@smartledger/bsv 7.12.0 → 8.0.0

package/lib/transaction/input/multisig.js

@@ -1,7 +1,7 @@
 'use strict'
 
 var _ = require('../../util/_')
-var inherits = require('inherits')
+var inherits = require('../../util/inherits')
 var Input = require('./input')
 var Output = require('../output')
 var $ = require('../../util/preconditions')

package/lib/transaction/input/multisigscripthash.js

@@ -1,7 +1,7 @@
 'use strict'
 
 var _ = require('../../util/_')
-var inherits = require('inherits')
+var inherits = require('../../util/inherits')
 var Input = require('./input')
 var Output = require('../output')
 var $ = require('../../util/preconditions')

package/lib/transaction/input/publickey.js

@@ -1,6 +1,6 @@
 'use strict'
 
-var inherits = require('inherits')
+var inherits = require('../../util/inherits')
 
 var $ = require('../../util/preconditions')
 

package/lib/transaction/input/publickeyhash.js

@@ -1,6 +1,6 @@
 'use strict'
 
-var inherits = require('inherits')
+var inherits = require('../../util/inherits')
 
 var $ = require('../../util/preconditions')
 

package/lib/transaction/sighash.js

@@ -168,15 +168,27 @@ var sighashPreimage = function sighashPreimage (transaction, sighashType, inputN
   // only took effect when FORKID was absent could never select OTDA in practice, and
   // the flag would mean nothing.
   //
-  // Gated on SCRIPT_ENABLE_CHRONICLE, which is off by default: before the upgrade the
-  // 0x20 bit means nothing, so BIP-143 signatures already exist whose type byte happens
-  // to set it. Honouring it unconditionally would reinterpret those as OTDA.
+  // Routed on the bit alone, not on whether Chronicle is enabled, which is what
+  // the node does:
+  //
+  //   if(enabledSighashForkid && sigHashType.hasForkId() && !sigHashType.hasChronicle())
+  //       return SignatureHashBIP143(...);
+  //   return SignatureHashOriginal(...);
+  //
+  // The concern that made this gated is real — before the upgrade the 0x20 bit
+  // meant nothing, so BIP-143 signatures exist whose type byte happens to set
+  // it, and reinterpreting those as OTDA would be a disaster. The node answers
+  // it in a different place: CheckSignatureEncoding rejects a signature
+  // carrying the bit outside Chronicle as SCRIPT_ERR_ILLEGAL_CHRONICLE, so
+  // such a signature never reaches this function. Gating here instead made 260
+  // of the node's 1000 digest vectors disagree, because the digest for a given
+  // transaction and hash type then depends on a flag the node does not consult.
   //
   // Note the sighash type byte is committed INSIDE the preimage either way, so setting
   // this bit changes the digest even where it does not change the algorithm.
-  if ((sighashType & Signature.SIGHASH_CHRONICLE) && (flags & Interpreter.SCRIPT_ENABLE_CHRONICLE)) {
-    // fall through to the original algorithm
-  } else if ((sighashType & Signature.SIGHASH_FORKID) && (flags & Interpreter.SCRIPT_ENABLE_SIGHASH_FORKID)) {
+  if ((sighashType & Signature.SIGHASH_FORKID) &&
+      !(sighashType & Signature.SIGHASH_CHRONICLE) &&
+      (flags & Interpreter.SCRIPT_ENABLE_SIGHASH_FORKID)) {
     return sighashPreimageForForkId(txcopy, sighashType, inputNumber, subscript, satoshisBN)
   }
 

package/lib/transaction/signature.js

@@ -2,7 +2,7 @@
 
 var _ = require('../util/_')
 var $ = require('../util/preconditions')
-var inherits = require('inherits')
+var inherits = require('../util/inherits')
 var JSUtil = require('../util/js')
 
 var PublicKey = require('../publickey')

package/lib/util/inherits.js

@@ -0,0 +1,37 @@
+'use strict'
+
+/**
+ * Set up prototypal inheritance between two constructors.
+ *
+ * Replaces the `inherits` dependency, whose modern branch this reproduces exactly:
+ * `ctor.super_` is assigned and `ctor.prototype` is REPLACED with an object whose
+ * prototype is `superCtor.prototype`.
+ *
+ * Two details are load-bearing and must not be "simplified" into
+ * `Object.setPrototypeOf(ctor.prototype, superCtor.prototype)`:
+ *
+ *   - `constructor` is redefined as non-enumerable. A plain assignment would make it
+ *     enumerable, so it would start showing up in `for…in` and in anything that walks
+ *     own+inherited keys — this library's `toObject`/`toJSON` paths among them.
+ *   - `ctor.super_` is part of the observable surface; `TransactionSignature` and the
+ *     four Input subclasses are public classes, so anything reading `.super_` today
+ *     keeps working.
+ *
+ * The package also carried an `Object.create`-less fallback for pre-ES5 browsers. That
+ * branch is unreachable on Node >= 20.19 and in every browser this library targets.
+ *
+ * @param {Function} ctor - the subclass constructor
+ * @param {Function} superCtor - the superclass constructor
+ */
+module.exports = function inherits (ctor, superCtor) {
+  if (!superCtor) return
+  ctor.super_ = superCtor
+  ctor.prototype = Object.create(superCtor.prototype, {
+    constructor: {
+      value: ctor,
+      enumerable: false,
+      writable: true,
+      configurable: true
+    }
+  })
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "7.12.0",
+  "version": "8.0.0",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -60,6 +60,9 @@
     "lint": "standard",
     "check:load-order": "node scripts/check-address-load-order.js",
     "conformance": "node conformance/verify.js",
+    "vectors:sv": "node tools/sv-vector-report.js",
+    "vectors:sv-tx": "node tools/sv-tx-report.js",
+    "vectors:sv-sighash": "node tools/sv-sighash-report.js",
     "conformance:generate": "node conformance/generate.js",
     "lint:ratchet": "node scripts/lint-ratchet.js",
     "lint:ratchet:update": "node scripts/lint-ratchet.js --update",
@@ -231,12 +234,7 @@
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
     "bn.js": "=4.12.5",
-    "bs58": "=4.0.1",
-    "clone-deep": "^4.0.1",
-    "hash.js": "^1.1.7",
-    "inherits": "2.0.4",
-    "secrets.js-grempe": "^2.0.0",
-    "unorm": "1.6.0"
+    "secrets.js-grempe": "^2.0.0"
   },
   "devDependencies": {
     "assert": "^2.1.0",
@@ -277,7 +275,8 @@
       "before",
       "beforeEach",
       "describe",
-      "it"
+      "it",
+      "globalThis"
     ],
     "ignore": [
       "dist/**",

package/test/consensus/base58-vectors.js

@@ -0,0 +1,120 @@
+'use strict'
+
+/**
+ * Base58 and Base58Check vectors from SV Node v1.2.0.
+ *
+ * `base58_encode_decode.json` had no counterpart in the inherited bitcoind
+ * corpus and nothing else here exercises it. It is small, but it is the only
+ * place the raw codec is pinned against the node in both directions, and it
+ * carries the two cases an implementation gets wrong: the empty input, and
+ * leading zero bytes, which base58 encodes as leading '1's rather than as part
+ * of a number.
+ *
+ * The key vectors are content-identical to the bitcoind copies that
+ * test/address.js and test/privatekey.js already use — same 50 rows, different
+ * whitespace. They are run here against the SV copies regardless, so that the
+ * corpus under test/data/bitcoin-sv is the one this library is measured
+ * against. That directory is the declared specification, and re-copying it
+ * from a newer node tag should move these tests with it.
+ */
+
+require('chai').should()
+const bsv = require('../..')
+const Base58 = bsv.encoding.Base58
+const Base58Check = bsv.encoding.Base58Check
+const Address = bsv.Address
+const PrivateKey = bsv.PrivateKey
+
+const encodeDecode = require('../data/bitcoin-sv/base58_encode_decode.json')
+const keysValid = require('../data/bitcoin-sv/base58_keys_valid.json')
+const keysInvalid = require('../data/bitcoin-sv/base58_keys_invalid.json')
+
+describe('base58 vectors (SV Node v1.2.0)', function () {
+  describe('the raw codec', function () {
+    it('encodes every vector to the recorded string', function () {
+      encodeDecode.forEach(function (v, i) {
+        Base58.encode(Buffer.from(v[0], 'hex'))
+          .should.equal(v[1], 'encoding row ' + i + ' (' + v[0] + ')')
+      })
+    })
+
+    it('decodes every vector back to the recorded bytes', function () {
+      encodeDecode.forEach(function (v, i) {
+        Base58.decode(v[1]).toString('hex')
+          .should.equal(v[0], 'decoding row ' + i + ' (' + JSON.stringify(v[1]) + ')')
+      })
+    })
+
+    it('keeps leading zero bytes as leading ones', function () {
+      // Ten zero bytes encode as ten '1's. An implementation that treats the
+      // input purely as a number loses them, and every address starting 1
+      // depends on this.
+      Base58.encode(Buffer.alloc(10)).should.equal('1111111111')
+      Base58.decode('1111111111').should.deep.equal(Buffer.alloc(10))
+    })
+
+    it('round-trips the empty input', function () {
+      Base58.encode(Buffer.alloc(0)).should.equal('')
+      Base58.decode('').length.should.equal(0)
+    })
+  })
+
+  describe('keys and addresses', function () {
+    it('accepts every valid key vector', function () {
+      let addresses = 0
+      let privkeys = 0
+      keysValid.forEach(function (v, i) {
+        const str = v[0]
+        const meta = v[2]
+        if (meta.isPrivkey) {
+          const key = PrivateKey.fromWIF(str)
+          key.toWIF().should.equal(str, 'WIF round trip at ' + i)
+          privkeys++
+        } else {
+          const network = meta.isTestnet ? 'testnet' : 'livenet'
+          const address = Address.fromString(str, network)
+          address.toString().should.equal(str, 'address round trip at ' + i)
+          address.hashBuffer.toString('hex')
+            .should.equal(v[1], 'hash at ' + i)
+          address.type.should.equal(
+            meta.addrType === 'script' ? Address.PayToScriptHash : Address.PayToPublicKeyHash,
+            'type at ' + i)
+          addresses++
+        }
+      })
+      // Both kinds must actually have been reached.
+      addresses.should.be.above(0)
+      privkeys.should.be.above(0)
+    })
+
+    it('rejects every invalid key vector, as neither address nor key', function () {
+      // The claim these vectors make is that the string is not a valid address
+      // and not a valid WIF — not that it fails Base58Check. Several of them
+      // carry a perfectly good checksum and are simply the wrong length or
+      // version, so the checksum layer accepts them and the layer above is
+      // what has to refuse. Asserting the stronger thing would be asserting
+      // something the corpus does not say.
+      let checksumOk = 0
+      keysInvalid.forEach(function (v, i) {
+        const str = v[0]
+        Address.isValid(str).should.equal(false, 'Address accepted row ' + i)
+
+        let isKey = true
+        try {
+          PrivateKey.fromWIF(str)
+        } catch (e) {
+          isKey = false
+        }
+        isKey.should.equal(false, 'PrivateKey accepted row ' + i)
+
+        try {
+          Base58Check.decode(str)
+          checksumOk++
+        } catch (e) { /* a bad checksum is one way to be invalid, not the only one */ }
+      })
+      // Guards the reasoning above: if none of them had a valid checksum, this
+      // test would be weaker than it looks and Base58Check could be asserted.
+      checksumOk.should.be.above(0)
+    })
+  })
+})

package/test/consensus/sv-script-vectors.js

@@ -0,0 +1,81 @@
+'use strict'
+
+/**
+ * Consensus ratchet over the SV Node script vectors.
+ *
+ * A report tells you where you are; this stops you going backwards. Both read
+ * the same harness, so the progress figure and the gate cannot disagree.
+ *
+ * False accepts are held at zero outright rather than through an allowlist,
+ * because accepting a script the network rejects is the direction that can
+ * cost money. False rejects are held at zero too — the corpus passes
+ * completely, so there is nothing to exempt and no list to maintain.
+ */
+
+require('chai').should()
+const harness = require('../../tools/sv-vector-harness')
+
+describe('SV Node script vectors', function () {
+  this.timeout(120000)
+
+  let results = null
+
+  before(function () {
+    results = harness.runAll()
+  })
+
+  it('runs the whole corpus', function () {
+    results.length.should.equal(1483)
+  })
+
+  it('uses no flag the harness does not recognise', function () {
+    // An unrecognised flag means vectors run under the wrong rules, and any
+    // pass among them means nothing.
+    const unknown = new Set()
+    results.forEach(r => r.unknownFlags.forEach(f => unknown.add(f)))
+    Array.from(unknown).should.deep.equal([])
+  })
+
+  it('accepts nothing the node rejects', function () {
+    const accepts = results.filter(r => r.direction === 'accept')
+    const detail = accepts.map(r =>
+      '\n  ' + r.id + '  ' + r.reason + '\n      ' + harness.describe(r.row)).join('')
+    accepts.length.should.equal(0, 'false accepts must stay at zero:' + detail)
+  })
+
+  it('rejects nothing the node accepts', function () {
+    const rejects = results.filter(r => r.direction === 'reject')
+    const detail = rejects.map(r =>
+      '\n  ' + r.id + '  ' + r.reason + '\n      ' + harness.describe(r.row)).join('')
+    rejects.length.should.equal(0, 'false rejects must stay at zero:' + detail)
+  })
+
+  it('fails for the reason the node gives', function () {
+    // Matching the outcome is not the same as matching the reason, and the gap
+    // hid three real bugs — see ERROR_CODE_ALIASES in the harness. Each left
+    // the script failing, so the two tests above stayed green throughout.
+    const wrong = results.filter(r => r.codeMatches === false)
+    const detail = wrong.map(r =>
+      '\n  ' + r.id + '  expected ' + r.expectedCode + ', reported ' + r.gotCode +
+      '\n      ' + harness.describe(r.row)).join('')
+    wrong.length.should.equal(0,
+      wrong.length + ' vector(s) fail for the wrong reason:' + detail)
+  })
+
+  it('compares a code on every vector the node rejects', function () {
+    // Guards the test above: if `comparable` ever narrowed, it would pass by
+    // checking nothing.
+    const rejected = results.filter(r => r.row.expected !== 'OK' && r.passed)
+    rejected.length.should.equal(600)
+    rejected.every(r => r.codeMatches !== null).should.equal(true)
+  })
+
+  it('uses every alias it grants', function () {
+    // The ratchet's other direction. An alias no vector produces any more is
+    // an exemption outliving its reason, and should be deleted rather than
+    // left to cover something later.
+    const produced = new Set(results.filter(r => r.gotCode).map(r => r.gotCode))
+    const unused = Object.keys(harness.ERROR_CODE_ALIASES).filter(a => !produced.has(a))
+    unused.should.deep.equal([], 'alias(es) no vector produces; remove them')
+  })
+})

package/test/consensus/sv-sighash-vectors.js

@@ -0,0 +1,51 @@
+'use strict'
+
+/**
+ * Transaction digest vectors from SV Node v1.2.0 — the regression gate.
+ *
+ * The work is in tools/sv-sighash-harness.js, which npm run vectors:sv-sighash
+ * also uses, so the progress report and this gate cannot disagree about what
+ * passes. That file documents the corpus layout and the node's routing.
+ *
+ * Unlike the script and transaction vectors, this one carries no known-failure
+ * list. It has never had a failing row and there is no reason it should: a
+ * digest is a pure function of a transaction and a hash type, with no era to
+ * negotiate.
+ */
+
+require('chai').should()
+const harness = require('../../tools/sv-sighash-harness')
+
+describe('SV Node sighash vectors', function () {
+  this.timeout(120000)
+
+  const results = harness.runAll()
+
+  it('covers the whole corpus', function () {
+    results.length.should.equal(1000)
+  })
+
+  it('matches the node on both digest columns', function () {
+    const failures = results.filter(r => !r.passed)
+      .map(r => '#' + r.index + ' ' + r.reason)
+    failures.slice(0, 8).should.deep.equal([],
+      failures.length + ' of ' + results.length + ' rows disagree with the node')
+  })
+
+  it('routes every Chronicle-bit row to the original digest', function () {
+    // Stated separately so a routing regression reads as one rather than as
+    // hundreds of unexplained hash mismatches.
+    const withBit = harness.chronicleRows()
+    withBit.length.should.equal(511)
+    withBit.forEach(v => v[4].should.equal(v[5]))
+    results.filter(r => r.chronicleBit)
+      .forEach(r => r.algorithm.should.equal('OTDA'))
+  })
+
+  it('still exercises both algorithms', function () {
+    // Guards the test above: if the routing collapsed to OTDA everywhere it
+    // would pass, and this is what would notice.
+    results.filter(r => r.algorithm === 'BIP143').length.should.be.above(0)
+    results.filter(r => r.algorithm === 'OTDA').length.should.be.above(0)
+  })
+})

package/test/consensus/sv-tx-vectors.js

@@ -0,0 +1,48 @@
+'use strict'
+
+/**
+ * Consensus ratchet over the SV Node transaction vectors.
+ *
+ * These reach a level the script corpus cannot. A script vector evaluates one
+ * unlocking script against one locking script; these deserialise a whole
+ * transaction, resolve each input against the output it claims to spend, and
+ * require every one to verify, with locktimes and sequence numbers in play.
+ *
+ * That level earned itself immediately: it found that Genesis reverts
+ * OP_CHECKLOCKTIMEVERIFY and OP_CHECKSEQUENCEVERIFY to upgradable NOPs, which
+ * this library did not implement and no script vector can reach — the
+ * behaviour only appears once a real nLockTime and sequence number exist.
+ */
+
+require('chai').should()
+const harness = require('../../tools/sv-tx-harness')
+
+describe('SV Node transaction vectors', function () {
+  this.timeout(120000)
+
+  let results = null
+
+  before(function () {
+    results = harness.runAll()
+  })
+
+  it('runs both files', function () {
+    results.length.should.equal(161)
+    results.filter(r => r.expected).length.should.equal(93)
+    results.filter(r => !r.expected).length.should.equal(68)
+  })
+
+  it('accepts no transaction the node rejects', function () {
+    const accepts = results.filter(r => r.direction === 'accept')
+    const detail = accepts.map(r =>
+      '\n  ' + r.id + '  ' + r.reason + '\n      ' + harness.describe(r)).join('')
+    accepts.length.should.equal(0, 'false accepts must stay at zero:' + detail)
+  })
+
+  it('rejects no transaction the node accepts', function () {
+    const rejects = results.filter(r => r.direction === 'reject')
+    const detail = rejects.map(r =>
+      '\n  ' + r.id + '  ' + r.reason + '\n      ' + harness.describe(r)).join('')
+    rejects.length.should.equal(0, 'false rejects must stay at zero:' + detail)
+  })
+})

package/test/crypto/backend_selection.js

@@ -0,0 +1,126 @@
+'use strict'
+
+/* global describe, it */
+
+// The hashing and PBKDF2 backends are chosen by CAPABILITY, not by `process.browser`.
+//
+// `process.browser` is a Browserify-era convention, undefined in React Native, Deno,
+// Cloudflare Workers and Bun. Every one of those took the node branch and
+// require('crypto')'d, which fails outright in React Native or — worse — resolves to a
+// partial shim. rn-nodeify and several RN starter templates register exactly such a
+// shim, so this is a reported failure mode, not a hypothetical one.
+//
+// Each case runs in a child process because it has to intercept module resolution
+// before lib/ is loaded, which cannot be undone safely in-process.
+
+require('chai').should()
+var path = require('path')
+var spawnSync = require('child_process').spawnSync
+
+var ROOT = path.resolve(__dirname, '../..')
+var SHA256_ABC = 'ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad'
+
+// Run `body` with Module._load intercepted by `stub`, and print the result of `report`.
+function inChild (stub, report) {
+  var src = [
+    'var Module = require("module"), orig = Module._load',
+    'var real = orig.call(Module, "crypto", module, false)',
+    'Module._load = function (r) {',
+    '  if (r === "crypto") { ' + stub + ' }',
+    '  return orig.apply(this, arguments)',
+    '}',
+    // Only the pure-JS backend is loaded for comparison. hash.node.js require()s
+    // 'crypto' at module scope, so it is not even loadable when the stub removes it —
+    // which is precisely why hash.js must not reach for it unconditionally.
+    'var HASH = require(' + JSON.stringify(path.join(ROOT, 'lib/crypto/hash.js')) + ')',
+    'var PURE = require(' + JSON.stringify(path.join(ROOT, 'lib/crypto/hash.browser.js')) + ')',
+    'console.log(' + report + ')'
+  ].join('\n')
+  var out = spawnSync(process.execPath, ['-e', src], { encoding: 'utf8' })
+  if (out.status !== 0) throw new Error('child failed: ' + out.stderr)
+  return out.stdout.trim()
+}
+
+describe('crypto backend selection', function () {
+  this.timeout(30000)
+
+  it('uses node crypto when it is present and correct', function () {
+    // Not the pure-JS module => the node backend was selected.
+    inChild('return real', '(HASH !== PURE) + " " + HASH.sha256(Buffer.from("abc")).toString("hex")')
+      .should.equal('true ' + SHA256_ABC)
+  })
+
+  it('falls back to the pure-JS backend when there is no crypto module', function () {
+    inChild('var e = new Error("no crypto"); e.code = "MODULE_NOT_FOUND"; throw e',
+      '(HASH === PURE) + " " + HASH.sha256(Buffer.from("abc")).toString("hex")')
+      .should.equal('true ' + SHA256_ABC)
+  })
+
+  // The important one. A shim that EXISTS but computes the wrong digest must be
+  // rejected — trusting it would silently corrupt every hash in the library, and a
+  // wrong hash is invisible until it matters.
+  it('rejects a crypto shim that returns incorrect digests', function () {
+    inChild(
+      'return { createHash: function () { return { update: function () { return this }, ' +
+      'digest: function () { return "deadbeef" } } } }',
+      '(HASH === PURE) + " " + HASH.sha256(Buffer.from("abc")).toString("hex")')
+      .should.equal('true ' + SHA256_ABC)
+  })
+
+  // OpenSSL 3 moved ripemd160 to the legacy provider, so some Node builds have sha256
+  // but throw on ripemd160 — and ripemd160 is what addresses are built from.
+  it('rejects a crypto build without ripemd160', function () {
+    inChild(
+      'return Object.assign({}, real, { createHash: function (a) { ' +
+      'if (a === "ripemd160") throw new Error("Digest method not supported"); ' +
+      'return real.createHash(a) } })',
+      '(HASH === PURE) + " " + HASH.sha256ripemd160(Buffer.from("abc")).toString("hex").slice(0, 16)')
+      .should.equal('true bb1be98c142444d7')
+  })
+
+  it('does not consult process.browser', function () {
+    var src = [
+      'process.browser = undefined',
+      'var a = require(' + JSON.stringify(path.join(ROOT, 'lib/crypto/hash.js')) + ')',
+      'console.log(a.sha256(Buffer.from("abc")).toString("hex"))'
+    ].join('\n')
+    var withoutFlag = spawnSync(process.execPath, ['-e', src], { encoding: 'utf8' })
+    var withFlag = spawnSync(process.execPath, ['-e', 'process.browser = true\n' + src.split('\n').slice(1).join('\n')], { encoding: 'utf8' })
+    withoutFlag.stdout.trim().should.equal(SHA256_ABC)
+    withFlag.stdout.trim().should.equal(SHA256_ABC)
+  })
+
+  describe('pbkdf2', function () {
+    // BIP-39 English test vector; the seed must not depend on which backend ran.
+    var PHRASE = 'abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about'
+    var SEED = 'c55257c360c07c72029aebc1b53c05ed0362ada38ead3e3e9efa3708e53495531f09a6987599d18264c1e1c92f2cf141630c7a3c4ab7c81b2f001698e7463b04'
+
+    function seedInChild (stub) {
+      var src = [
+        'var Module = require("module"), orig = Module._load',
+        'var real = orig.call(Module, "crypto", module, false)',
+        'Module._load = function (r) { if (r === "crypto") { ' + stub + ' } return orig.apply(this, arguments) }',
+        'var bsv = require(' + JSON.stringify(ROOT) + ')',
+        'console.log(new bsv.Mnemonic(' + JSON.stringify(PHRASE) + ').toSeed("TREZOR").toString("hex"))'
+      ].join('\n')
+      var out = spawnSync(process.execPath, ['-e', src], { encoding: 'utf8' })
+      if (out.status !== 0) throw new Error('child failed: ' + out.stderr)
+      return out.stdout.trim()
+    }
+
+    it('derives the BIP-39 vector with node crypto', function () {
+      seedInChild('return real').should.equal(SEED)
+    })
+
+    it('derives the same seed with no crypto module', function () {
+      seedInChild('var e = new Error("no crypto"); e.code = "MODULE_NOT_FOUND"; throw e').should.equal(SEED)
+    })
+
+    it('rejects a shim whose HMAC is wrong and still derives the right seed', function () {
+      seedInChild(
+        'return Object.assign({}, real, { createHmac: function () { return { ' +
+        'update: function () { return this }, digest: function () { return Buffer.alloc(64) } } } })'
+      ).should.equal(SEED)
+    })
+  })
+})