@smartledger/bsv 7.11.0 → 7.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (44) hide show
  1. package/CHANGELOG.md +135 -0
  2. package/README.md +38 -38
  3. package/bsv-anchor.min.js +11 -17
  4. package/bsv-didweb.min.js +11 -17
  5. package/bsv-gdaf.min.js +69 -75
  6. package/bsv-ltp.min.js +55 -61
  7. package/bsv-mnemonic.min.js +11 -17
  8. package/bsv-shamir.min.js +11 -17
  9. package/bsv-smartcontract.min.js +1 -1
  10. package/bsv-statuslist.min.js +53 -59
  11. package/bsv-vcjwt.min.js +11 -17
  12. package/bsv.bundle.js +69 -75
  13. package/bsv.min.js +69 -75
  14. package/build/esbuild/crypto-shim.js +35 -0
  15. package/build/esbuild.js +7 -3
  16. package/docs/AUDIT_SCOPE.md +198 -0
  17. package/docs/MODULE_REFERENCE_COMPLETE.md +27 -27
  18. package/docs/advanced/UTXO_MANAGER_GUIDE.md +1 -1
  19. package/docs/getting-started/INSTALLATION.md +23 -23
  20. package/docs/getting-started/QUICK_START.md +7 -7
  21. package/docs/migration/FROM_BSV_1_5_6.md +5 -5
  22. package/index.js +10 -2
  23. package/lib/crypto/hash.browser.js +13 -5
  24. package/lib/crypto/hash.js +58 -2
  25. package/lib/crypto/random.js +72 -15
  26. package/lib/didweb/index.js +88 -9
  27. package/lib/encoding/base58.js +67 -3
  28. package/lib/mnemonic/mnemonic.js +19 -5
  29. package/lib/mnemonic/pbkdf2.js +35 -2
  30. package/lib/script/interpreter.js +21 -2
  31. package/lib/transaction/input/multisig.js +1 -1
  32. package/lib/transaction/input/multisigscripthash.js +1 -1
  33. package/lib/transaction/input/publickey.js +1 -1
  34. package/lib/transaction/input/publickeyhash.js +1 -1
  35. package/lib/transaction/signature.js +1 -1
  36. package/lib/util/inherits.js +37 -0
  37. package/package.json +16 -9
  38. package/test/build/bundle_crypto_shim.js +104 -0
  39. package/test/build/bundle_externals.js +6 -1
  40. package/test/crypto/backend_selection.js +126 -0
  41. package/test/crypto/random.js +73 -0
  42. package/test/didweb/relationships.js +144 -0
  43. package/test/transaction/unspentoutput.js +6 -1
  44. package/version.js +1 -1
package/CHANGELOG.md CHANGED
@@ -7,6 +7,141 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
7
7
 
8
8
  ## [Unreleased]
9
9
 
10
+ ## [7.13.0] - 2026-08-11
11
+
12
+ Two of the three fixes below came from another team building a React Native keystore on
13
+ this library. Both were reproduced here before being acted on.
14
+
15
+ ### The CSPRNG no longer guesses its environment
16
+
17
+ **This is the one to read.** `Random.getRandomBuffer` chose its backend by testing
18
+ `process.browser` — a Browserify-era convention that is **undefined in React Native,
19
+ Deno, Cloudflare Workers and Bun**. Every one of those fell through to the Node branch
20
+ and called `require('crypto').randomBytes`. In React Native that fails outright at best;
21
+ at worst something in the dependency graph has registered a partial crypto shim —
22
+ rn-nodeify and several RN starter templates do exactly this — and a weak `randomBytes`
23
+ makes `PrivateKey.fromRandom()` silently produce guessable keys.
24
+
25
+ `globalThis.crypto.getRandomValues` is now tried first, covering browsers, Node >= 19,
26
+ Deno, Workers, Bun, and React Native with `react-native-get-random-values`. Node crypto
27
+ remains a fallback. **If neither exists, it throws** — a key library must never return
28
+ bytes it cannot vouch for. `getRandomBufferBrowser` also read a bare `window`, which does
29
+ not exist in Workers or React Native; it reads `globalThis` now.
30
+
31
+ Requests above WebCrypto's 65,536-byte per-call limit are filled in chunks, and a test
32
+ asserts the tail past that boundary is real entropy rather than zero padding.
33
+
34
+ On Node the bytes now come from `globalThis.crypto` rather than `crypto.randomBytes`.
35
+ Both are the same OS CSPRNG, but it is a behaviour change, hence the minor bump.
36
+
37
+ ### Hash and PBKDF2 backends are chosen by capability
38
+
39
+ `lib/crypto/hash.js` and `lib/mnemonic/pbkdf2.js` carried the identical defect.
40
+ `process.browser` no longer appears anywhere in `lib/`.
41
+
42
+ Node's implementations stay *preferred* rather than being replaced by `@noble/hashes`
43
+ outright: measured sha256 is at parity for 32-byte inputs (1.17x) but ~10x for 64 KB and
44
+ above, which is block parsing and document anchoring. The unconditional reach for node
45
+ crypto was the bug, not its use.
46
+
47
+ The probe checks **correctness, not existence** — digests are verified against
48
+ known-answer vectors, `ripemd160` is probed separately because OpenSSL 3 moved it to the
49
+ legacy provider, and PBKDF2 checks `createHmac('sha512')` against RFC 4231 case 1. A
50
+ shim that returns wrong digests is rejected in favour of the audited pure-JS path,
51
+ because a wrong hash is invisible until it matters.
52
+
53
+ ### did:web verification relationships are no longer collapsed
54
+
55
+ DID Core defines `authentication` and `assertionMethod` to be distinct: one proves who
56
+ you are now, the other makes a claim that outlives the session. `buildDidWebDocuments`
57
+ cross-listed every key into both, so a caller could not express "this key may log in but
58
+ may not make assertions". Keys now take an optional `relationships` array; omitting it
59
+ reproduces the previous document exactly, key order included.
60
+
61
+ `rotateIssuerKey` had the worse version: it rewrote **both** relationships whatever was
62
+ being rotated, so replacing a compromised authentication key invalidated every statement
63
+ the issuer had ever signed. Rotation is now scoped to `newKey.relationships`, and
64
+ relationships outside that scope carry across from an optional `currentDocument` along
65
+ with the verification methods they still reference. Without a `currentDocument` the
66
+ output is unchanged.
67
+
68
+ ### Runtime dependencies: 10 -> 5
69
+
70
+ `unorm`, `hash.js`, `inherits`, `clone-deep` and `bs58` (with `base-x`) are replaced by
71
+ in-tree equivalents. What remains is `bn.js`, `secrets.js-grempe` and the three `@noble`
72
+ packages — every dependency is now either audited cryptography or a deliberate separate
73
+ decision. `bsv.min.js` drops another 155 KB (1,187,504 -> 1,032,437);
74
+ `bsv-mnemonic.min.js` -30%.
75
+
76
+ Each replacement was differentially tested against the thing it replaced *before* the
77
+ dependency was removed: base58 over 20,336 encode/decode round-trips covering every
78
+ leading-zero count 0-8, and the hashes over 192 comparisons against the Node path
79
+ including the 55/56/64/119/128-byte block boundaries. `bsv.deps.bs58` is kept as a
80
+ facade over the new encoder, since it is a public escape hatch.
81
+
82
+ ## [7.12.0] - 2026-08-10
83
+
84
+ ### The browser bundles lose a fifth of their weight
85
+
86
+ `crypto-browserify` is a faithful shim for the whole of Node's `crypto`, and the browser
87
+ build used it for the `crypto` built-in. Faithful is the problem: every bundle carried
88
+ AES, DES, Diffie-Hellman, RSA public-encrypt and an ASN.1 parser for code the library
89
+ never calls. Reading the module graph rather than guessing, the bundles need exactly
90
+ three entry points — `createHash` (`hash.node.js`, and the didweb / vcjwt / statuslist /
91
+ anchor / gdaf modules, which `require('crypto')` unconditionally), `createHmac`
92
+ (`mnemonic/pbkdf2.node.js`) and `randomBytes` (secrets.js-grempe's Shamir CSPRNG).
93
+
94
+ `build/esbuild/crypto-shim.js` provides those three and nothing else. Fourteen packages
95
+ leave the graph; `bsv.min.js` drops from 378 module inputs to 309, and the duplicate
96
+ `bn.js` copy disappears with them.
97
+
98
+ ```
99
+ bsv-anchor.min.js 341,349 → 167,670 -50.9%
100
+ bsv-didweb.min.js 342,010 → 168,331 -50.8%
101
+ bsv-vcjwt.min.js 343,018 → 169,332 -50.6%
102
+ bsv-shamir.min.js 354,058 → 180,342 -49.1%
103
+ bsv-statuslist.min.js 435,810 → 261,944 -39.9%
104
+ bsv-mnemonic.min.js 636,824 → 463,208 -27.3%
105
+ bsv-ltp.min.js 674,540 → 545,227 -19.2%
106
+ bsv.min.js 1,317,994 → 1,187,504 -9.9%
107
+ ───────── ─────────
108
+ total (16 bundles) 7,491,257 → 5,928,232 -20.9%
109
+ ```
110
+
111
+ No API changes. Digests, signatures and Shamir shares are unchanged — the new shim is
112
+ checked against node's own `crypto` for sha1/sha256/sha512/ripemd160 and HMAC-SHA512, and
113
+ the built bundles were additionally verified against NIST SHA-256 known-answer vectors.
114
+
115
+ `getRandomValues` is deliberately **not** exported. secrets.js prefers it over
116
+ `randomBytes` when present, so exporting it would silently move the Shamir CSPRNG onto a
117
+ different code path; `crypto-browserify` did not expose it either, so omitting it keeps
118
+ the selection identical to every prior release.
119
+
120
+ ### Dependency advisories cleared
121
+
122
+ Dev-dependency alerts went from 10 (6 high, 2 moderate, 2 low) to **zero**. The
123
+ production tree audited clean throughout — `npm audit --omit=dev` was 0 before and after
124
+ — so no published version was ever affected.
125
+
126
+ The high and moderate findings (js-yaml, serialize-javascript, tmp) are closed with
127
+ pinned `overrides`, because npm's own suggestions were all wrong: a semver-major jump to
128
+ `standard@17`, a *downgrade* of crypto-browserify, and `mocha@11.3.0` when 11.8.0 was
129
+ already installed. The js-yaml 3.x line has a 3.15.1 backport above the vulnerable range,
130
+ so eslint and istanbul keep the 3.x API instead of being forced to 4.x where `safeLoad`
131
+ no longer exists.
132
+
133
+ The remaining low finding was `elliptic`, which has no patched version at all. It was
134
+ never our EC implementation — that moved to `@noble/curves` — but arrived transitively
135
+ through crypto-browserify. Removing that polyfill removed the chain entirely.
136
+
137
+ ### Testing
138
+
139
+ `build/esbuild.js` used to keep `elliptic` out of the output with a hand-written
140
+ `onResolve` stub. That stub is gone, replaced by `test/build/bundle_crypto_shim.js`,
141
+ which asserts no bundle's module graph contains any part of the chain, pins the shim's
142
+ exported surface, and compares its digests against node's. A stub goes silent when it
143
+ stops matching; an assertion does not.
144
+
10
145
  ## [7.11.0] - 2026-08-10
11
146
 
12
147
  ### The Chronicle default, decided
package/README.md CHANGED
@@ -186,42 +186,42 @@ console.log('Status:', status) // 'revoked'
186
186
  ### **Core Modules**
187
187
  | Module | Size | Use Case | CDN |
188
188
  |--------|------|----------|-----|
189
- | **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js` |
190
- | **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.11.0/bsv.bundle.js` |
189
+ | **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js` |
190
+ | **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.13.0/bsv.bundle.js` |
191
191
 
192
192
  ### **W3C Verifiable Credentials**
193
193
  | Module | Size | Use Case | CDN |
194
194
  |--------|------|----------|-----|
195
- | **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.11.0/bsv-didweb.min.js` |
196
- | **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.11.0/bsv-vcjwt.min.js` |
197
- | **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.11.0/bsv-statuslist.min.js` |
198
- | **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.11.0/bsv-anchor.min.js` |
195
+ | **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.13.0/bsv-didweb.min.js` |
196
+ | **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.13.0/bsv-vcjwt.min.js` |
197
+ | **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.13.0/bsv-statuslist.min.js` |
198
+ | **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.13.0/bsv-anchor.min.js` |
199
199
 
200
200
  ### **Smart Contract & Development**
201
201
  | Module | Size | Use Case | CDN |
202
202
  |--------|------|----------|-----|
203
- | **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.11.0/bsv-smartcontract.min.js` |
204
- | **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.11.0/bsv-covenant.min.js` |
205
- | **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.11.0/bsv-script-helper.min.js` |
206
- | **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.11.0/bsv-security.min.js` |
203
+ | **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.13.0/bsv-smartcontract.min.js` |
204
+ | **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.13.0/bsv-covenant.min.js` |
205
+ | **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.13.0/bsv-script-helper.min.js` |
206
+ | **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.13.0/bsv-security.min.js` |
207
207
 
208
208
  ### **Legal & Compliance**
209
209
  | Module | Size | Use Case | CDN |
210
210
  |--------|------|----------|-----|
211
- | **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.11.0/bsv-ltp.min.js` |
212
- | **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.11.0/bsv-gdaf.min.js` |
211
+ | **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.13.0/bsv-ltp.min.js` |
212
+ | **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.13.0/bsv-gdaf.min.js` |
213
213
 
214
214
  ### **Advanced Cryptography**
215
215
  | Module | Size | Use Case | CDN |
216
216
  |--------|------|----------|-----|
217
- | **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.11.0/bsv-shamir.min.js` |
217
+ | **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.13.0/bsv-shamir.min.js` |
218
218
 
219
219
  ### **Utilities**
220
220
  | Module | Size | Use Case | CDN |
221
221
  |--------|------|----------|-----|
222
- | **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.11.0/bsv-ecies.min.js` |
223
- | **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.11.0/bsv-message.min.js` |
224
- | **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.11.0/bsv-mnemonic.min.js` |
222
+ | **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.13.0/bsv-ecies.min.js` |
223
+ | **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.13.0/bsv-message.min.js` |
224
+ | **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.13.0/bsv-mnemonic.min.js` |
225
225
 
226
226
  ## ⚡ **2-Minute Quick Start**
227
227
 
@@ -232,7 +232,7 @@ Get started with Bitcoin SV development in under 2 minutes:
232
232
  npm install @smartledger/bsv
233
233
 
234
234
  # Or include in HTML
235
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
235
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
236
236
  ```
237
237
 
238
238
  > **🔒 v5.0.0 (production hardening — has breaking changes):** Shamir secret
@@ -332,8 +332,8 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
332
332
 
333
333
  ### 🔧 **Basic Development** (~1.2MB total)
334
334
  ```html
335
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
336
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-script-helper.min.js"></script>
335
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
336
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-script-helper.min.js"></script>
337
337
  <script>
338
338
  const privateKey = new bsv.PrivateKey();
339
339
  const utxos = new bsv.SmartContract.UTXOGenerator().createRealUTXOs(2, 100000);
@@ -342,9 +342,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
342
342
 
343
343
  ### 🔒 **Smart Contract Development** (~2.8MB total — each bundle re-embeds core BSV)
344
344
  ```html
345
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
346
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-covenant.min.js"></script>
347
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-smartcontract.min.js"></script>
345
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
346
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-covenant.min.js"></script>
347
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-smartcontract.min.js"></script>
348
348
  <script>
349
349
  const covenant = bsv.SmartContract.createCovenantBuilder()
350
350
  .extractField('amount').push(50000).greaterThanOrEqual().verify().build();
@@ -354,9 +354,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
354
354
 
355
355
  ### 🆕 **Legal & Identity Development** (~3.4MB total — each bundle re-embeds core BSV)
356
356
  ```html
357
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
358
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-ltp.min.js"></script>
359
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-gdaf.min.js"></script>
357
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
358
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-ltp.min.js"></script>
359
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-gdaf.min.js"></script>
360
360
  <script>
361
361
  // Legal Token Protocol
362
362
  const propertyToken = bsv.createPropertyToken({
@@ -370,9 +370,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
370
370
 
371
371
  ### 🆕 **Security & Cryptography** (~1.5MB total)
372
372
  ```html
373
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
374
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-security.min.js"></script>
375
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-shamir.min.js"></script>
373
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
374
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-security.min.js"></script>
375
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-shamir.min.js"></script>
376
376
  <script>
377
377
  // Threshold Cryptography
378
378
  const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -384,7 +384,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
384
384
 
385
385
  ### 🎯 **Everything Bundle** (~1.1MB)
386
386
  ```html
387
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.bundle.js"></script>
387
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.bundle.js"></script>
388
388
  <script>
389
389
  // Everything available immediately
390
390
  const shares = bsv.splitSecret('secret', 5, 3); // Shamir Secret Sharing
@@ -494,8 +494,8 @@ const contractTx = covenant.createCovenantTransaction({
494
494
 
495
495
  #### 1. **Minimal Setup** - Core + Script Helper (~1.2MB)
496
496
  ```html
497
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
498
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-script-helper.min.js"></script>
497
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
498
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-script-helper.min.js"></script>
499
499
  <script>
500
500
  const tx = new bsv.Transaction();
501
501
  const sig = bsvScriptHelper.createSignature(tx, privateKey, 0, script, satoshis);
@@ -504,9 +504,9 @@ const contractTx = covenant.createCovenantTransaction({
504
504
 
505
505
  #### 2. **DeFi Development** - Core + Covenants + Debug (~2.8MB — each bundle re-embeds core BSV)
506
506
  ```html
507
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
508
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-covenant.min.js"></script>
509
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-smartcontract.min.js"></script>
507
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
508
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-covenant.min.js"></script>
509
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-smartcontract.min.js"></script>
510
510
  <script>
511
511
  const covenant = new bsvCovenant.CovenantInterface();
512
512
  const debugInfo = SmartContract.interpretScript(script);
@@ -516,8 +516,8 @@ const contractTx = covenant.createCovenantTransaction({
516
516
 
517
517
  #### 3. **Security First** - Core + Enhanced Security (~1.2MB)
518
518
  ```html
519
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.min.js"></script>
520
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv-security.min.js"></script>
519
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
520
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-security.min.js"></script>
521
521
  <script>
522
522
  const verified = bsvSecurity.SmartVerify.verify(signature, hash, publicKey);
523
523
  const enhanced = bsvSecurity.EllipticFixed.createSignature(privateKey, hash);
@@ -526,7 +526,7 @@ const contractTx = covenant.createCovenantTransaction({
526
526
 
527
527
  #### 4. **Everything Bundle** - One File Solution (~1.1MB)
528
528
  ```html
529
- <script src="https://unpkg.com/@smartledger/bsv@7.11.0/bsv.bundle.js"></script>
529
+ <script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.bundle.js"></script>
530
530
  <script>
531
531
  // Everything available under bsv namespace
532
532
  const keys = bsv.SmartLedgerBundle.generateKeys();
@@ -834,7 +834,7 @@ const timelockScript = helper.createTimelockScript(
834
834
 
835
835
  See the **[16 Loading Options](#-16-loading-options---choose-your-approach)**
836
836
  table near the top for the full list of bundles with current sizes and
837
- canonical `unpkg.com/@smartledger/bsv@7.11.0/...` URLs.
837
+ canonical `unpkg.com/@smartledger/bsv@7.13.0/...` URLs.
838
838
 
839
839
  ## 🔐 Security
840
840