@anywalletkit/wallet-zcash 0.5.0 → 0.5.1

package/dist/index.cjs

@@ -985,7 +985,24 @@ var import_secp256k12 = require("@noble/curves/secp256k1.js");
 
 // src/read-only-account.ts
 var import_core6 = require("@anywalletkit/core");
+function assertSpendShape(spend) {
+  const proto = typeof spend === "object" && spend !== null && !Array.isArray(spend) ? Object.getPrototypeOf(spend) : void 0;
+  if (proto === void 0 || proto !== null && Object.getPrototypeOf(proto) !== null) {
+    throw new UnsafeTransactionError("malformed-spend", "A spend must be one plain object ({ to, value, \u2026 }); a list or another kind of object is not signed.");
+  }
+}
 var toBig = (v) => typeof v === "bigint" ? v : BigInt(typeof v === "string" ? v.trim() : Math.round(v));
+function spendValue(v) {
+  if (typeof v === "bigint") return v;
+  if (typeof v === "number" && Number.isInteger(v)) return BigInt(v);
+  if (typeof v === "string" && v.length <= 300 && !/\s/.test(v)) {
+    try {
+      return BigInt(v);
+    } catch {
+    }
+  }
+  throw new UnsafeTransactionError("malformed-spend", "A spend value must be a bigint, a whole number or an integer string of at most 300 characters (zatoshis).");
+}
 var WalletAccountReadOnlyZcash = class {
   /** The transparent address. */
   address;
@@ -1030,8 +1047,9 @@ var WalletAccountReadOnlyZcash = class {
   }
   /** Coin selection for a spend (ZIP-317 fee). Validates the recipient and the dust floor first. */
   async planSpend(spend) {
+    assertSpendShape(spend);
     if (this.scriptKind !== "p2pkh") throw new Error(`Cannot build spends from a ${this.scriptKind} address; only P2PKH (t1\u2026) accounts spend.`);
-    const amount = toBig(spend.value);
+    const amount = spendValue(spend.value);
     const recipient = decodeAddress(spend.to, this._network);
     if (amount < DUST_LIMIT) throw new Error(`The amount must be at least the dust limit (${DUST_LIMIT} zatoshis).`);
     const utxos = await this.requireClient("plan a spend").listUnspent(this.address);