@anywalletkit/wallet-zcash 0.3.1 → 0.5.0

package/dist/index.cjs

@@ -128,7 +128,8 @@ function encodeAddress(kind, hash, network) {
   return b58.encode(Uint8Array.of(a, b, ...hash));
 }
 function decodeAddress(address, network) {
-  const a = address.trim();
+  if (typeof address !== "string" || /\s/.test(address)) throw new Error(`Invalid Zcash address: it carries whitespace or an invisible character (${JSON.stringify(address)}).`);
+  const a = address;
   if (/^u1|^utest/i.test(a)) throw new Error(`Unified address (${a.slice(0, 6)}\u2026) \u2014 shielded receivers are not supported; use a transparent t-address.`);
   if (/^zs1|^ztestsapling/i.test(a)) throw new Error("Sapling shielded address (zs1\u2026) \u2014 this wallet sends to transparent t-addresses only.");
   if (/^zc/i.test(a) && a.length > 90) throw new Error("Sprout address (zc\u2026) \u2014 the Sprout pool is deprecated; use a transparent t-address.");
@@ -1103,15 +1104,22 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
   path;
   /** Compressed secp256k1 public key. */
   publicKey;
-  /** The signer that holds the key. */
-  signer;
+  /**
+   * The signer that holds the key, in a private field: not a property of the account, so no code
+   * the account is handed to (a protocol module, a logger) can reach it and sign around the
+   * account's checks (audit 2026-10-29 A1).
+   */
+  #signer;
+  /** What holds the key: `seed`, `key` (one imported key) or `external`. */
+  signerKind;
   _disposed = false;
   _readOnly;
   /** `publicKey` is the signer's compressed secp256k1 key (33 bytes); it is needed synchronously for the address. */
   constructor(signer, publicKey, path, config = {}) {
     super(addressFromPublicKey(publicKey, config.network ?? "mainnet"), config);
-    this.signer = (0, import_core7.requireCurve)(signer, "secp256k1");
-    if (!this.signer.schemes.includes("ecdsa")) throw new import_core7.SignerError(`A Zcash account needs a signer with the 'ecdsa' scheme (has: ${this.signer.schemes.join(", ")}).`);
+    this.#signer = (0, import_core7.requireCurve)(signer, "secp256k1");
+    this.signerKind = this.#signer.kind;
+    if (!this.#signer.schemes.includes("ecdsa")) throw new import_core7.SignerError(`A Zcash account needs a signer with the 'ecdsa' scheme (has: ${this.#signer.schemes.join(", ")}).`);
     this.publicKey = publicKey;
     this.path = path;
   }
@@ -1130,7 +1138,7 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
   /** Zcash message signature (zcashd `signmessage` encoding), base64. */
   async sign(message) {
     this.live();
-    return signMessageWith(message, this.signer);
+    return signMessageWith(message, this.#signer);
   }
   ctx(intended) {
     return { network: this._network, ownAddress: this.address, intended, maxFee: this.maxFee };
@@ -1159,15 +1167,15 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
     return { lockTime, expiryHeight, consensusBranchId };
   }
   /** Sign every input through the signer; the scriptSig is `<DER ‖ 0x01> <pubkey>`. */
-  async signInputs(tx, spent) {
+  async #signInputs(tx, spent) {
     for (let i = 0; i < tx.inputs.length; i++) {
       const digest = sighashAll(tx, i, spent);
-      const rs = await this.signer.sign(digest, { scheme: "ecdsa", context: "zcash-sighash" });
+      const rs = await this.#signer.sign(digest, { scheme: "ecdsa", context: "zcash-sighash" });
       const der = import_secp256k12.secp256k1.Signature.fromBytes(rs, "compact").toBytes("der");
       tx.inputs[i].scriptSig = p2pkhScriptSig(der, this.publicKey);
     }
   }
-  async signSpend(spend) {
+  async #signSpend(spend) {
     this.live();
     const plan = await this.planSpend(spend);
     const params = await this.chainParams();
@@ -1179,7 +1187,7 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
     const spent = plan.utxos.map((u) => ({ value: u.value, script: this.scriptPubKey }));
     const have = plan.utxos.reduce((s, u) => s + u.value, 0n);
     if (have < plan.amount + plan.fee) throw new import_core7.InsufficientFundsError(plan.amount + plan.fee, have, "ZEC");
-    await this.signInputs(tx, spent);
+    await this.#signInputs(tx, spent);
     const ctx = this.ctx({ to: spend.to, value: plan.amount });
     const desc = describeTransaction(tx, spent, ctx);
     assertSafe(desc, ctx);
@@ -1211,7 +1219,7 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
   /** "What you sign": the fully resolved spend (signed, NOT broadcast) or a caller's raw hex. */
   async describeTransaction(tx) {
     if (typeof tx === "string") return (await this.describeRaw(tx)).desc;
-    return (await this.signSpend(tx)).desc;
+    return (await this.#signSpend(tx)).desc;
   }
   /** Sign without broadcasting. Returns the raw transaction hex. Raw hex input gets the checks `sendTransaction` runs (prevouts through the client) and is returned unchanged, never re-signed. */
   async signTransaction(tx, options = {}) {
@@ -1221,7 +1229,7 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
       this.checkMax(desc.fee, (0, import_core7.feeLimit)(this._config.transactionMaxFee, options), "transaction");
       return tx;
     }
-    const built = await this.signSpend(tx);
+    const built = await this.#signSpend(tx);
     this.checkMax(built.fee, (0, import_core7.feeLimit)(this._config.transactionMaxFee, options), "transaction");
     return built.hex;
   }
@@ -1239,7 +1247,7 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
       hash = txid(parsed);
       fee = desc.fee;
     } else {
-      const built = await this.signSpend(tx);
+      const built = await this.#signSpend(tx);
       rawHex = built.hex;
       hash = built.txid;
       fee = built.fee;
@@ -1252,7 +1260,7 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
     if (o.token) throw new Error("Tokens are not supported on the zcash blockchain.");
     this.live();
     const client = this.requireClient("transfer");
-    const built = await this.signSpend({ to: o.recipient, value: o.amount });
+    const built = await this.#signSpend({ to: o.recipient, value: o.amount });
     this.checkMax(built.fee, (0, import_core7.feeLimit)(this._config.transferMaxFee, writeOptions), "transfer");
     return { hash: await this.broadcast(client, built.hex, built.txid), fee: built.fee };
   }
@@ -1277,7 +1285,7 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
   }
   dispose() {
     this._disposed = true;
-    this.signer.dispose();
+    this.#signer.dispose();
   }
 };