@scure/btc-signer 2.2.0 → 2.3.0

package/src/p2p.ts

@@ -42,6 +42,9 @@ const MINUS_3_SQRT = Fp.sqrt(Fp.create(BigInt(-3)));
 const _3n = BigInt(3);
 const _4n = BigInt(4);
 const _7n = BigInt(7);
+// Precomputed 1/2 mod p: turns the frequent "divide by 2" steps of XSwiftEC/XSwiftECInv
+// into single multiplications instead of one modular inversion per call.
+const INV_2 = Fp.inv(Fp.create(_2n));
 // This is the "lift_x(x) succeeds" predicate for field-normalized x values.
 // Raw x >= p would need the full BIP340 range check before reducing modulo p.
 const isValidX = (x: bigint) => FpIsSquare(Fp, Fp.add(Fp.mul(Fp.mul(x, x), x), _7n));
@@ -91,7 +94,7 @@ export const elligatorSwift = /* @__PURE__ */ Object.freeze({
       const r = trySqrt(Fp.mul(Fp.neg(s), Fp.add(Fp.mul(_4n, t0), t1)));
       if (r === undefined) return; // [2 condition]
       if (ellCase & 1 && Fp.is0(r)) return;
-      v = Fp.div(Fp.add(Fp.neg(u), Fp.div(r, s)), _2n); // v = (-u + r / s) / 2
+      v = Fp.mul(Fp.add(Fp.neg(u), Fp.div(r, s)), INV_2); // v = (-u + r / s) / 2
     }
     const w = trySqrt(s);
     if (w === undefined) return; // [3 condition]
@@ -99,7 +102,7 @@ export const elligatorSwift = /* @__PURE__ */ Object.freeze({
     const t0 = last & 1 ? Fp.add(_1n, MINUS_3_SQRT) : Fp.sub(_1n, MINUS_3_SQRT);
     const w0 = last === 0 || last === 5 ? Fp.neg(w) : w; // -w | w
     // w0 * (u * t0 / 2 + v)
-    return Fp.mul(w0, Fp.add(Fp.div(Fp.mul(u, t0), _2n), v));
+    return Fp.mul(w0, Fp.add(Fp.mul(Fp.mul(u, t0), INV_2), v));
   },
   // Encode public key (point or x coordinate bigint) into 64-byte pseudorandom encoding
   // BIP324 samples encodings for x(P), so callers must pass a curve X coordinate in 0..p-1;
@@ -109,11 +112,18 @@ export const elligatorSwift = /* @__PURE__ */ Object.freeze({
     // so encode() must reject out-of-range x instead of silently reducing a different bigint modulo p.
     if (!Fp.isValid(x))
       throw new RangeError('elligatorSwift.encode: expected x coordinate in range 0..p-1');
+    // Off-curve x cannot round-trip: decode() only returns lift_x-able candidates, so
+    // the loop below would silently emit an encoding of a *different* public key.
+    if (!isValidX(x))
+      throw new RangeError('elligatorSwift.encode: expected x coordinate of a curve point');
     // 200k test cycles per keygen: avg=4 max=48
     // seems too much, but same as for reference implementation
     while (true) {
-      // random scalar 1..Fp.ORDER
-      const u = Fp.create(Fp.fromBytes(secp256k1.utils.randomSecretKey()));
+      // Random field element 1..p-1: BIP324 samples u over the whole field (the previous
+      // secret-key sampler silently restricted u to 1..n-1); decode() remaps u = 0, so
+      // zero cannot round-trip and is skipped.
+      const u = Fp.create(Fp.fromBytes(randomBytes(32), true));
+      if (Fp.is0(u)) continue;
       const ellCase = randomBytes(1)[0] & 7; // [0..8)
       const t = elligatorSwift._inv(x, u, ellCase);
       if (!t) continue;
@@ -140,9 +150,11 @@ export const elligatorSwift = /* @__PURE__ */ Object.freeze({
     // try different cases
     let res = Fp.add(u, Fp.mul(Fp.mul(y, y), _4n)); // u + 4 * Y ** 2,
     if (isValidX(res)) return Fp.toBytes(res) as TRet<Uint8Array>;
-    res = Fp.div(Fp.sub(Fp.div(Fp.neg(x), y), u), _2n); // (-X / Y - u) / 2
+    // X / Y is shared by the remaining candidates; computing it once saves an inversion.
+    const xDivY = Fp.div(x, y);
+    res = Fp.mul(Fp.sub(Fp.neg(xDivY), u), INV_2); // (-X / Y - u) / 2
     if (isValidX(res)) return Fp.toBytes(res) as TRet<Uint8Array>;
-    res = Fp.div(Fp.sub(Fp.div(x, y), u), _2n); // (X / Y - u) / 2
+    res = Fp.mul(Fp.sub(xDivY, u), INV_2); // (X / Y - u) / 2
     if (isValidX(res)) return Fp.toBytes(res) as TRet<Uint8Array>;
     throw new Error('elligatorSwift: cannot decode public key');
   },
@@ -173,6 +185,10 @@ export const elligatorSwift = /* @__PURE__ */ Object.freeze({
   ): TRet<Uint8Array> => {
     // BIP324 Shared secret computation hashes "the exactly 64-byte public keys'
     // encodings sent over the wire", so both ElligatorSwift inputs must be 64 bytes here.
+    // Initiator/responder ordering decides the hash-input order, so require a real boolean
+    // instead of letting arbitrary truthy values pick a side.
+    if (typeof initiating !== 'boolean')
+      throw new TypeError('"initiating" expected boolean, got type=' + typeof initiating);
     const ours = abytes(publicKeyOurs, 64, 'publicKeyOurs');
     const theirs = abytes(publicKeyTheirs, 64, 'publicKeyTheirs');
     const ecdhPoint = elligatorSwift.getSharedSecret(privateKeyOurs, theirs);

package/src/payment.ts

@@ -29,11 +29,18 @@ export type P2Ret = {
 };
 
 // Pay to Anchor (P2A)
+// BIP433 Pay-to-Anchor witness program bytes; the scriptPubKey is `OP_1 <0x4e73>`.
+const P2A_PROGRAM = /* @__PURE__ */ Uint8Array.from([0x4e, 0x73]);
 type OutP2AType = { type: 'p2a'; script: Bytes };
 const OutP2A: Coder<OptScript, OutP2AType | undefined> = {
   encode(from: TArg<ScriptType>): TRet<OutP2AType | undefined> {
     // BIP433 defines P2A as the exact OP_1 <0x4e73> scriptPubKey.
-    if (from.length !== 2 || from[0] !== 1 || !u.isBytes(from[1]) || hex.encode(from[1]) !== '4e73')
+    if (
+      from.length !== 2 ||
+      from[0] !== 1 ||
+      !u.isBytes(from[1]) ||
+      !u.equalBytes(from[1], P2A_PROGRAM)
+    )
       return;
     return { type: 'p2a', script: Script.encode(from) } as TRet<OutP2AType | undefined>;
   },
@@ -41,7 +48,7 @@ const OutP2A: Coder<OptScript, OutP2AType | undefined> = {
     if (to.type !== 'p2a') return;
     // The decoded object keeps `script` for caller convenience, but the `p2a`
     // tag always canonicalizes back to the fixed BIP433 script.
-    return [1, hex.decode('4e73')] as TRet<OptScript>;
+    return [1, Uint8Array.from(P2A_PROGRAM)] as TRet<OptScript>;
   },
 };
 
@@ -87,8 +94,9 @@ const OutPKH: Coder<OptScript, OutPKHType | undefined> = {
   encode(from: TArg<ScriptType>): TRet<OutPKHType | undefined> {
     if (from.length !== 5 || from[0] !== 'DUP' || from[1] !== 'HASH160' || !u.isBytes(from[2]))
       return;
-    // OutScript validates that the pushed HASH160 is exactly 20 bytes.
-    // This child matcher only recognizes the canonical P2PKH opcode skeleton.
+    // Require the exact 20-byte HASH160 here so near-miss scripts fall through
+    // to OutUnknown instead of throwing in the OutScript validator on decode.
+    if (from[2].length !== 20) return;
     if (from[3] !== 'EQUALVERIFY' || from[4] !== 'CHECKSIG') return;
     return { type: 'pkh', hash: from[2] } as TRet<OutPKHType | undefined>;
   },
@@ -105,8 +113,9 @@ const OutSH: Coder<OptScript, OutSHType | undefined> = {
   encode(from: TArg<ScriptType>): TRet<OutSHType | undefined> {
     if (from.length !== 3 || from[0] !== 'HASH160' || !u.isBytes(from[1]) || from[2] !== 'EQUAL')
       return;
-    // OutScript validates that the pushed HASH160 is exactly 20 bytes.
-    // This child matcher only recognizes the canonical P2SH opcode skeleton.
+    // Require the exact 20-byte HASH160 here so near-miss scripts fall through
+    // to OutUnknown instead of throwing in the OutScript validator on decode.
+    if (from[1].length !== 20) return;
     return { type: 'sh', hash: from[1] } as TRet<OutSHType | undefined>;
   },
   // OutScript validates `sh.hash` before this branch emits the canonical
@@ -159,9 +168,12 @@ const OutMS: Coder<OptScript, OutMSType | undefined> = {
     if (typeof m !== 'number' || typeof n !== 'number') return;
     const pubkeys = from.slice(1, -2);
     if (n !== pubkeys.length) return;
-    for (const pub of pubkeys) if (!u.isBytes(pub)) return;
-    // OutScript validates pubkey encodings and `0 < m <= n <= 16`.
-    // This child matcher only recognizes the canonical CHECKMULTISIG skeleton.
+    // Require valid ECDSA pubkeys and `0 < m <= n` here so near-miss
+    // CHECKMULTISIG scripts (garbage keys, degenerate 0-of-0) fall through to
+    // OutUnknown instead of throwing in the OutScript validator on decode.
+    // Script.decode only yields 0..16 for opcode numbers, so n <= 16 holds.
+    for (const pub of pubkeys) if (!u.isBytes(pub) || !isValidPubkey(pub, u.PubT.ecdsa)) return;
+    if (!Number.isSafeInteger(m) || m < 1 || m > n) return;
     // We don't need n here because it is the same as pubkeys.length.
     return { type: 'ms', m, pubkeys: pubkeys as Bytes[] } as TRet<OutMSType | undefined>;
   },
@@ -182,6 +194,10 @@ const OutTR: Coder<OptScript, OutTRType | undefined> = {
     // BIP341 assigns native taproot meaning only to version 1 with a 32-byte x-only program;
     // other OP_1 program lengths remain reserved future witness programs and should fall through.
     if (from.length !== 2 || from[0] !== 1 || !u.isBytes(from[1]) || from[1].length !== 32) return;
+    // A 32-byte v1 program with an off-curve x coordinate is a fundable but
+    // taproot-unspendable output; classify it as unknown instead of throwing
+    // in the OutScript validator on decode.
+    if (!isValidPubkey(from[1], u.PubT.schnorr)) return;
     return { type: 'tr', pubkey: from[1] } as TRet<OutTRType | undefined>;
   },
   // OutScript validates `tr.pubkey` before this branch emits the canonical
@@ -243,9 +259,13 @@ const OutTRMS: Coder<OptScript, OutTRMSType | undefined> = {
         if (elm !== (i === 1 ? 'CHECKSIG' : 'CHECKSIGADD')) return;
         continue;
       }
-      if (!u.isBytes(elm)) return;
+      // Require actual Schnorr pubkeys here (same as tr_ns) so near-miss
+      // CHECKSIGADD scripts fall through to OutUnknown instead of throwing
+      // in the OutScript validator on decode.
+      if (!u.isBytes(elm) || !isValidPubkey(elm, u.PubT.schnorr)) return;
       pubkeys.push(elm);
     }
+    if (!Number.isSafeInteger(m) || m < 1 || m > pubkeys.length || pubkeys.length > 999) return;
     return { type: 'tr_ms', pubkeys, m } as TRet<OutTRMSType | undefined>;
   },
   decode: (to: TArg<OutTRMSType>): TRet<OptScript> => {
@@ -408,7 +428,8 @@ export const OutScript: TRet<
 export type OutScriptType = typeof OutScript;
 // TRet-wrapping OutScript changes decode() to the normalized descriptor surface, but the local
 // checkScript/Address caches still need an explicit alias that can carry the decode-side `undefined`.
-type OutScriptValue = ReturnType<OutScriptType['decode']> | undefined;
+type AddressValue = NonNullable<ReturnType<OutScriptType['decode']>>;
+type OutScriptValue = AddressValue | undefined;
 
 // Basic sanity check for scripts
 function checkWSH(s: TArg<OutWSHType>, witnessScript: TArg<Bytes>) {
@@ -606,6 +627,7 @@ export const p2sh = <T extends P2Ret>(
   child: TArg<T>,
   network: BTC_NETWORK = NETWORK
 ): TRet<Extends<P2SHReturn<T>, P2Ret>> => {
+  u.validateObject(child as Record<string, any>, {}, {}, 'child');
   // It is already tested inside noble-hashes and checkScript
   // BIP16 redeemScripts are pushed by scriptSig, so anything over the 520-byte pushed-element
   // limit would be fundable by HASH160 but unspendable once wrapped in P2SH.
@@ -672,6 +694,7 @@ export const p2wsh = (
   child: TArg<P2Ret>,
   network: BTC_NETWORK = NETWORK
 ): TRet<Extends<P2WSH, P2Ret>> => {
+  u.validateObject(child as Record<string, any>, {}, {}, 'child');
   const cs = child.script;
   if (!u.isBytes(cs)) throw new Error(`Wrong script: ${typeof cs}, expected Uint8Array`);
   // BIP141 P2WSH says the witness "must consist of ... a serialized script (witnessScript)"
@@ -782,9 +805,16 @@ function checkTaprootScript(
     // disable custom. All custom scripts for taproot should have prefix 'tr_'
     if (customScripts) {
       const cs = P.apply(Script, P.coders.match(customScripts));
-      const c = cs.decode(script);
+      let c;
+      // match() throws when no custom coder matches; treat that as "not a custom
+      // script" so the allowUnknownOutputs escape below stays reachable.
+      try {
+        c = cs.decode(script);
+      } catch (e) {
+        c = undefined;
+      }
       if (c !== undefined) {
-        if (typeof c.type !== 'string' || !c.type.startsWith('tr_'))
+        if (!u.astring(c.type, 'c.type').startsWith('tr_'))
           throw new Error(`P2TR: invalid custom type=${c.type}`);
         return;
       }
@@ -867,6 +897,13 @@ type _TaprootTreeInternal = {
  * ```
  */
 export function taprootListToTree(taprootList: TArg<TaprootScriptList>): TRet<TaprootScriptTree> {
+  u.aarray<TaprootScriptList[number]>(taprootList, 'taprootList', (leaf, title) => {
+    // p2tr reduces non-binary trees through this helper, so nested branch arrays are valid here.
+    if (Array.isArray(leaf)) return;
+    u.validateObject(leaf as Record<string, any>, {}, {}, title);
+    // This helper only arranges weighted tree nodes; p2tr validates leaf scripts while hashing.
+    if (leaf.weight !== undefined) anumber(leaf.weight, title + '.weight');
+  });
   // Empty flat lists cannot represent a taproot script tree; omit the tree entirely for
   // key-path-only outputs instead of passing [] here, otherwise this helper would return
   // undefined and downstream taproot tree walkers would fail much later on a non-tree value.
@@ -947,17 +984,22 @@ function taprootHashTree(
   allowUnknownOutputs = false,
   customScripts?: TArg<CustomScript[]>
 ): TRet<HashedTree> {
-  if (!tree) throw new Error('taprootHashTree: empty tree');
+  if (tree === undefined) throw new Error('taprootHashTree: empty tree');
+  if (!Array.isArray(tree) && !P.utils.isPlainObject(tree))
+    throw new TypeError('"tree" expected object or array, got type=' + typeof tree);
   if (Array.isArray(tree) && tree.length === 1) tree = tree[0];
   // Terminal node (leaf)
   if (!Array.isArray(tree)) {
+    u.validateObject(tree as Record<string, any>, {}, {}, 'tree');
     const version = tree.leafVersion;
     const { script: leafScript } = tree;
     // Earliest tree walk where we can validate tapScripts
     if (tree.tapLeafScript || (tree.tapMerkleRoot && !u.equalBytes(tree.tapMerkleRoot, P.EMPTY)))
       throw new Error('P2TR: tapRoot leafScript cannot have tree');
-    const script = typeof leafScript === 'string' ? hex.decode(leafScript) : leafScript;
-    if (!u.isBytes(script)) throw new Error(`checkScript: wrong script type=${script}`);
+    const script =
+      typeof leafScript === 'string'
+        ? hex.decode(leafScript)
+        : abytes(leafScript, undefined, 'tree.script');
     checkTaprootScript(script, internalPubKey, allowUnknownOutputs, customScripts);
     return {
       type: 'leaf',
@@ -1071,18 +1113,20 @@ export function p2tr(
     );
     const tapMerkleRoot = hashedTree.hash;
     const [tweakedPubkey, parity] = u.taprootTweakPubkey(pubKey, tapMerkleRoot);
+    const tapLeafScript: NonNullable<TransactionInput['tapLeafScript']> = [];
     const leaves = taprootWalkTree(hashedTree).map((l) => {
       const version = tapLeafVersion(l.version);
-      return {
-        ...l,
-        // Leaf versions are stored as the base even byte; only the control block adds the
-        // output-key parity bit required by BIP 341 script-path spending.
-        controlBlock: TaprootControlBlock.encode({
-          version: version + parity,
-          internalKey: pubKey,
-          merklePath: l.path,
-        }),
+      // Leaf versions are stored as the base even byte; only the control block adds the
+      // output-key parity bit required by BIP 341 script-path spending.
+      const controlBlock = {
+        version: version + parity,
+        internalKey: pubKey,
+        merklePath: l.path,
       };
+      // Skip an encode/decode copy for performance; callers must treat returned metadata as
+      // immutable.
+      tapLeafScript.push([controlBlock, u.concatBytes(l.script, new Uint8Array([version]))]);
+      return { ...l, controlBlock: TaprootControlBlock.encode(controlBlock) };
     });
     return {
       type: 'tr',
@@ -1093,10 +1137,7 @@ export function p2tr(
       // PSBT stuff
       tapInternalKey: pubKey,
       leaves,
-      tapLeafScript: leaves.map((l) => [
-        TaprootControlBlock.decode(l.controlBlock),
-        u.concatBytes(l.script, new Uint8Array([tapLeafVersion(l.version)])),
-      ]),
+      tapLeafScript,
       tapMerkleRoot,
     } as const as TRet<Extends<P2TR_TREE, P2Ret>>;
   } else {
@@ -1278,6 +1319,7 @@ export function getAddress(
   privKey: TArg<Bytes>,
   network: BTC_NETWORK = NETWORK
 ): string {
+  u.astring(type, 'type');
   if (type === 'tr') {
     return p2tr(u.pubSchnorr(privKey), undefined, network).address;
   }
@@ -1429,18 +1471,24 @@ export function WIF(network: BTC_NETWORK = NETWORK): TRet<Coder<Bytes, string>>
  * coder.encode(p2wpkh(pubECDSA(randomPrivateKeyBytes())));
  * ```
  */
-export function Address(network: BTC_NETWORK = NETWORK) {
+export function Address(network: BTC_NETWORK = NETWORK): TRet<P.Coder<AddressValue, string>> {
+  u.validateObject(network as Record<string, any>, {}, {}, 'network');
   return {
-    encode(from: Exclude<OutScriptValue, undefined>): string {
+    encode(from: TArg<AddressValue>): string {
+      u.validateObject(from as Record<string, any>, {}, {}, 'from');
       const { type } = from;
+      u.astring(type, 'from.type');
       if (type === 'wpkh') return programToWitness(0, from.hash, network);
       else if (type === 'wsh') return programToWitness(0, from.hash, network);
       else if (type === 'tr') return programToWitness(1, from.pubkey, network);
+      // BIP433 P2A is the fixed v1 witness program 0x4e73 ('bc1pfeessrawgf').
+      else if (type === 'p2a') return programToWitness(1, P2A_PROGRAM, network);
       else if (type === 'pkh') return formatKey(from.hash, [network.pubKeyHash]);
       else if (type === 'sh') return formatKey(from.hash, [network.scriptHash]);
       throw new Error(`Unknown address type=${type}`);
     },
-    decode(address: string): OutScriptValue {
+    decode(address: string): TRet<AddressValue> {
+      u.astring(address, 'address');
       if (address.length < 14 || address.length > 74) throw new Error('Invalid address length');
       // Bech32
       if (network.bech32 && address.toLowerCase().startsWith(`${network.bech32}1`)) {
@@ -1458,25 +1506,27 @@ export function Address(network: BTC_NETWORK = NETWORK) {
         const data = bech32.fromWords(program);
         validateWitness(version, data);
         if (version === 0 && data.length === 32)
-          return { type: 'wsh', hash: data } as OutScriptValue;
+          return { type: 'wsh', hash: data } as TRet<AddressValue>;
         else if (version === 0 && data.length === 20)
-          return { type: 'wpkh', hash: data } as OutScriptValue;
+          return { type: 'wpkh', hash: data } as TRet<AddressValue>;
         else if (version === 1 && data.length === 32)
-          return { type: 'tr', pubkey: data } as OutScriptValue;
+          return { type: 'tr', pubkey: data } as TRet<AddressValue>;
+        else if (version === 1 && u.equalBytes(data, P2A_PROGRAM))
+          return { type: 'p2a', script: Script.encode([1, data]) } as TRet<AddressValue>;
         // Future witness versions can still be valid addresses, but this helper
-        // only returns typed descriptors for recognized v0 and taproot templates.
+        // only returns typed descriptors for recognized v0, taproot and P2A templates.
         else throw new Error('Unknown witness program');
       }
       const data = base58check.decode(address);
       if (data.length !== 21) throw new Error('Invalid base58 address');
       // Pay To Public Key Hash
       if (data[0] === network.pubKeyHash) {
-        return { type: 'pkh', hash: data.slice(1) } as OutScriptValue;
+        return { type: 'pkh', hash: data.slice(1) } as TRet<AddressValue>;
       } else if (data[0] === network.scriptHash) {
         return {
           type: 'sh',
           hash: data.slice(1),
-        } as OutScriptValue;
+        } as TRet<AddressValue>;
       }
       throw new Error(`Invalid address prefix=${data[0]}`);
     },

package/src/psbt.ts

@@ -1,4 +1,5 @@
 import { hex } from '@scure/base';
+import { anumber } from '@noble/hashes/utils.js';
 import * as P from 'micro-packed';
 import {
   CompactSize,
@@ -10,17 +11,23 @@ import {
   VarBytes,
 } from './script.ts';
 import {
+  aarray,
   type Bytes,
   compareBytes,
   equalBytes,
   PubT,
   type TArg,
   type TRet,
+  validateObject,
   validatePubkey,
 } from './utils.ts';
 
 // PSBT BIP174, BIP370, BIP371
 
+// Be friendly to bad ECMAScript parsers by not using bigint literals.
+// prettier-ignore
+const _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1);
+
 // BIP174 keydata only says "public key", so legacy PSBT ECDSA fields still accept both
 // compressed (33-byte) and uncompressed (65-byte) SEC1 encodings, but not x-only keys.
 const PubKeyECDSA: P.CoderType<Bytes> = /* @__PURE__ */ (() =>
@@ -157,9 +164,9 @@ const tapTree = /* @__PURE__ */ (() =>
         while (next.length < depth) next.push(0);
         path = next;
       }
-      let leaves = 0n;
-      for (let i = 0; i < tree.length; i++) leaves += 1n << BigInt(maxDepth - tree[i].depth);
-      if (leaves !== 1n << BigInt(maxDepth))
+      let leaves = _0n;
+      for (let i = 0; i < tree.length; i++) leaves += _1n << BigInt(maxDepth - tree[i].depth);
+      if (leaves !== _1n << BigInt(maxDepth))
         throw new Error('tapTree: tuples must describe a complete binary tree');
       return tree;
     }
@@ -593,7 +600,7 @@ export const PSBTOutputCoder = /* @__PURE__ */ (() =>
       // in the field coder itself because BIP371 constrains the tuple value, not just the row shape.
       // BIP174/BIP370 define PSBT_OUT_AMOUNT as a signed int64 transport field, but it still
       // represents the transaction output amount in satoshis, so negative output values are invalid.
-      if (o.amount !== undefined && o.amount < 0n)
+      if (o.amount !== undefined && o.amount < _0n)
         throw new Error(`validateOutput: wrong amount=${o.amount}`);
       if (o.bip32Derivation) for (const [k] of o.bip32Derivation) validatePubkey(k, PubT.ecdsa);
       return o;
@@ -726,6 +733,9 @@ export function cleanPSBTFields<T extends PSBTKeyMap>(
   info: T,
   lst: TArg<PSBTKeyMapKeys<T>>
 ): TRet<PSBTKeyMapKeys<T>> {
+  anumber(version, 'version');
+  validateObject(info as Record<string, any>, {}, {}, 'info');
+  validateObject(lst as Record<string, any>, {}, {}, 'lst');
   const _lst = lst as PSBTKeyMapKeys<T>;
   const out: PSBTKeyMapKeys<T> = {};
   for (const _k in _lst) {
@@ -747,7 +757,7 @@ export function cleanPSBTFields<T extends PSBTKeyMap>(
   return out as TRet<PSBTKeyMapKeys<T>>;
 }
 
-function validatePSBT(tx: P.UnwrapCoder<PSBTRaw>) {
+function validatePSBT(tx: P.UnwrapCoder<PSBTRaw>): P.UnwrapCoder<PSBTRaw> {
   const version = (tx && tx.global && tx.global.version) || 0;
   validatePSBTFields(version, PSBTGlobal, tx.global);
   for (const i of tx.inputs) validatePSBTFields(version, PSBTInput, i);
@@ -803,6 +813,10 @@ export function mergeKeyMap<T extends PSBTKeyMap>(
   allowedFields?: TArg<readonly (keyof PSBTKeyMapKeys<T>)[]>,
   allowUnknown?: boolean
 ): TRet<PSBTKeyMapKeys<T>> {
+  validateObject(psbtEnum as Record<string, any>, {}, {}, 'psbtEnum');
+  validateObject(val as Record<string, any>, {}, {}, 'val');
+  if (cur !== undefined) validateObject(cur as Record<string, any>, {}, {}, 'cur');
+  if (allowedFields !== undefined) aarray(allowedFields, 'allowedFields');
   const _val = val as PSBTKeyMapKeys<T>;
   const _cur = cur as PSBTKeyMapKeys<T> | undefined;
   const _allowedFields = allowedFields as readonly (keyof PSBTKeyMapKeys<T>)[] | undefined;

package/src/script.ts

@@ -1,5 +1,14 @@
 import * as P from 'micro-packed';
-import { isBytes, reverseObject, type ValueOf, type Bytes, type TArg, type TRet } from './utils.ts';
+import {
+  aarray,
+  abytes,
+  isBytes,
+  reverseObject,
+  type Bytes,
+  type TArg,
+  type TRet,
+  type ValueOf,
+} from './utils.ts';
 
 /**
  * Maximum byte size allowed for a single pushed script element.
@@ -8,6 +17,12 @@ import { isBytes, reverseObject, type ValueOf, type Bytes, type TArg, type TRet
  */
 export const MAX_SCRIPT_BYTE_LENGTH = 520;
 
+// Be friendly to bad ECMAScript parsers by not using bigint literals.
+// prettier-ignore
+const _0n = /* @__PURE__ */ BigInt(0), _1n = /* @__PURE__ */ BigInt(1), _2n = /* @__PURE__ */ BigInt(2), _8n = /* @__PURE__ */ BigInt(8);
+const U8_MAX = /* @__PURE__ */ BigInt(0xff);
+const COMPACT_DIRECT_MAX = /* @__PURE__ */ BigInt(0xfc);
+
 // prettier-ignore
 /**
  * Bitcoin Script opcode table.
@@ -87,11 +102,11 @@ export type ScriptType = ScriptOP[];
 export function ScriptNum(bytesLimit = 6, forceMinimal = false): P.CoderType<bigint> {
   return P.wrap({
     encodeStream: (w: P.Writer, value: bigint) => {
-      if (value === 0n) return;
+      if (value === _0n) return;
       const neg = value < 0;
       const val = BigInt(value);
       const nums = [];
-      for (let abs = neg ? -val : val; abs; abs >>= 8n) nums.push(Number(abs & 0xffn));
+      for (let abs = neg ? -val : val; abs; abs >>= _8n) nums.push(Number(abs & U8_MAX));
       if (nums[nums.length - 1] >= 0x80) nums.push(neg ? 0x80 : 0);
       else if (neg) nums[nums.length - 1] |= 0x80;
       w.bytes(new Uint8Array(nums));
@@ -100,24 +115,22 @@ export function ScriptNum(bytesLimit = 6, forceMinimal = false): P.CoderType<big
       const len = r.leftBytes;
       if (len > bytesLimit)
         throw new Error(`ScriptNum: number (${len}) bigger than limit=${bytesLimit}`);
-      if (len === 0) return 0n;
+      if (len === 0) return _0n;
+      // Read the payload once instead of peeking for the minimality check and
+      // then re-reading it byte-by-byte through the Reader.
+      const data = r.bytes(len);
       if (forceMinimal) {
-        const data = r.bytes(len, true);
         // MSB is zero (without sign bit) -> not minimally encoded
-        if ((data[data.length - 1] & 0x7f) === 0) {
+        if ((data[len - 1] & 0x7f) === 0) {
           // exception
-          if (len <= 1 || (data[data.length - 2] & 0x80) === 0)
+          if (len <= 1 || (data[len - 2] & 0x80) === 0)
             throw new Error('Non-minimally encoded ScriptNum');
         }
       }
-      let last = 0;
-      let res = 0n;
-      for (let i = 0; i < len; ++i) {
-        last = r.byte();
-        res |= BigInt(last) << (8n * BigInt(i));
-      }
-      if (last >= 0x80) {
-        res &= (2n ** BigInt(len * 8) - 1n) >> 1n;
+      let res = _0n;
+      for (let i = 0; i < len; ++i) res |= BigInt(data[i]) << (_8n * BigInt(i));
+      if (data[len - 1] >= 0x80) {
+        res &= (_2n ** BigInt(len * 8) - _1n) >> _1n;
         res = -res;
       }
       return res;
@@ -148,7 +161,9 @@ export function OpToNum(
   if (isBytes(op)) {
     try {
       const val = ScriptNum(bytesLimit, forceMinimal).decode(op);
-      if (val > Number.MAX_SAFE_INTEGER) return;
+      // Symmetric safe-integer bound: large negative values would otherwise
+      // coerce through Number() with silent precision loss.
+      if (val > Number.MAX_SAFE_INTEGER || val < -Number.MAX_SAFE_INTEGER) return;
       return Number(val);
     } catch (e) {
       return;
@@ -203,10 +218,14 @@ export const Script: TRet<P.CoderType<ScriptType>> = /* @__PURE__ */ (() =>
   Object.freeze(
     P.wrap({
       encodeStream: (w: P.Writer, value: TArg<ScriptType>) => {
+        aarray(value, 'value');
         for (let o of value) {
           if (typeof o === 'string') {
-            if (OP[o] === undefined) throw new Error(`Unknown opcode=${o}`);
-            w.byte(OP[o]);
+            const op = OP[o];
+            // OP is a plain object, so inherited Object.prototype keys ('toString',
+            // 'constructor', ...) are not opcodes and must be rejected here too.
+            if (typeof op !== 'number') throw new Error(`Unknown opcode=${o}`);
+            w.byte(op);
             continue;
           } else if (typeof o === 'number') {
             if (o === 0x00) {
@@ -224,7 +243,7 @@ export const Script: TRet<P.CoderType<ScriptType>> = /* @__PURE__ */ (() =>
           }
           // Encode big numbers
           if (typeof o === 'number') o = ScriptNum().encode(BigInt(o));
-          if (!isBytes(o)) throw new Error(`Wrong Script OP=${o} (${typeof o})`);
+          abytes(o, undefined, 'value');
           // Bytes
           const len = o.length;
           if (len < OP.PUSHDATA1) w.byte(len);
@@ -267,13 +286,6 @@ export const Script: TRet<P.CoderType<ScriptType>> = /* @__PURE__ */ (() =>
     })
   ))() as TRet<P.CoderType<ScriptType>>;
 
-// BTC specific variable length integer encoding
-// https://en.bitcoin.it/wiki/Protocol_documentation#Variable_length_integer
-const CSLimits: Record<number, [number, number, bigint, bigint]> = {
-  0xfd: [0xfd, 2, 253n, 65535n],
-  0xfe: [0xfe, 4, 65536n, 4294967295n],
-  0xff: [0xff, 8, 4294967296n, 18446744073709551615n],
-};
 /**
  * Bitcoin CompactSize integer coder.
  * @example
@@ -282,16 +294,25 @@ const CSLimits: Record<number, [number, number, bigint, bigint]> = {
  * CompactSize.encode(1n);
  * ```
  */
-export const CompactSize: P.CoderType<bigint> = /* @__PURE__ */ (() =>
-  Object.freeze(
+export const CompactSize: P.CoderType<bigint> = /* @__PURE__ */ (() => {
+  // BTC specific variable length integer encoding
+  // https://en.bitcoin.it/wiki/Protocol_documentation#Variable_length_integer
+  const limits: Record<number, [number, number, bigint, bigint]> = {
+    0xfd: [0xfd, 2, BigInt(0xfd), BigInt(0xffff)],
+    0xfe: [0xfe, 4, BigInt(0x10000), BigInt(0xffffffff)],
+    0xff: [0xff, 8, BigInt(0x100000000), BigInt('0xffffffffffffffff')],
+  };
+  // Hoisted: Object.values() would otherwise allocate a fresh array on every encode.
+  const limitsList = Object.values(limits);
+  return Object.freeze(
     P.wrap({
       encodeStream: (w: P.Writer, value: bigint) => {
         if (typeof value === 'number') value = BigInt(value);
-        if (0n <= value && value <= 252n) return w.byte(Number(value));
-        for (const [flag, bytes, start, stop] of Object.values(CSLimits)) {
+        if (_0n <= value && value <= COMPACT_DIRECT_MAX) return w.byte(Number(value));
+        for (const [flag, bytes, start, stop] of limitsList) {
           if (start > value || value > stop) continue;
           w.byte(flag);
-          for (let i = 0; i < bytes; i++) w.byte(Number((value >> (8n * BigInt(i))) & 0xffn));
+          for (let i = 0; i < bytes; i++) w.byte(Number((value >> (_8n * BigInt(i))) & U8_MAX));
           return;
         }
         throw w.err(`VarInt too big: ${value}`);
@@ -299,16 +320,17 @@ export const CompactSize: P.CoderType<bigint> = /* @__PURE__ */ (() =>
       decodeStream: (r: P.Reader): bigint => {
         const b0 = r.byte();
         if (b0 <= 0xfc) return BigInt(b0);
-        const [_, bytes, start] = CSLimits[b0];
-        let num = 0n;
-        for (let i = 0; i < bytes; i++) num |= BigInt(r.byte()) << (8n * BigInt(i));
+        const [_, bytes, start] = limits[b0];
+        let num = _0n;
+        for (let i = 0; i < bytes; i++) num |= BigInt(r.byte()) << (_8n * BigInt(i));
         // BIP 152 / BIP 174: CompactSize fields must use the shortest encoding,
         // so wider prefixes for smaller values are rejected here.
         if (num < start) throw r.err(`Wrong CompactSize(${8 * bytes})`);
         return num;
       },
     })
-  ))();
+  );
+})();
 
 // Same thing, but in number instead of bigint. Checks for safe integer inside
 /**