feat(tempo): multisig

.github/workflows/verify.yml

@@ -245,7 +245,7 @@ jobs:
           CI: true
           VITE_TEMPO_ENV: localnet
           VITE_TEMPO_MULTISIG: 'true'
-          VITE_TEMPO_TAG: sha-7825976
+          VITE_TEMPO_TAG: sha-5190cf5
 
   test-tempo:
     name: Test Local Tempo (${{ matrix.hardfork }}, ${{ matrix.shard }}/${{ matrix.total-shards }})

package.json

@@ -71,7 +71,7 @@
     "fast-check": "^4.9.0",
     "knip": "^5.64.0",
     "micro-eth-signer": "^0.14.0",
-    "ox": "0.14.34",
+    "ox": "0.14.43",
     "permissionless": "^0.2.57",
     "prool": "~0.2.14",
     "publint": "^0.2.12",
@@ -149,7 +149,7 @@
     {
       "name": "const viem = require('viem') (cjs)",
       "path": "./src/_cjs/index.js",
-      "limit": "106 kB"
+      "limit": "112 kB"
     },
     {
       "name": "import { createClient, http } from 'viem'",
@@ -196,7 +196,7 @@
     {
       "name": "import * from 'viem/chains'",
       "path": "./src/_esm/chains/index.js",
-      "limit": "113 kB",
+      "limit": "119 kB",
       "import": "*"
     },
     {
@@ -208,7 +208,7 @@
     {
       "name": "import { tempoTestnet } from 'viem/chains'",
       "path": "./src/_esm/chains/index.js",
-      "limit": "70 kB",
+      "limit": "76 kB",
       "import": "{ tempoTestnet }"
     },
     {

pnpm-workspace.yaml

@@ -50,7 +50,7 @@ auditConfig:
     - GHSA-jmr9-qjv8-65gv
 
 overrides:
-  ox: 0.14.34
+  ox: 0.14.43
   typescript: ^5.9.3
   '@opentelemetry/api@^1.8.0': ~1.7.0
   permissionless>viem: workspace:*

scripts/generateTempoAbis.ts

@@ -36,23 +36,18 @@ function tempoAdapter(): SourceAdapter {
       after: 'IAddressRegistry',
       items: [
         'function deriveAccount(bytes32 salt, uint8 threshold, (address owner, uint8 weight)[] owners) pure returns (address account)',
-        'function isMultisigAccount(address account) view returns (bool)',
-        'function getConfig(address account) view returns ((uint64 version, uint8 threshold, (address owner, uint8 weight)[] owners))',
-        'function updateConfig(uint8 threshold, (address owner, uint8 weight)[] owners)',
-        'event MultisigInitialized(address indexed account)',
-        'event MultisigConfigUpdated(address indexed account, uint8 threshold, (address owner, uint8 weight)[] owners)',
-        'error NotMultisigAccount()',
+        'function getConfigCommitment(address account) view returns (bytes32 commitment)',
+        'function updateConfig((bytes32 salt, uint64 version, uint8 threshold, (address owner, uint8 weight)[] owners) current, uint8 threshold, (address owner, uint8 weight)[] owners)',
+        'event MultisigConfigUpdated(address indexed account, bytes32 salt, uint64 version, uint8 threshold, (address owner, uint8 weight)[] owners)',
         'error InvalidAccount()',
         'error InvalidConfig()',
         'error InvalidThreshold()',
-        'error InvalidOwner()',
+        'error InvalidMultisigOwner()',
         'error InvalidWeight()',
         'error TooManyOwners()',
         'error DuplicateOwner()',
         'error InvalidOwnerOrder()',
-        'error AccountAlreadyInitialized()',
-        'error UnauthorizedCaller()',
-        'error SameTransactionUpdateNotAllowed()',
+        'error UnauthorizedMultisigCaller()',
       ],
     },
   }

site/pages/tempo/accounts/account.fromMultisig.mdx

@@ -1,11 +1,12 @@
 ---
-description: Instantiates a native multisig account from its initial config or initialized address.
+description: Instantiates a native multisig account from an initial or current config.
 ---
 
 # `Account.fromMultisig`
 
-Instantiates an Account for a [native multisig](https://tips.sh/1061). Pass an initial config to
-derive and bootstrap an account, or pass the address of an initialized account to reconstruct it.
+Instantiates an Account for a [native multisig](https://tips.sh/1061). Set `address` to `infer`
+to derive the stable account address. After the config changes, replace `infer` with the stable
+address and pass the current config fields.
 
 :::warning
 **Experimental.** Native multisig support is experimental and may change in a future release.
@@ -37,6 +38,7 @@ const owner_2 = Account.fromSecp256k1(
 )
 
 const account = Account.fromMultisig({
+  address: 'infer',
   owners: [owner_1, owner_2],
   threshold: 2,
 })
@@ -45,12 +47,34 @@ console.log('Address:', account.address)
 ```
 
 `Account.fromMultisig` normalizes the config with `MultisigConfig.from`, including canonical
-owner ordering. You can also pass a pre-built `MultisigConfig.Config`.
+owner ordering. The initial config always uses version `0`.
 
-### Initialized Account
+### Current Config
 
-After bootstrap, reconstruct the account from its stable address. Request preparation reads the
-current owners, threshold, and version from the multisig precompile.
+After a config update, reconstruct the account from its stable address and current config.
+The address does not change when the config changes.
+
+```ts twoslash
+import { Account } from 'viem/tempo'
+
+const account = Account.fromMultisig({
+  address: '0x0000000000000000000000000000000000000001',
+  owners: [
+    '0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266',
+    '0x70997970C51812dc3A010C7d01b50e0d17dc79C8',
+  ],
+  salt: '0x0000000000000000000000000000000000000000000000000000000000000000',
+  threshold: 2,
+  version: 1,
+})
+```
+
+Tempo stores the config commitment, not the config fields. Retain each current config or
+recover it from the account's `MultisigConfigUpdated` events.
+
+### Address Only
+
+Use an address-only account when only the stable account identity is needed.
 
 ```ts twoslash
 import { Account } from 'viem/tempo'
@@ -60,12 +84,13 @@ const account = Account.fromMultisig(
 )
 ```
 
-The address form cannot bootstrap an uninitialized account or aggregate local owner signatures.
-Collect approvals independently and pass them to the prepared request's `signatures` field.
+An address-only account contains no config or local owner keys. A coordinated client can load the
+current config from its store. Otherwise, provide the config through `{ address, ...config }`
+before sending.
 
 :::tip
-You can continue passing the original initial config after the account is initialized. The
-initial config and initialized address identify the same stable account, even after owner rotation.
+Keep using `address: 'infer'` while the account remains at version `0`. After a config update,
+use the stable address with the new config.
 :::
 
 ### External Owners
@@ -76,6 +101,7 @@ Pass addresses when owner approvals are collected outside the current process.
 import { Account } from 'viem/tempo'
 
 const account = Account.fromMultisig({
+  address: 'infer',
   owners: [
     '0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266',
     '0x70997970C51812dc3A010C7d01b50e0d17dc79C8',
@@ -96,6 +122,7 @@ const owner = Account.fromSecp256k1(
 )
 
 const account = Account.fromMultisig({
+  address: 'infer',
   owners: [
     { owner, weight: 2 },
     { owner: '0x70997970C51812dc3A010C7d01b50e0d17dc79C8', weight: 1 },
@@ -110,7 +137,7 @@ const account = Account.fromMultisig({
 type ReturnType = MultisigAccount
 
 type MultisigAccount = LocalAccount<'multisig'> & {
-  /** Normalized initial configuration, when supplied. */
+  /** Normalized config, when supplied. */
   config: MultisigConfig.Config | undefined
   /** @internal Local owner accounts retained for signing. */
   owners: readonly LocalAccount[]
@@ -125,27 +152,44 @@ supported.
 
 ### value
 
-- **Type:** `Address | Account.fromMultisig.Config`
+- **Type:** `Account.fromMultisig.Parameters`
+
+An initial config, a stable address with its current config, or an address without a retained
+config.
 
-An initialized multisig address or the initial config used to derive and bootstrap an account.
+#### value.address
+
+- **Type:** `'infer' | Address`
+
+Set this field to `infer` to derive an account from a version-zero config. For a current config,
+pass the account's stable address. Pass an `Address` as `value` when no config is needed.
 
 #### value.owners
 
 - **Type:** `readonly (Address | LocalAccount | { owner: Address | LocalAccount; weight: number })[]`
 
-The initial owners. Passing a local account makes that account available for local aggregation.
+The config owners. Passing a local account makes that account available for local aggregation.
 Passing an address keeps that owner's approval external.
 
-#### value.threshold (optional)
+#### value.salt
+
+- **Type:** `Hex`
+- **Default:** `0x0000000000000000000000000000000000000000000000000000000000000000`
+
+The 32-byte config salt. This field is optional for an initial config and required for a current
+config.
+
+#### value.threshold
 
 - **Type:** `number`
 - **Default:** `1`
 
-The total owner weight required to authorize a transaction.
+The total owner weight required to authorize an operation. This field is optional for an initial
+config and required for a current config.
 
-#### value.salt (optional)
+#### value.version
 
-- **Type:** `Hex`
-- **Default:** `0x0000000000000000000000000000000000000000000000000000000000000000`
+- **Type:** `bigint | number`
 
-A 32-byte salt used to derive a distinct address for the same owner set and threshold.
+The nonzero current config version. For an initial config, omit this field or pass `0` when
+spreading a normalized `MultisigConfig.Config` value.