feat(tempo): multisig (#5029)

* feat(tempo): support multisig mailbox approvals

* Update pending-tempo-multisig-receipts.md

* refactor(tempo): configure transaction envelopes

* fix(tempo): preserve portable chain declarations

* docs: update agent guidelines

* feat(tempo): add multisig operation store

* feat(tempo): add multisig approval actions

* feat(tempo): refine multisig approval flow

* feat(tempo): prepare multisig approval requests

* feat(tempo): add experimental multisig client option

* feat(tempo): coordinate multisig approvals with storage

* refactor(tempo): namespace multisig rpc methods

* fix(tempo): serialize stored multisig operation

* refactor(tempo): use transaction actions for multisig approvals

* docs(tempo): refine multisig transaction examples

* Delete .changeset/calm-mailboxes-coordinate.md

* chore: update ox to 0.14.36

* fix multisig approval preparation and tests

* update tempo transaction snapshots

* fix(tempo): harden multisig transaction coordination

* refactor(tempo): simplify multisig transport and receipt types

* chore: format multisig transport and update size limits

* docs(tempo): simplify multisig export annotation

* refactor(tempo): inline multisig polling helpers

* fix(test): reset sepolia fork in cross-chain test

* feat(tempo): add multisig operation RPCs

* refactor(tempo): use ox multisig operation helpers

* refactor(tempo): export multisig operations

* feat(tempo): add multisig transport

* docs(tempo): document multisig operations

* test(tempo): separate multisig owner approvals

* fix(tempo): harden multisig coordination

* refactor(tempo): rename storage utilities to store

* refactor(tempo): scope multisig submission derivation

* fix(tempo): correct multisig transaction coordination

* refactor(tempo): internalize operation serialization

* chore: update chain bundle limits

* fix(tempo): harden multisig coordination

* fix(tempo): settle multisig submissions

* fix(tempo): validate multisig submissions

* feat(tempo): support multisig config witnesses

* refactor(tempo): flatten multisig config inputs

* refactor(tempo): update multisig action interfaces

* fix(tempo): update multisig operations for ox 0.14.41

* ci: update Tempo multisig image

* feat(tempo): cache multisig configs

* feat(tempo): coordinate multisig key authorizations

* test(tempo): expand multisig authorization coverage

* fix(tempo): stabilize multisig authorization coordination

* chore: update Tempo chain size limits

* Delete .changeset/tender-mails-coordinate.md

* refactor(tempo): use account and owner for multisig approvals

* test(tempo): update multisig error snapshot

* fix: use secure randomness in vector generators

* test(tempo): update multisig owner error snapshot

* test(tempo): update access key error snapshot

* test(tempo): update submission error snapshot

* refactor(tempo): rename multisig address inference sentinel

* feat(tempo): coordinate multisig through relays

* feat(tempo): support t12 multisig rpc

* fix(tempo): correct multisig coordination

* chore(tempo): simplify multisig references

* fix(tempo): propagate relay lookup failures

* fix(tempo): preserve account overrides

* fix(tempo): align multisig account derivation

* ci: update Tempo multisig image

* test(tempo): update multisig owner snapshot

* test: update multisig access key snapshot

* test: update multisig submission snapshot

* fix(tempo): harden multisig coordination

Author: jxom

.changeset/tender-mails-coordinate.md

@@ -0,0 +1,20 @@
+---
+"viem": patch
+---
+
+Added coordinated Tempo multisig transactions, key authorizations, config resolution, and canonical CREATE2 account derivation for the updated TIP-1061 protocol.
+
+```ts
+import { Account } from 'viem/tempo'
+
+const initial = Account.fromMultisig({
+  address: 'infer',
+  owners: ['0x0000000000000000000000000000000000000001'],
+})
+const current = Account.fromMultisig({
+  address: initial.address,
+  ...initial.config,
+  version: 1,
+})
+const addressOnly = Account.fromMultisig(initial.address)
+```

.github/workflows/verify.yml

@@ -245,7 +245,7 @@ jobs:
           CI: true
           VITE_TEMPO_ENV: localnet
           VITE_TEMPO_MULTISIG: 'true'
-          VITE_TEMPO_TAG: sha-7825976
+          VITE_TEMPO_TAG: sha-2bd9fa3
 
   test-tempo:
     name: Test Local Tempo (${{ matrix.hardfork }}, ${{ matrix.shard }}/${{ matrix.total-shards }})

AGENTS.md

@@ -71,7 +71,7 @@
     "fast-check": "^4.9.0",
     "knip": "^5.64.0",
     "micro-eth-signer": "^0.14.0",
-    "ox": "0.14.34",
+    "ox": "0.14.44",
     "permissionless": "^0.2.57",
     "prool": "~0.2.14",
     "publint": "^0.2.12",
@@ -149,7 +149,7 @@
     {
       "name": "const viem = require('viem') (cjs)",
       "path": "./src/_cjs/index.js",
-      "limit": "106 kB"
+      "limit": "112 kB"
     },
     {
       "name": "import { createClient, http } from 'viem'",
@@ -196,7 +196,7 @@
     {
       "name": "import * from 'viem/chains'",
       "path": "./src/_esm/chains/index.js",
-      "limit": "113 kB",
+      "limit": "119 kB",
       "import": "*"
     },
     {
@@ -208,7 +208,7 @@
     {
       "name": "import { tempoTestnet } from 'viem/chains'",
       "path": "./src/_esm/chains/index.js",
-      "limit": "70 kB",
+      "limit": "76 kB",
       "import": "{ tempoTestnet }"
     },
     {

package.json

@@ -50,7 +50,7 @@ auditConfig:
     - GHSA-jmr9-qjv8-65gv
 
 overrides:
-  ox: 0.14.34
+  ox: 0.14.44
   typescript: ^5.9.3
   '@opentelemetry/api@^1.8.0': ~1.7.0
   permissionless>viem: workspace:*

pnpm-lock.yaml

@@ -36,23 +36,18 @@ function tempoAdapter(): SourceAdapter {
       after: 'IAddressRegistry',
       items: [
         'function deriveAccount(bytes32 salt, uint8 threshold, (address owner, uint8 weight)[] owners) pure returns (address account)',
-        'function isMultisigAccount(address account) view returns (bool)',
-        'function getConfig(address account) view returns ((uint64 version, uint8 threshold, (address owner, uint8 weight)[] owners))',
-        'function updateConfig(uint8 threshold, (address owner, uint8 weight)[] owners)',
-        'event MultisigInitialized(address indexed account)',
-        'event MultisigConfigUpdated(address indexed account, uint8 threshold, (address owner, uint8 weight)[] owners)',
-        'error NotMultisigAccount()',
+        'function getConfigCommitment(address account) view returns (bytes32 commitment)',
+        'function updateConfig((bytes32 salt, uint64 version, uint8 threshold, (address owner, uint8 weight)[] owners) current, uint8 threshold, (address owner, uint8 weight)[] owners)',
+        'event MultisigConfigUpdated(address indexed account, bytes32 salt, uint64 version, uint8 threshold, (address owner, uint8 weight)[] owners)',
         'error InvalidAccount()',
         'error InvalidConfig()',
         'error InvalidThreshold()',
-        'error InvalidOwner()',
+        'error InvalidMultisigOwner()',
         'error InvalidWeight()',
         'error TooManyOwners()',
         'error DuplicateOwner()',
         'error InvalidOwnerOrder()',
-        'error AccountAlreadyInitialized()',
-        'error UnauthorizedCaller()',
-        'error SameTransactionUpdateNotAllowed()',
+        'error UnauthorizedMultisigCaller()',
       ],
     },
   }