@smartledger/bsv 7.12.0 → 7.13.0

package/docs/AUDIT_SCOPE.md

@@ -5,8 +5,7 @@ cryptographic core, and carries the enquiry text to send to vendors. It exists s
 every vendor prices the *same* thing, and so that the reasoning behind the scope
 boundary survives past the engagement that prompted it.
 
-Measured against **v7.12.0**, 2026-08-10 (`lib/` is byte-identical to v7.11.0, where these
-figures were first taken). Re-measure before sending if the version has
+Measured against **v7.13.0**, 2026-08-11. Re-measure before sending if the version has
 moved (`docs/AUDIT_SCOPE.md` is not covered by a drift gate).
 
 ## 1. The question we are asking
@@ -30,24 +29,24 @@ testing.
 Two tiers, to be **priced separately** so the boundary can be drawn against a number
 rather than before seeing one.
 
-### Tier 1 — core, 11,739 lines across 33 files
+### Tier 1 — core, 11,879 lines across 33 files
 
 | Module | Lines | Why it matters |
 | --- | ---: | --- |
-| `lib/script/` | 3,375 | Consensus script interpreter. Divergence from the node means accepting a transaction the network rejects, or the reverse. |
+| `lib/script/` | 3,394 | Consensus script interpreter. Divergence from the node means accepting a transaction the network rejects, or the reverse. |
 | `lib/transaction/` | 2,767 | Sighash construction and signing — both BIP-143 and the Original Transaction Digest Algorithm. |
-| `lib/crypto/` | 2,378 | ECDSA, nonce derivation, signature encoding, the script-number type. |
+| `lib/crypto/` | 2,499 | ECDSA, nonce derivation, signature encoding, the script-number type. |
 | `lib/hdprivatekey.js`, `lib/hdpublickey.js` | 1,168 | BIP-32 derivation, including hardened paths. |
 | `lib/privatekey.js`, `lib/publickey.js` | 843 | Key construction, serialisation, WIF. Recent defects here produced a *different* key without error. |
 | `lib/address.js` | 543 | Address derivation and network binding. |
 | `lib/networks.js`, `lib/opcode.js` | 665 | Network parameters and the opcode table, which BSV upgrades have reassigned. |
 
-### Tier 2 — optional, 1,496 lines
+### Tier 2 — optional, 1,607 lines
 
 | Module | Lines | Why it may belong in scope |
 | --- | ---: | --- |
-| `lib/encoding/` | 644 | Base58Check, varint and buffer readers — the parsing surface untrusted bytes hit first. |
-| `lib/mnemonic/` | 544 | BIP-39 seed derivation. Small, but a weakness here compromises every key beneath it. |
+| `lib/encoding/` | 708 | Base58Check, varint and buffer readers — the parsing surface untrusted bytes hit first. |
+| `lib/mnemonic/` | 591 | BIP-39 seed derivation. Small, but a weakness here compromises every key beneath it. |
 | `lib/ecies/` | 308 | Encryption built on audited primitives; the composition is ours. |
 
 Tier 2 is cryptographic rather than application code, so excluding it is a **budget
@@ -59,19 +58,19 @@ is not.
 | Component | Status | Reason |
 | --- | --- | --- |
 | `@noble/curves`, `@noble/hashes`, `@noble/ciphers` | Already audited | The primitives come from the Noble libraries, which **Cure53 has audited and published on**. We do not implement curve or hash arithmetic ourselves. State this explicitly to vendors — otherwise they price work we do not need. |
-| `lib/smart_contract/`, `lib/ltp/`, `lib/gdaf/`, `lib/ordinals/`, `lib/block/`, plus 9 further directories and 6 top-level files | Excluded | Application layer, 22,699 lines — 18,435 in the five named modules and 4,264 in the remainder. Written in-house and covered by adversarial tests. Worth a separate engagement; including it here would blur the question in §1. |
+| `lib/smart_contract/`, `lib/ltp/`, `lib/gdaf/`, `lib/ordinals/`, `lib/block/`, plus 9 further directories and 6 top-level files | Excluded | Application layer, 22,815 lines — 18,435 in the five named modules and 4,380 in the remainder. Written in-house and covered by adversarial tests. Worth a separate engagement; including it here would blur the question in §1. |
 
-Totals reconcile against `lib/`, which is 35,934 lines across 122 files:
+Totals reconcile against `lib/`, which is 36,301 lines across 123 files:
 
 ```
-tier 1      11,739
-tier 2       1,496
-excluded    22,699
+tier 1      11,879
+tier 2       1,607
+excluded    22,815
             ------
-total       35,934
+total       36,301
 ```
 
-Core + optional = 13,235.
+Core + optional = 13,486.
 
 ## 4. What an auditor gets on day one
 
@@ -125,17 +124,17 @@ seeking a quote for an independent security review of its cryptographic core.
 
 Scope, and we would like these priced separately:
 
-  Tier 1 — 11,739 lines, 33 files. Script interpreter, sighash and signing,
+  Tier 1 — 11,879 lines, 33 files. Script interpreter, sighash and signing,
   ECDSA and signature encoding, BIP-32 derivation, key and address
   construction.
 
-  Tier 2 — 1,496 lines. BIP-39 mnemonics, ECIES, and the Base58Check/varint
+  Tier 2 — 1,607 lines. BIP-39 mnemonics, ECIES, and the Base58Check/varint
   decoding surface.
 
 JavaScript (CommonJS), Node >= 20.19. The code is public.
 
 Explicitly out of scope: elliptic-curve and hash primitives, which are supplied
-by the Noble libraries and already audited; and our 22,699-line application
+by the Noble libraries and already audited; and our 22,815-line application
 layer (credentials, tokens, ordinals), which we would treat as a separate
 engagement.
 
@@ -163,7 +162,7 @@ SmartLedger Technology
 Every figure in this document, including the excluded total, must come out of this
 script. **Derive the excluded count as the complement — never by subtracting tier 1
 alone.** The first draft did exactly that, double-counted tier 2, and published parts
-summing to 37,430 against a 35,934 whole; §7 could not catch it because it reproduced
+summing to 37,430 against a 36,301 whole; §7 could not catch it because it reproduced
 every figure except the wrong one.
 
 ```sh

package/docs/MODULE_REFERENCE_COMPLETE.md

@@ -55,19 +55,19 @@ Three advanced modules totaling **~2.7MB** of functionality:
 - **Purpose**: Threshold cryptography for secure secret distribution
 - **Use Cases**: Backup keys, multi-party security, key recovery
 - **Features**: Split secrets into N shares, require M to reconstruct
-- **CDN**: `unpkg.com/@smartledger/bsv@7.12.0/bsv-shamir.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@7.13.0/bsv-shamir.min.js`
 
 #### **🌐 Global Digital Attestation Framework - GDAF (1184KB)**  
 - **Purpose**: W3C Verifiable Credentials and decentralized identity
 - **Use Cases**: Identity verification, attestations, zero-knowledge proofs
 - **Features**: DID creation, credential issuance, selective disclosure
-- **CDN**: `unpkg.com/@smartledger/bsv@7.12.0/bsv-gdaf.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@7.13.0/bsv-gdaf.min.js`
 
 #### **⚖️ Legal Token Protocol - LTP (1184KB)**
 - **Purpose**: Legal compliance framework for tokenized assets
 - **Use Cases**: Property rights, obligations, compliant tokenization  
 - **Features**: Legal primitives, compliance checking, attestation anchoring
-- **CDN**: `unpkg.com/@smartledger/bsv@7.12.0/bsv-ltp.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@7.13.0/bsv-ltp.min.js`
 
 ### **2. Incorrect File Sizes in Documentation**
 
@@ -81,18 +81,18 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 | Module | Size | Use Case | CDN Link |
 |--------|------|----------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.12.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@7.12.0/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.12.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.12.0/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.12.0/bsv-security.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.12.0/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.12.0/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.12.0/bsv-mnemonic.min.js` |
-| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@7.12.0/bsv-shamir.min.js` |
-| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@7.12.0/bsv-gdaf.min.js` |
-| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@7.12.0/bsv-ltp.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.13.0/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@7.13.0/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.13.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.13.0/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.13.0/bsv-security.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.13.0/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.13.0/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.13.0/bsv-mnemonic.min.js` |
+| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@7.13.0/bsv-shamir.min.js` |
+| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@7.13.0/bsv-gdaf.min.js` |
+| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@7.13.0/bsv-ltp.min.js` |
 
 ## 🎯 **Updated Usage Examples**
 
@@ -100,22 +100,22 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **1. Basic Development (~963KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-script-helper.min.js"></script>
 ```
 
 #### **2. Smart Contract Development (~2.7MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-smartcontract.min.js"></script>
 ```
 
 #### **3. 🆕 Legal & Compliance Development (~3.2MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const legalToken = bsv.createLegalToken({
@@ -132,9 +132,9 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **4. 🆕 Security & Cryptography (~1.4MB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-shamir.min.js"></script>
 <script>
   // Shamir Secret Sharing
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -146,7 +146,7 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **5. Everything Bundle (937KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);

package/docs/advanced/UTXO_MANAGER_GUIDE.md

@@ -722,7 +722,7 @@ interface UTXO {
 <html>
 <head>
     <title>UTXO Manager Demo</title>
-    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@7.12.0/bsv.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@7.13.0/bsv.min.js"></script>
 </head>
 <body>
     <script>

package/docs/getting-started/INSTALLATION.md

@@ -48,7 +48,7 @@ const tx: Transaction = new Transaction();
 #### **Core Library Only (937KB)**
 For basic Bitcoin SV operations:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const address = privateKey.toAddress();
@@ -58,7 +58,7 @@ For basic Bitcoin SV operations:
 #### **Complete Bundle (937KB)**  
 Everything in one file:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.bundle.js"></script>
 <script>
   // All features available immediately
   const shares = bsv.splitSecret('secret', 5, 3);
@@ -71,9 +71,9 @@ Everything in one file:
 
 #### **Smart Contract Development (~2.7MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().build();
@@ -82,9 +82,9 @@ Everything in one file:
 
 #### **Legal & Identity Development (~3.2MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -98,9 +98,9 @@ Everything in one file:
 
 #### **Security & Cryptography (~1.4MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3);
@@ -114,18 +114,18 @@ Everything in one file:
 
 | Module | Size | Purpose | CDN Link |
 |--------|------|---------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.12.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.12.0/bsv-smartcontract.min.js` |
-| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@7.12.0/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@7.12.0/bsv-gdaf.min.js` |
-| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@7.12.0/bsv-shamir.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.12.0/bsv-security.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.12.0/bsv-mnemonic.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.12.0/bsv-ecies.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.12.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.12.0/bsv-script-helper.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.12.0/bsv-message.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.13.0/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.13.0/bsv-smartcontract.min.js` |
+| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@7.13.0/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@7.13.0/bsv-gdaf.min.js` |
+| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@7.13.0/bsv-shamir.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.13.0/bsv-security.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.13.0/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.13.0/bsv-ecies.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.13.0/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.13.0/bsv-script-helper.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.13.0/bsv-message.min.js` |
 
 ## ⚙️ **Development Environment Setup**
 

package/docs/getting-started/QUICK_START.md

@@ -14,10 +14,10 @@ npm install @smartledger/bsv
 ### Browser CDN (Instant)
 ```html
 <!-- Core library (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
 
 <!-- Everything included (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.bundle.js"></script>
 ```
 
 ## 💰 **Your First Transaction (60 seconds)**
@@ -127,19 +127,19 @@ SmartLedger-BSV offers 12 different loading options - use only what you need:
 
 ```html
 <!-- Core BSV only (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
 
 <!-- Smart contracts (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-smartcontract.min.js"></script>
 
 <!-- Legal tokens (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-ltp.min.js"></script>
 
 <!-- Digital identity (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-gdaf.min.js"></script>
 
 <!-- Everything (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.bundle.js"></script>
 ```
 
 ## ⚡ **Key Advantages**

package/docs/migration/FROM_BSV_1_5_6.md

@@ -159,17 +159,17 @@ const recovered = bsv.reconstructSecret([shares[0], shares[2], shares[4]]);
 ### **New Modular Options** 
 ```html
 <!-- Core compatibility (same size as bsv@1.5.6) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.min.js"></script>
 
 <!-- Add smart contracts when ready -->
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-smartcontract.min.js"></script>
 
 <!-- Add advanced features as needed -->
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv-gdaf.min.js"></script>
 
 <!-- Everything in one file -->
-<script src="https://unpkg.com/@smartledger/bsv@7.12.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.13.0/bsv.bundle.js"></script>
 ```
 
 ## 🔍 **Testing Your Migration**

package/index.js

@@ -24,14 +24,22 @@ bsv.deps = bsv.deps || {}
 bsv.deps._ = require('./lib/util/_')
 bsv.deps.Buffer = (typeof Buffer !== 'undefined') ? Buffer : null
 
+// `bsv.deps.bs58` is kept as a compatible facade rather than the `bs58` package, which
+// this library no longer depends on — the encoder now lives in lib/encoding/base58.js.
+// The contract callers rely on is unchanged: `encode(Buffer) -> string` and
+// `decode(string) -> bytes` (a Buffer, which is a Uint8Array, as bs58 also returned).
+var Base58Dep = require('./lib/encoding/base58')
+bsv.deps.bs58 = {
+  encode: Base58Dep.encode,
+  decode: Base58Dep.decode
+}
+
 if (typeof window === 'undefined') {
   // Node — hard require; failure means broken install.
   bsv.deps.bnjs = require('bn.js')
-  bsv.deps.bs58 = require('bs58')
 } else {
   // Browser — bundler-resolved; tolerate absence individually.
   try { bsv.deps.bnjs = require('bn.js') } catch (e) { /* polyfilled by bundler */ }
-  try { bsv.deps.bs58 = require('bs58') } catch (e) { /* polyfilled by bundler */ }
 }
 
 // module information (./version is generated from package.json by the `version` npm hook;

package/lib/crypto/hash.browser.js

@@ -1,6 +1,14 @@
 'use strict'
 
-var hash = require('hash.js')
+// The browser digests come from @noble/hashes — the same audited implementation the
+// Node path's primitives ultimately rest on, and already a dependency here for
+// @noble/curves. Previously this file used `hash.js`, so the browser bundle and Node
+// computed the same digests via two different implementations; one of them was audited.
+//
+// Only the four raw digests came from that dependency. `Hash.hmac` below is
+// hand-implemented against `hashf.blocksize` and is unchanged.
+var { sha256, sha512 } = require('@noble/hashes/sha2.js')
+var { sha1, ripemd160 } = require('@noble/hashes/legacy.js')
 var $ = require('../util/preconditions')
 
 var Hash = module.exports
@@ -16,7 +24,7 @@ var Hash = module.exports
  */
 Hash.sha1 = function (buf) {
   $.checkArgument(Buffer.isBuffer(buf))
-  return Buffer.from(hash.sha1().update(buf).digest('hex'), 'hex')
+  return Buffer.from(sha1(buf))
 }
 
 Hash.sha1.blocksize = 512
@@ -32,7 +40,7 @@ Hash.sha1.blocksize = 512
  */
 Hash.sha256 = function (buf) {
   $.checkArgument(Buffer.isBuffer(buf))
-  return Buffer.from(hash.sha256().update(buf).digest('hex'), 'hex')
+  return Buffer.from(sha256(buf))
 }
 
 Hash.sha256.blocksize = 512
@@ -64,7 +72,7 @@ Hash.sha256sha256 = function (buf) {
  */
 Hash.ripemd160 = function (buf) {
   $.checkArgument(Buffer.isBuffer(buf))
-  return Buffer.from(hash.ripemd160().update(buf).digest('hex'), 'hex')
+  return Buffer.from(ripemd160(buf))
 }
 /**
  * A RIPEMD160 hash of a SHA256 hash, which is always 160 bits or 20 bytes long.
@@ -93,7 +101,7 @@ Hash.sha256ripemd160 = function (buf) {
  */
 Hash.sha512 = function (buf) {
   $.checkArgument(Buffer.isBuffer(buf))
-  return Buffer.from(hash.sha512().update(buf).digest('hex'), 'hex')
+  return Buffer.from(sha512(buf))
 }
 
 Hash.sha512.blocksize = 1024

package/lib/crypto/hash.js

@@ -1,2 +1,58 @@
-if (process.browser) module.exports = require('./hash.browser')
-else module.exports = require('./hash.node')
+'use strict'
+
+// Pick the hashing backend by CAPABILITY, not by `process.browser`.
+//
+// This file used to read `process.browser`, a Browserify-era convention that is
+// undefined in React Native, Deno, Cloudflare Workers and Bun. All of them took the
+// node branch and required('crypto'), which in React Native fails outright or — worse —
+// resolves to a partial shim. See lib/crypto/random.js for the same bug in the CSPRNG.
+//
+// Node's implementation is kept as the preferred backend rather than always using
+// @noble/hashes, because it is materially faster on the payload sizes this library
+// actually hashes in bulk: measured at parity for 32 bytes (1.2x) but ~10x for 64 KB
+// and above, which is block parsing and document anchoring.
+//
+// Two capability checks, not one:
+//
+//   - The digests must be CORRECT, verified against known-answer vectors. A partial
+//     crypto shim that supplies a wrong or stubbed createHash would otherwise silently
+//     corrupt every hash in the library. Falling back to the audited pure-JS
+//     implementation is always safe; trusting an unknown shim is not.
+//   - `ripemd160` must be present. OpenSSL 3 moved it to the legacy provider, so some
+//     Node builds have sha256 but throw on ripemd160 — which is what addresses are
+//     built from, making this a real failure and not a theoretical one.
+//
+// The probe costs four hashes of three bytes, once, at module load.
+
+var VECTORS = {
+  sha1: 'a9993e364706816aba3e25717850c26c9cd0d89d',
+  sha256: 'ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad',
+  sha512: 'ddaf35a193617abacc417349ae20413112e6fa4e89a97ea20a9eeee64b55d39a' +
+          '2192992a274fc1a836ba3c23a3feebbd454d4423643ce80e2a9ac94fa54ca49f',
+  ripemd160: '8eb208f7e05d987a9b044a8e98c6b087f15a0bfc'
+}
+
+function nodeHashesAreUsable () {
+  var crypto
+  try {
+    crypto = require('crypto')
+  } catch (e) {
+    return false
+  }
+  if (!crypto || typeof crypto.createHash !== 'function') return false
+
+  var algorithms = Object.keys(VECTORS)
+  for (var i = 0; i < algorithms.length; i++) {
+    var algorithm = algorithms[i]
+    try {
+      if (crypto.createHash(algorithm).update('abc').digest('hex') !== VECTORS[algorithm]) {
+        return false
+      }
+    } catch (e) {
+      return false
+    }
+  }
+  return true
+}
+
+module.exports = nodeHashesAreUsable() ? require('./hash.node') : require('./hash.browser')

package/lib/crypto/random.js

@@ -1,37 +1,94 @@
 'use strict'
 
+// WebCrypto refuses more than 65,536 bytes in a single getRandomValues() call, so large
+// requests are filled in chunks. Node's randomBytes has no such limit, which is why this
+// only matters on the WebCrypto path.
+var MAX_GET_RANDOM_VALUES = 65536
+
 function Random () {
 }
 
-/* secure random bytes that sometimes throws an error due to lack of entropy */
+/**
+ * Cryptographically secure random bytes.
+ *
+ * Backend selection is by FEATURE DETECTION, not by environment guess. This previously
+ * branched on `process.browser` — a Browserify-era convention that is undefined in React
+ * Native, Deno, Cloudflare Workers, Bun, and any bundler that does not shim it. All of
+ * those fell through to `require('crypto').randomBytes`. In React Native that is a hard
+ * failure at best; at worst a partial crypto shim (rn-nodeify and several RN starter
+ * templates register one) supplies a weak `randomBytes`, and `PrivateKey.fromRandom()`
+ * silently produces guessable keys.
+ *
+ * `globalThis.crypto.getRandomValues` covers browsers, Node >= 19, Deno, Workers, Bun,
+ * and React Native with react-native-get-random-values, so it is tried first.
+ *
+ * If no CSPRNG can be found this THROWS. That is as important as the detection: a key
+ * library must never return bytes it cannot vouch for.
+ *
+ * @param {number} size - number of bytes
+ * @returns {Buffer}
+ */
 Random.getRandomBuffer = function (size) {
-  if (process.browser) { return Random.getRandomBufferBrowser(size) } else { return Random.getRandomBufferNode(size) }
+  var webcrypto = typeof globalThis !== 'undefined' ? globalThis.crypto : undefined
+  if (webcrypto && typeof webcrypto.getRandomValues === 'function') {
+    return Random._fromGetRandomValues(webcrypto, size)
+  }
+
+  // Node < 19 has no global crypto. Kept as a fallback rather than the default.
+  try {
+    var nodeCrypto = require('crypto')
+    if (nodeCrypto && typeof nodeCrypto.randomBytes === 'function') {
+      return nodeCrypto.randomBytes(size)
+    }
+  } catch (e) { /* no node crypto in this environment */ }
+
+  throw new Error('bsv: no CSPRNG available in this environment (needs globalThis.crypto.getRandomValues or node crypto)')
 }
 
+/**
+ * Fill `size` bytes from a WebCrypto instance, respecting the per-call limit.
+ * @private
+ */
+Random._fromGetRandomValues = function (webcrypto, size) {
+  var buf = Buffer.alloc(size)
+  for (var offset = 0; offset < size; offset += MAX_GET_RANDOM_VALUES) {
+    var chunk = new Uint8Array(Math.min(MAX_GET_RANDOM_VALUES, size - offset))
+    webcrypto.getRandomValues(chunk)
+    Buffer.from(chunk).copy(buf, offset)
+  }
+  return buf
+}
+
+/**
+ * Node-specific CSPRNG. Retained as public API; `getRandomBuffer` no longer routes
+ * here by default.
+ */
 Random.getRandomBufferNode = function (size) {
   var crypto = require('crypto')
   return crypto.randomBytes(size)
 }
 
+/**
+ * WebCrypto CSPRNG. Retained as public API.
+ *
+ * Reads `globalThis` rather than a bare `window`, which does not exist in Web Workers,
+ * Node, or React Native.
+ */
 Random.getRandomBufferBrowser = function (size) {
-  if (!window.crypto && !window.msCrypto) {
-    throw new Error('window.crypto not available')
+  var g = typeof globalThis !== 'undefined' ? globalThis : {}
+  var crypto = null
+
+  if (g.crypto && typeof g.crypto.getRandomValues === 'function') {
+    crypto = g.crypto
+  } else if (g.msCrypto && typeof g.msCrypto.getRandomValues === 'function') { // internet explorer
+    crypto = g.msCrypto
   }
-  var crypto
 
-  if (window.crypto && window.crypto.getRandomValues) {
-    crypto = window.crypto
-  } else if (window.msCrypto && window.msCrypto.getRandomValues) { // internet explorer
-    crypto = window.msCrypto
-  } else {
+  if (!crypto) {
     throw new Error('window.crypto.getRandomValues not available')
   }
 
-  var bbuf = new Uint8Array(size)
-  crypto.getRandomValues(bbuf)
-  var buf = Buffer.from(bbuf)
-
-  return buf
+  return Random._fromGetRandomValues(crypto, size)
 }
 
 module.exports = Random