Make Amount opaque, and use it more

This helps to ensure type-safety of values that are required to satisfy
zatoshi range bounds.

zcash_proofs/src/sapling/mod.rs

@@ -2,6 +2,7 @@ use pairing::bls12_381::Bls12;
 use sapling_crypto::jubjub::{
     edwards, fs::FsRepr, FixedGenerators, JubjubBls12, JubjubParams, Unknown,
 };
+use zcash_primitives::transaction::components::Amount;
 
 mod prover;
 mod verifier;
@@ -11,12 +12,12 @@ pub use self::verifier::SaplingVerificationContext;
 
 // This function computes `value` in the exponent of the value commitment base
 fn compute_value_balance(
-    value: i64,
+    value: Amount,
     params: &JubjubBls12,
 ) -> Option<edwards::Point<Bls12, Unknown>> {
     // Compute the absolute value (failing if -i64::MAX is
     // the value)
-    let abs = match value.checked_abs() {
+    let abs = match i64::from(value).checked_abs() {
         Some(a) => a as u64,
         None => return None,
     };

zcash_proofs/src/sapling/prover.rs

@@ -13,7 +13,9 @@ use sapling_crypto::{
     primitives::{Diversifier, Note, PaymentAddress, ProofGenerationKey, ValueCommitment},
     redjubjub::{PrivateKey, PublicKey, Signature},
 };
-use zcash_primitives::{merkle_tree::CommitmentTreeWitness, sapling::Node};
+use zcash_primitives::{
+    merkle_tree::CommitmentTreeWitness, sapling::Node, transaction::components::Amount,
+};
 
 use super::compute_value_balance;
 
@@ -245,7 +247,7 @@ impl SaplingProvingContext {
     /// and output_proof() must be completed before calling this function.
     pub fn binding_sig(
         &self,
-        value_balance: i64,
+        value_balance: Amount,
         sighash: &[u8; 32],
         params: &JubjubBls12,
     ) -> Result<Signature, ()> {

zcash_proofs/src/sapling/verifier.rs

@@ -6,6 +6,7 @@ use sapling_crypto::{
     jubjub::{edwards, FixedGenerators, JubjubBls12, Unknown},
     redjubjub::{PublicKey, Signature},
 };
+use zcash_primitives::transaction::components::Amount;
 
 use super::compute_value_balance;
 
@@ -169,7 +170,7 @@ impl SaplingVerificationContext {
     /// have been checked before calling this function.
     pub fn final_check(
         &self,
-        value_balance: i64,
+        value_balance: Amount,
         sighash_value: &[u8; 32],
         binding_sig: Signature,
         params: &JubjubBls12,