@anywalletkit/wallet-btc 0.3.2 → 0.4.1

package/dist/index.cjs

@@ -722,7 +722,24 @@ var purposeFor = (type) => type === "p2tr" ? 86 : 84;
 
 // src/read-only-account.ts
 var import_core8 = require("@anywalletkit/core");
+function assertSpendShape(spend) {
+  const proto = typeof spend === "object" && spend !== null && !Array.isArray(spend) ? Object.getPrototypeOf(spend) : void 0;
+  if (proto === void 0 || proto !== null && Object.getPrototypeOf(proto) !== null) {
+    throw new UnsafeTransactionError("malformed-spend", "A spend must be one plain object ({ to, value, \u2026 }); a list or another kind of object is not signed.");
+  }
+}
 var toBig = (v) => typeof v === "bigint" ? v : BigInt(Math.round(Number(v)));
+function spendValue(v) {
+  if (typeof v === "bigint") return v;
+  if (typeof v === "number" && Number.isInteger(v)) return BigInt(v);
+  if (typeof v === "string" && v.length <= 300 && !/\s/.test(v)) {
+    try {
+      return BigInt(v);
+    } catch {
+    }
+  }
+  throw new UnsafeTransactionError("malformed-spend", "A spend value must be a bigint, a whole number or an integer string of at most 300 characters (sats).");
+}
 var WalletAccountReadOnlyBtc = class {
   /** The address. */
   address;
@@ -788,7 +805,8 @@ var WalletAccountReadOnlyBtc = class {
   }
   /** Coin selection for a spend (see coinselect.ts). Validates the recipient and the dust floor first. */
   async planSpend(spend) {
-    const amount = toBig(spend.value);
+    assertSpendShape(spend);
+    const amount = spendValue(spend.value);
     const recipient = decodeAddress(spend.to, this._network);
     const floor = dustLimit(recipient.kind);
     if (amount < floor) throw new Error(`The amount must be at least the dust limit of the recipient's address type (${floor} sat).`);
@@ -885,8 +903,14 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
   /** Compressed secp256k1 public key. */
   publicKey;
   addressType;
-  /** The signer that holds the key. */
-  signer;
+  /**
+   * The signer that holds the key, in a private field: not a property of the account, so no code
+   * the account is handed to (a protocol module, a logger) can reach it and sign around the
+   * account's checks (audit 2026-10-29 A1).
+   */
+  #signer;
+  /** What holds the key: `seed`, `key` (one imported key) or `external`. */
+  signerKind;
   _disposed = false;
   _readOnly;
   /** `publicKey` is the signer's compressed secp256k1 key (33 bytes); it is needed synchronously for the address. */
@@ -894,9 +918,10 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
     const type = config.addressType ?? "p2wpkh";
     super(addressFromPublicKey(publicKey, networkParams(config.network ?? "bitcoin"), type), config);
     this.addressType = type;
-    this.signer = (0, import_core9.requireCurve)(signer, "secp256k1");
+    this.#signer = (0, import_core9.requireCurve)(signer, "secp256k1");
+    this.signerKind = this.#signer.kind;
     const needed = type === "p2tr" ? "schnorr" : "ecdsa";
-    if (!this.signer.schemes.includes(needed)) throw new import_core9.SignerError(`A ${type} account needs a signer with the '${needed}' scheme (has: ${this.signer.schemes.join(", ")}).`);
+    if (!this.#signer.schemes.includes(needed)) throw new import_core9.SignerError(`A ${type} account needs a signer with the '${needed}' scheme (has: ${this.#signer.schemes.join(", ")}).`);
     this.publicKey = publicKey;
     this.path = path;
   }
@@ -916,7 +941,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
   async sign(message) {
     this.live();
     if (this.addressType === "p2tr") throw new UnsupportedAddressTypeError("BIP-137 message signatures do not exist for taproot accounts (BIP-322 is not implemented).");
-    return signMessageWith(message, this.signer, "p2wpkh");
+    return signMessageWith(message, this.#signer, "p2wpkh");
   }
   /** The x-only internal key and its BIP-86 tweak (no script tree) for taproot key-path spends. */
   taprootKeys() {
@@ -934,7 +959,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
       const scripts = Array.from({ length: tx.inputsLength }, () => this.scriptPubKey);
       for (let i = 0; i < tx.inputsLength; i++) {
         const sighash = tx.preimageWitnessV1(i, scripts, import_btc_signer4.SigHash.DEFAULT, values);
-        const sig = await this.signer.sign(sighash, { scheme: "schnorr", context: "btc-taproot-keypath", tweak });
+        const sig = await this.#signer.sign(sighash, { scheme: "schnorr", context: "btc-taproot-keypath", tweak });
         tx.updateInput(i, { tapKeySig: sig }, true);
       }
       return;
@@ -942,7 +967,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
     const scriptCode = (0, import_btc_signer4.p2pkh)(this.publicKey).script;
     for (let i = 0; i < tx.inputsLength; i++) {
       const sighash = tx.preimageWitnessV0(i, scriptCode, import_btc_signer4.SigHash.ALL, values[i]);
-      const rs = await this.signer.sign(sighash, { scheme: "ecdsa", context: "btc-sighash" });
+      const rs = await this.#signer.sign(sighash, { scheme: "ecdsa", context: "btc-sighash" });
       const der = import_secp256k12.secp256k1.Signature.fromBytes(rs, "compact").toBytes("der");
       const sig = new Uint8Array(der.length + 1);
       sig.set(der, 0);
@@ -1129,7 +1154,7 @@ var WalletAccountBtc = class _WalletAccountBtc extends WalletAccountReadOnlyBtc
   }
   dispose() {
     this._disposed = true;
-    this.signer.dispose();
+    this.#signer.dispose();
   }
 };