@smartledger/bsv 8.1.0 → 8.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (47) hide show
  1. package/CHANGELOG.md +166 -0
  2. package/README.md +38 -38
  3. package/bsv-ecies.min.js +1 -1
  4. package/bsv-gdaf.min.js +62 -62
  5. package/bsv-ltp.min.js +48 -48
  6. package/bsv-smartcontract.min.js +1 -1
  7. package/bsv.bundle.js +62 -62
  8. package/bsv.min.js +62 -62
  9. package/docs/AUDIT_SCOPE.md +8 -8
  10. package/docs/BRC220_ENCODING_AMENDMENT.md +100 -0
  11. package/docs/BRC220_PLAN.md +224 -0
  12. package/docs/MODULE_REFERENCE_COMPLETE.md +27 -27
  13. package/docs/advanced/UTXO_MANAGER_GUIDE.md +1 -1
  14. package/docs/getting-started/INSTALLATION.md +23 -23
  15. package/docs/getting-started/QUICK_START.md +7 -7
  16. package/docs/migration/FROM_BSV_1_5_6.md +5 -5
  17. package/index.js +5 -0
  18. package/index.mjs +1 -0
  19. package/lib/gdaf/attestation-signer.js +54 -2
  20. package/lib/gdaf/attestation-verifier.js +41 -25
  21. package/lib/gdaf/zk-prover.js +143 -46
  22. package/lib/notaryhash/certificate.js +282 -0
  23. package/lib/notaryhash/encoding.js +150 -0
  24. package/lib/notaryhash/index.js +334 -0
  25. package/lib/notaryhash/merkle.js +209 -0
  26. package/lib/notaryhash/script.js +261 -0
  27. package/lib/notaryhash/suites.js +156 -0
  28. package/lib/util/jcs.js +75 -0
  29. package/package.json +9 -6
  30. package/test/gdaf/canonicalization.js +106 -0
  31. package/test/gdaf/zk_prover.js +204 -0
  32. package/test/notaryhash/certificate.js +249 -0
  33. package/test/notaryhash/encoding.js +186 -0
  34. package/test/notaryhash/merkle.js +181 -0
  35. package/test/notaryhash/script.js +270 -0
  36. package/test/notaryhash/verify.js +339 -0
  37. package/tools/minimal_reproduction.js +119 -0
  38. package/tools/opcode_map.js +342 -0
  39. package/tools/server.js +97 -0
  40. package/tools/simple_real_tx.js +136 -0
  41. package/tools/sv-sighash-harness.js +123 -0
  42. package/tools/sv-sighash-report.js +71 -0
  43. package/tools/sv-tx-harness.js +172 -0
  44. package/tools/sv-tx-report.js +43 -0
  45. package/tools/sv-vector-harness.js +304 -0
  46. package/tools/sv-vector-report.js +88 -0
  47. package/version.js +1 -1
package/CHANGELOG.md CHANGED
@@ -7,6 +7,172 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
7
7
 
8
8
  ## [Unreleased]
9
9
 
10
+ ## [8.3.0] - 2026-08-16
11
+
12
+ ### BRC-220 (NotaryHash)
13
+
14
+ `bsv.NotaryHash` implements [BRC-220](https://github.com/bitcoin-sv/BRCs/blob/master/apps/0220.md)
15
+ — privacy-preserving signed-hash notarization with SPV-verifiable certificates. A signer
16
+ proves they signed a specific hash; the on-chain anchor fixes that proof in time; the
17
+ document itself is never disclosed.
18
+
19
+ Four of the five things the spec needs already existed here, which is why it lives in this
20
+ library rather than a separate package: RFC 8785 canonicalization (added in 8.2.0 for an
21
+ unrelated reason), SPV inclusion proofs in TSC format, a header-first trust model that
22
+ already refused to take a provider's word, and `OP_FALSE OP_RETURN` with length-prefixed
23
+ binary.
24
+
25
+ ```js
26
+ var report = bsv.NotaryHash.verify(certificate, { header: independentlyObtainedHeader })
27
+ // { valid, signature, proofIntegrity, anchor, batchInclusion, errors }
28
+ ```
29
+
30
+ All three of the spec's validity checks, plus a fourth for batched certificates:
31
+
32
+ 1. **Signature** — offline, against the registered suite
33
+ 2. **Proof integrity** — the recomputed `proofHash` matches the certificate
34
+ 3. **Anchor** — SPV, against a block header the *caller* supplies
35
+ 4. **Batch inclusion** — the proof is one the on-chain root commits to
36
+
37
+ `verify()` returns a report naming which check failed, because a bad signature and an
38
+ unmined transaction need different fixes. `isValid()` is the strict boolean for `if (...)`.
39
+
40
+ **This library never fetches a block header.** The spec says the verifier trusts only a
41
+ header "obtained from any source it chooses"; quietly choosing one on the caller's behalf
42
+ would restore exactly the trust the protocol removes. `verifyAnchorSPV` refuses to pass
43
+ without one.
44
+
45
+ **Post-quantum is deliberately not bundled.** The spec names ML-DSA and SLH-DSA, but
46
+ `ECDSA-secp256k1` is first-class alongside them, so an ECDSA-only implementation is
47
+ conformant. `@noble/post-quantum` is the one Noble package with no independent audit — its
48
+ README says so — and is 0.x, 669 KB, and does not claim constant-time execution. Depending
49
+ on it would forfeit the "primitives are already audited" property that `docs/AUDIT_SCOPE.md`
50
+ relies on. Suites are registered instead:
51
+
52
+ ```js
53
+ bsv.NotaryHash.registerSuite('ML-DSA-65', { verify: function (hash, sig, key) { … } })
54
+ ```
55
+
56
+ An unregistered algorithm returns **false** — it does not fall through to a default, which
57
+ for an `ML-DSA-65` certificate would be catastrophic. A suite's result is coerced with
58
+ `=== true`, so one returning a truthy object cannot smuggle a pass through.
59
+
60
+ **`encoding` is `"raw"`.** The spec requires the field but never enumerates its values, so
61
+ this library defines them and proposes the definition upstream in
62
+ `docs/BRC220_ENCODING_AMENDMENT.md`. For `ECDSA-secp256k1` that is 64 bytes of `r ‖ s`,
63
+ because `proofHash` covers the signature bytes and DER is not canonical — measured over 200
64
+ signatures from one key, DER came out at 69, 70 and 71 bytes, all of it legal. Low-S is
65
+ required and rejected rather than normalised, since normalising changes bytes that are
66
+ inside `proofHash`.
67
+
68
+ **Batch mode uses RFC 6962**, which is a *third* Merkle tree in this repository and differs
69
+ from both others — `lib/spv` is Bitcoin's (double-SHA, rightmost leaf duplicated) and
70
+ `lib/gdaf/zk-prover.js` is single-SHA without domain separation. RFC 6962 domain-separates
71
+ (`leaf = SHA256(0x00‖d)`, `node = SHA256(0x01‖l‖r)`) and never duplicates. All six published
72
+ Certificate Transparency roots match.
73
+
74
+ Design decisions are recorded in `docs/BRC220_PLAN.md`, including two open questions the
75
+ spec does not answer: what a batch leaf contains (`proofHash` is the reading taken), and
76
+ confirmation against the reference implementation's golden vector.
77
+
78
+ ### Dependencies
79
+
80
+ `@noble/curves`, `@noble/hashes` and `@noble/ciphers` to 2.3.0. These are the signing and
81
+ hashing primitives, so the evidence is a differential rather than a green suite: 1,638
82
+ observable outputs were captured on 2.2.0 and recomputed on 2.3.0 — hashes over every input
83
+ length 0–200, HMACs across four key shapes, 40 keys' worth of RFC-6979 signatures,
84
+ addresses, DER encodings, BIP-32 derivations and point multiplication. All identical. The
85
+ comparison was confirmed capable of failing: perturbing sha256 by one byte moves 695 lines.
86
+
87
+ ### Also
88
+
89
+ RFC 8785 canonicalization moves from `lib/gdaf/attestation-signer.js` to `lib/util/jcs.js`,
90
+ since two unrelated modules now need it and a notarization module reaching into the
91
+ credentials module would be the wrong direction. `attestation-signer` delegates; behaviour
92
+ unchanged.
93
+
94
+ ## [8.2.0] - 2026-08-15
95
+
96
+ Two independent reviews of 8.1.0, both acted on after reproducing every claim. Between
97
+ them they found a proof system that verified nothing, a selective-disclosure scheme that
98
+ leaked the fields it withheld, and a signature canonicalization no other implementation
99
+ can reproduce. **4,469 tests passed with all of it in place**, because none of them
100
+ touched those files.
101
+
102
+ ### `lib/gdaf/zk-prover.js` — verified nothing, and leaked what it hid
103
+
104
+ This module had **zero test coverage**.
105
+
106
+ **`verifyRangeProof` verified nothing.** It ended at `return proof.inRange === true` — a
107
+ boolean the prover writes about itself. `valueCommitment` was never consulted, so any
108
+ object of the right shape passed:
109
+
110
+ ```js
111
+ { type: 'RangeProof', range: { min: 18, max: 120 },
112
+ valueCommitment: '00…', proofHash: 'de…', inRange: true } // → true
113
+ ```
114
+
115
+ `verifyAgeProof` had the same shape: it accepted `meetsRequirement`, then checked only
116
+ that `challengeResponse` was a non-empty string.
117
+
118
+ Both now require the **opening**, check the commitment actually opens to the claimed
119
+ value, and recompute the range or age rather than trusting the prover. Without an opening
120
+ they return `false`, because nothing has been proven. The generators return the opening
121
+ alongside the proof rather than inside it — embedding it would make every proof
122
+ self-opening.
123
+
124
+ **Selective disclosure leaked the withheld fields.** One salt covered every leaf and
125
+ travelled in the proof, so the sibling hashes on the Merkle path could be brute-forced
126
+ back into the hidden values. Disclosing only `credentialSubject.name` recovered `id`
127
+ directly, and `partyAffiliation` with `eligible` from their shared parent node. Each leaf
128
+ now carries its own salt, derived from a master that never leaves the generator, and only
129
+ the disclosed leaves' salts travel in the proof.
130
+
131
+ **A proof generated without an explicit salt could never verify.** The return used the
132
+ `salt` argument — `undefined` when omitted — instead of the one `createMerkleTree`
133
+ produced.
134
+
135
+ **Nothing here is zero-knowledge**, and the module said otherwise in three places. These
136
+ are hash commitments and a Merkle tree; the range and age commitments can only be checked
137
+ by opening them, which reveals the committed value. The npm keyword
138
+ `zero-knowledge-proofs` is replaced with `selective-disclosure`, the "Bulletproof-style"
139
+ comment is corrected, and the docblock states the limitation plainly.
140
+
141
+ 21 tests where there were none, each pinning the attack rather than the fix.
142
+
143
+ ### GDAF canonicalization is now RFC 8785
144
+
145
+ `_canonicalizeJSON` sorted keys and then rebuilt an object, which loses the sort: V8
146
+ orders integer-like own properties numerically, ahead of string keys.
147
+
148
+ ```
149
+ ours {"2":"two","10":"ten"}
150
+ JCS {"10":"ten","2":"two"} (UTF-16 code-unit order)
151
+ ```
152
+
153
+ Within this library that was deterministic — signing and verification agreed, and no
154
+ forgery follows. The failure is interoperability: GDAF credentials exist to be checked by
155
+ other parties, and a JCS-conformant verifier in any language computes a different hash and
156
+ rejects a valid signature.
157
+
158
+ `_canonicalizeJCS` serializes directly rather than round-tripping through an object, so
159
+ the order survives. Non-finite numbers now throw rather than serializing as `null`, which
160
+ would silently sign a different document than the one supplied.
161
+
162
+ **Migration is handled**: signing uses JCS, and verification tries JCS then the legacy
163
+ form, so credentials, presentations and `rootHash` values written before this keep
164
+ verifying. `1847`, `1847.0` and `1.847e3` still hash identically, which is correct rather
165
+ than a weakness — they are the same IEEE-754 double — and a test pins it.
166
+
167
+ ### Packaging
168
+
169
+ `files` shipped `test/` but not `tools/`, and three consensus specs require it. `tools/`
170
+ now ships, and the tarball file-count guard is raised to 370 to accommodate it: the
171
+ vectors are inert without the harnesses that run them.
172
+
173
+ Note that a consumer still cannot run the shipped tests, because devDependencies are
174
+ absent — whether `test/` should ship at all is a separate question.
175
+
10
176
  ## [8.1.0] - 2026-08-13
11
177
 
12
178
  ### `useGenesisLimits()` no longer raises the script-number bound
package/README.md CHANGED
@@ -186,42 +186,42 @@ console.log('Status:', status) // 'revoked'
186
186
  ### **Core Modules**
187
187
  | Module | Size | Use Case | CDN |
188
188
  |--------|------|----------|-----|
189
- | **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@8.1.0/bsv.min.js` |
190
- | **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@8.1.0/bsv.bundle.js` |
189
+ | **bsv.min.js** | 1149KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@8.3.0/bsv.min.js` |
190
+ | **bsv.bundle.js** | 1149KB | Everything in one file | `unpkg.com/@smartledger/bsv@8.3.0/bsv.bundle.js` |
191
191
 
192
192
  ### **W3C Verifiable Credentials**
193
193
  | Module | Size | Use Case | CDN |
194
194
  |--------|------|----------|-----|
195
- | **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@8.1.0/bsv-didweb.min.js` |
196
- | **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@8.1.0/bsv-vcjwt.min.js` |
197
- | **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@8.1.0/bsv-statuslist.min.js` |
198
- | **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@8.1.0/bsv-anchor.min.js` |
195
+ | **🟢 bsv-didweb.min.js** | 315KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@8.3.0/bsv-didweb.min.js` |
196
+ | **🟢 bsv-vcjwt.min.js** | 315KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@8.3.0/bsv-vcjwt.min.js` |
197
+ | **🟢 bsv-statuslist.min.js** | 415KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@8.3.0/bsv-statuslist.min.js` |
198
+ | **🟢 bsv-anchor.min.js** | 314KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@8.3.0/bsv-anchor.min.js` |
199
199
 
200
200
  ### **Smart Contract & Development**
201
201
  | Module | Size | Use Case | CDN |
202
202
  |--------|------|----------|-----|
203
- | **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@8.1.0/bsv-smartcontract.min.js` |
204
- | **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@8.1.0/bsv-covenant.min.js` |
205
- | **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@8.1.0/bsv-script-helper.min.js` |
206
- | **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@8.1.0/bsv-security.min.js` |
203
+ | **bsv-smartcontract.min.js** | 873KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@8.3.0/bsv-smartcontract.min.js` |
204
+ | **bsv-covenant.min.js** | 873KB | Covenant operations | `unpkg.com/@smartledger/bsv@8.3.0/bsv-covenant.min.js` |
205
+ | **bsv-script-helper.min.js** | 30KB | Custom script tools | `unpkg.com/@smartledger/bsv@8.3.0/bsv-script-helper.min.js` |
206
+ | **bsv-security.min.js** | 30KB | Security enhancements | `unpkg.com/@smartledger/bsv@8.3.0/bsv-security.min.js` |
207
207
 
208
208
  ### **Legal & Compliance**
209
209
  | Module | Size | Use Case | CDN |
210
210
  |--------|------|----------|-----|
211
- | **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@8.1.0/bsv-ltp.min.js` |
212
- | **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@8.1.0/bsv-gdaf.min.js` |
211
+ | **bsv-ltp.min.js** | 1149KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@8.3.0/bsv-ltp.min.js` |
212
+ | **bsv-gdaf.min.js** | 1149KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@8.3.0/bsv-gdaf.min.js` |
213
213
 
214
214
  ### **Advanced Cryptography**
215
215
  | Module | Size | Use Case | CDN |
216
216
  |--------|------|----------|-----|
217
- | **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@8.1.0/bsv-shamir.min.js` |
217
+ | **bsv-shamir.min.js** | 353KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@8.3.0/bsv-shamir.min.js` |
218
218
 
219
219
  ### **Utilities**
220
220
  | Module | Size | Use Case | CDN |
221
221
  |--------|------|----------|-----|
222
- | **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@8.1.0/bsv-ecies.min.js` |
223
- | **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@8.1.0/bsv-message.min.js` |
224
- | **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@8.1.0/bsv-mnemonic.min.js` |
222
+ | **bsv-ecies.min.js** | 79KB | Encryption | `unpkg.com/@smartledger/bsv@8.3.0/bsv-ecies.min.js` |
223
+ | **bsv-message.min.js** | 30KB | Message signing | `unpkg.com/@smartledger/bsv@8.3.0/bsv-message.min.js` |
224
+ | **bsv-mnemonic.min.js** | 592KB | HD wallets | `unpkg.com/@smartledger/bsv@8.3.0/bsv-mnemonic.min.js` |
225
225
 
226
226
  ## ⚡ **2-Minute Quick Start**
227
227
 
@@ -232,7 +232,7 @@ Get started with Bitcoin SV development in under 2 minutes:
232
232
  npm install @smartledger/bsv
233
233
 
234
234
  # Or include in HTML
235
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv.min.js"></script>
235
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv.min.js"></script>
236
236
  ```
237
237
 
238
238
  > **🔒 v5.0.0 (production hardening — has breaking changes):** Shamir secret
@@ -332,8 +332,8 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
332
332
 
333
333
  ### 🔧 **Basic Development** (~1.2MB total)
334
334
  ```html
335
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv.min.js"></script>
336
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv-script-helper.min.js"></script>
335
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv.min.js"></script>
336
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv-script-helper.min.js"></script>
337
337
  <script>
338
338
  const privateKey = new bsv.PrivateKey();
339
339
  const utxos = new bsv.SmartContract.UTXOGenerator().createRealUTXOs(2, 100000);
@@ -342,9 +342,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
342
342
 
343
343
  ### 🔒 **Smart Contract Development** (~2.8MB total — each bundle re-embeds core BSV)
344
344
  ```html
345
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv.min.js"></script>
346
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv-covenant.min.js"></script>
347
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv-smartcontract.min.js"></script>
345
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv.min.js"></script>
346
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv-covenant.min.js"></script>
347
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv-smartcontract.min.js"></script>
348
348
  <script>
349
349
  const covenant = bsv.SmartContract.createCovenantBuilder()
350
350
  .extractField('amount').push(50000).greaterThanOrEqual().verify().build();
@@ -354,9 +354,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
354
354
 
355
355
  ### 🆕 **Legal & Identity Development** (~3.4MB total — each bundle re-embeds core BSV)
356
356
  ```html
357
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv.min.js"></script>
358
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv-ltp.min.js"></script>
359
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv-gdaf.min.js"></script>
357
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv.min.js"></script>
358
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv-ltp.min.js"></script>
359
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv-gdaf.min.js"></script>
360
360
  <script>
361
361
  // Legal Token Protocol
362
362
  const propertyToken = bsv.createPropertyToken({
@@ -370,9 +370,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
370
370
 
371
371
  ### 🆕 **Security & Cryptography** (~1.5MB total)
372
372
  ```html
373
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv.min.js"></script>
374
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv-security.min.js"></script>
375
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv-shamir.min.js"></script>
373
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv.min.js"></script>
374
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv-security.min.js"></script>
375
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv-shamir.min.js"></script>
376
376
  <script>
377
377
  // Threshold Cryptography
378
378
  const shares = bsv.splitSecret('my_secret_key', 5, 3); // 5 shares, 3 needed
@@ -384,7 +384,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
384
384
 
385
385
  ### 🎯 **Everything Bundle** (~1.1MB)
386
386
  ```html
387
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv.bundle.js"></script>
387
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv.bundle.js"></script>
388
388
  <script>
389
389
  // Everything available immediately
390
390
  const shares = bsv.splitSecret('secret', 5, 3); // Shamir Secret Sharing
@@ -494,8 +494,8 @@ const contractTx = covenant.createCovenantTransaction({
494
494
 
495
495
  #### 1. **Minimal Setup** - Core + Script Helper (~1.2MB)
496
496
  ```html
497
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv.min.js"></script>
498
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv-script-helper.min.js"></script>
497
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv.min.js"></script>
498
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv-script-helper.min.js"></script>
499
499
  <script>
500
500
  const tx = new bsv.Transaction();
501
501
  const sig = bsvScriptHelper.createSignature(tx, privateKey, 0, script, satoshis);
@@ -504,9 +504,9 @@ const contractTx = covenant.createCovenantTransaction({
504
504
 
505
505
  #### 2. **DeFi Development** - Core + Covenants + Debug (~2.8MB — each bundle re-embeds core BSV)
506
506
  ```html
507
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv.min.js"></script>
508
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv-covenant.min.js"></script>
509
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv-smartcontract.min.js"></script>
507
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv.min.js"></script>
508
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv-covenant.min.js"></script>
509
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv-smartcontract.min.js"></script>
510
510
  <script>
511
511
  const covenant = new bsvCovenant.CovenantInterface();
512
512
  const debugInfo = SmartContract.interpretScript(script);
@@ -516,8 +516,8 @@ const contractTx = covenant.createCovenantTransaction({
516
516
 
517
517
  #### 3. **Security First** - Core + Enhanced Security (~1.2MB)
518
518
  ```html
519
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv.min.js"></script>
520
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv-security.min.js"></script>
519
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv.min.js"></script>
520
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv-security.min.js"></script>
521
521
  <script>
522
522
  const verified = bsvSecurity.SmartVerify.verify(signature, hash, publicKey);
523
523
  const enhanced = bsvSecurity.EllipticFixed.createSignature(privateKey, hash);
@@ -526,7 +526,7 @@ const contractTx = covenant.createCovenantTransaction({
526
526
 
527
527
  #### 4. **Everything Bundle** - One File Solution (~1.1MB)
528
528
  ```html
529
- <script src="https://unpkg.com/@smartledger/bsv@8.1.0/bsv.bundle.js"></script>
529
+ <script src="https://unpkg.com/@smartledger/bsv@8.3.0/bsv.bundle.js"></script>
530
530
  <script>
531
531
  // Everything available under bsv namespace
532
532
  const keys = bsv.SmartLedgerBundle.generateKeys();
@@ -834,7 +834,7 @@ const timelockScript = helper.createTimelockScript(
834
834
 
835
835
  See the **[16 Loading Options](#-16-loading-options---choose-your-approach)**
836
836
  table near the top for the full list of bundles with current sizes and
837
- canonical `unpkg.com/@smartledger/bsv@8.1.0/...` URLs.
837
+ canonical `unpkg.com/@smartledger/bsv@8.3.0/...` URLs.
838
838
 
839
839
  ## 🔐 Security
840
840