureCount": 2,
           "status": "submitting",
           "submissionId": "0xbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb",
@@ -680,7 +680,7 @@ describe('from', () => {
           "weight": 2,
         },
         "success": {
-          "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
+          "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
           "approvals": [
             "0x01000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200",
             "0x01000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000047cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997807775510db8ed040293d9ac69f7430dbba7dade63ce982299e04b79d227873d100",
@@ -701,7 +701,7 @@ describe('from', () => {
             "version": 1n,
           },
           "createdAt": 1,
-          "hash": "0x2d7e3c7c38a9acf85f0a9d70a39b0e9e5a05d92c7a73b633a47a45be4a112b3b",
+          "hash": "0x246027f7c6940fb4b68a746c49819c1c45737aa6c975aafcce721b4a619a9ab1",
           "signatureCount": 2,
           "status": "success",
           "threshold": 2,
@@ -747,7 +747,7 @@ describe('from', () => {
       },
       `
       {
-        "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
+        "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
         "approvals": [
           "0x01000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200",
         ],
@@ -833,7 +833,7 @@ describe('from', () => {
       },
       `
       {
-        "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
+        "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
         "approvals": [
           "0x01000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200",
         ],
@@ -890,7 +890,7 @@ describe('from', () => {
     expect({ pending, success }).toMatchInlineSnapshot(`
       {
         "pending": {
-          "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
+          "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
           "approvals": [
             "0x01000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200",
           ],
@@ -910,8 +910,8 @@ describe('from', () => {
             "version": 1n,
           },
           "createdAt": 1,
-          "hash": "0xa83016f0e94c4a6125483ffeba3abb0a8df1bc0f5a503f63639e806b793520bb",
-          "keyAuthorization": "0xf838f782107980943333333333333333333333333333333333333333846b49d2008080808094ef6b17836e1b3647105c3084124485e3e1b0ab7f",
+          "hash": "0xd18f389ae23bdc81939861c9a1079201968a2ec5fbd67ad1063556b46af8914f",
+          "keyAuthorization": "0xf838f782107980943333333333333333333333333333333333333333846b49d20080808080940f8659dd87410f00a1668211ecda7ac7f9c9fd13",
           "signatureCount": 1,
           "status": "pending",
           "threshold": 2,
@@ -920,7 +920,7 @@ describe('from', () => {
           "weight": 1,
         },
         "success": {
-          "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
+          "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
           "approvals": [
             "0x01000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200",
             "0x01000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000047cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997807775510db8ed040293d9ac69f7430dbba7dade63ce982299e04b79d227873d100",
@@ -941,8 +941,8 @@ describe('from', () => {
             "version": 1n,
           },
           "createdAt": 1,
-          "hash": "0xa83016f0e94c4a6125483ffeba3abb0a8df1bc0f5a503f63639e806b793520bb",
-          "keyAuthorization": "0xf901b3f782107980943333333333333333333333333333333333333333846b49d2008080808094ef6b17836e1b3647105c3084124485e3e1b0ab7fb9017805f9017494ef6b17836e1b3647105c3084124485e3e1b0ab7ff852a000000000000000000000000000000000000000000000000000000000000000000102eed69407e1ed8ea0e9601e5546b0a03aed683df360140701d694288f0cd85005f34168f731a468aef268c2f9456f01f90108b88201000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200b88201000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000047cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997807775510db8ed040293d9ac69f7430dbba7dade63ce982299e04b79d227873d100",
+          "hash": "0xd18f389ae23bdc81939861c9a1079201968a2ec5fbd67ad1063556b46af8914f",
+          "keyAuthorization": "0xf901b3f782107980943333333333333333333333333333333333333333846b49d20080808080940f8659dd87410f00a1668211ecda7ac7f9c9fd13b9017805f90174940f8659dd87410f00a1668211ecda7ac7f9c9fd13f852a000000000000000000000000000000000000000000000000000000000000000000102eed69407e1ed8ea0e9601e5546b0a03aed683df360140701d694288f0cd85005f34168f731a468aef268c2f9456f01f90108b88201000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200b88201000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000047cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997807775510db8ed040293d9ac69f7430dbba7dade63ce982299e04b79d227873d100",
           "signatureCount": 2,
           "status": "success",
           "threshold": 2,
@@ -988,7 +988,7 @@ describe('from', () => {
       },
       `
       {
-        "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
+        "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
         "approvals": [
           "0x01000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200",
           "0x01000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000047cf27b188d034f7e8a52380304b51ac3c08969e277f21b35a60b48fc4766997807775510db8ed040293d9ac69f7430dbba7dade63ce982299e04b79d227873d100",
@@ -1034,7 +1034,7 @@ describe('RPC conversion', () => {
     expect({ keyAuthorizationRpc, transactionRpc }).toMatchInlineSnapshot(`
       {
         "keyAuthorizationRpc": {
-          "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
+          "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
           "approvals": [
             "0x01000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200",
           ],
@@ -1054,8 +1054,8 @@ describe('RPC conversion', () => {
             "version": "0x1",
           },
           "createdAt": 1,
-          "hash": "0xa83016f0e94c4a6125483ffeba3abb0a8df1bc0f5a503f63639e806b793520bb",
-          "keyAuthorization": "0xf838f782107980943333333333333333333333333333333333333333846b49d2008080808094ef6b17836e1b3647105c3084124485e3e1b0ab7f",
+          "hash": "0xd18f389ae23bdc81939861c9a1079201968a2ec5fbd67ad1063556b46af8914f",
+          "keyAuthorization": "0xf838f782107980943333333333333333333333333333333333333333846b49d20080808080940f8659dd87410f00a1668211ecda7ac7f9c9fd13",
           "signatureCount": 1,
           "status": "pending",
           "threshold": 2,
@@ -1064,7 +1064,7 @@ describe('RPC conversion', () => {
           "weight": 1,
         },
         "transactionRpc": {
-          "account": "0xef6b17836e1b3647105c3084124485e3e1b0ab7f",
+          "account": "0x0f8659dd87410f00a1668211ecda7ac7f9c9fd13",
           "approvals": [
             "0x01000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000065ecbe4d1a6330a44c8f7ef951d4bf165e6c6b721efada985fb41661bc6e7fd6c8734640c4998ff7e374b06ce1a64a2ecd82ab036384fb83d9a79b127a27d503200",
           ],
@@ -1084,7 +1084,7 @@ describe('RPC conversion', () => {
             "version": "0x1",
           },
           "createdAt": 1,
-          "hash": "0x2d7e3c7c38a9acf85f0a9d70a39b0e9e5a05d92c7a73b633a47a45be4a112b3b",
+          "hash": "0x246027f7c6940fb4b68a746c49819c1c45737aa6c975aafcce721b4a619a9ab1",
           "signatureCount": 1,
           "status": "pending",
           "threshold": 2,

package/src/tempo/AccountSimulation.test.ts

@@ -113,6 +113,25 @@ describe('fromRpc', () => {
 })
 
 describe('toRpc', () => {
+  test('behavior: round-trips the grant signer', () => {
+    const signer = '0x2222222222222222222222222222222222222222'
+    const spec = AccountSimulation.fromRpc({ ...rpc, signer })
+    expect(spec.signer).toBe(signer)
+    expect(AccountSimulation.toRpc(spec).signer).toBe(signer)
+    expect(
+      'signer' in AccountSimulation.toRpc(AccountSimulation.fromRpc(rpc)),
+    ).toBe(false)
+  })
+
+  test('error: rejects an invalid grant signer', () => {
+    expect(() => AccountSimulation.fromRpc({ ...rpc, signer: '0x1234' }))
+      .toThrowErrorMatchingInlineSnapshot(`
+      [Address.InvalidAddressError: Address "0x1234" is invalid.
+
+      Details: Address is not a 20 byte (40 hexadecimal character) value.]
+    `)
+  })
+
   test('behavior: encodes configurations and shims long key data', () => {
     expect(AccountSimulation.toRpc(AccountSimulation.fromRpc(rpc)))
       .toMatchInlineSnapshot(`
@@ -146,6 +165,30 @@ describe('toRpc', () => {
     `)
   })
 
+  test('behavior: shims key data that is not a valid length hint', () => {
+    const keyData = (keyData: `0x${string}`) =>
+      AccountSimulation.toRpc(
+        AccountSimulation.fromRpc({
+          ...rpc,
+          approvals: [{ ...rpc.approvals[0], keyData }],
+        }),
+      ).approvals[0]?.keyData
+
+    expect({
+      empty: keyData('0x'),
+      four: keyData('0x01020304'),
+      one: keyData('0x01'),
+      three: keyData('0x010203'),
+    }).toMatchInlineSnapshot(`
+      {
+        "empty": "0x0000",
+        "four": "0x01020304",
+        "one": "0x01",
+        "three": "0x0003",
+      }
+    `)
+  })
+
   test('behavior: encodes the maximum uint64 configuration version', () => {
     const spec = AccountSimulation.fromRpc(rpc)
 

package/src/tempo/AccountSimulation.ts

@@ -28,6 +28,8 @@ export type Rpc = Compute<{
   approvals: readonly ApprovalRpc[]
   /** Canonical RLP-encoded applicable configuration. */
   config: Hex.Hex
+  /** Account that signs the modeled key authorization. Omitted for a direct signature. */
+  signer?: Address.Address | undefined
 }>
 
 /** Account simulation spec used to construct an RPC simulation signature. */
@@ -36,6 +38,8 @@ export type Spec = Compute<{
   approvals: readonly Approval[]
   /** Complete applicable configuration. */
   config: AccountConfig.Config
+  /** Account that signs the modeled key authorization. Omitted for a direct signature. */
+  signer?: Address.Address | undefined
 }>
 
 /**
@@ -53,14 +57,20 @@ export type Spec = Compute<{
  * @returns The account simulation spec with decoded configurations.
  */
 export function fromRpc(spec: Rpc): Spec {
-  const { approvals, config } = spec
+  const { approvals, config, signer } = spec
   assertApprovals(approvals)
-  return { approvals, config: deserializeConfig(config) }
+  if (signer !== undefined) Address.assert(signer)
+  return {
+    approvals,
+    config: deserializeConfig(config),
+    ...(signer !== undefined ? { signer } : {}),
+  }
 }
 
 export declare namespace fromRpc {
   /** Error type for `fromRpc`. */
   export type ErrorType =
+    | Address.assert.ErrorType
     | Hex.isEqual.ErrorType
     | InvalidSimulationError
     | AccountConfig.assert.ErrorType
@@ -84,8 +94,9 @@ export declare namespace fromRpc {
  * @returns The JSON-RPC account simulation spec with encoded configurations.
  */
 export function toRpc(spec: Spec): Rpc {
-  const { approvals, config } = spec
+  const { approvals, config, signer } = spec
   assertApprovals(approvals)
+  if (signer !== undefined) Address.assert(signer)
   return {
     approvals: approvals.map(({ keyData, keyType, owner }) => ({
       ...(keyData !== undefined ? { keyData: shimKeyData(keyData) } : {}),
@@ -93,12 +104,14 @@ export function toRpc(spec: Spec): Rpc {
       owner,
     })),
     config: serializeConfig(config),
+    ...(signer !== undefined ? { signer } : {}),
   }
 }
 
 export declare namespace toRpc {
   /** Error type for `toRpc`. */
   export type ErrorType =
+    | Address.assert.ErrorType
     | Hex.fromNumber.ErrorType
     | InvalidSimulationError
     | AccountConfig.assert.ErrorType
@@ -164,12 +177,13 @@ function serializeConfig(config: AccountConfig.Input): Hex.Hex {
 }
 
 /**
- * Shims long key data into the length hint accepted by Tempo's gas estimator.
+ * Shims key data into the 1-, 2-, or 4-byte length hint accepted by Tempo's
+ * gas estimator. Other sizes are replaced by a 2-byte hint of their length.
  * @internal
  */
 function shimKeyData(data: Hex.Hex): Hex.Hex {
   const size = Hex.size(data)
-  if (size <= 4) return data
+  if (size === 1 || size === 2 || size === 4) return data
   return Hex.fromNumber(size, { size: 2 })
 }
 

package/src/tempo/KeyAuthorization.test.ts

@@ -96,42 +96,80 @@ const signature_keychain = {
 } as const satisfies SignatureEnvelope.Keychain
 
 describe('configurable account binding', () => {
-  test('rejects unbound grants before signing or encoding', () => {
-    const authorization = {
-      address,
-      chainId: 1n,
-      type: 'configurable',
-    } as const
-    const signed = {
-      ...authorization,
-      signature: SignatureEnvelope.from(signature_secp256k1),
-    }
-    for (const encode of [
-      () => KeyAuthorization.from(authorization),
-      () => KeyAuthorization.toTuple(authorization),
-      () => KeyAuthorization.getSignPayload(authorization),
-      () => KeyAuthorization.serialize(authorization),
-      () => KeyAuthorization.toRpc(signed),
-    ])
-      expect(encode).toThrowErrorMatchingInlineSnapshot(
-        `[KeyAuthorization.MissingAccountError: Configurable account key grants require a parent account binding.]`,
-      )
+  test('behavior: accepts unbound configurable grants', () => {
+    // The node binds a root-signed grant to its signer, so only admin-signed
+    // grants need `account` (TIP-1049).
+    const signed = KeyAuthorization.from(
+      { address, chainId: 1n, type: 'configurable' },
+      { signature: signature_secp256k1 },
+    )
+    const rpc = KeyAuthorization.toRpc(signed)
+    expect({
+      deserialized: KeyAuthorization.deserialize(
+        KeyAuthorization.serialize(signed),
+      ),
+      fromRpc: KeyAuthorization.fromRpc(rpc),
+      fromTuple: KeyAuthorization.fromTuple([['0x01', '0x03', address]]),
+      rpc,
+    }).toMatchInlineSnapshot(`
+      {
+        "deserialized": {
+          "address": "0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c",
+          "chainId": 1n,
+          "signature": {
+            "signature": {
+              "r": "0xfa78c5905fb0b9d6066ef531f962a62bc6ef0d5eb59ecb134056d206f75aaed7",
+              "s": "0x780926ff2601a935c2c79707d9e1799948c9f19dcdde1e090e903b19a07923d0",
+              "yParity": 1,
+            },
+            "type": "secp256k1",
+          },
+          "type": "configurable",
+        },
+        "fromRpc": {
+          "address": "0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c",
+          "chainId": 1n,
+          "limits": undefined,
+          "signature": {
+            "signature": {
+              "r": "0xfa78c5905fb0b9d6066ef531f962a62bc6ef0d5eb59ecb134056d206f75aaed7",
+              "s": "0x780926ff2601a935c2c79707d9e1799948c9f19dcdde1e090e903b19a07923d0",
+              "yParity": 1,
+            },
+            "type": "secp256k1",
+          },
+          "type": "configurable",
+        },
+        "fromTuple": {
+          "address": "0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c",
+          "chainId": 1n,
+          "type": "configurable",
+        },
+        "rpc": {
+          "chainId": "0x1",
+          "expiry": null,
+          "keyId": "0xbe95c3f554e9fc85ec51be69a3d807a0d55bcf2c",
+          "keyType": "configurableAccount",
+          "limits": undefined,
+          "signature": {
+            "r": "0xfa78c5905fb0b9d6066ef531f962a62bc6ef0d5eb59ecb134056d206f75aaed7",
+            "s": "0x780926ff2601a935c2c79707d9e1799948c9f19dcdde1e090e903b19a07923d0",
+            "type": "secp256k1",
+            "yParity": "0x1",
+          },
+        },
+      }
+    `)
   })
 
-  test('rejects unbound RPC and RLP grants', () => {
+  test('behavior: preserves a bound account', () => {
     const signed = KeyAuthorization.from(
       { account: address, address, chainId: 1n, type: 'configurable' },
       { signature: signature_secp256k1 },
     )
-    const rpc = KeyAuthorization.toRpc(signed)
-    for (const account of [undefined, null])
-      expect(() => KeyAuthorization.fromRpc({ ...rpc, account })).toThrowError(
-        KeyAuthorization.MissingAccountError,
-      )
-    expect(() =>
-      KeyAuthorization.fromTuple([['0x01', '0x03', address]]),
-    ).toThrowError(KeyAuthorization.MissingAccountError)
-    expect(KeyAuthorization.fromRpc(rpc).account).toBe(address)
+    expect(
+      KeyAuthorization.fromRpc(KeyAuthorization.toRpc(signed)).account,
+    ).toBe(address)
     expect(
       KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)).account,
     ).toBe(address)
@@ -1450,13 +1488,13 @@ describe('serialize', () => {
 })
 
 describe('toRpc', () => {
-  test('behavior: configurable key type uses the RPC multisig key type', () => {
+  test('behavior: configurable key type uses the RPC configurableAccount key type', () => {
     const authorization = KeyAuthorization.from(
       { account: address, address, chainId: 1n, type: 'configurable' },
       { signature: signature_secp256k1 },
     )
     const rpc = KeyAuthorization.toRpc(authorization)
-    expect(rpc.keyType).toMatchInlineSnapshot(`"multisig"`)
+    expect(rpc.keyType).toMatchInlineSnapshot(`"configurableAccount"`)
     expect(KeyAuthorization.fromRpc(rpc).type).toMatchInlineSnapshot(
       `"configurable"`,
     )
@@ -2818,4 +2856,25 @@ describe('admin keys (TIP-1049)', () => {
     })
     expect(KeyAuthorization.hash(a)).not.toBe(KeyAuthorization.hash(b))
   })
+
+  describe('configurable admin keys', () => {
+    test('behavior: a configurable account may sign or be granted an admin key', () => {
+      const signed = KeyAuthorization.from(
+        {
+          account: signature_configurable.account,
+          address,
+          chainId: 1n,
+          isAdmin: true,
+          type: 'configurable',
+        },
+        { signature: signature_configurable },
+      )
+      expect(
+        KeyAuthorization.deserialize(KeyAuthorization.serialize(signed)),
+      ).toEqual(signed)
+      expect(
+        KeyAuthorization.fromRpc(KeyAuthorization.toRpc(signed)),
+      ).toMatchObject({ isAdmin: true, type: 'configurable' })
+    })
+  })
 })