@smartledger/bsv 8.2.0 → 8.3.0

package/test/notaryhash/script.js

@@ -0,0 +1,270 @@
+'use strict'
+
+/* global describe, it */
+
+// BRC-220 on-chain record. As with the encoding module, the property that matters is that
+// another implementation reading the spec produces and accepts the same bytes — so the
+// tests assert the push layout the spec dictates rather than only round-tripping our own
+// output, which would pass even if every field were in the wrong place.
+
+require('chai').should()
+var bsv = require('../..')
+var NS = require('../../lib/notaryhash/script')
+var Hash = require('../../lib/crypto/hash')
+var Opcode = require('../../lib/opcode')
+
+var FULL = {
+  mode: NS.MODE.FULL,
+  algorithm: 'ECDSA-secp256k1',
+  hashAlgorithm: 'SHA-256',
+  payloadHash: Buffer.alloc(32, 0x11),
+  proofHash: Buffer.alloc(32, 0x22),
+  publicKey: Buffer.alloc(33, 0x02),
+  signature: Buffer.alloc(64, 0x30)
+}
+
+// The spec counts PUSH indices, which start after OP_FALSE OP_RETURN. Script chunks
+// include those two opcodes, so push N is chunk N+2.
+function pushes (script) {
+  return script.chunks.slice(2)
+}
+
+describe('BRC-220 on-chain record', function () {
+  describe('push layout', function () {
+    it('is OP_FALSE OP_RETURN followed by the pushes', function () {
+      var s = NS.build(FULL)
+      s.chunks[0].opcodenum.should.equal(Opcode.OP_FALSE)
+      s.chunks[1].opcodenum.should.equal(Opcode.OP_RETURN)
+    })
+
+    it('puts the prefix at push index 0, as 10 ASCII bytes', function () {
+      var p = pushes(NS.build(FULL))
+      p[0].buf.toString('ascii').should.equal('NOTARYHASH')
+      p[0].buf.length.should.equal(10)
+      p[0].buf.toString('hex').should.equal('4e4f5441525948415348')
+    })
+
+    // The spec discriminates on "the mode/kind byte at push index 2". If this drifts,
+    // every other implementation reads the wrong field.
+    it('puts the version at push index 1 and the mode at push index 2', function () {
+      var p = pushes(NS.build(FULL))
+      p[1].buf.length.should.equal(1)
+      p[1].buf[0].should.equal(1)
+      p[2].buf.length.should.equal(1)
+      p[2].buf[0].should.equal(NS.MODE.FULL)
+    })
+
+    it('orders full-mode fields as the spec lists them', function () {
+      var p = pushes(NS.build(FULL))
+      p.length.should.equal(9)
+      p[3].buf.toString('utf8').should.equal('ECDSA-secp256k1')
+      p[4].buf.toString('utf8').should.equal('SHA-256')
+      p[5].buf.toString('hex').should.equal(FULL.payloadHash.toString('hex'))
+      p[6].buf.toString('hex').should.equal(FULL.proofHash.toString('hex'))
+      p[7].buf.toString('hex').should.equal(FULL.publicKey.toString('hex'))
+      p[8].buf.toString('hex').should.equal(FULL.signature.toString('hex'))
+    })
+
+    it('lays batch mode out as root then u32be count', function () {
+      var p = pushes(NS.build({ mode: NS.MODE.BATCH, merkleRoot: Buffer.alloc(32, 0xaa), leafCount: 12345 }))
+      p.length.should.equal(5)
+      p[2].buf[0].should.equal(NS.MODE.BATCH)
+      p[3].buf.length.should.equal(32)
+      p[4].buf.length.should.equal(4)
+      p[4].buf.readUInt32BE(0).should.equal(12345)
+    })
+
+    // The canonical proof bytes use lp() because they are one flat string; here the push
+    // opcode already carries the length. Applying lp() as well would double-encode.
+    it('does not length-prefix inside the pushes', function () {
+      var p = pushes(NS.build(FULL))
+      // A doubly-encoded payloadHash would be 4 + 32 bytes.
+      p[5].buf.length.should.equal(32)
+      p[3].buf.length.should.equal('ECDSA-secp256k1'.length)
+    })
+  })
+
+  describe('hybrid mode', function () {
+    it('puts SHA-256 of the key and signature on chain', function () {
+      var p = pushes(NS.build(Object.assign({}, FULL, { mode: NS.MODE.HYBRID })))
+      p[7].buf.toString('hex').should.equal(Hash.sha256(FULL.publicKey).toString('hex'))
+      p[8].buf.toString('hex').should.equal(Hash.sha256(FULL.signature).toString('hex'))
+      p[7].buf.length.should.equal(32)
+      p[8].buf.length.should.equal(32)
+    })
+
+    // The caller always supplies the FULL key and signature; hashing is this module's job.
+    // Accepting a pre-hashed blob would produce a record that looks right and cannot be
+    // reconciled with the certificate, and nothing downstream would notice.
+    it('hashes internally rather than trusting a pre-hashed input', function () {
+      var preHashed = Object.assign({}, FULL, {
+        mode: NS.MODE.HYBRID,
+        publicKey: Hash.sha256(FULL.publicKey)
+      })
+      var p = pushes(NS.build(preHashed))
+      // Hashed again, so it does NOT equal the value that was passed in.
+      p[7].buf.toString('hex').should.not.equal(Hash.sha256(FULL.publicKey).toString('hex'))
+    })
+
+    it('parses to hashes, never to raw blobs', function () {
+      var parsed = NS.parse(NS.build(Object.assign({}, FULL, { mode: NS.MODE.HYBRID })))
+      parsed.publicKeyHash.toString('hex').should.equal(Hash.sha256(FULL.publicKey).toString('hex'))
+      ;(parsed.publicKey === undefined).should.equal(true)
+      ;(parsed.signature === undefined).should.equal(true)
+    })
+  })
+
+  describe('round trip', function () {
+    it('preserves every full-mode field', function () {
+      var p = NS.parse(NS.build(FULL))
+      p.mode.should.equal(NS.MODE.FULL)
+      p.version.should.equal(1)
+      p.algorithm.should.equal(FULL.algorithm)
+      p.hashAlgorithm.should.equal(FULL.hashAlgorithm)
+      p.payloadHash.toString('hex').should.equal(FULL.payloadHash.toString('hex'))
+      p.proofHash.toString('hex').should.equal(FULL.proofHash.toString('hex'))
+      p.publicKey.toString('hex').should.equal(FULL.publicKey.toString('hex'))
+      p.signature.toString('hex').should.equal(FULL.signature.toString('hex'))
+    })
+
+    it('preserves batch fields', function () {
+      var p = NS.parse(NS.build({ mode: NS.MODE.BATCH, merkleRoot: Buffer.alloc(32, 0xbb), leafCount: 1 }))
+      p.merkleRoot.toString('hex').should.equal(Buffer.alloc(32, 0xbb).toString('hex'))
+      p.leafCount.should.equal(1)
+    })
+
+    it('round-trips through hex', function () {
+      var hex = NS.build(FULL).toHex()
+      NS.parse(hex).algorithm.should.equal(FULL.algorithm)
+    })
+
+    it('carries a post-quantum-sized signature in full mode', function () {
+      var big = Object.assign({}, FULL, { signature: Buffer.alloc(7856, 0x5a) })
+      NS.parse(NS.build(big)).signature.length.should.equal(7856)
+    })
+  })
+
+  describe('parser rejects', function () {
+    function corrupt (fn) {
+      var s = NS.build(FULL)
+      fn(s)
+      return s
+    }
+
+    // Long enough to pass the length check, so the OP_FALSE check is what rejects it.
+    it('a record that does not open with OP_FALSE', function () {
+      var s = corrupt(function (s) { s.chunks[0] = { opcodenum: Opcode.OP_1 } })
+      ;(function () { NS.parse(s) }).should.throw(/OP_FALSE/)
+    })
+
+    it('a record with no OP_RETURN', function () {
+      var s = corrupt(function (s) { s.chunks[1] = { opcodenum: Opcode.OP_1 } })
+      ;(function () { NS.parse(s) }).should.throw(/OP_RETURN/)
+    })
+
+    it('a foreign protocol prefix', function () {
+      var s = corrupt(function (s) { s.chunks[2].buf = Buffer.from('SOMETHINGELSE', 'ascii') })
+      ;(function () { NS.parse(s) }).should.throw(/prefix/)
+    })
+
+    it('an unsupported version', function () {
+      var s = corrupt(function (s) { s.chunks[3].buf = Buffer.from([9]) })
+      ;(function () { NS.parse(s) }).should.throw(/version: 9/)
+    })
+
+    it('an unknown mode', function () {
+      var s = corrupt(function (s) { s.chunks[4].buf = Buffer.from([7]) })
+      ;(function () { NS.parse(s) }).should.throw(/unknown NotaryHash mode: 7/)
+    })
+
+    it('the wrong number of pushes', function () {
+      var s = corrupt(function (s) { s.chunks.pop() })
+      ;(function () { NS.parse(s) }).should.throw(/exactly 11 pushes/)
+    })
+
+    it('a payloadHash that is not 32 bytes', function () {
+      var s = corrupt(function (s) { s.chunks[7].buf = Buffer.alloc(31, 1) })
+      ;(function () { NS.parse(s) }).should.throw(/payloadHash must be exactly 32/)
+    })
+
+    it('a leafCount that is not 4 bytes', function () {
+      var s = NS.build({ mode: NS.MODE.BATCH, merkleRoot: Buffer.alloc(32, 1), leafCount: 5 })
+      s.chunks[6].buf = Buffer.alloc(3, 0)
+      ;(function () { NS.parse(s) }).should.throw(/leafCount must be 4 bytes/)
+    })
+
+    it('too few pushes to be a record at all', function () {
+      ;(function () { NS.parse(new bsv.Script().add(Opcode.OP_FALSE).add(Opcode.OP_RETURN)) })
+        .should.throw(/too few pushes/)
+    })
+  })
+
+  describe('builder rejects', function () {
+    it('an unknown mode', function () {
+      ;(function () { NS.build(Object.assign({}, FULL, { mode: 5 })) }).should.throw(/mode must be/)
+    })
+
+    it('hex where raw bytes belong', function () {
+      ;(function () {
+        NS.build(Object.assign({}, FULL, { payloadHash: FULL.payloadHash.toString('hex') }))
+      }).should.throw(/must be a Buffer/)
+    })
+
+    it('a payloadHash of the wrong length', function () {
+      ;(function () {
+        NS.build(Object.assign({}, FULL, { payloadHash: Buffer.alloc(31) }))
+      }).should.throw(/exactly 32 bytes/)
+    })
+
+    it('a non-integer leafCount', function () {
+      ;(function () {
+        NS.build({ mode: NS.MODE.BATCH, merkleRoot: Buffer.alloc(32), leafCount: 1.5 })
+      }).should.throw(/leafCount/)
+    })
+  })
+
+  // A builder that minimally encodes its pushes represents u8(1) as OP_1. Those records
+  // are conformant, and rejecting them would be an interop failure rather than a safety
+  // measure — the mode byte is a routing hint, and every field that matters is checked
+  // on its own terms.
+  describe('interop with minimally-encoded pushes', function () {
+    it('reads OP_1 / OP_0 as the version and mode bytes', function () {
+      var s = NS.build(FULL)
+      s.chunks[3] = { opcodenum: Opcode.OP_1 }
+      s.chunks[4] = { opcodenum: Opcode.OP_0 }
+      var p = NS.parse(s)
+      p.version.should.equal(1)
+      p.mode.should.equal(NS.MODE.FULL)
+    })
+
+    it('reads OP_2 as batch mode', function () {
+      var s = NS.build({ mode: NS.MODE.BATCH, merkleRoot: Buffer.alloc(32, 3), leafCount: 2 })
+      s.chunks[4] = { opcodenum: Opcode.OP_2 }
+      NS.parse(s).mode.should.equal(NS.MODE.BATCH)
+    })
+  })
+
+  describe('isNotaryHash', function () {
+    it('accepts a record of each mode', function () {
+      NS.isNotaryHash(NS.build(FULL)).should.equal(true)
+      NS.isNotaryHash(NS.build(Object.assign({}, FULL, { mode: NS.MODE.HYBRID }))).should.equal(true)
+      NS.isNotaryHash(NS.build({ mode: NS.MODE.BATCH, merkleRoot: Buffer.alloc(32), leafCount: 0 }))
+        .should.equal(true)
+    })
+
+    it('rejects an unrelated output without throwing', function () {
+      NS.isNotaryHash(bsv.Script.buildPublicKeyHashOut(bsv.PrivateKey.fromRandom().toAddress()))
+        .should.equal(false)
+      NS.isNotaryHash('not-hex-at-all').should.equal(false)
+    })
+
+    // It is a scanning filter, not a validator. Saying so in a test stops it being used
+    // as one.
+    it('is only a filter — a truncated record still passes it but fails parse()', function () {
+      var s = NS.build(FULL)
+      s.chunks = s.chunks.slice(0, 6)
+      NS.isNotaryHash(s).should.equal(true)
+      ;(function () { NS.parse(s) }).should.throw()
+    })
+  })
+})

package/test/notaryhash/verify.js

@@ -0,0 +1,339 @@
+'use strict'
+
+/* global describe, it, before */
+
+// BRC-220 verification: the three checks the spec requires, wired together.
+//
+// The plan's stance is that each check must have a test that defeats it IN ISOLATION —
+// a suite where only the conjunction is tested cannot tell you that check 3 was never
+// wired up, because checks 1 and 2 carry the verdict. Each of the three below is broken
+// on its own with the others left intact.
+
+require('chai').should()
+var bsv = require('../..')
+var NH = require('../../lib/notaryhash')
+var Encoding = require('../../lib/notaryhash/encoding')
+var Hash = require('../../lib/crypto/hash')
+var BN = require('../../lib/crypto/bn')
+
+// The Bitcoin genesis coinbase — one of the reference vectors the spec names, and the
+// only check here that is external to this implementation.
+var GENESIS_COINBASE_RAWTX =
+  '01000000010000000000000000000000000000000000000000000000000000000000000000ffffffff' +
+  '4d04ffff001d0104455468652054696d65732030332f4a616e2f32303039204368616e63656c6c6f72' +
+  '206f6e206272696e6b206f66207365636f6e64206261696c6f757420666f722062616e6b73ffffffff' +
+  '0100f2052a01000000434104678afdb0fe5548271967f1a67130b7105cd6a828e03909a67962e0ea1f' +
+  '61deb649f6bc3f4cef38c4f35504e51ec112de5c384df7ba0b8d578a4c702b6bf11d5fac00000000'
+var GENESIS_COINBASE_TXID = '4a5e1e4baab89f3a32518a88c31bc87f618f76673e2cc77ab2127b7afdeda33b'
+
+function rawSig (sig) {
+  return Buffer.concat([
+    sig.r.toArrayLike(Buffer, 'be', 32),
+    sig.s.toArrayLike(Buffer, 'be', 32)
+  ])
+}
+
+describe('BRC-220 verification', function () {
+  var key, publicKey, payloadHash, signature, certificate, header, rawTx
+
+  before(function () {
+    key = bsv.PrivateKey.fromRandom()
+    publicKey = key.toPublicKey().toBuffer()
+    payloadHash = Hash.sha256(Buffer.from('the document nobody sees'))
+
+    // The signer signs the 32-byte payloadHash DIRECTLY — spec §Algorithms.
+    var ecdsa = bsv.crypto.ECDSA().set({ hashbuf: payloadHash, endian: 'little', privkey: key })
+    ecdsa.sign()
+    signature = rawSig(ecdsa.sig)
+
+    var createdAt = '2026-08-16T00:00:00.000Z'
+    var proofHash = Encoding.proofHash({
+      algorithm: 'ECDSA-secp256k1',
+      hashAlgorithm: 'SHA-256',
+      payloadHash: payloadHash,
+      publicKey: publicKey,
+      signature: signature,
+      createdAtUnix: Encoding.toUnixSeconds(createdAt)
+    })
+
+    // A real transaction carrying the record, so the anchor check has something to read.
+    var tx = new bsv.Transaction()
+    tx.addOutput(new bsv.Transaction.Output({
+      script: NH.Script.build({
+        mode: NH.MODE.FULL,
+        algorithm: 'ECDSA-secp256k1',
+        hashAlgorithm: 'SHA-256',
+        payloadHash: payloadHash,
+        proofHash: proofHash,
+        publicKey: publicKey,
+        signature: signature
+      }),
+      satoshis: 0
+    }))
+    rawTx = tx.toString()
+    var txid = NH.txidFromRawTx(rawTx)
+
+    // A single-transaction block: the Merkle root is the txid itself, so an empty path
+    // folds to it. Proof of work is not required for these fixtures.
+    header = new bsv.BlockHeader({
+      version: 1,
+      prevHash: Buffer.alloc(32),
+      merkleRoot: Buffer.from(txid, 'hex').reverse(),
+      time: 1786838400,
+      bits: 0x1d00ffff,
+      nonce: 0
+    })
+
+    certificate = NH.Certificate.attachSPV(
+      NH.Certificate.build({
+        mode: NH.MODE.FULL,
+        algorithm: 'ECDSA-secp256k1',
+        hashAlgorithm: 'SHA-256',
+        payloadHash: payloadHash,
+        publicKey: publicKey,
+        signature: signature,
+        createdAt: createdAt,
+        anchor: { txid: txid, blockHeight: 800000 }
+      }),
+      { rawTx: rawTx, blockHash: header.id, blockHeight: 800000, merkleProof: { index: 0, nodes: [] } }
+    )
+  })
+
+  var OPTS = function () { return { header: header, requirePow: false } }
+
+  describe('the happy path', function () {
+    it('passes all three checks', function () {
+      var report = NH.verify(certificate, OPTS())
+      report.signature.should.equal(true)
+      report.proofIntegrity.should.equal(true)
+      report.anchor.should.equal(true, JSON.stringify(report.errors))
+      report.valid.should.equal(true)
+    })
+
+    it('isValid returns a strict boolean', function () {
+      NH.isValid(certificate, OPTS()).should.equal(true)
+      NH.isValid(certificate, OPTS()).should.be.a('boolean')
+    })
+  })
+
+  // Each check defeated on its own, with the other two left working.
+  describe('check 1 — signature, defeated in isolation', function () {
+    it('fails when the signature is forged, while proof integrity still passes', function () {
+      var forged = Object.assign({}, certificate, { signature: 'aa'.repeat(64) })
+      var report = NH.verify(forged, OPTS())
+      report.signature.should.equal(false)
+      report.valid.should.equal(false)
+    })
+
+    it('fails when the certificate names a key that did not sign', function () {
+      var other = bsv.PrivateKey.fromRandom().toPublicKey().toBuffer()
+      var swapped = Object.assign({}, certificate, { publicKey: other.toString('hex') })
+      NH.verify(swapped, OPTS()).signature.should.equal(false)
+    })
+
+    // An unregistered algorithm must FAIL, never fall through to a default. Falling
+    // through to ECDSA for an ML-DSA certificate would be catastrophic.
+    it('fails for an algorithm no suite is registered for', function () {
+      var pq = Object.assign({}, certificate, { algorithm: 'ML-DSA-65' })
+      NH.verifySignature(pq).should.equal(false)
+      NH.Suites.verify('ML-DSA-65', Buffer.alloc(32), Buffer.alloc(64), Buffer.alloc(33))
+        .should.equal(false)
+    })
+  })
+
+  describe('check 2 — proof integrity, defeated in isolation', function () {
+    // The signature still verifies here: payloadHash, signature and publicKey are
+    // untouched. Only proofHash is a lie, and only check 2 can see it.
+    it('fails when proofHash is replaced, while the signature still verifies', function () {
+      var lying = Object.assign({}, certificate, { proofHash: '00'.repeat(32) })
+      var report = NH.verify(lying, OPTS())
+      report.signature.should.equal(true)
+      report.proofIntegrity.should.equal(false)
+      report.valid.should.equal(false)
+    })
+
+    it('fails when createdAt is moved after issuance', function () {
+      var moved = Object.assign({}, certificate, { createdAt: '2026-08-17T00:00:00.000Z' })
+      NH.verify(moved, OPTS()).proofIntegrity.should.equal(false)
+    })
+  })
+
+  describe('check 3 — anchor, defeated in isolation', function () {
+    // Signature and proof integrity both still pass; only the anchor is wrong.
+    it('fails when rawTx does not hash to anchor.txid', function () {
+      var wrongTxid = Object.assign({}, certificate, {
+        anchor: { txid: 'ff'.repeat(32), blockHeight: 800000 }
+      })
+      var report = NH.verify(wrongTxid, OPTS())
+      report.signature.should.equal(true)
+      report.proofIntegrity.should.equal(true)
+      report.anchor.should.equal(false)
+      report.errors.should.include('rawTx does not hash to anchor.txid')
+    })
+
+    it('fails when the merkle proof does not fold to the header root', function () {
+      var otherHeader = new bsv.BlockHeader({
+        version: 1,
+        prevHash: Buffer.alloc(32),
+        merkleRoot: Buffer.alloc(32, 0x77),
+        time: 1786838400,
+        bits: 0x1d00ffff,
+        nonce: 0
+      })
+      NH.verifyAnchorSPV(certificate, { header: otherHeader, requirePow: false })
+        .valid.should.equal(false)
+    })
+
+    it('fails when the transaction carries no NotaryHash record', function () {
+      var empty = new bsv.Transaction()
+      empty.addOutput(new bsv.Transaction.Output({
+        script: bsv.Script.buildDataOut('nothing to see'), satoshis: 0
+      }))
+      var swapped = Object.assign({}, certificate, {
+        spv: Object.assign({}, certificate.spv, { rawTx: empty.toString() })
+      })
+      NH.verifyAnchorSPV(swapped, OPTS()).errors.join(' ').should.match(/no NotaryHash record|does not hash/)
+    })
+
+    // THE anchor check. The certificate is internally perfect and the transaction is
+    // real; it simply is not the transaction this certificate describes.
+    it('fails when the on-chain record describes a different payload', function () {
+      var otherPayload = Hash.sha256(Buffer.from('a different document'))
+      var tx = new bsv.Transaction()
+      tx.addOutput(new bsv.Transaction.Output({
+        script: NH.Script.build({
+          mode: NH.MODE.FULL,
+          algorithm: 'ECDSA-secp256k1',
+          hashAlgorithm: 'SHA-256',
+          payloadHash: otherPayload,
+          proofHash: Buffer.alloc(32, 0x01),
+          publicKey: Buffer.from(certificate.publicKey, 'hex'),
+          signature: Buffer.from(certificate.signature, 'hex')
+        }),
+        satoshis: 0
+      }))
+      var raw = tx.toString()
+      var txid = NH.txidFromRawTx(raw)
+      var h = new bsv.BlockHeader({
+        version: 1,
+        prevHash: Buffer.alloc(32),
+        merkleRoot: Buffer.from(txid, 'hex').reverse(),
+        time: 1786838400,
+        bits: 0x1d00ffff,
+        nonce: 0
+      })
+      var mismatched = Object.assign({}, certificate, {
+        anchor: { txid: txid, blockHeight: 800000 },
+        spv: Object.assign({}, certificate.spv, { rawTx: raw })
+      })
+      var report = NH.verifyAnchorSPV(mismatched, { header: h, requirePow: false })
+      report.valid.should.equal(false)
+      report.errors.should.include('on-chain record does not match the certificate')
+    })
+
+    // Not supplying a header is not a pass. This is the trust the spec exists to remove.
+    it('refuses to pass without a block header', function () {
+      var report = NH.verifyAnchorSPV(certificate, {})
+      report.valid.should.equal(false)
+      report.errors.join(' ').should.match(/block header is required/)
+    })
+
+    it('reports a missing SPV envelope rather than ignoring the anchor', function () {
+      var noSpv = Object.assign({}, certificate)
+      delete noSpv.spv
+      NH.verifyAnchorSPV(noSpv, OPTS()).errors.should.include('certificate has no SPV envelope')
+    })
+  })
+
+  describe('reporting', function () {
+    it('names which check failed rather than saying only "invalid"', function () {
+      var forged = Object.assign({}, certificate, { signature: 'aa'.repeat(64) })
+      NH.verify(forged, OPTS()).errors.should.include('signature does not verify')
+    })
+
+    it('reports shape problems before attempting the checks', function () {
+      var report = NH.verify({ protocol: 'NotaryHash' }, OPTS())
+      report.shape.length.should.be.above(0)
+      report.signature.should.equal(false)
+      report.valid.should.equal(false)
+    })
+
+    // skipAnchor is for offline triage and must never report a valid certificate.
+    it('never reports valid when the anchor was skipped', function () {
+      var report = NH.verify(certificate, { skipAnchor: true })
+      report.signature.should.equal(true)
+      report.proofIntegrity.should.equal(true)
+      report.valid.should.equal(false)
+      report.errors.join(' ').should.match(/NOT verified/)
+    })
+  })
+
+  describe('txidFromRawTx', function () {
+    // External check: the spec names this reference vector, and it is the one assertion
+    // here that does not depend on our own construction being right.
+    it('matches the Bitcoin genesis coinbase transaction', function () {
+      NH.txidFromRawTx(GENESIS_COINBASE_RAWTX).should.equal(GENESIS_COINBASE_TXID)
+    })
+
+    it('accepts a Buffer as well as hex', function () {
+      NH.txidFromRawTx(Buffer.from(GENESIS_COINBASE_RAWTX, 'hex')).should.equal(GENESIS_COINBASE_TXID)
+    })
+  })
+
+  describe('suite registry', function () {
+    it('registers a caller-supplied suite and uses it', function () {
+      var called = false
+      NH.registerSuite('TEST-SUITE', {
+        verify: function () { called = true; return true }
+      })
+      NH.Suites.verify('TEST-SUITE', Buffer.alloc(32), Buffer.alloc(8), Buffer.alloc(8))
+        .should.equal(true)
+      called.should.equal(true)
+      NH.Suites.unregister('TEST-SUITE')
+    })
+
+    // A suite returning a truthy object must not smuggle a pass through — that is the
+    // defect class this codebase has fixed most often.
+    it('coerces a truthy non-boolean suite result to false', function () {
+      NH.registerSuite('TRUTHY-SUITE', { verify: function () { return { ok: true } } })
+      NH.Suites.verify('TRUTHY-SUITE', Buffer.alloc(32), Buffer.alloc(8), Buffer.alloc(8))
+        .should.equal(false)
+      NH.Suites.unregister('TRUTHY-SUITE')
+    })
+
+    it('survives a throwing suite without reporting a pass', function () {
+      NH.registerSuite('THROWS', { verify: function () { throw new Error('boom') } })
+      NH.Suites.verify('THROWS', Buffer.alloc(32), Buffer.alloc(8), Buffer.alloc(8))
+        .should.equal(false)
+      NH.Suites.unregister('THROWS')
+    })
+
+    it('ships only ECDSA-secp256k1 by default', function () {
+      NH.Suites.list().should.deep.equal(['ECDSA-secp256k1'])
+    })
+  })
+
+  describe('ECDSA suite specifics', function () {
+    it('requires low-S, rejecting the malleated form', function () {
+      var sig = bsv.crypto.Signature.fromDER(
+        new bsv.crypto.Signature(
+          BN.fromBuffer(Buffer.from(certificate.signature, 'hex').slice(0, 32)),
+          BN.fromBuffer(Buffer.from(certificate.signature, 'hex').slice(32))
+        ).toDER()
+      )
+      var high = Buffer.concat([
+        sig.r.toArrayLike(Buffer, 'be', 32),
+        bsv.crypto.Point.getN().sub(sig.s).toArrayLike(Buffer, 'be', 32)
+      ])
+      NH.Suites.verify('ECDSA-secp256k1', payloadHash, high, publicKey).should.equal(false)
+    })
+
+    it('accepts DER for the legacy encoding', function () {
+      var raw = Buffer.from(certificate.signature, 'hex')
+      var der = new bsv.crypto.Signature(
+        BN.fromBuffer(raw.slice(0, 32)), BN.fromBuffer(raw.slice(32))
+      ).toDER()
+      NH.Suites.verify('ECDSA-secp256k1', payloadHash, der, publicKey).should.equal(true)
+    })
+  })
+})

package/version.js

@@ -1,3 +1,3 @@
 'use strict'
 // GENERATED by scripts/sync-version.js on `npm version` — do not edit.
-module.exports = '8.2.0'
+module.exports = '8.3.0'