@1sat/wallet-toolbox 0.0.74 → 0.0.76

package/dist/api/balance/index.js

@@ -107,8 +107,4 @@ export const getExchangeRate = {
 // Module exports
 // ============================================================================
 /** All balance skills for registry */
-export const balanceSkills = [
-    getBalance,
-    getPaymentUtxos,
-    getExchangeRate,
-];
+export const balanceSkills = [getBalance, getPaymentUtxos, getExchangeRate];

package/dist/api/broadcast/index.js

@@ -65,8 +65,9 @@ export const broadcast = {
             return { txid };
         }
         catch (error) {
+            console.error("[broadcast]", error);
             return {
-                error: error instanceof Error ? error.message : "Unknown error",
+                error: error instanceof Error ? error.message : "unknown-error",
             };
         }
     },

package/dist/api/inscriptions/index.js

@@ -101,6 +101,7 @@ export const inscribe = {
             };
         }
         catch (error) {
+            console.error("[inscribe]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/api/locks/index.js

@@ -143,6 +143,7 @@ export const lockBsv = {
             };
         }
         catch (error) {
+            console.error("[lockBsv]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -228,6 +229,9 @@ export const unlockBsv = {
             for (let i = 0; i < maturedLocks.length; i++) {
                 const lock = maturedLocks[i];
                 const input = tx.inputs[i];
+                if (!lock.output.lockingScript || !input.sourceTXID) {
+                    return { error: "missing-lock-data" };
+                }
                 const lockingScript = Script.fromHex(lock.output.lockingScript);
                 const preimage = TransactionSignature.format({
                     sourceTXID: input.sourceTXID,
@@ -277,6 +281,7 @@ export const unlockBsv = {
             };
         }
         catch (error) {
+            console.error("[unlockBsv]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/api/ordinals/index.js

@@ -175,9 +175,12 @@ export async function buildTransferOrdinals(ctx, request) {
             });
             recipientAddress = PublicKey.fromString(publicKey).toAddress();
         }
-        else {
+        else if (address) {
             recipientAddress = address;
         }
+        else {
+            return { error: "must-provide-counterparty-or-address" };
+        }
         // Preserve important tags from source output
         const tags = [];
         for (const tag of ordinal.tags ?? []) {
@@ -188,7 +191,7 @@ export async function buildTransferOrdinals(ctx, request) {
             }
         }
         const sourceName = extractName(ordinal.customInstructions);
-        inputs.push({
+        inputs?.push({
             outpoint,
             inputDescription: "Ordinal to transfer",
             unlockingScriptLength: 108,
@@ -196,7 +199,7 @@ export async function buildTransferOrdinals(ctx, request) {
         // Only track output in wallet when transferring to a counterparty (wallet can derive keys to spend it)
         // External address transfers are NOT tracked since the wallet cannot spend them
         if (counterparty) {
-            outputs.push({
+            outputs?.push({
                 lockingScript: new P2PKH().lock(recipientAddress).toHex(),
                 satoshis: 1,
                 outputDescription: "Ordinal transfer",
@@ -211,7 +214,7 @@ export async function buildTransferOrdinals(ctx, request) {
         }
         else {
             // External address - output is not tracked in wallet
-            outputs.push({
+            outputs?.push({
                 lockingScript: new P2PKH().lock(recipientAddress).toHex(),
                 satoshis: 1,
                 outputDescription: "Ordinal transfer to external address",
@@ -396,7 +399,7 @@ export const transferOrdinals = {
                 inputs: params.inputs,
                 outputs: params.outputs?.map((o) => ({
                     ...o,
-                    lockingScript: o.lockingScript?.slice(0, 20) + "...",
+                    lockingScript: `${o.lockingScript?.slice(0, 20)}...`,
                 })),
             }, null, 2));
             // Debug: Check if BEEF contains the source transactions
@@ -451,6 +454,7 @@ export const transferOrdinals = {
             };
         }
         catch (error) {
+            console.error("[transferOrdinals]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -520,6 +524,7 @@ export const listOrdinal = {
             };
         }
         catch (error) {
+            console.error("[listOrdinal]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -658,6 +663,7 @@ export const cancelListing = {
             };
         }
         catch (error) {
+            console.error("[cancelListing]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -824,6 +830,7 @@ export const purchaseOrdinal = {
             };
         }
         catch (error) {
+            console.error("[purchaseOrdinal]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/api/payments/index.js

@@ -126,6 +126,7 @@ export const sendBsv = {
             };
         }
         catch (error) {
+            console.error("[sendBsv]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -178,6 +179,7 @@ export const sendAllBsv = {
             };
         }
         catch (error) {
+            console.error("[sendAllBsv]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/api/signing/index.js

@@ -67,6 +67,7 @@ export const signMessage = {
             };
         }
         catch (error) {
+            console.error("[signMessage]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/api/sweep/index.js

@@ -5,8 +5,7 @@
  */
 import { BSV21 } from "@bopen-io/templates";
 import { P2PKH, PrivateKey, PublicKey, Transaction, Utils, } from "@bsv/sdk";
-import { deriveFundAddress } from "../../indexers";
-import { BSV21_BASKET, BSV21_FEE_SATS, BSV21_PROTOCOL, ONESAT_PROTOCOL, } from "../constants";
+import { BSV21_BASKET, BSV21_PROTOCOL, ONESAT_PROTOCOL } from "../constants";
 export * from "./types";
 /**
  * Prepare sweep inputs from IndexedOutput objects by fetching locking scripts.
@@ -217,10 +216,11 @@ export const sweepBsv = {
             };
         }
         catch (error) {
+            console.error("[sweepBsv]", error);
             // Log detailed error info for WERR_REVIEW_ACTIONS
             if (error && typeof error === "object" && "sendWithResults" in error) {
                 const werr = error;
-                console.error("[sweep] WERR_REVIEW_ACTIONS details:", {
+                console.error("[sweepBsv] WERR_REVIEW_ACTIONS details:", {
                     message: werr.message,
                     txid: werr.txid,
                     sendWithResults: JSON.stringify(werr.sendWithResults, null, 2),
@@ -359,19 +359,19 @@ export const sweepOrdinals = {
                 outputs,
                 options: { signAndProcess: false, randomizeOutputs: false },
             };
-            console.log(`[sweepOrdinals] === CREATE ACTION ARGS ===`);
+            console.log("[sweepOrdinals] === CREATE ACTION ARGS ===");
             console.log(`[sweepOrdinals] description: ${createActionArgs.description}`);
             console.log(`[sweepOrdinals] inputBEEF length: ${beefData.length} bytes`);
             console.log(`[sweepOrdinals] inputs count: ${inputDescriptors.length}`);
             console.log(`[sweepOrdinals] outputs count: ${outputs.length}`);
-            console.log(`[sweepOrdinals] inputs:`, JSON.stringify(inputDescriptors, null, 2));
-            console.log(`[sweepOrdinals] outputs:`, JSON.stringify(outputs, null, 2));
-            console.log(`[sweepOrdinals] options:`, JSON.stringify(createActionArgs.options));
-            console.log(`[sweepOrdinals] Calling createAction...`);
+            console.log("[sweepOrdinals] inputs:", JSON.stringify(inputDescriptors, null, 2));
+            console.log("[sweepOrdinals] outputs:", JSON.stringify(outputs, null, 2));
+            console.log("[sweepOrdinals] options:", JSON.stringify(createActionArgs.options));
+            console.log("[sweepOrdinals] Calling createAction...");
             let createResult;
             try {
                 createResult = await ctx.wallet.createAction(createActionArgs);
-                console.log(`[sweepOrdinals] createAction returned:`, JSON.stringify(createResult, (key, value) => {
+                console.log("[sweepOrdinals] createAction returned:", JSON.stringify(createResult, (key, value) => {
                     // Don't stringify large binary data
                     if (key === "tx" && value instanceof Uint8Array)
                         return `<Uint8Array ${value.length} bytes>`;
@@ -381,12 +381,12 @@ export const sweepOrdinals = {
                 }, 2));
             }
             catch (createError) {
-                console.error(`[sweepOrdinals] createAction threw:`, createError);
+                console.error("[sweepOrdinals] createAction threw:", createError);
                 const errorMsg = createError instanceof Error
                     ? createError.message
                     : String(createError);
                 const errorStack = createError instanceof Error ? createError.stack : undefined;
-                console.error(`[sweepOrdinals] Stack:`, errorStack);
+                console.error("[sweepOrdinals] Stack:", errorStack);
                 return { error: `createAction failed: ${errorMsg}` };
             }
             if ("error" in createResult && createResult.error) {
@@ -398,7 +398,7 @@ export const sweepOrdinals = {
             // Sign each input with our external key
             const tx = Transaction.fromBEEF(createResult.signableTransaction.tx);
             // Log transaction structure for debugging
-            console.log(`[sweepOrdinals] === Transaction Structure ===`);
+            console.log("[sweepOrdinals] === Transaction Structure ===");
             console.log(`[sweepOrdinals] Inputs (${tx.inputs.length}):`);
             let totalInputSats = 0;
             for (let i = 0; i < tx.inputs.length; i++) {
@@ -417,7 +417,7 @@ export const sweepOrdinals = {
             }
             console.log(`[sweepOrdinals] Total in: ${totalInputSats}, Total out: ${totalOutputSats}, Fee: ${totalInputSats - totalOutputSats}`);
             console.log(`[sweepOrdinals] Signable tx hex: ${Utils.toHex(createResult.signableTransaction.tx)}`);
-            console.log(`[sweepOrdinals] ==============================`);
+            console.log("[sweepOrdinals] ==============================");
             // Build a set of outpoints we control
             const ourOutpoints = new Set(inputs.map((input) => {
                 const [txid, vout] = input.outpoint.split("_");
@@ -435,12 +435,12 @@ export const sweepOrdinals = {
             await tx.sign();
             // Log signed transaction details for debugging
             const localTxid = tx.id("hex");
-            console.log(`[sweepOrdinals] === LOCAL SIGNED TX ===`);
+            console.log("[sweepOrdinals] === LOCAL SIGNED TX ===");
             console.log(`[sweepOrdinals] Local txid: ${localTxid}`);
             console.log(`[sweepOrdinals] Signed tx hex: ${tx.toHex()}`);
             // Extract unlocking scripts for signAction
             const spends = {};
-            console.log(`[sweepOrdinals] === UNLOCKING SCRIPTS FOR SIGNACTION ===`);
+            console.log("[sweepOrdinals] === UNLOCKING SCRIPTS FOR SIGNACTION ===");
             for (let i = 0; i < tx.inputs.length; i++) {
                 const txInput = tx.inputs[i];
                 const inputOutpoint = `${txInput.sourceTXID}.${txInput.sourceOutputIndex}`;
@@ -463,18 +463,18 @@ export const sweepOrdinals = {
                 return { error: String(signResult.error) };
             }
             // Debug: compare local vs signAction result
-            console.log(`[sweepOrdinals] === SIGN ACTION RESULT ===`);
+            console.log("[sweepOrdinals] === SIGN ACTION RESULT ===");
             console.log(`[sweepOrdinals] signAction txid: ${signResult.txid}`);
             // Log broadcast results if available
             if ("sendWithResults" in signResult) {
-                console.log(`[sweepOrdinals] sendWithResults:`, JSON.stringify(signResult.sendWithResults));
+                console.log("[sweepOrdinals] sendWithResults:", JSON.stringify(signResult.sendWithResults));
             }
             console.log(`[sweepOrdinals] Local txid (partial): ${localTxid}`);
-            console.log(`[sweepOrdinals] Note: TXIDs differ because local is partial (wallet input unsigned)`);
+            console.log("[sweepOrdinals] Note: TXIDs differ because local is partial (wallet input unsigned)");
             if (signResult.tx) {
                 // Parse returned BEEF to show final transaction structure
                 const returnedTx = Transaction.fromBEEF(signResult.tx);
-                console.log(`[sweepOrdinals] === FINAL TX STRUCTURE (broadcast) ===`);
+                console.log("[sweepOrdinals] === FINAL TX STRUCTURE (broadcast) ===");
                 console.log(`[sweepOrdinals] Final inputs (${returnedTx.inputs.length}):`);
                 let returnedInputSats = 0;
                 for (let i = 0; i < returnedTx.inputs.length; i++) {
@@ -501,7 +501,7 @@ export const sweepOrdinals = {
                 const satPerByte = finalFee / txSize;
                 console.log(`[sweepOrdinals] Tx size: ${txSize} bytes, Fee rate: ${satPerByte.toFixed(2)} sat/byte`);
                 if (satPerByte < 0.5) {
-                    console.warn(`[sweepOrdinals] WARNING: Fee rate seems very low!`);
+                    console.warn("[sweepOrdinals] WARNING: Fee rate seems very low!");
                 }
             }
             return {
@@ -510,6 +510,7 @@ export const sweepOrdinals = {
             };
         }
         catch (error) {
+            console.error("[sweepOrdinals]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -583,6 +584,22 @@ export const sweepBsv21 = {
             if (!inputs.every((i) => i.tokenId === tokenId)) {
                 return { error: "mixed-token-ids" };
             }
+            // Lookup token details to verify it's active and get fee info
+            const tokenDetails = await ctx.services.bsv21.getTokenDetails(tokenId);
+            if (!tokenDetails.status.is_active) {
+                return { error: "token-not-active" };
+            }
+            const { fee_address, fee_per_output } = tokenDetails.status;
+            // Validate all input outpoints exist in the overlay
+            const candidateOutpoints = inputs.map((i) => i.outpoint);
+            const validated = await ctx.services.bsv21.validateOutputs(tokenId, candidateOutpoints, { unspent: true });
+            const validSet = new Set(validated.map((v) => v.outpoint));
+            const invalidInputs = inputs.filter((i) => !validSet.has(i.outpoint));
+            if (invalidInputs.length > 0) {
+                return {
+                    error: `unvalidated-inputs: ${invalidInputs.map((i) => i.outpoint).join(", ")}`,
+                };
+            }
             // Parse WIF
             const privateKey = PrivateKey.fromWif(wif);
             // Sum all input amounts
@@ -630,17 +647,24 @@ export const sweepBsv21 = {
                 satoshis: 1,
                 outputDescription: `Sweep ${totalAmount} tokens`,
                 basket: BSV21_BASKET,
-                tags: [`id:${tokenId}`, `amt:${totalAmount}`],
+                tags: [
+                    `id:${tokenId}`,
+                    `amt:${totalAmount}`,
+                    `dec:${tokenDetails.token.dec}`,
+                    ...(tokenDetails.token.sym ? [`sym:${tokenDetails.token.sym}`] : []),
+                    ...(tokenDetails.token.icon
+                        ? [`icon:${tokenDetails.token.icon}`]
+                        : []),
+                ],
                 customInstructions: JSON.stringify({
                     protocolID: BSV21_PROTOCOL,
                     keyID,
                 }),
             });
-            // 2. Fee output (1000 sats) to overlay fund address
-            const fundAddress = deriveFundAddress(tokenId);
+            // 2. Fee output to overlay fund address
             outputs.push({
-                lockingScript: p2pkh.lock(fundAddress).toHex(),
-                satoshis: BSV21_FEE_SATS,
+                lockingScript: p2pkh.lock(fee_address).toHex(),
+                satoshis: fee_per_output,
                 outputDescription: "Overlay processing fee",
                 tags: [],
             });
@@ -698,13 +722,12 @@ export const sweepBsv21 = {
             // Submit to overlay service for indexing
             if (signResult.tx) {
                 try {
-                    const services = ctx.services;
-                    const overlayResult = await services.overlay.submitBsv21(signResult.tx, tokenId);
-                    console.log(`[sweepBsv21] Overlay submission result:`, overlayResult);
+                    const overlayResult = await ctx.services.overlay.submitBsv21(signResult.tx, tokenId);
+                    console.log("[sweepBsv21] Overlay submission result:", overlayResult);
                 }
                 catch (overlayError) {
                     // Log but don't fail the sweep - tx is already broadcast
-                    console.warn(`[sweepBsv21] Overlay submission failed:`, overlayError);
+                    console.warn("[sweepBsv21] Overlay submission failed:", overlayError);
                 }
             }
             return {
@@ -713,6 +736,7 @@ export const sweepBsv21 = {
             };
         }
         catch (error) {
+            console.error("[sweepBsv21]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/api/tokens/index.js

@@ -5,8 +5,7 @@
  */
 import { BSV21, OrdLock } from "@bopen-io/templates";
 import { BigNumber, LockingScript, OP, P2PKH, PublicKey, Transaction, TransactionSignature, UnlockingScript, Utils, } from "@bsv/sdk";
-import { deriveFundAddress } from "../../indexers";
-import { BSV21_BASKET, BSV21_FEE_SATS, BSV21_PROTOCOL } from "../constants";
+import { BSV21_BASKET, BSV21_PROTOCOL } from "../constants";
 // ============================================================================
 // Internal helpers
 // ============================================================================
@@ -105,31 +104,19 @@ export const getBsv21Balances = {
             const amtTag = o.tags?.find((t) => t.startsWith("amt:"))?.slice(4);
             if (!idTag || !amtTag)
                 continue;
-            const idContent = idTag.slice(3);
-            const lastColonIdx = idContent.lastIndexOf(":");
-            if (lastColonIdx === -1)
-                continue;
-            const tokenId = idContent.slice(0, lastColonIdx);
-            const status = idContent.slice(lastColonIdx + 1);
-            if (status === "invalid")
-                continue;
-            const isConfirmed = status === "valid";
+            const tokenId = idTag.slice(3);
             const amt = BigInt(amtTag);
             const dec = Number.parseInt(o.tags?.find((t) => t.startsWith("dec:"))?.slice(4) || "0", 10);
             const symTag = o.tags?.find((t) => t.startsWith("sym:"))?.slice(4);
             const iconTag = o.tags?.find((t) => t.startsWith("icon:"))?.slice(5);
             const existing = balanceMap.get(tokenId);
             if (existing) {
-                if (isConfirmed)
-                    existing.confirmed += amt;
-                else
-                    existing.pending += amt;
+                existing.amt += amt;
             }
             else {
                 balanceMap.set(tokenId, {
                     id: tokenId,
-                    confirmed: isConfirmed ? amt : 0n,
-                    pending: isConfirmed ? 0n : amt,
+                    amt,
                     sym: symTag,
                     icon: iconTag,
                     dec,
@@ -140,11 +127,11 @@ export const getBsv21Balances = {
             p: "bsv-20",
             op: "transfer",
             dec: b.dec,
-            amt: (b.confirmed + b.pending).toString(),
+            amt: b.amt.toString(),
             id: b.id,
             sym: b.sym,
             icon: b.icon,
-            all: { confirmed: b.confirmed, pending: b.pending },
+            all: { confirmed: b.amt, pending: 0n },
             listed: { confirmed: 0n, pending: 0n },
         }));
     },
@@ -191,6 +178,14 @@ export const sendBsv21 = {
                 !/^\d+$/.test(parts[1])) {
                 return { error: "invalid-token-id-format" };
             }
+            if (!ctx.services) {
+                return { error: "services-required" };
+            }
+            const tokenDetails = await ctx.services.bsv21.getTokenDetails(tokenId);
+            if (!tokenDetails.status.is_active) {
+                return { error: "token-not-active" };
+            }
+            const { fee_address, fee_per_output } = tokenDetails.status;
             const result = await ctx.wallet.listOutputs({
                 basket: BSV21_BASKET,
                 includeTags: true,
@@ -201,16 +196,24 @@ export const sendBsv21 = {
                 const idTag = o.tags?.find((t) => t.startsWith("id:"));
                 if (!idTag)
                     return false;
-                const idContent = idTag.slice(3);
-                const lastColonIdx = idContent.lastIndexOf(":");
-                if (lastColonIdx === -1)
-                    return false;
-                const id = idContent.slice(0, lastColonIdx);
-                const status = idContent.slice(lastColonIdx + 1);
-                return id === tokenId && status !== "invalid";
+                return idTag.slice(3) === tokenId;
             });
-            if (tokenUtxos.length === 0) {
-                return { error: "no-token-utxos-found" };
+            // Batch-validate all candidate outpoints against the overlay
+            const validOutpoints = new Set();
+            let overlayValidated = false;
+            if (ctx.services?.bsv21) {
+                const candidateOutpoints = tokenUtxos.map((o) => o.outpoint);
+                try {
+                    const validated = await ctx.services.bsv21.validateOutputs(tokenId, candidateOutpoints, { unspent: true });
+                    overlayValidated = true;
+                    for (const v of validated) {
+                        validOutpoints.add(v.outpoint);
+                    }
+                }
+                catch (e) {
+                    console.error("[sendBsv21] overlay validation error:", e);
+                    return { error: "overlay-validation-failed" };
+                }
             }
             const selected = [];
             let totalIn = 0n;
@@ -221,23 +224,15 @@ export const sendBsv21 = {
                 if (!amtTag)
                     continue;
                 const utxoAmount = BigInt(amtTag.slice(4));
-                if (ctx.services?.bsv21) {
-                    try {
-                        const [txid] = utxo.outpoint.split("_");
-                        const validation = await ctx.services.bsv21.getTokenByTxid(tokenId, txid);
-                        const outputData = validation.outputs.find((o) => `${validation.txid}_${o.vout}` === utxo.outpoint);
-                        if (!outputData)
-                            continue;
-                    }
-                    catch {
-                        continue;
-                    }
+                // Skip UTXOs not confirmed in the overlay
+                if (overlayValidated && !validOutpoints.has(utxo.outpoint)) {
+                    continue;
                 }
                 selected.push(utxo);
                 totalIn += utxoAmount;
             }
             if (totalIn < amount) {
-                return { error: "insufficient-validated-tokens" };
+                return { error: "insufficient-tokens" };
             }
             let recipientAddress;
             if (counterparty) {
@@ -252,9 +247,12 @@ export const sendBsv21 = {
             else if (paymail) {
                 return { error: "paymail-not-yet-implemented" };
             }
-            else {
+            else if (address) {
                 recipientAddress = address;
             }
+            else {
+                return { error: "must-provide-counterparty-or-address" };
+            }
             const outputs = [];
             const p2pkh = new P2PKH();
             const destinationLockingScript = p2pkh.lock(recipientAddress);
@@ -264,16 +262,10 @@ export const sendBsv21 = {
                 satoshis: 1,
                 outputDescription: `Send ${amount} tokens`,
             });
-            // Fee output to overlay fund address
-            const fundAddress = deriveFundAddress(tokenId);
-            outputs.push({
-                lockingScript: p2pkh.lock(fundAddress).toHex(),
-                satoshis: BSV21_FEE_SATS,
-                outputDescription: "Overlay processing fee",
-                tags: [],
-            });
             const change = totalIn - amount;
+            let tokenOutputCount = 1;
             if (change > 0n) {
+                tokenOutputCount = 2;
                 const changeKeyID = `${tokenId}-${Date.now()}`;
                 const { publicKey } = await ctx.wallet.getPublicKey({
                     protocolID: BSV21_PROTOCOL,
@@ -289,15 +281,31 @@ export const sendBsv21 = {
                     satoshis: 1,
                     outputDescription: "Token change",
                     basket: BSV21_BASKET,
-                    tags: [`id:${tokenId}`, `amt:${change}`],
+                    tags: [
+                        `id:${tokenId}`,
+                        `amt:${change}`,
+                        `dec:${tokenDetails.token.dec}`,
+                        ...(tokenDetails.token.sym
+                            ? [`sym:${tokenDetails.token.sym}`]
+                            : []),
+                        ...(tokenDetails.token.icon
+                            ? [`icon:${tokenDetails.token.icon}`]
+                            : []),
+                    ],
                     customInstructions: JSON.stringify({
                         protocolID: BSV21_PROTOCOL,
                         keyID: changeKeyID,
                     }),
                 });
             }
-            const symTag = tokenUtxos[0]?.tags?.find((t) => t.startsWith("sym:"));
-            const symbol = symTag ? symTag.slice(4) : tokenId.slice(0, 8);
+            // Fee output to overlay fund address (per token output)
+            outputs.push({
+                lockingScript: p2pkh.lock(fee_address).toHex(),
+                satoshis: fee_per_output * tokenOutputCount,
+                outputDescription: "Overlay processing fee",
+                tags: [],
+            });
+            const symbol = tokenDetails.token.sym || tokenId.slice(0, 8);
             const createResult = await ctx.wallet.createAction({
                 description: `Send ${amount} ${symbol}`,
                 inputs: selected.map((o) => ({
@@ -324,12 +332,11 @@ export const sendBsv21 = {
             // Submit to overlay service for indexing
             if (signResult.tx && ctx.services) {
                 try {
-                    const services = ctx.services;
-                    const overlayResult = await services.overlay.submitBsv21(signResult.tx, tokenId);
-                    console.log(`[sendBsv21] Overlay submission result:`, overlayResult);
+                    const overlayResult = await ctx.services.overlay.submitBsv21(signResult.tx, tokenId);
+                    console.log("[sendBsv21] Overlay submission result:", overlayResult);
                 }
                 catch (overlayError) {
-                    console.warn(`[sendBsv21] Overlay submission failed:`, overlayError);
+                    console.warn("[sendBsv21] Overlay submission failed:", overlayError);
                 }
             }
             return {
@@ -338,6 +345,7 @@ export const sendBsv21 = {
             };
         }
         catch (error) {
+            console.error("[sendBsv21]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -391,11 +399,13 @@ export const purchaseBsv21 = {
             const [txid, voutStr] = parts;
             const vout = Number.parseInt(voutStr, 10);
             try {
-                await ctx.services.bsv21.getTokenByTxid(tokenId, txid);
+                await ctx.services.bsv21.validateOutput(tokenId, outpoint);
             }
-            catch {
+            catch (e) {
+                console.error("[purchaseBsv21] overlay validation error:", e);
                 return { error: "listing-not-found-in-overlay" };
             }
+            const tokenDetails = await ctx.services.bsv21.getTokenDetails(tokenId);
             const beef = await ctx.services.getBeefForTxid(txid);
             const listingBeefTx = beef.findTxid(txid);
             if (!listingBeefTx?.tx) {
@@ -426,7 +436,15 @@ export const purchaseBsv21 = {
                 satoshis: 1,
                 outputDescription: "Purchased tokens",
                 basket: BSV21_BASKET,
-                tags: [`id:${tokenId}`, `amt:${tokenAmount}`],
+                tags: [
+                    `id:${tokenId}`,
+                    `amt:${tokenAmount}`,
+                    `dec:${tokenDetails.token.dec}`,
+                    ...(tokenDetails.token.sym ? [`sym:${tokenDetails.token.sym}`] : []),
+                    ...(tokenDetails.token.icon
+                        ? [`icon:${tokenDetails.token.icon}`]
+                        : []),
+                ],
                 customInstructions: JSON.stringify({
                     protocolID: BSV21_PROTOCOL,
                     keyID: bsv21KeyID,
@@ -454,6 +472,15 @@ export const purchaseBsv21 = {
                     });
                 }
             }
+            // Fee output to overlay fund address
+            if (tokenDetails.status.is_active) {
+                outputs.push({
+                    lockingScript: p2pkh.lock(tokenDetails.status.fee_address).toHex(),
+                    satoshis: tokenDetails.status.fee_per_output,
+                    outputDescription: "Overlay processing fee",
+                    tags: [],
+                });
+            }
             const createResult = await ctx.wallet.createAction({
                 description: `Purchase ${tokenAmount} tokens for ${payoutSatoshis} sats`,
                 inputBEEF: beef.toBinary(),
@@ -488,12 +515,11 @@ export const purchaseBsv21 = {
             // Submit to overlay service for indexing
             if (signResult.tx && ctx.services) {
                 try {
-                    const services = ctx.services;
-                    const overlayResult = await services.overlay.submitBsv21(signResult.tx, tokenId);
-                    console.log(`[purchaseBsv21] Overlay submission result:`, overlayResult);
+                    const overlayResult = await ctx.services.overlay.submitBsv21(signResult.tx, tokenId);
+                    console.log("[purchaseBsv21] Overlay submission result:", overlayResult);
                 }
                 catch (overlayError) {
-                    console.warn(`[purchaseBsv21] Overlay submission failed:`, overlayError);
+                    console.warn("[purchaseBsv21] Overlay submission failed:", overlayError);
                 }
             }
             return {
@@ -502,6 +528,7 @@ export const purchaseBsv21 = {
             };
         }
         catch (error) {
+            console.error("[purchaseBsv21]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/indexers/Bsv21Indexer.js

@@ -77,8 +77,7 @@ export class Bsv21Indexer extends Indexer {
             return;
         const tags = [];
         if (txo.owner && this.owners.has(txo.owner)) {
-            // Use id:tokenId:status format for querying by token and status
-            tags.push(`id:${bsv21.id}:${bsv21.status}`);
+            tags.push(`id:${bsv21.id}`);
             tags.push(`amt:${bsv21.amt.toString()}`);
             // Add metadata tags for efficient querying
             if (bsv21.sym)

package/dist/services/OneSatServices.js

@@ -139,7 +139,7 @@ export class OneSatServices {
     }
     async postBeef(beef, txids) {
         console.log("[OneSatServices] postBeef called with txids:", txids);
-        console.log("[OneSatServices] BEEF structure:\n" + beef.toLogString());
+        console.log(`[OneSatServices] BEEF structure:\n${beef.toLogString()}`);
         const results = [];
         for (const txid of txids) {
             try {
@@ -149,7 +149,7 @@ export class OneSatServices {
                 console.log("[OneSatServices] AtomicBEEF length:", atomicBeef.length, "bytes");
                 // Parse back to verify structure
                 const verifyBeef = Beef.fromBinary(atomicBeef);
-                console.log("[OneSatServices] AtomicBEEF parsed back:\n" + verifyBeef.toLogString());
+                console.log(`[OneSatServices] AtomicBEEF parsed back:\n${verifyBeef.toLogString()}`);
                 // TODO: Remove hardcoded callback headers after server testing
                 const status = await this.arcade.submitTransaction(atomicBeef, {
                     callbackUrl: `${this.baseUrl}/1sat/arc/callback`,
@@ -292,10 +292,8 @@ export class OneSatServices {
                 const depth = currentHeight - tx.merklePath.blockHeight + 1;
                 return { txid, status: "mined", depth };
             }
-            else {
-                // No merkle path = known but not yet mined
-                return { txid, status: "known", depth: 0 };
-            }
+            // No merkle path = known but not yet mined
+            return { txid, status: "known", depth: 0 };
         }
         catch {
             // 404 or error from Beef = unknown

package/dist/services/client/Bsv21Client.d.ts

@@ -1,5 +1,23 @@
 import type { Bsv21TransactionData, ClientOptions, IndexedOutput, TokenDetailResponse } from "../types";
 import { BaseClient } from "./BaseClient";
+/**
+ * Query options for /outputs validation endpoints.
+ * All flags default to false on the server.
+ */
+export interface OutputQueryOptions {
+    /** Filter for unspent outputs only */
+    unspent?: boolean;
+    /** Include spend txid */
+    spend?: boolean;
+    /** Include satoshis */
+    sats?: boolean;
+    /** Include events array */
+    events?: boolean;
+    /** Include block info */
+    block?: boolean;
+    /** Comma-separated data tags to include (e.g. 'bsv21') */
+    tags?: string;
+}
 /**
  * Client for /1sat/bsv21/* routes.
  * Provides BSV21 token queries.
@@ -66,6 +84,24 @@ export declare class Bsv21Client extends BaseClient {
      * @param addresses - Array of addresses (max 100)
      */
     getHistoryMulti(tokenId: string, lockType: string, addresses: string[]): Promise<IndexedOutput[]>;
+    /**
+     * Validate specific outpoints against the token's overlay topic.
+     * Returns only those found in the overlay. By default returns minimal data
+     * (outpoint + score). Use opts to include additional fields.
+     * @param tokenId - Token ID (txid_vout format)
+     * @param outpoints - Array of outpoints to validate (max 1000)
+     * @param opts - Optional query flags for additional data
+     */
+    validateOutputs(tokenId: string, outpoints: string[], opts?: OutputQueryOptions): Promise<IndexedOutput[]>;
+    /**
+     * Validate a single outpoint against the token's overlay topic.
+     * Returns 404 if not found. By default returns minimal data (outpoint + score).
+     * @param tokenId - Token ID (txid_vout format)
+     * @param outpoint - Outpoint to validate (txid_vout or txid:vout)
+     * @param opts - Optional query flags for additional data
+     */
+    validateOutput(tokenId: string, outpoint: string, opts?: OutputQueryOptions): Promise<IndexedOutput>;
+    private buildOutputQuery;
     /**
      * Clear the token details cache
      */

package/dist/services/client/Bsv21Client.js

@@ -100,6 +100,51 @@ export class Bsv21Client extends BaseClient {
             body: JSON.stringify(addresses),
         });
     }
+    /**
+     * Validate specific outpoints against the token's overlay topic.
+     * Returns only those found in the overlay. By default returns minimal data
+     * (outpoint + score). Use opts to include additional fields.
+     * @param tokenId - Token ID (txid_vout format)
+     * @param outpoints - Array of outpoints to validate (max 1000)
+     * @param opts - Optional query flags for additional data
+     */
+    async validateOutputs(tokenId, outpoints, opts) {
+        const params = this.buildOutputQuery(opts);
+        return this.request(`/${tokenId}/outputs${params}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(outpoints),
+        });
+    }
+    /**
+     * Validate a single outpoint against the token's overlay topic.
+     * Returns 404 if not found. By default returns minimal data (outpoint + score).
+     * @param tokenId - Token ID (txid_vout format)
+     * @param outpoint - Outpoint to validate (txid_vout or txid:vout)
+     * @param opts - Optional query flags for additional data
+     */
+    async validateOutput(tokenId, outpoint, opts) {
+        const params = this.buildOutputQuery(opts);
+        return this.request(`/${tokenId}/outputs/${outpoint}${params}`);
+    }
+    buildOutputQuery(opts) {
+        if (!opts)
+            return "";
+        const parts = [];
+        if (opts.unspent)
+            parts.push("unspent=true");
+        if (opts.spend)
+            parts.push("spend=true");
+        if (opts.sats)
+            parts.push("sats=true");
+        if (opts.events)
+            parts.push("events=true");
+        if (opts.block)
+            parts.push("block=true");
+        if (opts.tags)
+            parts.push(`tags=${encodeURIComponent(opts.tags)}`);
+        return parts.length > 0 ? `?${parts.join("&")}` : "";
+    }
     /**
      * Clear the token details cache
      */

package/dist/services/client/index.d.ts

@@ -5,5 +5,5 @@ export { ArcadeClient } from "./ArcadeClient";
 export { TxoClient } from "./TxoClient";
 export { OwnerClient } from "./OwnerClient";
 export { OrdfsClient } from "./OrdfsClient";
-export { Bsv21Client } from "./Bsv21Client";
+export { Bsv21Client, type OutputQueryOptions } from "./Bsv21Client";
 export { OverlayClient } from "./OverlayClient";

package/dist/sync/SyncManager.d.ts

@@ -81,13 +81,13 @@ export interface SyncProcessorOptions {
     indexers?: Indexer[];
 }
 export interface SyncProcessorEvents {
-    "process:start": {};
+    "process:start": Record<string, never>;
     "process:progress": {
         pending: number;
         done: number;
         failed: number;
     };
-    "process:complete": {};
+    "process:complete": Record<string, never>;
     "process:error": {
         message: string;
     };
@@ -161,7 +161,7 @@ export interface SyncEvents {
         done: number;
         failed: number;
     };
-    "sync:complete": {};
+    "sync:complete": Record<string, never>;
     "sync:error": {
         message: string;
     };

package/dist/sync/SyncManager.js

@@ -44,7 +44,7 @@ export class SyncFetcher {
         }
         this.listeners
             .get(event)
-            .add(listener);
+            ?.add(listener);
     }
     off(event, listener) {
         this.listeners
@@ -52,7 +52,9 @@ export class SyncFetcher {
             ?.delete(listener);
     }
     emit(event, data) {
-        this.listeners.get(event)?.forEach((listener) => listener(data));
+        for (const listener of this.listeners.get(event) ?? []) {
+            listener(data);
+        }
     }
     /**
      * Fetch new outputs via SSE and enqueue them.
@@ -161,7 +163,7 @@ export class SyncProcessor {
         }
         this.listeners
             .get(event)
-            .add(listener);
+            ?.add(listener);
     }
     off(event, listener) {
         this.listeners
@@ -169,7 +171,9 @@ export class SyncProcessor {
             ?.delete(listener);
     }
     emit(event, data) {
-        this.listeners.get(event)?.forEach((listener) => listener(data));
+        for (const listener of this.listeners.get(event) ?? []) {
+            listener(data);
+        }
     }
     /**
      * Start processing the queue.
@@ -379,18 +383,16 @@ export class SyncProcessor {
                 },
             };
         }
-        else {
-            // P2PKH-based output - use wallet payment for auto-signing
-            return {
-                outputIndex: vout,
-                protocol: "wallet payment",
-                paymentRemittance: {
-                    derivationPrefix: derivation.derivationPrefix,
-                    derivationSuffix: derivation.derivationSuffix,
-                    senderIdentityKey: derivation.senderIdentityKey,
-                },
-            };
-        }
+        // P2PKH-based output - use wallet payment for auto-signing
+        return {
+            outputIndex: vout,
+            protocol: "wallet payment",
+            paymentRemittance: {
+                derivationPrefix: derivation.derivationPrefix,
+                derivationSuffix: derivation.derivationSuffix,
+                senderIdentityKey: derivation.senderIdentityKey,
+            },
+        };
     }
     collectTags(txo) {
         const tags = [];
@@ -467,7 +469,7 @@ export class SyncManager {
         }
         this.listeners
             .get(event)
-            .add(listener);
+            ?.add(listener);
     }
     off(event, listener) {
         this.listeners
@@ -475,7 +477,9 @@ export class SyncManager {
             ?.delete(listener);
     }
     emit(event, data) {
-        this.listeners.get(event)?.forEach((listener) => listener(data));
+        for (const listener of this.listeners.get(event) ?? []) {
+            listener(data);
+        }
     }
     // ===== Sync Control =====
     /**

package/dist/wallet/factory.d.ts

@@ -5,7 +5,7 @@
  * (browser extension) and 1sat-website (React app).
  */
 import { PrivateKey } from "@bsv/sdk";
-import { Monitor, type PermissionsManagerConfig, StorageClient, Wallet, WalletPermissionsManager, WalletStorageManager } from "@bsv/wallet-toolbox-mobile/out/src/index.client.js";
+import { Monitor, StorageClient, Wallet, WalletStorageManager } from "@bsv/wallet-toolbox-mobile/out/src/index.client.js";
 import { OneSatServices } from "../services/OneSatServices";
 import { type FullSyncResult, type FullSyncStage } from "./fullSync";
 type Chain = "main" | "test";
@@ -17,10 +17,6 @@ export interface WebWalletConfig {
     privateKey: PrivateKey | string;
     /** Network: 'main' or 'test' */
     chain: Chain;
-    /** Admin originator that bypasses permission checks (e.g., chrome-extension://id or https://wallet.example.com) */
-    adminOriginator: string;
-    /** Permission configuration for WalletPermissionsManager */
-    permissionsConfig: PermissionsManagerConfig;
     /** Fee model. Default: { model: 'sat/kb', value: 100 } */
     feeModel?: {
         model: "sat/kb";
@@ -39,10 +35,8 @@ export interface WebWalletConfig {
  * Result of wallet creation.
  */
 export interface WebWalletResult {
-    /** Wallet instance with permission management */
-    wallet: WalletPermissionsManager;
-    /** Underlying wallet without permission checks (for trusted contexts like sweep-ui) */
-    rawWallet: Wallet;
+    /** Wallet instance */
+    wallet: Wallet;
     /** 1Sat services for API access */
     services: OneSatServices;
     /** Monitor for transaction lifecycle (not started - call monitor.startTasks() when ready) */
@@ -57,15 +51,14 @@ export interface WebWalletResult {
     remoteStorage?: StorageClient;
 }
 /**
- * Create a web wallet with storage, services, permissions, and monitor.
+ * Create a web wallet with storage, services, and monitor.
  *
  * @example
  * ```typescript
  * const { wallet, services, monitor, destroy } = await createWebWallet({
  *   privateKey: identityWif,
  *   chain: 'main',
- *   adminOriginator: 'https://wallet.example.com',
- *   permissionsConfig: DEFAULT_PERMISSIONS_CONFIG,
+ *   storageIdentityKey: 'device-unique-id',
  * });
  *
  * // Wire up monitor callbacks

package/dist/wallet/factory.js

@@ -5,7 +5,7 @@
  * (browser extension) and 1sat-website (React app).
  */
 import { KeyDeriver, PrivateKey } from "@bsv/sdk";
-import { Monitor, Services, StorageClient, StorageIdb, StorageProvider, Wallet, WalletPermissionsManager, WalletStorageManager, } from "@bsv/wallet-toolbox-mobile/out/src/index.client.js";
+import { Monitor, Services, StorageClient, StorageIdb, StorageProvider, Wallet, WalletStorageManager, } from "@bsv/wallet-toolbox-mobile/out/src/index.client.js";
 import { OneSatServices } from "../services/OneSatServices";
 import { fullSync } from "./fullSync";
 // Default database name for IndexedDB storage
@@ -39,15 +39,14 @@ function parsePrivateKey(input) {
     }
 }
 /**
- * Create a web wallet with storage, services, permissions, and monitor.
+ * Create a web wallet with storage, services, and monitor.
  *
  * @example
  * ```typescript
  * const { wallet, services, monitor, destroy } = await createWebWallet({
  *   privateKey: identityWif,
  *   chain: 'main',
- *   adminOriginator: 'https://wallet.example.com',
- *   permissionsConfig: DEFAULT_PERMISSIONS_CONFIG,
+ *   storageIdentityKey: 'device-unique-id',
  * });
  *
  * // Wire up monitor callbacks
@@ -58,7 +57,7 @@ function parsePrivateKey(input) {
  * ```
  */
 export async function createWebWallet(config) {
-    const { chain, adminOriginator, permissionsConfig } = config;
+    const { chain } = config;
     const feeModel = config.feeModel ?? DEFAULT_FEE_MODEL;
     // 1. Parse private key and create KeyDeriver
     const privateKey = parsePrivateKey(config.privateKey);
@@ -73,10 +72,10 @@ export async function createWebWallet(config) {
     const localStorage = new StorageIdb(storageOptions);
     await localStorage.migrate(DEFAULT_DATABASE_NAME, config.storageIdentityKey);
     // 4. Create storage manager with local-only storage initially (empty backups)
-    let storage = new WalletStorageManager(identityPubKey, localStorage, []);
+    const storage = new WalletStorageManager(identityPubKey, localStorage, []);
     await storage.makeAvailable();
-    // 5. Create the underlying Wallet FIRST (needed for StorageClient signing)
-    const underlyingWallet = new Wallet({
+    // 5. Create wallet (needed before StorageClient for signing)
+    const wallet = new Wallet({
         chain,
         keyDeriver,
         storage,
@@ -89,7 +88,7 @@ export async function createWebWallet(config) {
     if (config.remoteStorageUrl) {
         console.log(`[createWebWallet] Attempting remote storage connection to ${config.remoteStorageUrl}`);
         try {
-            remoteClient = new StorageClient(underlyingWallet, config.remoteStorageUrl);
+            remoteClient = new StorageClient(wallet, config.remoteStorageUrl);
             const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error("Remote storage connection timeout")), DEFAULT_REMOTE_STORAGE_TIMEOUT));
             await Promise.race([remoteClient.makeAvailable(), timeoutPromise]);
             // Add remote to storage manager - it will partition as conflicting if another device is active
@@ -137,8 +136,8 @@ export async function createWebWallet(config) {
     // bypass the monitor's onTransactionBroadcasted callback. We detect broadcasts
     // by checking for txid in the result and sync to backup immediately.
     if (remoteClient) {
-        const originalCreateAction = underlyingWallet.createAction.bind(underlyingWallet);
-        underlyingWallet.createAction = async (args) => {
+        const originalCreateAction = wallet.createAction.bind(wallet);
+        wallet.createAction = async (args) => {
             const result = await originalCreateAction(args);
             if (result.txid) {
                 console.log("[createWebWallet] Broadcast detected in createAction:", result.txid);
@@ -148,8 +147,8 @@ export async function createWebWallet(config) {
             }
             return result;
         };
-        const originalSignAction = underlyingWallet.signAction.bind(underlyingWallet);
-        underlyingWallet.signAction = async (args) => {
+        const originalSignAction = wallet.signAction.bind(wallet);
+        wallet.signAction = async (args) => {
             const result = await originalSignAction(args);
             if (result.txid) {
                 console.log("[createWebWallet] Broadcast detected in signAction:", result.txid);
@@ -160,9 +159,7 @@ export async function createWebWallet(config) {
             return result;
         };
     }
-    // 9. Wrap with permissions manager
-    const wallet = new WalletPermissionsManager(underlyingWallet, adminOriginator, permissionsConfig);
-    // 10. Create monitor (not started - consumer calls startTasks() when ready)
+    // 9. Create monitor (not started - consumer calls startTasks() when ready)
     const monitor = new Monitor({
         chain,
         services: oneSatServices,
@@ -175,7 +172,7 @@ export async function createWebWallet(config) {
         unprovenAttemptsLimitMain: 144,
     });
     monitor.addDefaultTasks();
-    console.log("[createWebWallet] Monitor created with tasks:", monitor["_tasks"].map((t) => t.name));
+    console.log("[createWebWallet] Monitor created with tasks:", monitor._tasks.map((t) => t.name));
     // 11. Wire up monitor callbacks - sync to remote first, then call user callbacks
     // Note: For delayed broadcasts, the monitor triggers these. For immediate broadcasts,
     // the interception in step 8 handles the sync, but these still fire for the user callback.
@@ -228,7 +225,7 @@ export async function createWebWallet(config) {
     const destroy = async () => {
         monitor.stopTasks();
         await monitor.destroy();
-        await underlyingWallet.destroy();
+        await wallet.destroy();
     };
     // 13. Create fullSync function if remote storage is connected
     const fullSyncFn = remoteClient
@@ -243,7 +240,6 @@ export async function createWebWallet(config) {
         : undefined;
     return {
         wallet,
-        rawWallet: underlyingWallet,
         services: oneSatServices,
         monitor,
         destroy,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1sat/wallet-toolbox",
-  "version": "0.0.74",
+  "version": "0.0.76",
   "description": "BSV wallet library extending @bsv/wallet-toolbox with 1Sat Ordinals protocol support",
   "author": "1Sat Team",
   "license": "MIT",