type Item = {
  chainId: bigint;      // Chain ID where valid
  address: Address;     // Contract to delegate to
  nonce: bigint;        // Account nonce
  yParity: number;      // Signature Y parity (0 or 1)
  r: bigint;            // Signature r value
  s: bigint;            // Signature s value
};

type Unsigned = {
  chainId: bigint;
  address: Address;
  nonce: bigint;
};

type DelegationDesignation = {
  authority: Address;         // Signer (EOA granting permission)
  delegatedAddress: Address;  // Contract receiving delegation
};

EOA Account
├── Balance: Original EOA balance
├── Nonce: Original EOA nonce
└── Code: → Points to delegated contract code

Authorization.MAGIC_BYTE = 0x05;                    // Signing hash prefix
Authorization.PER_EMPTY_ACCOUNT_COST = 25000n;      // Gas for empty account
Authorization.PER_AUTH_BASE_COST = 12500n;          // Base gas per authorization

Authorization.SECP256K1_N = 0xfff...n;              // Curve order
Authorization.SECP256K1_HALF_N = SECP256K1_N >> 1n; // N/2 for malleability check

// User creates authorization delegating to sponsor contract
const unsigned = {
  chainId: 1n,
  address: sponsorContractAddress,
  nonce: await getAccountNonce(userEOA)
};

const auth = Authorization.sign.call(unsigned, userPrivateKey);

// Relayer includes in transaction
transaction.authorizationList = [auth];
transaction.gasPrice = relayerGasPrice;

// Delegate to batch executor contract
const auth = Authorization.sign.call({
  chainId: 1n,
  address: batchExecutorAddress,
  nonce: currentNonce
}, privateKey);

// Batch executor can:
// - Approve multiple tokens
// - Swap on multiple DEXes
// - Transfer to multiple recipients

// Guardian creates authorization
const guardianAuth = {
  chainId: 1n,
  address: recoveryModuleAddress,
  nonce: guardianNonce
};

const auth = Authorization.sign.call(guardianAuth, guardianPrivateKey);

// Recovery module can:
// - Verify guardian consensus
// - Execute recovery operations
// - Transfer assets to new account

// Good: Validate before processing
try {
  Authorization.validate.call(auth);
  processAuthorization(auth);
} catch (e) {
  handleInvalidAuth(e);
}

// Good: Verify nonce matches account state
const currentNonce = await getAccountNonce(authority);
if (auth.nonce !== currentNonce) {
  throw new Error('Nonce mismatch');
}

// Good: Check if accounts are empty
const isEmpty = await isAccountEmpty(auth.address);
const gas = Authorization.getGasCost.call(auth, isEmpty);

// Good: Process with error handling
const results = authList.map(auth => {
  try {
    return { auth, result: Authorization.process.call(auth) };
  } catch (e) {
    return { auth, error: e };
  }
});

// Good: Verify types before processing
function handleAuth(data: unknown) {
  if (Authorization.isItem(data)) {
    Authorization.validate.call(data);
    return processAuth(data);
  }
  throw new Error('Invalid authorization data');
}

// Validation ensures s <= N/2
// Prevents second valid signature for same authorization
Authorization.validate.call(auth);  // Throws if s > N/2

// Good: Explicit chain ID
const auth = {
  chainId: 1n,  // Mainnet only
  address: contractAddress,
  nonce: 0n
};

// Bad: Reusing cross-chain
// Authorization signed for chain 1 invalid on chain 137

const authority = Authorization.verify.call(auth);
// Verify authority is expected/authorized

const usedNonces = new Set<string>();
const key = `${authority}-${auth.nonce}`;

if (usedNonces.has(key)) {
  throw new Error('Nonce already used');
}
usedNonces.add(key);

if (auth.chainId !== expectedChainId) {
  throw new Error('Wrong chain ID');
}

const trustedContracts = new Set([...]);

if (!trustedContracts.has(auth.address)) {
  throw new Error('Untrusted delegation target');
}

const maxGas = Authorization.calculateGasCost.call(authList, maxEmpty);
if (requiredGas > maxGas) {
  throw new Error('Gas limit exceeded');
}

// Import specific methods
import { sign, verify, validate } from 'tevm/primitives/Authorization'

// Or import entire namespace
import * as Authorization from 'tevm/primitives/Authorization'

// Selective imports reduce bundle size
const auth = sign.call(unsigned, privateKey)
const valid = validate.call(auth)