@smartledger/bsv 7.5.5 → 7.5.7

package/CHANGELOG.md

@@ -7,6 +7,80 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [7.5.7] - 2026-08-07
+
+### Fixed
+
+- **`Address` threw whenever `lib/script` was required before `lib/address`.**
+  The two modules form a require cycle, and `address.js` ended with the usual idiom
+  — export yourself, then `var Script = require('./script')`. That only holds when
+  `address` loads first. Reaching `lib/script` first meant the require returned
+  script's **partially initialised** exports (`{}`), the captured binding stayed `{}`
+  forever, and every `instanceof Script` raised
+  `TypeError: Right-hand side of 'instanceof' is not callable`. `var` hoisting hid it,
+  since the name is in scope for the functions defined above the assignment.
+
+  This was reachable, not theoretical: deep imports are public API through the
+  `exports` map (`"./lib/*"`), so requiring `lib/script` first is a supported way to
+  use the package. Both `Address.fromScript(script)` and `new Address(script)` threw,
+  reaching the check through `_transformScript` and `_classifyArguments` respectively.
+
+  `Script` is now resolved at call time through a small accessor rather than captured
+  at module scope. `require` is cached, so it costs nothing, and by the time any of
+  these functions run the module is complete — which keeps `instanceof` **exact**
+  rather than loosening the check to a structural duck-type that a non-Script object
+  could satisfy.
+
+- **`scripts/check-address-load-order.js`** guards it, wired into CI and available as
+  `npm run check:load-order`. It deliberately lives outside mocha: the check must clear
+  `require.cache`, which would invalidate every module reference an in-process suite is
+  holding. It exercises `fromScript`, the constructor **and** `payingTo` — the first
+  two reach the check by different paths, and `payingTo` reaches the `Script`
+  constructor itself. Confirmed to fail against the unpatched module rather than
+  passing vacuously.
+
+Reported with an accurate reproduction and diagnosis in
+`BUG-address-load-order-instanceof.md`. Suite 4601 (unchanged — the guard is a
+standalone script, by necessity).
+
+## [7.5.6] - 2026-08-07
+
+### Fixed
+
+- **`cashAddrPrefixArray` threw whenever STN was enabled.** The getter's STN branch
+  called `STN.cashAddrPrefixToArray(...)`, but `STN` is a plain data object with no
+  methods — the two sibling branches correctly call the module-level function of that
+  name. Reading `Networks.testnet.cashAddrPrefixArray` after `Networks.enableStn()`
+  raised `TypeError: STN.cashAddrPrefixToArray is not a function`. Live, not latent.
+
+  Nothing caught it because nothing exercised the path: the existing network tests
+  assert on `cashAddrPrefix` (the string) and never read the array getter. Four
+  regression tests now cover all three branches plus the fact that each mode yields a
+  distinct prefix array, and they were confirmed to fail against the unpatched getter
+  rather than passing vacuously. They reset both toggles in `afterEach`, since
+  `enableStn`/`enableRegtest` mutate the shared `testnet` object and otherwise leak
+  into later tests.
+
+### Changed (no behavioural difference)
+
+Two defects that were correct by accident, corrected so the code states its intent.
+Both were verified to leave output unchanged before being touched.
+
+- **`Hash.hmac`** tested `key < blocksize` — a `Buffer` compared against a number,
+  which is always `false`, so the zero-padding branch never ran. The result was right
+  anyway: the XOR loop indexes past a short key and `x ^ undefined === x ^ 0`, exactly
+  what padding produces. Now `key.length < blocksize`. HMAC output is **byte-identical**
+  across 48 vectors spanning short, block-sized and over-length keys, in both the Node
+  and browser implementations.
+
+- **`BN.prototype.toSMBigEndian`** used `&` (bitwise) between two comparisons rather
+  than `&&`. It worked because `===` binds tighter than `&` and `true & true` is `1`.
+  Now `&&`.
+
+Reported with a reproduction and a correct diagnosis in
+`BUG-networks-stn-cashaddrprefixarray.md`; each claim was reproduced here before being
+acted on. Suite 4597 → 4601.
+
 ## [7.5.5] - 2026-08-07
 
 ### Fixed (security)

package/README.md

@@ -186,42 +186,42 @@ console.log('Status:', status) // 'revoked'
 ### **Core Modules**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js` |
-| **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.5.5/bsv.bundle.js` |
+| **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.5.7/bsv.min.js` |
+| **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.5.7/bsv.bundle.js` |
 
 ### **W3C Verifiable Credentials**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.5.5/bsv-didweb.min.js` |
-| **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.5.5/bsv-vcjwt.min.js` |
-| **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.5.5/bsv-statuslist.min.js` |
-| **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.5.5/bsv-anchor.min.js` |
+| **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@7.5.7/bsv-didweb.min.js` |
+| **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@7.5.7/bsv-vcjwt.min.js` |
+| **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@7.5.7/bsv-statuslist.min.js` |
+| **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@7.5.7/bsv-anchor.min.js` |
 
 ### **Smart Contract & Development**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.5.5/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.5.5/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.5.5/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.5.5/bsv-security.min.js` |
+| **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.5.7/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.5.7/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.5.7/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@7.5.7/bsv-security.min.js` |
 
 ### **Legal & Compliance**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.5.5/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.5.5/bsv-gdaf.min.js` |
+| **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@7.5.7/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@7.5.7/bsv-gdaf.min.js` |
 
 ### **Advanced Cryptography**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.5.5/bsv-shamir.min.js` |
+| **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@7.5.7/bsv-shamir.min.js` |
 
 ### **Utilities**
 | Module | Size | Use Case | CDN |
 |--------|------|----------|-----|
-| **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.5.5/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.5.5/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.5.5/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@7.5.7/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@7.5.7/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@7.5.7/bsv-mnemonic.min.js` |
 
 ## ⚡ **2-Minute Quick Start**
 
@@ -232,7 +232,7 @@ Get started with Bitcoin SV development in under 2 minutes:
 npm install @smartledger/bsv
 
 # Or include in HTML
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv.min.js"></script>
 ```
 
 > **🔒 v5.0.0 (production hardening — has breaking changes):** Shamir secret
@@ -332,8 +332,8 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🔧 **Basic Development** (~1.2MB total)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv-script-helper.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const utxos = new bsv.SmartContract.UTXOGenerator().createRealUTXOs(2, 100000);
@@ -342,9 +342,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🔒 **Smart Contract Development** (~2.8MB total — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().verify().build();
@@ -354,9 +354,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🆕 **Legal & Identity Development** (~3.4MB total — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -370,9 +370,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🆕 **Security & Cryptography** (~1.5MB total)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -384,7 +384,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
 
 ### 🎯 **Everything Bundle** (~1.1MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);           // Shamir Secret Sharing
@@ -494,8 +494,8 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 1. **Minimal Setup** - Core + Script Helper (~1.2MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv-script-helper.min.js"></script>
 <script>
   const tx = new bsv.Transaction();
   const sig = bsvScriptHelper.createSignature(tx, privateKey, 0, script, satoshis);
@@ -504,9 +504,9 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 2. **DeFi Development** - Core + Covenants + Debug (~2.8MB — each bundle re-embeds core BSV)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = new bsvCovenant.CovenantInterface();
   const debugInfo = SmartContract.interpretScript(script);
@@ -516,8 +516,8 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 3. **Security First** - Core + Enhanced Security (~1.2MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv-security.min.js"></script>
 <script>
   const verified = bsvSecurity.SmartVerify.verify(signature, hash, publicKey);
   const enhanced = bsvSecurity.EllipticFixed.createSignature(privateKey, hash);
@@ -526,7 +526,7 @@ const contractTx = covenant.createCovenantTransaction({
 
 #### 4. **Everything Bundle** - One File Solution (~1.1MB)
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.5.5/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.5.7/bsv.bundle.js"></script>
 <script>
   // Everything available under bsv namespace
   const keys = bsv.SmartLedgerBundle.generateKeys();
@@ -834,7 +834,7 @@ const timelockScript = helper.createTimelockScript(
 
 See the **[16 Loading Options](#-16-loading-options---choose-your-approach)**
 table near the top for the full list of bundles with current sizes and
-canonical `unpkg.com/@smartledger/bsv@7.5.5/...` URLs.
+canonical `unpkg.com/@smartledger/bsv@7.5.7/...` URLs.
 
 ## 🔐 Security