@smartledger/bsv 6.2.0 → 6.2.2

package/docs/MODULE_REFERENCE_COMPLETE.md

@@ -55,19 +55,19 @@ Three advanced modules totaling **~2.7MB** of functionality:
 - **Purpose**: Threshold cryptography for secure secret distribution
 - **Use Cases**: Backup keys, multi-party security, key recovery
 - **Features**: Split secrets into N shares, require M to reconstruct
-- **CDN**: `unpkg.com/@smartledger/bsv@6.2.0/bsv-shamir.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@6.2.2/bsv-shamir.min.js`
 
 #### **🌐 Global Digital Attestation Framework - GDAF (1184KB)**  
 - **Purpose**: W3C Verifiable Credentials and decentralized identity
 - **Use Cases**: Identity verification, attestations, zero-knowledge proofs
 - **Features**: DID creation, credential issuance, selective disclosure
-- **CDN**: `unpkg.com/@smartledger/bsv@6.2.0/bsv-gdaf.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@6.2.2/bsv-gdaf.min.js`
 
 #### **⚖️ Legal Token Protocol - LTP (1184KB)**
 - **Purpose**: Legal compliance framework for tokenized assets
 - **Use Cases**: Property rights, obligations, compliant tokenization  
 - **Features**: Legal primitives, compliance checking, attestation anchoring
-- **CDN**: `unpkg.com/@smartledger/bsv@6.2.0/bsv-ltp.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@6.2.2/bsv-ltp.min.js`
 
 ### **2. Incorrect File Sizes in Documentation**
 
@@ -81,18 +81,18 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 | Module | Size | Use Case | CDN Link |
 |--------|------|----------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@6.2.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@6.2.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@6.2.0/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@6.2.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@6.2.0/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@6.2.0/bsv-security.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@6.2.0/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@6.2.0/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@6.2.0/bsv-mnemonic.min.js` |
-| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@6.2.0/bsv-shamir.min.js` |
-| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@6.2.0/bsv-gdaf.min.js` |
-| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@6.2.0/bsv-ltp.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@6.2.2/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@6.2.2/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@6.2.2/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@6.2.2/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@6.2.2/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@6.2.2/bsv-security.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@6.2.2/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@6.2.2/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@6.2.2/bsv-mnemonic.min.js` |
+| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@6.2.2/bsv-shamir.min.js` |
+| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@6.2.2/bsv-gdaf.min.js` |
+| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@6.2.2/bsv-ltp.min.js` |
 
 ## 🎯 **Updated Usage Examples**
 
@@ -100,22 +100,22 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **1. Basic Development (~963KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-script-helper.min.js"></script>
 ```
 
 #### **2. Smart Contract Development (~2.7MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-smartcontract.min.js"></script>
 ```
 
 #### **3. 🆕 Legal & Compliance Development (~3.2MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const legalToken = bsv.createLegalToken({
@@ -132,9 +132,9 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **4. 🆕 Security & Cryptography (~1.4MB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-shamir.min.js"></script>
 <script>
   // Shamir Secret Sharing
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -146,7 +146,7 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **5. Everything Bundle (937KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);

package/docs/advanced/UTXO_MANAGER_GUIDE.md

@@ -722,7 +722,7 @@ interface UTXO {
 <html>
 <head>
     <title>UTXO Manager Demo</title>
-    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@6.2.0/bsv.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@6.2.2/bsv.min.js"></script>
 </head>
 <body>
     <script>

package/docs/getting-started/INSTALLATION.md

@@ -48,7 +48,7 @@ const tx: Transaction = new Transaction();
 #### **Core Library Only (937KB)**
 For basic Bitcoin SV operations:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const address = privateKey.toAddress();
@@ -58,7 +58,7 @@ For basic Bitcoin SV operations:
 #### **Complete Bundle (937KB)**  
 Everything in one file:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.bundle.js"></script>
 <script>
   // All features available immediately
   const shares = bsv.splitSecret('secret', 5, 3);
@@ -71,9 +71,9 @@ Everything in one file:
 
 #### **Smart Contract Development (~2.7MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().build();
@@ -82,9 +82,9 @@ Everything in one file:
 
 #### **Legal & Identity Development (~3.2MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -98,9 +98,9 @@ Everything in one file:
 
 #### **Security & Cryptography (~1.4MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3);
@@ -114,18 +114,18 @@ Everything in one file:
 
 | Module | Size | Purpose | CDN Link |
 |--------|------|---------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@6.2.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@6.2.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@6.2.0/bsv-smartcontract.min.js` |
-| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@6.2.0/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@6.2.0/bsv-gdaf.min.js` |
-| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@6.2.0/bsv-shamir.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@6.2.0/bsv-security.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@6.2.0/bsv-mnemonic.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@6.2.0/bsv-ecies.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@6.2.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@6.2.0/bsv-script-helper.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@6.2.0/bsv-message.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@6.2.2/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@6.2.2/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@6.2.2/bsv-smartcontract.min.js` |
+| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@6.2.2/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@6.2.2/bsv-gdaf.min.js` |
+| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@6.2.2/bsv-shamir.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@6.2.2/bsv-security.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@6.2.2/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@6.2.2/bsv-ecies.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@6.2.2/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@6.2.2/bsv-script-helper.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@6.2.2/bsv-message.min.js` |
 
 ## ⚙️ **Development Environment Setup**
 

package/docs/getting-started/QUICK_START.md

@@ -14,10 +14,10 @@ npm install @smartledger/bsv
 ### Browser CDN (Instant)
 ```html
 <!-- Core library (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.min.js"></script>
 
 <!-- Everything included (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.bundle.js"></script>
 ```
 
 ## 💰 **Your First Transaction (60 seconds)**
@@ -127,19 +127,19 @@ SmartLedger-BSV offers 12 different loading options - use only what you need:
 
 ```html
 <!-- Core BSV only (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.min.js"></script>
 
 <!-- Smart contracts (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-smartcontract.min.js"></script>
 
 <!-- Legal tokens (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-ltp.min.js"></script>
 
 <!-- Digital identity (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-gdaf.min.js"></script>
 
 <!-- Everything (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.bundle.js"></script>
 ```
 
 ## ⚡ **Key Advantages**

package/docs/migration/FROM_BSV_1_5_6.md

@@ -159,17 +159,17 @@ const recovered = bsv.reconstructSecret([shares[0], shares[2], shares[4]]);
 ### **New Modular Options** 
 ```html
 <!-- Core compatibility (same size as bsv@1.5.6) -->
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.min.js"></script>
 
 <!-- Add smart contracts when ready -->
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-smartcontract.min.js"></script>
 
 <!-- Add advanced features as needed -->
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv-gdaf.min.js"></script>
 
 <!-- Everything in one file -->
-<script src="https://unpkg.com/@smartledger/bsv@6.2.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@6.2.2/bsv.bundle.js"></script>
 ```
 
 ## 🔍 **Testing Your Migration**

package/index.js

@@ -26,8 +26,9 @@ if (typeof window === 'undefined') {
   try { bsv.deps.bs58 = require('bs58') } catch (e) { /* polyfilled by bundler */ }
 }
 
-// module information
-bsv.version = 'v' + require('./package.json').version
+// module information (./version is generated from package.json by the `version` npm hook;
+// requiring it instead of package.json keeps ~4 KB of dev metadata out of the bundles)
+bsv.version = 'v' + require('./version')
 bsv.versionGuard = function (version) {
   if (version !== undefined) {
     var message = `

package/lib/smart_contract/index.js

@@ -374,7 +374,7 @@ SmartContract.utils.decodeCompactSize = function (buffer, offset) {
 }
 
 // Version information — tracks the package version so the two never drift.
-SmartContract.version = require('../../package.json').version
+SmartContract.version = require('../../version') // generated; keeps package.json out of bundles
 SmartContract.description = 'Smart Contract Framework for Bitcoin SV'
 
 // Feature flags

package/lib/smart_contract/preimage.js

@@ -40,6 +40,15 @@ function Preimage(preimage, options) {
   }
 }
 
+// Structural minimum of a BIP-143 preimage, so a too-short buffer fails with an
+// HONEST error instead of tripping decodeCompactSize into a misleading
+// "8-byte CompactSize" throw. LEFT fixed (nVersion 4 + hashPrevouts 32 +
+// hashSequence 32 + outpoint 36 = 104) + smallest scriptLen varint (1) + RIGHT
+// fixed (amount 8 + nSequence 4 + hashOutputs 32 + nLocktime 4 + sighash 4 = 52).
+Preimage.LEFT_FIXED_LENGTH = 4 + 32 + 32 + 36 // 104
+Preimage.RIGHT_FIXED_LENGTH = 8 + 4 + 32 + 4 + 4 // 52
+Preimage.MIN_PREIMAGE_LENGTH = Preimage.LEFT_FIXED_LENGTH + 1 + Preimage.RIGHT_FIXED_LENGTH // 157
+
 /**
  * Extract all preimage fields using bidirectional strategy
  * @param {string} extractionStrategy - 'LEFT', 'RIGHT', or 'DYNAMIC'
@@ -141,13 +150,27 @@ Preimage.prototype.extractFields = function(fieldNames) {
  * @returns {Object} Validation result
  */
 Preimage.prototype.validate = function() {
+  var errors = []
+  var warnings = []
+
+  // Length first: a buffer too short to hold the fixed fields can't be
+  // field-extracted, so report it without tripping extraction. (For a
+  // non-deferred Preimage construction already threw the same error.)
+  if (this.preimage.length < Preimage.MIN_PREIMAGE_LENGTH) {
+    errors.push('Preimage too short: ' + this.preimage.length +
+      ' bytes (BIP-143 preimage requires at least ' + Preimage.MIN_PREIMAGE_LENGTH + ')')
+    return {
+      valid: false,
+      errors: errors,
+      warnings: warnings,
+      sighashInfo: this.sighashInfo
+    }
+  }
+
   if (!this.fields) {
     this._extractFields()
   }
 
-  var errors = []
-  var warnings = []
-
   // Check required fields
   var requiredFields = [
     'version', 'hashPrevouts', 'hashSequence', 'outpoint',
@@ -165,11 +188,6 @@ Preimage.prototype.validate = function() {
     warnings.push('Zero hashes detected - check SIGHASH flags: ' + this.sighashInfo.zeroFields.join(', '))
   }
 
-  // Validate preimage length
-  if (this.preimage.length < 104) { // Minimum BIP-143 preimage size
-    errors.push('Preimage too short: ' + this.preimage.length + ' bytes (minimum 104)')
-  }
-
   return {
     valid: errors.length === 0,
     errors: errors,
@@ -222,6 +240,13 @@ Preimage.prototype._extractFields = function() {
     warnings: []
   }
 
+  // Fail closed with an honest error before any slice/varint work runs on a
+  // buffer too small to hold the fixed BIP-143 fields.
+  if (this.preimage.length < Preimage.MIN_PREIMAGE_LENGTH) {
+    throw new Error('Preimage too short: ' + this.preimage.length +
+      ' bytes (BIP-143 preimage requires at least ' + Preimage.MIN_PREIMAGE_LENGTH + ')')
+  }
+
   try {
     if (this.strategy === 'LEFT' || this.strategy === 'DYNAMIC') {
       this._extractFromLeft()
@@ -735,6 +760,10 @@ Preimage.prototype._getExtractionStrategy = function(fieldName) {
  * @returns {Object} Decoded value and next offset
  */
 Preimage.decodeCompactSize = function(buffer, offset) {
+  if (offset >= buffer.length) {
+    throw new Error('CompactSize read past end of preimage buffer (offset ' +
+      offset + ', length ' + buffer.length + ')')
+  }
   var firstByte = buffer[offset]
 
   if (firstByte < 0xfd) {
@@ -742,24 +771,22 @@ Preimage.decodeCompactSize = function(buffer, offset) {
     return { value: firstByte, nextOffset: offset + 1, bytes: 1 }
   } else if (firstByte === 0xfd) {
     // 2 byte encoding (253-65535)
+    if (offset + 3 > buffer.length) {
+      throw new Error('Truncated 2-byte CompactSize in preimage at offset ' + offset)
+    }
     var value = buffer.readUInt16LE(offset + 1)
     return { value: value, nextOffset: offset + 3, bytes: 3 }
   } else if (firstByte === 0xfe) {
     // 4 byte encoding (65536-4294967295) - rare for script lengths
-    var value = buffer.readUInt32LE(offset + 1)
-    return { value: value, nextOffset: offset + 5, bytes: 5 }
-  } else {
-    // 8 byte encoding - extremely rare, try to handle gracefully
-    console.warn('Encountered 8-byte CompactSize - this is very unusual for script lengths')
-    // For our purposes, assume it's a reasonable script length and try to parse it
-    // This is a fallback for malformed or test data
-    try {
-      // Read as 4-byte for now since 8-byte values would be enormous for scripts
-      var value = buffer.readUInt32LE(offset + 1)
-      return { value: value, nextOffset: offset + 9, bytes: 9 } // Skip full 8 bytes + marker
-    } catch (e) {
-      throw new Error('Invalid 8-byte CompactSize encoding in preimage')
+    if (offset + 5 > buffer.length) {
+      throw new Error('Truncated 4-byte CompactSize in preimage at offset ' + offset)
     }
+    var value4 = buffer.readUInt32LE(offset + 1)
+    return { value: value4, nextOffset: offset + 5, bytes: 5 }
+  } else {
+    // 0xff marks an 8-byte length (>4 GB) - impossible for a real script length,
+    // so this is malformed/misaligned data rather than a value to salvage.
+    throw new Error('Invalid CompactSize: 8-byte length prefix (0xff) is not a valid script length')
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "6.2.0",
+  "version": "6.2.2",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -51,7 +51,7 @@
     "preimage:extract": "node examples/preimage/extract_preimage_bidirectional.js",
     "prepublishOnly": "npm run build-all",
     "sync-cdn": "node scripts/sync-cdn-urls.js",
-    "version": "node scripts/sync-cdn-urls.js && git add README.md docs",
+    "version": "node scripts/sync-cdn-urls.js && node scripts/sync-version.js && git add README.md docs version.js",
     "test:browser:ci": "node tests/browser-smoke-runner.js"
   },
   "unpkg": "bsv.min.js",
@@ -59,6 +59,7 @@
   "cdn": "bsv.min.js",
   "files": [
     "index.js",
+    "version.js",
     "test/",
     ".mocharc.json",
     "lib/",
@@ -195,12 +196,12 @@
   },
   "devDependencies": {
     "assert": "^2.1.0",
-    "brfs": "2.0.1",
     "browserify-zlib": "^0.2.0",
     "buffer": "^6.0.3",
     "chai": "4.2.0",
     "crypto-browserify": "^3.12.1",
     "esbuild": "^0.28.1",
+    "events": "^3.3.0",
     "jose": "^5.10.0",
     "mocha": "^11.7.6",
     "nyc": "^18.0.0",
@@ -209,12 +210,9 @@
     "sinon": "7.2.3",
     "standard": "12.0.1",
     "stream-browserify": "^3.0.0",
-    "terser-webpack-plugin": "^5.6.1",
     "typescript": "^5.9.3",
     "util": "^0.12.5",
-    "vm-browserify": "^1.1.2",
-    "webpack": "^5.107.2",
-    "webpack-cli": "^5.1.4"
+    "vm-browserify": "^1.1.2"
   },
   "license": "MIT",
   "standard": {

package/test/build/version_sync.js

@@ -0,0 +1,14 @@
+'use strict'
+
+/* global describe, it */
+
+// version.js is generated from package.json by the `version` npm hook so the bundles
+// embed only the version string (not the whole package.json). Assert it hasn't drifted.
+
+require('chai').should()
+
+describe('version.js stays in sync with package.json', function () {
+  it('version.js === package.json.version', function () {
+    require('../../version').should.equal(require('../../package.json').version)
+  })
+})

package/test/smart_contract/preimage.js

@@ -0,0 +1,98 @@
+'use strict'
+
+/* global describe, it */
+
+// Coverage for SmartContract.Preimage (previously untested public class).
+// Focus: a too-short buffer must fail with an HONEST error (it used to trip
+// decodeCompactSize into a misleading "8-byte CompactSize" throw plus console
+// spam), while real BIP-143 preimages round-trip their fields.
+
+require('chai').should()
+var bsv = require('../..')
+var Preimage = bsv.SmartContract.Preimage
+
+describe('SmartContract.Preimage', function () {
+  describe('length guard (honest failure)', function () {
+    it('exposes the derived BIP-143 structural minimum (157)', function () {
+      Preimage.LEFT_FIXED_LENGTH.should.equal(104)
+      Preimage.RIGHT_FIXED_LENGTH.should.equal(52)
+      Preimage.MIN_PREIMAGE_LENGTH.should.equal(157)
+    })
+
+    it('throws a clear "too short" error at construction, not a CompactSize error', function () {
+      ;[0, 50, 103, 156].forEach(function (n) {
+        (function () { return new Preimage(Buffer.alloc(n)) })
+          .should.throw(/Preimage too short/)
+      })
+    })
+
+    it('does NOT mention CompactSize when the real problem is length', function () {
+      var threw
+      try { threw = new Preimage(Buffer.alloc(50)) } catch (e) { threw = e.message }
+      threw.should.match(/Preimage too short/)
+      threw.should.not.match(/CompactSize/)
+    })
+
+    it('validate() reports the length gracefully for a deferred preimage (no throw)', function () {
+      var p = new Preimage(Buffer.alloc(50), { deferExtraction: true })
+      var res = p.validate()
+      res.valid.should.equal(false)
+      res.errors.join(' ').should.match(/Preimage too short: 50 bytes/)
+    })
+
+    it('accepts a buffer exactly at the minimum length', function () {
+      // 157 bytes: 104 left + 1-byte scriptLen varint (0x00 => empty script) + 52 right.
+      var buf = Buffer.alloc(Preimage.MIN_PREIMAGE_LENGTH)
+      ;(function () { return new Preimage(buf) }).should.not.throw()
+    })
+  })
+
+  describe('decodeCompactSize (honest failure)', function () {
+    it('throws when reading past the end of the buffer', function () {
+      (function () { Preimage.decodeCompactSize(Buffer.alloc(4), 4) })
+        .should.throw(/past end of preimage buffer/)
+    })
+
+    it('rejects the 8-byte (0xff) length prefix as invalid for a script length', function () {
+      var buf = Buffer.concat([Buffer.from([0xff]), Buffer.alloc(8)])
+      ;(function () { Preimage.decodeCompactSize(buf, 0) })
+        .should.throw(/8-byte length prefix/)
+    })
+
+    it('rejects a truncated 2-byte CompactSize', function () {
+      (function () { Preimage.decodeCompactSize(Buffer.from([0xfd, 0x01]), 0) })
+        .should.throw(/Truncated 2-byte CompactSize/)
+    })
+
+    it('decodes a plain 1-byte length', function () {
+      var r = Preimage.decodeCompactSize(Buffer.from([0x19]), 0)
+      r.value.should.equal(0x19)
+      r.bytes.should.equal(1)
+      r.nextOffset.should.equal(1)
+    })
+  })
+
+  describe('real preimage round-trip', function () {
+    it('constructs, extracts fields, and validates a genuine preimage', function () {
+      var ex = Preimage.createExample(0x41) // SIGHASH_ALL | FORKID
+      ex.preimage.length.should.be.above(Preimage.MIN_PREIMAGE_LENGTH)
+
+      // Fixed-width fields come back at their BIP-143 sizes.
+      ex.getField('version').length.should.equal(4)
+      ex.getField('hashPrevouts').length.should.equal(32)
+      ex.getField('hashOutputs').length.should.equal(32)
+      ex.getField('sighash').length.should.equal(4)
+
+      var v = ex.validate()
+      v.valid.should.equal(true)
+      v.errors.length.should.equal(0)
+    })
+
+    it('reports SIGHASH flag info for the extracted sighash', function () {
+      var ex = Preimage.createExample(0x41)
+      var info = ex.getSighashInfo()
+      info.flagName.should.match(/ALL/)
+      info.flagName.should.match(/FORKID/)
+    })
+  })
+})

package/version.js

@@ -0,0 +1,3 @@
+'use strict'
+// GENERATED by scripts/sync-version.js on `npm version` — do not edit.
+module.exports = '6.2.2'