Perform a contract action from a txManifest protocol

.github/actions/build-smplx-wasm/action.yml

@@ -0,0 +1,71 @@
+name: Build smplx_wasm
+description: >-
+  Build the smplx_wasm WASM package from the vendored `smplx` git submodule so the
+  `file:smplx/crates/wasm/pkg` dependency resolves. Like `lwk_wasm/pkg`, it is a wasm-pack
+  build artifact that is not committed, so it must be produced in CI. The output is cached
+  by the pinned submodule commit, so the Rust build only runs when the submodule bumps.
+  Requires the repo to be checked out with `submodules: recursive`.
+
+  The fork's build script needs a C compiler with a WebAssembly backend — Apple's system
+  clang has none, and neither does a bare ubuntu runner without LLVM's clang on PATH, which
+  is why one is installed rather than assumed. Without it the build fails inside
+  `secp256k1-sys` and `simplicity-sys` with "unable to create target", which points at the
+  crates and misleads.
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve pinned smplx commit
+      id: smplx
+      shell: bash
+      run: echo "sha=$(git rev-parse HEAD:smplx)" >> "$GITHUB_OUTPUT"
+
+    - name: Restore built smplx pkg
+      id: pkg-cache
+      uses: actions/cache@v4
+      with:
+        path: smplx/crates/wasm/pkg
+        key: smplx-wasm-${{ runner.os }}-${{ steps.smplx.outputs.sha }}
+
+    # 1.91.0 because `crates/simplex` declares it as the workspace's minimum, and the
+    # build tree demands it independently: `ar_archive_writer` reached through wasm-pack
+    # requires 1.88.0. An earlier pin of 1.85.0 built locally on a newer toolchain and
+    # failed here on the runner's, which is the whole reason to pin rather than inherit.
+    - name: Install Rust toolchain (1.91.0 + wasm32)
+      if: steps.pkg-cache.outputs.cache-hit != 'true'
+      uses: dtolnay/rust-toolchain@master
+      with:
+        toolchain: "1.91.0"
+        targets: wasm32-unknown-unknown
+
+    - name: Cache cargo registry + build
+      if: steps.pkg-cache.outputs.cache-hit != 'true'
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/.cargo/registry/index
+          ~/.cargo/registry/cache
+          ~/.cargo/git/db
+          smplx/target
+        key: cargo-smplx-${{ runner.os }}-${{ steps.smplx.outputs.sha }}
+        restore-keys: |
+          cargo-smplx-${{ runner.os }}-
+
+    - name: Install wasm-pack
+      if: steps.pkg-cache.outputs.cache-hit != 'true'
+      uses: jetli/wasm-pack-action@v0.4.0
+
+    # Installed rather than exported: the fork's build script already searches for a clang
+    # with a WebAssembly backend and fails with a clear message when there is none, so
+    # putting one on PATH keeps that guard rather than bypassing it.
+    - name: Install a C compiler with a WebAssembly backend
+      if: steps.pkg-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo apt-get install --no-install-recommends -y clang llvm
+
+    - name: Build smplx_wasm
+      if: steps.pkg-cache.outputs.cache-hit != 'true'
+      shell: bash
+      run: smplx/crates/wasm/build.sh

.github/workflows/build-extension.yml

@@ -25,7 +25,7 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout (with the lwk submodule)
+      - name: Checkout (with the lwk and smplx submodules)
         uses: actions/checkout@v4
         with:
           submodules: recursive
@@ -38,6 +38,11 @@ jobs:
         with:
           profile: ${{ inputs.profile }}
 
+      # The manifest runtime compiles Simplicity contracts and signs with them, so the
+      # extension does not build without this package either.
+      - name: Build smplx_wasm
+        uses: ./.github/actions/build-smplx-wasm
+
       - name: Install dependencies
         uses: ./.github/actions/install
 

.github/workflows/check.yml

@@ -0,0 +1,49 @@
+name: Check
+
+# Runs the same gate a commit runs locally, on every push and pull request. Until this
+# existed nothing in CI ran the tests at all: the only workflows were a manual extension
+# build and two deploys, so 456 tests protected nothing that could block a merge.
+on:
+  push:
+    branches: ["**"]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      # Recursive, and both wasm packages are built before anything else runs. A leaner
+      # job was tried and does not work: on a checkout without them `bun install` reports
+      # "Failed to install 2 packages", typechecking fails with eleven errors about
+      # `lwk_wasm` and `smplx-wasm` having no declarations, and three test files fail
+      # outright on `Cannot find module 'smplx-wasm/smplx_wasm_bg.js'` — they drive the
+      # real module rather than a substitute, which is the point of them.
+      - name: Checkout (with the lwk and smplx submodules)
+        uses: actions/checkout@v4
+        with:
+          submodules: recursive
+
+      - name: Setup Bun
+        uses: ./.github/actions/setup-bun
+
+      # dev rather than release: this job checks code, and an unoptimised wasm builds
+      # faster. The release profile belongs to the build workflow, which ships the result.
+      - name: Build lwk_wasm
+        uses: ./.github/actions/build-lwk-wasm
+        with:
+          profile: dev
+
+      - name: Build smplx_wasm
+        uses: ./.github/actions/build-smplx-wasm
+
+      - name: Install dependencies
+        uses: ./.github/actions/install
+
+      # typecheck across apps/extension, packages/ and apps/web, then lint, format and
+      # the test suite. The three projects are separate deliberately — see the comment in
+      # lefthook.yml for why one `tsc --noEmit` never covered them.
+      - name: Check
+        run: bun run check

.gitmodules

@@ -2,3 +2,7 @@
 	path = lwk
 	url = https://github.com/lukachi/lwk.git
 	branch = humid/esplora-backend-config
+[submodule "smplx"]
+	path = smplx
+	url = https://github.com/lukachi/smplx.git
+	branch = humid/wasm-issuance

.oxfmtrc.json

@@ -10,6 +10,8 @@
 	"sortTailwindcss": true,
 	"ignorePatterns": [
 		"lwk/**",
+		"smplx/**",
+		"**/__fixtures__/**",
 		"AGENTS.md",
 		"CLAUDE.md",
 		"README.md",

.oxlintrc.json

@@ -37,6 +37,7 @@
 	},
 	"ignorePatterns": [
 		"lwk/**",
+		"smplx/**",
 		"dist/**",
 		"build/**",
 		"node_modules/**",

apps/extension/src/background.ts

@@ -2,6 +2,7 @@
 
 import { createAccountRegistry } from "@/core/accounts/application/account-registry";
 import type { AccountModelState } from "@/core/accounts/application/account-registry/model/account-model";
+import type { AccountGroupId } from "@/core/accounts/application/account-registry/model/identifiers";
 import type {
 	ActivityPage,
 	EstimateMaxSendInput,
@@ -16,6 +17,10 @@
 import type { Caip25Scopes } from "@/core/caip25";
 import { addUnlockedChainRecord } from "@/core/chains/application/chain-store/addChainRecord";
 import { getUnlockedChainStoreState } from "@/core/chains/application/chain-store/secureChainStore";
+import {
+	type LiquidContractIdentity,
+	readLiquidContractIdentity,
+} from "@/core/chains/liquid/application/contractIdentity";
 import {
 	buildLiquidDappAccountScope,
 	resolveAccountGroupIdsForIdentifiers,
@@ -113,7 +118,7 @@
 /** Skip a background refresh if the cached snapshot was synced within this window. */
 const BACKGROUND_REFRESH_MIN_INTERVAL_MS = 60_000;
 
 const init = async () => {
 	const { eventBus, messageBus } = setupBackgroundTransport();
 
 	// Capture the event bus so the wallet-event broadcaster can push provider events (accountsChanged,
@@ -275,6 +280,35 @@
 	const getReceiveAddress = async (): Promise<ReceiveAddress> =>
 		liquidChainGroup.accountRuntime.getReceiveAddress((await resolveSelectedLiquidAccount()).input);
 
+	// The address and key contract actions are signed with, for the selected account. Not
+	// the same as the receive address above: the contract SDK signs with one key at a fixed
+	// path and returns change to that key's own unblinded address, so a covenant action can
+	// only spend what sits there. Reading it is what makes that limit visible.
+	const readContractIdentity = async (
+		accountGroupId?: AccountGroupId,
+	): Promise<LiquidContractIdentity> => {
+		const { input } = await resolveSelectedLiquidAccount();
+
+		// The settings page is per-account, and the account it shows is not necessarily the
+		// selected one. Reading the selected account's identity there would put one
+		// account's address and key on another account's screen, with nothing to say so —
+		// and the values are what someone then funds and locks a covenant to.
+		const group =
+			accountGroupId === undefined
+				? undefined
+				: input.keyManagerState.accountModel.accountGroups[accountGroupId];
+
+		if (accountGroupId !== undefined && !group) {
+			throw new Error(`No account group ${accountGroupId}.`);
+		}
+
+		return readLiquidContractIdentity({
+			accountGroupIndex: group ? (group.groupIndex ?? 0) : input.accountGroupIndex,
+			chain: input.chain,
+			keyManagerState: input.keyManagerState,
+		});
+	};
+
 	// In-extension send: preview then execute against the SELECTED account (resolved exactly like
 	// getReceiveAddress). Both call the chain group's runtime, which calls the same backend fns the
 	// dapp path uses — but WITHOUT the dapp confirmation popup, because the popup's own review screen
@@ -392,7 +426,7 @@
 			if (!group) continue;
 
 			accountIds.push(
 				await liquidChainGroup.accountRuntime.resolveAccountIdentifier({
 					accountGroupId: group.id,
 					accountGroupIndex: group.groupIndex ?? 0,
 					chain,
@@ -580,6 +614,7 @@
 				getActivity,
 				getPortfolio,
 				getReceiveAddress,
+				readContractIdentity,
 				inspectTransfer,
 				purgeAccountPortfolio,
 				purgeAccountWalletConnectSessions,

apps/extension/src/bun-test-env.d.ts

@@ -0,0 +1,14 @@
+/// <reference types="bun-types" />
+
+// Makes `bun:test` resolvable to `tsc`, which the test files import from.
+//
+// `@types/bun` re-exports `bun-types` and is supposed to be picked up automatically,
+// but it is not under this project's configuration, so the reference is stated once
+// here rather than repeated at the top of every test file — the same arrangement
+// `vite-env.d.ts` already uses for Vite's ambient types.
+//
+// Side effect worth knowing: this also makes Bun's globals visible to application
+// code, which does not run under Bun. Reach for a browser or extension API there,
+// not `Bun.*`.
+
+export {};

apps/extension/src/core/chains/liquid/adapters/lwk/createLwkWalletBackend.ts

@@ -1,9 +1,10 @@
 import type { LiquidWalletBackend } from "../../application/backends/LiquidWalletBackend";
 import { getWalletActivityForAsset } from "./wallet/getActivity";
 import { getWalletBalanceForAsset } from "./wallet/getBalance";
-import { getWalletReceiveAddress } from "./wallet/getReceiveAddress";
-import { getWalletUtxosForAsset } from "./wallet/getUTXOs";
+import { getWalletReceiveAddress, getWalletSigningAddress } from "./wallet/getReceiveAddress";
+import { getExplicitWalletUtxosForAsset, getWalletUtxosForAsset } from "./wallet/getUTXOs";
 import { getWalletDescriptorEntries } from "./wallet/getWalletDescriptor";
+import { readChainTipHeight } from "./wallet/readChainTipHeight";
 import { createLwkLiquidAccount } from "./wallet/resolveAccount";
 import { estimateMaxSend, inspectTransfer, sendTransfer } from "./wallet/sendTransfer";
 import { inspectMessageSigning, signMessage } from "./wallet/signMessage";
@@ -16,7 +17,10 @@ export function createLwkWalletBackend(): LiquidWalletBackend {
 		getActivity: getWalletActivityForAsset,
 		getBalance: getWalletBalanceForAsset,
 		getReceiveAddress: getWalletReceiveAddress,
+		getSigningAddress: getWalletSigningAddress,
 		getDescriptorEntries: getWalletDescriptorEntries,
+		getExplicitUtxos: getExplicitWalletUtxosForAsset,
+		getTipHeight: readChainTipHeight,
 		getUtxos: getWalletUtxosForAsset,
 		inspectMessageSigning,
 		inspectTransfer,

apps/extension/src/core/chains/liquid/adapters/lwk/sync-worker/createInlineScanClient.ts

@@ -1,6 +1,7 @@
 import type { SyncWorkerClient } from "./createWorkerScanClient";
 import {
 	broadcastPset as runBroadcastPset,
+	broadcastTransaction as runBroadcastTransaction,
 	readActivity as runReadActivity,
 	scanAndRead as runScanAndRead,
 	scanFresh as runScanFresh,
@@ -20,6 +21,9 @@ export function createInlineScanClient(): SyncWorkerClient {
 		async broadcast(input) {
 			return { txid: await runBroadcastPset({ ...input, id: (seq += 1) }) };
 		},
+		async broadcastTransaction(input) {
+			return { txid: await runBroadcastTransaction({ ...input, id: (seq += 1) }) };
+		},
 		async readActivity(input) {
 			return runReadActivity({ ...input, id: (seq += 1) });
 		},

apps/extension/src/core/chains/liquid/adapters/lwk/sync-worker/createOffscreenScanClient.ts

@@ -2,6 +2,7 @@ import browser from "webextension-polyfill";
 
 import type {
 	BroadcastInput,
+	BroadcastTxInput,
 	ReadActivityInput,
 	ScanInput,
 	SyncWorkerClient,
@@ -52,6 +53,7 @@ async function ensureOffscreenDocument(offscreen: ChromeOffscreenApi): Promise<v
 /** A scan/read/broadcast request payload for the offscreen document (the target is added on send). */
 type OffscreenRequestPayload =
 	| { input: BroadcastInput; op: "broadcast" }
+	| { input: BroadcastTxInput; op: "broadcastTransaction" }
 	| { input: ScanInput; op: "scan" | "scanAndRead" }
 	| { input: ReadActivityInput; op: "readActivity" };
 
@@ -75,6 +77,17 @@ async function requestScan(payload: OffscreenRequestPayload): Promise<OffscreenS
  */
 export function createOffscreenScanClient(): SyncWorkerClient {
 	return {
+		async broadcastTransaction(input) {
+			const response = await requestScan({ input, op: "broadcastTransaction" });
+
+			if (!response.ok) throw new Error(response.error);
+
+			if (response.op !== "broadcastTransaction") {
+				throw new Error("Unexpected offscreen scan response.");
+			}
+
+			return { txid: response.txid };
+		},
 		async broadcast(input) {
 			const response = await requestScan({ input, op: "broadcast" });
 

apps/extension/src/core/chains/liquid/adapters/lwk/sync-worker/createWorkerScanClient.ts

@@ -16,6 +16,14 @@
 export type BroadcastInput = { chain: ScanInput["chain"]; psetBase64: string };
 export type BroadcastResult = { txid: string };
 
+/**
+ * Inputs to broadcast an already-signed, consensus-encoded transaction.
+ *
+ * The manifest path produces one of these rather than a PSET: smplx blinds, signs and
+ * finalises internally and hands back a finished transaction.
+ */
+export type BroadcastTxInput = { chain: ScanInput["chain"]; txHex: string };
+
 /** Inputs to read one asset's activity page from the worker's cached wollet. */
 export type ReadActivityInput = ScanInput & {
 	cursor: string | null;
@@ -33,6 +41,7 @@
 /** A promise-per-request handle to a scan backend (a dedicated worker, offscreen, or inline). */
 export type SyncWorkerClient = {
 	broadcast: (input: BroadcastInput) => Promise<BroadcastResult>;
+	broadcastTransaction: (input: BroadcastTxInput) => Promise<BroadcastResult>;
 	readActivity: (input: ReadActivityInput) => Promise<ActivityPageResult>;
 	scan: (input: ScanInput) => Promise<ScanResult>;
 	scanAndRead: (input: ScanInput) => Promise<ScanAndReadResult>;
@@ -90,11 +99,18 @@
 
 		return new Promise<SuccessResponse>((resolve, reject) => {
 			pending.set(id, { reject, resolve });
 			worker.postMessage({ ...input, id });
 		});
 	}
 
 	return {
+		broadcastTransaction() {
+			// Same reason as `broadcast` below: LWK's Esplora client needs a `window` this
+			// context does not have.
+			return Promise.reject(
+				new Error("The dedicated worker cannot broadcast; use the offscreen or inline client."),
+			);
+		},
 		broadcast() {
 			// LWK can't run in a dedicated Worker (Esplora's async retry/sleep needs a `window` a
 			// Worker lacks), so this path never broadcasts — the offscreen/inline clients do. Present