@arkade-os/sdk 0.4.23 → 0.4.25

package/dist/cjs/repositories/sqlite/walletRepository.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.SQLiteWalletRepository = void 0;
 const serialization_1 = require("../serialization");
 const scriptFromAddress_1 = require("../scriptFromAddress");
+const vtxoOwnership_1 = require("../../contracts/vtxoOwnership");
 /**
  * SQLite-based implementation of WalletRepository.
  *
@@ -245,6 +246,28 @@ class SQLiteWalletRepository {
         await this.ensureInit();
         await this.db.run(`DELETE FROM ${this.tables.vtxos} WHERE address = ?`, [address]);
     }
+    async getVtxosForScript(script) {
+        await this.ensureInit();
+        const rows = await this.db.all(`SELECT * FROM ${this.tables.vtxos} WHERE script = ?`, [script]);
+        return rows.map(vtxoRowToDomain);
+    }
+    async saveVtxosForScript(key, vtxos) {
+        if (!key.address) {
+            throw new Error("SQLiteWalletRepository requires an address");
+        }
+        for (const vtxo of vtxos) {
+            if (!(0, vtxoOwnership_1.isVtxoForScript)(vtxo, key.script)) {
+                throw new Error(`VTXO ${vtxo.txid}:${vtxo.vout} script mismatch: expected ${key.script}, got ${vtxo.script}`);
+            }
+        }
+        return this.saveVtxos(key.address, vtxos);
+    }
+    async deleteVtxosForScript(script) {
+        await this.ensureInit();
+        await this.db.run(`DELETE FROM ${this.tables.vtxos} WHERE script = ?`, [
+            script,
+        ]);
+    }
     // ── UTXO management ────────────────────────────────────────────────
     async getUtxos(address) {
         await this.ensureInit();

package/dist/cjs/script/base.js

@@ -1,47 +1,14 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VtxoScript = exports.TapTreeCoder = void 0;
 exports.scriptFromTapLeafScript = scriptFromTapLeafScript;
 exports.getSequence = getSequence;
 const btc_signer_1 = require("@scure/btc-signer");
-const bip68 = __importStar(require("bip68"));
 const payment_js_1 = require("@scure/btc-signer/payment.js");
 const psbt_js_1 = require("@scure/btc-signer/psbt.js");
 const base_1 = require("@scure/base");
 const address_1 = require("./address");
+const timelock_1 = require("../utils/timelock");
 const tapscript_1 = require("./tapscript");
 exports.TapTreeCoder = psbt_js_1.PSBTOutput.tapTree[2];
 function scriptFromTapLeafScript(leaf) {
@@ -163,19 +130,19 @@ class VtxoScript {
         const paths = [];
         for (const leaf of this.leaves) {
             try {
-                const tapscript = tapscript_1.CSVMultisigTapscript.decode(scriptFromTapLeafScript(leaf));
-                paths.push(tapscript);
-                continue;
-            }
-            catch (e) {
-                try {
-                    const tapscript = tapscript_1.ConditionCSVMultisigTapscript.decode(scriptFromTapLeafScript(leaf));
-                    paths.push(tapscript);
+                const script = scriptFromTapLeafScript(leaf);
+                if (tapscript_1.CSVMultisigTapscript.isScriptValid(script) === true) {
+                    const tapScript = tapscript_1.CSVMultisigTapscript.decode(script);
+                    paths.push(tapScript);
                 }
-                catch (e) {
-                    continue;
+                else if (tapscript_1.ConditionCSVMultisigTapscript.isScriptValid(script) === true) {
+                    const tapScript = tapscript_1.ConditionCSVMultisigTapscript.decode(script);
+                    paths.push(tapScript);
                 }
             }
+            catch (e) {
+                console.debug("Failed to decode script", e);
+            }
         }
         return paths;
     }
@@ -206,9 +173,7 @@ function getSequence(tapLeafScript) {
         const script = scriptWithLeafVersion.subarray(0, scriptWithLeafVersion.length - 1);
         try {
             const params = tapscript_1.CSVMultisigTapscript.decode(script).params;
-            sequence = bip68.encode(params.timelock.type === "blocks"
-                ? { blocks: Number(params.timelock.value) }
-                : { seconds: Number(params.timelock.value) });
+            sequence = (0, timelock_1.timelockToSequence)(params.timelock);
         }
         catch {
             const params = tapscript_1.CLTVMultisigTapscript.decode(script).params;

package/dist/cjs/script/tapscript.js

@@ -1,43 +1,10 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CLTVMultisigTapscript = exports.ConditionMultisigTapscript = exports.ConditionCSVMultisigTapscript = exports.CSVMultisigTapscript = exports.MultisigTapscript = exports.TapscriptType = void 0;
 exports.decodeTapscript = decodeTapscript;
-const bip68 = __importStar(require("bip68"));
 const btc_signer_1 = require("@scure/btc-signer");
 const base_1 = require("@scure/base");
+const timelock_1 = require("../utils/timelock");
 const MinimalScriptNum = (0, btc_signer_1.ScriptNum)(undefined, true);
 var TapscriptType;
 (function (TapscriptType) {
@@ -271,9 +238,7 @@ var CSVMultisigTapscript;
                 throw new Error(`Invalid pubkey length: expected 32, got ${pubkey.length}`);
             }
         }
-        const sequence = MinimalScriptNum.encode(BigInt(bip68.encode(params.timelock.type === "blocks"
-            ? { blocks: Number(params.timelock.value) }
-            : { seconds: Number(params.timelock.value) })));
+        const sequence = MinimalScriptNum.encode(BigInt((0, timelock_1.timelockToSequence)(params.timelock)));
         const asm = [
             sequence.length === 1 ? sequence[0] : sequence,
             "CHECKSEQUENCEVERIFY",
@@ -296,17 +261,12 @@ var CSVMultisigTapscript;
         if (script.length === 0) {
             throw new Error("Failed to decode: script is empty");
         }
-        const asm = btc_signer_1.Script.decode(script);
-        if (asm.length < 3) {
-            throw new Error(`Invalid script: too short (expected at least 3)`);
+        const isValid = isScriptValid(script);
+        if (isValid instanceof Error) {
+            throw isValid;
         }
+        const asm = btc_signer_1.Script.decode(script);
         const sequence = asm[0];
-        if (typeof sequence === "string") {
-            throw new Error("Invalid script: expected sequence number");
-        }
-        if (asm[1] !== "CHECKSEQUENCEVERIFY" || asm[2] !== "DROP") {
-            throw new Error("Invalid script: expected CHECKSEQUENCEVERIFY DROP");
-        }
         const multisigScript = new Uint8Array(btc_signer_1.Script.encode(asm.slice(3)));
         let multisig;
         try {
@@ -322,10 +282,7 @@ var CSVMultisigTapscript;
         else {
             sequenceNum = Number(MinimalScriptNum.decode(sequence));
         }
-        const decodedTimelock = bip68.decode(sequenceNum);
-        const timelock = decodedTimelock.blocks !== undefined
-            ? { type: "blocks", value: BigInt(decodedTimelock.blocks) }
-            : { type: "seconds", value: BigInt(decodedTimelock.seconds) };
+        const timelock = (0, timelock_1.sequenceToTimelock)(sequenceNum);
         const reconstructed = encode({
             timelock,
             ...multisig.params,
@@ -348,6 +305,21 @@ var CSVMultisigTapscript;
         return tapscript.type === TapscriptType.CSVMultisig;
     }
     CSVMultisigTapscript.is = is;
+    function isScriptValid(script) {
+        const asm = btc_signer_1.Script.decode(script);
+        if (asm.length < 3) {
+            return new Error(`Invalid script: too short (expected at least 3)`);
+        }
+        const sequence = asm[0];
+        if (typeof sequence === "string") {
+            return new Error("Invalid script: expected sequence number");
+        }
+        if (asm[1] !== "CHECKSEQUENCEVERIFY" || asm[2] !== "DROP") {
+            return new Error("Invalid script: expected CHECKSEQUENCEVERIFY DROP");
+        }
+        return true;
+    }
+    CSVMultisigTapscript.isScriptValid = isScriptValid;
 })(CSVMultisigTapscript || (exports.CSVMultisigTapscript = CSVMultisigTapscript = {}));
 /**
  * Combines a condition script with an exit closure. The resulting script requires
@@ -382,18 +354,14 @@ var ConditionCSVMultisigTapscript;
         if (script.length === 0) {
             throw new Error("Failed to decode: script is empty");
         }
-        const asm = btc_signer_1.Script.decode(script);
-        if (asm.length < 1) {
-            throw new Error(`Invalid script: too short (expected at least 1)`);
-        }
-        let verifyIndex = -1;
-        for (let i = asm.length - 1; i >= 0; i--) {
-            if (asm[i] === "VERIFY") {
-                verifyIndex = i;
-            }
+        const isValid = isScriptValid(script);
+        if (isValid instanceof Error) {
+            throw isValid;
         }
+        const asm = btc_signer_1.Script.decode(script);
+        let verifyIndex = getVerifyIndex(asm);
         if (verifyIndex === -1) {
-            throw new Error("Invalid script: missing VERIFY operation");
+            throw Error("Invalid script: missing VERIFY operation");
         }
         const conditionScript = new Uint8Array(btc_signer_1.Script.encode(asm.slice(0, verifyIndex)));
         const csvMultisigScript = new Uint8Array(btc_signer_1.Script.encode(asm.slice(verifyIndex + 1)));
@@ -426,6 +394,28 @@ var ConditionCSVMultisigTapscript;
         return tapscript.type === TapscriptType.ConditionCSVMultisig;
     }
     ConditionCSVMultisigTapscript.is = is;
+    function getVerifyIndex(asm) {
+        let verifyIndex = -1;
+        for (let i = asm.length - 1; i >= 0; i--) {
+            if (asm[i] === "VERIFY") {
+                verifyIndex = i;
+                return verifyIndex;
+            }
+        }
+        return verifyIndex;
+    }
+    function isScriptValid(script) {
+        const asm = btc_signer_1.Script.decode(script);
+        if (asm.length < 1) {
+            return new Error(`Invalid script: too short (expected at least 1)`);
+        }
+        let verifyIndex = getVerifyIndex(asm);
+        if (verifyIndex === -1) {
+            return new Error("Invalid script: missing VERIFY operation");
+        }
+        return true;
+    }
+    ConditionCSVMultisigTapscript.isScriptValid = isScriptValid;
 })(ConditionCSVMultisigTapscript || (exports.ConditionCSVMultisigTapscript = ConditionCSVMultisigTapscript = {}));
 /**
  * Combines a condition script with a forfeit closure. The resulting script requires
@@ -460,18 +450,14 @@ var ConditionMultisigTapscript;
         if (script.length === 0) {
             throw new Error("Failed to decode: script is empty");
         }
-        const asm = btc_signer_1.Script.decode(script);
-        if (asm.length < 1) {
-            throw new Error(`Invalid script: too short (expected at least 1)`);
-        }
-        let verifyIndex = -1;
-        for (let i = asm.length - 1; i >= 0; i--) {
-            if (asm[i] === "VERIFY") {
-                verifyIndex = i;
-            }
+        const isValid = isScriptValid(script);
+        if (isValid instanceof Error) {
+            throw isValid;
         }
+        const asm = btc_signer_1.Script.decode(script);
+        let verifyIndex = getVerifyIndex(asm);
         if (verifyIndex === -1) {
-            throw new Error("Invalid script: missing VERIFY operation");
+            throw Error("Invalid script: missing VERIFY operation");
         }
         const conditionScript = new Uint8Array(btc_signer_1.Script.encode(asm.slice(0, verifyIndex)));
         const multisigScript = new Uint8Array(btc_signer_1.Script.encode(asm.slice(verifyIndex + 1)));
@@ -504,6 +490,28 @@ var ConditionMultisigTapscript;
         return tapscript.type === TapscriptType.ConditionMultisig;
     }
     ConditionMultisigTapscript.is = is;
+    function getVerifyIndex(asm) {
+        let verifyIndex = -1;
+        for (let i = asm.length - 1; i >= 0; i--) {
+            if (asm[i] === "VERIFY") {
+                verifyIndex = i;
+                return verifyIndex;
+            }
+        }
+        return verifyIndex;
+    }
+    function isScriptValid(script) {
+        const asm = btc_signer_1.Script.decode(script);
+        if (asm.length < 1) {
+            return new Error(`Invalid script: too short (expected at least 1)`);
+        }
+        let verifyIndex = getVerifyIndex(asm);
+        if (verifyIndex === -1) {
+            return new Error("Invalid script: missing VERIFY operation");
+        }
+        return true;
+    }
+    ConditionMultisigTapscript.isScriptValid = isScriptValid;
 })(ConditionMultisigTapscript || (exports.ConditionMultisigTapscript = ConditionMultisigTapscript = {}));
 /**
  * Implements an absolute timelock (CLTV) script combined with a forfeit closure.
@@ -544,10 +552,11 @@ var CLTVMultisigTapscript;
         if (script.length === 0) {
             throw new Error("Failed to decode: script is empty");
         }
-        const asm = btc_signer_1.Script.decode(script);
-        if (asm.length < 3) {
-            throw new Error(`Invalid script: too short (expected at least 3)`);
+        const isValid = isScriptValid(script);
+        if (isValid instanceof Error) {
+            throw isValid;
         }
+        const asm = btc_signer_1.Script.decode(script);
         const locktime = asm[0];
         if (typeof locktime === "string") {
             throw new Error("Invalid script: expected locktime number");
@@ -592,4 +601,19 @@ var CLTVMultisigTapscript;
         return tapscript.type === TapscriptType.CLTVMultisig;
     }
     CLTVMultisigTapscript.is = is;
+    function isScriptValid(script) {
+        const asm = btc_signer_1.Script.decode(script);
+        if (asm.length < 3) {
+            return new Error(`Invalid script: too short (expected at least 3)`);
+        }
+        const locktime = asm[0];
+        if (typeof locktime === "string") {
+            return new Error("Invalid script: expected locktime as number or bytes");
+        }
+        if (asm[1] !== "CHECKLOCKTIMEVERIFY" || asm[2] !== "DROP") {
+            return new Error("Invalid script: expected CHECKLOCKTIMEVERIFY DROP");
+        }
+        return true;
+    }
+    CLTVMultisigTapscript.isScriptValid = isScriptValid;
 })(CLTVMultisigTapscript || (exports.CLTVMultisigTapscript = CLTVMultisigTapscript = {}));

package/dist/cjs/utils/timelock.js

@@ -0,0 +1,59 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.timelockToSequence = timelockToSequence;
+exports.sequenceToTimelock = sequenceToTimelock;
+const bip68 = __importStar(require("bip68"));
+/**
+ * Convert RelativeTimelock to BIP68 sequence number.
+ */
+function timelockToSequence(timelock) {
+    return bip68.encode(timelock.type === "blocks"
+        ? { blocks: Number(timelock.value) }
+        : { seconds: Number(timelock.value) });
+}
+/**
+ * Convert BIP68 sequence number back to RelativeTimelock.
+ */
+function sequenceToTimelock(sequence) {
+    const decoded = bip68.decode(sequence);
+    if ("blocks" in decoded && decoded.blocks !== undefined) {
+        return { type: "blocks", value: BigInt(decoded.blocks) };
+    }
+    if ("seconds" in decoded && decoded.seconds !== undefined) {
+        return { type: "seconds", value: BigInt(decoded.seconds) };
+    }
+    throw new Error(`Invalid BIP68 sequence: ${sequence}`);
+}

package/dist/cjs/utils/unknownFields.js

@@ -1,44 +1,11 @@
 "use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VtxoTreeExpiry = exports.CosignerPublicKey = exports.ConditionWitness = exports.VtxoTaprootTree = exports.ArkPsbtFieldKeyType = exports.ArkPsbtFieldKey = void 0;
 exports.setArkPsbtField = setArkPsbtField;
 exports.getArkPsbtFields = getArkPsbtFields;
-const bip68 = __importStar(require("bip68"));
 const btc_signer_1 = require("@scure/btc-signer");
 const base_1 = require("@scure/base");
+const timelock_1 = require("./timelock");
 /**
  * ArkPsbtFieldKey are the available key names for the Arkade PSBT custom fields.
  */
@@ -184,11 +151,7 @@ exports.VtxoTreeExpiry = {
         const v = (0, btc_signer_1.ScriptNum)(6, true).decode(unknown[1]);
         if (!v)
             return null;
-        const { blocks, seconds } = bip68.decode(Number(v));
-        return {
-            type: blocks ? "blocks" : "seconds",
-            value: BigInt(blocks ?? seconds ?? 0),
-        };
+        return (0, timelock_1.sequenceToTimelock)(Number(v));
     }),
 };
 const encodedPsbtFieldKey = Object.fromEntries(Object.values(ArkPsbtFieldKey).map((key) => [

package/dist/cjs/wallet/serviceWorker/wallet-message-handler.js

@@ -5,6 +5,8 @@ const indexer_1 = require("../../providers/indexer");
 const index_1 = require("../index");
 const utils_1 = require("../utils");
 const transactionHistory_1 = require("../../utils/transactionHistory");
+const vtxoOwnership_1 = require("../../contracts/vtxoOwnership");
+const scriptFromAddress_1 = require("../../repositories/scriptFromAddress");
 class WalletNotInitializedError extends Error {
     constructor() {
         super("Wallet handler not initialized");
@@ -317,6 +319,16 @@ class WalletMessageHandler {
                         type: "REFRESH_VTXOS_SUCCESS",
                     });
                 }
+                case "REFRESH_OUTPOINTS": {
+                    const manager = await this.readonlyWallet.getContractManager();
+                    const { outpoints } = message
+                        .payload;
+                    await manager.refreshOutpoints(outpoints);
+                    return this.tagged({
+                        id,
+                        type: "REFRESH_OUTPOINTS_SUCCESS",
+                    });
+                }
                 case "SEND": {
                     const { recipients } = message.payload;
                     const txid = await this.wallet.send(...recipients);
@@ -587,11 +599,47 @@ class WalletMessageHandler {
                     const { newVtxos, spentVtxos } = funds;
                     if (newVtxos.length + spentVtxos.length === 0)
                         return;
-                    // save virtual outputs using unified repository
-                    await this.walletRepository?.saveVtxos(address, [
-                        ...newVtxos,
-                        ...spentVtxos,
-                    ]);
+                    // Save virtual outputs using unified repository. The
+                    // event may carry rows for several scripts (other
+                    // contracts the wallet watches), so split by script and
+                    // save each bucket under its own contract address rather
+                    // than saving a mixed-script array under one address.
+                    const byScript = new Map();
+                    for (const v of [...newVtxos, ...spentVtxos]) {
+                        if (!v.script) {
+                            // Without a script we can't route the row to the
+                            // right contract bucket; surface the drop instead
+                            // of silently losing the VTXO.
+                            console.warn(`WalletMessageHandler.notifyIncomingFunds: dropping VTXO without script ${v.txid}:${v.vout}`);
+                            continue;
+                        }
+                        const arr = byScript.get(v.script) ?? [];
+                        arr.push(v);
+                        byScript.set(v.script, arr);
+                    }
+                    let walletScript;
+                    try {
+                        walletScript = (0, scriptFromAddress_1.scriptFromArkAddress)(address);
+                    }
+                    catch {
+                        walletScript = undefined;
+                    }
+                    const cm = await this.readonlyWallet.getContractManager();
+                    const contracts = await cm.getContracts();
+                    const addrByScript = new Map(contracts.map((c) => [c.script, c.address]));
+                    for (const [script, vtxos] of byScript) {
+                        const filtered = (0, vtxoOwnership_1.warnAndFilterVtxosForScript)(vtxos, script, "WalletMessageHandler.notifyIncomingFunds");
+                        if (filtered.length === 0)
+                            continue;
+                        const targetAddress = script === walletScript
+                            ? address
+                            : addrByScript.get(script);
+                        if (!targetAddress)
+                            continue;
+                        if (this.walletRepository) {
+                            await (0, vtxoOwnership_1.saveVtxosForContract)(this.walletRepository, { script, address: targetAddress }, filtered);
+                        }
+                    }
                     // notify all clients about the virtual output state update
                     this.scheduleForNextTick(() => this.tagged({
                         type: "VTXO_UPDATE",
@@ -803,17 +851,30 @@ class WalletMessageHandler {
                 }
             }
         };
-        // Aggregate virtual outputs from all contract addresses
+        // Aggregate virtual outputs from all contract addresses. Address
+        // buckets may carry legacy duplicate rows from other contracts; gate
+        // each bucket by its owning contract script before deduplication so a
+        // wrong-script row never wins the txid:vout race.
         const manager = await this.readonlyWallet.getContractManager();
         const contracts = await manager.getContracts();
         for (const contract of contracts) {
-            const vtxos = await this.walletRepository.getVtxos(contract.address);
-            addVtxos(vtxos);
+            addVtxos(await (0, vtxoOwnership_1.getVtxosForContract)(this.walletRepository, contract));
         }
-        // Also check the wallet's primary address
+        // Also check the wallet's primary address. Decode it to its script
+        // and apply the same script gate. Failing to decode the wallet's own
+        // address is a structural bug — surfacing the error is safer than
+        // silently dropping the primary bucket and zeroing the user's
+        // visible balance.
         const walletAddress = await this.readonlyWallet.getAddress();
+        let walletScript;
+        try {
+            walletScript = (0, scriptFromAddress_1.scriptFromArkAddress)(walletAddress);
+        }
+        catch (e) {
+            throw new Error(`WalletMessageHandler.getVtxosFromRepo: failed to derive script from wallet address ${walletAddress}: ${e instanceof Error ? e.message : String(e)}`);
+        }
         const walletVtxos = await this.walletRepository.getVtxos(walletAddress);
-        addVtxos(walletVtxos);
+        addVtxos((0, vtxoOwnership_1.filterVtxosForScript)(walletVtxos, walletScript));
         return allVtxos;
     }
     /**

package/dist/cjs/wallet/serviceWorker/wallet.js

@@ -60,6 +60,7 @@ exports.DEFAULT_MESSAGE_TIMEOUTS = {
     UPDATE_CONTRACT: 30000,
     DELETE_CONTRACT: 10000,
     REFRESH_VTXOS: 30000,
+    REFRESH_OUTPOINTS: 30000,
 };
 const DEDUPABLE_REQUEST_TYPES = new Set([
     "GET_ADDRESS",
@@ -824,6 +825,15 @@ class ServiceWorkerReadonlyWallet {
                 };
                 await sendContractMessage(message);
             },
+            async refreshOutpoints(outpoints) {
+                const message = {
+                    type: "REFRESH_OUTPOINTS",
+                    id: (0, utils_2.getRandomId)(),
+                    tag: messageTag,
+                    payload: { outpoints },
+                };
+                await sendContractMessage(message);
+            },
             async isWatching() {
                 const message = {
                     type: "IS_CONTRACT_MANAGER_WATCHING",