@smartledger/bsv 6.1.2 → 6.2.1

package/build/esbuild/empty.js

@@ -0,0 +1,2 @@
+'use strict'
+module.exports = {}

package/build/esbuild/globals.js

@@ -0,0 +1,6 @@
+// esbuild inject shim: provide the Node `Buffer` and `process` globals in browser
+// bundles (webpack did this via ProvidePlugin). esbuild replaces unbound references
+// to `Buffer` / `process` with these imports.
+import process from 'process/browser'
+export { Buffer } from 'buffer'
+export { process }

package/build/esbuild.js

@@ -0,0 +1,129 @@
+'use strict'
+// esbuild build for the browser bundles (webpack -> esbuild migration). Replaces the 16
+// webpack configs + webpack.base.js with one config-driven builder. Two polyfill modes
+// mirror webpack.base.js: `full` = bundlePolyfills (browserify shims for Node built-ins,
+// so Shamir/secrets.js gets a CSPRNG in the browser); `stub` = externStubs (built-ins
+// stubbed to empty; bsv is loaded separately). Feature bundles externalise the bsv root
+// to the global `bsv`. Every bundle is UMD (browser global + require()/AMD).
+//
+// esbuild gotcha: its `alias` prefix-matches (mis-resolving subpaths like process/browser),
+// so resolution is done with precise onResolve plugins instead.
+const path = require('path')
+const esbuild = require('esbuild')
+const R = (p) => require.resolve(p)
+const ROOT = path.resolve(__dirname, '..')
+const BSV_INDEX = path.join(ROOT, 'index.js')
+const EMPTY = path.join(__dirname, 'esbuild/empty.js')
+
+const BUILTIN = /^(crypto|stream|assert|util|zlib|vm|buffer|path|http|https|os|url|fs|net|tls|readline|child_process)$/
+
+// full (bundlePolyfills): real browserify shims; unused server-only built-ins -> empty.
+const FULL_SHIM = {
+  crypto: R('crypto-browserify'),
+  stream: R('stream-browserify'),
+  assert: R('assert/'),
+  util: R('util/'),
+  zlib: R('browserify-zlib'),
+  vm: R('vm-browserify'),
+  buffer: R('buffer/'),
+  path: R('path-browserify')
+}
+// stub (externStubs): everything empty except buffer/process (still needed as globals).
+const STUB_SHIM = { buffer: R('buffer/') }
+
+function polyfillPlugin (mode) {
+  return {
+    name: 'node-polyfills-' + mode,
+    setup (build) {
+      const shim = mode === 'stub' ? STUB_SHIM : FULL_SHIM
+      build.onResolve({ filter: BUILTIN }, (a) => ({ path: shim[a.path] || EMPTY }))
+      build.onResolve({ filter: /^process(\/browser)?$/ }, () => ({ path: R('process/browser') }))
+      // keep `elliptic` out of the bundle (webpack aliased browserify-sign / create-ecdh -> false)
+      build.onResolve({ filter: /^(browserify-sign|create-ecdh)(\/|$)/ }, () => ({ path: EMPTY }))
+    }
+  }
+}
+
+// Externalise the bsv root (require('../..') / require('../index.js') / etc.) to the global
+// `bsv` — the webpack `externals: { … : 'bsv' }` behaviour for feature bundles.
+function externalBsvPlugin () {
+  return {
+    name: 'external-bsv',
+    setup (build) {
+      build.onResolve({ filter: /^\.\.?[\\/]/ }, (a) => {
+        const resolved = path.resolve(a.resolveDir, a.path)
+        if (resolved === BSV_INDEX || resolved === ROOT) return { path: a.path, namespace: 'bsv-global' }
+      })
+      build.onLoad({ filter: /.*/, namespace: 'bsv-global' }, () => ({
+        contents: 'module.exports=(typeof globalThis!=="undefined"?globalThis:(typeof self!=="undefined"?self:window)).bsv',
+        loader: 'js'
+      }))
+    }
+  }
+}
+
+function umdFooter (globalName) {
+  return 'if(typeof module!=="undefined"&&module.exports){module.exports=' + globalName +
+    '}else if(typeof define==="function"&&define.amd){define([],function(){return ' + globalName + '})}'
+}
+
+// The 16 published browser bundles (mirrors package.json build-* scripts).
+const BUNDLES = [
+  { file: 'bsv.min.js', entry: 'index.js', global: 'bsv', mode: 'full', externalBsv: false },
+  { file: 'bsv.bundle.js', entry: 'bundle-entry.js', global: 'bsv', mode: 'full', externalBsv: false },
+  { file: 'bsv-ecies.min.js', entry: 'ecies/index.js', global: 'bsvEcies', mode: 'full', externalBsv: true },
+  { file: 'bsv-message.min.js', entry: 'message/index.js', global: 'bsvMessage', mode: 'full', externalBsv: true },
+  { file: 'bsv-mnemonic.min.js', entry: 'mnemonic/index.js', global: 'bsvMnemonic', mode: 'full', externalBsv: true },
+  { file: 'bsv-shamir.min.js', entry: 'shamir-entry.js', global: 'bsvShamir', mode: 'full', externalBsv: true },
+  { file: 'bsv-smartcontract.min.js', entry: 'smartcontract-entry.js', global: 'bsvSmartContract', mode: 'stub', externalBsv: true },
+  { file: 'bsv-covenant.min.js', entry: 'covenant-entry.js', global: 'bsvCovenant', mode: 'stub', externalBsv: true },
+  { file: 'bsv-script-helper.min.js', entry: 'script-helper-entry.js', global: 'bsvScriptHelper', mode: 'stub', externalBsv: true },
+  { file: 'bsv-security.min.js', entry: 'security-entry.js', global: 'bsvSecurity', mode: 'full', externalBsv: false },
+  { file: 'bsv-ltp.min.js', entry: 'ltp-entry.js', global: 'bsvLTP', mode: 'full', externalBsv: false },
+  { file: 'bsv-gdaf.min.js', entry: 'gdaf-entry.js', global: 'bsvGDAF', mode: 'full', externalBsv: false },
+  { file: 'bsv-didweb.min.js', entry: 'didweb-entry.js', global: 'bsvDIDWeb', mode: 'full', externalBsv: false },
+  { file: 'bsv-vcjwt.min.js', entry: 'vcjwt-entry.js', global: 'bsvVcJwt', mode: 'full', externalBsv: false },
+  { file: 'bsv-statuslist.min.js', entry: 'statuslist-entry.js', global: 'bsvStatusList', mode: 'full', externalBsv: false },
+  { file: 'bsv-anchor.min.js', entry: 'anchor-entry.js', global: 'bsvAnchor', mode: 'full', externalBsv: false }
+]
+
+// Build one bundle. Pass { write: false } to get the output in memory (for tests).
+function buildOne (cfg, opts) {
+  opts = opts || {}
+  const plugins = [polyfillPlugin(cfg.mode)]
+  if (cfg.externalBsv) plugins.push(externalBsvPlugin())
+  return esbuild.build({
+    entryPoints: [path.join(ROOT, cfg.entry)],
+    bundle: true,
+    format: 'iife',
+    globalName: cfg.global,
+    platform: 'browser',
+    target: ['es2020'], // bsv + @noble/curves use BigInt
+    minify: true,
+    legalComments: 'none',
+    plugins,
+    inject: [path.join(__dirname, 'esbuild/globals.js')],
+    define: { global: 'globalThis' },
+    footer: { js: umdFooter(cfg.global) },
+    write: opts.write !== false,
+    outfile: opts.write === false ? undefined : path.join(ROOT, cfg.file),
+    logLevel: opts.logLevel || 'warning'
+  })
+}
+
+// The full library bundle (bsv.min.js) — kept for the build-integrity test.
+function buildFullBundle (opts) {
+  return buildOne(BUNDLES[0], opts)
+}
+
+function buildAll () {
+  return Promise.all(BUNDLES.map(function (c) { return buildOne(c) }))
+}
+
+module.exports = { buildFullBundle, buildAll, buildOne, BUNDLES }
+
+if (require.main === module) {
+  buildAll().then(function () {
+    console.log('esbuild: built ' + BUNDLES.length + ' bundles')
+  }).catch(function (e) { console.error(e.message || e); process.exit(1) })
+}

package/docs/MODULE_REFERENCE_COMPLETE.md

@@ -55,19 +55,19 @@ Three advanced modules totaling **~2.7MB** of functionality:
 - **Purpose**: Threshold cryptography for secure secret distribution
 - **Use Cases**: Backup keys, multi-party security, key recovery
 - **Features**: Split secrets into N shares, require M to reconstruct
-- **CDN**: `unpkg.com/@smartledger/bsv@6.1.2/bsv-shamir.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@6.2.1/bsv-shamir.min.js`
 
 #### **🌐 Global Digital Attestation Framework - GDAF (1184KB)**  
 - **Purpose**: W3C Verifiable Credentials and decentralized identity
 - **Use Cases**: Identity verification, attestations, zero-knowledge proofs
 - **Features**: DID creation, credential issuance, selective disclosure
-- **CDN**: `unpkg.com/@smartledger/bsv@6.1.2/bsv-gdaf.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@6.2.1/bsv-gdaf.min.js`
 
 #### **⚖️ Legal Token Protocol - LTP (1184KB)**
 - **Purpose**: Legal compliance framework for tokenized assets
 - **Use Cases**: Property rights, obligations, compliant tokenization  
 - **Features**: Legal primitives, compliance checking, attestation anchoring
-- **CDN**: `unpkg.com/@smartledger/bsv@6.1.2/bsv-ltp.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@6.2.1/bsv-ltp.min.js`
 
 ### **2. Incorrect File Sizes in Documentation**
 
@@ -81,18 +81,18 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 | Module | Size | Use Case | CDN Link |
 |--------|------|----------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@6.1.2/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@6.1.2/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@6.1.2/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@6.1.2/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@6.1.2/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@6.1.2/bsv-security.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@6.1.2/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@6.1.2/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@6.1.2/bsv-mnemonic.min.js` |
-| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@6.1.2/bsv-shamir.min.js` |
-| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@6.1.2/bsv-gdaf.min.js` |
-| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@6.1.2/bsv-ltp.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@6.2.1/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@6.2.1/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@6.2.1/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@6.2.1/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@6.2.1/bsv-security.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@6.2.1/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@6.2.1/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@6.2.1/bsv-mnemonic.min.js` |
+| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@6.2.1/bsv-shamir.min.js` |
+| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@6.2.1/bsv-gdaf.min.js` |
+| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@6.2.1/bsv-ltp.min.js` |
 
 ## 🎯 **Updated Usage Examples**
 
@@ -100,22 +100,22 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **1. Basic Development (~963KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-script-helper.min.js"></script>
 ```
 
 #### **2. Smart Contract Development (~2.7MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-smartcontract.min.js"></script>
 ```
 
 #### **3. 🆕 Legal & Compliance Development (~3.2MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const legalToken = bsv.createLegalToken({
@@ -132,9 +132,9 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **4. 🆕 Security & Cryptography (~1.4MB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-shamir.min.js"></script>
 <script>
   // Shamir Secret Sharing
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -146,7 +146,7 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **5. Everything Bundle (937KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);

package/docs/THREAT_MODEL.md

@@ -0,0 +1,127 @@
+# Threat model — `@smartledger/bsv`
+
+This document states, property by property, **what the library guarantees, under what
+assumptions, and which adversarial test proves each guarantee.** It is deliberately
+honest about what is *not* guaranteed. Every ``test/…`` path referenced here is checked
+to exist by `test/security/threat_model_coverage.js`, so this document cannot drift from
+the suite (the same "docs are tested claims" principle behind the type-drift gate).
+
+The guiding principle, learned the hard way (see `SECURITY.md` → 6.0.0): **verification
+fails closed by construction** — a verify function returns a strict boolean or throws,
+never a truthy object that can be mistaken for success — and **every security property
+ships an adversarial test that asserts the *bad* input is rejected.**
+
+## 1. Assets and trust boundaries
+
+| Asset | Boundary | What must not happen |
+| --- | --- | --- |
+| Private keys / entropy | key-gen, HD derivation, CSPRNG | weak/predictable keys; entropy from `Math.random` |
+| ECDSA signatures | `verify` / `verifyBool` | a forged signature verifying as valid (fail-open) |
+| On-chain covenants | the Script interpreter | spending a covenant UTXO in a way the covenant forbids |
+| Ordinal listings | the OrdLock covenant | taking the ordinal without paying the seller/royalty/fee |
+| Credentials / DIDs | JWS verify + issuer binding | forged/tampered/attacker-issuer credentials accepted |
+| Revocation status | StatusList2021 verify | a revoked credential reading as valid (bypass) |
+| SPV inclusion | Merkle branch + header PoW | a transaction "proven" included when it is not |
+
+The trust boundary is the **verify / enforce** call. Inputs on the far side are treated
+as adversarial. Callers on the near side are trusted (a malicious local process, patched
+Node, or hostile browser extension is out of scope — see `SECURITY.md`).
+
+## 2. Security properties and the tests that enforce them
+
+### 2.1 Signature verification fails closed
+
+- Static `crypto.ECDSA.verify` and `SmartVerify.smartVerify` return a **strict boolean**
+  and **reject a forged signature** (wrong key); `ECDSA.prototype.verifyBool()` is the
+  safe boolean path. The instance `verify()` returns the instance (documented trap) — its
+  contract is pinned so a regression to fail-open trips a red test.
+  → `test/security/fail_closed_contracts.js`
+- The hardened curve produces **low-S canonical** signatures, keeps `recoveryParam`
+  consistent, **rejects zero / out-of-range `r`,`s`**, and **returns `false` (never
+  throws) on malformed signatures**.
+  → `test/crypto/elliptic-fixed.js`
+
+### 2.2 Covenants enforce their spend rule
+
+- The OP_PUSH_TX core, Token state-machine, and value covenants are **interpreter-verified**:
+  a spend that violates the covenant is rejected by the consensus interpreter.
+  → `test/smart_contract/covenants.js`, `test/smart_contract/token_generalized.js`,
+  `test/smart_contract/ordinal_transfer.js`
+- **Ordinal marketplace (OrdLock):** the ordinal cannot be taken without recreating the
+  required payment(s) byte-for-byte — underpaying the seller, redirecting a royalty/fee, or
+  cancelling with the wrong key are all rejected; tampering any output after signing breaks
+  the covenant.
+  → `test/ordinals/ordlock.js`
+
+### 2.3 Credential / token verification fails closed (C1–C4)
+
+- A **tampered JWS** signature is rejected; a token **re-signed by an attacker but attributed
+  to the victim issuer** is rejected (issuer-key binding, C4); `verifyOwnership` **rejects a
+  signature by the wrong key** (C2); `verifyAnchor` **refuses to fabricate success** without a
+  real chain proof (C3); `prepareRightTokenTransfer` **rejects a non-owner** transfer.
+  → `test/ltp/verify_failclosed.js`
+
+### 2.4 Revocation cannot be bypassed
+
+- A status list whose **bitstring was tampered without re-signing** is rejected; reading
+  **refuses without a pinned `expectedIssuerDid`**; a list **signed by a different (attacker)
+  issuer** under the victim DID is rejected.
+  → `test/statuslist/failclosed.js`
+
+### 2.5 SPV inclusion cannot be forged
+
+- `verifyMerkleProof` recomputes the root for every leaf (cross-checked against
+  `Block.getMerkleTree`), **rejects a tampered branch node** and the **right proof against the
+  wrong txid**; `verifyTxInclusion` binds the branch to a header's merkle root.
+  → `test/spv/merkleproof.js`
+- `verifyHeaderChain` **rejects a broken link** and a **header that fails proof-of-work**, and
+  honours a trusted-hash checkpoint.
+  → `test/spv/headerchain.js`
+
+### 2.6 Secret sharing does not leak
+
+- Shamir shares do **not** embed a hash of the secret by default (checksum is opt-in), so a
+  sub-threshold holder cannot brute-force a low-entropy secret offline.
+  → `test/crypto/shamir.js`
+
+### 2.7 The type surface does not lie
+
+- `bsv.d.ts` declares only APIs that exist at runtime, and the modules added in 6.x stay fully
+  typed (parsed via the TypeScript AST).
+  → `test/types/dts_drift.js`
+
+## 3. Trust assumptions and known limitations (honest)
+
+- **The inherited crypto/tx/script core has not been independently audited by us.** This
+  library forks `moneybutton/bsv` ← `bitpay/bitcore-lib`. We hardened the layer where the
+  6.0.0 bugs lived (verification/enforcement) and test the trust boundaries adversarially,
+  but the underlying EC math (`@noble/curves@2`, audited upstream), BN, and script primitives
+  are **trusted, not re-audited here**. An external audit is the top open item.
+- **`ECDSA.prototype.verify()` remains a footgun** (returns the instance). Mitigated by
+  `verifyBool()`, types, and a pinning test; **removal is planned for the next major.**
+- **`verifyHeaderChain` does not validate difficulty retargeting** — it checks linkage and
+  per-header PoW, not that the difficulty is correct for the height. Anchor confirmations
+  should therefore be pinned to a **trusted checkpoint hash**; this is by design and
+  documented in `lib/spv/headerchain.js`.
+- **`verifyAnchor`** is trustless only on the `{spvProof, header/headerChain, rawTx}` path;
+  the `chainProvider` path trusts the injected provider.
+- **No published provenance yet.** Bundles are a reproducible build of source (see §4) but
+  npm provenance attestation is pending a trusted-publisher registration (2FA-gated). This is
+  a *supply-chain verifiability* gap, not a code vulnerability.
+- **Genesis limits.** Covenant scripts require post-Genesis limits (`SmartContract.enableGenesis()`);
+  the guarantees assume a post-Genesis BSV node.
+
+## 4. Supply chain / reproducible builds
+
+- The published `*.min.js` / `*.bundle.js` are a **byte-for-byte reproducible build** of
+  `lib/` — CI rebuilds them and fails if they differ (the "Build & bundle integrity" gate),
+  and the build is deterministic across Node 20 and 22.
+- The published tarball ships **no `node_modules`**; the runtime dependency set is small and
+  pinned, and `elliptic` was removed from the runtime/bundle path (6.x uses `@noble/curves`).
+- Merges are gated on the full test suite (Node 20 + 22), a pristine scoped lint of the
+  audited modules, a whole-repo lint ratchet, and the type-drift gate.
+
+## 5. Reporting
+
+See [`SECURITY.md`](../SECURITY.md) for private disclosure. Do not open public issues for
+vulnerabilities.

package/docs/advanced/UTXO_MANAGER_GUIDE.md

@@ -722,7 +722,7 @@ interface UTXO {
 <html>
 <head>
     <title>UTXO Manager Demo</title>
-    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@6.1.2/bsv.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@6.2.1/bsv.min.js"></script>
 </head>
 <body>
     <script>

package/docs/getting-started/INSTALLATION.md

@@ -48,7 +48,7 @@ const tx: Transaction = new Transaction();
 #### **Core Library Only (937KB)**
 For basic Bitcoin SV operations:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const address = privateKey.toAddress();
@@ -58,7 +58,7 @@ For basic Bitcoin SV operations:
 #### **Complete Bundle (937KB)**  
 Everything in one file:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.bundle.js"></script>
 <script>
   // All features available immediately
   const shares = bsv.splitSecret('secret', 5, 3);
@@ -71,9 +71,9 @@ Everything in one file:
 
 #### **Smart Contract Development (~2.7MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().build();
@@ -82,9 +82,9 @@ Everything in one file:
 
 #### **Legal & Identity Development (~3.2MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -98,9 +98,9 @@ Everything in one file:
 
 #### **Security & Cryptography (~1.4MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3);
@@ -114,18 +114,18 @@ Everything in one file:
 
 | Module | Size | Purpose | CDN Link |
 |--------|------|---------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@6.1.2/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@6.1.2/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@6.1.2/bsv-smartcontract.min.js` |
-| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@6.1.2/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@6.1.2/bsv-gdaf.min.js` |
-| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@6.1.2/bsv-shamir.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@6.1.2/bsv-security.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@6.1.2/bsv-mnemonic.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@6.1.2/bsv-ecies.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@6.1.2/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@6.1.2/bsv-script-helper.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@6.1.2/bsv-message.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@6.2.1/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@6.2.1/bsv-smartcontract.min.js` |
+| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@6.2.1/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@6.2.1/bsv-gdaf.min.js` |
+| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@6.2.1/bsv-shamir.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@6.2.1/bsv-security.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@6.2.1/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@6.2.1/bsv-ecies.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@6.2.1/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@6.2.1/bsv-script-helper.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@6.2.1/bsv-message.min.js` |
 
 ## ⚙️ **Development Environment Setup**
 

package/docs/getting-started/QUICK_START.md

@@ -14,10 +14,10 @@ npm install @smartledger/bsv
 ### Browser CDN (Instant)
 ```html
 <!-- Core library (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
 
 <!-- Everything included (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.bundle.js"></script>
 ```
 
 ## 💰 **Your First Transaction (60 seconds)**
@@ -127,19 +127,19 @@ SmartLedger-BSV offers 12 different loading options - use only what you need:
 
 ```html
 <!-- Core BSV only (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
 
 <!-- Smart contracts (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-smartcontract.min.js"></script>
 
 <!-- Legal tokens (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-ltp.min.js"></script>
 
 <!-- Digital identity (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-gdaf.min.js"></script>
 
 <!-- Everything (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.bundle.js"></script>
 ```
 
 ## ⚡ **Key Advantages**

package/docs/migration/FROM_BSV_1_5_6.md

@@ -159,17 +159,17 @@ const recovered = bsv.reconstructSecret([shares[0], shares[2], shares[4]]);
 ### **New Modular Options** 
 ```html
 <!-- Core compatibility (same size as bsv@1.5.6) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.min.js"></script>
 
 <!-- Add smart contracts when ready -->
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-smartcontract.min.js"></script>
 
 <!-- Add advanced features as needed -->
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv-gdaf.min.js"></script>
 
 <!-- Everything in one file -->
-<script src="https://unpkg.com/@smartledger/bsv@6.1.2/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.1/bsv.bundle.js"></script>
 ```
 
 ## 🔍 **Testing Your Migration**

package/index.js

@@ -26,8 +26,9 @@ if (typeof window === 'undefined') {
   try { bsv.deps.bs58 = require('bs58') } catch (e) { /* polyfilled by bundler */ }
 }
 
-// module information
-bsv.version = 'v' + require('./package.json').version
+// module information (./version is generated from package.json by the `version` npm hook;
+// requiring it instead of package.json keeps ~4 KB of dev metadata out of the bundles)
+bsv.version = 'v' + require('./version')
 bsv.versionGuard = function (version) {
   if (version !== undefined) {
     var message = `

package/lib/smart_contract/index.js

@@ -374,7 +374,7 @@ SmartContract.utils.decodeCompactSize = function (buffer, offset) {
 }
 
 // Version information — tracks the package version so the two never drift.
-SmartContract.version = require('../../package.json').version
+SmartContract.version = require('../../version') // generated; keeps package.json out of bundles
 SmartContract.description = 'Smart Contract Framework for Bitcoin SV'
 
 // Feature flags

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "6.1.2",
+  "version": "6.2.1",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -45,33 +45,13 @@
     "smart-contracts": "node examples/smart_contract_templates.js",
     "smart-contracts:working": "node examples/final_working_contracts.js",
     "workflow": "node examples/complete_workflow_demo.js",
-    "build-bsv": "webpack --config build/webpack.config.js",
-    "build-ecies": "webpack --config build/webpack.ecies.config.js",
-    "build-message": "webpack --config build/webpack.message.config.js",
-    "build-mnemonic": "webpack --config build/webpack.mnemonic.config.js",
-    "build-shamir": "webpack --config build/webpack.shamir.config.js",
-    "build-ltp": "webpack --config build/webpack.ltp.config.js",
-    "build-gdaf": "webpack --config build/webpack.gdaf.config.js",
-    "build-smartcontract": "webpack --config build/webpack.smartcontract.config.js",
-    "build-covenant": "webpack --config build/webpack.covenant.config.js",
-    "build-script-helper": "webpack --config build/webpack.script-helper.config.js",
-    "build-security": "webpack --config build/webpack.security.config.js",
-    "build-didweb": "webpack --config build/webpack.didweb.config.js",
-    "build-vcjwt": "webpack --config build/webpack.vcjwt.config.js",
-    "build-statuslist": "webpack --config build/webpack.statuslist.config.js",
-    "build-anchor": "webpack --config build/webpack.anchor.config.js",
-    "build-bundle": "webpack --config build/webpack.bundle.config.js",
-    "build": "npm run build-bsv && npm run build-ecies && npm run build-message && npm run build-mnemonic && npm run build-shamir && npm run build-smartcontract",
-    "build-specialized": "npm run build-covenant && npm run build-script-helper && npm run build-security",
-    "build-credentials": "npm run build-didweb && npm run build-vcjwt && npm run build-statuslist && npm run build-anchor",
-    "build-advanced": "npm run build-ltp && npm run build-gdaf",
-    "build-all": "npm run build && npm run build-bundle && npm run build-specialized && npm run build-advanced && npm run build-credentials",
+    "build-all": "node build/esbuild.js",
     "test:browser": "echo 'Open tests/standalone-modules-test.html in browser for comprehensive testing'",
     "test:bundle": "echo 'Open tests/bundle-completeness-test.html in browser to verify bundle completeness'",
     "preimage:extract": "node examples/preimage/extract_preimage_bidirectional.js",
     "prepublishOnly": "npm run build-all",
     "sync-cdn": "node scripts/sync-cdn-urls.js",
-    "version": "node scripts/sync-cdn-urls.js && git add README.md docs",
+    "version": "node scripts/sync-cdn-urls.js && node scripts/sync-version.js && git add README.md docs version.js",
     "test:browser:ci": "node tests/browser-smoke-runner.js"
   },
   "unpkg": "bsv.min.js",
@@ -79,6 +59,7 @@
   "cdn": "bsv.min.js",
   "files": [
     "index.js",
+    "version.js",
     "test/",
     ".mocharc.json",
     "lib/",
@@ -220,6 +201,7 @@
     "buffer": "^6.0.3",
     "chai": "4.2.0",
     "crypto-browserify": "^3.12.1",
+    "esbuild": "^0.28.1",
     "jose": "^5.10.0",
     "mocha": "^11.7.6",
     "nyc": "^18.0.0",