@smartledger/bsv 7.1.0 → 7.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (19) hide show
  1. package/CHANGELOG.md +87 -0
  2. package/README.md +38 -38
  3. package/bsv-gdaf.min.js +27 -27
  4. package/bsv-ltp.min.js +27 -27
  5. package/bsv-smartcontract.min.js +1 -1
  6. package/bsv.bundle.js +27 -27
  7. package/bsv.d.ts +17 -1
  8. package/bsv.min.js +27 -27
  9. package/docs/MODULE_REFERENCE_COMPLETE.md +27 -27
  10. package/docs/advanced/UTXO_MANAGER_GUIDE.md +1 -1
  11. package/docs/getting-started/INSTALLATION.md +23 -23
  12. package/docs/getting-started/QUICK_START.md +7 -7
  13. package/docs/migration/FROM_BSV_1_5_6.md +5 -5
  14. package/lib/ordinals/README.md +24 -1
  15. package/lib/ordinals/inscription.js +113 -23
  16. package/lib/ordinals/ordlock.js +1 -0
  17. package/package.json +1 -1
  18. package/test/ordinals/inscription.js +154 -0
  19. package/version.js +1 -1
package/CHANGELOG.md CHANGED
@@ -7,6 +7,93 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
7
7
 
8
8
  ## [Unreleased]
9
9
 
10
+ ## [7.2.0] - 2026-08-05
11
+
12
+ Extends the 7.0.1/7.0.2 silent-argument sweep into `lib/ordinals/`, which the earlier
13
+ pass did not cover, and fixes a parser bug found while checking the module against the
14
+ 1Sat specification. Several calls that previously succeeded now throw; see **Breaking**
15
+ at the end of this section.
16
+
17
+ The unifying defect: an inscription is permanent, and every one of these paths committed
18
+ something other than what the caller asked for, with no error and a script that looked
19
+ correct afterwards.
20
+
21
+ ### Fixed
22
+
23
+ - **`Ordinals.buildInscription` no longer inscribes an empty payload when `content` is
24
+ omitted.** `toBuf(params.content)` mapped a missing value to a zero-length Buffer, so
25
+ `buildInscription({ address, contentType })` returned a well-formed inscription script
26
+ carrying nothing — `isInscription()` reported `true`, `createInscriptionOutput` wrapped
27
+ it in a spendable 1-sat output, and the mistake was only visible after broadcast. This
28
+ was reported from the field by a caller whose own builder names the field `data`:
29
+ passing `data` produced a script **byte-identical** to omitting the content entirely.
30
+ `content` is now required, and the error names the field that was passed instead when
31
+ it is one of the obvious aliases (`data`, `body`, `payload`, `text`, `message`). An
32
+ explicit `content: ''` still builds an empty payload, so a deliberate one remains
33
+ expressible; only absence is rejected.
34
+
35
+ - **Non-string, non-Buffer content is rejected instead of stringified.** `String(v)`
36
+ turned an object into the literal text `[object Object]`, an array into `1,2`, and
37
+ `false` into `"false"` — permanently. Only strings and Buffers are accepted; callers
38
+ encode their own values (`JSON.stringify`, `Buffer.from`). Content may still be
39
+ *arbitrary binary under any MIME type* — that is unchanged and is the point of the
40
+ format; what is gone is the guessing.
41
+
42
+ - **Buffer content now requires an explicit `contentType`.** It previously defaulted to
43
+ `text/plain`, mislabelling binary — a PNG inscribed as text. Bytes carry no hint about
44
+ what they are, so the caller must say. The `text/plain` default still applies to string
45
+ content, where it is truthful. An empty or non-string `contentType` is also rejected
46
+ rather than silently replaced by the default.
47
+
48
+ - **An empty base lock is rejected: it produced an anyone-can-spend ordinal.** With no
49
+ base lock the script is just the inert envelope — `OP_FALSE OP_IF` skips to `OP_ENDIF`,
50
+ so whatever the spender pushes is the final stack and *any* spender succeeds. The 1Sat
51
+ specification is explicit that a locking script "cannot be omitted entirely". Callers
52
+ legitimately building an envelope to append to their own script (as the OrdLock listing
53
+ does for its inline inscription) pass `{ allowEmptyLock: true }`, matching the existing
54
+ `{ allowNonEnforcing: true }` precedent. The regression test proves the unguarded script
55
+ really is anyone-can-spend by satisfying it through the interpreter with `OP_1`.
56
+
57
+ - **Passing both `lock` and `address` throws instead of silently ignoring `address`.**
58
+ They name different owners; resolving that by precedence meant a caller who supplied
59
+ both got an ordinal owned by whichever one the implementation preferred.
60
+
61
+ - **`createInscriptionOutput` validates `satoshis`.** `Output` already rejected negatives
62
+ and fractions, but `0` and the string `'1'` passed through — a 0-sat output carries no
63
+ ordinal at all. It must now be a positive integer; the default of 1 is unchanged.
64
+
65
+ - **`parseInscription` recovers a locking script that follows the envelope.** The 1Sat
66
+ spec allows the lock to be *prepended or appended* ("A locking script (typically P2PKH)
67
+ is then prepended/appended to the inscription script, optionally separated by
68
+ OP_CODESEPARATOR"), but the parser took only the chunks *before* the envelope as the
69
+ lock and discarded everything after `OP_ENDIF`. For the appended form it therefore
70
+ reported `lock` as an **empty script** while `isInscription` returned `true` — telling a
71
+ wallet inspecting a third-party ordinal that an owned output had no locking script, the
72
+ exact inverse of the guard above. `lock` is now the whole script minus the envelope, in
73
+ script order. A separating `OP_CODESEPARATOR` is kept, because it genuinely runs and
74
+ affects the sighash. The common prepended form is unchanged.
75
+
76
+ ### Changed
77
+
78
+ - `bsv.d.ts`: `InscriptionParams.content` is now required rather than optional, so
79
+ TypeScript callers get the original bug as a **compile error**; added `allowEmptyLock`;
80
+ documented that `lock` and `address` are mutually exclusive and that `contentType` is
81
+ required for Buffer content. Verified under `tsc --strict`.
82
+
83
+ ### Breaking
84
+
85
+ Calls that previously returned a script and now throw: `content` omitted, `content` that
86
+ is not a string or Buffer, Buffer content without a `contentType`, an empty or non-string
87
+ `contentType`, an empty base lock without `allowEmptyLock`, `lock` and `address` together,
88
+ and a `satoshis` value that is not a positive integer. Each produced an inscription that
89
+ did not match the caller's intent, so code hitting one of these was already broken; the
90
+ change is that it now fails at build time rather than on chain.
91
+
92
+ `parseInscription(...).lock` now includes script chunks that follow the envelope. Code
93
+ that relied on the previous value for the appended form was reading an empty script.
94
+
95
+ Suite 4485 → 4502.
96
+
10
97
  ## [7.1.0] - 2026-07-17
11
98
 
12
99
  Six security fixes from an audit of the crypto core. Four change verification
package/README.md CHANGED
@@ -186,42 +186,42 @@ console.log('Status:', status) // 'revoked'
186
186
  ### **Core Modules**
187
187
  | Module | Size | Use Case | CDN |
188
188
  |--------|------|----------|-----|
189
- | **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js` |
190
- | **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.1.0/bsv.bundle.js` |
189
+ | **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js` |
190
+ | **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.2.0/bsv.bundle.js` |
191
191
 
192
192
  ### **W3C Verifiable Credentials**
193
193
  | Module | Size | Use Case | CDN |
194
194
  |--------|------|----------|-----|
195
- | **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.1.0/bsv-didweb.min.js` |
196
- | **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.1.0/bsv-vcjwt.min.js` |
197
- | **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.1.0/bsv-statuslist.min.js` |
198
- | **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.1.0/bsv-anchor.min.js` |
195
+ | **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.2.0/bsv-didweb.min.js` |
196
+ | **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.2.0/bsv-vcjwt.min.js` |
197
+ | **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.2.0/bsv-statuslist.min.js` |
198
+ | **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.2.0/bsv-anchor.min.js` |
199
199
 
200
200
  ### **Smart Contract & Development**
201
201
  | Module | Size | Use Case | CDN |
202
202
  |--------|------|----------|-----|
203
- | **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.1.0/bsv-smartcontract.min.js` |
204
- | **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.1.0/bsv-covenant.min.js` |
205
- | **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.1.0/bsv-script-helper.min.js` |
206
- | **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.1.0/bsv-security.min.js` |
203
+ | **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.2.0/bsv-smartcontract.min.js` |
204
+ | **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.2.0/bsv-covenant.min.js` |
205
+ | **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.2.0/bsv-script-helper.min.js` |
206
+ | **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.2.0/bsv-security.min.js` |
207
207
 
208
208
  ### **Legal & Compliance**
209
209
  | Module | Size | Use Case | CDN |
210
210
  |--------|------|----------|-----|
211
- | **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.1.0/bsv-ltp.min.js` |
212
- | **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.1.0/bsv-gdaf.min.js` |
211
+ | **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.2.0/bsv-ltp.min.js` |
212
+ | **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.2.0/bsv-gdaf.min.js` |
213
213
 
214
214
  ### **Advanced Cryptography**
215
215
  | Module | Size | Use Case | CDN |
216
216
  |--------|------|----------|-----|
217
- | **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.1.0/bsv-shamir.min.js` |
217
+ | **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.2.0/bsv-shamir.min.js` |
218
218
 
219
219
  ### **Utilities**
220
220
  | Module | Size | Use Case | CDN |
221
221
  |--------|------|----------|-----|
222
- | **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.1.0/bsv-ecies.min.js` |
223
- | **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.1.0/bsv-message.min.js` |
224
- | **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.1.0/bsv-mnemonic.min.js` |
222
+ | **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.2.0/bsv-ecies.min.js` |
223
+ | **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.2.0/bsv-message.min.js` |
224
+ | **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.2.0/bsv-mnemonic.min.js` |
225
225
 
226
226
  ## ⚡ **2-Minute Quick Start**
227
227
 
@@ -232,7 +232,7 @@ Get started with Bitcoin SV development in under 2 minutes:
232
232
  npm install @smartledger/bsv
233
233
 
234
234
  # Or include in HTML
235
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
235
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
236
236
  ```
237
237
 
238
238
  > **🔒 v5.0.0 (production hardening — has breaking changes):** Shamir secret
@@ -332,8 +332,8 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
332
332
 
333
333
  ### 🔧 **Basic Development** (~1.2MB total)
334
334
  ```html
335
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
336
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-script-helper.min.js"></script>
335
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
336
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-script-helper.min.js"></script>
337
337
  <script>
338
338
  const privateKey = new bsv.PrivateKey();
339
339
  const utxos = new bsv.SmartContract.UTXOGenerator().createRealUTXOs(2, 100000);
@@ -342,9 +342,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
342
342
 
343
343
  ### 🔒 **Smart Contract Development** (~2.8MB total — each bundle re-embeds core BSV)
344
344
  ```html
345
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
346
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-covenant.min.js"></script>
347
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-smartcontract.min.js"></script>
345
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
346
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-covenant.min.js"></script>
347
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-smartcontract.min.js"></script>
348
348
  <script>
349
349
  const covenant = bsv.SmartContract.createCovenantBuilder()
350
350
  .extractField('amount').push(50000).greaterThanOrEqual().verify().build();
@@ -354,9 +354,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
354
354
 
355
355
  ### 🆕 **Legal & Identity Development** (~3.4MB total — each bundle re-embeds core BSV)
356
356
  ```html
357
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
358
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-ltp.min.js"></script>
359
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-gdaf.min.js"></script>
357
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
358
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-ltp.min.js"></script>
359
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-gdaf.min.js"></script>
360
360
  <script>
361
361
  // Legal Token Protocol
362
362
  const propertyToken = bsv.createPropertyToken({
@@ -370,9 +370,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
370
370
 
371
371
  ### 🆕 **Security & Cryptography** (~1.5MB total)
372
372
  ```html
373
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
374
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-security.min.js"></script>
375
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-shamir.min.js"></script>
373
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
374
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-security.min.js"></script>
375
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-shamir.min.js"></script>
376
376
  <script>
377
377
  // Threshold Cryptography
378
378
  const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -384,7 +384,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
384
384
 
385
385
  ### 🎯 **Everything Bundle** (~1.1MB)
386
386
  ```html
387
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.bundle.js"></script>
387
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.bundle.js"></script>
388
388
  <script>
389
389
  // Everything available immediately
390
390
  const shares = bsv.splitSecret('secret', 5, 3); // Shamir Secret Sharing
@@ -494,8 +494,8 @@ const contractTx = covenant.createCovenantTransaction({
494
494
 
495
495
  #### 1. **Minimal Setup** - Core + Script Helper (~1.2MB)
496
496
  ```html
497
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
498
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-script-helper.min.js"></script>
497
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
498
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-script-helper.min.js"></script>
499
499
  <script>
500
500
  const tx = new bsv.Transaction();
501
501
  const sig = bsvScriptHelper.createSignature(tx, privateKey, 0, script, satoshis);
@@ -504,9 +504,9 @@ const contractTx = covenant.createCovenantTransaction({
504
504
 
505
505
  #### 2. **DeFi Development** - Core + Covenants + Debug (~2.8MB — each bundle re-embeds core BSV)
506
506
  ```html
507
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
508
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-covenant.min.js"></script>
509
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-smartcontract.min.js"></script>
507
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
508
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-covenant.min.js"></script>
509
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-smartcontract.min.js"></script>
510
510
  <script>
511
511
  const covenant = new bsvCovenant.CovenantInterface();
512
512
  const debugInfo = SmartContract.interpretScript(script);
@@ -516,8 +516,8 @@ const contractTx = covenant.createCovenantTransaction({
516
516
 
517
517
  #### 3. **Security First** - Core + Enhanced Security (~1.2MB)
518
518
  ```html
519
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.min.js"></script>
520
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv-security.min.js"></script>
519
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
520
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-security.min.js"></script>
521
521
  <script>
522
522
  const verified = bsvSecurity.SmartVerify.verify(signature, hash, publicKey);
523
523
  const enhanced = bsvSecurity.EllipticFixed.createSignature(privateKey, hash);
@@ -526,7 +526,7 @@ const contractTx = covenant.createCovenantTransaction({
526
526
 
527
527
  #### 4. **Everything Bundle** - One File Solution (~1.1MB)
528
528
  ```html
529
- <script src="https://unpkg.com/@smartledger/bsv@7.1.0/bsv.bundle.js"></script>
529
+ <script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.bundle.js"></script>
530
530
  <script>
531
531
  // Everything available under bsv namespace
532
532
  const keys = bsv.SmartLedgerBundle.generateKeys();
@@ -834,7 +834,7 @@ const timelockScript = helper.createTimelockScript(
834
834
 
835
835
  See the **[16 Loading Options](#-16-loading-options---choose-your-approach)**
836
836
  table near the top for the full list of bundles with current sizes and
837
- canonical `unpkg.com/@smartledger/bsv@7.1.0/...` URLs.
837
+ canonical `unpkg.com/@smartledger/bsv@7.2.0/...` URLs.
838
838
 
839
839
  ## 🔐 Security
840
840