@anywalletkit/wallet-zcash 0.4.0 → 0.5.1

package/dist/index.cjs

@@ -985,7 +985,24 @@ var import_secp256k12 = require("@noble/curves/secp256k1.js");
 
 // src/read-only-account.ts
 var import_core6 = require("@anywalletkit/core");
+function assertSpendShape(spend) {
+  const proto = typeof spend === "object" && spend !== null && !Array.isArray(spend) ? Object.getPrototypeOf(spend) : void 0;
+  if (proto === void 0 || proto !== null && Object.getPrototypeOf(proto) !== null) {
+    throw new UnsafeTransactionError("malformed-spend", "A spend must be one plain object ({ to, value, \u2026 }); a list or another kind of object is not signed.");
+  }
+}
 var toBig = (v) => typeof v === "bigint" ? v : BigInt(typeof v === "string" ? v.trim() : Math.round(v));
+function spendValue(v) {
+  if (typeof v === "bigint") return v;
+  if (typeof v === "number" && Number.isInteger(v)) return BigInt(v);
+  if (typeof v === "string" && v.length <= 300 && !/\s/.test(v)) {
+    try {
+      return BigInt(v);
+    } catch {
+    }
+  }
+  throw new UnsafeTransactionError("malformed-spend", "A spend value must be a bigint, a whole number or an integer string of at most 300 characters (zatoshis).");
+}
 var WalletAccountReadOnlyZcash = class {
   /** The transparent address. */
   address;
@@ -1030,8 +1047,9 @@ var WalletAccountReadOnlyZcash = class {
   }
   /** Coin selection for a spend (ZIP-317 fee). Validates the recipient and the dust floor first. */
   async planSpend(spend) {
+    assertSpendShape(spend);
     if (this.scriptKind !== "p2pkh") throw new Error(`Cannot build spends from a ${this.scriptKind} address; only P2PKH (t1\u2026) accounts spend.`);
-    const amount = toBig(spend.value);
+    const amount = spendValue(spend.value);
     const recipient = decodeAddress(spend.to, this._network);
     if (amount < DUST_LIMIT) throw new Error(`The amount must be at least the dust limit (${DUST_LIMIT} zatoshis).`);
     const utxos = await this.requireClient("plan a spend").listUnspent(this.address);
@@ -1104,15 +1122,22 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
   path;
   /** Compressed secp256k1 public key. */
   publicKey;
-  /** The signer that holds the key. */
-  signer;
+  /**
+   * The signer that holds the key, in a private field: not a property of the account, so no code
+   * the account is handed to (a protocol module, a logger) can reach it and sign around the
+   * account's checks (audit 2026-10-29 A1).
+   */
+  #signer;
+  /** What holds the key: `seed`, `key` (one imported key) or `external`. */
+  signerKind;
   _disposed = false;
   _readOnly;
   /** `publicKey` is the signer's compressed secp256k1 key (33 bytes); it is needed synchronously for the address. */
   constructor(signer, publicKey, path, config = {}) {
     super(addressFromPublicKey(publicKey, config.network ?? "mainnet"), config);
-    this.signer = (0, import_core7.requireCurve)(signer, "secp256k1");
-    if (!this.signer.schemes.includes("ecdsa")) throw new import_core7.SignerError(`A Zcash account needs a signer with the 'ecdsa' scheme (has: ${this.signer.schemes.join(", ")}).`);
+    this.#signer = (0, import_core7.requireCurve)(signer, "secp256k1");
+    this.signerKind = this.#signer.kind;
+    if (!this.#signer.schemes.includes("ecdsa")) throw new import_core7.SignerError(`A Zcash account needs a signer with the 'ecdsa' scheme (has: ${this.#signer.schemes.join(", ")}).`);
     this.publicKey = publicKey;
     this.path = path;
   }
@@ -1131,7 +1156,7 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
   /** Zcash message signature (zcashd `signmessage` encoding), base64. */
   async sign(message) {
     this.live();
-    return signMessageWith(message, this.signer);
+    return signMessageWith(message, this.#signer);
   }
   ctx(intended) {
     return { network: this._network, ownAddress: this.address, intended, maxFee: this.maxFee };
@@ -1163,7 +1188,7 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
   async #signInputs(tx, spent) {
     for (let i = 0; i < tx.inputs.length; i++) {
       const digest = sighashAll(tx, i, spent);
-      const rs = await this.signer.sign(digest, { scheme: "ecdsa", context: "zcash-sighash" });
+      const rs = await this.#signer.sign(digest, { scheme: "ecdsa", context: "zcash-sighash" });
       const der = import_secp256k12.secp256k1.Signature.fromBytes(rs, "compact").toBytes("der");
       tx.inputs[i].scriptSig = p2pkhScriptSig(der, this.publicKey);
     }
@@ -1278,7 +1303,7 @@ var WalletAccountZcash = class _WalletAccountZcash extends WalletAccountReadOnly
   }
   dispose() {
     this._disposed = true;
-    this.signer.dispose();
+    this.#signer.dispose();
   }
 };