@hazbase/simplicity 0.3.1 → 0.3.2

package/dist/x402/index.d.ts

@@ -152,6 +152,10 @@ export type DecodePsbtResult = {
             address?: string;
             hex?: string;
         };
+        scriptPubKey?: {
+            address?: string;
+            hex?: string;
+        };
     }>;
 };
 export type LiquidX402LwkWasmModule = {

package/dist/x402/index.js

@@ -219,6 +219,9 @@ async function prepareLiquidX402LwkWasmPayment(input) {
     if (requirements.extra.asset === "lbtc") {
         builder = builder.addLbtcRecipient(recipient, amount);
     }
+    else if (typeof recipient.isBlinded === "function" && recipient.isBlinded() === false && typeof builder.addExplicitRecipient === "function") {
+        builder = builder.addExplicitRecipient(recipient, amount, parseLwkAssetId(lwk, requirements.asset));
+    }
     else {
         builder = builder.addRecipient(recipient, amount, parseLwkAssetId(lwk, requirements.asset));
     }
@@ -270,12 +273,13 @@ async function verifyLiquidX402Payment(rpc, input) {
         return basic;
     }
     try {
+        const expectedTarget = await resolveExpectedLiquidOutputTarget(rpc, requirements);
         const decoded = await rpc.call("decodepsbt", [payload.psetBase64]);
         const actualSummaryHash = buildLiquidPsetSummaryHash(decoded, requirements);
         if (actualSummaryHash !== payload.summaryHash) {
             return { ...basic, isValid: false, invalidReason: "pset_summary_mismatch" };
         }
-        if (!decodedContainsExpectedOutput(decoded, requirements)) {
+        if (!decodedContainsExpectedOutput(decoded, requirements, expectedTarget)) {
             return { ...basic, isValid: false, invalidReason: "pset_expected_output_missing" };
         }
         if (!decodedFeeWithinCap(decoded, requirements)) {
@@ -376,12 +380,56 @@ function buildLiquidPsetSummaryHash(_decoded, requirements) {
         maxFeeSat: req.extra.maxFeeSat ?? null,
     }));
 }
-function decodedContainsExpectedOutput(decoded, requirements) {
+function decodedContainsExpectedOutput(decoded, requirements, expectedTarget = buildFallbackExpectedLiquidOutputTarget(requirements)) {
     const expectedAmount = atomicToDecimalNumber(requirements.maxAmountRequired, requirements.extra.decimals);
     return (decoded.outputs ?? []).some((output) => (String(output.asset ?? "").toLowerCase() === requirements.asset.toLowerCase() &&
         Math.round(Number(output.amount ?? 0) * 10 ** requirements.extra.decimals) ===
             Math.round(expectedAmount * 10 ** requirements.extra.decimals) &&
-        String(output.script?.address ?? "") === requirements.payTo));
+        decodedOutputMatchesLiquidTarget(output, expectedTarget)));
+}
+async function resolveExpectedLiquidOutputTarget(rpc, requirements) {
+    const target = buildFallbackExpectedLiquidOutputTarget(requirements);
+    try {
+        const info = await rpc.call("validateaddress", [requirements.payTo]);
+        if (info?.isvalid !== false) {
+            addNormalizedAddress(target.addresses, info.address);
+            addNormalizedAddress(target.addresses, info.unconfidential);
+            addNormalizedAddress(target.addresses, info.confidential);
+            addNormalizedHex(target.scriptHexes, info.scriptPubKey);
+        }
+    }
+    catch {
+        // Older or mocked RPC clients may not expose validateaddress. Exact payTo
+        // matching remains safe for unconfidential outputs in that case.
+    }
+    return target;
+}
+function buildFallbackExpectedLiquidOutputTarget(requirements) {
+    const target = { addresses: new Set(), scriptHexes: new Set() };
+    addNormalizedAddress(target.addresses, requirements.payTo);
+    return target;
+}
+function decodedOutputMatchesLiquidTarget(output, expectedTarget) {
+    const address = output.script?.address ?? output.scriptPubKey?.address;
+    const scriptHex = output.script?.hex ?? output.scriptPubKey?.hex;
+    return (expectedTarget.addresses.has(normalizeAddressForComparison(address)) ||
+        expectedTarget.scriptHexes.has(normalizeHexForComparison(scriptHex)));
+}
+function addNormalizedAddress(target, value) {
+    const normalized = normalizeAddressForComparison(value);
+    if (normalized)
+        target.add(normalized);
+}
+function addNormalizedHex(target, value) {
+    const normalized = normalizeHexForComparison(value);
+    if (normalized)
+        target.add(normalized);
+}
+function normalizeAddressForComparison(value) {
+    return String(value ?? "").trim().toLowerCase();
+}
+function normalizeHexForComparison(value) {
+    return String(value ?? "").trim().toLowerCase().replace(/^0x/u, "");
 }
 function coerceRequirements(value) {
     if (!value || typeof value !== "object" || Array.isArray(value))
@@ -454,7 +502,17 @@ function ensureLwkWasmNodeTimerCompat() {
     }
 }
 function parseLwkAddress(lwk, address, network) {
-    return typeof lwk.Address.parse === "function" ? lwk.Address.parse(address, network) : new lwk.Address(address);
+    if (typeof lwk.Address.parse === "function") {
+        try {
+            return lwk.Address.parse(address, network);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (!message.includes("non-blinded"))
+                throw error;
+        }
+    }
+    return new lwk.Address(address);
 }
 function parseLwkAssetId(lwk, assetId) {
     return typeof lwk.AssetId.fromString === "function" ? lwk.AssetId.fromString(assetId) : new lwk.AssetId(assetId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hazbase/simplicity",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "An SDK for Simplicity on Liquid",
   "author": "IndieSquare Inc <info@hazbase.com>",
   "keywords": [