@anywalletkit/wallet-btc 0.3.1 → 0.4.0

package/dist/index.cjs

@@ -885,8 +885,14 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
   /** Compressed secp256k1 public key. */
   publicKey;
   addressType;
-  /** The signer that holds the key. */
-  signer;
+  /**
+   * The signer that holds the key, in a private field: not a property of the account, so no code
+   * the account is handed to (a protocol module, a logger) can reach it and sign around the
+   * account's checks (audit 2026-10-29 A1).
+   */
+  #signer;
+  /** What holds the key: `seed`, `key` (one imported key) or `external`. */
+  signerKind;
   _disposed = false;
   _readOnly;
   /** `publicKey` is the signer's compressed secp256k1 key (33 bytes); it is needed synchronously for the address. */
@@ -894,9 +900,10 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
     const type = config.addressType ?? "p2wpkh";
     super(addressFromPublicKey(publicKey, networkParams(config.network ?? "bitcoin"), type), config);
     this.addressType = type;
-    this.signer = (0, import_core9.requireCurve)(signer, "secp256k1");
+    this.#signer = (0, import_core9.requireCurve)(signer, "secp256k1");
+    this.signerKind = this.#signer.kind;
     const needed = type === "p2tr" ? "schnorr" : "ecdsa";
-    if (!this.signer.schemes.includes(needed)) throw new import_core9.SignerError(`A ${type} account needs a signer with the '${needed}' scheme (has: ${this.signer.schemes.join(", ")}).`);
+    if (!this.#signer.schemes.includes(needed)) throw new import_core9.SignerError(`A ${type} account needs a signer with the '${needed}' scheme (has: ${this.#signer.schemes.join(", ")}).`);
     this.publicKey = publicKey;
     this.path = path;
   }
@@ -916,7 +923,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
   async sign(message) {
     this.live();
     if (this.addressType === "p2tr") throw new UnsupportedAddressTypeError("BIP-137 message signatures do not exist for taproot accounts (BIP-322 is not implemented).");
-    return signMessageWith(message, this.signer, "p2wpkh");
+    return signMessageWith(message, this.#signer, "p2wpkh");
   }
   /** The x-only internal key and its BIP-86 tweak (no script tree) for taproot key-path spends. */
   taprootKeys() {
@@ -928,13 +935,13 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
    * p2wpkh → `partialSig` (DER + SIGHASH_ALL), p2tr → `tapKeySig` (64 bytes, DEFAULT).
    * btc-signer only computes the sighash and assembles the witness; it never sees a key.
    */
-  async signInputs(tx, values) {
+  async #signInputs(tx, values) {
     if (this.addressType === "p2tr") {
       const { tweak } = this.taprootKeys();
       const scripts = Array.from({ length: tx.inputsLength }, () => this.scriptPubKey);
       for (let i = 0; i < tx.inputsLength; i++) {
         const sighash = tx.preimageWitnessV1(i, scripts, import_btc_signer4.SigHash.DEFAULT, values);
-        const sig = await this.signer.sign(sighash, { scheme: "schnorr", context: "btc-taproot-keypath", tweak });
+        const sig = await this.#signer.sign(sighash, { scheme: "schnorr", context: "btc-taproot-keypath", tweak });
         tx.updateInput(i, { tapKeySig: sig }, true);
       }
       return;
@@ -942,7 +949,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
     const scriptCode = (0, import_btc_signer4.p2pkh)(this.publicKey).script;
     for (let i = 0; i < tx.inputsLength; i++) {
       const sighash = tx.preimageWitnessV0(i, scriptCode, import_btc_signer4.SigHash.ALL, values[i]);
-      const rs = await this.signer.sign(sighash, { scheme: "ecdsa", context: "btc-sighash" });
+      const rs = await this.#signer.sign(sighash, { scheme: "ecdsa", context: "btc-sighash" });
       const der = import_secp256k12.secp256k1.Signature.fromBytes(rs, "compact").toBytes("der");
       const sig = new Uint8Array(der.length + 1);
       sig.set(der, 0);
@@ -953,7 +960,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
   ctx(intended) {
     return { network: this._network, ownAddress: this.address, intended, maxFeeRate: this.maxFeeRate };
   }
-  async signPlan(plan, to, recipientValue, change, lockTime, rbf) {
+  async #signPlan(plan, to, recipientValue, change, lockTime, rbf) {
     const spend = spendInfo(this.publicKey, this._network, this.addressType);
     const tx = new import_btc_signer4.Transaction({ lockTime });
     const sequence = rbf ? RBF_SEQUENCE : FINAL_SEQUENCE;
@@ -962,7 +969,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
     }
     tx.addOutputAddress(to, recipientValue, this._network);
     if (change > 0n) tx.addOutputAddress(this.address, change, this._network);
-    await this.signInputs(tx, plan.utxos.map((u) => u.value));
+    await this.#signInputs(tx, plan.utxos.map((u) => u.value));
     tx.finalize();
     return tx;
   }
@@ -971,7 +978,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
    * signed vsize somehow needs more, the difference comes out of change (never the
    * recipient) and the tx is re-signed once.
    */
-  async signSpend(spend) {
+  async #signSpend(spend) {
     this.live();
     const plan = await this.planSpend(spend);
     await this.verifyPrevouts(plan.utxos);
@@ -979,7 +986,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
     const rbf = spend.rbf ?? this._config.rbf ?? true;
     let change = plan.change;
     let fee = plan.fee;
-    let tx = await this.signPlan(plan, spend.to, plan.amount, change, lockTime, rbf);
+    let tx = await this.#signPlan(plan, spend.to, plan.amount, change, lockTime, rbf);
     const required = BigInt(tx.vsize) * plan.feeRate;
     if (required > fee) {
       const delta = required - fee;
@@ -992,7 +999,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
         fee = plan.fee + plan.change;
         change = 0n;
       } else fee = required;
-      tx = await this.signPlan(plan, spend.to, plan.amount, change, lockTime, rbf);
+      tx = await this.#signPlan(plan, spend.to, plan.amount, change, lockTime, rbf);
       if (BigInt(tx.vsize) * plan.feeRate > fee) throw new Error("Fee shortfall after output rebalance.");
     }
     const ctx = this.ctx({ to: spend.to, value: plan.amount });
@@ -1063,7 +1070,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
   /** "What you sign": the fully resolved spend (signed, NOT broadcast) or a caller's raw hex. */
   async describeTransaction(tx) {
     if (typeof tx === "string") return (await this.describeRaw(tx)).desc;
-    return (await this.signSpend(tx)).desc;
+    return (await this.#signSpend(tx)).desc;
   }
   /** Sign without broadcasting. Returns the raw transaction hex. Raw hex input gets the checks `sendTransaction` runs (prevouts through the client) and is returned unchanged, never re-signed. */
   async signTransaction(tx, options = {}) {
@@ -1073,7 +1080,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
       this.checkMax(desc.fee, (0, import_core9.feeLimit)(this._config.transactionMaxFee, options), "transaction");
       return tx;
     }
-    const { tx: built, fee } = await this.signSpend(tx);
+    const { tx: built, fee } = await this.#signSpend(tx);
     this.checkMax(fee, (0, import_core9.feeLimit)(this._config.transactionMaxFee, options), "transaction");
     return built.hex;
   }
@@ -1091,7 +1098,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
       hash = parsed.id;
       fee = desc.fee;
     } else {
-      const built = await this.signSpend(tx);
+      const built = await this.#signSpend(tx);
       rawHex = built.tx.hex;
       hash = built.tx.id;
       fee = built.fee;
@@ -1104,7 +1111,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
     if (o.token) throw new Error("Tokens are not supported on the bitcoin blockchain.");
     this.live();
     const client = this.requireClient("transfer");
-    const built = await this.signSpend({ to: o.recipient, value: o.amount });
+    const built = await this.#signSpend({ to: o.recipient, value: o.amount });
     this.checkMax(built.fee, (0, import_core9.feeLimit)(this._config.transferMaxFee, writeOptions), "transfer");
     return { hash: await this.broadcast(client, built.tx.hex, built.tx.id), fee: built.fee };
   }
@@ -1129,7 +1136,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
   }
   dispose() {
     this._disposed = true;
-    this.signer.dispose();
+    this.#signer.dispose();
   }
 };