@smartledger/bsv 8.3.1 → 9.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (40) hide show
  1. package/CHANGELOG.md +91 -0
  2. package/README.md +74 -64
  3. package/bsv-gdaf.min.js +49 -49
  4. package/bsv-script-helper.min.js +1 -1
  5. package/bsv-smartcontract.min.js +21 -21
  6. package/bsv.bundle.js +49 -49
  7. package/bsv.d.ts +0 -4
  8. package/bsv.min.js +49 -49
  9. package/docs/BRC220_BATCH_LEAF_AMENDMENT.md +82 -7
  10. package/docs/MODULE_REFERENCE_COMPLETE.md +27 -27
  11. package/docs/README.md +2 -1
  12. package/docs/THREAT_MODEL.md +10 -2
  13. package/docs/advanced/UTXO_MANAGER_GUIDE.md +1 -1
  14. package/docs/getting-started/INSTALLATION.md +23 -23
  15. package/docs/getting-started/QUICK_START.md +7 -7
  16. package/docs/migration/FROM_BSV_1_5_6.md +5 -5
  17. package/index.js +10 -26
  18. package/lib/covenant/helpers.js +34 -35
  19. package/lib/covenant/pushtx.js +2 -2
  20. package/lib/custom-script-helper.js +0 -16
  21. package/lib/ordinals/ordlock.js +1 -1
  22. package/lib/smart_contract/debugger.js +2 -2
  23. package/lib/smart_contract/dsl.js +2 -2
  24. package/lib/smart_contract/index.js +0 -3
  25. package/lib/smart_contract/locks.js +1 -41
  26. package/lib/smart_contract/pels.js +1 -1
  27. package/lib/smart_contract/token.js +1 -1
  28. package/package.json +1 -1
  29. package/test/build/esm_wrapper.js +32 -8
  30. package/test/data/brc220-batch-vector.json +129 -0
  31. package/test/notaryhash/batch_vector.js +282 -0
  32. package/test/ordinals/inscription.js +24 -14
  33. package/test/ordinals/ordlock.js +0 -46
  34. package/test/smart_contract/covenants.js +0 -38
  35. package/test/smart_contract/dsl_debugger.js +0 -9
  36. package/test/smart_contract/ordinal_transfer.js +0 -10
  37. package/test/smart_contract/sighash_marketplace.js +0 -10
  38. package/test/smart_contract/token_generalized.js +0 -10
  39. package/tools/gen-brc220-batch-vector.js +205 -0
  40. package/version.js +1 -1
package/CHANGELOG.md CHANGED
@@ -7,6 +7,97 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
7
7
 
8
8
  ## [Unreleased]
9
9
 
10
+ ## [9.0.0] - 2026-08-21
11
+
12
+ ### BREAKING — removed APIs that enforced nothing
13
+
14
+ Everything here either did not work on mainnet or had been promised for removal and
15
+ kept shipping. None of it is replaced, because in each case the honest replacement is
16
+ "do not do this".
17
+
18
+ | Removed | Why |
19
+ | --- | --- |
20
+ | `SmartContract.enableGenesis()` | A workaround for the flags bug below. With the era flags present there is nothing for it to do, and what it did — mutating process-wide limit statics — turned 15 of the node's 22 `SCRIPTNUM_OVERFLOW` vectors into false accepts. `Interpreter.useGenesisLimits()` is untouched for callers who really want it. |
21
+ | `SmartContract.Locks.timeLockCLTV` | Built on `OP_CHECKLOCKTIMEVERIFY`, which Genesis reverted to an upgradable NOP. Enforced nothing on mainnet — the coins were spendable immediately. |
22
+ | `SmartContract.Locks.htlc` | Its timeout branch is the same NOP. An HTLC whose timeout does not bind is a hash-lock, which `Locks.hashLock` already provides. |
23
+ | `CustomScriptHelper.createTimelockScript` | Same NOP, third copy. |
24
+ | `bsv.SmartUTXO` (namespace export) | A development-only file-backed simulator on the production namespace. Soft-deprecated in 4.0.1 promising removal in 6.0.0, then shipped through 6.x, 7.x and 8.x still warning. The module is unchanged and still available as `require('@smartledger/bsv/lib/smartutxo')` — what the warning always said to do. |
25
+
26
+ There is now **no time-lock primitive in this library**. That is deliberate: a lock
27
+ that does not lock has no safe use, and the previous versions passed their own tests
28
+ only because the covenant harness verified them under pre-Genesis flags.
29
+
30
+ `SmartContract.Covenant` and `SmartContract.Builder` are **kept**. They are also
31
+ non-enforcing, but they already fail closed — their script-producing methods throw
32
+ unless you pass `allowNonEnforcing: true` — so they cannot silently hand back a script
33
+ that does not do what it looks like.
34
+
35
+ ### Fixed — covenants were verified under pre-Genesis rules
36
+
37
+ `lib/covenant/helpers.js` assembled its verification flags by hand, and the list
38
+ omitted the three **UTXO-era** flags: `SCRIPT_GENESIS`, `SCRIPT_UTXO_AFTER_GENESIS`
39
+ and `SCRIPT_UTXO_AFTER_CHRONICLE`. It did carry `SCRIPT_ENABLE_CHRONICLE`, which
40
+ enables the string opcodes, so the omission was easy to miss — the opcodes ran, and
41
+ only the *limits* were wrong.
42
+
43
+ The interpreter derives its data limits from those era flags. Without them every
44
+ covenant was verified under rules BSV replaced at Genesis in February 2020:
45
+
46
+ | | before | after |
47
+ | --- | ---: | ---: |
48
+ | max stack element | 520 bytes | unbounded |
49
+ | max script size | 10,000 bytes | unbounded |
50
+
51
+ An OP_PUSH_TX preimage is ~585 bytes, so this library's flagship feature could not
52
+ verify against its own harness — it failed with `SCRIPT_ERR_PUSH_SIZE`.
53
+
54
+ `flags()` now delegates to `Interpreter.mainnetFlags()`, the same function a no-flags
55
+ `verify()` uses. Local verification and network behaviour can no longer drift apart
56
+ without both moving together. `SCRIPT_VERIFY_NULLFAIL` is gained (stricter).
57
+
58
+ ### Removed — `SmartContract.enableGenesis()`
59
+
60
+ Now a **deprecated no-op**; the symbol survives one major and goes away in 9.0.0.
61
+
62
+ It existed to paper over the missing era flags by raising the interpreter's
63
+ process-wide limit statics. That was treating the symptom: raising the statics cannot
64
+ enable post-Genesis arithmetic — only the era flags can — and it *weakens* pre-Genesis
65
+ validation, turning 15 of the reference node's 22 `SCRIPTNUM_OVERFLOW` vectors into
66
+ false accepts. With the flags fixed there is nothing for it to do.
67
+
68
+ It is a no-op rather than a passthrough deliberately: restoring the old behaviour as a
69
+ courtesy to existing call sites would reintroduce the defect this release removes.
70
+ `Interpreter.useGenesisLimits()` is untouched for callers who really do want to move
71
+ the statics.
72
+
73
+ **Action:** delete the call. Covenants now verify with no opt-in.
74
+
75
+ ### Disclosed — CLTV time locks do not bind on mainnet
76
+
77
+ Fixing the flags surfaced this. Genesis reverted `OP_CHECKLOCKTIMEVERIFY` to an
78
+ upgradable NOP for outputs created after it, so **`Locks.timeLockCLTV` and the timeout
79
+ branch of `Locks.htlc` enforce nothing on current BSV mainnet** — the coins are
80
+ spendable immediately by the key holder.
81
+
82
+ This was invisible because the covenant harness verified under flags missing the era
83
+ bits. The library's own tests asserted that an early spend was rejected, and passed,
84
+ while the network would have accepted it. That is the failure mode `docs/THREAT_MODEL.md`
85
+ §1 is written around, found in our own code.
86
+
87
+ Both behaviours are now pinned in `test/smart_contract/covenants.js`: the lock does not
88
+ bind under mainnet flags, and still binds under explicitly pre-Genesis flags — so the
89
+ opcode is implemented correctly and the issue is purely which era we verify under. The
90
+ JSDoc on both functions carries the warning, as does the README and the threat model.
91
+
92
+ The functions are kept, not deleted: they remain correct for pre-Genesis outputs and
93
+ useful for interop. **Do not use them to time-lock value on mainnet.**
94
+
95
+ ### Documentation
96
+
97
+ - README: the multisig example destructured `{ CustomScriptHelper }`, which is
98
+ `undefined` — the module exports the class itself and every method is static. The
99
+ `check:readme` gate did not catch it because it only resolves `bsv.*` symbols.
100
+
10
101
  ## [8.3.1] - 2026-08-20
11
102
 
12
103
  ### Fixed — BRC-220 signature verification was not interoperable
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  **🚀 Complete Bitcoin SV Development Framework with W3C Verifiable Credentials, DID:web, Legal Compliance, and 16 Flexible Loading Options**
4
4
 
5
- [![Version](https://img.shields.io/badge/version-8.3.1-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
5
+ [![Version](https://img.shields.io/badge/version-9.0.0-blue.svg)](https://www.npmjs.com/package/@smartledger/bsv)
6
6
  [![License](https://img.shields.io/badge/license-MIT-green.svg)](LICENSE)
7
7
  [![BSV](https://img.shields.io/badge/BSV-Compatible-orange.svg)](https://bitcoinsv.com/)
8
8
  [![Modular](https://img.shields.io/badge/Loading-Modular-purple.svg)](#-16-loading-options---choose-your-approach)
@@ -37,9 +37,6 @@ through `Script.Interpreter`. Every locking script has both a positive
37
37
  ```javascript
38
38
  const bsv = require('@smartledger/bsv')
39
39
  const SC = bsv.SmartContract
40
- SC.enableGenesis() // OP_PUSH_TX needs the lifted element cap — but note this is
41
- // process-wide and weakens pre-Genesis validation. See
42
- // "Consensus defaults" below before calling it in an app.
43
40
 
44
41
  // Self-replicating covenant — every spend recreates the same script (value − fee).
45
42
  const lock = SC.perpetualCovenant(500)
@@ -64,12 +61,18 @@ const { ok, err } = SC.verifyScript(unlockScript, lockingScript, { tx, inputInde
64
61
  | `PELS` | Perpetually Enforcing Locking Scripts — `perpetualCovenant(fee)` |
65
62
  | `Token` | Stateful ownership token (NFT) — `ownershipToken(fee, owner[, auth])`, `ownershipTokenMulti(owner[, auth])`, `ownerId(key)`, `unlockTransfer(...)`, `unlockTransferMulti(...)` |
66
63
  | `Authorizers` | Pluggable token ownership — `singleKey()`, `multisig(m, n)`, `predicate({...})` |
67
- | `Locks` | Hash-lock, P2PKH, CLTV time-lock, m-of-n multisig, HTLC |
64
+ | `Locks` | Hash-lock, P2PKH, m-of-n multisig. CLTV time-lock and HTLC were removed in 9.0.0 — see below |
68
65
  | `CovenantHelpers` | Consensus-flag `verify()` harness, raw BIP-143 preimage, signing, fund/spend scaffolding |
69
66
 
70
67
  > ⚠️ Research-grade. Review carefully before mainnet value: the OP_PUSH_TX key
71
68
  > is the intentionally public `a=k=1` construction, and low-S malleability is
72
69
  > left unenforced for the in-script signature.
70
+ >
71
+ > ℹ️ **CLTV-based time locks were removed in 9.0.0** (`Locks.timeLockCLTV`,
72
+ > `Locks.htlc`, `CustomScriptHelper.createTimelockScript`). Genesis reverted
73
+ > `OP_CHECKLOCKTIMEVERIFY` to an upgradable NOP for outputs created after it, so they
74
+ > enforced nothing on mainnet — the coins were spendable immediately. They appeared to
75
+ > work only because the harness verified under pre-Genesis flags.
73
76
 
74
77
  ## 🔏 NotaryHash (BRC-220)
75
78
 
@@ -282,42 +285,42 @@ console.log('Status:', status) // 'revoked'
282
285
  ### **Core Modules**
283
286
  | Module | Size | Use Case | CDN |
284
287
  |--------|------|----------|-----|
285
- | **bsv.min.js** | 1039KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@8.3.1/bsv.min.js` |
286
- | **bsv.bundle.js** | 1039KB | Everything in one file | `unpkg.com/@smartledger/bsv@8.3.1/bsv.bundle.js` |
288
+ | **bsv.min.js** | 1037KB | Core BSV + SmartContract | `unpkg.com/@smartledger/bsv@9.0.0/bsv.min.js` |
289
+ | **bsv.bundle.js** | 1037KB | Everything in one file | `unpkg.com/@smartledger/bsv@9.0.0/bsv.bundle.js` |
287
290
 
288
291
  ### **W3C Verifiable Credentials**
289
292
  | Module | Size | Use Case | CDN |
290
293
  |--------|------|----------|-----|
291
- | **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@8.3.1/bsv-didweb.min.js` |
292
- | **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@8.3.1/bsv-vcjwt.min.js` |
293
- | **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@8.3.1/bsv-statuslist.min.js` |
294
- | **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@8.3.1/bsv-anchor.min.js` |
294
+ | **🟢 bsv-didweb.min.js** | 166KB | **DID:web generation** | `unpkg.com/@smartledger/bsv@9.0.0/bsv-didweb.min.js` |
295
+ | **🟢 bsv-vcjwt.min.js** | 166KB | **VC-JWT issue/verify** | `unpkg.com/@smartledger/bsv@9.0.0/bsv-vcjwt.min.js` |
296
+ | **🟢 bsv-statuslist.min.js** | 256KB | **StatusList2021 revocation** | `unpkg.com/@smartledger/bsv@9.0.0/bsv-statuslist.min.js` |
297
+ | **🟢 bsv-anchor.min.js** | 164KB | **BSV anchoring (hash-only)** | `unpkg.com/@smartledger/bsv@9.0.0/bsv-anchor.min.js` |
295
298
 
296
299
  ### **Smart Contract & Development**
297
300
  | Module | Size | Use Case | CDN |
298
301
  |--------|------|----------|-----|
299
- | **bsv-smartcontract.min.js** | 140KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@8.3.1/bsv-smartcontract.min.js` |
300
- | **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@8.3.1/bsv-covenant.min.js` |
301
- | **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@8.3.1/bsv-script-helper.min.js` |
302
- | **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@8.3.1/bsv-security.min.js` |
302
+ | **bsv-smartcontract.min.js** | 138KB | Complete covenant framework | `unpkg.com/@smartledger/bsv@9.0.0/bsv-smartcontract.min.js` |
303
+ | **bsv-covenant.min.js** | 35KB | Covenant operations | `unpkg.com/@smartledger/bsv@9.0.0/bsv-covenant.min.js` |
304
+ | **bsv-script-helper.min.js** | 33KB | Custom script tools | `unpkg.com/@smartledger/bsv@9.0.0/bsv-script-helper.min.js` |
305
+ | **bsv-security.min.js** | 32KB | Security enhancements | `unpkg.com/@smartledger/bsv@9.0.0/bsv-security.min.js` |
303
306
 
304
307
  ### **Legal & Compliance**
305
308
  | Module | Size | Use Case | CDN |
306
309
  |--------|------|----------|-----|
307
- | **bsv-ltp.min.js** | 534KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@8.3.1/bsv-ltp.min.js` |
308
- | **bsv-gdaf.min.js** | 1039KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@8.3.1/bsv-gdaf.min.js` |
310
+ | **bsv-ltp.min.js** | 534KB | Legal Token Protocol | `unpkg.com/@smartledger/bsv@9.0.0/bsv-ltp.min.js` |
311
+ | **bsv-gdaf.min.js** | 1037KB | Digital Identity & Attestation | `unpkg.com/@smartledger/bsv@9.0.0/bsv-gdaf.min.js` |
309
312
 
310
313
  ### **Advanced Cryptography**
311
314
  | Module | Size | Use Case | CDN |
312
315
  |--------|------|----------|-----|
313
- | **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@8.3.1/bsv-shamir.min.js` |
316
+ | **bsv-shamir.min.js** | 177KB | Threshold Cryptography | `unpkg.com/@smartledger/bsv@9.0.0/bsv-shamir.min.js` |
314
317
 
315
318
  ### **Utilities**
316
319
  | Module | Size | Use Case | CDN |
317
320
  |--------|------|----------|-----|
318
- | **bsv-ecies.min.js** | 137KB | Encryption | `unpkg.com/@smartledger/bsv@8.3.1/bsv-ecies.min.js` |
319
- | **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@8.3.1/bsv-message.min.js` |
320
- | **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@8.3.1/bsv-mnemonic.min.js` |
321
+ | **bsv-ecies.min.js** | 137KB | Encryption | `unpkg.com/@smartledger/bsv@9.0.0/bsv-ecies.min.js` |
322
+ | **bsv-message.min.js** | 34KB | Message signing | `unpkg.com/@smartledger/bsv@9.0.0/bsv-message.min.js` |
323
+ | **bsv-mnemonic.min.js** | 320KB | HD wallets | `unpkg.com/@smartledger/bsv@9.0.0/bsv-mnemonic.min.js` |
321
324
 
322
325
  ## ⚡ **2-Minute Quick Start**
323
326
 
@@ -328,7 +331,7 @@ Get started with Bitcoin SV development in under 2 minutes:
328
331
  npm install @smartledger/bsv
329
332
 
330
333
  # Or include in HTML
331
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv.min.js"></script>
334
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv.min.js"></script>
332
335
  ```
333
336
 
334
337
  > **🔒 Upgrading?** 8.0.0 changed what `verify()` means with no flags, and moved
@@ -428,8 +431,8 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
428
431
 
429
432
  ### 🔧 **Basic Development** (~1.05MB total)
430
433
  ```html
431
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv.min.js"></script>
432
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv-script-helper.min.js"></script>
434
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv.min.js"></script>
435
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv-script-helper.min.js"></script>
433
436
  <script>
434
437
  const privateKey = new bsv.PrivateKey();
435
438
  const utxos = new bsv.SmartContract.UTXOGenerator().createRealUTXOs(2, 100000);
@@ -438,9 +441,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
438
441
 
439
442
  ### 🔒 **Smart Contract Development** (~1.2MB total — each bundle re-embeds core BSV)
440
443
  ```html
441
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv.min.js"></script>
442
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv-covenant.min.js"></script>
443
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv-smartcontract.min.js"></script>
444
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv.min.js"></script>
445
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv-covenant.min.js"></script>
446
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv-smartcontract.min.js"></script>
444
447
  <script>
445
448
  const covenant = bsv.SmartContract.createCovenantBuilder()
446
449
  .extractField('amount').push(50000).greaterThanOrEqual().verify().build();
@@ -450,9 +453,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
450
453
 
451
454
  ### 🆕 **Legal & Identity Development** (~2.55MB total — each bundle re-embeds core BSV)
452
455
  ```html
453
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv.min.js"></script>
454
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv-ltp.min.js"></script>
455
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv-gdaf.min.js"></script>
456
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv.min.js"></script>
457
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv-ltp.min.js"></script>
458
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv-gdaf.min.js"></script>
456
459
  <script>
457
460
  // Legal Token Protocol
458
461
  const result = bsv.LTP.createRightToken({
@@ -467,9 +470,9 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
467
470
 
468
471
  ### 🆕 **Security & Cryptography** (~1.22MB total)
469
472
  ```html
470
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv.min.js"></script>
471
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv-security.min.js"></script>
472
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv-shamir.min.js"></script>
473
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv.min.js"></script>
474
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv-security.min.js"></script>
475
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv-shamir.min.js"></script>
473
476
  <script>
474
477
  // Threshold Cryptography
475
478
  const shares = bsv.Shamir.split('my_secret_key', 3, 5); // 5 shares, any 3 recover
@@ -481,7 +484,7 @@ const covenant = bsv.SmartContract.createCovenantBuilder()
481
484
 
482
485
  ### 🎯 **Everything Bundle** (~1.02MB)
483
486
  ```html
484
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv.bundle.js"></script>
487
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv.bundle.js"></script>
485
488
  <script>
486
489
  // Everything available immediately
487
490
  const shares = bsv.Shamir.split('secret', 3, 5); // Shamir Secret Sharing
@@ -618,8 +621,8 @@ const { ok, err } = bsv.SmartContract.verifyScript(unlockScript, lock, { tx, sat
618
621
 
619
622
  #### 1. **Minimal Setup** - Core + Script Helper (~1.05MB)
620
623
  ```html
621
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv.min.js"></script>
622
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv-script-helper.min.js"></script>
624
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv.min.js"></script>
625
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv-script-helper.min.js"></script>
623
626
  <script>
624
627
  const tx = new bsv.Transaction();
625
628
  const sig = bsvScriptHelper.createSignature(tx, privateKey, 0, script, satoshis);
@@ -628,9 +631,9 @@ const { ok, err } = bsv.SmartContract.verifyScript(unlockScript, lock, { tx, sat
628
631
 
629
632
  #### 2. **DeFi Development** - Core + Covenants + Debug (~1.2MB — each bundle re-embeds core BSV)
630
633
  ```html
631
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv.min.js"></script>
632
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv-covenant.min.js"></script>
633
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv-smartcontract.min.js"></script>
634
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv.min.js"></script>
635
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv-covenant.min.js"></script>
636
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv-smartcontract.min.js"></script>
634
637
  <script>
635
638
  const lock = bsv.SmartContract.perpetualCovenant(500);
636
639
  const debugInfo = bsv.SmartContract.interpretScript(script);
@@ -640,8 +643,8 @@ const { ok, err } = bsv.SmartContract.verifyScript(unlockScript, lock, { tx, sat
640
643
 
641
644
  #### 3. **Security First** - Core + Enhanced Security (~1.05MB)
642
645
  ```html
643
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv.min.js"></script>
644
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv-security.min.js"></script>
646
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv.min.js"></script>
647
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv-security.min.js"></script>
645
648
  <script>
646
649
  const verified = bsvSecurity.SmartVerify.smartVerify(hash, signature, publicKey);
647
650
  const enhanced = bsvSecurity.EllipticFixed.sign(hash, privateKey);
@@ -650,7 +653,7 @@ const { ok, err } = bsv.SmartContract.verifyScript(unlockScript, lock, { tx, sat
650
653
 
651
654
  #### 4. **Everything Bundle** - One File Solution (~1.02MB)
652
655
  ```html
653
- <script src="https://unpkg.com/@smartledger/bsv@8.3.1/bsv.bundle.js"></script>
656
+ <script src="https://unpkg.com/@smartledger/bsv@9.0.0/bsv.bundle.js"></script>
654
657
  <script>
655
658
  // Everything available under the bsv namespace
656
659
  const key = bsv.PrivateKey.fromRandom();
@@ -833,7 +836,6 @@ console.log('Valid structure:', preimage.isValid); // Boolean validation
833
836
  ```javascript
834
837
  const bsv = require('@smartledger/bsv')
835
838
  const SC = bsv.SmartContract
836
- SC.enableGenesis() // OP_PUSH_TX needs post-Genesis limits
837
839
 
838
840
  // Bare OP_PUSH_TX authenticator: unlocks only with the (grindable) preimage of
839
841
  // THIS transaction. Built from the nChain `a=k=1` public-key construction —
@@ -925,36 +927,44 @@ const interp = new bsv.Script.Interpreter();
925
927
  const ok = interp.verify(unlockScript, lockScript, tx, 0, undefined, satoshisBN);
926
928
  ```
927
929
 
928
- > ⚠️ **`Interpreter.useGenesisLimits()` is legacy and should not be used to enable
929
- > covenants.** It cannot enable post-Genesis arithmetic — that comes from the era
930
- > flags — and because it mutates process-wide statics it *weakens* pre-Genesis
930
+ > ⚠️ **You no longer need to opt in to anything.** Since 8.4.0 the covenant harness
931
+ > verifies under `Interpreter.mainnetFlags()`, whose era bits lift the pre-Genesis
932
+ > element, opcode and script-size caps. `SmartContract.enableGenesis()` was removed in
933
+ > 9.0.0 and can be deleted from your code.
934
+ >
935
+ > **`Interpreter.useGenesisLimits()` remains available but should not be used to
936
+ > enable covenants.** It cannot enable post-Genesis arithmetic — that comes from the
937
+ > era flags — and because it mutates process-wide statics it *weakens* pre-Genesis
931
938
  > validation: raising `MAXIMUM_ELEMENT_SIZE` turns 15 of the reference node's 22
932
- > `SCRIPTNUM_OVERFLOW` vectors into false accepts. If you must call it, capture
933
- > and restore the caps around it with `Interpreter.getLimits()` /
934
- > `Interpreter.setLimits()`.
939
+ > `SCRIPTNUM_OVERFLOW` vectors into false accepts. If you must call it, capture and
940
+ > restore the caps with `Interpreter.getLimits()` / `Interpreter.setLimits()`.
935
941
 
936
942
  ## 🛠️ Custom Scripts
937
943
 
938
944
  ### Multi-signature Scripts
939
945
  ```javascript
940
- const { CustomScriptHelper } = require('@smartledger/bsv/lib/custom-script-helper');
941
- const helper = new CustomScriptHelper();
946
+ // The module exports the class itself, and every method is STATIC — do not
947
+ // destructure a named export and do not instantiate.
948
+ const CustomScriptHelper = require('@smartledger/bsv/lib/custom-script-helper');
942
949
 
943
- // Create 2-of-3 multisig script
944
- const multisigScript = helper.createMultisigScript([
950
+ // Create 2-of-3 multisig script — signature is (m, publicKeys)
951
+ const multisigScript = CustomScriptHelper.createMultisigScript(2, [
945
952
  publicKey1, publicKey2, publicKey3
946
- ], 2);
953
+ ]);
947
954
  ```
948
955
 
949
956
  ### Timelock Contracts
950
- ```javascript
951
- // Create timelock script (block height)
952
- const timelockScript = helper.createTimelockScript(
953
- publicKey,
954
- 750000, // block height
955
- 'block'
956
- );
957
- ```
957
+
958
+ **Not supported.** `CustomScriptHelper.createTimelockScript`, `Locks.timeLockCLTV` and
959
+ `Locks.htlc` were removed in 9.0.0. All three were built on
960
+ `OP_CHECKLOCKTIMEVERIFY`, which Genesis reverted to an upgradable NOP for outputs
961
+ created after it — so on current BSV mainnet they enforced nothing and the coins were
962
+ spendable immediately by the key holder.
963
+
964
+ They looked correct because this library's covenant harness verified them under
965
+ pre-Genesis flags; that was fixed in the same release. If you need time-based
966
+ conditions on BSV, enforce them off-chain or with `nLockTime` at the transaction
967
+ level, and be aware that neither is equivalent to a script-enforced lock.
958
968
 
959
969
  ## 📁 Examples
960
970
 
@@ -972,7 +982,7 @@ const timelockScript = helper.createTimelockScript(
972
982
 
973
983
  See the **[16 Loading Options](#-16-loading-options---choose-your-approach)**
974
984
  table near the top for the full list of bundles with current sizes and
975
- canonical `unpkg.com/@smartledger/bsv@8.3.1/...` URLs.
985
+ canonical `unpkg.com/@smartledger/bsv@9.0.0/...` URLs.
976
986
 
977
987
  ## 🔐 Security
978
988
 
@@ -1117,6 +1127,6 @@ For security vulnerabilities, follow the disclosure process in
1117
1127
 
1118
1128
  ---
1119
1129
 
1120
- **SmartLedger-BSV v8.3.1** — *Complete Bitcoin SV Development Framework*
1130
+ **SmartLedger-BSV v9.0.0** — *Complete Bitcoin SV Development Framework*
1121
1131
 
1122
1132
  Built with ❤️ for the Bitcoin SV ecosystem • 16 Loading Options • Interpreter-Verified Covenants