@smartledger/bsv 7.2.0 → 7.3.0

package/docs/MODULE_REFERENCE_COMPLETE.md

@@ -55,19 +55,19 @@ Three advanced modules totaling **~2.7MB** of functionality:
 - **Purpose**: Threshold cryptography for secure secret distribution
 - **Use Cases**: Backup keys, multi-party security, key recovery
 - **Features**: Split secrets into N shares, require M to reconstruct
-- **CDN**: `unpkg.com/@smartledger/bsv@7.2.0/bsv-shamir.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@7.3.0/bsv-shamir.min.js`
 
 #### **🌐 Global Digital Attestation Framework - GDAF (1184KB)**  
 - **Purpose**: W3C Verifiable Credentials and decentralized identity
 - **Use Cases**: Identity verification, attestations, zero-knowledge proofs
 - **Features**: DID creation, credential issuance, selective disclosure
-- **CDN**: `unpkg.com/@smartledger/bsv@7.2.0/bsv-gdaf.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@7.3.0/bsv-gdaf.min.js`
 
 #### **⚖️ Legal Token Protocol - LTP (1184KB)**
 - **Purpose**: Legal compliance framework for tokenized assets
 - **Use Cases**: Property rights, obligations, compliant tokenization  
 - **Features**: Legal primitives, compliance checking, attestation anchoring
-- **CDN**: `unpkg.com/@smartledger/bsv@7.2.0/bsv-ltp.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@7.3.0/bsv-ltp.min.js`
 
 ### **2. Incorrect File Sizes in Documentation**
 
@@ -81,18 +81,18 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 | Module | Size | Use Case | CDN Link |
 |--------|------|----------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.2.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@7.2.0/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.2.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.2.0/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.2.0/bsv-security.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.2.0/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.2.0/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.2.0/bsv-mnemonic.min.js` |
-| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@7.2.0/bsv-shamir.min.js` |
-| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@7.2.0/bsv-gdaf.min.js` |
-| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@7.2.0/bsv-ltp.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.3.0/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.3.0/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@7.3.0/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.3.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.3.0/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.3.0/bsv-security.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.3.0/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.3.0/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.3.0/bsv-mnemonic.min.js` |
+| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@7.3.0/bsv-shamir.min.js` |
+| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@7.3.0/bsv-gdaf.min.js` |
+| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@7.3.0/bsv-ltp.min.js` |
 
 ## 🎯 **Updated Usage Examples**
 
@@ -100,22 +100,22 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **1. Basic Development (~963KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-script-helper.min.js"></script>
 ```
 
 #### **2. Smart Contract Development (~2.7MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-smartcontract.min.js"></script>
 ```
 
 #### **3. 🆕 Legal & Compliance Development (~3.2MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const legalToken = bsv.createLegalToken({
@@ -132,9 +132,9 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **4. 🆕 Security & Cryptography (~1.4MB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-shamir.min.js"></script>
 <script>
   // Shamir Secret Sharing
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -146,7 +146,7 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **5. Everything Bundle (937KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);

package/docs/advanced/UTXO_MANAGER_GUIDE.md

@@ -722,7 +722,7 @@ interface UTXO {
 <html>
 <head>
     <title>UTXO Manager Demo</title>
-    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@7.2.0/bsv.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@7.3.0/bsv.min.js"></script>
 </head>
 <body>
     <script>

package/docs/getting-started/INSTALLATION.md

@@ -48,7 +48,7 @@ const tx: Transaction = new Transaction();
 #### **Core Library Only (937KB)**
 For basic Bitcoin SV operations:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const address = privateKey.toAddress();
@@ -58,7 +58,7 @@ For basic Bitcoin SV operations:
 #### **Complete Bundle (937KB)**  
 Everything in one file:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.bundle.js"></script>
 <script>
   // All features available immediately
   const shares = bsv.splitSecret('secret', 5, 3);
@@ -71,9 +71,9 @@ Everything in one file:
 
 #### **Smart Contract Development (~2.7MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().build();
@@ -82,9 +82,9 @@ Everything in one file:
 
 #### **Legal & Identity Development (~3.2MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -98,9 +98,9 @@ Everything in one file:
 
 #### **Security & Cryptography (~1.4MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3);
@@ -114,18 +114,18 @@ Everything in one file:
 
 | Module | Size | Purpose | CDN Link |
 |--------|------|---------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.2.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.2.0/bsv-smartcontract.min.js` |
-| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@7.2.0/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@7.2.0/bsv-gdaf.min.js` |
-| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@7.2.0/bsv-shamir.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.2.0/bsv-security.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.2.0/bsv-mnemonic.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.2.0/bsv-ecies.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.2.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.2.0/bsv-script-helper.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.2.0/bsv-message.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.3.0/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.3.0/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.3.0/bsv-smartcontract.min.js` |
+| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@7.3.0/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@7.3.0/bsv-gdaf.min.js` |
+| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@7.3.0/bsv-shamir.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.3.0/bsv-security.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.3.0/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.3.0/bsv-ecies.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.3.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.3.0/bsv-script-helper.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.3.0/bsv-message.min.js` |
 
 ## ⚙️ **Development Environment Setup**
 

package/docs/getting-started/QUICK_START.md

@@ -14,10 +14,10 @@ npm install @smartledger/bsv
 ### Browser CDN (Instant)
 ```html
 <!-- Core library (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.min.js"></script>
 
 <!-- Everything included (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.bundle.js"></script>
 ```
 
 ## 💰 **Your First Transaction (60 seconds)**
@@ -127,19 +127,19 @@ SmartLedger-BSV offers 12 different loading options - use only what you need:
 
 ```html
 <!-- Core BSV only (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.min.js"></script>
 
 <!-- Smart contracts (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-smartcontract.min.js"></script>
 
 <!-- Legal tokens (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-ltp.min.js"></script>
 
 <!-- Digital identity (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-gdaf.min.js"></script>
 
 <!-- Everything (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.bundle.js"></script>
 ```
 
 ## ⚡ **Key Advantages**

package/docs/migration/FROM_BSV_1_5_6.md

@@ -159,17 +159,17 @@ const recovered = bsv.reconstructSecret([shares[0], shares[2], shares[4]]);
 ### **New Modular Options** 
 ```html
 <!-- Core compatibility (same size as bsv@1.5.6) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.min.js"></script>
 
 <!-- Add smart contracts when ready -->
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-smartcontract.min.js"></script>
 
 <!-- Add advanced features as needed -->
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv-gdaf.min.js"></script>
 
 <!-- Everything in one file -->
-<script src="https://unpkg.com/@smartledger/bsv@7.2.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.3.0/bsv.bundle.js"></script>
 ```
 
 ## 🔍 **Testing Your Migration**

package/lib/ordinals/README.md

@@ -113,6 +113,22 @@ var terms = Ord.parseOrdLock(script)
 // }
 ```
 
+**`parseOrdLock` verifies, it does not pattern-match.** The terms are recovered from the
+script's shape and then checked by reconstruction: the listing is rebuilt from the recovered
+seller / payments / inscription and must match the input byte-for-byte. A script that merely
+wears the same arrangement of opcodes — without the `OP_PUSH_TX` covenant that actually binds
+the payment into `hashOutputs` — is rejected. So a non-null result means the purchase branch
+really does enforce payment, and a UI can display the price without inventing a listing that
+does not exist.
+
+> **Interoperability.** This is *this library's* OrdLock. Semantically it is the widely
+> deployed ordinal-lock pattern — `hash256(destOutput ‖ payOutput ‖ trailingOutputs) ==
+> hashOutputs` under `SIGHASH_ALL|ANYONECANPAY` — generalized to multiple payment outputs.
+> But it is built on our audited `OP_PUSH_TX` core rather than compiled from the sCrypt
+> `OrdinalLock` contract, so **the script bytes differ and listings are not interchangeable
+> with that template**: `parseOrdLock` reads listings this library built, not arbitrary
+> marketplace listings.
+
 ### Buy (purchase side)
 
 ```js
@@ -171,9 +187,26 @@ B.parseBsv20(script)                  // { p:'bsv-20', op:'mint', tick:'ORDI', a
 B.parseBsv20('{"p":"bsv-20","op":"mint","tick":"ORDI","amt":"1"}')  // also accepts JSON / objects
 ```
 
-Builders validate their inputs (ticker ≤ 4 bytes, non-negative integer amounts, `dec` 0–18,
-well-formed BSV-21 `id`) and throw on bad data. Balance tracking is an indexer concern —
-this module builds and reads the on-chain payloads.
+Builders validate their inputs against the specification and throw on bad data: ticker ≤ 4
+bytes, `dec` 0–18, well-formed BSV-21 `id`, and amounts that are non-negative integers
+**within uint64** (`amt`/`max`/`lim` are "strings representing uint64" — a larger value is
+valid JSON that indexers discard, burning the tokens). A numeric amount past
+`Number.MAX_SAFE_INTEGER` is rejected rather than silently rounded; pass a string. `sym` and
+`icon` must be strings — `icon` an outpoint reference (`<txid>_<vout>`), as the spec defines
+it — so a stray object can no longer be written as the literal text `[object Object]`.
+
+`lim: 0` is accepted and means *unlimited*, per the spec ("0 or omitted = unlimited"); only
+`max`/`amt` must be greater than zero.
+
+**`parseBsv20` / `isBsv20` enforce validity rather than assuming it.** The operation must be
+one the spec defines and must carry the fields that operation requires — a `transfer` with no
+amount and no token, an `auth` carrying `amt` (which the spec forbids), an over-uint64 amount,
+or an unknown `op` all return `null`. Operations this library does not yet *build* are still
+*read*: `burn`, `auth`, and `deploy+auth` parse correctly. Non-canonical amounts (leading
+zeros) are tolerated when reading other people's payloads, though our builders always emit
+canonical ones.
+
+Balance tracking is an indexer concern — this module builds and reads the on-chain payloads.
 
 ## API
 
@@ -182,7 +215,7 @@ this module builds and reads the on-chain payloads.
 | `buildInscription`, `createInscriptionOutput`, `batchInscriptionOutputs` | build inscription scripts / outputs |
 | `parseInscription`, `isInscription` | read an inscription back |
 | `buildOrdLock`, `listInscriptionOutput` | build an OrdLock listing script / 1-sat output |
-| `parseOrdLock`, `isOrdLock` | recover a listing's seller, payments, price, inscription |
+| `parseOrdLock`, `isOrdLock` | recover a listing's seller, payments, price, inscription — **verified**, see below |
 | `buildListingTx` | assemble a signed listing tx (P2PKH ordinal → OrdLock) |
 | `buildPurchaseTx` | assemble a signed purchase tx from a listing UTXO + buyer coins |
 | `purchaseOrdLock`, `cancelOrdLock` | build unlock scripts for a spend you assemble |

package/lib/ordinals/bsv20.js

@@ -21,19 +21,41 @@ var inscription = require('./inscription')
 var CONTENT_TYPE = 'application/bsv-20'
 var MAX_DEC = 18
 
+// "Amounts in BSV-21: strings representing uint64" — amt/max/lim are bounded by 2^64-1.
+// A larger value is emitted happily by JSON but rejected by indexers, burning the tokens.
+var MAX_UINT64 = '18446744073709551615'
+
 /** A non-negative integer string (no sign, no decimal point). */
 function isIntString (v) { return typeof v === 'string' && /^\d+$/.test(v) }
 
+/** True if the CANONICAL decimal string `s` is greater than 2^64-1. */
+function exceedsUint64 (s) {
+  return s.length > MAX_UINT64.length || (s.length === MAX_UINT64.length && s > MAX_UINT64)
+}
+
 /** Normalize an amount-like field to a CANONICAL non-negative integer string (no leading zeros). */
 function normInt (v, name) {
+  var s
   if (typeof v === 'number') {
     if (!Number.isInteger(v) || v < 0) throw new Error(name + ' must be a non-negative integer')
-    return String(v)
+    // Beyond 2^53 a JS number is already an approximation, so String(v) would silently
+    // emit a *different* amount than the caller believes they passed.
+    if (v > Number.MAX_SAFE_INTEGER) {
+      throw new Error(name + ' exceeds Number.MAX_SAFE_INTEGER and would lose precision — ' +
+        'pass it as a string')
+    }
+    s = String(v)
+  } else if (isIntString(v)) {
+    // Strip leading zeros ("007" -> "7", "000" -> "0") so the emitted payload is canonical
+    // and not rejected by indexers that expect canonical decimal integers.
+    s = v.replace(/^0+(?=\d)/, '')
+  } else {
+    throw new Error(name + ' must be a non-negative integer (string or number)')
+  }
+  if (exceedsUint64(s)) {
+    throw new Error(name + ' exceeds the uint64 maximum (' + MAX_UINT64 + ')')
   }
-  // Strip leading zeros ("007" -> "7", "000" -> "0") so the emitted payload is canonical
-  // and not rejected by indexers that expect canonical decimal integers.
-  if (isIntString(v)) return v.replace(/^0+(?=\d)/, '')
-  throw new Error(name + ' must be a non-negative integer (string or number)')
+  return s
 }
 
 /** Normalize a strictly-positive amount (mint/transfer/supply must move > 0). */
@@ -57,14 +79,39 @@ function normDec (dec) {
   return String(d)
 }
 
+var OUTPOINT_RE = /^[0-9a-fA-F]{64}_\d+$/
+
 /** Validate a BSV-21 token id: `<64-hex-txid>_<vout>`. */
 function assertId (id) {
-  if (typeof id !== 'string' || !/^[0-9a-fA-F]{64}_\d+$/.test(id)) {
+  if (typeof id !== 'string' || !OUTPOINT_RE.test(id)) {
     throw new Error('id must be "<txid>_<vout>" (64-hex txid, underscore, output index)')
   }
   return id
 }
 
+/**
+ * Validate a free-text field (`sym`). Rejects non-strings rather than running them through
+ * `String()`, which wrote the literal text `[object Object]` into a permanent payload.
+ */
+function assertText (v, name) {
+  if (typeof v !== 'string') {
+    var t = v === null ? 'null' : Array.isArray(v) ? 'an array' : (typeof v === 'object' ? 'an ' : 'a ') + typeof v
+    throw new Error(name + ' must be a string, got ' + t)
+  }
+  if (!v.length) throw new Error(name + ' must not be empty')
+  return v
+}
+
+/** Validate `icon`, which the spec defines as an outpoint reference (`<txid>_<vout>`). */
+function assertIcon (v) {
+  assertText(v, 'icon')
+  if (!OUTPOINT_RE.test(v)) {
+    throw new Error('icon must be an outpoint reference "<txid>_<vout>" (64-hex txid, ' +
+      'underscore, output index)')
+  }
+  return v
+}
+
 /** Wrap a BSV-20 JSON payload in an inscription locking script (P2PKH owner by default). */
 function buildBsv20 (payload, params) {
   params = params || {}
@@ -84,7 +131,9 @@ function buildBsv20 (payload, params) {
 function buildDeploy (params) {
   params = params || {}
   var p = { p: 'bsv-20', op: 'deploy', tick: assertTick(params.tick), max: normPositive(params.max, 'max') }
-  if (params.lim != null) p.lim = normPositive(params.lim, 'lim')
+  // `lim` is "0 or omitted = unlimited" per the spec, so 0 is a meaningful value here and
+  // must not be rejected the way a zero `max`/`amt` is.
+  if (params.lim != null) p.lim = normInt(params.lim, 'lim')
   if (params.dec != null) p.dec = normDec(params.dec)
   return buildBsv20(p, params)
 }
@@ -122,8 +171,8 @@ function buildDeployMint (params) {
   params = params || {}
   var p = { p: 'bsv-20', op: 'deploy+mint', amt: normPositive(params.amt, 'amt') }
   if (params.dec != null) p.dec = normDec(params.dec)
-  if (params.sym != null) p.sym = String(params.sym)
-  if (params.icon != null) p.icon = String(params.icon)
+  if (params.sym != null) p.sym = assertText(params.sym, 'sym')
+  if (params.icon != null) p.icon = assertIcon(params.icon)
   return buildBsv20(p, params)
 }
 
@@ -149,10 +198,69 @@ function bodyOf (input) {
   return insc ? insc.contentText : null
 }
 
+/**
+ * Required-field rules per operation, from the BSV-20 / BSV-21 specification.
+ *
+ * `tickOrId` means the operation must carry exactly one of `tick` (v1) or `id` (v2/BSV-21).
+ * `noAmt` marks the operations the spec says must NOT carry an `amt` at all.
+ */
+var OP_RULES = {
+  deploy: { need: ['tick', 'max'] },
+  mint: { need: ['amt'], tickOrId: true },
+  transfer: { need: ['amt'], tickOrId: true },
+  'deploy+mint': { need: ['amt'] },
+  'deploy+auth': { need: [], noAmt: true },
+  auth: { need: ['id'], noAmt: true },
+  burn: { need: ['id', 'amt'] }
+}
+
+/**
+ * Is `v` a uint64 amount as it may appear ON CHAIN? Leading zeros are tolerated here even
+ * though the builder emits canonical values: this reads other people's payloads, and a
+ * non-canonical amount is still an amount.
+ */
+function isParsedAmount (v) {
+  var s = typeof v === 'number' ? (Number.isInteger(v) && v >= 0 ? String(v) : null) : (isIntString(v) ? v : null)
+  if (s == null) return false
+  return !exceedsUint64(s.replace(/^0+(?=\d)/, ''))
+}
+
+/** Validate a parsed payload against the spec's per-operation field rules. */
+function isValidPayload (obj) {
+  if (!obj || obj.p !== 'bsv-20' || typeof obj.op !== 'string') return false
+  var rule = OP_RULES[obj.op]
+  if (!rule) return false // unknown operation: we cannot vouch for it
+  for (var i = 0; i < rule.need.length; i++) {
+    if (obj[rule.need[i]] == null) return false
+  }
+  if (rule.tickOrId && (obj.tick == null) === (obj.id == null)) return false
+  if (rule.noAmt && obj.amt != null) return false
+  if (obj.tick != null) {
+    if (typeof obj.tick !== 'string' || !obj.tick.length || Buffer.byteLength(obj.tick, 'utf8') > 4) return false
+  }
+  if (obj.id != null && (typeof obj.id !== 'string' || !OUTPOINT_RE.test(obj.id))) return false
+  var amounts = ['amt', 'max', 'lim']
+  for (var j = 0; j < amounts.length; j++) {
+    if (obj[amounts[j]] != null && !isParsedAmount(obj[amounts[j]])) return false
+  }
+  if (obj.dec != null) {
+    var d = typeof obj.dec === 'string' ? Number(obj.dec) : obj.dec
+    if (!Number.isInteger(d) || d < 0 || d > MAX_DEC) return false
+  }
+  return true
+}
+
 /**
  * Parse a BSV-20 payload from a locking script (Script/Buffer/hex), a JSON string, or an
  * already-parsed object. Returns the payload object (with `p:'bsv-20'`) or null if the
  * input carries no valid BSV-20 inscription.
+ *
+ * "Valid" is enforced, not assumed: the operation must be one the spec defines and must
+ * carry the fields that operation requires, with `tick`/`id`/amount/`dec` well-formed.
+ * A payload this returns is one an indexer will act on; previously any JSON object with
+ * `p: 'bsv-20'` and a string `op` was returned, including `{p:'bsv-20', op:'transfer'}`
+ * with no amount and no token — which an indexer discards.
+ *
  * @returns {null|{ p:'bsv-20', op:string, tick?:string, id?:string, amt?:string, max?:string, lim?:string, dec?:string, sym?:string, icon?:string }}
  */
 function parseBsv20 (input) {
@@ -160,14 +268,13 @@ function parseBsv20 (input) {
     var body = bodyOf(input)
     if (body == null) return null
     var obj = (typeof body === 'object') ? body : JSON.parse(body)
-    if (!obj || obj.p !== 'bsv-20' || typeof obj.op !== 'string') return null
-    return obj
+    return isValidPayload(obj) ? obj : null
   } catch (e) {
     return null
   }
 }
 
-/** True if the input carries a valid BSV-20 inscription. */
+/** True if the input carries a valid BSV-20 inscription (see parseBsv20 for what that means). */
 function isBsv20 (input) { return parseBsv20(input) !== null }
 
 module.exports = {

package/lib/ordinals/ordlock.js

@@ -205,7 +205,19 @@ function splitPayBlob (blob) {
 
 /**
  * Parse an OrdLock listing script into its economic terms. Returns null if `script`
- * is not a recognizable OrdLock (so it doubles as a detector).
+ * is not an OrdLock (so it doubles as a detector).
+ *
+ * The terms are recovered from the script's shape and then **verified by reconstruction**:
+ * the listing is rebuilt from the recovered seller / payment outputs / inscription and must
+ * match the input byte-for-byte. A script that merely wears the same arrangement of opcodes
+ * — without the OP_PUSH_TX covenant that actually binds the payment into `hashOutputs` —
+ * is rejected, so a non-null result means the purchase branch genuinely enforces payment.
+ *
+ * Note this is *this library's* OrdLock. It is semantically the widely-deployed
+ * ordinal-lock pattern (`hash256(destOutput ‖ payOutput ‖ trailingOutputs) == hashOutputs`
+ * under SIGHASH_ALL|ANYONECANPAY), generalized to multiple payment outputs, but it is built
+ * on our OP_PUSH_TX core rather than compiled from the sCrypt contract — so the bytes differ
+ * and listings are not interchangeable with that template.
  *
  * @param {Script|Buffer|string} script
  * @param {object} [opts]  { network }  network for the returned address strings
@@ -269,6 +281,20 @@ function parseOrdLock (script, opts) {
       insc = { contentType: parsedInsc.contentType, content: parsedInsc.content, contentText: parsedInsc.contentText }
     }
 
+    // Everything above recovers terms from the script's SHAPE. Shape alone proves nothing:
+    // a script carrying this arrangement of opcodes but no OP_PUSH_TX covenant enforces no
+    // payment at all, and reporting a seller and a price for it invents a listing that does
+    // not exist. So rebuild the listing from the recovered terms and require it to match
+    // byte-for-byte — the only way to know the purchase branch really binds the payment.
+    var rebuilt = buildOrdLock({
+      seller: sellerPKH,
+      payOutputs: splitPayBlob(payBlob),
+      inscription: parsedInsc
+        ? { contentType: parsedInsc.contentType, content: parsedInsc.content }
+        : undefined
+    })
+    if (rebuilt.toHex() !== s.toHex()) return null
+
     return {
       seller: { pubKeyHash: sellerPKH, address: bsv.Address.fromPublicKeyHash(sellerPKH, network).toString() },
       payOutputs: payOutputs,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "7.2.0",
+  "version": "7.3.0",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",