@smartledger/bsv 7.6.0 → 7.6.2

package/docs/MODULE_REFERENCE_COMPLETE.md

@@ -55,19 +55,19 @@ Three advanced modules totaling **~2.7MB** of functionality:
 - **Purpose**: Threshold cryptography for secure secret distribution
 - **Use Cases**: Backup keys, multi-party security, key recovery
 - **Features**: Split secrets into N shares, require M to reconstruct
-- **CDN**: `unpkg.com/@smartledger/bsv@7.6.0/bsv-shamir.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@7.6.2/bsv-shamir.min.js`
 
 #### **🌐 Global Digital Attestation Framework - GDAF (1184KB)**  
 - **Purpose**: W3C Verifiable Credentials and decentralized identity
 - **Use Cases**: Identity verification, attestations, zero-knowledge proofs
 - **Features**: DID creation, credential issuance, selective disclosure
-- **CDN**: `unpkg.com/@smartledger/bsv@7.6.0/bsv-gdaf.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@7.6.2/bsv-gdaf.min.js`
 
 #### **⚖️ Legal Token Protocol - LTP (1184KB)**
 - **Purpose**: Legal compliance framework for tokenized assets
 - **Use Cases**: Property rights, obligations, compliant tokenization  
 - **Features**: Legal primitives, compliance checking, attestation anchoring
-- **CDN**: `unpkg.com/@smartledger/bsv@7.6.0/bsv-ltp.min.js`
+- **CDN**: `unpkg.com/@smartledger/bsv@7.6.2/bsv-ltp.min.js`
 
 ### **2. Incorrect File Sizes in Documentation**
 
@@ -81,18 +81,18 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 | Module | Size | Use Case | CDN Link |
 |--------|------|----------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.6.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.6.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@7.6.0/bsv-smartcontract.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.6.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.6.0/bsv-script-helper.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.6.0/bsv-security.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.6.0/bsv-ecies.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.6.0/bsv-message.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.6.0/bsv-mnemonic.min.js` |
-| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@7.6.0/bsv-shamir.min.js` |
-| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@7.6.0/bsv-gdaf.min.js` |
-| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@7.6.0/bsv-ltp.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.6.2/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.6.2/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Covenant development | `unpkg.com/@smartledger/bsv@7.6.2/bsv-smartcontract.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.6.2/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.6.2/bsv-script-helper.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.6.2/bsv-security.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.6.2/bsv-ecies.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.6.2/bsv-message.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.6.2/bsv-mnemonic.min.js` |
+| **🆕 bsv-shamir.min.js** | 432KB | **Secret sharing** | `unpkg.com/@smartledger/bsv@7.6.2/bsv-shamir.min.js` |
+| **🆕 bsv-gdaf.min.js** | 1184KB | **Digital attestation** | `unpkg.com/@smartledger/bsv@7.6.2/bsv-gdaf.min.js` |
+| **🆕 bsv-ltp.min.js** | 1184KB | **Legal tokens** | `unpkg.com/@smartledger/bsv@7.6.2/bsv-ltp.min.js` |
 
 ## 🎯 **Updated Usage Examples**
 
@@ -100,22 +100,22 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **1. Basic Development (~963KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-script-helper.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-script-helper.min.js"></script>
 ```
 
 #### **2. Smart Contract Development (~2.7MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-smartcontract.min.js"></script>
 ```
 
 #### **3. 🆕 Legal & Compliance Development (~3.2MB — each bundle re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const legalToken = bsv.createLegalToken({
@@ -132,9 +132,9 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **4. 🆕 Security & Cryptography (~1.4MB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-shamir.min.js"></script>
 <script>
   // Shamir Secret Sharing
   const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -146,7 +146,7 @@ Three advanced modules totaling **~2.7MB** of functionality:
 
 #### **5. Everything Bundle (937KB)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.bundle.js"></script>
 <script>
   // Everything available immediately
   const shares = bsv.splitSecret('secret', 5, 3);

package/docs/advanced/UTXO_MANAGER_GUIDE.md

@@ -722,7 +722,7 @@ interface UTXO {
 <html>
 <head>
     <title>UTXO Manager Demo</title>
-    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@7.6.0/bsv.min.js"></script>
+    <script src="https://cdn.jsdelivr.net/npm/@smartledger/bsv@7.6.2/bsv.min.js"></script>
 </head>
 <body>
     <script>

package/docs/getting-started/INSTALLATION.md

@@ -48,7 +48,7 @@ const tx: Transaction = new Transaction();
 #### **Core Library Only (937KB)**
 For basic Bitcoin SV operations:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.min.js"></script>
 <script>
   const privateKey = new bsv.PrivateKey();
   const address = privateKey.toAddress();
@@ -58,7 +58,7 @@ For basic Bitcoin SV operations:
 #### **Complete Bundle (937KB)**  
 Everything in one file:
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.bundle.js"></script>
 <script>
   // All features available immediately
   const shares = bsv.splitSecret('secret', 5, 3);
@@ -71,9 +71,9 @@ Everything in one file:
 
 #### **Smart Contract Development (~2.7MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-covenant.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-covenant.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-smartcontract.min.js"></script>
 <script>
   const covenant = bsv.SmartContract.createCovenantBuilder()
     .extractField('amount').push(50000).greaterThanOrEqual().build();
@@ -82,9 +82,9 @@ Everything in one file:
 
 #### **Legal & Identity Development (~3.2MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-gdaf.min.js"></script>
 <script>
   // Legal Token Protocol
   const propertyToken = bsv.createPropertyToken({
@@ -98,9 +98,9 @@ Everything in one file:
 
 #### **Security & Cryptography (~1.4MB total — each bundle is self-contained and re-embeds core BSV)**
 ```html
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-security.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-shamir.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-security.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-shamir.min.js"></script>
 <script>
   // Threshold Cryptography
   const shares = bsv.splitSecret('my_secret_key', 5, 3);
@@ -114,18 +114,18 @@ Everything in one file:
 
 | Module | Size | Purpose | CDN Link |
 |--------|------|---------|----------|
-| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.6.0/bsv.min.js` |
-| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.6.0/bsv.bundle.js` |
-| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.6.0/bsv-smartcontract.min.js` |
-| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@7.6.0/bsv-ltp.min.js` |
-| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@7.6.0/bsv-gdaf.min.js` |
-| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@7.6.0/bsv-shamir.min.js` |
-| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.6.0/bsv-security.min.js` |
-| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.6.0/bsv-mnemonic.min.js` |
-| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.6.0/bsv-ecies.min.js` |
-| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.6.0/bsv-covenant.min.js` |
-| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.6.0/bsv-script-helper.min.js` |
-| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.6.0/bsv-message.min.js` |
+| **bsv.min.js** | 937KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@7.6.2/bsv.min.js` |
+| **bsv.bundle.js** | 937KB | Everything in one file | `unpkg.com/@smartledger/bsv@7.6.2/bsv.bundle.js` |
+| **bsv-smartcontract.min.js** | 937KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@7.6.2/bsv-smartcontract.min.js` |
+| **bsv-ltp.min.js** | 1184KB | **Legal Token Protocol** | `unpkg.com/@smartledger/bsv@7.6.2/bsv-ltp.min.js` |
+| **bsv-gdaf.min.js** | 1184KB | **Digital Identity & Attestation** | `unpkg.com/@smartledger/bsv@7.6.2/bsv-gdaf.min.js` |
+| **bsv-shamir.min.js** | 432KB | **Threshold Cryptography** | `unpkg.com/@smartledger/bsv@7.6.2/bsv-shamir.min.js` |
+| **bsv-security.min.js** | 26KB | Security enhancements (opt-in helpers — see README › Security) | `unpkg.com/@smartledger/bsv@7.6.2/bsv-security.min.js` |
+| **bsv-mnemonic.min.js** | 681KB | HD wallets | `unpkg.com/@smartledger/bsv@7.6.2/bsv-mnemonic.min.js` |
+| **bsv-ecies.min.js** | 71KB | Encryption | `unpkg.com/@smartledger/bsv@7.6.2/bsv-ecies.min.js` |
+| **bsv-covenant.min.js** | 913KB | Covenant operations | `unpkg.com/@smartledger/bsv@7.6.2/bsv-covenant.min.js` |
+| **bsv-script-helper.min.js** | 26KB | Custom script tools | `unpkg.com/@smartledger/bsv@7.6.2/bsv-script-helper.min.js` |
+| **bsv-message.min.js** | 26KB | Message signing | `unpkg.com/@smartledger/bsv@7.6.2/bsv-message.min.js` |
 
 ## ⚙️ **Development Environment Setup**
 

package/docs/getting-started/QUICK_START.md

@@ -14,10 +14,10 @@ npm install @smartledger/bsv
 ### Browser CDN (Instant)
 ```html
 <!-- Core library (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.min.js"></script>
 
 <!-- Everything included (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.bundle.js"></script>
 ```
 
 ## 💰 **Your First Transaction (60 seconds)**
@@ -127,19 +127,19 @@ SmartLedger-BSV offers 12 different loading options - use only what you need:
 
 ```html
 <!-- Core BSV only (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.min.js"></script>
 
 <!-- Smart contracts (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-smartcontract.min.js"></script>
 
 <!-- Legal tokens (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-ltp.min.js"></script>
 
 <!-- Digital identity (1.16MB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-gdaf.min.js"></script>
 
 <!-- Everything (937KB) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.bundle.js"></script>
 ```
 
 ## ⚡ **Key Advantages**

package/docs/migration/FROM_BSV_1_5_6.md

@@ -159,17 +159,17 @@ const recovered = bsv.reconstructSecret([shares[0], shares[2], shares[4]]);
 ### **New Modular Options** 
 ```html
 <!-- Core compatibility (same size as bsv@1.5.6) -->
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.min.js"></script>
 
 <!-- Add smart contracts when ready -->
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-smartcontract.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-smartcontract.min.js"></script>
 
 <!-- Add advanced features as needed -->
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-ltp.min.js"></script>
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv-gdaf.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-ltp.min.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv-gdaf.min.js"></script>
 
 <!-- Everything in one file -->
-<script src="https://unpkg.com/@smartledger/bsv@7.6.0/bsv.bundle.js"></script>
+<script src="https://unpkg.com/@smartledger/bsv@7.6.2/bsv.bundle.js"></script>
 ```
 
 ## 🔍 **Testing Your Migration**

package/lib/script/interpreter.js

@@ -681,7 +681,11 @@ Interpreter.prototype.checkSequence = function (nSequence) {
   var nLockTimeMask =
         Interpreter.SEQUENCE_LOCKTIME_TYPE_FLAG | Interpreter.SEQUENCE_LOCKTIME_MASK
   var txToSequenceMasked = new BN(txToSequence & nLockTimeMask)
-  var nSequenceMasked = nSequence.and(nLockTimeMask)
+  // new BN(...) is required: bn.js `and` takes a BN, and passing the plain
+  // number threw 'num.clone is not a function'. The interpreter's try/catch
+  // swallowed it and reported SCRIPT_ERR_UNKNOWN_ERROR, making every
+  // OP_CHECKSEQUENCEVERIFY script fail with a misleading error.
+  var nSequenceMasked = nSequence.and(new BN(nLockTimeMask))
 
   // There are two kinds of nSequence: lock-by-blockheight and
   // lock-by-blocktime, distinguished by whether nSequenceMasked <

package/lib/smart_contract/pushtx.js

@@ -180,7 +180,22 @@ function sFromPreimage (preimage) {
   if (z[0] < 0x01 || z[0] > 0x7f) return null
   var s = new BN(z).add(new BN(Gx)).mod(N)
   if (s.gt(HALF_N)) return null // enforce low-S (canonical / non-malleable)
-  var sBE = s.toBuffer('be', 32)
+  // NOT s.toBuffer('be', 32): lib/crypto/bn.js REPLACES toBuffer with an
+  // options-object form, so 'be' would land in `opts`, opts.size would be
+  // undefined and the 32 ignored — yielding a natural-length buffer.
+  //
+  // That truncation is currently UNREACHABLE, and the reason is worth writing
+  // down because it is not obvious: z is filtered to a leading byte of
+  // 0x01..0x7f above, so z is in [2**248, 2**255); adding Gx (~0.476 * 2**256)
+  // never wraps; and the low-S check caps the result at n/2. s therefore lands
+  // in a narrow band with a leading byte of 0x7a..0x7f and is always 32 bytes.
+  //
+  // The call is still wrong, and worth fixing, because that safety is an
+  // accident of two filters that have nothing to do with buffer length. Widen
+  // the MINIMALDATA range or drop low-S and the truncation becomes reachable —
+  // silently, inside a covenant, where DER_PREFIX declares s to be exactly 32
+  // bytes and a short one makes the spend invalid.
+  var sBE = s.toBuffer({ size: 32 })
   return (sBE[0] >= 0x01) ? sBE : null // s <= n/2 already guarantees sBE[0] <= 0x7f
 }
 
@@ -215,7 +230,12 @@ function grind (spend, inputIndex, lockingScript, satoshis, opts) {
     if (field === 'nLockTime') spend.nLockTime = nonce
     else input.sequenceNumber = 0xfffffffe - nonce // stay < 0xffffffff (non-final)
     var preimage = H.rawPreimage(spend, inputIndex, lockingScript, satoshis, sighashType)
-    if (sFromPreimage(preimage)) return { preimage: preimage, tries: i + 1, field: field, nonce: nonce }
+    // Length-checked, not truthy: grind's contract is a FIXED-length DER
+    // signature, and a short s would be truthy. Belt-and-braces alongside the
+    // toBuffer fix above — this is the check that would catch it if the
+    // upstream filters that currently make a short s impossible ever change.
+    var sBE = sFromPreimage(preimage)
+    if (sBE && sBE.length === 32) return { preimage: preimage, tries: i + 1, field: field, nonce: nonce }
   }
   throw new Error('OP_PUSH_TX grind failed after ' + maxTries + ' tries')
 }

package/lib/transaction/transaction.js

@@ -340,7 +340,7 @@ Transaction.prototype.fromObject = function fromObject (arg) {
   var self = this
   var transaction
   if (arg instanceof Transaction) {
-    transaction = transaction.toObject()
+    transaction = arg.toObject()
   } else {
     transaction = arg
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "7.6.0",
+  "version": "7.6.2",
   "description": "🚀 Complete Bitcoin SV development framework with legally-recognizable DID:web + W3C VC-JWT toolkit, Legal Token Protocol (LTP), Global Digital Attestation Framework (GDAF), StatusList2021 revocation, and 16 flexible loading options. Standards-based credentials with ES256/ES256K support, on-chain BSV anchoring, and comprehensive Bitcoin SV API. Perfect for legal tokens, verifiable credentials, DeFi, smart contracts, and secure Bitcoin applications.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -228,7 +228,7 @@
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
     "aes-js": "^3.1.2",
-    "bn.js": "=4.12.3",
+    "bn.js": "=4.12.5",
     "bs58": "=4.0.1",
     "clone-deep": "^4.0.1",
     "hash.js": "^1.1.7",

package/test/regressions.js

@@ -0,0 +1,180 @@
+'use strict'
+
+/* global describe, it */
+
+// Regressions for three wrong calls that shipped through 7.5.8, each of which
+// no test exercised.
+//
+// Two were live: Transaction#fromObject threw on an input its own
+// checkArgument accepts, and OP_CHECKSEQUENCEVERIFY failed every script with a
+// misleading error. Those two tests fail on the unfixed code.
+//
+// The third — sFromPreimage's toBuffer call — is LATENT, and the tests say so
+// rather than pretending otherwise. See the note on that block.
+
+require('chai').should()
+var bsv = require('../')
+var BN = bsv.crypto.BN
+
+describe('regressions', function () {
+  describe('Transaction#fromObject with a Transaction', function () {
+    // `fromObject` read `transaction.toObject()` where it meant
+    // `arg.toObject()`, so the branch that exists specifically to accept a
+    // Transaction was the only branch that could not work. checkArgument
+    // admits the input; the next line threw TypeError on it.
+    it('accepts a Transaction, which its own checkArgument allows', function () {
+      var key = bsv.PrivateKey.fromRandom()
+      var source = new bsv.Transaction().to(key.toAddress(), 1000)
+
+      var copy = new bsv.Transaction().fromObject(source)
+
+      copy.outputs.length.should.equal(1)
+      copy.outputs[0].satoshis.should.equal(1000)
+      copy.toObject().should.deep.equal(source.toObject())
+    })
+
+    it('still accepts the plain object form', function () {
+      var key = bsv.PrivateKey.fromRandom()
+      var source = new bsv.Transaction().to(key.toAddress(), 1000)
+
+      var copy = new bsv.Transaction().fromObject(source.toObject())
+
+      copy.toObject().should.deep.equal(source.toObject())
+    })
+  })
+
+  describe('BN#toBuffer with the native signature', function () {
+    // lib/crypto/bn.js REPLACES toBuffer with an options-object form. Calling
+    // it with bn.js's native (endian, length) signature silently ignores the
+    // length: 'be' lands in `opts`, `opts.size` is undefined, and the result
+    // is the natural-length buffer.
+    it('pads to the requested size when given the options form', function () {
+      // Leading zero byte, so the natural encoding is shorter than 32.
+      var n = new BN('00ff' + '11'.repeat(30), 'hex')
+
+      n.toBuffer({ size: 32 }).length.should.equal(32)
+    })
+
+    it('does NOT honour a positional length, which is why the options form is required', function () {
+      var n = new BN('00ff' + '11'.repeat(30), 'hex')
+
+      // Documents the trap rather than endorsing it: this is the call shape
+      // that produced a 31-byte s inside the OP_PUSH_TX grind.
+      n.toBuffer('be', 32).length.should.equal(31)
+    })
+  })
+
+  describe('PushTx.sFromPreimage uses the right toBuffer signature', function () {
+    // sFromPreimage called `s.toBuffer('be', 32)` — bn.js's NATIVE signature,
+    // against a toBuffer that lib/crypto/bn.js has replaced with an
+    // options-object form. The length argument was therefore ignored.
+    //
+    // This is a latent defect, NOT a live one, and the distinction is worth
+    // stating precisely: the truncation is currently unreachable. `s` is
+    // (HASH256(preimage) + Gx) mod n, and the caller has already required the
+    // hash's leading byte to be 0x01..0x7f, so z is in [2**248, 2**255).
+    // Adding Gx (about 0.476 * 2**256) never wraps, and the low-S filter caps
+    // the result at n/2 — confining s to a narrow band whose leading byte is
+    // always 0x7a..0x7f. It can never be zero, so the natural encoding is
+    // always 32 bytes anyway.
+    //
+    // The fix is worth making because the correctness of the output currently
+    // depends on two upstream filters that have nothing to do with buffer
+    // length. Change the MINIMALDATA range or drop the low-S requirement and
+    // the truncation becomes reachable, silently, in a covenant.
+    it('always returns exactly 32 bytes', function () {
+      var PushTx = bsv.SmartContract.PushTx
+      var accepted = 0
+
+      for (var i = 0; i < 4000; i++) {
+        var preimage = bsv.crypto.Hash.sha256(Buffer.from('grind-' + i))
+        var sBE = PushTx.sFromPreimage(preimage)
+        if (sBE) {
+          accepted++
+          sBE.length.should.equal(32)
+        }
+      }
+
+      accepted.should.be.above(0)
+    })
+
+    it('keeps s inside the band that makes the length safe', function () {
+      // Pins the property the paragraph above relies on. If this ever fails,
+      // the toBuffer call shape matters again — and the fix is already in.
+      var PushTx = bsv.SmartContract.PushTx
+
+      for (var i = 0; i < 2000; i++) {
+        var preimage = bsv.crypto.Hash.sha256(Buffer.from('band-' + i))
+        var sBE = PushTx.sFromPreimage(preimage)
+        if (sBE) {
+          sBE[0].should.be.within(0x01, 0x7f)
+        }
+      }
+    })
+  })
+
+  describe('OP_CHECKSEQUENCEVERIFY', function () {
+    // checkSequence masked with `nSequence.and(nLockTimeMask)` where the mask
+    // is a plain number. bn.js `and` requires a BN, so it threw
+    // 'num.clone is not a function'; the interpreter's try/catch swallowed
+    // that and reported SCRIPT_ERR_UNKNOWN_ERROR, making every CSV script fail
+    // with a misleading error.
+    //
+    // Note this is only reachable with SCRIPT_VERIFY_CHECKSEQUENCEVERIFY set:
+    // post-Genesis BSV reverted CSV to OP_NOP3 and the flag is off by default.
+    it('evaluates instead of failing with SCRIPT_ERR_UNKNOWN_ERROR', function () {
+      var Interpreter = bsv.Script.Interpreter
+      var key = bsv.PrivateKey.fromRandom()
+      var address = key.toAddress()
+      var prev = new bsv.Transaction().to(address, 1000)
+      var spend = new bsv.Transaction().from({
+        txId: prev.hash,
+        outputIndex: 0,
+        script: bsv.Script.buildPublicKeyHashOut(address).toHex(),
+        satoshis: 1000
+      })
+      spend.version = 2
+      spend.inputs[0].sequenceNumber = 20
+
+      var interpreter = new Interpreter()
+      var verified = interpreter.verify(
+        bsv.Script.fromASM('OP_1'),
+        bsv.Script.fromASM('OP_10 OP_CHECKSEQUENCEVERIFY'),
+        spend, 0,
+        Interpreter.SCRIPT_VERIFY_CHECKSEQUENCEVERIFY,
+        new BN(1000)
+      )
+
+      interpreter.errstr.should.equal('')
+      verified.should.equal(true)
+    })
+
+    it('still rejects a sequence that does not satisfy the requirement', function () {
+      var Interpreter = bsv.Script.Interpreter
+      var key = bsv.PrivateKey.fromRandom()
+      var address = key.toAddress()
+      var prev = new bsv.Transaction().to(address, 1000)
+      var spend = new bsv.Transaction().from({
+        txId: prev.hash,
+        outputIndex: 0,
+        script: bsv.Script.buildPublicKeyHashOut(address).toHex(),
+        satoshis: 1000
+      })
+      spend.version = 2
+      // Below the required relative locktime of 10.
+      spend.inputs[0].sequenceNumber = 5
+
+      var interpreter = new Interpreter()
+      var verified = interpreter.verify(
+        bsv.Script.fromASM('OP_1'),
+        bsv.Script.fromASM('OP_10 OP_CHECKSEQUENCEVERIFY'),
+        spend, 0,
+        Interpreter.SCRIPT_VERIFY_CHECKSEQUENCEVERIFY,
+        new BN(1000)
+      )
+
+      verified.should.equal(false)
+      interpreter.errstr.should.equal('SCRIPT_ERR_UNSATISFIED_LOCKTIME')
+    })
+  })
+})

package/version.js

@@ -1,3 +1,3 @@
 'use strict'
 // GENERATED by scripts/sync-version.js on `npm version` — do not edit.
-module.exports = '7.6.0'
+module.exports = '7.6.2'