@smartledger/bsv 7.11.0 → 7.13.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "7.11.0",
+  "version": "7.13.0",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -231,19 +231,15 @@
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
     "bn.js": "=4.12.5",
-    "bs58": "=4.0.1",
-    "clone-deep": "^4.0.1",
-    "hash.js": "^1.1.7",
-    "inherits": "2.0.4",
-    "secrets.js-grempe": "^2.0.0",
-    "unorm": "1.6.0"
+    "secrets.js-grempe": "^2.0.0"
   },
   "devDependencies": {
     "assert": "^2.1.0",
     "browserify-zlib": "^0.2.0",
     "buffer": "^6.0.3",
     "chai": "6.2.2",
-    "crypto-browserify": "^3.12.1",
+    "create-hash": "^1.2.0",
+    "create-hmac": "^1.1.7",
     "esbuild": "^0.28.1",
     "events": "^3.3.0",
     "jose": "^5.10.0",
@@ -251,6 +247,7 @@
     "nyc": "^18.0.0",
     "path-browserify": "^1.0.1",
     "process": "^0.11.10",
+    "randombytes": "^2.1.0",
     "sinon": "22.1.0",
     "standard": "12.0.1",
     "stream-browserify": "^3.0.0",
@@ -258,6 +255,15 @@
     "util": "^0.12.5",
     "vm-browserify": "^1.1.2"
   },
+  "overrides": {
+    "js-yaml@^3": "^3.15.1",
+    "js-yaml@^4": "^4.3.1",
+    "serialize-javascript": "^7.0.5",
+    "tmp": "^0.2.7",
+    "mocha": {
+      "diff": "^8.0.3"
+    }
+  },
   "license": "MIT",
   "standard": {
     "globals": [
@@ -266,7 +272,8 @@
       "before",
       "beforeEach",
       "describe",
-      "it"
+      "it",
+      "globalThis"
     ],
     "ignore": [
       "dist/**",

package/test/build/bundle_crypto_shim.js

@@ -0,0 +1,104 @@
+'use strict'
+
+/* global describe, it, before */
+
+// The browser `crypto` polyfill is our own three-function shim, not crypto-browserify.
+//
+// Two things have to hold, and neither is visible to a test that stays inside lib/.
+//
+// 1. `elliptic` must not re-enter the bundles. It carries an advisory with no patched
+//    version, and it is reachable from crypto-browserify via browserify-sign and
+//    create-ecdh. build/esbuild.js used to keep it out with a hand-written onResolve
+//    stub; removing crypto-browserify removed the need for the stub, and this file
+//    replaces it. A stub is silent when it stops matching — an assertion is not.
+//
+// 2. The shim must keep implementing what the bundles actually call. If someone adds a
+//    `crypto.pbkdf2` call to a bundled module, resolution still succeeds and the member
+//    is simply `undefined`, so the failure surfaces far from its cause.
+//
+// The known-answer test exists because "the bundle builds" and "the bundle hashes
+// correctly" are different claims, and only the second one matters to a caller.
+
+require('chai').should()
+var crypto = require('crypto')
+var esbuild = require('../../build/esbuild.js')
+var shim = require('../../build/esbuild/crypto-shim.js')
+
+// Reachable from crypto-browserify; `elliptic` is the one with no fix available.
+var BANNED = ['elliptic', 'browserify-sign', 'create-ecdh', 'crypto-browserify']
+
+describe('browser crypto shim', function () {
+  this.timeout(300000)
+
+  var pkgsByBundle = {}
+
+  before(function () {
+    return Promise.all(esbuild.BUNDLES.map(function (cfg) {
+      return esbuild.buildOne(cfg, { metafile: true, write: false, logLevel: 'silent' })
+        .then(function (result) {
+          pkgsByBundle[cfg.file] = Object.keys(result.metafile.inputs)
+            .map(function (p) {
+              var m = /node_modules\/((?:@[^/]+\/)?[^/]+)\//.exec(p)
+              return m && m[1]
+            })
+            .filter(Boolean)
+        })
+    }))
+  })
+
+  it('built every bundle', function () {
+    esbuild.BUNDLES.length.should.be.above(0)
+    Object.keys(pkgsByBundle).length.should.equal(esbuild.BUNDLES.length)
+  })
+
+  // Guard against the graph being empty for an unrelated reason, which would make the
+  // "no banned packages" assertion below pass without checking anything.
+  it('resolved a non-trivial dependency graph', function () {
+    Object.keys(pkgsByBundle).forEach(function (file) {
+      pkgsByBundle[file].length.should.be.above(0, file + ' has no node_modules inputs')
+    })
+  })
+
+  it('pulls no part of the elliptic chain into any bundle', function () {
+    var offenders = []
+    Object.keys(pkgsByBundle).forEach(function (file) {
+      BANNED.forEach(function (pkg) {
+        if (pkgsByBundle[file].indexOf(pkg) !== -1) offenders.push(file + ' → ' + pkg)
+      })
+    })
+    offenders.should.deep.equal([])
+  })
+
+  it('exports exactly the members the bundles call', function () {
+    Object.keys(shim).sort().should.deep.equal(['createHash', 'createHmac', 'randomBytes'])
+  })
+
+  // Deliberately absent: secrets.js-grempe prefers getRandomValues over randomBytes when
+  // it is present, so exporting it would silently move the Shamir CSPRNG to another code
+  // path. crypto-browserify did not expose it either.
+  it('does not expose getRandomValues', function () {
+    ;(shim.getRandomValues === undefined).should.equal(true)
+  })
+
+  it('hashes identically to node crypto', function () {
+    ['', 'abc', 'The quick brown fox jumps over the lazy dog'].forEach(function (input) {
+      ;['sha1', 'sha256', 'sha512', 'ripemd160'].forEach(function (alg) {
+        shim.createHash(alg).update(input).digest('hex')
+          .should.equal(crypto.createHash(alg).update(input).digest('hex'), alg + ' of ' + JSON.stringify(input))
+      })
+    })
+  })
+
+  it('hmacs identically to node crypto', function () {
+    shim.createHmac('sha512', Buffer.from('key')).update('message').digest('hex')
+      .should.equal(crypto.createHmac('sha512', Buffer.from('key')).update('message').digest('hex'))
+  })
+
+  it('draws distinct random bytes of the requested length', function () {
+    var a = shim.randomBytes(32)
+    var b = shim.randomBytes(32)
+    a.length.should.equal(32)
+    b.length.should.equal(32)
+    a.toString('hex').should.not.equal(b.toString('hex'))
+  })
+})

package/test/build/bundle_externals.js

@@ -74,7 +74,12 @@ describe('feature bundles externalise the shared primitives', function () {
     // Named FILES, not the directory. `lib/util/` as a prefix exempts anything added
     // under it later, including something stateful — which is the property this test
     // exists to prevent. Listing them means a new util file has to be considered.
-    var SHARED = ['lib/util/_.js', 'lib/util/preconditions.js', 'lib/util/js.js']
+    //
+    // And listing ONLY what is actually embedded, for the same reason: naming a file
+    // that no bundle pulls in pre-approves it, so the consideration never happens.
+    // Measured — `lib/util/_.js` is the only one today. If a bundle starts needing
+    // another, this line should change in the same commit that causes it.
+    var SHARED = ['lib/util/_.js']
     var EXPECTED = {
       'bsv-ecies.min.js': ['lib/ecies/'],
       'bsv-message.min.js': ['lib/message/'],

package/test/crypto/backend_selection.js

@@ -0,0 +1,126 @@
+'use strict'
+
+/* global describe, it */
+
+// The hashing and PBKDF2 backends are chosen by CAPABILITY, not by `process.browser`.
+//
+// `process.browser` is a Browserify-era convention, undefined in React Native, Deno,
+// Cloudflare Workers and Bun. Every one of those took the node branch and
+// require('crypto')'d, which fails outright in React Native or — worse — resolves to a
+// partial shim. rn-nodeify and several RN starter templates register exactly such a
+// shim, so this is a reported failure mode, not a hypothetical one.
+//
+// Each case runs in a child process because it has to intercept module resolution
+// before lib/ is loaded, which cannot be undone safely in-process.
+
+require('chai').should()
+var path = require('path')
+var spawnSync = require('child_process').spawnSync
+
+var ROOT = path.resolve(__dirname, '../..')
+var SHA256_ABC = 'ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad'
+
+// Run `body` with Module._load intercepted by `stub`, and print the result of `report`.
+function inChild (stub, report) {
+  var src = [
+    'var Module = require("module"), orig = Module._load',
+    'var real = orig.call(Module, "crypto", module, false)',
+    'Module._load = function (r) {',
+    '  if (r === "crypto") { ' + stub + ' }',
+    '  return orig.apply(this, arguments)',
+    '}',
+    // Only the pure-JS backend is loaded for comparison. hash.node.js require()s
+    // 'crypto' at module scope, so it is not even loadable when the stub removes it —
+    // which is precisely why hash.js must not reach for it unconditionally.
+    'var HASH = require(' + JSON.stringify(path.join(ROOT, 'lib/crypto/hash.js')) + ')',
+    'var PURE = require(' + JSON.stringify(path.join(ROOT, 'lib/crypto/hash.browser.js')) + ')',
+    'console.log(' + report + ')'
+  ].join('\n')
+  var out = spawnSync(process.execPath, ['-e', src], { encoding: 'utf8' })
+  if (out.status !== 0) throw new Error('child failed: ' + out.stderr)
+  return out.stdout.trim()
+}
+
+describe('crypto backend selection', function () {
+  this.timeout(30000)
+
+  it('uses node crypto when it is present and correct', function () {
+    // Not the pure-JS module => the node backend was selected.
+    inChild('return real', '(HASH !== PURE) + " " + HASH.sha256(Buffer.from("abc")).toString("hex")')
+      .should.equal('true ' + SHA256_ABC)
+  })
+
+  it('falls back to the pure-JS backend when there is no crypto module', function () {
+    inChild('var e = new Error("no crypto"); e.code = "MODULE_NOT_FOUND"; throw e',
+      '(HASH === PURE) + " " + HASH.sha256(Buffer.from("abc")).toString("hex")')
+      .should.equal('true ' + SHA256_ABC)
+  })
+
+  // The important one. A shim that EXISTS but computes the wrong digest must be
+  // rejected — trusting it would silently corrupt every hash in the library, and a
+  // wrong hash is invisible until it matters.
+  it('rejects a crypto shim that returns incorrect digests', function () {
+    inChild(
+      'return { createHash: function () { return { update: function () { return this }, ' +
+      'digest: function () { return "deadbeef" } } } }',
+      '(HASH === PURE) + " " + HASH.sha256(Buffer.from("abc")).toString("hex")')
+      .should.equal('true ' + SHA256_ABC)
+  })
+
+  // OpenSSL 3 moved ripemd160 to the legacy provider, so some Node builds have sha256
+  // but throw on ripemd160 — and ripemd160 is what addresses are built from.
+  it('rejects a crypto build without ripemd160', function () {
+    inChild(
+      'return Object.assign({}, real, { createHash: function (a) { ' +
+      'if (a === "ripemd160") throw new Error("Digest method not supported"); ' +
+      'return real.createHash(a) } })',
+      '(HASH === PURE) + " " + HASH.sha256ripemd160(Buffer.from("abc")).toString("hex").slice(0, 16)')
+      .should.equal('true bb1be98c142444d7')
+  })
+
+  it('does not consult process.browser', function () {
+    var src = [
+      'process.browser = undefined',
+      'var a = require(' + JSON.stringify(path.join(ROOT, 'lib/crypto/hash.js')) + ')',
+      'console.log(a.sha256(Buffer.from("abc")).toString("hex"))'
+    ].join('\n')
+    var withoutFlag = spawnSync(process.execPath, ['-e', src], { encoding: 'utf8' })
+    var withFlag = spawnSync(process.execPath, ['-e', 'process.browser = true\n' + src.split('\n').slice(1).join('\n')], { encoding: 'utf8' })
+    withoutFlag.stdout.trim().should.equal(SHA256_ABC)
+    withFlag.stdout.trim().should.equal(SHA256_ABC)
+  })
+
+  describe('pbkdf2', function () {
+    // BIP-39 English test vector; the seed must not depend on which backend ran.
+    var PHRASE = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about'
+    var SEED = 'c55257c360c07c72029aebc1b53c05ed0362ada38ead3e3e9efa3708e53495531f09a6987599d18264c1e1c92f2cf141630c7a3c4ab7c81b2f001698e7463b04'
+
+    function seedInChild (stub) {
+      var src = [
+        'var Module = require("module"), orig = Module._load',
+        'var real = orig.call(Module, "crypto", module, false)',
+        'Module._load = function (r) { if (r === "crypto") { ' + stub + ' } return orig.apply(this, arguments) }',
+        'var bsv = require(' + JSON.stringify(ROOT) + ')',
+        'console.log(new bsv.Mnemonic(' + JSON.stringify(PHRASE) + ').toSeed("TREZOR").toString("hex"))'
+      ].join('\n')
+      var out = spawnSync(process.execPath, ['-e', src], { encoding: 'utf8' })
+      if (out.status !== 0) throw new Error('child failed: ' + out.stderr)
+      return out.stdout.trim()
+    }
+
+    it('derives the BIP-39 vector with node crypto', function () {
+      seedInChild('return real').should.equal(SEED)
+    })
+
+    it('derives the same seed with no crypto module', function () {
+      seedInChild('var e = new Error("no crypto"); e.code = "MODULE_NOT_FOUND"; throw e').should.equal(SEED)
+    })
+
+    it('rejects a shim whose HMAC is wrong and still derives the right seed', function () {
+      seedInChild(
+        'return Object.assign({}, real, { createHmac: function () { return { ' +
+        'update: function () { return this }, digest: function () { return Buffer.alloc(64) } } } })'
+      ).should.equal(SEED)
+    })
+  })
+})

package/test/crypto/random.js

@@ -28,5 +28,78 @@ describe('Random', function () {
         }
       }
     })
+
+    // WebCrypto refuses more than 65,536 bytes per call. Before chunking, a request
+    // above that limit threw; a naive implementation that ignored the return size
+    // instead would hand back a zero-filled tail, which is far worse than throwing.
+    it('fills requests larger than the 65536-byte getRandomValues limit', function () {
+      var buf = Random.getRandomBuffer(70000)
+      buf.length.should.equal(70000)
+      // The tail comes from a second call — assert it is real entropy, not zero padding.
+      var tail = buf.subarray(65536)
+      tail.some(function (b) { return b !== 0 }).should.equal(true)
+      buf.subarray(0, 32).toString('hex').should.not.equal(tail.subarray(0, 32).toString('hex'))
+    })
+
+    it('handles the exact limit and one past it', function () {
+      Random.getRandomBuffer(65536).length.should.equal(65536)
+      Random.getRandomBuffer(65537).length.should.equal(65537)
+    })
+
+    // The backend is chosen by feature detection. This used to branch on
+    // `process.browser`, which is undefined in React Native, Deno, Workers and Bun —
+    // all of which then fell through to require('crypto').randomBytes. Where a partial
+    // crypto shim supplies a weak randomBytes, that produced guessable keys silently.
+    it('does not depend on process.browser', function () {
+      var saved = process.browser
+      try {
+        process.browser = undefined
+        Random.getRandomBuffer(16).length.should.equal(16)
+        process.browser = true
+        Random.getRandomBuffer(16).length.should.equal(16)
+      } finally {
+        process.browser = saved
+      }
+    })
+
+    it('prefers globalThis.crypto.getRandomValues when present', function () {
+      var calls = 0
+      var real = Object.getOwnPropertyDescriptor(globalThis, 'crypto')
+      try {
+        Object.defineProperty(globalThis, 'crypto', {
+          configurable: true,
+          value: {
+            getRandomValues: function (arr) {
+              calls++
+              for (var i = 0; i < arr.length; i++) arr[i] = (i * 7 + 3) & 0xff
+              return arr
+            }
+          }
+        })
+        var buf = Random.getRandomBuffer(4)
+        calls.should.equal(1)
+        buf.toString('hex').should.equal('030a1118')
+      } finally {
+        if (real) Object.defineProperty(globalThis, 'crypto', real)
+      }
+    })
+
+    // The throw matters as much as the detection: a key library must never return bytes
+    // it cannot vouch for. Verified in a child process because it has to remove both
+    // backends, which cannot be undone safely in-process.
+    it('throws rather than returning bytes when no CSPRNG exists', function () {
+      var out = require('child_process').spawnSync(process.execPath, ['-e', [
+        'var Module = require("module"), orig = Module._load',
+        'delete globalThis.crypto',
+        'Module._load = function (r) {',
+        '  if (r === "crypto") { var e = new Error("no crypto"); e.code = "MODULE_NOT_FOUND"; throw e }',
+        '  return orig.apply(this, arguments)',
+        '}',
+        'var R = require(' + JSON.stringify(require.resolve('../../lib/crypto/random.js')) + ')',
+        'try { R.getRandomBuffer(32); console.log("RETURNED") }',
+        'catch (e) { console.log("THREW") }'
+      ].join('\n')], { encoding: 'utf8' })
+      out.stdout.trim().should.equal('THREW')
+    })
   })
 })

package/test/didweb/relationships.js

@@ -0,0 +1,144 @@
+'use strict'
+
+/* global describe, it */
+
+// DID Core defines the verification relationships to be DISTINCT. `authentication`
+// proves who you are right now; `assertionMethod` makes a claim that outlives the
+// session. Keeping them apart is what stops a low-friction login signature from being
+// redeemed as a signed statement.
+//
+// This module used to cross-list every key into both, and `rotateIssuerKey` rewrote both
+// regardless of which one was being rotated — so replacing a compromised authentication
+// key invalidated every statement the issuer had ever signed.
+
+require('chai').should()
+var didweb = require('../../lib/didweb')
+
+var DOMAIN = 'example.com'
+var DID = 'did:web:example.com'
+var P256 = { kid: 'auth-1', jwk: { kty: 'EC', crv: 'P-256', x: 'a', y: 'b' } }
+var K1 = { kid: 'sign-1', jwk: { kty: 'EC', crv: 'secp256k1', x: 'c', y: 'd' } }
+
+function scoped (key, rels) {
+  return { kid: key.kid, jwk: key.jwk, relationships: rels }
+}
+
+describe('did:web verification relationships', function () {
+  describe('buildDidWebDocuments', function () {
+    // The compatibility guarantee: callers that never heard of `relationships` must get
+    // byte-identical documents, including key order.
+    it('keeps the previous output when no relationships are given', function () {
+      var doc = didweb.buildDidWebDocuments({ domain: DOMAIN, p256: P256, k1: K1 }).didDocument
+      doc.authentication.should.deep.equal([DID + '#auth-1', DID + '#sign-1'])
+      doc.assertionMethod.should.deep.equal([DID + '#auth-1', DID + '#sign-1'])
+      Object.keys(doc).should.deep.equal([
+        '@context', 'id', 'verificationMethod', 'authentication', 'assertionMethod'
+      ])
+    })
+
+    it('scopes each key to the relationships it was given', function () {
+      var doc = didweb.buildDidWebDocuments({
+        domain: DOMAIN,
+        p256: scoped(P256, ['authentication']),
+        k1: scoped(K1, ['assertionMethod'])
+      }).didDocument
+      doc.authentication.should.deep.equal([DID + '#auth-1'])
+      doc.assertionMethod.should.deep.equal([DID + '#sign-1'])
+    })
+
+    it('supports the other three relationships and omits empty ones', function () {
+      var doc = didweb.buildDidWebDocuments({
+        domain: DOMAIN,
+        p256: scoped(P256, ['keyAgreement', 'capabilityInvocation', 'capabilityDelegation'])
+      }).didDocument
+      doc.keyAgreement.should.deep.equal([DID + '#auth-1'])
+      doc.capabilityInvocation.should.deep.equal([DID + '#auth-1'])
+      doc.capabilityDelegation.should.deep.equal([DID + '#auth-1'])
+      ;(doc.authentication === undefined).should.equal(true)
+      ;(doc.assertionMethod === undefined).should.equal(true)
+    })
+
+    it('rejects an unknown relationship rather than silently dropping it', function () {
+      ;(function () {
+        didweb.buildDidWebDocuments({ domain: DOMAIN, p256: scoped(P256, ['notARelationship']) })
+      }).should.throw(/unknown verification relationship/)
+    })
+
+    it('rejects an empty relationship list', function () {
+      ;(function () {
+        didweb.buildDidWebDocuments({ domain: DOMAIN, p256: scoped(P256, []) })
+      }).should.throw(/non-empty array/)
+    })
+  })
+
+  describe('rotateIssuerKey', function () {
+    function currentDoc () {
+      return didweb.buildDidWebDocuments({
+        domain: DOMAIN,
+        p256: scoped(P256, ['authentication']),
+        k1: scoped(K1, ['assertionMethod'])
+      }).didDocument
+    }
+
+    // The reported failure. Rotating a compromised auth key must not touch
+    // assertionMethod, or every seal the issuer ever made stops verifying.
+    it('leaves assertionMethod intact when only authentication is rotated', function () {
+      var before = currentDoc()
+      var after = didweb.rotateIssuerKey({
+        domain: DOMAIN,
+        newKey: { kid: 'auth-2', jwk: { kty: 'EC', crv: 'P-256', x: 'e', y: 'f' }, relationships: ['authentication'] },
+        currentDocument: before
+      }).didDocument
+
+      after.authentication.should.deep.equal([DID + '#auth-2'])
+      after.assertionMethod.should.deep.equal(before.assertionMethod)
+    })
+
+    it('still defines the key that the carried-over relationship points at', function () {
+      var after = didweb.rotateIssuerKey({
+        domain: DOMAIN,
+        newKey: { kid: 'auth-2', jwk: { kty: 'EC' }, relationships: ['authentication'] },
+        currentDocument: currentDoc()
+      }).didDocument
+
+      var defined = after.verificationMethod.map(function (vm) { return vm.id })
+      // Every referenced id resolves — no dangling references.
+      Object.keys(after).forEach(function (k) {
+        if (Array.isArray(after[k]) && k !== 'verificationMethod' && k !== '@context') {
+          after[k].forEach(function (id) { defined.indexOf(id).should.be.above(-1, k + ' references undefined ' + id) })
+        }
+      })
+    })
+
+    it('drops the rotated-out key, which nothing references any more', function () {
+      var after = didweb.rotateIssuerKey({
+        domain: DOMAIN,
+        newKey: { kid: 'auth-2', jwk: { kty: 'EC' }, relationships: ['authentication'] },
+        currentDocument: currentDoc()
+      }).didDocument
+      after.verificationMethod.some(function (vm) {
+        return vm.id === DID + '#auth-1'
+      }).should.equal(false)
+    })
+
+    it('keeps the previous behaviour with no currentDocument', function () {
+      var doc = didweb.rotateIssuerKey({
+        domain: DOMAIN, newKey: { kid: 'k9', jwk: { kty: 'EC' } }
+      }).didDocument
+      doc.authentication.should.deep.equal([DID + '#k9'])
+      doc.assertionMethod.should.deep.equal([DID + '#k9'])
+      doc.verificationMethod.length.should.equal(1)
+      Object.keys(doc).should.deep.equal([
+        '@context', 'id', 'verificationMethod', 'authentication', 'assertionMethod', 'rotationInfo'
+      ])
+    })
+
+    it('still reports rotationInfo', function () {
+      var doc = didweb.rotateIssuerKey({
+        domain: DOMAIN, newKey: { kid: 'k9', jwk: { kty: 'EC' } }, keepOldForDays: 7
+      }).didDocument
+      doc.rotationInfo.gracePeriodDays.should.equal(7)
+      doc.rotationInfo.rotatedAt.should.be.a('string')
+    })
+  })
+})

package/test/transaction/unspentoutput.js

@@ -2,7 +2,12 @@
 
 var chai = require('chai')
 var expect = chai.expect
-var cloneDeep = require('clone-deep')
+/* global structuredClone */
+// structuredClone, not the former clone-deep dependency: the fixture below is plain
+// JSON (strings and numbers), where the two are equivalent. The interpreter's stack
+// clone is NOT — it holds Buffers, which structuredClone would return as Uint8Array.
+// The global comment is for standard@12's eslint, which predates the API.
+var cloneDeep = structuredClone
 
 var bsv = require('../..')
 var UnspentOutput = bsv.Transaction.UnspentOutput

package/version.js

@@ -1,3 +1,3 @@
 'use strict'
 // GENERATED by scripts/sync-version.js on `npm version` — do not edit.
-module.exports = '7.11.0'
+module.exports = '7.13.0'