@anywalletkit/wallet-zcash 0.2.6 → 0.3.1

package/dist/index.d.cts

@@ -1,5 +1,5 @@
-import { S as SpentOutput, Z as ZcashNetwork, a as ZcashTxDescription, b as ZcashClient, U as Utxo, c as ZcashTxInfo, d as ZcashConfig, e as ZcashSpend, f as ZcashTransferOptions, g as ZcashMaxSpendableResult, h as ZcashReceipt, i as ZcashTransaction } from './history-DQNeEwXE.cjs';
-export { B as BLOCKCHAIR_URL, j as BlockchairClient, k as BlockchairTxDashboard, C as CAIP2, H as HistoryUnavailableError, l as ZcashChainTx, m as ZcashClientConfig, n as ZcashHistoryCursor, o as ZcashHistoryOptions, p as ZcashHistoryPage, q as ZcashHistoryRaw, r as ZcashHistorySource, s as ZcashTxInputDescription, t as ZcashTxOutputDescription, u as ZcashWarning, v as blockchairTime, w as createZcashHistory, x as decodeHistoryCursor, y as encodeHistoryCursor, z as mapDashboardTx, A as zcashExplorerTxUrl } from './history-DQNeEwXE.cjs';
+import { S as SpentOutput, Z as ZcashNetwork, a as ZcashTxDescription, b as ZcashClient, U as Utxo, c as ZcashTxInfo, d as ZcashConfig, e as ZcashSpend, f as ZcashTransferOptions, g as ZcashMaxSpendableResult, h as ZcashReceipt, i as ZcashTransaction } from './history-CiZ6aFMT.cjs';
+export { B as BLOCKCHAIR_URL, j as BlockchairClient, k as BlockchairInput, l as BlockchairOutput, m as BlockchairTxDashboard, n as BlockchairTxRow, C as CAIP2, H as HistoryUnavailableError, o as ZcashChainTx, p as ZcashClientConfig, q as ZcashHistoryCursor, r as ZcashHistoryOptions, s as ZcashHistoryPage, t as ZcashHistoryRaw, u as ZcashHistorySource, v as ZcashTxInputDescription, w as ZcashTxOutputDescription, x as ZcashWarning, y as blockchairTime, z as createZcashHistory, A as decodeHistoryCursor, D as encodeHistoryCursor, E as mapDashboardTx, F as zcashExplorerTxUrl } from './history-CiZ6aFMT.cjs';
 import { Signer, IWalletAccountReadOnly, IWalletAccount, WriteOptions, TransferResult, WalletManager, FeeRates } from '@anywalletkit/core';
 
 declare const TX_VERSION_V5 = 2147483653;
@@ -83,7 +83,9 @@ type UnsafeTransactionCode =
 /** The recipient output is missing or carries a different amount. */
  | 'recipient-mismatch'
 /** A change output pays an address that is not ours. */
- | 'change-not-ours';
+ | 'change-not-ours'
+/** Off mainnet without a configured `consensusBranchId`: the branch id cannot be known. */
+ | 'unknown-branch-id';
 /** A transaction failed a hard safety check and was not signed / broadcast. */
 declare class UnsafeTransactionError extends Error {
     readonly code: UnsafeTransactionCode;
@@ -163,11 +165,31 @@ declare class ZcashBlockbookClient implements ZcashClient {
 
 /**
  * One client, or a failover client over the list: each call walks the list in
- * order, `retries` extra rounds. A node's rejection of a broadcast (plain
- * Error) is final — only transport failures (NetworkError) move on.
+ * order, `retries` extra rounds. A node's refusal of a broadcast is final when
+ * no endpoint before it went silent; after a silent one the transaction may be
+ * out, so the result is "maybe sent" (round 3, M12). Transport failures move on.
  */
 declare function createClient(config: ZcashConfig): ZcashClient | undefined;
 
+/**
+ * The transaction was handed to the network but no definitive answer came back (no response, a
+ * timeout, a 5xx, an unreadable body): it MAY be in the mempool. Do not spend the same coins again —
+ * watch `hash`, the txid computed before sending (round 3, M12).
+ */
+declare class BroadcastUnknownError extends Error {
+    /** Always true: the transaction may be on its way. */
+    readonly maybeSent = true;
+    /** The transaction id (hex). */
+    readonly hash: string;
+    constructor(hash: string, cause: unknown);
+}
+
+/**
+ * An endpoint answered with a refusal (HTTP 4xx other than 408 with a reason, or an error body):
+ * nothing was taken. A thrown fetch, a timeout, a 5xx or a body that cannot be read may have been.
+ */
+declare function isAnsweredRefusal(e: unknown): boolean;
+
 /** Hash of a signed message (`Zcash Signed Message:` prefix, double SHA-256). */
 declare function magicHash(message: string | Uint8Array): Uint8Array;
 /** Encode `r‖s` + recovery id as a base64 signature (compressed-key header 31 + recovery). */
@@ -366,7 +388,13 @@ declare class WalletAccountZcash extends WalletAccountReadOnlyZcash implements I
     /** Zcash message signature (zcashd `signmessage` encoding), base64. */
     sign(message: string | Uint8Array): Promise<string>;
     private ctx;
-    /** Lock time + expiry + branch id from the tip (or the config override). */
+    /**
+     * Lock time, expiry and branch id for a transaction that lands in the next block (round 3, L7):
+     * expiry = tip + 1 + `expiryDelta`, the branch id in force at tip + 1 (mainnet table; off mainnet
+     * `consensusBranchId` must be configured — testnet and regtest activate upgrades at other heights).
+     * Without a tip nothing is signed when the expiry, anti-fee-sniping or the branch id need it: a
+     * transaction signed with expiry 0 never expires.
+     */
     private chainParams;
     /** Sign every input through the signer; the scriptSig is `<DER ‖ 0x01> <pubkey>`. */
     private signInputs;
@@ -386,6 +414,12 @@ declare class WalletAccountZcash extends WalletAccountReadOnlyZcash implements I
     sendTransaction(tx: ZcashTransaction, options?: WriteOptions): Promise<TransferResult>;
     /** Native ZEC only (`token` is rejected). Subject to `transferMaxFee`. */
     transfer(o: ZcashTransferOptions, writeOptions?: WriteOptions): Promise<TransferResult>;
+    /**
+     * Send once through the client. Only a node's refusal means nothing went out; "already in the
+     * mempool / block chain" means an earlier attempt delivered it; anything else may have landed and
+     * is a {@link BroadcastUnknownError} with the txid computed before sending (round 3, M12).
+     */
+    private broadcast;
     /** The same address as a {@link WalletAccountReadOnlyZcash}. */
     toReadOnlyAccount(): IWalletAccountReadOnly;
     dispose(): void;
@@ -416,4 +450,4 @@ declare class WalletManagerZcash extends WalletManager<WalletAccountZcash, Zcash
     getFeeRates(): Promise<FeeRates>;
 }
 
-export { type BlockbookTxDetails, type BlockbookVin, type BlockbookVout, CURRENT_BRANCH_ID, type CoinSelectOptions, type CoinSelection, DEFAULT_EXPIRY_DELTA, DEFAULT_MAX_FEE, DUST_LIMIT, type DecodedAddress, type DescribeContext, FINAL_SEQUENCE, GRACE_ACTIONS, MAINNET_UPGRADES, MARGINAL_FEE, MAX_SEQUENCE, MAX_UTXO_INPUTS, P2PKH_INPUT_SIZE, SIGHASH_ALL, type ScriptKind, type SpendPlan, SpentOutput, TX_VERSION_V5, TooManyInputsError, type TransparentTxV5, type TxInput, type TxOutput, type UnsafeTransactionCode, UnsafeTransactionError, Utxo, VERSION_GROUP_ID_V5, WalletAccountReadOnlyZcash, WalletAccountZcash, WalletManagerZcash, ZcashBlockbookClient, ZcashClient, ZcashConfig, ZcashMaxSpendableResult, ZcashNetwork, ZcashReceipt, ZcashSpend, ZcashTransaction, ZcashTransferOptions, ZcashTxDescription, ZcashTxInfo, addressFor, addressFromPublicKey, addressFromScript, addressPrefix, assertSafe, branchIdForHeight, coinType, conventionalFee, createClient, decodeAddress, WalletManagerZcash as default, describeTransaction, encodeAddress, encodeMessageSignature, estimateSize, hash160, headerDigest, logicalActions, magicHash, outputSize, outputsDigest, p2pkhScriptSig, parseP2pkhScriptSig, parseTx, prevoutsDigest, recoverMessagePublicKey, scriptFor, scriptKind, selectAll, selectCoins, sequenceDigest, serializeTx, sighashAll, signMessageWith, spendableUtxos, transparentDigest, txHashPersonalization, txid, txidDigest };
+export { type BlockbookTxDetails, type BlockbookVin, type BlockbookVout, BroadcastUnknownError, type Built, CURRENT_BRANCH_ID, type CoinSelectOptions, type CoinSelection, DEFAULT_EXPIRY_DELTA, DEFAULT_MAX_FEE, DUST_LIMIT, type DecodedAddress, type DescribeContext, FINAL_SEQUENCE, GRACE_ACTIONS, MAINNET_UPGRADES, MARGINAL_FEE, MAX_SEQUENCE, MAX_UTXO_INPUTS, P2PKH_INPUT_SIZE, SIGHASH_ALL, type ScriptKind, type SpendPlan, SpentOutput, TX_VERSION_V5, TooManyInputsError, type TransparentTxV5, type TxInput, type TxOutput, type UnsafeTransactionCode, UnsafeTransactionError, Utxo, VERSION_GROUP_ID_V5, WalletAccountReadOnlyZcash, WalletAccountZcash, WalletManagerZcash, ZcashBlockbookClient, ZcashClient, ZcashConfig, ZcashMaxSpendableResult, ZcashNetwork, ZcashReceipt, ZcashSpend, ZcashTransaction, ZcashTransferOptions, ZcashTxDescription, ZcashTxInfo, addressFor, addressFromPublicKey, addressFromScript, addressPrefix, assertSafe, branchIdForHeight, coinType, conventionalFee, createClient, decodeAddress, WalletManagerZcash as default, describeTransaction, encodeAddress, encodeMessageSignature, estimateSize, hash160, headerDigest, isAnsweredRefusal, logicalActions, magicHash, outputSize, outputsDigest, p2pkhScriptSig, parseP2pkhScriptSig, parseTx, prevoutsDigest, recoverMessagePublicKey, scriptFor, scriptKind, selectAll, selectCoins, sequenceDigest, serializeTx, sighashAll, signMessageWith, spendableUtxos, transparentDigest, txHashPersonalization, txid, txidDigest };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-import { S as SpentOutput, Z as ZcashNetwork, a as ZcashTxDescription, b as ZcashClient, U as Utxo, c as ZcashTxInfo, d as ZcashConfig, e as ZcashSpend, f as ZcashTransferOptions, g as ZcashMaxSpendableResult, h as ZcashReceipt, i as ZcashTransaction } from './history-DQNeEwXE.js';
-export { B as BLOCKCHAIR_URL, j as BlockchairClient, k as BlockchairTxDashboard, C as CAIP2, H as HistoryUnavailableError, l as ZcashChainTx, m as ZcashClientConfig, n as ZcashHistoryCursor, o as ZcashHistoryOptions, p as ZcashHistoryPage, q as ZcashHistoryRaw, r as ZcashHistorySource, s as ZcashTxInputDescription, t as ZcashTxOutputDescription, u as ZcashWarning, v as blockchairTime, w as createZcashHistory, x as decodeHistoryCursor, y as encodeHistoryCursor, z as mapDashboardTx, A as zcashExplorerTxUrl } from './history-DQNeEwXE.js';
+import { S as SpentOutput, Z as ZcashNetwork, a as ZcashTxDescription, b as ZcashClient, U as Utxo, c as ZcashTxInfo, d as ZcashConfig, e as ZcashSpend, f as ZcashTransferOptions, g as ZcashMaxSpendableResult, h as ZcashReceipt, i as ZcashTransaction } from './history-CiZ6aFMT.js';
+export { B as BLOCKCHAIR_URL, j as BlockchairClient, k as BlockchairInput, l as BlockchairOutput, m as BlockchairTxDashboard, n as BlockchairTxRow, C as CAIP2, H as HistoryUnavailableError, o as ZcashChainTx, p as ZcashClientConfig, q as ZcashHistoryCursor, r as ZcashHistoryOptions, s as ZcashHistoryPage, t as ZcashHistoryRaw, u as ZcashHistorySource, v as ZcashTxInputDescription, w as ZcashTxOutputDescription, x as ZcashWarning, y as blockchairTime, z as createZcashHistory, A as decodeHistoryCursor, D as encodeHistoryCursor, E as mapDashboardTx, F as zcashExplorerTxUrl } from './history-CiZ6aFMT.js';
 import { Signer, IWalletAccountReadOnly, IWalletAccount, WriteOptions, TransferResult, WalletManager, FeeRates } from '@anywalletkit/core';
 
 declare const TX_VERSION_V5 = 2147483653;
@@ -83,7 +83,9 @@ type UnsafeTransactionCode =
 /** The recipient output is missing or carries a different amount. */
  | 'recipient-mismatch'
 /** A change output pays an address that is not ours. */
- | 'change-not-ours';
+ | 'change-not-ours'
+/** Off mainnet without a configured `consensusBranchId`: the branch id cannot be known. */
+ | 'unknown-branch-id';
 /** A transaction failed a hard safety check and was not signed / broadcast. */
 declare class UnsafeTransactionError extends Error {
     readonly code: UnsafeTransactionCode;
@@ -163,11 +165,31 @@ declare class ZcashBlockbookClient implements ZcashClient {
 
 /**
  * One client, or a failover client over the list: each call walks the list in
- * order, `retries` extra rounds. A node's rejection of a broadcast (plain
- * Error) is final — only transport failures (NetworkError) move on.
+ * order, `retries` extra rounds. A node's refusal of a broadcast is final when
+ * no endpoint before it went silent; after a silent one the transaction may be
+ * out, so the result is "maybe sent" (round 3, M12). Transport failures move on.
  */
 declare function createClient(config: ZcashConfig): ZcashClient | undefined;
 
+/**
+ * The transaction was handed to the network but no definitive answer came back (no response, a
+ * timeout, a 5xx, an unreadable body): it MAY be in the mempool. Do not spend the same coins again —
+ * watch `hash`, the txid computed before sending (round 3, M12).
+ */
+declare class BroadcastUnknownError extends Error {
+    /** Always true: the transaction may be on its way. */
+    readonly maybeSent = true;
+    /** The transaction id (hex). */
+    readonly hash: string;
+    constructor(hash: string, cause: unknown);
+}
+
+/**
+ * An endpoint answered with a refusal (HTTP 4xx other than 408 with a reason, or an error body):
+ * nothing was taken. A thrown fetch, a timeout, a 5xx or a body that cannot be read may have been.
+ */
+declare function isAnsweredRefusal(e: unknown): boolean;
+
 /** Hash of a signed message (`Zcash Signed Message:` prefix, double SHA-256). */
 declare function magicHash(message: string | Uint8Array): Uint8Array;
 /** Encode `r‖s` + recovery id as a base64 signature (compressed-key header 31 + recovery). */
@@ -366,7 +388,13 @@ declare class WalletAccountZcash extends WalletAccountReadOnlyZcash implements I
     /** Zcash message signature (zcashd `signmessage` encoding), base64. */
     sign(message: string | Uint8Array): Promise<string>;
     private ctx;
-    /** Lock time + expiry + branch id from the tip (or the config override). */
+    /**
+     * Lock time, expiry and branch id for a transaction that lands in the next block (round 3, L7):
+     * expiry = tip + 1 + `expiryDelta`, the branch id in force at tip + 1 (mainnet table; off mainnet
+     * `consensusBranchId` must be configured — testnet and regtest activate upgrades at other heights).
+     * Without a tip nothing is signed when the expiry, anti-fee-sniping or the branch id need it: a
+     * transaction signed with expiry 0 never expires.
+     */
     private chainParams;
     /** Sign every input through the signer; the scriptSig is `<DER ‖ 0x01> <pubkey>`. */
     private signInputs;
@@ -386,6 +414,12 @@ declare class WalletAccountZcash extends WalletAccountReadOnlyZcash implements I
     sendTransaction(tx: ZcashTransaction, options?: WriteOptions): Promise<TransferResult>;
     /** Native ZEC only (`token` is rejected). Subject to `transferMaxFee`. */
     transfer(o: ZcashTransferOptions, writeOptions?: WriteOptions): Promise<TransferResult>;
+    /**
+     * Send once through the client. Only a node's refusal means nothing went out; "already in the
+     * mempool / block chain" means an earlier attempt delivered it; anything else may have landed and
+     * is a {@link BroadcastUnknownError} with the txid computed before sending (round 3, M12).
+     */
+    private broadcast;
     /** The same address as a {@link WalletAccountReadOnlyZcash}. */
     toReadOnlyAccount(): IWalletAccountReadOnly;
     dispose(): void;
@@ -416,4 +450,4 @@ declare class WalletManagerZcash extends WalletManager<WalletAccountZcash, Zcash
     getFeeRates(): Promise<FeeRates>;
 }
 
-export { type BlockbookTxDetails, type BlockbookVin, type BlockbookVout, CURRENT_BRANCH_ID, type CoinSelectOptions, type CoinSelection, DEFAULT_EXPIRY_DELTA, DEFAULT_MAX_FEE, DUST_LIMIT, type DecodedAddress, type DescribeContext, FINAL_SEQUENCE, GRACE_ACTIONS, MAINNET_UPGRADES, MARGINAL_FEE, MAX_SEQUENCE, MAX_UTXO_INPUTS, P2PKH_INPUT_SIZE, SIGHASH_ALL, type ScriptKind, type SpendPlan, SpentOutput, TX_VERSION_V5, TooManyInputsError, type TransparentTxV5, type TxInput, type TxOutput, type UnsafeTransactionCode, UnsafeTransactionError, Utxo, VERSION_GROUP_ID_V5, WalletAccountReadOnlyZcash, WalletAccountZcash, WalletManagerZcash, ZcashBlockbookClient, ZcashClient, ZcashConfig, ZcashMaxSpendableResult, ZcashNetwork, ZcashReceipt, ZcashSpend, ZcashTransaction, ZcashTransferOptions, ZcashTxDescription, ZcashTxInfo, addressFor, addressFromPublicKey, addressFromScript, addressPrefix, assertSafe, branchIdForHeight, coinType, conventionalFee, createClient, decodeAddress, WalletManagerZcash as default, describeTransaction, encodeAddress, encodeMessageSignature, estimateSize, hash160, headerDigest, logicalActions, magicHash, outputSize, outputsDigest, p2pkhScriptSig, parseP2pkhScriptSig, parseTx, prevoutsDigest, recoverMessagePublicKey, scriptFor, scriptKind, selectAll, selectCoins, sequenceDigest, serializeTx, sighashAll, signMessageWith, spendableUtxos, transparentDigest, txHashPersonalization, txid, txidDigest };
+export { type BlockbookTxDetails, type BlockbookVin, type BlockbookVout, BroadcastUnknownError, type Built, CURRENT_BRANCH_ID, type CoinSelectOptions, type CoinSelection, DEFAULT_EXPIRY_DELTA, DEFAULT_MAX_FEE, DUST_LIMIT, type DecodedAddress, type DescribeContext, FINAL_SEQUENCE, GRACE_ACTIONS, MAINNET_UPGRADES, MARGINAL_FEE, MAX_SEQUENCE, MAX_UTXO_INPUTS, P2PKH_INPUT_SIZE, SIGHASH_ALL, type ScriptKind, type SpendPlan, SpentOutput, TX_VERSION_V5, TooManyInputsError, type TransparentTxV5, type TxInput, type TxOutput, type UnsafeTransactionCode, UnsafeTransactionError, Utxo, VERSION_GROUP_ID_V5, WalletAccountReadOnlyZcash, WalletAccountZcash, WalletManagerZcash, ZcashBlockbookClient, ZcashClient, ZcashConfig, ZcashMaxSpendableResult, ZcashNetwork, ZcashReceipt, ZcashSpend, ZcashTransaction, ZcashTransferOptions, ZcashTxDescription, ZcashTxInfo, addressFor, addressFromPublicKey, addressFromScript, addressPrefix, assertSafe, branchIdForHeight, coinType, conventionalFee, createClient, decodeAddress, WalletManagerZcash as default, describeTransaction, encodeAddress, encodeMessageSignature, estimateSize, hash160, headerDigest, isAnsweredRefusal, logicalActions, magicHash, outputSize, outputsDigest, p2pkhScriptSig, parseP2pkhScriptSig, parseTx, prevoutsDigest, recoverMessagePublicKey, scriptFor, scriptKind, selectAll, selectCoins, sequenceDigest, serializeTx, sighashAll, signMessageWith, spendableUtxos, transparentDigest, txHashPersonalization, txid, txidDigest };

package/dist/index.js

@@ -14,15 +14,19 @@ import {
   encodeCursor,
   fetchWithTimeout,
   hexToBytes,
+  isAlreadyKnown,
+  isAnsweredRefusal,
   isInt,
   isIntString,
   isRecord,
   mapDashboardTx,
+  refusal,
+  refusedStatus,
   reverseBytes,
   u32le,
   utf8ToBytes,
   zcashExplorerTxUrl
-} from "./chunk-6C7LNZNX.js";
+} from "./chunk-JIJF3MGJ.js";
 
 // src/address.ts
 import { sha256 } from "@noble/hashes/sha2.js";
@@ -340,9 +344,26 @@ function describeTransaction(tx, spent, ctx) {
   const inputs = tx.inputs.map((i, k) => ({ txid: i.txid, vout: i.vout, value: spent[k].value, address: addressFromScript(spent[k].script, ctx.network) }));
   const outputs = [];
   const warnings = /* @__PURE__ */ new Set();
+  const scriptOf = (address) => {
+    try {
+      return bytesToHex(decodeAddress(address, ctx.network).script);
+    } catch {
+      return void 0;
+    }
+  };
+  const ownScript = scriptOf(ctx.ownAddress);
+  const intendedScript = ctx.intended ? scriptOf(ctx.intended.to) : void 0;
+  let recipientSeen = false;
   for (const o of tx.outputs) {
     const address = addressFromScript(o.script, ctx.network);
-    const role = address !== void 0 && address === ctx.ownAddress ? "change" : ctx.intended === void 0 ? "recipient" : address !== void 0 && address === ctx.intended.to && o.value === ctx.intended.value ? "recipient" : "unknown";
+    const script = bytesToHex(o.script);
+    const mine = script === ownScript;
+    let role;
+    if (ctx.intended === void 0) role = mine ? "change" : "recipient";
+    else if (!recipientSeen && script === intendedScript && o.value === ctx.intended.value) {
+      role = "recipient";
+      recipientSeen = true;
+    } else role = mine ? "change" : "unknown";
     if (scriptKind(o.script) !== "unknown" && o.value < DUST_LIMIT) warnings.add("dust-output");
     outputs.push({ address, value: o.value, role });
   }
@@ -408,7 +429,11 @@ var ZcashBlockbookClient = class _ZcashBlockbookClient {
   async get(path, check) {
     const url = `${this.base}/api${path}`;
     const res = await fetchWithTimeout(this.fetchFn, url, { headers: this.headers }, this.timeoutMs, this.base);
-    if (!res.ok) throw new NetworkError(`Blockbook request failed: ${res.status} ${res.statusText} (${url})`, { provider: this.base });
+    if (!res.ok) {
+      const reason = refusedStatus(res.status) ? (await res.text().catch(() => "")).slice(0, 200) : "";
+      const err = new NetworkError(`Blockbook request failed: ${res.status} ${res.statusText} (${url})${reason ? `: ${reason}` : ""}`, { provider: this.base });
+      throw refusedStatus(res.status) ? refusal(err) : err;
+    }
     let body;
     try {
       body = await res.json();
@@ -458,7 +483,7 @@ var ZcashBlockbookClient = class _ZcashBlockbookClient {
   }
   async broadcast(rawTx) {
     const data = await this.get(`/v2/sendtx/${rawTx}`, (v) => isRecord(v));
-    if (data.error) throw new Error(`Broadcast rejected: ${typeof data.error === "string" ? data.error : data.error.message ?? "broadcast failed"}`);
+    if (data.error) throw refusal(new Error(`Broadcast rejected: ${typeof data.error === "string" ? data.error : data.error.message ?? "broadcast failed"}`));
     if (!data.result) throw new NetworkError("Blockbook returned no txid", { provider: this.base });
     return data.result;
   }
@@ -494,12 +519,19 @@ function createClient(config) {
   const attempts = list.length + (config.retries ?? 3);
   const call = (method) => async (...args) => {
     let last;
+    let silent = false;
     for (let i = 0; i < attempts; i++) {
       const c = list[i % list.length];
       try {
         return await c[method].apply(c, args);
       } catch (e) {
-        if (method === "broadcast" && !(e instanceof NetworkError2)) throw e;
+        if (method === "broadcast") {
+          if (isAnsweredRefusal(e)) {
+            if (!silent) throw e;
+            throw new NetworkError2("A Zcash client refused the broadcast after another never answered: it may be out", { cause: e });
+          }
+          silent = true;
+        }
         last = e;
       }
     }
@@ -510,6 +542,19 @@ function createClient(config) {
   return out;
 }
 
+// src/errors.ts
+var BroadcastUnknownError = class extends Error {
+  /** Always true: the transaction may be on its way. */
+  maybeSent = true;
+  /** The transaction id (hex). */
+  hash;
+  constructor(hash, cause) {
+    super(`Broadcast outcome unknown for ${hash}: ${cause instanceof Error ? cause.message.slice(0, 200) : String(cause).slice(0, 200)}`, { cause });
+    this.name = "BroadcastUnknownError";
+    this.hash = hash;
+  }
+};
+
 // src/message.ts
 import { sha256 as sha2562 } from "@noble/hashes/sha2.js";
 import { secp256k1 } from "@noble/curves/secp256k1.js";
@@ -563,7 +608,7 @@ function recoverMessagePublicKey(message, signature) {
 import { LocalSigner as LocalSigner2, SignerError as SignerError2, WalletManager, isSeedSigner } from "@anywalletkit/core";
 
 // src/account.ts
-import { InsufficientFundsError as InsufficientFundsError3, LocalSigner, SignerError, feeLimit, requireCurve } from "@anywalletkit/core";
+import { InsufficientFundsError as InsufficientFundsError3, LocalSigner, NetworkError as NetworkError4, SignerError, feeLimit, requireCurve } from "@anywalletkit/core";
 import { secp256k1 as secp256k12 } from "@noble/curves/secp256k1.js";
 
 // src/read-only-account.ts
@@ -719,13 +764,27 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
   ctx(intended) {
     return { network: this._network, ownAddress: this.address, intended, maxFee: this.maxFee };
   }
-  /** Lock time + expiry + branch id from the tip (or the config override). */
+  /**
+   * Lock time, expiry and branch id for a transaction that lands in the next block (round 3, L7):
+   * expiry = tip + 1 + `expiryDelta`, the branch id in force at tip + 1 (mainnet table; off mainnet
+   * `consensusBranchId` must be configured — testnet and regtest activate upgrades at other heights).
+   * Without a tip nothing is signed when the expiry, anti-fee-sniping or the branch id need it: a
+   * transaction signed with expiry 0 never expires.
+   */
   async chainParams() {
-    const tip = await this.tipHeight();
     const delta = this._config.expiryDelta ?? DEFAULT_EXPIRY_DELTA;
-    const consensusBranchId = this._config.consensusBranchId ?? branchIdForHeight(tip);
-    const lockTime = tip !== void 0 && this._config.antiFeeSniping !== false ? tip : 0;
-    const expiryHeight = tip !== void 0 && delta > 0 ? tip + delta : 0;
+    const configured = this._config.consensusBranchId;
+    if (configured === void 0 && this._network !== "mainnet") {
+      throw new UnsafeTransactionError("unknown-branch-id", `On ${this._network} the consensus branch id depends on that network's upgrade heights; set consensusBranchId in the config.`);
+    }
+    const antiSnipe = this._config.antiFeeSniping !== false;
+    const needTip = delta > 0 || antiSnipe || configured === void 0;
+    const tip = needTip ? await this.tipHeight() : void 0;
+    if (needTip && tip === void 0) throw new NetworkError4("The Zcash chain tip is unknown, so the expiry height and the branch id cannot be set; nothing was signed.");
+    const next = tip === void 0 ? void 0 : tip + 1;
+    const consensusBranchId = configured ?? branchIdForHeight(next);
+    const lockTime = tip !== void 0 && antiSnipe ? tip : 0;
+    const expiryHeight = next !== void 0 && delta > 0 ? next + delta : 0;
     return { lockTime, expiryHeight, consensusBranchId };
   }
   /** Sign every input through the signer; the scriptSig is `<DER ‖ 0x01> <pubkey>`. */
@@ -815,8 +874,7 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
       fee = built.fee;
     }
     this.checkMax(fee, feeLimit(this._config.transactionMaxFee, options), "transaction");
-    const id = await client.broadcast(rawHex);
-    return { hash: id || hash, fee };
+    return { hash: await this.broadcast(client, rawHex, hash), fee };
   }
   /** Native ZEC only (`token` is rejected). Subject to `transferMaxFee`. */
   async transfer(o, writeOptions = {}) {
@@ -825,8 +883,21 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
     const client = this.requireClient("transfer");
     const built = await this.signSpend({ to: o.recipient, value: o.amount });
     this.checkMax(built.fee, feeLimit(this._config.transferMaxFee, writeOptions), "transfer");
-    const id = await client.broadcast(built.hex);
-    return { hash: id || built.txid, fee: built.fee };
+    return { hash: await this.broadcast(client, built.hex, built.txid), fee: built.fee };
+  }
+  /**
+   * Send once through the client. Only a node's refusal means nothing went out; "already in the
+   * mempool / block chain" means an earlier attempt delivered it; anything else may have landed and
+   * is a {@link BroadcastUnknownError} with the txid computed before sending (round 3, M12).
+   */
+  async broadcast(client, rawHex, txid2) {
+    try {
+      return await client.broadcast(rawHex) || txid2;
+    } catch (e) {
+      if (isAlreadyKnown(e)) return txid2;
+      if (isAnsweredRefusal(e)) throw e;
+      throw new BroadcastUnknownError(txid2, e);
+    }
   }
   /** The same address as a {@link WalletAccountReadOnlyZcash}. */
   toReadOnlyAccount() {
@@ -890,6 +961,7 @@ var WalletManagerZcash = class extends WalletManager {
 export {
   BLOCKCHAIR_URL,
   BlockchairClient,
+  BroadcastUnknownError,
   CAIP2,
   CURRENT_BRANCH_ID,
   DEFAULT_EXPIRY_DELTA,
@@ -933,6 +1005,7 @@ export {
   estimateSize,
   hash160,
   headerDigest,
+  isAnsweredRefusal,
   logicalActions,
   magicHash,
   mapDashboardTx,