dcr-ts 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -4,6 +4,224 @@ Notable changes per release. Dates are release dates.
 
 This library has **not** been independently audited. See [SECURITY.md](SECURITY.md).
 
+## 0.3.0 — 2026-09-08
+
+A second automated review pass, and the first whose findings were reproduced by
+running them rather than read from the source. Everything below was confirmed by
+executing it against the published 0.2.1, and every guard but two was checked by
+deleting it and watching a test fail — the two exceptions are defence in depth
+behind `Writer.bytes` and `@scure`'s own catch, so deleting either leaves the
+downstream guard to catch the same case.
+
+Read the breaking section before upgrading: several arguments that 0.2.1 accepted
+and answered now throw, and one predicate answers differently.
+
+### Fixed — found by review
+
+- **`ExtendedKey.fromSeed` accepted a *string* seed and derived a different,
+  fully valid master key.** `@noble`'s `toBytes` UTF-8-encodes a string before its
+  own byte check runs, so a seed handed over as hex text never failed — it became
+  the seed material. A 64-character hex seed, the likeliest wrong value at that
+  call site, sits inside the documented 16–64 window. The result signs, serializes
+  and produces addresses that pass this library's own `isValidAddress`, for a
+  wallet nobody meant to create. The worst shape of failure this package exists to
+  prevent, and it was silent.
+- **The four hash-address encoders checked length but not type.** A 20-character
+  string, a 20-element `Array<number>`, an array-like or a `Float64Array` all
+  satisfy `.length === 20`, and `Uint8Array.prototype.set` coerces element by
+  element, so `pubKeyHashAddress`, `scriptHashAddress`, `pubKeyHashEd25519Address`
+  and `pubKeyHashSchnorrAddress` returned well-formed, valid-checksum addresses for
+  hashes nobody holds the preimage of. `assertHash160` records this reasoning and
+  the pay-to-hash script builders were fixed with it in 0.2.0; their address-side
+  siblings were missed, in the same file that pass edited. The realistic way in is
+  not a bare string but a hash split into hex pairs and never parsed — `"0a"`
+  coerces to 0 and `"10"` to decimal 10, so the address shares a prefix with the
+  intended one and differs in the middle.
+- **`calcSignatureHash` type-checks its cached prefix.** The length test stood
+  alone, and `Writer.bytes` coerces, so a 32-character string committed the
+  preimage to 32 zero bytes: the prefix half stopped distinguishing transactions
+  entirely and `rawTxInSignature` returned a well-formed signature over a message
+  the caller did not hold.
+- **`addOutput` rejects a value that is not a `bigint`.** `Writer.i64`'s bounds
+  test is a BigInt relational comparison, which coerces rather than refuses, so
+  `""`, `" "` and `[]` all became a zero-atom output on a transaction that built,
+  hashed and signed cleanly — sending the whole input value to the miner as fee.
+  The plain `number` that looks like the likelier mistake was the one case that
+  already threw. `addInput`'s `valueIn` and `signatureScript` reach the same
+  writer and are checked too.
+- **A BIP39 passphrase that is not a string meant `String(v)`.** `@scure`'s salt is
+  the concatenation `"mnemonic" + passphrase`, which never rejects, so `null`
+  silently meant the passphrase `"null"` — and through `mnemonicToMasterKey`, a
+  different wallet with nothing raised. `passphrase ?? null` is ordinary
+  JavaScript, and a database column that is NULL for "no passphrase" is the
+  ordinary way to arrive at one. Only omitting the argument takes the default.
+- **A network is matched by its version prefixes, not by object identity.**
+  `decodeAddress` found its entry with `===`, the last place a `Network` turned on
+  the object rather than its contents, while every encoder read the prefix fields
+  off whatever it was handed. So one process holding two equal-but-not-identical
+  `mainnet` objects could encode an address with one and have the other refuse to
+  decode it — and this package invites exactly that, since its own `exports` map
+  hands `import` the ESM bundle and `require` the CJS one. `structuredClone`, a
+  worker boundary and a network read back from a JSON config do the same.
+  `DcrError` has been branded with a registry symbol for this reason since 0.2.0;
+  `Network` was not covered. The symptom was self-contradictory: a good address
+  rejected as `wrong-network`, reported as *"for mainnet, not mainnet"*.
+- **`signP2PKHInputs` no longer drops a signing it was asked to perform.** Two
+  entries sharing an `idx` let the last win: the earlier signature was computed and
+  discarded, and the input the caller meant to cover with the mistyped entry kept
+  its empty signature script. N signings requested, N−1 delivered, and no way to
+  notice, since the return value is the transaction rather than a per-input result.
+  Both outcomes fail closed — the overwritten input is unspendable — so this
+  reports the mistake rather than repairing it. Rejected before the prefix hash is
+  taken, so a refused batch leaves the transaction untouched.
+- **`isValidPublicKey` answered `true` for a hex string, and `verifyHash` took
+  the same string.** `@noble` accepts hex wherever it accepts a key, so the
+  predicate attested to a key the caller was not holding as bytes and the verifier
+  agreed with it. Both now require bytes: the predicate answers `false`, and
+  `verifyHash` throws `invalid-argument`, for the reason it already threw on a
+  wrong-length hash — a wrong-typed key is a caller bug, not a failed
+  verification. `isValidPublicKey`'s two siblings in that file already carried the
+  check.
+- **Nine more exported entries proved their argument's shape before reading it.**
+  Four of them failed *silently* rather than loudly: `base58Encode` encoded a
+  digit string into a plausible base58 string, and `Writer.u64`, `Writer.i64` and
+  `Writer.bytes` each accepted a wrong-shaped operand and wrote bytes for it.
+  `copyOf`, `dcrToAtoms`, `atomsToDcr`, `ExtendedKey.derivePath` and
+  `ExtendedKey.fromSerialized` reported bare engine errors instead of a `DcrError`
+  a caller can classify with `hasErrorCode`.
+- **`encodeWif` names a rejected signature type without quoting it.** The one
+  `${}` interpolation left in the library that a caller-chosen object could reach,
+  so its `toString` decided what the error message said; an object returning 5,000
+  characters of text with an embedded ANSI escape produced exactly that message.
+  `shown` exists for this and is documented at length; this line predated it.
+
+### Changed — breaking
+
+Every change is fail-closed, and every guard in the section above rejects input
+the *typed* API never accepted — but two of the three below can be reached by code
+that typechecks, because neither index distinctness nor wordlist length is
+expressible in the type system. A JavaScript caller can reach all of them.
+
+- **A supplied `network` must be a `Network`.** `decodeAddress(address, null)` —
+  and `0`, `""`, `false`, a partial object, anything that is not a network — now
+  throws `invalid-argument` instead of falling back to network-agnostic decoding,
+  which is what `addressToScript` already refused. `isValidAddress` with such a
+  value goes from `true` to **`false`**, silently, which is the one change here
+  that does not announce itself: a caller storing the selected network as `null`
+  to mean "any" will find every address rejected. Omitting the argument still
+  infers the network, as before.
+- **A malformed wordlist throws where `validateMnemonic` used to answer.** The
+  phrase is still answered `false` for a non-string, which is what a predicate is
+  for and what `mnemonicToMasterKey` documents relying on — but now by decision
+  rather than by `@scure` catching its own `TypeError`. The wordlist is the
+  caller's configuration rather than the subject being predicated, so a list that
+  is not 2048 words throws, as it already did at every other entry in that module.
+- **`signP2PKHInputs` rejects a repeated `idx`.** It used to let the later entry
+  overwrite the earlier one's signature script, dropping a signing the caller
+  asked for with nothing to notice it by. `readonly P2PKHInputToSign[]` cannot
+  express distinctness, so this is reachable from code that typechecks.
+- **Wrong-shaped arguments throw where they were coerced.** Every guard in the
+  section above is a behaviour change for a JavaScript caller, and one is worth
+  naming on its own: `pubKeyHashAddress(Array.from(hash), network)` returned the
+  correct address in 0.2.1 and now throws, because a plain `Array` is not bytes.
+  `Array.from` is how a `Uint8Array` degrades through `JSON.stringify`, so a hash
+  rebuilt from JSON is the ordinary way to arrive there. Convert with
+  `Uint8Array.from` before calling.
+
+### Fixed — regressions in the guards above, before release
+
+Caught by reproducing the whole diff against the published 0.2.1 rather than by
+the tests written alongside the guards, which is what that comparison is for.
+
+- **Two guards broke the contract they exist to serve.** `validateMnemonic(phrase,
+  null)` and `decodeAddress(address, partialNetwork)` each proved one field and
+  then read others a partial value does not have, throwing a bare `TypeError`
+  where 0.2.1 had answered `false` and thrown a typed `wrong-network`. Both are
+  `DcrError`s again, so `hasErrorCode` classifies them and a catch that rethrows
+  non-`DcrError`s no longer rethrows.
+- **Two option guards disagreed with the defaults beside them.**
+  `addInput(outPoint, { valueIn: null })` threw, where `opts.valueIn ??
+  NULL_VALUE_IN` had always taken the documented default — so `valueIn` behaved
+  differently from `sequence` and `blockHeight` next to it. JSON carries `null`
+  and never `undefined`, so an input rebuilt from an RPC response is the ordinary
+  way there. `signatureScript` is aligned the same way: `null` and `""` mean "no
+  script" as they always did, and only a *truthy* non-`Uint8Array` is rejected.
+
+### Fixed — CI
+
+- **A registry outage no longer reds the build, or aborts a release.**
+  `npm audit` exits 1 for three unrelated reasons — it found an advisory, the
+  registry was unreachable, or the registry rejected the request — and reports
+  all three as `audit endpoint returned an error`. Only the first should fail a
+  build, and on 2026-09-04 a 503 failed CI after npm spent seven minutes on its
+  own internal retries. The same step gates `release.yml`, where that would abort
+  a publish and leave a signed tag with nothing shipped against it.
+  `.github/audit-production-deps.sh` now tells them apart by HTTP status: an
+  advisory and a rejected request each fail on the first attempt, since retrying
+  fixes neither, while a 5xx, a 429 or a transport failure is retried with
+  backoff and npm's own retrying is capped so each attempt fails in seconds
+  rather than minutes. An audit that never ran still fails — passing a gate that
+  did not execute is how a security check stops being one — but it says so in
+  those words. Both workflows run the one script so they cannot drift.
+- **CI audits through the endpoint the registry still supports.** The npm bundled
+  with the Node runtime posts to `/-/npm/v1/security/audits/quick`, which the
+  registry is retiring and which answered a 400 `Invalid package tree` here; a
+  current npm uses `/-/npm/v1/security/advisories/bulk`. The `package` job now
+  installs one, as `release.yml` already did for OIDC. The informational full
+  audit, which gates nothing, is bounded by a timeout rather than left to hang.
+
+### Documented — a dcrd-faithful non-canonical address
+
+- **Ed25519 pay-to-pubkey addresses have one alias, and it matches dcrd.** The
+  oddness bit means nothing for an Ed25519 key, so it is masked off rather than
+  required to be clear: identifier bytes `0x01` and `0x81` name the same address,
+  decoding to the same key and the same pkScript, and only the `0x01` form is what
+  `pubKeyEd25519Address` emits. `encode(decode(x))` is therefore not always `x`
+  for this one kind. dcrd's `stdaddr.DecodeAddressV0` masks identically and its
+  `AddressPubKeyEd25519V0.String()` re-emits the `0x01` form too — verified
+  directly against dcrd, address for address and script for script. A sweep of
+  every identifier byte across all four networks, every WIF suite byte and every
+  extended-key version found this to be the only such alias in the decoders. Now
+  pinned by a test, so neither half of the parity can drift unnoticed.
+
+## 0.2.1 — 2026-08-25
+
+**No changes to the library.** `src/` is byte-identical to 0.2.0 and the built
+bundle is unchanged; the package version is not embedded in it. Everything here
+is release infrastructure, plus the one thing that could only be tested by
+performing a release.
+
+### Changed — releasing
+
+- **Publishing moved to CI, authorised by a signed tag.** The workflow verifies
+  the tag against an allowed-signers list before it does anything else, pins the
+  checkout to the commit the tag points at, refuses a tag that disagrees with
+  `package.json`, and re-runs the full gates — typecheck, tests, both-format
+  entry-point resolution, a production-dependency audit, and a dcrd vector
+  regeneration — before it can publish.
+- **Authentication is OIDC, not a stored token.** Trusted publishing means no
+  long-lived credential exists in the repository at all, and npm generates the
+  provenance attestation automatically. 0.2.0 was published by hand before the
+  package existed on the registry, so it carries no attestation; this is the
+  first release that does.
+- **The signer policy is read from the default branch, not from the tag.**
+  Reading it from the tagged tree would have let a tag supply the policy
+  authorising it — a tag carrying its own allowed-signers list, signed with the
+  key it names, would have verified itself.
+- **Canonical `repository.url`** (`git+https://…​.git`), matching what
+  `hosted-git-info` normalises to. This was previously described as a provenance
+  fix; it is not. `libnpmpublish` never reads the field when generating an
+  attestation.
+- **CI and npm badges in the README**, which is also the package page on npm.
+
+### Why this version exists
+
+The publish step had never executed. The republish guard correctly stops any
+re-run against a version already on the registry, so no amount of re-running
+0.2.0 could exercise the OIDC exchange — only a version that does not yet exist
+can. Releasing 0.2.1 is how the path gets proven, and the cost is a version
+number rather than an untested release pipeline discovered at the worst moment.
+
 ## 0.2.0 — 2026-08-25
 
 ### Fixed — consensus

package/README.md

@@ -1,5 +1,8 @@
 # dcr-ts
 
+[![CI](https://github.com/jzbz/dcr-ts/actions/workflows/ci.yml/badge.svg)](https://github.com/jzbz/dcr-ts/actions/workflows/ci.yml)
+[![npm](https://img.shields.io/npm/v/dcr-ts)](https://www.npmjs.com/package/dcr-ts)
+
 Decred (DCR) primitives for TypeScript: **BLAKE-256**, addresses, WIF, **BIP32
 HD keys** with Decred serialization, BIP39 mnemonics, the **transaction wire
 format**, the **Decred signature hash**, and **low-S ECDSA** P2PKH signing.
@@ -142,9 +145,11 @@ signP2PKHInputs(tx, [
 ]);
 ```
 
-Byte-identical to calling `signP2PKHInput` per input. On the hashing alone this
-is 12–26x for 50–1000 inputs; end to end the win is smaller (1.7x at 250 inputs)
-because ECDSA dominates. `calcSignatureHash` also takes an optional
+Byte-identical to calling `signP2PKHInput` per input, for a list of distinct
+indices — a repeated `idx` is rejected with `invalid-argument` rather than
+letting the later entry overwrite the earlier one's signature. On the hashing
+alone this is 12–26x for 50–1000 inputs; end to end the win is smaller (1.7x at
+250 inputs) because ECDSA dominates. `calcSignatureHash` also takes an optional
 `cachedPrefix` from `sigHashPrefixAll(tx)` if you are building signature scripts
 yourself.
 

package/dist/index.cjs

@@ -31,6 +31,9 @@ function err(code, who, message) {
 
 // src/bytes.ts
 function copyOf(src, off, n) {
+  if (!isBytes(src)) {
+    throw err("invalid-argument", "copyOf", `source must be a Uint8Array, got ${typeName(src)}`);
+  }
   if (!Number.isInteger(off) || !Number.isInteger(n) || off < 0 || n < 0) {
     throw err(
       "not-an-integer",
@@ -118,6 +121,7 @@ var Writer = class {
   // steps. Every input amount and output value in a transaction crosses one of
   // these, and the loop version measured ~33x slower on the primitive.
   u64(v) {
+    if (typeof v !== "bigint") throw err("invalid-argument", "Writer.u64", `value must be a bigint, got ${typeName(v)}`);
     if (v < 0n || v > 0xffffffffffffffffn) throw err("out-of-range", "Writer.u64", "value must fit in an unsigned 64-bit integer");
     this.ensure(8);
     this.view.setBigUint64(this.len, v, true);
@@ -126,6 +130,7 @@ var Writer = class {
   }
   /** Signed 64-bit little-endian (two's complement). Used for atom amounts. */
   i64(v) {
+    if (typeof v !== "bigint") throw err("invalid-argument", "Writer.i64", `value must be a bigint, got ${typeName(v)}`);
     if (v < -(1n << 63n) || v >= 1n << 63n) throw err("out-of-range", "Writer.i64", "value must fit in a signed 64-bit integer");
     this.ensure(8);
     this.view.setBigInt64(this.len, v, true);
@@ -133,6 +138,7 @@ var Writer = class {
     return this;
   }
   bytes(b) {
+    if (!isBytes(b)) throw err("invalid-argument", "Writer.bytes", `value must be a Uint8Array, got ${typeName(b)}`);
     this.ensure(b.length);
     this.buf.set(b, this.len);
     this.len += b.length;
@@ -775,6 +781,9 @@ for (let i = 0; i < ALPHABET.length; i++) {
   INDEX[ALPHABET.charCodeAt(i)] = i;
 }
 function base58Encode(bytes) {
+  if (!isBytes(bytes)) {
+    throw err("invalid-argument", "base58Encode", `input must be a Uint8Array, got ${typeName(bytes)}`);
+  }
   let zeros = 0;
   while (zeros < bytes.length && bytes[zeros] === 0) zeros++;
   let num = 0n;
@@ -910,6 +919,7 @@ function publicKeyFromPrivate(privateKey, compressed = true) {
   return secp256k1.secp256k1.getPublicKey(privateKey, compressed);
 }
 function isValidPublicKey(key) {
+  if (!isBytes(key)) return false;
   try {
     secp256k1.secp256k1.ProjectivePoint.fromHex(key);
     return true;
@@ -1204,6 +1214,32 @@ for (const network of Object.values(networks)) {
     { network, kind: "pubkey-ecdsa", prefix: network.pubKeyAddrId }
   );
 }
+function eq2(a, b) {
+  return a[0] === b[0] && a[1] === b[1];
+}
+var ADDRESS_PREFIX_FIELDS = [
+  "pubKeyAddrId",
+  "pubKeyHashAddrId",
+  "pubKeyHashEdwardsAddrId",
+  "pubKeyHashSchnorrAddrId",
+  "scriptHashAddrId"
+];
+function assertNetwork(network, who) {
+  const shaped = typeof network === "object" && network !== null && typeof network.name === "string" && ADDRESS_PREFIX_FIELDS.every((f) => {
+    const p = network[f];
+    return Array.isArray(p) && p.length === 2 && typeof p[0] === "number" && typeof p[1] === "number";
+  });
+  if (!shaped) {
+    throw err(
+      "invalid-argument",
+      who,
+      `network must be a Network with its address prefixes, got ${typeName(network)} (pass mainnet, testnet3, simnet or regnet)`
+    );
+  }
+}
+function sameNetwork(a, b) {
+  return a === b || eq2(a.pubKeyAddrId, b.pubKeyAddrId) && eq2(a.pubKeyHashAddrId, b.pubKeyHashAddrId) && eq2(a.pubKeyHashEdwardsAddrId, b.pubKeyHashEdwardsAddrId) && eq2(a.pubKeyHashSchnorrAddrId, b.pubKeyHashSchnorrAddrId) && eq2(a.scriptHashAddrId, b.scriptHashAddrId);
+}
 function encode(prefix, payload) {
   const data = new Uint8Array(2 + payload.length);
   data[0] = prefix[0];
@@ -1211,19 +1247,28 @@ function encode(prefix, payload) {
   data.set(payload, 2);
   return checkEncode(data);
 }
+function assertHash20(hash, who) {
+  if (!isBytes(hash)) {
+    throw err("invalid-argument", who, `hash must be a Uint8Array, got ${typeName(hash)}`);
+  }
+}
 function pubKeyHashAddress(hash, network) {
+  assertHash20(hash, "pubKeyHashAddress");
   if (hash.length !== 20) throw err("bad-length", "pubKeyHashAddress", `hash must be 20 bytes, got ${hash.length}`);
   return encode(network.pubKeyHashAddrId, hash);
 }
 function scriptHashAddress(hash, network) {
+  assertHash20(hash, "scriptHashAddress");
   if (hash.length !== 20) throw err("bad-length", "scriptHashAddress", `hash must be 20 bytes, got ${hash.length}`);
   return encode(network.scriptHashAddrId, hash);
 }
 function pubKeyHashEd25519Address(hash, network) {
+  assertHash20(hash, "pubKeyHashEd25519Address");
   if (hash.length !== 20) throw err("bad-length", "pubKeyHashEd25519Address", `hash must be 20 bytes, got ${hash.length}`);
   return encode(network.pubKeyHashEdwardsAddrId, hash);
 }
 function pubKeyHashSchnorrAddress(hash, network) {
+  assertHash20(hash, "pubKeyHashSchnorrAddress");
   if (hash.length !== 20) throw err("bad-length", "pubKeyHashSchnorrAddress", `hash must be 20 bytes, got ${hash.length}`);
   return encode(network.pubKeyHashSchnorrAddrId, hash);
 }
@@ -1293,6 +1338,7 @@ function decodeAddress(address, network) {
   if (typeof address !== "string") {
     throw err("invalid-argument", "decodeAddress", `address must be a string, got ${typeName(address)}`);
   }
+  if (network !== void 0) assertNetwork(network, "decodeAddress");
   if (address.length > MAX_ADDRESS_LENGTH) {
     throw err(
       "input-too-long",
@@ -1304,21 +1350,18 @@ function decodeAddress(address, network) {
   if (data.length < 3) throw err("bad-length", "decodeAddress", `payload is ${data.length} bytes, too short to hold a prefix and data`);
   const prefix = [data[0], data[1]];
   const payload = data.subarray(2);
-  const match = PREFIXES.find(
-    (e) => e.prefix[0] === prefix[0] && e.prefix[1] === prefix[1] && (!network || e.network === network)
-  );
+  const match = PREFIXES.find((e) => e.prefix[0] === prefix[0] && e.prefix[1] === prefix[1]);
   if (!match) {
     const hex = `0x${prefix[0].toString(16).padStart(2, "0")}${prefix[1].toString(16).padStart(2, "0")}`;
-    const onAnotherNetwork = network && PREFIXES.find((e) => e.prefix[0] === prefix[0] && e.prefix[1] === prefix[1]);
-    if (onAnotherNetwork) {
-      throw err(
-        "wrong-network",
-        "decodeAddress",
-        `address is a ${onAnotherNetwork.kind} address for ${onAnotherNetwork.network.name}, not ${network.name}`
-      );
-    }
     throw err("unknown-prefix", "decodeAddress", `unknown address prefix ${hex}`);
   }
+  if (network && !sameNetwork(match.network, network)) {
+    throw err(
+      "wrong-network",
+      "decodeAddress",
+      `address is a ${match.kind} address for ${match.network.name}, not ${network.name}`
+    );
+  }
   if (match.kind === "pubkey-ecdsa") {
     if (payload.length !== 33) throw err("bad-length", "decodeAddress", `pay-to-pubkey payload must be 33 bytes, got ${payload.length}`);
     const { kind, pubKey } = decodePubKeyData(payload);
@@ -1341,13 +1384,7 @@ function isValidAddress(address, network) {
   }
 }
 function addressToScript(address, network) {
-  if (!network || typeof network.name !== "string") {
-    throw err(
-      "invalid-argument",
-      "addressToScript",
-      "a network is required (pass mainnet, testnet3, simnet or regnet)"
-    );
-  }
+  assertNetwork(network, "addressToScript");
   const d = decodeAddress(address, network);
   switch (d.kind) {
     case "pubkeyhash-ecdsa":
@@ -1390,7 +1427,7 @@ function encodeWif(privateKey, network, signatureType = 0 /* Ecdsa */) {
   if (!isBytes(privateKey)) throw err("invalid-argument", "encodeWif", "private key must be a Uint8Array");
   if (privateKey.length !== 32) throw err("bad-length", "encodeWif", `private key must be 32 bytes, got ${privateKey.length}`);
   if (!Number.isInteger(signatureType) || SignatureType[signatureType] === void 0) {
-    throw err("unsupported-signature-type", "encodeWif", `unknown signature type ${signatureType}`);
+    throw err("unsupported-signature-type", "encodeWif", `unknown signature type ${shown(signatureType)}`);
   }
   assertWifScalar(privateKey, signatureType, "encodeWif");
   const payload = new Uint8Array(3 + 32);
@@ -1490,6 +1527,9 @@ var ExtendedKey = class _ExtendedKey {
   cachedPoint = void 0;
   /** Derive a master key from a BIP32 seed (16–64 bytes). */
   static fromSeed(seed, network) {
+    if (!isBytes(seed)) {
+      throw err("invalid-argument", "ExtendedKey.fromSeed", `seed must be a Uint8Array, got ${typeName(seed)}`);
+    }
     if (seed.length < 16 || seed.length > 64) {
       throw err("out-of-range", "ExtendedKey.fromSeed", `seed must be 16..64 bytes, got ${seed.length}`);
     }
@@ -1650,6 +1690,9 @@ var ExtendedKey = class _ExtendedKey {
     return this.derivePathInner(path, true);
   }
   derivePathInner(path, strictBip32) {
+    if (typeof path !== "string") {
+      throw err("invalid-path", "ExtendedKey.derivePath", `path must be a string, got ${typeName(path)}`);
+    }
     const parts = path.trim().split("/");
     if (parts[0] === "m" || parts[0] === "M") parts.shift();
     let key = this;
@@ -1738,6 +1781,9 @@ var ExtendedKey = class _ExtendedKey {
    * key it just parsed. See {@link copyOf}.
    */
   static fromSerialized(data) {
+    if (!isBytes(data)) {
+      throw err("invalid-argument", "ExtendedKey.fromSerialized", `serialization must be a Uint8Array, got ${typeName(data)}`);
+    }
     if (data.length !== SERIALIZED_LENGTH) throw err("bad-length", "ExtendedKey.fromSerialized", `expected ${SERIALIZED_LENGTH} bytes, got ${data.length}`);
     const version = [data[0], data[1], data[2], data[3]];
     const depth = data[4];
@@ -1798,7 +1844,15 @@ function assertMnemonicString(mnemonic, who) {
     throw err("invalid-argument", who, `mnemonic must be a string, got ${typeof mnemonic}`);
   }
 }
+function assertPassphrase(passphrase, who) {
+  if (typeof passphrase !== "string") {
+    throw err("invalid-argument", who, `passphrase must be a string, got ${typeName(passphrase)}`);
+  }
+}
 function assertWordlist(wordlist, who) {
+  if (!Array.isArray(wordlist)) {
+    throw err("invalid-argument", who, `wordlist must be an array of 2048 words, got ${typeName(wordlist)}`);
+  }
   if (wordlist.length !== 2048) {
     throw err("invalid-argument", who, `wordlist must hold 2048 words, got ${wordlist.length}`);
   }
@@ -1815,6 +1869,8 @@ function generateMnemonic(strength = 128, wordlist = english.wordlist) {
   return bip39.generateMnemonic(wordlist, strength);
 }
 function validateMnemonic(mnemonic, wordlist = english.wordlist) {
+  assertWordlist(wordlist, "validateMnemonic");
+  if (typeof mnemonic !== "string") return false;
   return bip39.validateMnemonic(mnemonic, wordlist);
 }
 function mnemonicToEntropy(mnemonic, wordlist = english.wordlist) {
@@ -1843,6 +1899,7 @@ function entropyToMnemonic(entropy, wordlist = english.wordlist) {
 }
 function mnemonicToSeed(mnemonic, passphrase = "") {
   assertMnemonicString(mnemonic, "mnemonicToSeed");
+  assertPassphrase(passphrase, "mnemonicToSeed");
   const words = mnemonic.normalize("NFKD").split(" ").length;
   if (!MNEMONIC_WORD_COUNTS.includes(words)) {
     throw err(
@@ -1855,6 +1912,7 @@ function mnemonicToSeed(mnemonic, passphrase = "") {
 }
 function mnemonicToMasterKey(mnemonic, network, passphrase = "", wordlist = english.wordlist) {
   assertMnemonicString(mnemonic, "mnemonicToMasterKey");
+  assertPassphrase(passphrase, "mnemonicToMasterKey");
   assertWordlist(wordlist, "mnemonicToMasterKey");
   if (!validateMnemonic(mnemonic, wordlist)) {
     throw err(
@@ -1954,6 +2012,20 @@ var Transaction = class _Transaction {
         `outpoint tree must be ${0 /* Regular */} (regular) or ${1 /* Stake */} (stake), got ${shown(previousOutPoint.tree)}`
       );
     }
+    if (opts.valueIn != null && typeof opts.valueIn !== "bigint") {
+      throw err(
+        "invalid-argument",
+        "tx.addInput",
+        `valueIn must be a bigint, got ${typeName(opts.valueIn)}`
+      );
+    }
+    if (opts.signatureScript && !isBytes(opts.signatureScript)) {
+      throw err(
+        "invalid-argument",
+        "tx.addInput",
+        `signatureScript must be a Uint8Array, got ${typeName(opts.signatureScript)}`
+      );
+    }
     this.inputs.push({
       previousOutPoint: {
         hash: copyOf(previousOutPoint.hash, 0, 32),
@@ -1970,6 +2042,13 @@ var Transaction = class _Transaction {
   }
   /** Add an output. The script is copied; see {@link addInput}. */
   addOutput(value, pkScript, version = 0) {
+    if (typeof value !== "bigint") {
+      throw err(
+        "invalid-argument",
+        "tx.addOutput",
+        `value must be a bigint, got ${typeName(value)}`
+      );
+    }
     if (!isBytes(pkScript)) {
       throw err(
         "invalid-argument",
@@ -2180,6 +2259,9 @@ function calcSignatureHash(subScript, hashType, tx, idx, cachedPrefix) {
   const prefixIsInputIndependent = masked === 1 /* All */ && !anyoneCanPay;
   let prefixHash;
   if (cachedPrefix !== void 0 && prefixIsInputIndependent) {
+    if (!isBytes(cachedPrefix)) {
+      throw err("invalid-argument", "sighash", `cachedPrefix must be a Uint8Array, got ${typeName(cachedPrefix)}`);
+    }
     if (cachedPrefix.length !== 32) {
       throw err("bad-length", "sighash", `cachedPrefix must be 32 bytes, got ${cachedPrefix.length}`);
     }
@@ -2241,6 +2323,9 @@ function signHash(hash, privateKey) {
 }
 function verifyHash(hash, derSignature, publicKey) {
   assertHash32(hash, "verifyHash");
+  if (!isBytes(publicKey)) {
+    throw err("invalid-argument", "verifyHash", `public key must be a Uint8Array, got ${typeName(publicKey)}`);
+  }
   try {
     const sig = secp256k1.secp256k1.Signature.fromDER(derSignature);
     const canonical = sig.toDERRawBytes();
@@ -2286,6 +2371,17 @@ function signP2PKHInput(tx, idx, subScript, privateKey, hashType = 1 /* All */,
 }
 function signP2PKHInputs(tx, toSign, hashType = 1 /* All */) {
   assertSignableSigHashType(hashType);
+  const seen = /* @__PURE__ */ new Set();
+  for (const { idx } of toSign) {
+    if (seen.has(idx)) {
+      throw err(
+        "invalid-argument",
+        "signP2PKHInputs",
+        `input index ${idx} is listed more than once`
+      );
+    }
+    seen.add(idx);
+  }
   const cachedPrefix = sigHashPrefixAll(tx);
   for (const { idx, subScript, privateKey, compressed = true } of toSign) {
     tx.inputs[idx].signatureScript = signatureScript(
@@ -2305,6 +2401,9 @@ function signP2PKHInputs(tx, toSign, hashType = 1 /* All */) {
 var ATOMS_PER_COIN = 100000000n;
 var COIN_DECIMALS = 8;
 function dcrToAtoms(dcr) {
+  if (typeof dcr !== "string") {
+    throw err("invalid-amount", "dcrToAtoms", `amount must be a string, got ${typeName(dcr)}`);
+  }
   const s = dcr.trim();
   if (!/^-?\d+(\.\d+)?$/.test(s)) throw err("invalid-amount", "dcrToAtoms", `cannot parse ${shown(dcr)}`);
   const negative = s.startsWith("-");
@@ -2318,6 +2417,9 @@ function dcrToAtoms(dcr) {
   return negative ? -atoms : atoms;
 }
 function atomsToDcr(atoms) {
+  if (typeof atoms !== "bigint") {
+    throw err("invalid-amount", "atomsToDcr", `atoms must be a bigint, got ${typeName(atoms)}`);
+  }
   const negative = atoms < 0n;
   const a = negative ? -atoms : atoms;
   const intPart = a / ATOMS_PER_COIN;